release: 0.140.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.139.0"
+  ".": "0.140.0"
 }

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.140.0](https://github.com/kernel/kernel-python-sdk/compare/v0.139.0...v0.140.0) (2026-11-04)
+
+
+### Features
+
+* Add single-use Kernel cards to vaults ([c11d264](https://github.com/kernel/kernel-python-sdk/commit/c11d2644383af967ddcb8b892b325ea4421eb956))
+* Drop Kernel's origin gate from 1Password fill ([e5454cb](https://github.com/kernel/kernel-python-sdk/commit/e5454cb02a33599e81ec5ca3c764e2522ad2cd76))
+* Let customers keep refreshing imported Link wallet grants ([f67de9c](https://github.com/kernel/kernel-python-sdk/commit/f67de9c930a43bc3f1b8db04a93bf13831b7d8cb))
+* Pass through tool_page_unloaded and disable SDK retries for WebMCP invoke failures ([56c9983](https://github.com/kernel/kernel-python-sdk/commit/56c998338b3f885d4d8276e5d038d9612bf0d1fd))
+
 ## [0.139.0](https://github.com/kernel/kernel-python-sdk/compare/v0.138.0...v0.139.0) (2026-10-30)
 
 

api.md

@@ -608,6 +608,7 @@ from kernel.types.vaults import (
     KernelCredentialVaultItemSpecInput,
     KernelCredentialVaultItemState,
     KernelPaymentRequestVaultItemSpec,
+    KernelSingleUseCard,
     KernelWalletState,
     KernelWalletVaultItemSpec,
     LinkShippingAddress,
@@ -639,6 +640,7 @@ from kernel.types.vaults import (
     ShopPayCardVaultItemSpec,
     ShopPayWalletState,
     ShopPayWalletVaultItemSpec,
+    SingleUseCardBillingAddress,
     VaultCardAliases,
     VaultCardFillField,
     VaultCheckoutContext,

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.139.0"
+version = "0.140.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.139.0"  # x-release-please-version
+__version__ = "0.140.0"  # x-release-please-version

src/kernel/resources/browsers/webmcp/webmcp.py

@@ -82,12 +82,16 @@ def invoke_tool(
         across navigation. Inspect a populated form, obtain any required confirmation,
         then submit through Playwright or computer interaction without invoking the tool
         again. If the tab or embedded frame disappears, or the request times out after
-        invocation begins, the response reports outcome_unknown and the tool is not
-        retried. CDP-backed custom tool outputs above 240 KiB return an error rather
-        than a truncated result.
+        invocation begins, the response reports outcome_unknown. If the tool's page is
+        reloaded or replaced by a navigation the tool did not start, and the tool never
+        responds, the response reports tool_page_unloaded once the replacement page
+        loads, or right away if the tool's tab crashes. Neither failure is retried, and
+        both set X-Should-Retry to false because the tool may have had side effects.
+        CDP-backed custom tool outputs above 240 KiB return an error rather than a
+        truncated result.
 
         Args:
-          input: Tool input, limited to 1 MiB after JSON serialization.
+          input: Tool input, limited to 4 MiB after JSON serialization.
 
           extra_headers: Send extra headers
 
@@ -219,12 +223,16 @@ async def invoke_tool(
         across navigation. Inspect a populated form, obtain any required confirmation,
         then submit through Playwright or computer interaction without invoking the tool
         again. If the tab or embedded frame disappears, or the request times out after
-        invocation begins, the response reports outcome_unknown and the tool is not
-        retried. CDP-backed custom tool outputs above 240 KiB return an error rather
-        than a truncated result.
+        invocation begins, the response reports outcome_unknown. If the tool's page is
+        reloaded or replaced by a navigation the tool did not start, and the tool never
+        responds, the response reports tool_page_unloaded once the replacement page
+        loads, or right away if the tool's tab crashes. Neither failure is retried, and
+        both set X-Should-Retry to false because the tool may have had side effects.
+        CDP-backed custom tool outputs above 240 KiB return an error rather than a
+        truncated result.
 
