langwatch 0.31.0 → 0.32.0

package/dist/chunk-KZDNN6V2.js

@@ -0,0 +1,996 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+
+var _chunkX4BHZH7Pjs = require('./chunk-X4BHZH7P.js');
+
+
+var _chunkBAA4HKOBjs = require('./chunk-BAA4HKOB.js');
+
+
+
+
+var _chunk724OLLZ4js = require('./chunk-724OLLZ4.js');
+
+
+
+
+var _chunkOGAE7BVQjs = require('./chunk-OGAE7BVQ.js');
+
+
+
+var _chunkBRPEG3YQjs = require('./chunk-BRPEG3YQ.js');
+
+// src/cli/utils/governance/wrapper.ts
+var _child_process = require('child_process');
+
+// src/cli/utils/governance/brand.ts
+var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
+var LANGWATCH_ORANGE = "#ED8926";
+function lwTag() {
+  return _chalk2.default.hex(LANGWATCH_ORANGE).bold("\u2726 langwatch");
+}
+
+// src/cli/utils/governance/budget.ts
+async function checkBudget(cfg, opts = {}) {
+  var _a, _b;
+  if (!cfg.access_token) return null;
+  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
+  const url = cfg.control_plane_url.replace(/\/+$/, "") + "/api/auth/cli/budget/status";
+  let res;
+  try {
+    res = await f(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${cfg.access_token}`,
+        Accept: "application/json"
+      }
+    });
+  } catch (e) {
+    return null;
+  }
+  if (res.status === 200) return null;
+  if (res.status === 404) return null;
+  if (res.status === 402) {
+    try {
+      const body = await res.json();
+      if (((_b = body.error) == null ? void 0 : _b.type) && body.error.scope) return body.error;
+    } catch (e) {
+    }
+  }
+  return null;
+}
+var PERIOD_LABEL = {
+  minute: "per-minute",
+  hour: "hourly",
+  day: "daily",
+  week: "weekly",
+  month: "monthly",
+  total: "total"
+};
+function renderBudgetExceeded(e) {
+  var _a;
+  const period = (e.period || "month").toLowerCase();
+  const periodLabel = (_a = PERIOD_LABEL[period]) != null ? _a : period;
+  const lines = [];
+  lines.push("\u26A0  Budget limit reached");
+  lines.push("");
+  lines.push(`   You've used $${e.spent_usd} of your $${e.limit_usd} ${periodLabel} budget.`);
+  lines.push("   To continue, ask your team admin to raise your limit.");
+  lines.push("");
+  if (e.admin_email) {
+    lines.push(`   Admin: ${e.admin_email}`);
+    lines.push("");
+  }
+  lines.push("   Need urgent access? Run:");
+  lines.push("     langwatch request-increase");
+  return lines.join("\n") + "\n";
+}
+
+// src/cli/utils/governance/platform-tool-policy.ts
+var DEFAULTS = {
+  allowVk: true,
+  allowOtelDirect: true
+};
+var PLATFORM_TOOL_POLICIES = {
+  claude: _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, DEFAULTS),
+  codex: _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, DEFAULTS),
+  gemini: _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, DEFAULTS),
+  opencode: _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, DEFAULTS),
+  // cursor is GUI-only; Path B is not meaningful (no terminal env
+  // reaches the agent panel). The wrapper still gates on this so
+  // future GUI integrations can flip allowOtelDirect to true.
