Heh, I really hope there never comes a day when Arc has vendor code. I'd really like for it to continue encouraging people to hack on their dependencies. And that requires keeping the code nearby. So a separate directory for apps is fine, and you're right that it allows versions of the same app to coexist. But hopefully we never start shoving libraries into a system path..
I was assuming it would work like PHP where dependencies are just cloned into into a local /vendor folder namespaced by owner/repo.
But that assumes there's a package manager, which assumes there's a consensus and standard around package management, and namespaces, and modules, and... we can just stick a pin in that for now.
