From 39d0464b588af3431f53f4f61b2acb36f68d6731 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 19:32:13 +0000
Subject: [PATCH 01/10] chore: update kernel-go-sdk to v0.107.0

Bumps the Go SDK from v0.105.1-0.20260916183112-dab5c0714192 to v0.107.0
(commit 6c9df7b).

The SDK surface is unchanged across this range: the previously pinned
pseudo-version already contained every feature commit in the 0.106.0 and
0.107.0 releases (persistent browser REPL, browser update start_url, config
registry, AgentCard preparation contracts, Link spend request errors). Only
release metadata differs, so no new commands or flags were required.

Coverage analysis: full enumeration of all 165 SDK methods in api.md against
the CLI command tree found no gaps. The six client.ConfigRegistry.* methods
are marked x-cli-skip in openapi.yaml and are correctly excluded. Param
fields without a dedicated flag were each verified as intentional:
- AuditLog{List,ExportChunk}Params.SearchUserID -> covered by --user-id
- AuditLogListParams.PageToken -> handled internally by ListAutoPaging
- AuthConnectionLoginParams.BrowserTelemetry -> deprecated, superseded by
  browser.telemetry, which --telemetry covers
- BrowserCurlParams.ResponseEncoding -> `browsers curl` streams raw bytes
  through its own HTTP client rather than the SDK method

Tested: go build ./..., go vet ./..., go test ./... (all 9 packages pass),
plus live API smoke tests of `browsers list`, `browsers create`,
`browsers repl` (verified top-level bindings persist across calls under a
stable REPL ID), `browsers update --start-url`, and `browsers delete`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 3b25c970..9eb823f3 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.105.1-0.20260916183112-dab5c0714192
+	github.com/kernel/kernel-go-sdk v0.107.0
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index 659ade8d..5f951cdc 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.105.1-0.20260916183112-dab5c0714192 h1:LuKqg8Lp9vg4EiixL4L5fPELDT5GFouh0gtSEc9uqoM=
-github.com/kernel/kernel-go-sdk v0.105.1-0.20260916183112-dab5c0714192/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.107.0 h1:0m4RkOquA3irSYK7hNU8VmLhTyl1jeCSydpTQ2tjba0=
+github.com/kernel/kernel-go-sdk v0.107.0/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

From 74e93b3654f7dd6d5373fd9cc4ff30acf018710b Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 18:53:32 +0000
Subject: [PATCH 02/10] chore: bump Go SDK to 51d7fb8
 (v0.107.1-0.20260917184535)

Updates github.com/kernel/kernel-go-sdk from v0.107.0 to
v0.107.1-0.20260917184535-51d7fb82550d (commit 51d7fb8).

The upstream commit ("chore(stlc): seal custom-code tracking files")
contains no API surface changes -- the api.md/Go source diff between
v0.107.0 and 51d7fb8 is empty.

Coverage analysis: full enumeration of all 165 methods in api.md against
the CLI command tree (215 commands). All 159 non-skipped methods have a
corresponding CLI command; the 6 config-registry methods are marked
x-cli-skip: true in openapi.yaml. All params struct fields map to
existing flags, positional args, or are pagination internals handled by
the auto-pagers.

No new commands or flags were needed.

Tested: go build ./..., go vet ./..., go test ./... (all pass),
kernel browsers list, kernel profiles list against the live API.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 9eb823f3..9c1121c0 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.107.0
+	github.com/kernel/kernel-go-sdk v0.107.1-0.20260917184535-51d7fb82550d
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index 5f951cdc..871d8b93 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.107.0 h1:0m4RkOquA3irSYK7hNU8VmLhTyl1jeCSydpTQ2tjba0=
-github.com/kernel/kernel-go-sdk v0.107.0/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.107.1-0.20260917184535-51d7fb82550d h1:VfVsuvaFQuxmQNy9OtNyFL1YeaKzE/+HlJIxw/jao1c=
+github.com/kernel/kernel-go-sdk v0.107.1-0.20260917184535-51d7fb82550d/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

From 627c950f7f3a0667c1089519d22dc045d6f9a86f Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 19:40:09 +0000
Subject: [PATCH 03/10] chore: bump Go SDK to v0.108.0 (3556e00)

Updates github.com/kernel/kernel-go-sdk from
v0.107.1-0.20260917184535-51d7fb82550d to v0.108.0.

The only difference between the two module versions is the
internal/version.go version constant -- api.md and every public Go
source file are byte-identical, so there are no new API methods,
params, or fields to expose.

Coverage analysis: full enumeration of all 165 SDK methods in api.md
against all 176 CLI leaf commands found no gaps. 6 methods
(ConfigRegistry.{List,Lookup,Resolve} and
ConfigRegistry.Analyses.{Get,List,Cancel}) are marked x-cli-skip in
openapi.yaml and are intentionally absent. The remaining 159 all have
CLI commands. An automated SDK-param-field vs CLI-flag comparison
surfaced only naming false positives (e.g. proxy -> --proxy-id/--proxy-name,
tags -> --tag, timeout_seconds -> --timeout, hold_keys -> --hold-key) and
fields exposed as positional args; all were verified covered.

Tested: go build ./..., go vet ./... (clean), go test ./... (all pass),
and smoke-tested `kernel browsers list` and `kernel app list` against
the live API.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 9c1121c0..45b25060 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.107.1-0.20260917184535-51d7fb82550d
+	github.com/kernel/kernel-go-sdk v0.108.0
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index 871d8b93..41e57300 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.107.1-0.20260917184535-51d7fb82550d h1:VfVsuvaFQuxmQNy9OtNyFL1YeaKzE/+HlJIxw/jao1c=
-github.com/kernel/kernel-go-sdk v0.107.1-0.20260917184535-51d7fb82550d/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.108.0 h1:GwCC3keLb9/Dy9ACEf5U62eCYk5mAgHavN7zvVeJDyk=
+github.com/kernel/kernel-go-sdk v0.108.0/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

From 7a8a71e246be6306751303483abbc7ef4ef426f6 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 20:06:55 +0000
Subject: [PATCH 04/10] chore: bump Go SDK to 6367486 and show org concurrency
 usage

Updates kernel-go-sdk to 6367486e6e06cdc3d9dc13c107dddca490e9b9bc.

That SDK change adds two response fields to OrgLimits:
concurrent_sessions_used and concurrent_sessions_available. Surface both
as rows in `kernel org limits get`. A null here means usage could not be
read rather than "unlimited", so these render as "unknown" instead of
reusing formatProjectLimitValue.

A full enumeration of the 165 methods in api.md found no missing
commands; the 6 config-registry methods are x-cli-skip. Param-field
audit found no missing flags: AuditLogListParams.PageToken is consumed
by the SDK auto-pager, AuthConnectionLoginParams.BrowserTelemetry is
deprecated in favor of browser.telemetry (already wired), and
BrowserCurlParams.ResponseEncoding does not apply because `browsers
curl` streams raw bytes over the browser HTTP client rather than calling
Browsers.Curl.