+  cursor: { allowVk: true, allowOtelDirect: false }
+};
+function hardcodedPolicy(toolSlug) {
+  if (toolSlug in PLATFORM_TOOL_POLICIES) {
+    return PLATFORM_TOOL_POLICIES[toolSlug];
+  }
+  return DEFAULTS;
+}
+function resolvePlatformToolPolicy(toolSlug, cachedPolicies) {
+  const cached = cachedPolicies == null ? void 0 : cachedPolicies[toolSlug];
+  if (cached) return cached;
+  return hardcodedPolicy(toolSlug);
+}
+
+// src/cli/utils/governance/shell-rc.ts
+var _fs = require('fs'); var fs = _interopRequireWildcard(_fs); var fs3 = _interopRequireWildcard(_fs);
+var _os = require('os'); var os = _interopRequireWildcard(_os); var os3 = _interopRequireWildcard(_os);
+var _path = require('path'); var path = _interopRequireWildcard(_path); var path3 = _interopRequireWildcard(_path);
+var _readline = require('readline'); var readline = _interopRequireWildcard(_readline);
+
+var BLOCK_BEGIN = "# >>> langwatch begin >>>";
+var BLOCK_END = "# <<< langwatch end <<<";
+function detectShell() {
+  var _a;
+  const raw = ((_a = process.env.SHELL) != null ? _a : "").toLowerCase();
+  if (raw.includes("fish")) return "fish";
+  if (raw.includes("zsh")) return "zsh";
+  if (raw.includes("bash")) return "bash";
+  if (process.platform === "darwin") return "zsh";
+  if (process.platform === "linux") return "bash";
+  return null;
+}
+function rcPath(shell) {
+  const home = os.homedir();
+  switch (shell) {
+    case "zsh":
+      return path.join(home, ".zshrc");
+    case "bash":
+      return path.join(home, ".bashrc");
+    case "fish":
+      return path.join(home, ".config", "fish", "config.fish");
+  }
+}
+function rcHasLangwatchBlock({
+  shell,
+  requiredKeys
+}) {
+  try {
+    const content = fs.readFileSync(rcPath(shell), "utf8");
+    const begin = content.indexOf(BLOCK_BEGIN);
+    const end = content.indexOf(BLOCK_END);
+    if (begin === -1 || end === -1 || end < begin) return false;
+    if (!requiredKeys || requiredKeys.length === 0) return true;
+    const block = content.slice(begin, end);
+    return requiredKeys.every((k) => block.includes(k));
+  } catch (e) {
+    return false;
+  }
+}
+function quote(s) {
+  if (!/[ \t\n'"$\\]/.test(s)) return s;
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+function buildOtelExportBlock(vars, shell) {
+  const entries = Object.entries(vars);
+  const fmt = shell === "fish" ? ([k, v]) => `set -gx ${k} ${quote(v)}` : ([k, v]) => `export ${k}=${quote(v)}`;
+  return entries.map(fmt).join("\n");
+}
+function persistBlockToRc(shell, block) {
+  const file = rcPath(shell);
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  const wrapped = `${BLOCK_BEGIN}
+${block}
+${BLOCK_END}
+`;
+  let existing = "";
+  try {
+    existing = fs.readFileSync(file, "utf8");
+  } catch (e) {
+  }
+  const marker = new RegExp(
+    `${escapeRegex(BLOCK_BEGIN)}[\\s\\S]*?${escapeRegex(BLOCK_END)}\\n?`,
+    "m"
+  );
+  let next;
+  if (marker.test(existing)) {
+    next = existing.replace(marker, wrapped);
+  } else {
+    const needsNewline = existing.length > 0 && !existing.endsWith("\n");
+    next = existing + (needsNewline ? "\n" : "") + "\n" + wrapped;
+  }
+  fs.writeFileSync(file, next);
+  return file;
+}
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function askPersistChoice(rcPathHint, tool) {
+  if (!process.stdin.isTTY) return "skip";
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const ans = await new Promise((resolve) => {
+    rl.question(
+      `Install env vars to ${rcPathHint} so that next time the plain \`${tool}\` command keeps capturing telemetry data? [Y/n/never] `,
+      (a) => resolve(a)
+    );
+  });
+  rl.close();
+  const norm = ans.trim().toLowerCase();
+  if (norm === "" || norm === "y" || norm === "yes") return "yes";
+  if (norm === "never") return "never";
+  return "no";
+}
+async function maybeOfferIngestionShellRcPersist({
+  cfg,
+  tool,
+  vars
+}) {
+  if (cfg.shell_rc_preference === "skip") return;
+  if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) return;
+  const shell = detectShell();
+  if (!shell) return;
+  if (Object.keys(vars).length === 0) return;
+  if (rcHasLangwatchBlock({ shell, requiredKeys: Object.keys(vars) })) return;
+  const block = buildOtelExportBlock(vars, shell);
+  const target = rcPath(shell);
+  console.log();
+  const choice = await askPersistChoice(target, tool);
+  if (choice === "skip" || choice === "no") return;
+  if (choice === "never") {
+    cfg.shell_rc_preference = "skip";
+    try {
+      _chunkOGAE7BVQjs.saveConfig.call(void 0, cfg);
+    } catch (e) {
+    }
+    return;
+  }
+  try {
+    const wrote = persistBlockToRc(shell, block);
+    console.log(
+      _chalk2.default.green(`  \u2713 Installed langwatch telemetry exports to ${wrote}`)