         Args:
-          input: Tool input, limited to 1 MiB after JSON serialization.
+          input: Tool input, limited to 4 MiB after JSON serialization.
 
           extra_headers: Send extra headers
 

src/kernel/resources/vaults/items.py

@@ -1280,8 +1280,8 @@ def perform_operation(
           page_url: Exact current top-level page URL. Must match exactly one open page in the
               browser unless target_id is supplied.
 
-          entry_id: ID of an approved request entry. Required when several approved entries have the
-              page's origin.
+          entry_id: ID of an approved request entry. Required when several entries are approved and
+              the page's origin does not match exactly one of them.
 
           target_id: CDP target ID of the page to fill, such as tab.target_id from
               playwright.execute. Use it when several open pages have page_url. The page's
@@ -1424,6 +1424,67 @@ def perform_operation(
         """
         ...
 
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        access_token: str,
+        type: Literal["update_access_token"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+        idempotency_key: str | None = None,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Connected Kernel wallets may advertise add_payment_method, which returns a
+        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        which removes one card without affecting the others. Both operations require
+        vaults:write in addition to vaults:use on the vault for scoped API keys, and
+        return 403 without both permissions.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+
+          idempotency_key: Specify a custom idempotency key for this request
+        """
+        ...
+
     @overload
     def perform_operation(
         self,
@@ -1656,6 +1717,7 @@ def perform_operation(
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
         | Literal["1pw_update_access_token"]
+        | Literal["update_access_token"]
         | Literal["webmcp_invoke"]
         | Literal["add_payment_method"]
         | Literal["remove_payment_method"],
@@ -3285,8 +3347,8 @@ async def perform_operation(
           page_url: Exact current top-level page URL. Must match exactly one open page in the
               browser unless target_id is supplied.
 
-          entry_id: ID of an approved request entry. Required when several approved entries have the
-              page's origin.
+          entry_id: ID of an approved request entry. Required when several entries are approved and
+              the page's origin does not match exactly one of them.
 
           target_id: CDP target ID of the page to fill, such as tab.target_id from
               playwright.execute. Use it when several open pages have page_url. The page's
@@ -3429,6 +3491,67 @@ async def perform_operation(
         """
         ...
 
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        access_token: str,
+        type: Literal["update_access_token"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+        idempotency_key: str | None = None,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Connected Kernel wallets may advertise add_payment_method, which returns a
+        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        which removes one card without affecting the others. Both operations require
+        vaults:write in addition to vaults:use on the vault for scoped API keys, and
+        return 403 without both permissions.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+
+          idempotency_key: Specify a custom idempotency key for this request
+        """
+        ...
+
     @overload
     async def perform_operation(
         self,
@@ -3661,6 +3784,7 @@ async def perform_operation(
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
         | Literal["1pw_update_access_token"]
+        | Literal["update_access_token"]
         | Literal["webmcp_invoke"]
         | Literal["add_payment_method"]
         | Literal["remove_payment_method"],

src/kernel/types/browsers/webmcp_invoke_tool_params.py

@@ -10,7 +10,7 @@
 
 class WebmcpInvokeToolParams(TypedDict, total=False):
     input: Required[Dict[str, object]]
-    """Tool input, limited to 1 MiB after JSON serialization."""
+    """Tool input, limited to 4 MiB after JSON serialization."""
 
     tool_ref: Required[str]
 