Tested: `kernel org limits get` and `-o json` against the live API
(1118 used + 882 available = 2000 max); full `go test ./...` passes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 cmd/org.go      | 21 +++++++++++++++++-
 cmd/org_test.go | 58 +++++++++++++++++++++++++++++++++++++++++++++++++
 go.mod          |  2 +-
 go.sum          |  4 ++--
 4 files changed, 81 insertions(+), 4 deletions(-)

diff --git a/cmd/org.go b/cmd/org.go
index 2bce469d..92143ade 100644
--- a/cmd/org.go
+++ b/cmd/org.go
@@ -135,6 +135,16 @@ func renderOrgLimits(limits *kernel.OrgLimits) {
 		{"Default Project Max Concurrent Sessions", formatProjectLimitValue(limits.DefaultProjectMaxConcurrentSessions, limits.JSON.DefaultProjectMaxConcurrentSessions)},
 	}
 
+	// Concurrency usage is measured live and only returned by newer API
+	// versions. Unlike the limit rows, a null here means usage could not be
+	// read rather than "unlimited", so render it as unknown.
+	if orgLimitFieldPresent(limits.JSON.ConcurrentSessionsUsed) {
+		rows = append(rows, []string{"Concurrent Sessions Used", formatOrgUsageValue(limits.ConcurrentSessionsUsed, limits.JSON.ConcurrentSessionsUsed)})
+	}
+	if orgLimitFieldPresent(limits.JSON.ConcurrentSessionsAvailable) {
+		rows = append(rows, []string{"Concurrent Sessions Available", formatOrgUsageValue(limits.ConcurrentSessionsAvailable, limits.JSON.ConcurrentSessionsAvailable)})
+	}
+
 	// Managed auth limits are plan-derived and only returned by newer API
 	// versions, so render each row only when the field is present. A null
 	// max_auth_connections means unlimited, so presence — not validity — is the
@@ -167,6 +177,15 @@ func orgLimitFieldPresent(field respjson.Field) bool {
 	return field.Raw() != respjson.Omitted
 }
 
+// formatOrgUsageValue renders a live usage counter, where a null means the API
+// could not read current usage rather than "unlimited".
+func formatOrgUsageValue(value int64, field respjson.Field) string {
+	if !field.Valid() {
+		return "unknown"
+	}
+	return fmt.Sprintf("%d", value)
+}
+
 func renderOrgEntitlements(entitlements *kernel.OrgEntitlements) {
 	if entitlements == nil {
 		pterm.Info.Println("No organization entitlements found")
@@ -266,7 +285,7 @@ var orgLimitsCmd = &cobra.Command{
 var orgLimitsGetCmd = &cobra.Command{
 	Use:   "get",
 	Short: "Get organization limits",
-	Long:  "Show the organization's effective limits: the concurrency limit, the default per-project cap applied to projects without an explicit override, and the plan-derived managed auth and vault limits along with current auth connection and vault usage.",
+	Long:  "Show the organization's effective limits: the concurrency limit, current organization-wide concurrent browser usage and remaining capacity, the default per-project cap applied to projects without an explicit override, and the plan-derived managed auth and vault limits along with current auth connection and vault usage.",
 	Args:  cobra.NoArgs,
 	RunE:  runOrgLimitsGet,
 }
diff --git a/cmd/org_test.go b/cmd/org_test.go
index 9118f619..33afdbbd 100644
--- a/cmd/org_test.go
+++ b/cmd/org_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"strings"
 	"testing"
 	"time"
 
@@ -296,6 +297,63 @@ func TestOrgLimitsGet_NullDefaultShownAsUnlimited(t *testing.T) {
 	assert.Contains(t, buf.String(), "unlimited")
 }
 
+func TestOrgLimitsGet_RendersConcurrencyUsage(t *testing.T) {
+	buf := capturePtermOutput(t)
+	fake := &FakeOrgLimitsService{
+		GetFunc: func(ctx context.Context, opts ...option.RequestOption) (*kernel.OrgLimits, error) {
+			limits := &kernel.OrgLimits{
+				MaxConcurrentSessions:       100,
+				ConcurrentSessionsUsed:      12,
+				ConcurrentSessionsAvailable: 88,
+			}
+			limits.JSON.ConcurrentSessionsUsed = respjson.NewField("12")
+			limits.JSON.ConcurrentSessionsAvailable = respjson.NewField("88")
+			return limits, nil
+		},
+	}
+	c := OrgCmd{limits: fake}
+	assert.NoError(t, c.LimitsGet(context.Background(), OrgLimitsGetInput{}))
+
+	out := buf.String()
+	assert.Contains(t, out, "Concurrent Sessions Used")
+	assert.Contains(t, out, "12")
+	assert.Contains(t, out, "Concurrent Sessions Available")
+	assert.Contains(t, out, "88")
+}
+
+func TestOrgLimitsGet_NullConcurrencyUsageShownAsUnknown(t *testing.T) {
+	buf := capturePtermOutput(t)
+	fake := &FakeOrgLimitsService{
+		GetFunc: func(ctx context.Context, opts ...option.RequestOption) (*kernel.OrgLimits, error) {
+			limits := &kernel.OrgLimits{MaxConcurrentSessions: 100}
+			// Null (not omitted) means usage could not be read, which is not
+			// the same as unlimited.
+			limits.JSON.ConcurrentSessionsUsed = respjson.NewField(respjson.Null)
+			limits.JSON.ConcurrentSessionsAvailable = respjson.NewField(respjson.Null)
+			return limits, nil
+		},
+	}
+	c := OrgCmd{limits: fake}
+	assert.NoError(t, c.LimitsGet(context.Background(), OrgLimitsGetInput{}))
+
+	out := buf.String()
+	// Both usage rows render as unknown rather than borrowing the "unlimited"
+	// meaning a null limit would have.
+	assert.Contains(t, out, "Concurrent Sessions Used")
+	assert.Contains(t, out, "Concurrent Sessions Available")
+	assert.Equal(t, 2, strings.Count(out, "unknown"))
+}
+
+func TestOrgLimitsGet_OmitsConcurrencyUsageRowsWhenAbsent(t *testing.T) {
+	buf := capturePtermOutput(t)
+	c := OrgCmd{limits: &FakeOrgLimitsService{}}
+	assert.NoError(t, c.LimitsGet(context.Background(), OrgLimitsGetInput{}))
+
+	out := buf.String()
+	assert.NotContains(t, out, "Concurrent Sessions Used")
+	assert.NotContains(t, out, "Concurrent Sessions Available")
+}
+
 func TestOrgLimitsGet_RendersManagedAuthLimits(t *testing.T) {
 	buf := capturePtermOutput(t)
 	fake := &FakeOrgLimitsService{
diff --git a/go.mod b/go.mod
index 45b25060..ce177f64 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.108.0
+	github.com/kernel/kernel-go-sdk v0.108.1-0.20260917195741-6367486e6e06
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index 41e57300..3427968d 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.108.0 h1:GwCC3keLb9/Dy9ACEf5U62eCYk5mAgHavN7zvVeJDyk=
-github.com/kernel/kernel-go-sdk v0.108.0/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.108.1-0.20260917195741-6367486e6e06 h1:VqkiahjT/KyvwQxlEqH/RCZjNd7ZFteoYHTuGj8uNfA=
+github.com/kernel/kernel-go-sdk v0.108.1-0.20260917195741-6367486e6e06/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

From 6643d5d26f4bd716114f14219ac9e23237b0954c Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 21:18:47 +0000
Subject: [PATCH 05/10] Update Go SDK to 3038f83 and adopt ordered credential
 fields

Bumps kernel-go-sdk to 3038f83eb3f7cc6a59059a0a04bdb111300ea77c, which
preserves credential field order: CredentialVaultItemSpec.Fields and
CredentialVaultItemSpecInputParam.Fields changed from a map keyed by name
to an ordered array, and each definition now carries a stable `name`.

- vaults_output.go: project spec.fields as an array (name, type, required,
  sensitive) instead of a keyed object, and look definitions up by name when
  deciding which non-sensitive values stay visible.
- vaults_credentials.go: document the ordered array and the name pattern,
  update the create example, note that update specs stay keyed by name,
  reject specs still using the object form with actionable guidance, and
  require every create field to carry a name. Error text never echoes values.
- README.md: same shape and ordering guidance.
- Tests: fixtures moved to the array shape; added coverage for field order
  reaching the API unchanged, the keyed-form error, and the missing-name error.

A full enumeration of api.md against the CLI command tree found no missing
commands. All config-registry and auth exchange endpoints are x-cli-skip.

