Support credential field labels

[masnwilliams]

summary

• accept optional credential field labels through the generated SDK adapter
• preserve labels in display-safe JSON metadata
• keep stable field names authoritative for state, updates, and browser fill
• update CLI guidance and examples for labels and ordered definitions
• test labeled and unlabeled metadata, order preservation, and name-keyed update/fill behavior

rollout

kernel/kernel#4214 is deployed, and this PR now uses the published kernel-go-sdk@v0.110.0 release.

testing

• make test
• make build
• git diff --check

---

Note

Low Risk
Display-metadata and SDK bump only; field names remain authoritative and existing secret redaction behavior is unchanged.

Overview
Adds optional human-readable label on vault credential field definitions while keeping name as the stable key for collection state, updates, and browser fill.

The CLI now passes labels through the kernel-go-sdk v0.110.0 credential create/update flow, includes label in filtered vault JSON output for spec.fields, and updates README plus vaults credentials help/examples to document label vs. name behavior. Tests and steering assertions cover labeled and unlabeled fields, definition order, and that public output still redacts sensitive values.

^{Reviewed by Cursor Bugbot for commit 57c299b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.109.0 ⏵ v0.110.0	+1

View full report

[rgarcia]

reviewed incrementally — looks good. credential labels remain display-only metadata, while stable field names continue to drive updates, state, and browser fills. tests cover SDK serialization, safe output, ordering, redaction, and labeled/unlabeled fields.