langwatch 0.32.0 → 0.33.0

package/dist/chunk-35TLPU6Q.mjs

@@ -0,0 +1,1411 @@
+import {
+  writeCodexGatewayBlock,
+  writeCodexOtelBlock
+} from "./chunk-EGOB3GIL.mjs";
+import {
+  runDeviceFlowLogin
+} from "./chunk-KTETIIUG.mjs";
+import {
+  GovernanceCliError,
+  getCliBootstrap,
+  mintIngestionKey
+} from "./chunk-G7XWPZVF.mjs";
+import {
+  isLoggedIn,
+  loadConfig,
+  saveConfig
+} from "./chunk-U47MQ6CS.mjs";
+import {
+  __spreadProps,
+  __spreadValues
+} from "./chunk-BAX4W3AY.mjs";
+
+// src/cli/utils/governance/wrapper.ts
+import { spawn } from "child_process";
+
+// src/cli/utils/governance/brand.ts
+import chalk from "chalk";
+var LANGWATCH_ORANGE = "#ED8926";
+function lwTag() {
+  return chalk.hex(LANGWATCH_ORANGE).bold("\u2726 langwatch");
+}
+
+// src/cli/utils/governance/budget.ts
+async function checkBudget(cfg, opts = {}) {
+  var _a, _b;
+  if (!cfg.access_token) return null;
+  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
+  const url = cfg.control_plane_url.replace(/\/+$/, "") + "/api/auth/cli/budget/status";
+  let res;
+  try {
+    res = await f(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${cfg.access_token}`,
+        Accept: "application/json"
+      }
+    });
+  } catch (e) {
+    return null;
+  }
+  if (res.status === 200) return null;
+  if (res.status === 404) return null;
+  if (res.status === 402) {
+    try {
+      const body = await res.json();
+      if (((_b = body.error) == null ? void 0 : _b.type) && body.error.scope) return body.error;
+    } catch (e) {
+    }
+  }
+  return null;
+}
+var PERIOD_LABEL = {
+  minute: "per-minute",
+  hour: "hourly",
+  day: "daily",
+  week: "weekly",
+  month: "monthly",
+  total: "total"
+};
+function renderBudgetExceeded(e) {
+  var _a;
+  const period = (e.period || "month").toLowerCase();
+  const periodLabel = (_a = PERIOD_LABEL[period]) != null ? _a : period;
+  const lines = [];
+  lines.push("\u26A0  Budget limit reached");
+  lines.push("");
+  lines.push(`   You've used $${e.spent_usd} of your $${e.limit_usd} ${periodLabel} budget.`);
+  lines.push("   To continue, ask your team admin to raise your limit.");
+  lines.push("");
+  if (e.admin_email) {
+    lines.push(`   Admin: ${e.admin_email}`);
+    lines.push("");
+  }
+  lines.push("   Need urgent access? Run:");
+  lines.push("     langwatch request-increase");
+  return lines.join("\n") + "\n";
+}
+
+// src/cli/utils/governance/platform-tool-policy.ts
+var DEFAULTS = {
+  allowVk: true,
+  allowOtelDirect: true
+};
+var PLATFORM_TOOL_POLICIES = {
+  claude: __spreadValues({}, DEFAULTS),
+  codex: __spreadValues({}, DEFAULTS),
+  gemini: __spreadValues({}, DEFAULTS),
+  opencode: __spreadValues({}, DEFAULTS),
+  // cursor is GUI-only; Path B is not meaningful (no terminal env
+  // reaches the agent panel). The wrapper still gates on this so
+  // future GUI integrations can flip allowOtelDirect to true.