+    );
+  } catch (err) {
+    console.log(
+      _chalk2.default.yellow(`  ! Couldn't write to ${target}: ${err.message}`)
+    );
+  }
+}
+
+// src/cli/utils/opencode-config-flag.ts
+
+
+
+function defaultOpencodeConfigPath() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const configHome = xdg && xdg.length > 0 ? xdg : path.default.join(os.default.homedir(), ".config");
+  return path.default.join(configHome, "opencode", "opencode.jsonc");
+}
+function stripJsoncComments(s) {
+  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+}
+function setOpencodeOpenTelemetryFlag(options = {}) {
+  var _a, _b;
+  const filePath = (_a = options.filePath) != null ? _a : defaultOpencodeConfigPath();
+  if (!fs.default.existsSync(filePath)) {
+    fs.default.mkdirSync(path.default.dirname(filePath), { recursive: true });
+    const content = JSON.stringify(
+      {
+        $schema: "https://opencode.ai/config.json",
+        experimental: { openTelemetry: true }
+      },
+      null,
+      2
+    ) + "\n";
+    fs.default.writeFileSync(filePath, content, { mode: 384 });
+    return { action: "created", path: filePath };
+  }
+  const raw = fs.default.readFileSync(filePath, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(stripJsoncComments(raw));
+  } catch (e) {
+    parsed = { $schema: "https://opencode.ai/config.json" };
+  }
+  const experimental = (_b = parsed.experimental) != null ? _b : {};
+  const prior = experimental.openTelemetry;
+  if (prior === true) return { action: "unchanged", path: filePath };
+  if (prior === false) return { action: "disabled-by-user", path: filePath };
+  parsed.experimental = _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, experimental), { openTelemetry: true });
+  fs.default.writeFileSync(filePath, JSON.stringify(parsed, null, 2) + "\n", {
+    mode: 384
+  });
+  return { action: "updated", path: filePath };
+}
+
+// src/cli/utils/governance/gemini-settings-preflight.ts
+
+
+
+function defaultGeminiSettingsPath() {
+  var _a;
+  const home = (_a = process.env.HOME) != null ? _a : os3.homedir();
+  return path3.join(home, ".gemini", "settings.json");
+}
+function stripJsoncComments2(s) {
+  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+}
+function warnIfGeminiOAuthSelected(options = {}) {
+  var _a, _b;
+  const filePath = (_a = options.filePath) != null ? _a : defaultGeminiSettingsPath();
+  const writeLine = (_b = options.writeLine) != null ? _b : ((line) => process.stderr.write(line + "\n"));
+  if (!fs3.existsSync(filePath)) {
+    return { action: "no-settings", warned: false };
+  }
+  let raw;
+  try {
+    raw = fs3.readFileSync(filePath, "utf8");
+  } catch (e) {
+    return { action: "parse-error", warned: false };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stripJsoncComments2(raw));
+  } catch (e) {
+    return { action: "parse-error", warned: false };
+  }
+  const selectedType = readSelectedType(parsed);
+  if (selectedType === "gemini-oauth") {
+    writeLine(
+      'warning: ~/.gemini/settings.json has security.auth.selectedType="gemini-oauth". gemini-cli 0.46 will use cached OAuth and ignore GOOGLE_API_KEY / GEMINI_API_KEY, so this `langwatch gemini` call will bypass the gateway. To route through langwatch: edit ~/.gemini/settings.json and set security.auth.selectedType to "gemini-api-key".'
+    );
+    return { action: "oauth-selected", warned: true };
+  }
+  return { action: "api-key-selected", warned: false };
+}
+function readSelectedType(parsed) {
+  if (parsed === null || typeof parsed !== "object") return null;
+  const security = parsed.security;
+  if (security === null || typeof security !== "object") return null;
+  const auth = security.auth;
+  if (auth === null || typeof auth !== "object") return null;
+  const selectedType = auth.selectedType;
+  return typeof selectedType === "string" ? selectedType : null;
+}
+
+// src/cli/utils/governance/wrapper-mode.ts
+var SOURCE_TYPE_BY_TOOL = {
+  claude: "claude_code",
+  codex: "codex",
+  gemini: "gemini",
+  opencode: "opencode"
+};
+async function resolveWrapperMode(cfg, tool, gatewayVars, gatewayClears = [], forcedMode) {
+  var _a, _b, _c, _d, _e, _f, _g;
+  const persistedMode = (_a = cfg.tool_mode) == null ? void 0 : _a[tool];
+  const hasVk = !!((_b = cfg.default_personal_vk) == null ? void 0 : _b.secret);
+  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
+  if (!policy.allowVk && !policy.allowOtelDirect) {
+    throw new (0, _chunk724OLLZ4js.GovernanceCliError)(
+      403,
+      "tool_disabled",
+      `Tool '${tool}' is disabled in the platform policy (both gateway and direct OTLP paths off). Ask your org admin to enable allow_vk or allow_otel_direct.`
+    );
+  }
+  let notice;
