release: 0.128.0

[kernel-internal]

Automated Release PR

0.128.0 (2026-10-19)

Features

• chore(stlc): seal custom-code tracking files (457e6c1)
• Fence browser allowlist updates with revision checks (a9ab0d3)
• Support existing-user AgentCard wallet imports (c1a6765)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

Medium Risk
Proxy method signatures rename id to id_or_name (breaking for keyword callers), and changes touch vault wallet import and payment-related type documentation alongside browser network fencing.

Overview
Release 0.128.0 syncs the Python SDK with API updates for browser egress allowlists, proxy addressing, vault wallets, and Link card docs.

Browser allowlists gain optimistic concurrency: responses expose network.allowlist_state (BrowserAllowlistState with revision, optional base_revision / mutation_id), and browser network updates can pass expected_allowlist_revision and mutation_id to fence allowed_hosts changes (stale updates → 409 stale_network).

Proxies now use an id_or_name path parameter on retrieve, update, delete, and check (ID wins on collision; ambiguous names → ambiguous_proxy_name). Call sites and tests move from positional/id= to id_or_name.

AgentCard wallet vault item docs describe importing an existing connected user when using a customer-owned provider_config (read-only validation before create, no hosted enrollment), distinct from Kernel-managed enrollment rules.

Link card specs narrow documented amount to at most 50000 minor units (prior dual limits for Link Pay Token vs virtual card are removed from the type docs).

^{Reviewed by Cursor Bugbot for commit e968fdd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit e968fdd. Configure here.}

[cursor]

Link card amount limits collapsed

Medium Severity

LinkCardVaultItemSpec.amount now documents a single cap of 50000 minor units. Link Pay Token execution still permits 500000, while virtual-card execution permits 50000. Callers following the collapsed docstring will under-limit Pay Token checkouts.

Additional Locations (1)

• src/kernel/types/vaults/card_vault_item_spec_param.py#L64-L66

 

^{Triggered by learned rule: Link Pay Token authorize uses optional checkout context}

^{Reviewed by Cursor Bugbot for commit e968fdd. Configure here.}