+  cursor: { allowVk: true, allowOtelDirect: false }
+};
+function hardcodedPolicy(toolSlug) {
+  if (toolSlug in PLATFORM_TOOL_POLICIES) {
+    return PLATFORM_TOOL_POLICIES[toolSlug];
+  }
+  return DEFAULTS;
+}
+function resolvePlatformToolPolicy(toolSlug, cachedPolicies) {
+  const cached = cachedPolicies == null ? void 0 : cachedPolicies[toolSlug];
+  if (cached) return cached;
+  return hardcodedPolicy(toolSlug);
+}
+
+// src/cli/utils/governance/shell-rc.ts
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import * as readline from "readline";
+import chalk2 from "chalk";
+var BLOCK_BEGIN = "# >>> langwatch begin >>>";
+var BLOCK_END = "# <<< langwatch end <<<";
+function detectShell() {
+  var _a;
+  const raw = ((_a = process.env.SHELL) != null ? _a : "").toLowerCase();
+  if (raw.includes("fish")) return "fish";
+  if (raw.includes("zsh")) return "zsh";
+  if (raw.includes("bash")) return "bash";
+  if (process.platform === "darwin") return "zsh";
+  if (process.platform === "linux") return "bash";
+  return null;
+}
+function rcPath(shell) {
+  const home = os.homedir();
+  switch (shell) {
+    case "zsh":
+      return path.join(home, ".zshrc");
+    case "bash":
+      return path.join(home, ".bashrc");
+    case "fish":
+      return path.join(home, ".config", "fish", "config.fish");
+  }
+}
+function rcHasLangwatchBlock({
+  shell,
+  requiredKeys
+}) {
+  try {
+    const content = fs.readFileSync(rcPath(shell), "utf8");
+    const begin = content.indexOf(BLOCK_BEGIN);
+    const end = content.indexOf(BLOCK_END);
+    if (begin === -1 || end === -1 || end < begin) return false;
+    if (!requiredKeys || requiredKeys.length === 0) return true;
+    const block = content.slice(begin, end);
+    return requiredKeys.every((k) => block.includes(k));
+  } catch (e) {
+    return false;
+  }
+}
+function quote(s) {
+  if (!/[ \t\n'"$\\]/.test(s)) return s;
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+function buildOtelExportBlock(vars, shell) {
+  const entries = Object.entries(vars);
+  const fmt = shell === "fish" ? ([k, v]) => `set -gx ${k} ${quote(v)}` : ([k, v]) => `export ${k}=${quote(v)}`;
+  return entries.map(fmt).join("\n");
+}
+function persistBlockToRc(shell, block) {
+  const file = rcPath(shell);
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  const wrapped = `${BLOCK_BEGIN}
+${block}
+${BLOCK_END}
+`;
+  let existing = "";
+  try {
+    existing = fs.readFileSync(file, "utf8");
+  } catch (e) {
+  }
+  const marker = new RegExp(
+    `${escapeRegex(BLOCK_BEGIN)}[\\s\\S]*?${escapeRegex(BLOCK_END)}\\n?`,
+    "m"
+  );
+  let next;
+  if (marker.test(existing)) {
+    next = existing.replace(marker, wrapped);
+  } else {
+    const needsNewline = existing.length > 0 && !existing.endsWith("\n");
+    next = existing + (needsNewline ? "\n" : "") + "\n" + wrapped;
+  }
+  fs.writeFileSync(file, next);
+  return file;
+}
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function askPersistChoice(rcPathHint, tool) {
+  if (!process.stdin.isTTY) return "skip";
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const ans = await new Promise((resolve) => {
+    rl.question(
+      `Install env vars to ${rcPathHint} so that next time the plain \`${tool}\` command keeps capturing telemetry data? [Y/n/never] `,
+      (a) => resolve(a)
+    );
+  });
+  rl.close();
+  const norm = ans.trim().toLowerCase();
+  if (norm === "" || norm === "y" || norm === "yes") return "yes";
+  if (norm === "never") return "never";
+  return "no";
+}
+async function maybeOfferIngestionShellRcPersist({
+  cfg,
+  tool,
+  vars
+}) {
+  if (cfg.shell_rc_preference === "skip") return;
+  if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) return;
+  const shell = detectShell();
+  if (!shell) return;
+  if (Object.keys(vars).length === 0) return;
+  if (rcHasLangwatchBlock({ shell, requiredKeys: Object.keys(vars) })) return;