+  let mode = forcedMode != null ? forcedMode : persistedMode === "gateway" ? "gateway" : persistedMode === "ingestion" ? "ingestion" : hasVk ? "gateway" : "ingestion";
+  if (mode === "gateway" && !policy.allowVk) {
+    mode = "ingestion";
+    notice = `${lwTag()} gateway path is disabled for ${tool} by your org admin; using direct OTLP ingestion instead.`;
+  }
+  if (mode === "ingestion" && !policy.allowOtelDirect) {
+    mode = "gateway";
+    notice = `${lwTag()} direct OTLP ingestion is disabled for ${tool} by your org admin; routing through the gateway instead.`;
+  }
+  if (mode === "gateway") {
+    if (tool === "gemini") {
+      warnIfGeminiOAuthSelected();
+    }
+    if (tool === "codex") {
+      const gw = _chunkX4BHZH7Pjs.writeCodexGatewayBlock.call(void 0, {
+        gatewayUrl: cfg.gateway_url,
+        envKey: "OPENAI_API_KEY"
+      });
+      return {
+        mode,
+        vars: gatewayVars,
+        clears: gatewayClears,
+        codexConfigPath: gw.path,
+        codexProfilePath: gw.profilePath,
+        extraArgs: ["--profile", gw.profile],
+        notice
+      };
+    }
+    return { mode, vars: gatewayVars, clears: gatewayClears, notice };
+  }
+  const sourceType = SOURCE_TYPE_BY_TOOL[tool];
+  if (!sourceType) {
+    return { mode: "gateway", vars: gatewayVars, clears: gatewayClears, notice };
+  }
+  if (!policy.allowOtelDirect) {
+    throw new (0, _chunk724OLLZ4js.GovernanceCliError)(
+      403,
+      "otel_direct_disabled",
+      `Direct OTLP ingestion is disabled for '${tool}' by your org admin. Ask them to enable allow_otel_direct, or run with the gateway path.`
+    );
+  }
+  const cached = (_c = cfg.default_personal_ingest_keys) == null ? void 0 : _c[sourceType];
+  let token;
+  let prefix;
+  let endpoint;
+  let minted;
+  if (cached == null ? void 0 : cached.secret) {
+    token = cached.secret;
+    prefix = cached.prefix;
+    endpoint = `${cfg.control_plane_url.replace(/\/+$/, "")}/api/otel`;
+    minted = false;
+  } else {
+    const r = await _chunk724OLLZ4js.mintIngestionKey.call(void 0, cfg, sourceType);
+    token = r.token;
+    prefix = r.prefix;
+    endpoint = r.endpoint;
+    minted = true;
+  }
+  const vars = buildOtelEnvBlock(tool, endpoint, token);
+  let codexConfigPath;
+  if (tool === "codex") {
+    const result = _chunkX4BHZH7Pjs.writeCodexOtelBlock.call(void 0, {
+      endpoint: `${endpoint}/v1/traces`,
+      ingestionToken: token,
+      environment: (_e = (_d = cfg.organization) == null ? void 0 : _d.slug) != null ? _e : "langwatch"
+    });
+    codexConfigPath = result.path;
+  }
+  if (tool === "opencode") {
+    setOpencodeOpenTelemetryFlag();
+  }
+  const next = _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, cfg), {
+    tool_mode: _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, (_f = cfg.tool_mode) != null ? _f : {}), { [tool]: "ingestion" })
+  });
+  if (minted) {
+    next.default_personal_ingest_keys = _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, (_g = cfg.default_personal_ingest_keys) != null ? _g : {}), {
+      [sourceType]: { secret: token, prefix }
+    });
+  }
+  try {
+    _chunkOGAE7BVQjs.saveConfig.call(void 0, next);
+  } catch (e) {
+  }
+  return { mode, vars, codexConfigPath, newKeyMinted: minted, notice };
+}
+function buildOtelEnvBlock(tool, endpoint, token) {
+  const base = {
+    OTEL_EXPORTER_OTLP_ENDPOINT: endpoint,
+    OTEL_EXPORTER_OTLP_HEADERS: `Authorization=Bearer ${token}`
+  };
+  switch (tool) {
+    case "claude":
+      return _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {
+        CLAUDE_CODE_ENABLE_TELEMETRY: "1",
+        OTEL_TRACES_EXPORTER: "otlp",
+        OTEL_LOGS_EXPORTER: "otlp",
+        OTEL_METRICS_EXPORTER: "otlp",
+        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json",
+        OTEL_LOG_USER_PROMPTS: "1",
+        OTEL_LOG_TOOL_DETAILS: "1",
+        OTEL_LOG_TOOL_CONTENT: "1",
+        OTEL_LOG_RAW_API_BODIES: "1"
+      }, base), {
+        OTEL_RESOURCE_ATTRIBUTES: "service.name=claude-code"
+      });
+    case "codex":
+      return _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {
+        OTEL_TRACES_EXPORTER: "otlp",
+        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
+      }, base), {
+        OTEL_RESOURCE_ATTRIBUTES: "service.name=codex"
+      });
+    case "gemini":
+      return _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {
+        GEMINI_TELEMETRY_ENABLED: "true",
+        GEMINI_TELEMETRY_TARGET: "local",
+        GEMINI_TELEMETRY_USE_COLLECTOR: "true",
+        GEMINI_TELEMETRY_TRACES_ENABLED: "true",
+        GEMINI_TELEMETRY_OTLP_PROTOCOL: "http",
+        GEMINI_TELEMETRY_OTLP_ENDPOINT: endpoint,
+        GEMINI_TELEMETRY_LOG_PROMPTS: "true",
+        OTEL_TRACES_EXPORTER: "otlp",
