@vendoai/vendo 0.4.1 → 0.4.3

package/dist/cli/provider-deps.d.ts

@@ -0,0 +1,26 @@
+import type { DevCredential } from "../dev-creds/resolve.js";
+import type { Output } from "./shared.js";
+/** Which provider module the resolved credential will load at runtime.
+    The Vendo Cloud gateway speaks the Anthropic-compatible /messages API
+    through the host-installed @ai-sdk/anthropic (dev-creds/model.ts). */
+export declare function providerModuleFor(credential: DevCredential): {
+    module: string;
+    spec: string;
+} | null;
+/** Lockfile-sniffed installer; npm is the fallback. */
+export declare function installCommandFor(root: string): Promise<{
+    command: string;
+    args: string[];
+}>;
+/** Test seam: resolves to the child's exit code (null on spawn error). */
+export type InstallRunner = (command: string, args: string[], cwd: string) => Promise<number | null>;
+export interface EnsureProviderDepsOptions {
+    root: string;
+    credential: DevCredential;
+    output: Output;
+    run?: InstallRunner;
+}
+/** Installs `ai@^6` + the credential's provider when the host can't resolve
+    them. Never fatal: a failed install degrades to the exact manual command
+    (the same one doctor's E-DEP-001 story names). */
+export declare function ensureProviderDeps(options: EnsureProviderDepsOptions): Promise<void>;

package/dist/cli/provider-deps.js

@@ -0,0 +1,100 @@
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * The starter model ladder resolves its provider from the HOST's
+ * node_modules at runtime (dev-creds/model.ts) — nothing declares
+ * `@ai-sdk/*` as a dependency, so a fresh install 500s on the first turn
+ * until the user reads the dev-server error and installs it by hand (0.4.1
+ * E2E certification finding). Init knows the resolved credential, so it can
+ * install exactly the provider that credential needs, up front.
+ */
+const PROVIDER_SPECS = {
+    anthropic: { module: "@ai-sdk/anthropic", spec: "@ai-sdk/anthropic@^3" },
+    openai: { module: "@ai-sdk/openai", spec: "@ai-sdk/openai@^3" },
+    google: { module: "@ai-sdk/google", spec: "@ai-sdk/google@^3" },
+};
+const AI_SPEC = "ai@^6";
+/** Which provider module the resolved credential will load at runtime.
+    The Vendo Cloud gateway speaks the Anthropic-compatible /messages API
+    through the host-installed @ai-sdk/anthropic (dev-creds/model.ts). */
+export function providerModuleFor(credential) {
+    if (credential.rung === "env-key")
+        return PROVIDER_SPECS[credential.provider];
+    if (credential.rung === "vendo-cloud")
+        return PROVIDER_SPECS.anthropic;
+    return null;
+}
+/** Resolvability is what the runtime ladder checks, so node_modules is the
+    evidence — not package.json (a hoisting monorepo satisfies the import
+    without a local entry). */
+async function isInstalled(root, moduleName) {
+    try {
+        await readFile(join(root, "node_modules", ...moduleName.split("/"), "package.json"), "utf8");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function fileExists(root, name) {
+    try {
+        await readFile(join(root, name));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Lockfile-sniffed installer; npm is the fallback. */
+export async function installCommandFor(root) {
+    if (await fileExists(root, "pnpm-lock.yaml"))
+        return { command: "pnpm", args: ["add"] };
+    if (await fileExists(root, "yarn.lock"))
+        return { command: "yarn", args: ["add"] };
+    if ((await fileExists(root, "bun.lockb")) || (await fileExists(root, "bun.lock"))) {
+        return { command: "bun", args: ["add"] };
+    }
+    return { command: "npm", args: ["install"] };
+}
+const INSTALL_TIMEOUT_MS = 240_000;
+const defaultRunner = (command, args, cwd) => new Promise((resolve) => {
+    const child = spawn(command, args, { cwd, stdio: "ignore" });
+    const timer = setTimeout(() => {
+        child.kill();
+        resolve(null);
+    }, INSTALL_TIMEOUT_MS);
+    child.on("error", () => {
+        clearTimeout(timer);
+        resolve(null);
+    });
+    child.on("exit", (code) => {
+        clearTimeout(timer);
+        resolve(code);
+    });
+});
+/** Installs `ai@^6` + the credential's provider when the host can't resolve
+    them. Never fatal: a failed install degrades to the exact manual command
+    (the same one doctor's E-DEP-001 story names). */
+export async function ensureProviderDeps(options) {
+    const provider = providerModuleFor(options.credential);
+    if (provider === null)
+        return;
+    const specs = [];
+    if (!(await isInstalled(options.root, "ai")))
+        specs.push(AI_SPEC);
+    if (!(await isInstalled(options.root, provider.module)))
+        specs.push(provider.spec);
+    if (specs.length === 0)
+        return;
+    const { command, args } = await installCommandFor(options.root);
+    const invocation = `${command} ${[...args, ...specs].join(" ")}`;
+    options.output.log(`Installing the model provider this credential uses: ${specs.join(" ")} (${command})…`);
+    const code = await (options.run ?? defaultRunner)(command, [...args, ...specs], options.root);
+    if (code === 0) {
+        options.output.log(`Installed ${specs.join(" ")}.`);
+    }
+    else {
+        options.output.error(`warning: could not install ${specs.join(" ")} — run \`${invocation}\` yourself before the first turn, or it fails at runtime (E-DEP-001).`);
+    }
+}

