@vendoai/vendo 0.4.0 → 0.4.1

package/dist/cli/cloud/device-login.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { join } from "node:path";
-import { option, positionals } from "./args.js";
+import { option } from "./args.js";
 import { isVendoKey, resolveCloudBaseUrl } from "./client.js";
 import { errorMessage, printJson } from "./output.js";
 import { deletePendingClaim, readPendingClaim, writePendingClaim } from "./pending-claim.js";
@@ -118,9 +118,11 @@ export async function runDeviceLogin(args, options = {}) {
             verificationUriComplete = resume.verification_uri_complete;
         }
         else {
-            // Optional email hint — shown to the human on the approval page.
-            const email = option(args, "--email") ?? positionals(args, ["--api-url", "--email", "--wait"])[0];
-            const claim = await postJson(fetchImpl, `${base}${CLAIM_PATH}`, "application/json", JSON.stringify(email === undefined ? {} : { login_hint: email }));
+            // No identity hint by design: the human signs in as whoever they choose
+            // on the approval page. A guessed login_hint (git email, positional arg)
+            // is an assumption that mis-attributes the claim, so the ceremony never
+            // sends one.
+            const claim = await postJson(fetchImpl, `${base}${CLAIM_PATH}`, "application/json", "{}");
             if (claim.status !== 200) {
                 const envelope = claim.body;
                 throw new Error(typeof envelope?.error?.message === "string"

package/dist/cli/shared.d.ts

@@ -1,5 +1,5 @@
 import { type Telemetry } from "@vendoai/telemetry";
-export declare const CLI_VERSION = "0.4.0";
+export declare const CLI_VERSION = "0.4.1";
 export interface Output {
     log(message: string): void;
     error(message: string): void;

package/dist/cli/shared.js

@@ -4,7 +4,7 @@ import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { initTelemetry, repoHost } from "@vendoai/telemetry";
-export const CLI_VERSION = "0.4.0";
+export const CLI_VERSION = "0.4.1";
 export const consoleOutput = {
     log: (message) => console.log(message),
     error: (message) => console.error(message),

package/dist/cli.js

@@ -18,7 +18,7 @@ Usage: vendo <command> [dir] [options]
 
 Commands:
   init [dir]      Set up Vendo: wire the handler, extract tools + theme, resolve a model key
-  login [email]   Claim a Vendo Cloud key: approve in the browser; the key lands in .env.local
+  login           Claim a Vendo Cloud key: approve in the browser; the key lands in .env.local
   doctor [dir]    Verify the install: wiring, live probes, and one real model turn (--json for agents)
 
 Advanced:
@@ -38,7 +38,6 @@ Options:
   --auth <preset>            Init only: wire this auth preset without asking (authJs, clerk, supabase, auth0, jwt, none)
   --framework <name>         Init only: override framework detection (next, express) — required non-interactively when detection fails
   --cloud-key <key>          Init only: write this Vendo Cloud key to .env.local instead of the login offer
-  --email <address>          Login only: pre-fill the approval page (login hint)
   --wait <seconds>           Login only: bound this call's polling to N seconds (agents loop re-runs; each resumes the same request), then exit resumably
   --byo                      Init only: decline the Vendo Cloud offer (bring your own model key)
   --ai-polish                Init only: consent to the AI extraction pass without a prompt (works non-interactively)
@@ -88,7 +87,7 @@ const REFINE_FLAGS = new Set(["--yes"]);
 const REFINE_VALUE_OPTIONS = ["--url", "--model-import", "--ask"];
 const SYNC_FLAGS = new Set(["--strict", "--json", "--report"]);
 const SYNC_VALUE_OPTIONS = ["--url", "--key", "--api-url"];
-const LOGIN_VALUE_OPTIONS = ["--email", "--api-url", "--wait"];
+const LOGIN_VALUE_OPTIONS = ["--api-url", "--wait"];
 /** ENG-335: options the CLI does not recognize — or value options missing
     their value — must fail loudly before anything runs. Silently dropping a
     flag is how the "--agent writes nothing" promise broke in the field: an

package/dist/wire/shared.d.ts

@@ -14,7 +14,7 @@ import type { RuntimeCaptureHandler } from "../runtime-capture.js";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export declare const VERSION = "0.4.0";
+export declare const VERSION = "0.4.1";
 export declare const BASE_PATH = "/api/vendo";
 export type SandboxVenue = "e2b" | "cloud" | "custom" | false;
 /** How inference is served: "custom" (a host-passed model) or "ladder" (the