Tested against the live API: vaults credentials create with out-of-alphabetical
field order (order preserved in the request and in get/list output), vaults
items get/list, vaults credentials update (keyed form, non-sensitive text/email
values still surfaced, sensitive omitted), vaults items invoke fill by field
name, and both new validation errors. Test vault, item, and browser deleted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 README.md                              | 10 ++++--
 cmd/vaults_credential_guidance_test.go |  2 +-
 cmd/vaults_credentials.go              | 35 +++++++++++++++---
 cmd/vaults_credentials_test.go         |  8 ++---
 cmd/vaults_fill_credentials_test.go    |  8 ++---
 cmd/vaults_output.go                   | 19 ++++++----
 cmd/vaults_public_values_test.go       |  6 ++--
 cmd/vaults_sdk_contract_test.go        | 50 +++++++++++++++++++++++++-
 go.mod                                 |  2 +-
 go.sum                                 |  4 +--
 10 files changed, 116 insertions(+), 28 deletions(-)

diff --git a/README.md b/README.md
index 3c93a6aa..d60c53c7 100644
--- a/README.md
+++ b/README.md
@@ -281,7 +281,7 @@ sensitive form. Define the observed fields without supplying values:
 kernel vaults create --name user-vault
 kernel browsers create --vault user-vault
 kernel vaults credentials create user-vault login --spec-file - <<'JSON'
-{"description":"Hacker News","fields":{"username":{"type":"text","required":true,"sensitive":false},"password":{"type":"password","required":true,"sensitive":true}}}
+{"description":"Hacker News","fields":[{"name":"username","type":"text","required":true,"sensitive":false},{"name":"password","type":"password","required":true,"sensitive":true}]}
 JSON
 kernel vaults items get user-vault login --wait 60 -o json
 kernel vaults items invoke user-vault login fill --spec-file - <<'JSON'
@@ -295,8 +295,14 @@ populated, not that login succeeded. `fill` requires an already-open page and ne
 navigates or submits it. Optional `page_url` selects the exact page; cards require it.
 Do not automatically retry failed/unknown fills or fall back to aliases.
 
+Create specs list `fields` as an ordered array. Each entry carries a stable `name`
+(letters, digits, and underscores, starting with a letter) that keys values, updates,
+and fills. Order is preserved: list fields in the same top-to-bottom order as the
+website, because the collection form renders that order unchanged.
+
 Use `credentials update <vault> <key> --version <version> --spec-file changes.json`
-with a spec such as `{"fields":{"password":{"value":"replacement"}}}`. Keep actual
+with a spec such as `{"fields":{"password":{"value":"replacement"}}}`; update specs key
+`fields` by name rather than using the ordered array. Keep actual
 secrets in protected files or stdin, never shell arguments. Omission preserves values;
 null or an empty string clears supported fields, including required text/email/password fields (returning them to pending collection). The form still requires nonempty required inputs. Field definitions cannot change. Stale versions fail,
 without retries. `items invoke <vault> <key> collect` reopens the full form without
diff --git a/cmd/vaults_credential_guidance_test.go b/cmd/vaults_credential_guidance_test.go
index 00142808..eb63830c 100644
--- a/cmd/vaults_credential_guidance_test.go
+++ b/cmd/vaults_credential_guidance_test.go
@@ -22,7 +22,7 @@ func TestCredentialHumanGuidance(t *testing.T) {
 				args := []string{"vaults", "items", "get", "user", "login"}
 				switch operation {
 				case "create":
-					args = []string{"vaults", "credentials", "create", "user", "login", "--spec-file", credentialSpecFile(t, `{"fields":{"password":{"type":"password"}}}`)}
+					args = []string{"vaults", "credentials", "create", "user", "login", "--spec-file", credentialSpecFile(t, `{"fields":[{"name":"password","type":"password"}]}`)}
 				case "collect":
 					args = []string{"vaults", "items", "invoke", "user", "login", "collect"}
 				}
diff --git a/cmd/vaults_credentials.go b/cmd/vaults_credentials.go
index 64f8f1b4..4347ec0d 100644
--- a/cmd/vaults_credentials.go
+++ b/cmd/vaults_credentials.go
@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -21,8 +22,12 @@ card item types for credit cards and payment checkout instead.
 
 First create a vault for the end user and attach it with browsers create --vault.
 Use a protected JSON file or stdin, never secret values in shell arguments.
-The spec contains description and fields keyed by name. Field types are text,
-email, password, and totp; definitions accept required, sensitive, and value.
+The spec contains description and an ordered fields array. Each field carries a
+stable name (letters, digits, and underscores; must start with a letter) used to
+key values, updates, and browser fills. List fields in the same top-to-bottom
+order as the website: the collection form renders that order unchanged.
+Field types are text, email, password, and totp; definitions accept required,
+sensitive, and value.
 Set description to the recognizable site name only, e.g. "Hacker News", not
 "Hacker News sign-in credentials". This text is the user-facing form title.
 Set sensitive:false explicitly for ordinary usernames and email addresses.
@@ -59,14 +64,14 @@ func newVaultCredentialsCommand() *cobra.Command {
 			},
 		}
 		if update {
-			cmd.Long += "\nUpdate preserves omitted fields, replaces nonempty string values, and clears supported values with null or an empty string. Clearing a required text/email/password field returns pending_collection; form submissions still require a nonempty value.\nField definitions are immutable. Do not automatically retry version conflicts."
+			cmd.Long += "\nUpdate spec fields are an object keyed by field name, not the ordered array used on create.\nUpdate preserves omitted fields, replaces nonempty string values, and clears supported values with null or an empty string. Clearing a required text/email/password field returns pending_collection; form submissions still require a nonempty value.\nField definitions are immutable. Do not automatically retry version conflicts."
 			cmd.Flags().Int64("version", 0, "Expected version from items get (required; never auto-refreshed)")
 			_ = cmd.MarkFlagRequired("version")
 			cmd.Flags().String("expected-item-id", "", "Immutable item ID from the original read; reject an update if the key now refers to a replacement item")
 			cmd.Example = "  kernel vaults credentials update user-vault login --version 2 --spec-file changes.json"
 		} else {
 			cmd.Example = `  kernel vaults credentials create user-vault login --spec-file - <<'JSON'
-{"description":"Hacker News","fields":{"username":{"type":"text","required":true,"sensitive":false},"password":{"type":"password","required":true,"sensitive":true}}}
+{"description":"Hacker News","fields":[{"name":"username","type":"text","required":true,"sensitive":false},{"name":"password","type":"password","required":true,"sensitive":true}]}
 JSON`
 		}
 		cmd.Flags().String("spec-file", "", "Credential spec JSON file (use '-' for stdin; maximum 128 KiB)")
@@ -123,8 +128,17 @@ func (c VaultsCmd) saveCredential(ctx context.Context, vault, key string, data [
 	} else {
 		var spec kernel.CredentialVaultItemSpecInputParam
 		if json.Unmarshal(data, &spec) != nil || len(spec.Fields) == 0 {
+			if credentialSpecUsesKeyedFields(data) {
+				return fmt.Errorf("credential spec fields must be an ordered array of definitions carrying a name, not an object keyed by name")
+			}
 			return fmt.Errorf("credential spec requires fields")
 		}
+		// Names key values, updates, and fills; reject specs the form cannot address.
+		for _, field := range spec.Fields {
+			if strings.TrimSpace(field.Name) == "" {
+				return fmt.Errorf("every credential spec field requires a name")
+			}
+		}
 		item, err = c.vaults.Items.Upsert(ctx, key, kernel.VaultItemUpsertParams{IDOrName: vault, OfCredential: &kernel.CredentialVaultItemRequestParam{Type: "credential", Spec: spec}}, option.WithMaxRetries(0))
 	}
 	if err != nil {
@@ -132,3 +146,16 @@ func (c VaultsCmd) saveCredential(ctx context.Context, vault, key string, data [
 	}
 	return c.showItem(item, output, open)
 }
+
+// The create spec moved from fields keyed by name to an ordered array; point
+// callers still sending the object form at the replacement shape.
+func credentialSpecUsesKeyedFields(data []byte) bool {
+	var object struct {
+		Fields json.RawMessage `json:"fields"`
+	}
+	if json.Unmarshal(data, &object) != nil {
+		return false
+	}
+	fields := bytes.TrimSpace(object.Fields)
+	return len(fields) > 0 && fields[0] == '{'
+}
diff --git a/cmd/vaults_credentials_test.go b/cmd/vaults_credentials_test.go
index 8dc6ef2e..206392d0 100644
--- a/cmd/vaults_credentials_test.go
+++ b/cmd/vaults_credentials_test.go
@@ -15,7 +15,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-const credentialFixture = `{"id":"credential-1","key":"login","type":"credential","version":2,"spec":{"description":"Website login","fields":{"password":{"type":"password","required":true,"sensitive":true,"value":"never-print"}}},"state":{"status":"pending_collection","fields":{"password":{"has_value":false,"value":"never-print"}}},"action":{"name":"collect","url":"https://vault.kernel.sh/collect#token=item.random","expires_at":"2026-10-01T00:00:00Z"},"available_operations":[{"type":"collect","description":"Open the form"},{"type":"fill","description":"Fill the form"}],"available_expansions":[]}`
+const credentialFixture = `{"id":"credential-1","key":"login","type":"credential","version":2,"spec":{"description":"Website login","fields":[{"name":"password","type":"password","required":true,"sensitive":true,"value":"never-print"}]},"state":{"status":"pending_collection","fields":{"password":{"has_value":false,"value":"never-print"}}},"action":{"name":"collect","url":"https://vault.kernel.sh/collect#token=item.random","expires_at":"2026-10-01T00:00:00Z"},"available_operations":[{"type":"collect","description":"Open the form"},{"type":"fill","description":"Fill the form"}],"available_expansions":[]}`
 