package/dist/cli/shared.d.ts

@@ -1,5 +1,5 @@
 import { type Telemetry } from "@vendoai/telemetry";
-export declare const CLI_VERSION = "0.4.1";
+export declare const CLI_VERSION = "0.4.3";
 export interface Output {
     log(message: string): void;
     error(message: string): void;

package/dist/cli/shared.js

@@ -4,7 +4,7 @@ import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { initTelemetry, repoHost } from "@vendoai/telemetry";
-export const CLI_VERSION = "0.4.1";
+export const CLI_VERSION = "0.4.3";
 export const consoleOutput = {
     log: (message) => console.log(message),
     error: (message) => console.error(message),

package/dist/mastra.js

@@ -29,6 +29,74 @@ export const VENDO_PRINCIPAL_KEY = "vendo-principal";
 /** Optional request-context key carrying the host session id into Vendo's
  *  audit trail; unset, the shim mints one per call. */
 export const VENDO_SESSION_KEY = "vendo-session-id";
+/** The bridge property carrying an OPEN tool's arguments (see
+ *  {@link isOpenObjectSchema}). */
+const OPEN_ARGS_KEY = "args";
+/**
+ * An OPEN tool input: an object schema with no declared properties that
+ * accepts arbitrary fields (extraction emits these for routes whose body shape
+ * it cannot type, e.g. `{type:"object", properties:{}, additionalProperties:
+ * true}`). Mastra's provider schema-compat layers hard-close every object node
+ * for strict-mode providers (the OpenAI layer sets `additionalProperties:
+ * false` on all of them), so an open schema reaches the model as "this tool
+ * takes NO arguments" — and the model dutifully calls it with `{}` even when
+ * the user dictated exact args (0.4.x E2E, report-mastra defect 5: the
+ * approved call then executed with an empty body). A schema with declared
+ * properties survives those transforms, so open inputs ride a single declared
+ * JSON-string property instead, unwrapped in execute before the guard.
+ */
+function isOpenObjectSchema(schema) {
+    if (typeof schema !== "object" || schema === null || Array.isArray(schema))
+        return false;
+    const record = schema;
+    if (record.type !== undefined && record.type !== "object")
+        return false;
+    const properties = record.properties;
+    const declared = typeof properties === "object" && properties !== null
+        && Object.keys(properties).length > 0;
+    return !declared && record.additionalProperties !== false;
+}
+function openArgsBridgeSchema(tool) {
+    return {
+        type: "object",
+        properties: {
+            [OPEN_ARGS_KEY]: {
+                // Both forms validate at runtime; strict-mode providers ride the
+                // string branch (their compat layer closes every object node), and
+                // permissive providers may pass the object directly.
+                type: ["string", "object"],
+                description: `The arguments to pass to ${tool}: a JSON object, or that object encoded as one JSON string literal (e.g. {"field":"value"}). Include every field the request calls for; pass {} when there are none.`,
+            },
+        },
+    };
+}
+/** Recover the real tool args from a bridged call: a JSON-string `args`
+ *  (the advertised shape), a plain-object `args` (a model that skipped the
+ *  encoding), or the raw payload itself (a provider that ignored the bridge). */
+function unwrapOpenArgs(input) {
+    if (typeof input !== "object" || input === null || Array.isArray(input))
+        return input ?? {};
+    const record = input;
+    if (OPEN_ARGS_KEY in record) {
+        const value = record[OPEN_ARGS_KEY];
+        if (value === null || value === undefined)
+            return {};
+        if (typeof value === "string") {
+            const trimmed = value.trim();
+            if (trimmed === "")
+                return {};
+            try {
+                return JSON.parse(trimmed);
+            }
+            catch {
+                throw new VendoError("validation", `${OPEN_ARGS_KEY} must be one JSON object literal (e.g. {"field":"value"}); the provided value did not parse as JSON`);
+            }
+        }
+        if (typeof value === "object" && !Array.isArray(value))
+            return value;
+    }
+    return record;
+}
 function principalFrom(context) {
     const candidate = context?.requestContext?.get(VENDO_PRINCIPAL_KEY);
     if (typeof candidate?.kind !== "string" || typeof candidate.subject !== "string") {
@@ -74,11 +142,12 @@ export async function vendoMastraTools(vendo, options) {
     });
     const tools = {};
     for (const entry of pack) {
+        const bridged = isOpenObjectSchema(entry.inputSchema);
         tools[entry.name] = createTool({
             id: entry.name,
             description: entry.description,
-            inputSchema: entry.inputSchema,
-            execute: (inputData, context) => entry.execute(inputData, {
+            inputSchema: bridged ? openArgsBridgeSchema(entry.name) : entry.inputSchema,
+            execute: (inputData, context) => entry.execute(bridged ? unwrapOpenArgs(inputData) : inputData, {
                 ctx: runContextFrom(context),
                 ...(context?.agent?.toolCallId === undefined ? {} : { callId: context.agent.toolCallId }),
             }),