package/dist/wire/shared.js

@@ -4,7 +4,7 @@ import { VendoError, } from "@vendoai/core";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export const VERSION = "0.4.0";
+export const VERSION = "0.4.1";
 export const BASE_PATH = "/api/vendo";
 const STATUS_BY_CODE = {
     validation: 400,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vendoai/vendo",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "The Vendo umbrella: default composition, public wire routes, React provider, and the vendo CLI.",
   "keywords": [
     "ai",
@@ -86,16 +86,16 @@
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "zod": "^3.25.0",
-    "@vendoai/actions": "0.4.0",
-    "@vendoai/core": "0.4.0",
-    "@vendoai/apps": "0.4.0",
-    "@vendoai/guard": "0.4.0",
-    "@vendoai/mcp": "0.4.0",
-    "@vendoai/agent": "0.4.0",
-    "@vendoai/automations": "0.4.0",
-    "@vendoai/ui": "0.4.0",
-    "@vendoai/telemetry": "0.3.0",
-    "@vendoai/store": "0.4.0"
+    "@vendoai/actions": "0.4.1",
+    "@vendoai/automations": "0.4.1",
+    "@vendoai/apps": "0.4.1",
+    "@vendoai/core": "0.4.1",
+    "@vendoai/guard": "0.4.1",
+    "@vendoai/agent": "0.4.1",
+    "@vendoai/mcp": "0.4.1",
+    "@vendoai/telemetry": "0.3.1",
+    "@vendoai/store": "0.4.1",
+    "@vendoai/ui": "0.4.1"
   },
   "peerDependencies": {
     "@auth/core": "^0.34.3",

package/dist/cli/cloud/deploy.d.ts

@@ -1,26 +0,0 @@
-import type { AppDocument, PermissionGrant } from "@vendoai/core";
-import { type VendoStore } from "@vendoai/store";
-import { type CloudCommandOptions } from "./command.js";
-export interface LocalDeployApp {
-    doc: AppDocument;
-    enabled: boolean;
-}
-export interface LocalDeployProject {
-    subject: string;
-    apps: LocalDeployApp[];
-    grants: PermissionGrant[];
-}
-export interface LocalProjectReadOptions {
-    subject?: string;
-    cwd?: string;
-}
-export interface ReadLocalProjectOptions extends LocalProjectReadOptions {
-    storeFactory?: () => VendoStore;
-}
-export type LocalProjectReader = (options: LocalProjectReadOptions) => Promise<LocalDeployProject>;
-export interface CloudDeployOptions extends CloudCommandOptions {
-    cwd?: string;
-    localProjectReader?: LocalProjectReader;
-}
-export declare function readLocalProject(options?: ReadLocalProjectOptions): Promise<LocalDeployProject>;
-export declare function runDeploy(args: string[], options?: CloudDeployOptions): Promise<number>;

