CLI: Update SDK to acf8805822d0adbfe0be88647246ad0c53448fb2 and add new commands/flags

[kernel-internal]

This PR updates the Go SDK to acf8805822d0adbfe0be88647246ad0c53448fb2 and adds CLI commands/flags for new SDK methods.

SDK Update

• Updated kernel-go-sdk to acf8805822d0adbfe0be88647246ad0c53448fb2 (v0.119.1-0.20261005141955-acf8805822d0)
• The latest SDK change (2f36763 → acf8805) only changes doc comments in search.go: Exa contents.highlights now defaults to true, and Perplexity search_context_size now defaults to medium. The CLI already passes these provider options through kernel search --request JSON, so this change needs no new flags.
• The earlier SDK changes since v0.117.0 add the managed_auth credential provider, the Kernel wallet/card provider, and VaultListParams.Query. These are covered below.

Merge fix

The automated merge of main into this branch left the build broken. main had already shipped webmcp_invoke in #279, so the merge duplicated the vaultOperationParams.WebMCP field, the invoke dispatch, the validation, and the help/example text. This PR removes the duplicates and keeps main's version.

Coverage Analysis

This PR was generated by performing a full enumeration of SDK methods and CLI commands. All 172 SDK methods in api.md have CLI coverage, except the ConfigRegistry endpoints, which are marked x-cli-skip. kernel search (get/providers/contents) and kernel browsers curl cover the Search and Curl methods through raw requests.

New Commands

• None (no new SDK methods)

New Flags / Spec Options

• kernel vaults credentials create --spec-file now accepts {"provider":"managed_auth","connection_id":"...","description":"..."} for CredentialVaultItemSpecInputUnionParam.OfManagedAuth (ManagedAuthCredentialVaultItemSpecInputParam). A missing connection_id is rejected before the request is sent. Display-safe output keeps spec.connection_id and state.fields[*].type.
• --provider kernel on kernel vaults wallets create for WalletVaultItemSpecUnionParam.OfKernel (KernelWalletVaultItemSpecParam). Provider config and --tokens-file are rejected for this provider.
• --provider kernel on kernel vaults cards create for CardVaultItemSpecUnionParam.OfKernel (KernelCardVaultItemSpecParam). cards update rejects Kernel cards because the API doesn't support updating them.
• --query on kernel vaults list for VaultListParams.Query, kept in the pagination hint.
• Spec help documents KernelWalletSpec and KernelCardSpec. Item output shows the merchant URL, card last4, and network token last4.

Testing

• acf8805 bump and merge fix: go build ./..., go vet ./... and go test ./... pass. kernel vaults list --query zz-nonexistent -o json against the live API returned {"vaults": []}. vaults items invoke --help no longer shows the duplicated webmcp_invoke text.
• Earlier commits: vaults credentials create with a managed_auth spec was run against the live API and the item was created ready with fill advertised. A missing connection_id was rejected client-side, an unknown connection returned 404, and the test resources were cleaned up. vaults wallets create --provider kernel sent its request, but the staging API answered provider configuration is unavailable. vaults cards create --provider kernel reached the API, which validated the spec.

Triggered by: kernel/kernel-go-sdk@acf8805
Reviewer: @kernel-internal[bot]

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.117.0 ⏵ v0.119.1-0.20261005141955-acf8805822d0	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dced2d6. Configure here.}