package/dist/react.d.ts

@@ -1,6 +1,7 @@
 import { VendoProvider } from "@vendoai/ui";
 import { type ComponentProps } from "react";
 export { createVendoClient, type VendoClient, type VendoClientConfig, VendoProvider, hostComponentMap, useVendoContext, useVendoDiscoverability, useVendoGreeting, useVendoTheme, useVendoTools, type ConnectorOption, type HostComponentsInput, defaultVendoGreeting, type VendoDiscoverability, type VendoGreeting, type ToolMeta, type ToolMetaMap, VendoAppEmbed, VendoApprovalEmbed, VendoToolResult, useActivity, useApp, useApps, useApprovals, useAutomations, useConnections, useConnectorCatalog, useGrants, useMobileTakeover, type MobileTakeover, type PollOptions, useSlotApp, useThreads, useVendoOverlay, type VendoOverlayController, useVendoStatus, useVendoThread, type VendoThreadApproval, ScriptedTransport, type DirectorCue, type DirectorScript, defaultVendoTheme, resolveTheme, themeCssVariables, useVoice, type UseVoiceResult, type OpenSurface, type InClientVenue, type PinDrift, type ShipDiff, type EditResult, type PinRebaseResult, type VersionEntry, type ConnectionAccount, type InitiatedConnection, type RunStatus, type RunRecord, type RunPlan, type AutomationEntry, type EnableResult, type Thread, type ThreadSummary, type GuardPosture, type VendoStatus, } from "@vendoai/ui";
+export { VendoOverlay, type VendoOverlayProps } from "@vendoai/ui/chrome";
 export { remixable, type RemixableRegistration, type RemixableReportOptions } from "./remixable.js";
 type ProviderProps = ComponentProps<typeof VendoProvider>;
 /** 09-vendo §1 — the UI provider prewired to the default wire base. */

package/dist/react.js

@@ -23,6 +23,13 @@ useActivity, useApp, useApps, useApprovals, useAutomations, useConnections, useC
 defaultVendoTheme, resolveTheme, themeCssVariables, 
 // voice/use-voice.ts
 useVoice, } from "@vendoai/ui";
+// The visible agent surface (launcher pill + panel) — re-exported from the
+// chrome subpath so the init-scaffolded layout wrapper can import everything
+// from "@vendoai/vendo/react": hosts only get @vendoai/vendo as a direct
+// dependency, and under pnpm strict linking the transitive "@vendoai/ui/chrome"
+// does not resolve for them (same TS2307 story as the registry's
+// ComponentRegistry import).
+export { VendoOverlay } from "@vendoai/ui/chrome";
 export { remixable } from "./remixable.js";
 /** 09-vendo §1 — the UI provider prewired to the default wire base. */
 export function VendoRoot(props) {