 func credentialSpecFile(t *testing.T, data string) string {
 	t.Helper()
@@ -42,12 +42,12 @@ func TestCredentialCreateAndUpdate(t *testing.T) {
 					assert.JSONEq(t, `{"fields":{"password":{"value":null}}}`, string(body["spec"]))
 				} else {
 					assert.Equal(t, "PUT", r.Method)
-					assert.JSONEq(t, `{"fields":{"password":{"type":"password","required":true}}}`, string(body["spec"]))
+					assert.JSONEq(t, `{"fields":[{"name":"password","type":"password","required":true}]}`, string(body["spec"]))
 				}
 				w.Header().Set("Content-Type", "application/json")
 				io.WriteString(w, credentialFixture)
 			})
-			args := []string{"vaults", "credentials", "create", "user", "login", "--spec-file", credentialSpecFile(t, `{"fields":{"password":{"type":"password","required":true}}}`), "-o", "json"}
+			args := []string{"vaults", "credentials", "create", "user", "login", "--spec-file", credentialSpecFile(t, `{"fields":[{"name":"password","type":"password","required":true}]}`), "-o", "json"}
 			if update {
 				args[2] = "update"
 				args[6] = credentialSpecFile(t, `{"fields":{"password":{"value":null}}}`)
@@ -75,7 +75,7 @@ func TestCredentialWriteErrorsAreRedactedAndNotRetried(t *testing.T) {
 				io.WriteString(w, `{"message":"secret-echo"}`)
 			})
 			c := VaultsCmd{vaults: &client.Vaults}
-			err := c.saveCredential(context.Background(), "user", "login", []byte(`{"fields":{"password":{"type":"password","value":"secret-echo"}}}`), false, 0, "", "json", false)
+			err := c.saveCredential(context.Background(), "user", "login", []byte(`{"fields":[{"name":"password","type":"password","value":"secret-echo"}]}`), false, 0, "", "json", false)
 			require.Error(t, err)
 			assert.NotContains(t, err.Error(), "secret-echo")
 			assert.Equal(t, 1, calls)
diff --git a/cmd/vaults_fill_credentials_test.go b/cmd/vaults_fill_credentials_test.go
index 2432d9a5..ee9e6c26 100644
--- a/cmd/vaults_fill_credentials_test.go
+++ b/cmd/vaults_fill_credentials_test.go
@@ -13,13 +13,13 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-const readyFillCredentialFixture = `{"id":"credential-1","type":"credential","spec":{"fields":{"expiration":{"type":"password"},"custom field":{"type":"text"},"otp":{"type":"totp"}}},"state":{"status":"ready"},"available_operations":[{"type":"fill","description":"Fill credential fields."}]}`
+const readyFillCredentialFixture = `{"id":"credential-1","type":"credential","spec":{"fields":[{"name":"expiration","type":"password"},{"name":"custom_field","type":"text"},{"name":"otp","type":"totp"}]},"state":{"status":"ready"},"available_operations":[{"type":"fill","description":"Fill credential fields."}]}`
 
 func TestVaultFillBothItemTypesAndInputs(t *testing.T) {
 	for _, input := range []string{"params", "spec-file"} {
 		for _, test := range []struct{ name, item, params, result string }{
 			{"card", readyFillCardFixture, fillParamsFixture, completedFillFixture},
-			{"credential", readyFillCredentialFixture, `{"browser_id":"browser-id","fields":[{"field":"expiration","selector":"#password"},{"field":"custom field","selector":"#custom"},{"field":"otp","selector":"#code"}]}`, completedFillFixture},
+			{"credential", readyFillCredentialFixture, `{"browser_id":"browser-id","fields":[{"field":"expiration","selector":"#password"},{"field":"custom_field","selector":"#custom"},{"field":"otp","selector":"#code"}]}`, completedFillFixture},
 			{"credential URL", readyFillCredentialFixture, `{"browser_id":"browser-id","page_url":"http://localhost/login","fields":[{"field":"expiration","selector":"#password"}]}`, `{"type":"fill","status":"completed","fields":[{"index":0,"status":"filled"}]}`},
 		} {
 			t.Run(input+"/"+test.name, func(t *testing.T) {
@@ -56,7 +56,7 @@ func TestVaultCredentialFillValidation(t *testing.T) {
 		for _, params := range []string{
 			`{"browser_id":"id","fields":[{"field":"unknown","selector":"#field"}]}`,
 			`{"browser_id":"id","fields":[{"field":"expiration","selector":"#field","format":"MM/YY"}]}`,
-			`{"browser_id":"id","fields":[{"field":"custom field","selector":"#field","format":"MM/YYYY"}]}`,
+			`{"browser_id":"id","fields":[{"field":"custom_field","selector":"#field","format":"MM/YYYY"}]}`,
 			`{"browser_id":"id","fields":[{"field":"expiration","selector":"#field","value":"secret-sentinel"}]}`,
 			`{"browser_id":"id","browser_id":"secret-sentinel","fields":[{"field":"expiration","selector":"#field"}]}`,
 		} {
@@ -106,7 +106,7 @@ func TestCredentialFillCLIOutcomes(t *testing.T) {
 				io.WriteString(w, result)
 			}))
 			defer server.Close()
-			out, stderr, exit := runVaultFillCLI(t, server.URL, "fill", "--params", `{"browser_id":"id","fields":[{"field":"expiration","selector":"#password"},{"field":"custom field","selector":"#custom"},{"field":"otp","selector":"#code"}]}`, "-o", "json")
+			out, stderr, exit := runVaultFillCLI(t, server.URL, "fill", "--params", `{"browser_id":"id","fields":[{"field":"expiration","selector":"#password"},{"field":"custom_field","selector":"#custom"},{"field":"otp","selector":"#code"}]}`, "-o", "json")
 			assert.True(t, json.Valid([]byte(out)))
 			assert.JSONEq(t, result, out)
 			assert.Empty(t, stderr)
diff --git a/cmd/vaults_output.go b/cmd/vaults_output.go
index 5616e52b..167af945 100644
--- a/cmd/vaults_output.go
+++ b/cmd/vaults_output.go
@@ -41,7 +41,7 @@ var vaultItemFields = vaultOutputFields{
 		"provider": nil, "wallet": nil, "user_id": nil, "payment_method_id": nil, "card_id": nil,
 		"amount": nil, "currency": nil, "merchant": nil, "merchant_name": nil, "merchant_url": nil,
 		"context": nil, "expires_at": nil, "description": nil,
-		"fields":          {"*": vaultFieldsOf("type required sensitive")},
+		"fields":          vaultFieldsOf("name type required sensitive"),
 		"provider_config": vaultFieldsOf("id name"),
 		"authorization":   {"method": nil, "client": {"type": nil, "provider_config": vaultFieldsOf("id name")}},
 		"totals":          vaultTotalFields,
@@ -134,11 +134,14 @@ func filterVaultJSON(raw json.RawMessage, fields vaultOutputFields) (json.RawMes
 }
 