+        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
+      }, base), {
+        OTEL_RESOURCE_ATTRIBUTES: "service.name=gemini-cli"
+      });
+    case "opencode":
+      return _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {
+        OTEL_TRACES_EXPORTER: "otlp",
+        OTEL_LOGS_EXPORTER: "otlp",
+        OTEL_METRICS_EXPORTER: "otlp",
+        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
+      }, base), {
+        OTEL_RESOURCE_ATTRIBUTES: "service.name=opencode"
+      });
+    default:
+      return base;
+  }
+}
+
+// src/cli/utils/governance/wrapper-path-choice.ts
+var _prompts = require('prompts'); var _prompts2 = _interopRequireDefault(_prompts);
+var TOOL_MODE_FLAG = "--tool-mode";
+function tokenToMode(token) {
+  const t = (token != null ? token : "").trim().toLowerCase();
+  if (t === "gateway" || t === "vk") return "gateway";
+  if (t === "otlp" || t === "ingestion" || t === "direct") return "ingestion";
+  return null;
+}
+function parseToolModeFlag(args, env = process.env) {
+  var _a;
+  const out = [];
+  let flagOverride;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === TOOL_MODE_FLAG) {
+      const value = args[i + 1];
+      const mode = tokenToMode(value);
+      if (mode) flagOverride = mode;
+      if (value !== void 0) i++;
+      continue;
+    }
+    if (arg.startsWith(`${TOOL_MODE_FLAG}=`)) {
+      const value = arg.slice(TOOL_MODE_FLAG.length + 1);
+      const mode = tokenToMode(value);
+      if (mode) flagOverride = mode;
+      continue;
+    }
+    out.push(arg);
+  }
+  const override = (_a = flagOverride != null ? flagOverride : tokenToMode(env.LANGWATCH_TOOL_MODE)) != null ? _a : void 0;
+  return { args: out, override };
+}
+function isForcedAutoLogin(env) {
+  const flag = env.LANGWATCH_AUTO_LOGIN;
+  return flag === "1" || flag === "true";
+}
+function pathChoiceMessage(tool) {
+  return `How should \`langwatch ${tool}\` run?`;
+}
+function gatewayChoiceTitle() {
+  return "Gateway (virtual key) - route LLM calls through LangWatch (usage billed per token)";
+}
+function otlpChoiceTitle(tool) {
+  return `Direct OTLP - use your own ${tool} plan, send only telemetry to LangWatch`;
+}
+async function resolveWrapperPath(opts) {
+  var _a, _b, _c;
+  const {
+    cfg,
+    tool,
+    override,
+    promptImpl = _prompts2.default,
+    saveImpl = _chunkOGAE7BVQjs.saveConfig,
+    writeImpl = (s) => void process.stderr.write(s),
+    env = process.env
+  } = opts;
+  const isTTY = (_a = opts.isTTY) != null ? _a : Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+  if (override) {
+    return { mode: override, prompted: false };
+  }
+  const pinned = (_b = cfg.tool_mode) == null ? void 0 : _b[tool];
+  if (pinned === "gateway" || pinned === "ingestion") {
+    return { mode: pinned, prompted: false };
+  }
+  if (opts.refreshPolicies) {
+    try {
+      const fresh = await opts.refreshPolicies(cfg);
+      if (fresh) {
+        cfg.tool_policies = fresh;
+        try {
+          saveImpl(_chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, cfg), { tool_policies: fresh }));
+        } catch (e) {
+        }
+      }
+    } catch (e) {
+    }
+  }
+  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
+  const allowGateway = policy.allowVk;
+  const allowOtlp = policy.allowOtelDirect;
+  if (allowGateway && !allowOtlp) {
+    return { mode: "gateway", prompted: false };
+  }
+  if (!allowGateway && allowOtlp) {
+    return { mode: "ingestion", prompted: false };
+  }
+  if (!allowGateway && !allowOtlp) {
+    return { mode: "gateway", prompted: false };
+  }
+  const canPrompt = isTTY && !isForcedAutoLogin(env);
+  if (!canPrompt) {
+    return { mode: "gateway", prompted: false };
+  }
+  const res = await promptImpl({
+    type: "select",
+    name: "path",
+    message: pathChoiceMessage(tool),
+    choices: [
+      {
+        title: gatewayChoiceTitle(),
+        value: "gateway"
+      },
+      {
+        title: otlpChoiceTitle(tool),
+        value: "ingestion"
+      }
+    ],
+    initial: 0
+  });
+  const chosen = tokenToMode(res == null ? void 0 : res.path);
+  if (!chosen) {
+    return { mode: "gateway", prompted: false };
+  }
+  const next = _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, cfg), {
+    tool_mode: _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, (_c = cfg.tool_mode) != null ? _c : {}), { [tool]: chosen })
+  });
+  try {
+    saveImpl(next);
+    cfg.tool_mode = next.tool_mode;
+  } catch (e) {
+  }
+  const label = chosen === "gateway" ? "gateway" : "otlp";
+  writeImpl(
+    `${lwTag()} saved. \`${tool}\` will use the ${label} path. Override with --tool-mode=${chosen === "gateway" ? "otlp" : "gateway"}, or edit ~/.langwatch/config.json (tool_mode.${tool}).
