release: 0.128.0

[kernel-internal]

Automated Release PR

0.128.0 (2026-10-19)

Features

• Add browser location session policy (48fd526)
• chore(stlc): seal custom-code tracking files (457e6c1)
• Fence browser allowlist updates with revision checks (a9ab0d3)
• Support existing-user AgentCard wallet imports (c1a6765)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

Medium Risk
Renaming proxy method parameters and new browser location/allowlist semantics can break callers or change runtime session behavior; vault wallet import paths touch payment credentials.

Overview
Release 0.128.0 bumps the package version and changelog; the SDK changes track new Kernel API behavior for browsers, proxies, and vault wallets.

Browser create and update now accept an optional location object for session-only timezone and locale overrides, and responses expose effective location (with per-field source). Network updates can opt into conditional allowlist changes via expected_allowlist_revision and mutation_id, with allowlist_state returned on network config for concurrency-safe retries.

Proxies retrieve, update, delete, and check take id_or_name instead of id (IDs win over ambiguous names). Vault AgentCard wallet docs describe importing an existing connection when user_id is set with a customer-owned provider_config. Link card amount is documented as capped at 50,000 minor units only.

^{Reviewed by Cursor Bugbot for commit a32f2ad. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit e968fdd. Configure here.}

[cursor]

Link card amount limits collapsed

Medium Severity

LinkCardVaultItemSpec.amount now documents a single cap of 50000 minor units. Link Pay Token execution still permits 500000, while virtual-card execution permits 50000. Callers following the collapsed docstring will under-limit Pay Token checkouts.

Additional Locations (1)

• src/kernel/types/vaults/card_vault_item_spec_param.py#L64-L66

 

^{Triggered by learned rule: Link Pay Token authorize uses optional checkout context}

^{Reviewed by Cursor Bugbot for commit e968fdd. Configure here.}