 func preservePublicCredentialValues(source, result vaultJSON) error {
+	type credentialDefinition struct {
+		Name      string `json:"name"`
+		Type      string `json:"type"`
+		Sensitive *bool  `json:"sensitive"`
+	}
+	// Definitions are an ordered array keyed by name; state values stay keyed by name.
 	var spec struct {
-		Fields map[string]struct {
-			Type      string `json:"type"`
-			Sensitive *bool  `json:"sensitive"`
-		} `json:"fields"`
+		Fields []credentialDefinition `json:"fields"`
 	}
 	var values struct {
 		Fields map[string]struct {
@@ -149,8 +152,12 @@ func preservePublicCredentialValues(source, result vaultJSON) error {
 	if json.Unmarshal(source["spec"], &spec) != nil || json.Unmarshal(source["state"], &values) != nil || values.Fields == nil {
 		return nil
 	}
+	definitions := make(map[string]credentialDefinition, len(spec.Fields))
+	for _, definition := range spec.Fields {
+		definitions[definition.Name] = definition
+	}
 	for name, field := range values.Fields {
-		definition := spec.Fields[name]
+		definition := definitions[name]
 		if definition.Sensitive == nil || *definition.Sensitive || (definition.Type != "text" && definition.Type != "email") || !field.HasValue {
 			field.Value = nil
 		}
diff --git a/cmd/vaults_public_values_test.go b/cmd/vaults_public_values_test.go
index 192c86ad..960a8f32 100644
--- a/cmd/vaults_public_values_test.go
+++ b/cmd/vaults_public_values_test.go
@@ -12,10 +12,10 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-const publicCredentialFixture = `{"id":"credential-1","key":"login","type":"credential","version":2,"spec":{"description":"Example","fields":{"username":{"type":"text","sensitive":false},"email":{"type":"email","sensitive":false},"password":{"type":"password"},"otp":{"type":"totp","sensitive":true}}},"state":{"status":"ready","fields":{"username":{"has_value":true,"value":"user-123"},"email":{"has_value":true,"value":"user@example.com"},"password":{"has_value":true,"value":"private-password"},"otp":{"has_value":true,"value":"private-seed"}}},"action":{"name":"collect","url":"https://vault.example/collect#token=user-123.token"},"available_operations":[{"type":"collect","description":"Open form"}],"available_expansions":[]}`
+const publicCredentialFixture = `{"id":"credential-1","key":"login","type":"credential","version":2,"spec":{"description":"Example","fields":[{"name":"username","type":"text","sensitive":false},{"name":"email","type":"email","sensitive":false},{"name":"password","type":"password"},{"name":"otp","type":"totp","sensitive":true}]},"state":{"status":"ready","fields":{"username":{"has_value":true,"value":"user-123"},"email":{"has_value":true,"value":"user@example.com"},"password":{"has_value":true,"value":"private-password"},"otp":{"has_value":true,"value":"private-seed"}}},"action":{"name":"collect","url":"https://vault.example/collect#token=user-123.token"},"available_operations":[{"type":"collect","description":"Open form"}],"available_expansions":[]}`
 
 func TestVaultPublicValuesAcrossCommands(t *testing.T) {
-	spec := credentialSpecFile(t, `{"fields":{"username":{"type":"text","sensitive":false,"value":"user-123"}}}`)
+	spec := credentialSpecFile(t, `{"fields":[{"name":"username","type":"text","sensitive":false,"value":"user-123"}]}`)
 	update := credentialSpecFile(t, `{"fields":{"username":{"value":"user-123"}}}`)
 	for _, args := range [][]string{
 		{"vaults", "credentials", "create", "user-123", "login", "--spec-file", spec},
@@ -55,7 +55,7 @@ func TestVaultPublicValueBoundary(t *testing.T) {
 		{"text", "false", false, false},
 	} {
 		t.Run(fmt.Sprint(tc), func(t *testing.T) {
-			raw := fmt.Sprintf(`{"type":"credential","spec":{"fields":{"field":{"type":%q,"sensitive":%s}}},"state":{"fields":{"field":{"has_value":%t,"value":"test-value"}}}}`, tc.kind, tc.sensitive, tc.hasValue)
+			raw := fmt.Sprintf(`{"type":"credential","spec":{"fields":[{"name":"field","type":%q,"sensitive":%s}]},"state":{"fields":{"field":{"has_value":%t,"value":"test-value"}}}}`, tc.kind, tc.sensitive, tc.hasValue)
 			out, err := filterVaultJSON(json.RawMessage(raw), vaultItemFields)
 			require.NoError(t, err)
 			assert.Equal(t, tc.visible, strings.Contains(string(out), "test-value"))
diff --git a/cmd/vaults_sdk_contract_test.go b/cmd/vaults_sdk_contract_test.go
index 29fb41eb..f6ae322b 100644
--- a/cmd/vaults_sdk_contract_test.go
+++ b/cmd/vaults_sdk_contract_test.go
@@ -66,7 +66,7 @@ func TestCredentialUpdateIdentityPrecondition(t *testing.T) {
 