+`
+  );
+  return { mode: chosen, prompted: true };
+}
+
+// src/cli/utils/governance/wrapper.ts
+function envForTool(cfg, tool) {
+  var _a;
+  const gw = cfg.gateway_url.replace(/\/+$/, "");
+  const auth = (_a = cfg.default_personal_vk) == null ? void 0 : _a.secret;
+  if (!auth) return { vars: {} };
+  switch (tool) {
+    case "claude":
+      return {
+        vars: {
+          ANTHROPIC_BASE_URL: gw,
+          ANTHROPIC_AUTH_TOKEN: auth
+        },
+        clears: ["ANTHROPIC_API_KEY"]
+      };
+    case "codex":
+      return {
+        vars: {
+          OPENAI_BASE_URL: gw,
+          OPENAI_API_KEY: auth
+        }
+      };
+    case "cursor":
+      return {
+        vars: {
+          OPENAI_BASE_URL: gw,
+          OPENAI_API_KEY: auth,
+          ANTHROPIC_BASE_URL: gw,
+          ANTHROPIC_AUTH_TOKEN: auth
+        },
+        clears: ["ANTHROPIC_API_KEY"]
+      };
+    case "gemini":
+      return {
+        vars: {
+          GOOGLE_GEMINI_BASE_URL: gw,
+          GEMINI_API_KEY: auth,
+          GOOGLE_API_KEY: auth
+        }
+      };
+    case "opencode":
+      return {
+        vars: {
+          OPENAI_BASE_URL: `${gw}/v1`,
+          OPENAI_API_KEY: auth,
+          ANTHROPIC_BASE_URL: `${gw}/v1`,
+          ANTHROPIC_AUTH_TOKEN: auth,
+          ANTHROPIC_API_KEY: auth
+        }
+      };
+    default:
+      return { vars: {} };
+  }
+}
+var TOOL_PROVIDER_FAMILIES = {
+  claude: ["anthropic"],
+  codex: ["openai"],
+  cursor: ["anthropic", "openai"],
+  gemini: ["google", "gemini"],
+  opencode: ["anthropic", "openai"]
+};
+function shouldForgetGatewayPin(args) {
+  return args.pinnedMode === "gateway" && args.retryable !== true;
+}
+function renderContactFooter(adminEmail) {
+  if (adminEmail) {
+    return `Need help? Contact your LangWatch admin: ${adminEmail}
+`;
+  }
+  return `If you need help, contact your LangWatch admin.
+`;
+}
+async function preflightWrapper(cfg, tool, opts = {}) {
+  var _a, _b, _c, _d, _e;
+  const cp = cfg.control_plane_url.replace(/\/+$/, "");
+  const bootstrap = await ((_a = opts.bootstrapImpl) != null ? _a : (0, _chunk724OLLZ4js.getCliBootstrap))(cfg).catch(
+    () => null
+  );
+  const adminEmail = (_b = bootstrap == null ? void 0 : bootstrap.adminEmail) != null ? _b : null;
+  if (!((_c = cfg.default_personal_vk) == null ? void 0 : _c.secret)) {
+    return {
+      ok: false,
+      message: `No personal virtual key on this account.
+Your organization needs at least one AI provider configured before
+\`langwatch ${tool}\` can route requests.
+If you're an admin, set one up at
+  ${cp}/settings/model-providers
+then run \`langwatch login --device\` to refresh your credentials.
+` + renderContactFooter(adminEmail)
+    };
+  }
+  const gw = cfg.gateway_url.replace(/\/+$/, "");
+  const f = (_d = opts.fetchImpl) != null ? _d : fetch;
+  const timeoutMs = (_e = opts.timeoutMs) != null ? _e : 3e3;
+  try {
+    const res = await f(`${gw}/healthz`, {
+      method: "GET",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) {
+      return {
+        ok: false,
+        retryable: true,
+        message: `AI Gateway at ${gw} returned HTTP ${res.status}.
