Add Kernel-managed wallet and card flows with outcome reporting

[hiroTamada]

Summary

• Add Kernel-hosted wallet enrollment, payment-method eligibility, and immutable card requests with Visa merchant country. Keep PAN, CVC, expiry values, and hosted action URLs out of tool inputs.
• Authorize only advertised Kernel cards after explicit user approval, through either manage_vault_cards authorize or the equivalent manage_vault_items invoke authorize. Hosted enrollment and spend approval remain private cardholder actions.
• Explain the complete merchant flow in tool descriptions, per-item guidance, README, and vault payment docs: vault-attached browser, exact current HTTPS merchant page URL, number / expiration (MM/YY) / cvc bindings, no stored billing fields, merchant submission, then exactly one confirm_transaction report of the observed outcome with the required input contract. Unknown outcomes require reconciliation, not retry or guessed reporting.
• Describe restart_verification only as advertised, user-approved, no-input recovery of a proven no-dispatch initial attestation failure; all other recovery_required states still require stopping and reconciliation. Both new operations use the existing advertised-operation passthrough.
• Redact upstream Kernel error text while retaining HTTP status, a validated short API code, and the SDK's classified timeout/connection/abort error categories for analytics. Distinguish 4xx validation/conflict rejection from uncertain 5xx/network/timeout authorization failures, including preflight redaction before the item provider is known.
• Give failed or unknown Kernel fills operation-specific guidance: inspect the browser page and item state, fix the cause, then retry only the field write. A 400 field_unavailable wrote no fields; remove unsupported billing bindings and enter billing details on the merchant page. This never permits replaying authorization, checkout, or transaction reporting; the tool does not retry automatically.
• Merge main without rebasing and retain its SDK 0.121.0 and Bun lockfile resolution. This SDK includes merchant_country; neither new operation requires a generated SDK update.

Validation

• bun test: 973 passed, 0 failed across 73 files. All API calls were mocked.
• bunx prettier --check "**/*.{ts,js,json,md}" "!AGENTS.md": passed. The unchanged AGENTS.md retains its pre-existing formatting warning.
• bun run lint: fails with "Invalid project directory" because Next.js 16 removed next lint. This is pre-existing on main; the lint script is unchanged from main.
• bunx tsc --noEmit: passed.
• bun install --frozen-lockfile: passed after resolving the merge and regenerating the lockfile with Bun.
• git diff main...HEAD --check: passed; full diff deslop and self-review completed.
• Tests cover transaction-report passthrough and refusal after advertisement disappears, advertised/unadvertised verification restart in recovery, guidance and fill format, status/code preservation, unsafe-code omission, URL redaction, validation rejection, network/timeout uncertainty, and payment-operation preflight failures. Additional coverage verifies preserved transport/HTTP error categories with redacted messages, fill-specific validation/transport/timeout guidance, no automatic retries, and no fill-retry guidance for uncertain authorization or outcome-reporting/recovery operations. Existing secret-input rejection tests remain intact.
• Repository-wide bun run format:check still reports only the pre-existing AGENTS.md formatting warning; that file was not changed.
• No live Kernel API calls or payments were performed.

Dependency / release note

restart_verification depends on kernel/kernel#4760, currently staging-only until merged and released. The MCP tool always re-fetches available_operations before submitting it, so unreleased or otherwise unavailable recovery is refused. Do not retry other recovery states or assume operation availability from SDK version.

---

Note

High Risk
Introduces real payment authorization, fill, and outcome-reporting paths with secret-bearing URLs; incorrect retry or error handling could affect live card transactions or leak capabilities.

Overview
Adds Kernel-hosted vault wallets and cards as a third provider (kernel) alongside Link and AgentCard, with MCP tools, schemas, per-item guidance, and expanded README/docs/vault-payments.md.

Wallets: manage_vault_wallets accepts provider: "kernel" and spec: {}, returning a private card_enrollment URL; payment_methods can surface advisory single-use eligibility. Org-level manage_vault_provider_configs excludes kernel (Kernel-managed, not customer config).

Cards: manage_vault_cards gains authorize (kernel-only, no spec) after checking advertised authorize; create uses a new spec (HTTPS merchant_url, optional ISO merchant_country for Visa, amount caps); update is rejected for kernel cards. Card PAN/CVC/expiry and hosted action URLs stay out of tool inputs.

Post-checkout: Tool copy and item guidance document confirm_transaction (exact-once reporting when advertised) and gated restart_verification for a narrow recovery case; both pass through existing manage_vault_items invoke when the API advertises them.

Errors: throwToolError accepts an optional safeMessage; throwKernelVaultError redacts upstream text (e.g. bearer approval URLs) while keeping HTTP status, validated API codes, and analytics error names. Guidance differs for fill (field-write retry only), 4xx rejection, and uncertain authorize/5xx/network.

Tests: Large vault-kernel.test.ts plus updates to response and vault error tests cover authorize gates, fill/report/recovery, redaction, and schema rejection.

^{Reviewed by Cursor Bugbot for commit 6db04be. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Oct 12, 2026 7:46pm UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 3a78d08. Configure here.}