 func TestCredentialInitialValuesWithReleasedSDK(t *testing.T) {
 	t.Setenv("KERNEL_PROJECT", "")
-	spec := `{"description":"Example","fields":{"username":{"type":"text","sensitive":false,"value":"synthetic-user"},"email":{"type":"email","sensitive":false,"value":"test@example.com"},"password":{"type":"password","sensitive":true,"value":"synthetic-password"},"otp":{"type":"totp","sensitive":true,"value":"JBSWY3DPEHPK3PXP"}}}`
+	spec := `{"description":"Example","fields":[{"name":"username","type":"text","sensitive":false,"value":"synthetic-user"},{"name":"email","type":"email","sensitive":false,"value":"test@example.com"},{"name":"password","type":"password","sensitive":true,"value":"synthetic-password"},{"name":"otp","type":"totp","sensitive":true,"value":"JBSWY3DPEHPK3PXP"}]}`
 	calls := 0
 	client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) {
 		calls++
@@ -123,3 +123,51 @@ func TestVaultPreparationEventsAreProjected(t *testing.T) {
 	assert.Contains(t, out, `"preparation_id": "prep-1"`)
 	assert.NotContains(t, out, "never-print")
 }
+
+func TestCredentialFieldOrderIsPreserved(t *testing.T) {
+	t.Setenv("KERNEL_PROJECT", "")
+	spec := `{"description":"Example","fields":[{"name":"email","type":"email","required":true,"sensitive":false},{"name":"password","type":"password","required":true,"sensitive":true},{"name":"otp","type":"totp","required":false,"sensitive":true}]}`
+	client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) {
+		var body struct {
+			Spec struct {
+				Fields json.RawMessage `json:"fields"`
+			} `json:"spec"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		// The website's top-to-bottom order must reach the API unchanged.
+		assert.Equal(t, `[{"name":"email","type":"email","required":true,"sensitive":false},{"name":"password","type":"password","required":true,"sensitive":true},{"name":"otp","type":"totp","required":false,"sensitive":true}]`, string(body.Spec.Fields))
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintf(w, `{"id":"credential-1","key":"login","type":"credential","version":1,"spec":%s,"state":{"status":"pending_collection","fields":{"email":{"has_value":false},"password":{"has_value":false},"otp":{"has_value":false}}},"available_operations":[],"available_expansions":[]}`, spec)
+	})
+	out, _, err := executeVaultCommand(t, client, "vaults", "credentials", "create", "user-123", "login", "--spec-file", credentialSpecFile(t, spec), "-o", "json")
+	require.NoError(t, err)
+	assert.Less(t, strings.Index(out, `"email"`), strings.Index(out, `"password"`))
+	assert.Less(t, strings.Index(out, `"password"`), strings.Index(out, `"otp"`))
+	for _, name := range []string{"email", "password", "otp"} {
+		assert.Contains(t, out, fmt.Sprintf(`"name": %q`, name))
+	}
+}
+
+func TestCredentialKeyedFieldsAreRejectedWithGuidance(t *testing.T) {
+	t.Setenv("KERNEL_PROJECT", "")
+	client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) {
+		t.Error("a keyed create spec must not reach the API")
+	})
+	_, _, err := executeVaultCommand(t, client, "vaults", "credentials", "create", "user-123", "login",
+		"--spec-file", credentialSpecFile(t, `{"fields":{"password":{"type":"password","value":"secret-echo"}}}`))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "ordered array")
+	assert.NotContains(t, err.Error(), "secret-echo")
+}
+
+func TestCredentialFieldsRequireNames(t *testing.T) {
+	t.Setenv("KERNEL_PROJECT", "")
+	client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) {
+		t.Error("an unnamed field must not reach the API")
+	})
+	_, _, err := executeVaultCommand(t, client, "vaults", "credentials", "create", "user-123", "login",
+		"--spec-file", credentialSpecFile(t, `{"fields":[{"type":"password","value":"secret-echo"}]}`))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "name")
+	assert.NotContains(t, err.Error(), "secret-echo")
+}
diff --git a/go.mod b/go.mod
index ce177f64..ac688f40 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.108.1-0.20260917195741-6367486e6e06
+	github.com/kernel/kernel-go-sdk v0.108.1-0.20260917210657-3038f83eb3f7
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index 3427968d..39ce8880 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.108.1-0.20260917195741-6367486e6e06 h1:VqkiahjT/KyvwQxlEqH/RCZjNd7ZFteoYHTuGj8uNfA=
-github.com/kernel/kernel-go-sdk v0.108.1-0.20260917195741-6367486e6e06/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.108.1-0.20260917210657-3038f83eb3f7 h1:JCSdNBocuT1xb4jig5f1ChwUGcQG3S5w2dNAstrk0r4=
+github.com/kernel/kernel-go-sdk v0.108.1-0.20260917210657-3038f83eb3f7/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

From 7176b477373369268b8820bd74f8e3ad292b4f09 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 21:41:31 +0000
Subject: [PATCH 06/10] chore: bump Go SDK to 5cfcedd and document opaque
 AgentCard card IDs

Updates github.com/kernel/kernel-go-sdk to
v0.108.1-0.20260917213155-5cfceddfb1ea (5cfcedd).

The SDK change ("Accept opaque AgentCard vaulted card IDs") revises the
card_id contract on CardVaultItemSpecAgentcard: the value is an opaque ID
returned by AgentCard and must be passed through unchanged, without
assuming a prefix or format. The `vaults cards create|update` help text
still advertised a `vc_...` shape, so it is updated to match.

The CLI already forwards card_id verbatim inside the --spec JSON (there is
no --card-id flag), so no behavior change was needed; a regression test now
pins that prefixed, unprefixed and punctuated IDs all round-trip unchanged.

A full enumeration of all 165 SDK methods in api.md against the CLI command
tree found no missing commands. The six client.ConfigRegistry.* methods are
marked x-cli-skip in openapi.yaml and are intentionally absent. The
AgentCard and Link card spec field sets in the help text were verified
complete against the SDK param structs. No new params or fields were added
by this SDK bump, so no new flags were required.

Tested: go build ./..., go vet ./..., go test ./... (all pass);
vaults cards create --help (help renders on one line);
against production API: auth status, app list, vaults list,
vaults items list agentcard-vault, vaults items get agentcard-vault.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 cmd/vaults_help.go |  2 +-
 cmd/vaults_test.go | 26 ++++++++++++++++++++++++++
 go.mod             |  2 +-
 go.sum             |  4 ++--
 4 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/cmd/vaults_help.go b/cmd/vaults_help.go
index 8e3dc275..e9b38ab7 100644
--- a/cmd/vaults_help.go
+++ b/cmd/vaults_help.go
@@ -69,7 +69,7 @@ type AgentCardCardSpec = {
   merchant: string;           // approval-screen name; 1..120 characters
   amount: number;             // integer minor units; 1..9007199254740991
   currency: string;           // three letters
-  card_id?: string;           // vc_...; otherwise chosen at approval
+  card_id?: string;           // opaque AgentCard ID, pass through unchanged; else chosen at approval
 };
 
 type LinkLineItem = {
diff --git a/cmd/vaults_test.go b/cmd/vaults_test.go
index 14942156..5ec933b3 100644
--- a/cmd/vaults_test.go
+++ b/cmd/vaults_test.go
@@ -303,6 +303,32 @@ func TestVaultCardRequestMapping(t *testing.T) {
 	}
 }
 
+func TestVaultCardAgentcardCardIDIsOpaque(t *testing.T) {
+	t.Setenv("KERNEL_PROJECT", "project-test")
+	// AgentCard card IDs are opaque: the CLI must forward whatever the caller
+	// supplies without assuming a prefix or format.
+	for _, cardID := range []string{"vc_chosen", "chosen", "card-123", "AGC/9f2e::7"} {
+		t.Run(cardID, func(t *testing.T) {
+			client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) {
+				var body map[string]json.RawMessage
+				require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+				var spec struct {
+					CardID string `json:"card_id"`
+				}
+				require.NoError(t, json.Unmarshal(body["spec"], &spec))
+				assert.Equal(t, cardID, spec.CardID)
+				w.Header().Set("Content-Type", "application/json")
+				_, _ = io.WriteString(w, requestedCardFixture)
+			})
+			spec := fmt.Sprintf(`{"wallet":"wallet-1","amount":1234,"currency":"usd","merchant":"Example Shop","card_id":%q}`, cardID)
+			_, _, err := executeVaultCommand(t, client,
+				"vaults", "cards", "create", "checkout", "order-1", "-o", "json",
+				"--provider", "agentcard", "--spec", spec)
+			require.NoError(t, err)
+		})
+	}
+}
+
 func TestVaultInvokeRequiresAdvertisedOperation(t *testing.T) {
 	t.Setenv("KERNEL_PROJECT", "project-test")
 	for _, state := range []string{"requested", "pending_authorization", "ready", "consumed", "expired", "declined"} {
diff --git a/go.mod b/go.mod
index ac688f40..b1f6bf1d 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.108.1-0.20260917210657-3038f83eb3f7
+	github.com/kernel/kernel-go-sdk v0.108.1-0.20260917213155-5cfceddfb1ea
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index 39ce8880..e703b32d 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.108.1-0.20260917210657-3038f83eb3f7 h1:JCSdNBocuT1xb4jig5f1ChwUGcQG3S5w2dNAstrk0r4=
-github.com/kernel/kernel-go-sdk v0.108.1-0.20260917210657-3038f83eb3f7/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.108.1-0.20260917213155-5cfceddfb1ea h1:x6h74lPqdIdkUGCxmR7mVPE7pcNj8n+b1/xt9tCLdgA=
+github.com/kernel/kernel-go-sdk v0.108.1-0.20260917213155-5cfceddfb1ea/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

From 0601cdf01da844a842fa8a3a3a409aac6ab5d20a Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 21:45:47 +0000
Subject: [PATCH 07/10] chore: bump Go SDK to v0.109.0 (5c91a27)

Updates github.com/kernel/kernel-go-sdk from
v0.108.1-0.20260917213155-5cfceddfb1ea to the v0.109.0 release (5c91a27).