+The wrapper cannot route \`langwatch ${tool}\` requests until the
+data plane is healthy. Check that the LangWatch gateway is running.
+` + renderContactFooter(adminEmail)
+      };
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      retryable: true,
+      message: `Cannot reach AI Gateway at ${gw}
+  ${err.message}
+Check that the LangWatch gateway is running, or set LANGWATCH_GATEWAY_URL
+if you've deployed it elsewhere.
+` + renderContactFooter(adminEmail)
+    };
+  }
+  const need = TOOL_PROVIDER_FAMILIES[tool];
+  if (need && need.length > 0 && bootstrap && Array.isArray(bootstrap.providers)) {
+    const have = new Set(bootstrap.providers.map((p) => p.name.toLowerCase()));
+    const matches = need.filter((n) => have.has(n));
+    if (matches.length === 0) {
+      const list = need.map((n) => `\`${n}\``).join(" or ");
+      return {
+        ok: false,
+        message: `No ${list} provider is configured for your organization.
+\`langwatch ${tool}\` needs at least one to route requests through the gateway.
+If you're an admin, configure one at
+  ${cp}/settings/model-providers
+` + renderContactFooter(adminEmail)
+      };
+    }
+  }
+  return { ok: true };
+}
+function shouldAutoLogin() {
+  const flag = process.env.LANGWATCH_AUTO_LOGIN;
+  if (flag === "1" || flag === "true") return true;
+  if (flag === "0" || flag === "false") return false;
+  return Boolean(process.stdin.isTTY);
+}
+async function runWrapped(tool, args) {
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i;
+  let cfg = _chunkOGAE7BVQjs.loadConfig.call(void 0, );
+  if (!_chunkOGAE7BVQjs.isLoggedIn.call(void 0, cfg)) {
+    if (!shouldAutoLogin()) {
+      process.stderr.write(
+        "Not logged in. Run `langwatch login --device` first.\n"
+      );
+      process.exit(1);
+    }
+    process.stderr.write(
+      "Not logged in. Starting device-flow login...\n"
+    );
+    try {
+      cfg = await _chunkBAA4HKOBjs.runDeviceFlowLogin.call(void 0, { cfg });
+    } catch (err) {
+      process.stderr.write(
+        `login failed: ${(_a = err.message) != null ? _a : "unknown error"}
+`
+      );
+      process.exit(1);
+    }
+    if (!_chunkOGAE7BVQjs.isLoggedIn.call(void 0, cfg)) {
+      process.stderr.write("login did not complete - exiting\n");
+      process.exit(1);
+    }
+  }
+  const exceeded = await checkBudget(cfg);
+  if (exceeded) {
+    process.stderr.write(renderBudgetExceeded(exceeded));
+    if (exceeded.request_increase_url) {
+      cfg.last_request_increase_url = exceeded.request_increase_url;
+      try {
+        _chunkOGAE7BVQjs.saveConfig.call(void 0, cfg);
+      } catch (e) {
+      }
+    }
+    process.exit(2);
+  }
+  const { args: toolArgs, override: pathOverride } = parseToolModeFlag(args);
+  let pathChoice;
+  try {
+    pathChoice = await resolveWrapperPath({
+      cfg,
+      tool,
+      args: toolArgs,
+      override: pathOverride,
+      // Re-check the org policy at run time so a path the admin disabled
+      // after login is respected without a re-login. Best-effort: on any
+      // failure resolveWrapperPath keeps the login-cached policy map.
+      refreshPolicies: (c) => _chunk724OLLZ4js.getCliBootstrap.call(void 0, c).then((b) => {
+        var _a2;
+        return (_a2 = b == null ? void 0 : b.toolPolicies) != null ? _a2 : null;
+      })
+    });
+  } catch (err) {
+    process.stderr.write(`path selection failed: ${err.message}
+`);
+    process.exit(2);
+  }
+  const toolEnv = envForTool(cfg, tool);
+  const gatewayVars = toolEnv.vars;
+  const gatewayClears = (_b = toolEnv.clears) != null ? _b : [];
+  let modeResult;
+  try {
+    modeResult = await resolveWrapperMode(
+      cfg,
+      tool,
+      gatewayVars,
+      gatewayClears,
+      pathChoice.mode
+    );
+  } catch (err) {
+    const isToolDisabled = err instanceof _chunk724OLLZ4js.GovernanceCliError && err.code === "tool_disabled";
+    const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
+    if (pathChoice.mode === "ingestion" && policy.allowVk && !isToolDisabled) {
+      process.stderr.write(
+        `${lwTag()} couldn't set up direct OTLP ingestion for ${tool} (${err.message}). Falling back to the gateway path.