package/dist/cli/cloud/deploy.js

@@ -1,187 +0,0 @@
-import { appStore, createStore, grantStore, } from "@vendoai/store";
-import { join } from "node:path";
-import { option, options as repeatedOptions } from "./args.js";
-import { CloudError, resolveCloudBaseUrl } from "./client.js";
-import { commandContext, } from "./command.js";
-import { errorMessage, formatTable, printJson } from "./output.js";
-export async function readLocalProject(options = {}) {
-    const store = options.storeFactory?.() ?? createStore({
-        dataDir: join(options.cwd ?? process.cwd(), ".vendo/data"),
-    });
-    try {
-        await store.ensureSchema();
-        const driver = store.raw();
-        const subjectRows = await driver.query("SELECT DISTINCT subject FROM vendo_apps ORDER BY subject ASC");
-        const subjects = subjectRows.rows.map((row) => row.subject);
-        if (subjects.length === 0)
-            throw new Error("No local Vendo apps found in .vendo/data");
-        let subject = options.subject;
-        if (subject === undefined) {
-            if (subjects.length > 1) {
-                throw new Error(`Multiple local Vendo subjects found: ${subjects.join(", ")}. Pass --subject <subject>.`);
-            }
-            subject = subjects[0];
-        }
-        else if (!subjects.includes(subject)) {
-            throw new Error(`Subject ${subject} was not found in the local Vendo store`);
-        }
-        const appIds = await driver.query("SELECT id FROM vendo_apps WHERE subject = $1 ORDER BY created_at ASC, id ASC", [subject]);
-        const apps = (await Promise.all(appIds.rows.map(async ({ id }) => {
-            const row = await appStore(store).get(id);
-            if (row === null || row.subject !== subject)
-                return null;
-            return { doc: row.doc, enabled: row.enabled };
-        }))).filter((row) => row !== null);
-        const grantIds = await driver.query(`SELECT id FROM vendo_grants
-       WHERE subject = $1 AND source = 'automation'
-         AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())
-       ORDER BY granted_at ASC, id ASC`, [subject]);
-        const grants = (await Promise.all(grantIds.rows.map(({ id }) => grantStore(store).get(id))))
-            .filter((grant) => grant !== null);
-        return { subject, apps, grants };
-    }
-    finally {
-        await store.close();
-    }
-}
-function machineOptions(args, context) {
-    return {
-        auth: "key",
-        apiKey: option(args, "--key"),
-        apiUrl: option(args, "--api-url"),
-        env: context.env,
-    };
-}
-function secretValues(args) {
-    const values = new Map();
-    for (const pair of repeatedOptions(args, "--secret")) {
-        const separator = pair.indexOf("=");
-        if (separator <= 0)
-            throw new Error("--secret must use NAME=VALUE");
-        values.set(pair.slice(0, separator), pair.slice(separator + 1));
-    }
-    return values;
-}
-function selectedApps(project, args) {
-    const requested = [...new Set(repeatedOptions(args, "--app"))];
-    if (requested.length === 0) {
-        const selected = project.apps.filter((app) => app.enabled && app.doc.trigger !== undefined);
-        if (selected.length === 0)
-            throw new Error("No enabled local automations found");
-        return selected;
-    }
-    const requestedIds = new Set(requested);
-    for (const appId of requested) {
-        const app = project.apps.find((candidate) => candidate.doc.id === appId);
-        if (app === undefined)
-            throw new Error(`App ${appId} was not found for subject ${project.subject}`);
-        if (app.doc.trigger === undefined)
-            throw new Error(`App ${appId} is not an automation`);
-    }
-    return project.apps.filter((app) => requestedIds.has(app.doc.id));
-}
-function warnUnsupportedFnSteps(context, apps) {
-    for (const app of apps) {
-        const run = app.doc.trigger?.run;
-        if (run?.kind === "steps" && run.steps.some((step) => step.tool.startsWith("fn:"))) {
-            context.output.error(`WARNING: Automation ${app.doc.id} has fn: steps that target the app's machine, which is unreachable from hosted sandboxes in v1; those steps will fail/park when fired hosted.`);
-        }
-    }
-}
-function deployResponse(value) {
-    if (typeof value !== "object" || value === null)
-        throw new Error("Vendo Cloud returned an invalid deploy response");
-    const result = value;
-    if (typeof result.org?.id !== "string"
-        || typeof result.org.slug !== "string"
-        || typeof result.instance?.status !== "string"
-        || typeof result.applied?.apps !== "number"
-        || typeof result.applied.grants !== "number"
-        || typeof result.applied.secrets !== "number"
-        || !Array.isArray(result.webhooks)
-        || result.webhooks.some((webhook) => typeof webhook.app_id !== "string"
-            || typeof webhook.source !== "string"
-            || typeof webhook.url !== "string")) {
-        throw new Error("Vendo Cloud returned an invalid deploy response");
-    }
-    return result;
-}
-function printDeploySummary(context, response) {
-    const lines = [
-        `Vendo Cloud deploy: ${response.org.slug} (${response.instance.status})`,
-        "",
-        formatTable(["APPLIED", "COUNT"], [
-            ["apps", String(response.applied.apps)],
-            ["grants", String(response.applied.grants)],
-            ["secrets", String(response.applied.secrets)],
-        ]),
-        "",
-    ];
-    if (response.webhooks.length === 0) {
-        lines.push("Webhooks: none");
-    }
-    else {
-        lines.push(formatTable(["AUTOMATION", "SOURCE", "WEBHOOK URL"], response.webhooks.map((webhook) => [
-            webhook.app_id,
-            webhook.source,
-            webhook.url,
-        ])));
-    }
-    context.output.log(lines.join("\n"));
-}
-export async function runDeploy(args, options = {}) {
-    const context = commandContext(options);
-    try {
-        const project = await (options.localProjectReader ?? readLocalProject)({
-            subject: option(args, "--subject"),
-            cwd: options.cwd ?? process.cwd(),
-        });
-        const apps = selectedApps(project, args);
-        warnUnsupportedFnSteps(context, apps);
-        const appIds = new Set(apps.map((app) => app.doc.id));
-        const grants = project.grants.filter((grant) => grant.subject === project.subject
-            && grant.source === "automation"
-            && grant.appId !== undefined
-            && appIds.has(grant.appId));
-        const provided = secretValues(args);
-        const referenced = new Set();
-        for (const app of apps) {
-            for (const name of app.doc.secrets ?? []) {
-                referenced.add(name);
-                if (!provided.has(name)) {
-                    context.output.error(`Automation ${app.doc.id} references missing secret ${name}; pass --secret ${name}=VALUE`);
-                }
-            }
-        }
-        const secrets = [...referenced]
-            .filter((name) => provided.has(name))
-            .map((name) => ({ name, value: provided.get(name) }));
-        const requestOptions = machineOptions(args, context);
-        if (secrets.length > 0 && new URL(resolveCloudBaseUrl(requestOptions)).protocol !== "https:") {
-            throw new Error("Deploying secret values requires an HTTPS Vendo Cloud URL");
-        }
-        const response = deployResponse(await context.fetcher("/api/v1/hosted/deploy", {
-            ...requestOptions,
-            method: "POST",
-            body: {
-                apps: apps.map((app) => ({ doc: app.doc, enabled: app.enabled })),
-                grants,
-                secrets,
-            },
-        }));
-        if (args.includes("--json"))
-            printJson(context.output, response);
-        else
-            printDeploySummary(context, response);
-        return 0;
-    }
-    catch (error) {
-        if (error instanceof CloudError && error.code === "cloud-required") {
-            context.output.error("This key's org needs a Cloud plan (cloud-required).");
-        }
-        else {
-            context.output.error(errorMessage(error));
-        }
-        return 1;
-    }
-}