Coverage analysis: api.md is byte-identical across this bump, so no API
methods, params or fields were added and no new commands or flags are
required. The only source changes relative to the previously pinned
pseudo-version are the release version stamp and a new
ConfigRegistryAnalysisService.WaitForResult convenience helper. All six
/config-registry endpoints are marked x-cli-skip in openapi.yaml, so that
helper is intentionally out of CLI scope.

A full enumeration of all 165 api.md methods against the CLI command tree
found no gaps. The six methods that do not match cmd/ by name are covered
through the SDK's *Streaming variants (Deployments.FollowStreaming,
Invocations.FollowStreaming, Browsers.Logs.StreamStreaming,
Browsers.Telemetry.StreamStreaming, Browsers.Fs.Watch.EventsStreaming,
Browsers.Process.StdoutStreamStreaming). The OrgLimits concurrency fields and
the opaque AgentCard card_id help text, both landed earlier on this branch,
were re-verified against the release.

Tested: go build ./..., go vet ./..., go test ./... (all pass); against the
production API: org limits get (both concurrency fields render), vaults list,
vaults cards create --help.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index b1f6bf1d..196dbe1f 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.108.1-0.20260917213155-5cfceddfb1ea
+	github.com/kernel/kernel-go-sdk v0.109.0
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index e703b32d..c34e2e2f 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.108.1-0.20260917213155-5cfceddfb1ea h1:x6h74lPqdIdkUGCxmR7mVPE7pcNj8n+b1/xt9tCLdgA=
-github.com/kernel/kernel-go-sdk v0.108.1-0.20260917213155-5cfceddfb1ea/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.109.0 h1:en9sI4w4AW0CptJn92KjpdvrQtzWohKcCu0ahmI6Ncg=
+github.com/kernel/kernel-go-sdk v0.109.0/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

From 51d68109a081feb36bf277181be527749e097a34 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Fri, 18 Sep 2026 19:53:51 +0000
Subject: [PATCH 08/10] Update SDK to c4dc2a2 and surface credential field
 labels

Bumps kernel-go-sdk from v0.109.0 to
v0.109.1-0.20260918194421-c4dc2a28cd2b, which adds an optional `label`
to CredentialVaultFieldDefinition and CredentialVaultFieldInputParam.

`label` is non-secret display metadata for the hosted collection form. It
already reached the API because credential specs are passed through from
--spec-file, but the display-safe output projection dropped it: the
spec.fields allowlist in printVaultItem only permitted name/type/required/
sensitive, so every read silently discarded a label the API returned.
Add it to the allowlist and document it in the command help and README.

A full enumeration of api.md (165 methods) against the CLI command tree
(176 commands) found no missing commands. The six config-registry
endpoints are marked x-cli-skip in openapi.yaml and remain unexposed;
Invocations.Follow and Deployments.Follow are covered by the streaming
paths in logs/invoke/deploy logs.

Tested against the live API: vaults credentials create with labelled
text and password fields round-trips `label` to the API and back, and
vaults items get/list both render it. Verified the pre-fix binary
stripped `label` from the same responses. Sensitive values stay omitted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 README.md                        |  5 ++++-
 cmd/vaults_credentials.go        |  4 +++-
 cmd/vaults_output.go             |  2 +-
 cmd/vaults_public_values_test.go | 38 ++++++++++++++++++++++++++++++++
 go.mod                           |  2 +-
 go.sum                           |  4 ++--
 6 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 78d9dba4..ae9937ca 100644
--- a/README.md
+++ b/README.md
@@ -299,7 +299,10 @@ Do not automatically retry failed/unknown fills or fall back to aliases.
 Create specs list `fields` as an ordered array. Each entry carries a stable `name`
 (letters, digits, and underscores, starting with a letter) that keys values, updates,
 and fills. Order is preserved: list fields in the same top-to-bottom order as the
-website, because the collection form renders that order unchanged.
+website, because the collection form renders that order unchanged. An optional `label`
+supplies non-secret display text for that field on the collection form; it never
+affects value keys, updates, or fills. Use a single trimmed line of at most 128 UTF-8
+bytes, and it is returned as metadata in `get`/`list` output.
 
 Use `credentials update <vault> <key> --version <version> --spec-file changes.json`
 with a spec such as `{"fields":{"password":{"value":"replacement"}}}`; update specs key
diff --git a/cmd/vaults_credentials.go b/cmd/vaults_credentials.go
index 84006e7b..5162a525 100644
--- a/cmd/vaults_credentials.go
+++ b/cmd/vaults_credentials.go
@@ -25,7 +25,9 @@ Use a protected JSON file or stdin, never secret values in shell arguments.
 The spec contains description and fields as an ordered array of named definitions.
 Inspect the website and list fields in its natural top-to-bottom order because the
 user-facing collection form renders that order unchanged. Field types are text,
-email, password, and totp; definitions accept name, required, sensitive, and value.
+email, password, and totp; definitions accept name, label, required, sensitive, and value.
+Optional label is non-secret display text for the form; it never changes value keys,
+updates, or fills. Use a single trimmed line of at most 128 UTF-8 bytes.
 Set description to the recognizable site name only, e.g. "Hacker News", not
 "Hacker News sign-in credentials". This text is the user-facing form title.
 Set sensitive:false explicitly for ordinary usernames and email addresses.
diff --git a/cmd/vaults_output.go b/cmd/vaults_output.go
index 49270fcf..9d1c60bd 100644
--- a/cmd/vaults_output.go
+++ b/cmd/vaults_output.go
@@ -41,7 +41,7 @@ var vaultItemFields = vaultOutputFields{
 		"provider": nil, "wallet": nil, "user_id": nil, "payment_method_id": nil, "card_id": nil,
 		"amount": nil, "currency": nil, "merchant": nil, "merchant_name": nil, "merchant_url": nil,
 		"context": nil, "expires_at": nil, "description": nil,
-		"fields":          vaultFieldsOf("name type required sensitive"),
+		"fields":          vaultFieldsOf("name label type required sensitive"),
 		"provider_config": vaultFieldsOf("id name"),
 		"authorization":   {"method": nil, "client": {"type": nil, "provider_config": vaultFieldsOf("id name")}},
 		"totals":          vaultTotalFields,
diff --git a/cmd/vaults_public_values_test.go b/cmd/vaults_public_values_test.go
index 669e6e63..4c9b0670 100644
--- a/cmd/vaults_public_values_test.go
+++ b/cmd/vaults_public_values_test.go
@@ -118,3 +118,41 @@ func TestVaultFillActionableErrors(t *testing.T) {
 		})
 	}
 }
+
+// label is non-secret display metadata: it must reach the API unchanged on create
+// and survive the display-safe output projection on every read.
+func TestVaultCredentialLabelsRoundTrip(t *testing.T) {
+	t.Setenv("KERNEL_PROJECT", "")
+	spec := `{"description":"Hacker News","fields":[{"name":"username","label":"Username or email","type":"text","required":true,"sensitive":false},{"name":"password","label":"Password","type":"password","required":true,"sensitive":true}]}`
+	fixture := fmt.Sprintf(`{"id":"credential-1","key":"login","type":"credential","version":1,"spec":%s,"state":{"status":"pending_collection","fields":{"username":{"has_value":false},"password":{"has_value":false}}},"available_operations":[],"available_expansions":[]}`, spec)
+	sent := ""
+	client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) {
+		var body struct {
+			Spec struct {
+				Fields json.RawMessage `json:"fields"`
+			} `json:"spec"`
+		}
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+		sent = string(body.Spec.Fields)
+		w.Header().Set("Content-Type", "application/json")
+		io.WriteString(w, fixture)
+	})
+	out, _, err := executeVaultCommand(t, client, "vaults", "credentials", "create", "user-123", "login", "--spec-file", credentialSpecFile(t, spec), "-o", "json")
+	require.NoError(t, err)
+	assert.Contains(t, sent, `"label":"Username or email"`)
+	assert.Contains(t, sent, `"label":"Password"`)
+	assert.Contains(t, out, `"label": "Username or email"`)
+	assert.Contains(t, out, `"label": "Password"`)
+}
+
+// A label is metadata only; it must never carry a value into the output.
+func TestVaultCredentialLabelDoesNotExposeValues(t *testing.T) {
+	fixture := strings.Replace(publicCredentialFixture,
+		`{"name":"password","type":"password"}`,
+		`{"name":"password","label":"Password","type":"password"}`, 1)
+	require.NotEqual(t, publicCredentialFixture, fixture)
+	out, err := filterVaultJSON(json.RawMessage(fixture), vaultItemFields)
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `"label":"Password"`)
+	assert.NotContains(t, string(out), "private-password")
+}
diff --git a/go.mod b/go.mod
index 196dbe1f..fea07dc7 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.109.0
+	github.com/kernel/kernel-go-sdk v0.109.1-0.20260918194421-c4dc2a28cd2b
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index c34e2e2f..e8b3adea 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.109.0 h1:en9sI4w4AW0CptJn92KjpdvrQtzWohKcCu0ahmI6Ncg=
-github.com/kernel/kernel-go-sdk v0.109.0/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.109.1-0.20260918194421-c4dc2a28cd2b h1:S2z/v7V8lUYRr2k4oJqD8nvJf5chPTqPHGWgic5xQeY=
+github.com/kernel/kernel-go-sdk v0.109.1-0.20260918194421-c4dc2a28cd2b/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