src/kernel/types/vaults/__init__.py

@@ -22,6 +22,7 @@
 from .credential_vault_item import CredentialVaultItem as CredentialVaultItem
 from .link_shipping_address import LinkShippingAddress as LinkShippingAddress
 from .shop_pay_wallet_state import ShopPayWalletState as ShopPayWalletState
+from .kernel_single_use_card import KernelSingleUseCard as KernelSingleUseCard
 from .vault_fill_field_param import VaultFillFieldParam as VaultFillFieldParam
 from .wallet_vault_item_spec import WalletVaultItemSpec as WalletVaultItemSpec
 from .vault_fill_field_result import VaultFillFieldResult as VaultFillFieldResult
@@ -37,6 +38,7 @@
 from .agentcard_prepared_processor import AgentcardPreparedProcessor as AgentcardPreparedProcessor
 from .credential_collection_action import CredentialCollectionAction as CredentialCollectionAction
 from .credential_vault_field_state import CredentialVaultFieldState as CredentialVaultFieldState
+from .kernel_single_use_card_param import KernelSingleUseCardParam as KernelSingleUseCardParam
 from .vault_checkout_context_param import VaultCheckoutContextParam as VaultCheckoutContextParam
 from .credential_account_vault_item import CredentialAccountVaultItem as CredentialAccountVaultItem
 from .item_perform_operation_params import ItemPerformOperationParams as ItemPerformOperationParams
@@ -46,6 +48,7 @@
 from .agentcard_checkout_preparation import AgentcardCheckoutPreparation as AgentcardCheckoutPreparation
 from .payment_request_vault_item_spec import PaymentRequestVaultItemSpec as PaymentRequestVaultItemSpec
 from .shop_pay_wallet_vault_item_spec import ShopPayWalletVaultItemSpec as ShopPayWalletVaultItemSpec
+from .single_use_card_billing_address import SingleUseCardBillingAddress as SingleUseCardBillingAddress
 from .agentcard_checkout_authorization import AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization
 from .fill_vault_item_operation_result import FillVaultItemOperationResult as FillVaultItemOperationResult
 from .payment_request_vault_item_state import PaymentRequestVaultItemState as PaymentRequestVaultItemState
@@ -66,6 +69,7 @@
 )
 from .payment_request_vault_item_spec_param import PaymentRequestVaultItemSpecParam as PaymentRequestVaultItemSpecParam
 from .shop_pay_wallet_vault_item_spec_param import ShopPayWalletVaultItemSpecParam as ShopPayWalletVaultItemSpecParam
+from .single_use_card_billing_address_param import SingleUseCardBillingAddressParam as SingleUseCardBillingAddressParam
 from .credential_vault_item_spec_input_param import (
     CredentialVaultItemSpecInputParam as CredentialVaultItemSpecInputParam,
 )

src/kernel/types/vaults/credential_account_vault_item.py

@@ -45,6 +45,7 @@ class AvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "update_access_token",
         "webmcp_invoke",
         "add_payment_method",
         "remove_payment_method",

src/kernel/types/vaults/credential_vault_item.py

@@ -52,6 +52,7 @@ class AvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "update_access_token",
         "webmcp_invoke",
         "add_payment_method",
         "remove_payment_method",

src/kernel/types/vaults/item_perform_operation_params.py

@@ -28,6 +28,7 @@
     "OnePasswordFillVaultItemOperationRequest",
     "OnePasswordRecoverVaultItemOperationRequest",
     "OnePasswordUpdateAccessTokenVaultItemOperationRequest",
+    "UpdateAccessTokenVaultItemOperationRequest",
     "WebmcpInvokeVaultItemOperationRequest",
     "AddPaymentMethodVaultItemOperationRequest",
     "RemovePaymentMethodVaultItemOperationRequest",
@@ -235,7 +236,8 @@ class OnePasswordFillVaultItemOperationRequest(TypedDict, total=False):
     entry_id: str
     """ID of an approved request entry.
 
-    Required when several approved entries have the page's origin.
+    Required when several entries are approved and the page's origin does not match
+    exactly one of them.
     """
 
     target_id: str
@@ -266,6 +268,14 @@ class OnePasswordUpdateAccessTokenVaultItemOperationRequest(TypedDict, total=Fal
     """Optional supplied expiry. Omit to clear the old expiry."""
 
 
+class UpdateAccessTokenVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    access_token: Required[str]
+
+    type: Required[Literal["update_access_token"]]
+
+
 class WebmcpInvokeVaultItemOperationRequest(TypedDict, total=False):
     id_or_name: Required[str]
 
@@ -329,6 +339,7 @@ class RemovePaymentMethodVaultItemOperationRequest(TypedDict, total=False):
     OnePasswordFillVaultItemOperationRequest,
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordUpdateAccessTokenVaultItemOperationRequest,
+    UpdateAccessTokenVaultItemOperationRequest,
     WebmcpInvokeVaultItemOperationRequest,
     AddPaymentMethodVaultItemOperationRequest,
     RemovePaymentMethodVaultItemOperationRequest,