+  const block = buildOtelExportBlock(vars, shell);
+  const target = rcPath(shell);
+  console.log();
+  const choice = await askPersistChoice(target, tool);
+  if (choice === "skip" || choice === "no") return;
+  if (choice === "never") {
+    cfg.shell_rc_preference = "skip";
+    try {
+      saveConfig(cfg);
+    } catch (e) {
+    }
+    return;
+  }
+  try {
+    const wrote = persistBlockToRc(shell, block);
+    console.log(
+      chalk2.green(`  \u2713 Installed langwatch telemetry exports to ${wrote}`)
+    );
+  } catch (err) {
+    console.log(
+      chalk2.yellow(`  ! Couldn't write to ${target}: ${err.message}`)
+    );
+  }
+}
+
+// src/cli/utils/opencode-config-flag.ts
+import fs2 from "fs";
+import os2 from "os";
+import path2 from "path";
+function defaultOpencodeConfigPath() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const configHome = xdg && xdg.length > 0 ? xdg : path2.join(os2.homedir(), ".config");
+  return path2.join(configHome, "opencode", "opencode.jsonc");
+}
+function stripJsoncComments(s) {
+  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+}
+function setOpencodeOpenTelemetryFlag(options = {}) {
+  var _a, _b;
+  const filePath = (_a = options.filePath) != null ? _a : defaultOpencodeConfigPath();
+  if (!fs2.existsSync(filePath)) {
+    fs2.mkdirSync(path2.dirname(filePath), { recursive: true });
+    const content = JSON.stringify(
+      {
+        $schema: "https://opencode.ai/config.json",
+        experimental: { openTelemetry: true }
+      },
+      null,
+      2
+    ) + "\n";
+    fs2.writeFileSync(filePath, content, { mode: 384 });
+    return { action: "created", path: filePath };
+  }
+  const raw = fs2.readFileSync(filePath, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(stripJsoncComments(raw));
+  } catch (e) {
+    parsed = { $schema: "https://opencode.ai/config.json" };
+  }
+  const experimental = (_b = parsed.experimental) != null ? _b : {};
+  const prior = experimental.openTelemetry;
+  if (prior === true) return { action: "unchanged", path: filePath };
+  if (prior === false) return { action: "disabled-by-user", path: filePath };
+  parsed.experimental = __spreadProps(__spreadValues({}, experimental), { openTelemetry: true });
+  fs2.writeFileSync(filePath, JSON.stringify(parsed, null, 2) + "\n", {
+    mode: 384
+  });
+  return { action: "updated", path: filePath };
+}
+
+// src/cli/utils/governance/gemini-settings-preflight.ts
+import * as fs3 from "fs";
+import * as os3 from "os";
+import * as path3 from "path";
+function defaultGeminiSettingsPath() {
+  var _a;
+  const home = (_a = process.env.HOME) != null ? _a : os3.homedir();
+  return path3.join(home, ".gemini", "settings.json");
+}
+function stripJsoncComments2(s) {
+  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+}
+function warnIfGeminiOAuthSelected(options = {}) {
+  var _a, _b;
+  const filePath = (_a = options.filePath) != null ? _a : defaultGeminiSettingsPath();
+  const writeLine = (_b = options.writeLine) != null ? _b : ((line) => process.stderr.write(line + "\n"));
+  if (!fs3.existsSync(filePath)) {
+    return { action: "no-settings", warned: false };
+  }
+  let raw;
+  try {
+    raw = fs3.readFileSync(filePath, "utf8");
+  } catch (e) {
+    return { action: "parse-error", warned: false };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stripJsoncComments2(raw));
+  } catch (e) {
+    return { action: "parse-error", warned: false };
+  }
+  const selectedType = readSelectedType(parsed);
+  if (selectedType === "gemini-oauth") {
+    writeLine(
+      'warning: ~/.gemini/settings.json has security.auth.selectedType="gemini-oauth". gemini-cli 0.46 will use cached OAuth and ignore GOOGLE_API_KEY / GEMINI_API_KEY, so this `langwatch gemini` call will bypass the gateway. To route through langwatch: edit ~/.gemini/settings.json and set security.auth.selectedType to "gemini-api-key".'
