fix(sdk): lazy-load auth path dependency

[bryan-hunter]

Summary

• lazy-load xdg-app-paths when Sandbox accesses local CLI auth
• preserve existing auth config path resolution
• apply the same import-safety fix in Sandbox defensively

Production context

The observed Vade production failure originated from the separate @vercel/cli-config dependency path:

@workflow/core
  → @vercel/functions
  → @vercel/oidc
  → @vercel/cli-config
  → xdg-app-paths@5.1.0

• vercel/agents#2646 removed the existing consumer-side patch; the subsequent Vade production deployment failed during page-data collection with path.parse(undefined)
• vercel/agents#2649 restored the lazy-import patch; the Vade production build and hosted deployment completed successfully
• vercel/vercel-internal#177 applies the upstream fix in @vercel/cli-config

Sandbox was not the dependency responsible for that deployment failure. However, Sandbox independently depends on xdg-app-paths@5.1.0 and eagerly imports it from its auth module, exposing the same import-time failure mode. This PR applies the equivalent fix here as a defensive measure in case Sandbox is evaluated in the same kind of entrypoint-less server build runtime.

Root cause

xdg-app-paths@5.1.0 constructs its default export at module load and calls path.parse(require.main?.filename ?? process.argv[0]). A server build worker with neither value can therefore fail while importing Sandbox, before Sandbox auth is used.

Fix

Resolve xdg-app-paths inside getGlobalPathConfig() so the import-time side effect runs only when local CLI auth is accessed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sandbox	Ready	Preview, v0	Aug 9, 2026 10:58pm
sandbox-cli	Ready	Preview	Aug 9, 2026 10:58pm
sandbox-sdk-ai-example	Ready	Preview	Aug 9, 2026 10:58pm
workflow-code-runner	Ready	Preview	Aug 9, 2026 10:58pm