@vendoai/vendo 0.4.1 → 0.4.2

package/dist/cli/cloud/device-login.js

@@ -91,13 +91,16 @@ export async function runDeviceLogin(args, options = {}) {
     const waitSeconds = waitRaw !== undefined && /^\d+$/.test(waitRaw) ? Number(waitRaw) : undefined;
     const waitMs = waitSeconds === undefined ? undefined : waitSeconds * 1000;
     const pendingHome = options.home === undefined ? {} : { home: options.home };
+    const claimCwd = options.root ?? process.cwd();
     try {
         // A still-open claim from a dead process (#479): resume polling it so the
         // human's late approval — against the code they were already shown —
-        // still lands the key. An expired or unreadable file is discarded (a
-        // fresh ceremony overwrites it below).
-        const pending = await readPendingClaim(pendingHome);
-        const resume = pending !== null && pending.api_url === base && pending.expires_at > now()
+        // still lands the key. Claims are scoped per project directory (0.4.2):
+        // only THIS cwd's ceremony is ever resumed, so concurrent logins in other
+        // repos neither clobber this one nor get resumed by it. An expired or
+        // unreadable file is discarded (a fresh ceremony overwrites it below).
+        const pending = await readPendingClaim(claimCwd, pendingHome);
+        const resume = pending !== null && pending.api_url === base && pending.cwd === claimCwd && pending.expires_at > now()
             ? pending
             : null;
         let claimToken;
@@ -174,7 +177,7 @@ export async function runDeviceLogin(args, options = {}) {
                     throw new Error("Vendo Cloud returned an invalid credential");
                 }
                 await upsertEnvLocal(root, "VENDO_API_KEY", key);
-                await deletePendingClaim(pendingHome);
+                await deletePendingClaim(claimCwd, pendingHome);
                 // Never print the key itself — .env.local is the hand-off, last4 the
                 // receipt. A resumed run names the full path: it may differ from cwd.
                 output.log(`Approved — wrote VENDO_API_KEY (…${key.slice(-4)}) to ${resume !== null ? join(root, ".env.local") : ".env.local"}.`);
@@ -190,11 +193,11 @@ export async function runDeviceLogin(args, options = {}) {
             if (error === "slow_down")
                 return "slow_down"; // RFC 8628 §3.5
             if (error === "expired_token") {
-                await deletePendingClaim(pendingHome);
+                await deletePendingClaim(claimCwd, pendingHome);
                 throw new Error("The code expired before it was approved; run `vendo login` again.");
             }
             if (error === "access_denied") {
-                await deletePendingClaim(pendingHome);
+                await deletePendingClaim(claimCwd, pendingHome);
                 throw new Error("Your human denied the request — no key was minted.");
             }
             // Any other token error is terminal for THIS claim (invalid_grant =
@@ -202,7 +205,7 @@ export async function runDeviceLogin(args, options = {}) {
             // again). Delete the pending file so the next `vendo login` opens a
             // fresh claim instead of resuming into the same error forever — the
             // exact trap a live install hit.
-            await deletePendingClaim(pendingHome);
+            await deletePendingClaim(claimCwd, pendingHome);
             const description = poll.body?.error_description;
             throw new Error(typeof description === "string"
                 ? description
@@ -230,7 +233,7 @@ export async function runDeviceLogin(args, options = {}) {
                 if (result === "slow_down")
                     intervalMs += 5000;
             }
-            await deletePendingClaim(pendingHome);
+            await deletePendingClaim(claimCwd, pendingHome);
             throw new Error("The code expired before it was approved; run `vendo login` again.");
         }
         // Bounded budget: poll immediately, then pace by interval, stopping at
@@ -243,7 +246,7 @@ export async function runDeviceLogin(args, options = {}) {
             if (result === "slow_down")
                 intervalMs += 5000;
             if (now() >= deadline) {
-                await deletePendingClaim(pendingHome);
+                await deletePendingClaim(claimCwd, pendingHome);
                 throw new Error("The code expired before it was approved; run `vendo login` again.");
             }
             if (now() >= pollDeadline)

package/dist/cli/cloud/pending-claim.d.ts

@@ -23,7 +23,10 @@ export interface PendingClaimOptions {
     home?: string;
 }
 /** An unreadable or malformed file reads as "no pending claim" — the caller
-    discards it by opening (and persisting) a fresh ceremony. */
-export declare function readPendingClaim(options?: PendingClaimOptions): Promise<PendingClaim | null>;
+    discards it by opening (and persisting) a fresh ceremony. Only a claim
+    opened for THIS cwd is ever returned. A pre-0.4.2 machine-global file is
+    honored (and migrated) only when its recorded cwd matches; someone else's
+    ceremony is never resumed. */
+export declare function readPendingClaim(cwd: string, options?: PendingClaimOptions): Promise<PendingClaim | null>;
 export declare function writePendingClaim(claim: PendingClaim, options?: PendingClaimOptions): Promise<void>;
-export declare function deletePendingClaim(options?: PendingClaimOptions): Promise<void>;
+export declare function deletePendingClaim(cwd: string, options?: PendingClaimOptions): Promise<void>;