From 5c5dc6232dd9a9ec5b97e61eca1612e63e3fdf6e Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Fri, 18 Sep 2026 19:57:56 +0000
Subject: [PATCH 09/10] chore: bump Go SDK to released v0.110.0 (a414a68)

The credential field `label` support landed here against the pre-release
commit c4dc2a2 (pseudo-version v0.109.1-0.20260918194421-c4dc2a28cd2b).
That change is now published as the tagged v0.110.0 release, so pin the
release instead of the pseudo-version; the SDK source is identical.

Also guards the credentials help text with a steering assertion so the
`label` documentation is not silently dropped by a later edit.

A full enumeration of all 165 api.md methods against the CLI command tree
found no missing commands; the 6 config-registry methods are x-cli-skip.

Tested against the live API: vaults credentials create with labelled text
and password fields round-trips `label` through create, items get, and
items list; the test vault was deleted afterwards. go build ./... and
go test ./... pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 cmd/vaults_credential_steering_test.go | 1 +
 go.mod                                 | 2 +-
 go.sum                                 | 4 ++--
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/cmd/vaults_credential_steering_test.go b/cmd/vaults_credential_steering_test.go
index 7f2e1667..173f9bfe 100644
--- a/cmd/vaults_credential_steering_test.go
+++ b/cmd/vaults_credential_steering_test.go
@@ -36,4 +36,5 @@ func TestCredentialHelpSteering(t *testing.T) {
 	assert.Contains(t, cmd.Example, `"description":"Hacker News"`)
 	assert.Contains(t, cmd.Example, `"fields":[{"name":"username"`)
 	assert.Contains(t, cmd.Example, `"sensitive":false`)
+	assert.Contains(t, cmd.Long, "definitions accept name, label, required, sensitive")
 }
diff --git a/go.mod b/go.mod
index fea07dc7..dcae6b62 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.109.1-0.20260918194421-c4dc2a28cd2b
+	github.com/kernel/kernel-go-sdk v0.110.0
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index e8b3adea..1f47cec9 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.109.1-0.20260918194421-c4dc2a28cd2b h1:S2z/v7V8lUYRr2k4oJqD8nvJf5chPTqPHGWgic5xQeY=
-github.com/kernel/kernel-go-sdk v0.109.1-0.20260918194421-c4dc2a28cd2b/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.110.0 h1:2KkE0hAlJav5xg2818Eg+mIK2p1F2nDZ0rZdA2EO1QQ=
+github.com/kernel/kernel-go-sdk v0.110.0/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

From 863ed39e5efd6e9693bd7e4253d5ca673cb10775 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Fri, 18 Sep 2026 23:36:09 +0000
Subject: [PATCH 10/10] chore: bump Go SDK to 6e379e6 (proxy_error raw_code)

Bumps kernel-go-sdk from v0.110.0 to
v0.110.1-0.20260918232759-6e379e6df7b9. The only change is in
browsertelemetry.go: the proxy_error event's code enum gains
origin_response_incomplete, restricted_route_unavailable, and unknown,
and BrowserProxyErrorEventData gains raw_code (the sanitized
X-Kernel-Proxy-Error header, present only when code is unknown).

No CLI change is needed for that field. Unlike the credential-label case,
telemetry output has no display allowlist: `browsers telemetry events`
and `telemetry stream` render the Seq/Time/Category/Type table from the
event envelope and emit the event body verbatim under `-o json`, so
raw_code and the new codes flow through on their own.

A full enumeration of api.md (165 methods) against the CLI command tree
(175 commands) found no missing commands or flags. The six
config-registry endpoints are marked x-cli-skip in openapi.yaml and
remain unexposed, as does POST /auth/connections/{id}/exchange, which
the SDK does not surface; the other 159 methods all map to a command.
No request param struct changed since v0.110.0, so no new flags.

Also drops a stale assertion in TestCredentialHelpSteering. The branch
and main both added credential field labels; main's wording of the help
text won the merge, but the branch's assertion on its own earlier
phrasing ("definitions accept name, label, required, sensitive")
survived and failed. The neighboring assertion on "optional non-secret
human-readable label" already covers the same guidance.

Tested against the live API: browsers create --telemetry network,page;
browsers curl; browsers telemetry events (table and -o json);
browsers delete. Full go test ./... passes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 cmd/vaults_credential_steering_test.go | 1 -
 go.mod                                 | 2 +-
 go.sum                                 | 4 ++--
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/cmd/vaults_credential_steering_test.go b/cmd/vaults_credential_steering_test.go
index 065c7351..4ca0b47b 100644
--- a/cmd/vaults_credential_steering_test.go
+++ b/cmd/vaults_credential_steering_test.go
@@ -39,5 +39,4 @@ func TestCredentialHelpSteering(t *testing.T) {
 	assert.Contains(t, cmd.Example, `"fields":[{"name":"username"`)
 	assert.Contains(t, cmd.Example, `"label":"Username"`)
 	assert.Contains(t, cmd.Example, `"sensitive":false`)
-	assert.Contains(t, cmd.Long, "definitions accept name, label, required, sensitive")
 }
diff --git a/go.mod b/go.mod
index dcae6b62..54673228 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.110.0
+	github.com/kernel/kernel-go-sdk v0.110.1-0.20260918232759-6e379e6df7b9
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80
diff --git a/go.sum b/go.sum
index 1f47cec9..7f091b2b 100644
--- a/go.sum
+++ b/go.sum
@@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.110.0 h1:2KkE0hAlJav5xg2818Eg+mIK2p1F2nDZ0rZdA2EO1QQ=
-github.com/kernel/kernel-go-sdk v0.110.0/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.110.1-0.20260918232759-6e379e6df7b9 h1:pXDNpTFqbNjXMSmMYlbzAIpqlVVuyaNP1Xzsm36qvRI=
+github.com/kernel/kernel-go-sdk v0.110.1-0.20260918232759-6e379e6df7b9/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=