Update Go SDK to 6923472 and send the kernel credential provider

Bump github.com/kernel/kernel-go-sdk to 6923472efed1a4e7f9d6f26124c3cbd381122812
("Let Vaults fill credentials from 1Password"). The credential create spec is now
a provider union, so vaults credentials create wraps the spec as the Kernel
variant, defaults provider to "kernel", and rejects other providers. 1Password
credentials, credential_account items, and the 1pw_* operations are left to
the dedicated 1Password CLI work in #271.

Tested against the real API: vaults create, credentials create (provider
defaulted to kernel), credentials update, items get, items list, credentials
create with provider 1password (rejected client-side), vaults delete.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: kernel-internal[bot]

cmd/vaults_credentials.go

@@ -126,18 +126,9 @@ func (c VaultsCmd) saveCredential(ctx context.Context, vault, key string, data [
 		}
 		item, err = c.vaults.Items.Update(ctx, key, kernel.VaultItemUpdateParams{IDOrName: vault, OfCredentialVaultItemUpdateRequest: &request}, option.WithMaxRetries(0))
 	} else {
-		var spec kernel.CredentialVaultItemSpecInputParam
-		if json.Unmarshal(data, &spec) != nil || len(spec.Fields) == 0 {
-			if credentialSpecUsesKeyedFields(data) {
-				return fmt.Errorf("credential spec fields must be an ordered array of definitions carrying a name, not an object keyed by name")
-			}
-			return fmt.Errorf("credential spec requires fields")
-		}
-		// Names key values, updates, and fills; reject specs the form cannot address.
-		for _, field := range spec.Fields {
-			if strings.TrimSpace(field.Name) == "" {
-				return fmt.Errorf("every credential spec field requires a name")
-			}
+		spec, specErr := credentialSpecInput(data)
+		if specErr != nil {
+			return specErr
 		}
 		item, err = c.vaults.Items.Upsert(ctx, key, kernel.VaultItemUpsertParams{IDOrName: vault, OfCredential: &kernel.CredentialVaultItemRequestParam{Type: "credential", Spec: spec}}, option.WithMaxRetries(0))
 	}
@@ -147,6 +138,29 @@ func (c VaultsCmd) saveCredential(ctx context.Context, vault, key string, data [
 	return c.showItem(item, output, open)
 }
 
+// Kernel-hosted specs default the provider; other providers are not supported here.
+func credentialSpecInput(data []byte) (kernel.CredentialVaultItemSpecInputUnionParam, error) {
+	var spec kernel.KernelCredentialVaultItemSpecInputParam
+	invalid := json.Unmarshal(data, &spec) != nil
+	if !invalid && spec.Provider != "" && spec.Provider != kernel.KernelCredentialVaultItemSpecInputProviderKernel {
+		return kernel.CredentialVaultItemSpecInputUnionParam{}, fmt.Errorf("credential spec provider must be kernel")
+	}
+	if invalid || len(spec.Fields) == 0 {
+		if credentialSpecUsesKeyedFields(data) {
+			return kernel.CredentialVaultItemSpecInputUnionParam{}, fmt.Errorf("credential spec fields must be an ordered array of definitions carrying a name, not an object keyed by name")
+		}
+		return kernel.CredentialVaultItemSpecInputUnionParam{}, fmt.Errorf("credential spec requires fields")
+	}
+	spec.Provider = kernel.KernelCredentialVaultItemSpecInputProviderKernel
+	// Names key values, updates, and fills; reject specs the form cannot address.
+	for _, field := range spec.Fields {
+		if strings.TrimSpace(field.Name) == "" {
+			return kernel.CredentialVaultItemSpecInputUnionParam{}, fmt.Errorf("every credential spec field requires a name")
+		}
+	}
+	return kernel.CredentialVaultItemSpecInputUnionParam{OfKernel: &spec}, nil
+}
+
 // The create spec moved from fields keyed by name to an ordered array; point
 // callers still sending the object form at the replacement shape.
 func credentialSpecUsesKeyedFields(data []byte) bool {

cmd/vaults_credentials_test.go

@@ -42,7 +42,7 @@ func TestCredentialCreateAndUpdate(t *testing.T) {
 					assert.JSONEq(t, `{"fields":{"password":{"value":null}}}`, string(body["spec"]))
 				} else {
 					assert.Equal(t, "PUT", r.Method)
-					assert.JSONEq(t, `{"fields":[{"name":"password","label":"Account Password","type":"password","required":true}]}`, string(body["spec"]))
+					assert.JSONEq(t, `{"provider":"kernel","fields":[{"name":"password","label":"Account Password","type":"password","required":true}]}`, string(body["spec"]))
 				}
 				w.Header().Set("Content-Type", "application/json")
 				io.WriteString(w, credentialFixture)
@@ -210,3 +210,13 @@ func TestCredentialDiscoveryAndInvalidInput(t *testing.T) {
 	require.NoError(t, err)
 	assert.JSONEq(t, `{"fields":{}}`, string(data))
 }
+
+func TestCredentialSpecInputProvider(t *testing.T) {
+	spec, err := credentialSpecInput([]byte(`{"provider":"kernel","fields":[{"name":"password","type":"password"}]}`))
+	require.NoError(t, err)
+	require.NotNil(t, spec.OfKernel)
+	assert.EqualValues(t, "kernel", spec.OfKernel.Provider)
+
+	_, err = credentialSpecInput([]byte(`{"provider":"1password","account":"op","requests":{"version":2,"entries":[]}}`))
+	assert.EqualError(t, err, "credential spec provider must be kernel")
+}

cmd/vaults_sdk_contract_test.go

@@ -73,7 +73,7 @@ func TestCredentialInitialValuesWithGeneratedSDK(t *testing.T) {
 		assert.Equal(t, "PUT", r.Method)
 		var body map[string]json.RawMessage
 		require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
-		assert.JSONEq(t, spec, string(body["spec"]))
+		assert.JSONEq(t, `{"provider":"kernel",`+spec[1:], string(body["spec"]))
 		w.Header().Set("Content-Type", "application/json")
 		fmt.Fprintf(w, `{"id":"credential-1","key":"login","type":"credential","version":1,"spec":%s,"state":{"status":"ready","fields":{"otp":{"has_value":true,"value":"JBSWY3DPEHPK3PXP"}}},"available_operations":[],"available_expansions":[]}`, spec)
 	})

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.113.1-0.20260928171941-35a02850ff6e
+	github.com/kernel/kernel-go-sdk v0.113.1-0.20260929201643-6923472efed1
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80

go.sum

@@ -66,8 +66,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.113.1-0.20260928171941-35a02850ff6e h1:ZN18RLvukJXyrbrk2ra40fC0LBFVbuArYjNwO7xyRaA=
-github.com/kernel/kernel-go-sdk v0.113.1-0.20260928171941-35a02850ff6e/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.113.1-0.20260929201643-6923472efed1 h1:seWvhEEybAmGnCrIQOICdd1ibSYP/D4SQeYiSJwA7xI=
+github.com/kernel/kernel-go-sdk v0.113.1-0.20260929201643-6923472efed1/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=