package/dist/cli/cloud/pending-claim.js

@@ -1,7 +1,17 @@
+import { createHash } from "node:crypto";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-function pendingClaimPath(options = {}) {
+/** Claims are keyed by the project directory they were opened for. A single
+    machine-global file let two concurrent `vendo login` runs clobber each
+    other, and let project A resume (and receive the key for) project B's
+    ceremony — found by the 0.4.1 E2E certification campaign. */
+function pendingClaimPath(cwd, options = {}) {
+    const name = `${createHash("sha256").update(cwd).digest("hex").slice(0, 16)}.json`;
+    return join(options.home ?? homedir(), ".vendo", "pending-claims", name);
+}
+/** The pre-0.4.2 machine-global location — read once for migration. */
+function legacyPendingClaimPath(options = {}) {
     return join(options.home ?? homedir(), ".vendo", "pending-claim.json");
 }
 function isPendingClaim(value) {
@@ -16,23 +26,37 @@ function isPendingClaim(value) {
         && typeof claim.api_url === "string"
         && typeof claim.cwd === "string";
 }
-/** An unreadable or malformed file reads as "no pending claim" — the caller
-    discards it by opening (and persisting) a fresh ceremony. */
-export async function readPendingClaim(options = {}) {
+async function readClaimFile(path) {
     try {
-        const value = JSON.parse(await readFile(pendingClaimPath(options), "utf8"));
+        const value = JSON.parse(await readFile(path, "utf8"));
         return isPendingClaim(value) ? value : null;
     }
     catch {
         return null;
     }
 }
+/** An unreadable or malformed file reads as "no pending claim" — the caller
+    discards it by opening (and persisting) a fresh ceremony. Only a claim
+    opened for THIS cwd is ever returned. A pre-0.4.2 machine-global file is
+    honored (and migrated) only when its recorded cwd matches; someone else's
+    ceremony is never resumed. */
+export async function readPendingClaim(cwd, options = {}) {
+    const scoped = await readClaimFile(pendingClaimPath(cwd, options));
+    if (scoped !== null)
+        return scoped.cwd === cwd ? scoped : null;
+    const legacy = await readClaimFile(legacyPendingClaimPath(options));
+    if (legacy === null || legacy.cwd !== cwd)
+        return null;
+    await writePendingClaim(legacy, options);
+    await rm(legacyPendingClaimPath(options), { force: true });
+    return legacy;
+}
 export async function writePendingClaim(claim, options = {}) {
-    const path = pendingClaimPath(options);
+    const path = pendingClaimPath(claim.cwd, options);
     await mkdir(join(path, ".."), { recursive: true, mode: 0o700 });
     await writeFile(path, `${JSON.stringify(claim, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
     await chmod(path, 0o600);
 }
-export async function deletePendingClaim(options = {}) {
-    await rm(pendingClaimPath(options), { force: true });
+export async function deletePendingClaim(cwd, options = {}) {
+    await rm(pendingClaimPath(cwd, options), { force: true });
 }

package/dist/cli/init.d.ts

@@ -4,6 +4,7 @@ import { type AiExtractionOptions } from "./extract/extraction.js";
 import { type DevCredential } from "../dev-creds/resolve.js";
 import { type HostFramework } from "./framework.js";
 import { type AuthPresetName } from "./init-auth.js";
+import { type InstallRunner } from "./provider-deps.js";
 import { type SelectOption } from "./pretty.js";
 import { type ThemeSummary } from "./theme/extract-theme.js";
 import { type Output } from "./shared.js";
@@ -76,6 +77,8 @@ export interface InitOptions {
     resolveCredential?: (options: {
         env: Record<string, string | undefined>;
     }) => Promise<DevCredential>;
+    /** Test seam: the provider-dependency install subprocess (provider-deps.ts). */
+    installProvider?: InstallRunner;
     /** Test seam (ENG-339): cloud-in-init step overrides. */
     cloud?: Partial<Omit<CloudStepOptions, "root" | "output" | "yes" | "credential">>;
     /** Test seam: AI extraction step overrides (harnesses, consent). */