package/dist/wire/apps.js

@@ -1,5 +1,21 @@
 import { VendoError } from "@vendoai/core";
+import { appStore } from "@vendoai/store";
 import { json, requestJson, route, string } from "./shared.js";
+/** Unscoped existence probe behind the ?pending=1 disambiguation: does ANY
+    principal own a record with this id? Owner-scoped open() answers not-found
+    for both "still building" and "exists under someone else", and masking the
+    latter as pending is the infinite skeleton of 0.4.1 E2E cert B4 (wire
+    principal ≠ chat principal). No document content leaves this check. A
+    store that can't answer (hosted wire-door stores have no local db handle)
+    keeps the pending window — today's behavior. */
+async function appRecordExists(store, appId) {
+    try {
+        return (await appStore(store).get(appId)) !== null;
+    }
+    catch {
+        return false;
+    }
+}
 /** 06-apps / 09 §3 — the /apps wire area: CRUD, open/call/edit, history,
     ship-diff, pin drift/rebase, the gesture fork (fork-pin), export/import,
     fork (whole-app copy — a different feature from fork-pin). */
@@ -71,13 +87,26 @@ export const appRoutes = [
             // console 404. Under the additive ?pending=1 flag, ONLY that expected
             // pre-servable miss becomes a quiet 200 {kind:"pending"}; unflagged
             // callers keep the contracted 404, and every other failure keeps its
-            // envelope and status either way.
+            // envelope and status either way. A record that DOES exist — just not
+            // for this caller — is not a build in progress and never will be: that
+            // answers the terminal failed vocabulary (with the principal-mismatch
+            // diagnosis) so the embed resolves promptly instead of skeleton-polling
+            // to its deadline (0.4.1 E2E cert B4).
             if (wire.url.searchParams.get("pending") === "1") {
                 try {
                     return json(await deps.apps.open(appId, ctx));
                 }
                 catch (reason) {
                     if (reason instanceof VendoError && reason.code === "not-found") {
+                        if (await appRecordExists(deps.store, appId)) {
+                            return json({
+                                kind: "failed",
+                                reason: "this app exists but is not visible to this surface's caller — "
+                                    + "the wire route's principal must resolve the same subject your agent loop uses "
+                                    + "(see the principal comment in the generated route, or docs.vendo.run/existing-agents)",
+                                retryable: false,
+                            });
+                        }
                         return json({ kind: "pending" });
                     }
                     throw reason;

package/dist/wire/shared.d.ts

@@ -14,7 +14,7 @@ import type { RuntimeCaptureHandler } from "../runtime-capture.js";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export declare const VERSION = "0.4.1";
+export declare const VERSION = "0.4.3";
 export declare const BASE_PATH = "/api/vendo";
 export type SandboxVenue = "e2b" | "cloud" | "custom" | false;
 /** How inference is served: "custom" (a host-passed model) or "ladder" (the

package/dist/wire/shared.js

@@ -4,7 +4,7 @@ import { VendoError, } from "@vendoai/core";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export const VERSION = "0.4.1";
+export const VERSION = "0.4.3";
 export const BASE_PATH = "/api/vendo";
 const STATUS_BY_CODE = {
     validation: 400,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vendoai/vendo",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "The Vendo umbrella: default composition, public wire routes, React provider, and the vendo CLI.",
   "keywords": [
     "ai",
@@ -86,16 +86,16 @@
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "zod": "^3.25.0",
-    "@vendoai/actions": "0.4.1",
-    "@vendoai/automations": "0.4.1",
-    "@vendoai/apps": "0.4.1",
-    "@vendoai/core": "0.4.1",
-    "@vendoai/guard": "0.4.1",
-    "@vendoai/agent": "0.4.1",
-    "@vendoai/mcp": "0.4.1",
+    "@vendoai/actions": "0.4.3",
+    "@vendoai/apps": "0.4.3",
+    "@vendoai/automations": "0.4.3",
+    "@vendoai/agent": "0.4.3",
+    "@vendoai/core": "0.4.3",
+    "@vendoai/guard": "0.4.3",
     "@vendoai/telemetry": "0.3.1",
-    "@vendoai/store": "0.4.1",
-    "@vendoai/ui": "0.4.1"
+    "@vendoai/ui": "0.4.3",
+    "@vendoai/mcp": "0.4.3",
+    "@vendoai/store": "0.4.3"
   },
   "peerDependencies": {
     "@auth/core": "^0.34.3",