+    );
+    return { action: "oauth-selected", warned: true };
+  }
+  return { action: "api-key-selected", warned: false };
+}
+function readSelectedType(parsed) {
+  if (parsed === null || typeof parsed !== "object") return null;
+  const security = parsed.security;
+  if (security === null || typeof security !== "object") return null;
+  const auth = security.auth;
+  if (auth === null || typeof auth !== "object") return null;
+  const selectedType = auth.selectedType;
+  return typeof selectedType === "string" ? selectedType : null;
+}
+
+// src/cli/utils/governance/wrapper-mode.ts
+var SOURCE_TYPE_BY_TOOL = {
+  claude: "claude_code",
+  codex: "codex",
+  gemini: "gemini",
+  opencode: "opencode"
+};
+async function resolveWrapperMode(cfg, tool, gatewayVars, gatewayClears = [], forcedMode) {
+  var _a, _b, _c, _d, _e, _f, _g;
+  const persistedMode = (_a = cfg.tool_mode) == null ? void 0 : _a[tool];
+  const hasVk = !!((_b = cfg.default_personal_vk) == null ? void 0 : _b.secret);
+  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
+  if (!policy.allowVk && !policy.allowOtelDirect) {
+    throw new GovernanceCliError(
+      403,
+      "tool_disabled",
+      `Tool '${tool}' is disabled in the platform policy (both gateway and direct OTLP paths off). Ask your org admin to enable allow_vk or allow_otel_direct.`
+    );
+  }
+  let notice;
+  let mode = forcedMode != null ? forcedMode : persistedMode === "gateway" ? "gateway" : persistedMode === "ingestion" ? "ingestion" : hasVk ? "gateway" : "ingestion";
+  if (mode === "gateway" && !policy.allowVk) {
+    mode = "ingestion";
+    notice = `${lwTag()} gateway path is disabled for ${tool} by your org admin; using direct OTLP ingestion instead.`;
+  }
+  if (mode === "ingestion" && !policy.allowOtelDirect) {
+    mode = "gateway";
+    notice = `${lwTag()} direct OTLP ingestion is disabled for ${tool} by your org admin; routing through the gateway instead.`;
+  }
+  if (mode === "gateway") {
+    if (tool === "gemini") {
+      warnIfGeminiOAuthSelected();
+    }
+    if (tool === "codex") {
+      const gw = writeCodexGatewayBlock({
+        gatewayUrl: cfg.gateway_url,
+        envKey: "OPENAI_API_KEY"
+      });
+      return {
+        mode,
+        vars: gatewayVars,
+        clears: gatewayClears,
+        codexConfigPath: gw.path,
+        codexProfilePath: gw.profilePath,
+        extraArgs: ["--profile", gw.profile],
+        notice
+      };
+    }
+    return { mode, vars: gatewayVars, clears: gatewayClears, notice };
+  }
+  const sourceType = SOURCE_TYPE_BY_TOOL[tool];
+  if (!sourceType) {
+    return { mode: "gateway", vars: gatewayVars, clears: gatewayClears, notice };
+  }
+  if (!policy.allowOtelDirect) {
+    throw new GovernanceCliError(
+      403,
+      "otel_direct_disabled",
+      `Direct OTLP ingestion is disabled for '${tool}' by your org admin. Ask them to enable allow_otel_direct, or run with the gateway path.`
+    );
+  }
+  const cached = (_c = cfg.default_personal_ingest_keys) == null ? void 0 : _c[sourceType];
