release: 0.122.0

[kernel-internal]

Automated Release PR

0.122.0 (2026-10-09)

Features

• Accept client-encrypted credential values in vault items (a289cba)
• Add feature-gated Korean ISP proxies (56785ca)
• Describe vault fill as safe to retry (e419d6d)
• Infer a challenge result for unobserved captcha providers in the relay (0e4734c)
• Support proxy routes in browser pools (669ea52)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

Medium Risk
Adds client-side encrypted credential submission and changes retry semantics for vault fill; networking and captcha event shape updates may affect integrators parsing telemetry or pool proxy configuration.

Overview
Release 0.122.0 bumps the SDK to match new API surface and documentation from the Kernel OpenAPI spec.

Vault credentials: Adds client.vaults.retrieve_encryption_key and the VaultEncryptionKey type so custom credential-collection UIs can fetch a vault public key and submit encrypted_value (JWE) on credential create/update instead of plaintext value. Credential field params now document mutual exclusivity between value and encrypted_value.

Vault fill behavior: SDK docs now state that fill is safe to retry after failure, unknown, or transport errors (fill does not submit the page), replacing prior guidance to avoid automatic retries.

Browser networking: proxy_routes are documented as supported on browser pools (with proxy-v3 / Envoy requirements), apply from session start including start_url, and pool create/update docs mention clearing routes via network: {proxy_routes: []}. allowed_hosts updates are clarified: only browsers created with an allowlist can change or remove it—not add one later.

Proxies: ISP proxy country lists now include KR (feature-gated on the API).

Captcha telemetry: Challenge/solve event models gain captcha_provider, task_kind, and inferred challenge results (with optional task_id instead of challenge_id); captcha_type is marked deprecated on those events.

Also: endpoint count 174→175, changelog entry, and generated tests for retrieve_encryption_key.

^{Reviewed by Cursor Bugbot for commit ead7682. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rgarcia]

Reviewed: vault encryption key method/type and encrypted_value on credential field input/update are modeled correctly.

[kernel-internal]

🤖 Release is at https://github.com/kernel/kernel-python-sdk/releases/tag/v0.122.0 🌻