package/dist/cli/init.js

@@ -14,6 +14,7 @@ import { BRIEF_TEMPLATE } from "./extract/stages.js";
 import { ENV_KEY_VARS, resolveDevCredential, describeDevCredential } from "../dev-creds/resolve.js";
 import { detectFramework, detectVendoWiring } from "./framework.js";
 import { resolveScaffoldAuth } from "./init-auth.js";
+import { ensureProviderDeps } from "./provider-deps.js";
 import { expressServerSource, registrySource, routeSource, serverActionsModuleSource, VENDO_ENV_EXAMPLE, wiringServerActions, } from "./init-scaffolds.js";
 import { createPrettyOutput, plainSelect, usePrettyOutput } from "./pretty.js";
 import { contrastingText } from "./theme/color.js";
@@ -927,6 +928,16 @@ export async function runInit(options) {
             wiringMs,
             ...(await cloudProjectProps(root)),
         });
+        // The credential's runtime provider must be resolvable from the host or
+        // the FIRST turn 500s (dev-creds/model.ts loads it host-side; nothing
+        // declares @ai-sdk/* — 0.4.1 E2E cert finding). Install exactly what the
+        // resolved credential needs; a failure degrades to the manual command.
+        await ensureProviderDeps({
+            root,
+            credential,
+            output,
+            ...(options.installProvider === undefined ? {} : { run: options.installProvider }),
+        });
         // The one short Cloud reminder in the end-of-run summary — ONLY while no
         // key exists (the full emphasized block already ran up top; no repeat).
         if (credential.rung === "none") {

package/dist/cli/provider-deps.d.ts

@@ -0,0 +1,26 @@
+import type { DevCredential } from "../dev-creds/resolve.js";
+import type { Output } from "./shared.js";
+/** Which provider module the resolved credential will load at runtime.
+    The Vendo Cloud gateway speaks the Anthropic-compatible /messages API
+    through the host-installed @ai-sdk/anthropic (dev-creds/model.ts). */
+export declare function providerModuleFor(credential: DevCredential): {
+    module: string;
+    spec: string;
+} | null;
+/** Lockfile-sniffed installer; npm is the fallback. */
+export declare function installCommandFor(root: string): Promise<{
+    command: string;
+    args: string[];
+}>;
+/** Test seam: resolves to the child's exit code (null on spawn error). */
+export type InstallRunner = (command: string, args: string[], cwd: string) => Promise<number | null>;
+export interface EnsureProviderDepsOptions {
+    root: string;
+    credential: DevCredential;
+    output: Output;
+    run?: InstallRunner;
+}
+/** Installs `ai@^6` + the credential's provider when the host can't resolve
+    them. Never fatal: a failed install degrades to the exact manual command
+    (the same one doctor's E-DEP-001 story names). */
+export declare function ensureProviderDeps(options: EnsureProviderDepsOptions): Promise<void>;

package/dist/cli/provider-deps.js

@@ -0,0 +1,100 @@
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * The starter model ladder resolves its provider from the HOST's
+ * node_modules at runtime (dev-creds/model.ts) — nothing declares
+ * `@ai-sdk/*` as a dependency, so a fresh install 500s on the first turn
+ * until the user reads the dev-server error and installs it by hand (0.4.1
+ * E2E certification finding). Init knows the resolved credential, so it can
+ * install exactly the provider that credential needs, up front.
+ */
+const PROVIDER_SPECS = {
+    anthropic: { module: "@ai-sdk/anthropic", spec: "@ai-sdk/anthropic@^3" },
+    openai: { module: "@ai-sdk/openai", spec: "@ai-sdk/openai@^3" },
+    google: { module: "@ai-sdk/google", spec: "@ai-sdk/google@^3" },
+};
+const AI_SPEC = "ai@^6";
+/** Which provider module the resolved credential will load at runtime.
+    The Vendo Cloud gateway speaks the Anthropic-compatible /messages API
+    through the host-installed @ai-sdk/anthropic (dev-creds/model.ts). */
+export function providerModuleFor(credential) {
+    if (credential.rung === "env-key")
+        return PROVIDER_SPECS[credential.provider];
+    if (credential.rung === "vendo-cloud")
+        return PROVIDER_SPECS.anthropic;
+    return null;
+}
+/** Resolvability is what the runtime ladder checks, so node_modules is the
+    evidence — not package.json (a hoisting monorepo satisfies the import
+    without a local entry). */
+async function isInstalled(root, moduleName) {
+    try {
+        await readFile(join(root, "node_modules", ...moduleName.split("/"), "package.json"), "utf8");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function fileExists(root, name) {
+    try {
+        await readFile(join(root, name));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Lockfile-sniffed installer; npm is the fallback. */
+export async function installCommandFor(root) {
+    if (await fileExists(root, "pnpm-lock.yaml"))
+        return { command: "pnpm", args: ["add"] };
+    if (await fileExists(root, "yarn.lock"))
+        return { command: "yarn", args: ["add"] };
+    if ((await fileExists(root, "bun.lockb")) || (await fileExists(root, "bun.lock"))) {
+        return { command: "bun", args: ["add"] };
+    }
+    return { command: "npm", args: ["install"] };
+}
+const INSTALL_TIMEOUT_MS = 240_000;
+const defaultRunner = (command, args, cwd) => new Promise((resolve) => {
+    const child = spawn(command, args, { cwd, stdio: "ignore" });
+    const timer = setTimeout(() => {
+        child.kill();
+        resolve(null);
+    }, INSTALL_TIMEOUT_MS);
+    child.on("error", () => {
+        clearTimeout(timer);
+        resolve(null);
+    });
+    child.on("exit", (code) => {
+        clearTimeout(timer);
+        resolve(code);
+    });
+});
+/** Installs `ai@^6` + the credential's provider when the host can't resolve
+    them. Never fatal: a failed install degrades to the exact manual command
+    (the same one doctor's E-DEP-001 story names). */
+export async function ensureProviderDeps(options) {
+    const provider = providerModuleFor(options.credential);
+    if (provider === null)
+        return;
+    const specs = [];
+    if (!(await isInstalled(options.root, "ai")))
+        specs.push(AI_SPEC);
+    if (!(await isInstalled(options.root, provider.module)))
+        specs.push(provider.spec);
+    if (specs.length === 0)
+        return;
+    const { command, args } = await installCommandFor(options.root);
+    const invocation = `${command} ${[...args, ...specs].join(" ")}`;
+    options.output.log(`Installing the model provider this credential uses: ${specs.join(" ")} (${command})…`);
+    const code = await (options.run ?? defaultRunner)(command, [...args, ...specs], options.root);
+    if (code === 0) {
+        options.output.log(`Installed ${specs.join(" ")}.`);
+    }
+    else {
+        options.output.error(`warning: could not install ${specs.join(" ")} — run \`${invocation}\` yourself before the first turn, or it fails at runtime (E-DEP-001).`);
+    }
+}