+`
+      );
+      try {
+        modeResult = await resolveWrapperMode(
+          cfg,
+          tool,
+          gatewayVars,
+          gatewayClears,
+          "gateway"
+        );
+      } catch (err2) {
+        process.stderr.write(
+          `mode resolution failed: ${err2.message}
+`
+        );
+        process.exit(2);
+      }
+    } else {
+      process.stderr.write(
+        `mode resolution failed: ${err.message}
+`
+      );
+      process.exit(2);
+    }
+  }
+  if (modeResult.notice) {
+    process.stderr.write(`${modeResult.notice}
+`);
+  }
+  if (modeResult.mode === "gateway") {
+    const probe = await preflightWrapper(cfg, tool);
+    if (!probe.ok) {
+      process.stderr.write((_c = probe.message) != null ? _c : "preflight failed\n");
+      if (shouldForgetGatewayPin({
+        pinnedMode: (_d = cfg.tool_mode) == null ? void 0 : _d[tool],
+        retryable: probe.retryable
+      })) {
+        const toolMode = _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, cfg.tool_mode);
+        delete toolMode[tool];
+        cfg.tool_mode = toolMode;
+        try {
+          _chunkOGAE7BVQjs.saveConfig.call(void 0, cfg);
+          process.stderr.write(
+            `${lwTag()} cleared the saved gateway path for \`${tool}\`; you'll be asked again next time so you can pick direct OTLP.
+`
+          );
+        } catch (e) {
+        }
+      }
+      process.exit(2);
+    }
+    if (modeResult.codexConfigPath) {
+      process.stderr.write(
+        `${lwTag()} wired [model_providers.langwatch] in ${modeResult.codexConfigPath}.
+`
+      );
+    }
+    if (modeResult.codexProfilePath) {
+      process.stderr.write(
+        `${lwTag()} wrote profile body to ${modeResult.codexProfilePath}.
+`
+      );
+    }
+  } else {
+    if (modeResult.newKeyMinted) {
+      process.stderr.write(
+        `${lwTag()} minted a personal ingestion key for ${tool}.
+`
+      );
+    }
+    if (modeResult.codexConfigPath) {
+      process.stderr.write(
+        `${lwTag()} wrote [otel] activation block to ${modeResult.codexConfigPath}.
+`
+      );
+    }
+    await maybeOfferIngestionShellRcPersist({
+      cfg,
+      tool,
+      vars: modeResult.vars
+    });
+  }
+  const parentEnv = _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, process.env);
+  for (const key of (_e = modeResult.clears) != null ? _e : []) {
+    delete parentEnv[key];
+  }
+  const env = _chunkBRPEG3YQjs.__spreadValues.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, parentEnv), modeResult.vars);
+  const finalArgs = [...(_f = modeResult.extraArgs) != null ? _f : [], ...toolArgs];
+  const shellName = (_h = ((_g = process.env.SHELL) != null ? _g : "").split("/").pop()) != null ? _h : "";
+  const aliasShell = process.platform !== "win32" && (shellName === "zsh" || shellName === "bash") ? process.env.SHELL : null;
+  const notFoundMessage = `${tool} not found in PATH - install it first (https://docs.langwatch.ai/ai-gateway/governance/admin-setup#cli-device-flow-rest-api)`;
+  let child;
+  if (aliasShell) {
+    const q = (s) => `'${s.replace(/'/g, "'\\''")}'`;
+    const reapply = [
+      ...((_i = modeResult.clears) != null ? _i : []).map((k) => `unset ${k}`),
+      ...Object.entries(modeResult.vars).map(([k, v]) => `export ${k}=${q(v)}`)
+    ].join("; ");
+    const guard = `command -v -- ${q(tool)} >/dev/null 2>&1 || { printf '%s\\n' ${q(notFoundMessage)} >&2; exit 127; }`;
+    const command = `${reapply ? `${reapply}; ` : ""}${guard}; ${tool} "$@"`;
+    child = _child_process.spawn.call(void 0, aliasShell, ["-i", "-c", command, tool, ...finalArgs], {
+      stdio: "inherit",
+      env
+    });
+  } else {
+    child = _child_process.spawn.call(void 0, tool, finalArgs, {
+      stdio: "inherit",
+      env,
+      shell: process.platform === "win32"
+    });
+  }
+  child.on("error", (err) => {
+    if (err.code === "ENOENT") {
+      process.stderr.write(`${notFoundMessage}
+`);
+      process.exit(127);
+    }
+    process.stderr.write(`exec ${tool}: ${err.message}
+`);
+    process.exit(1);
+  });
+  await new Promise((resolve) => {
+    child.on("close", (code) => {
+      process.exit(code != null ? code : 1);
+      resolve();
+    });
+  });
+  process.exit(0);
+}
+
+
+
+
+exports.envForTool = envForTool; exports.runWrapped = runWrapped;
+//# sourceMappingURL=chunk-KZDNN6V2.js.map