release: 0.128.0

[kernel-internal]

Automated Release PR

0.128.0 (2026-10-19)

Features

• Add browser location session policy (942881d)
• chore(stlc): seal custom-code tracking files (784dff8)
• Fence browser allowlist updates with revision checks (733ca11)
• Support existing-user AgentCard wallet imports (e84e82f)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

Medium Risk
Changes affect browser egress allowlist concurrency, proxy resolution by name, and vault wallet import behavior—callers should adopt revision fencing and understand ambiguous proxy name errors.

Overview
Release 0.128.0 bumps the package and changelog and regenerates the TypeScript client from the latest Kernel API.

Browser sessions gain a session location model: create and PATCH accept optional location overrides (timezone/locale), responses expose effective location with per-field provenance (override vs metro). Network allowlists add allowlist_state on saved config and optional expected_allowlist_revision / mutation_id on updates so allowed_hosts changes can be retried or rejected with 409 stale_network.

Proxies methods now document and type the path segment as id_or_name (retrieve, update, delete, check); ambiguous names can return 400 ambiguous_proxy_name.

Vault docs/types change for AgentCard wallets: with a customer-owned provider_config, user_id can import an existing connection after read-only validation (no hosted enrollment). Link card amount is documented as capped at 50,000 minor units.

^{Reviewed by Cursor Bugbot for commit f4cf30e. Bugbot is set up for automated code reviews on this repo. Configure here.}