package/dist/cli/shared.d.ts

@@ -1,5 +1,5 @@
 import { type Telemetry } from "@vendoai/telemetry";
-export declare const CLI_VERSION = "0.4.1";
+export declare const CLI_VERSION = "0.4.2";
 export interface Output {
     log(message: string): void;
     error(message: string): void;

package/dist/cli/shared.js

@@ -4,7 +4,7 @@ import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { initTelemetry, repoHost } from "@vendoai/telemetry";
-export const CLI_VERSION = "0.4.1";
+export const CLI_VERSION = "0.4.2";
 export const consoleOutput = {
     log: (message) => console.log(message),
     error: (message) => console.error(message),

package/dist/wire/shared.d.ts

@@ -14,7 +14,7 @@ import type { RuntimeCaptureHandler } from "../runtime-capture.js";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export declare const VERSION = "0.4.1";
+export declare const VERSION = "0.4.2";
 export declare const BASE_PATH = "/api/vendo";
 export type SandboxVenue = "e2b" | "cloud" | "custom" | false;
 /** How inference is served: "custom" (a host-passed model) or "ladder" (the

package/dist/wire/shared.js

@@ -4,7 +4,7 @@ import { VendoError, } from "@vendoai/core";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export const VERSION = "0.4.1";
+export const VERSION = "0.4.2";
 export const BASE_PATH = "/api/vendo";
 const STATUS_BY_CODE = {
     validation: 400,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vendoai/vendo",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "The Vendo umbrella: default composition, public wire routes, React provider, and the vendo CLI.",
   "keywords": [
     "ai",
@@ -86,16 +86,16 @@
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "zod": "^3.25.0",
-    "@vendoai/actions": "0.4.1",
-    "@vendoai/automations": "0.4.1",
-    "@vendoai/apps": "0.4.1",
-    "@vendoai/core": "0.4.1",
-    "@vendoai/guard": "0.4.1",
-    "@vendoai/agent": "0.4.1",
-    "@vendoai/mcp": "0.4.1",
+    "@vendoai/actions": "0.4.2",
+    "@vendoai/apps": "0.4.2",
+    "@vendoai/automations": "0.4.2",
+    "@vendoai/agent": "0.4.2",
+    "@vendoai/core": "0.4.2",
+    "@vendoai/guard": "0.4.2",
+    "@vendoai/mcp": "0.4.2",
+    "@vendoai/store": "0.4.2",
     "@vendoai/telemetry": "0.3.1",
-    "@vendoai/store": "0.4.1",
-    "@vendoai/ui": "0.4.1"
+    "@vendoai/ui": "0.4.2"
   },
   "peerDependencies": {
     "@auth/core": "^0.34.3",