+  let token;
+  let prefix;
+  let endpoint;
+  let minted;
+  if (cached == null ? void 0 : cached.secret) {
+    token = cached.secret;
+    prefix = cached.prefix;
+    endpoint = `${cfg.control_plane_url.replace(/\/+$/, "")}/api/otel`;
+    minted = false;
+  } else {
+    const r = await mintIngestionKey(cfg, sourceType);
+    token = r.token;
+    prefix = r.prefix;
+    endpoint = r.endpoint;
+    minted = true;
+  }
+  const vars = buildOtelEnvBlock(tool, endpoint, token);
+  let codexConfigPath;
+  if (tool === "codex") {
+    const result = writeCodexOtelBlock({
+      endpoint: `${endpoint}/v1/traces`,
+      ingestionToken: token,
+      environment: (_e = (_d = cfg.organization) == null ? void 0 : _d.slug) != null ? _e : "langwatch"
+    });
+    codexConfigPath = result.path;
+  }
+  if (tool === "opencode") {
+    setOpencodeOpenTelemetryFlag();
+  }
+  const next = __spreadProps(__spreadValues({}, cfg), {
+    tool_mode: __spreadProps(__spreadValues({}, (_f = cfg.tool_mode) != null ? _f : {}), { [tool]: "ingestion" })
+  });
+  if (minted) {
+    next.default_personal_ingest_keys = __spreadProps(__spreadValues({}, (_g = cfg.default_personal_ingest_keys) != null ? _g : {}), {
+      [sourceType]: { secret: token, prefix }
+    });
+  }
+  try {
+    saveConfig(next);
+  } catch (e) {
+  }
+  return {
+    mode,
+    vars,
+    codexConfigPath,
+    newKeyMinted: minted,
+    notice,
+    endpoint,
+    ingestionToken: token
+  };
+}
+function buildOtelEnvBlock(tool, endpoint, token) {
+  const base = {
+    OTEL_EXPORTER_OTLP_ENDPOINT: endpoint,
+    OTEL_EXPORTER_OTLP_HEADERS: `Authorization=Bearer ${token}`
+  };
+  switch (tool) {
+    case "claude":
+      return __spreadProps(__spreadValues({
+        CLAUDE_CODE_ENABLE_TELEMETRY: "1",
+        OTEL_TRACES_EXPORTER: "otlp",
+        OTEL_LOGS_EXPORTER: "otlp",
+        OTEL_METRICS_EXPORTER: "otlp",
+        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json",
+        OTEL_LOG_USER_PROMPTS: "1",
+        OTEL_LOG_TOOL_DETAILS: "1",
+        OTEL_LOG_TOOL_CONTENT: "1",
+        OTEL_LOG_RAW_API_BODIES: "1"
+      }, base), {
+        OTEL_RESOURCE_ATTRIBUTES: "service.name=claude-code"
+      });
+    case "codex":
+      return __spreadProps(__spreadValues({
+        OTEL_TRACES_EXPORTER: "otlp",
+        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
+      }, base), {
+        OTEL_RESOURCE_ATTRIBUTES: "service.name=codex"
+      });
+    case "gemini":
+      return __spreadProps(__spreadValues({
+        GEMINI_TELEMETRY_ENABLED: "true",
+        GEMINI_TELEMETRY_TARGET: "local",
+        GEMINI_TELEMETRY_USE_COLLECTOR: "true",
+        GEMINI_TELEMETRY_TRACES_ENABLED: "true",
+        GEMINI_TELEMETRY_OTLP_PROTOCOL: "http",
+        GEMINI_TELEMETRY_OTLP_ENDPOINT: endpoint,
+        GEMINI_TELEMETRY_LOG_PROMPTS: "true",
+        OTEL_TRACES_EXPORTER: "otlp",
+        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
+      }, base), {
+        OTEL_RESOURCE_ATTRIBUTES: "service.name=gemini-cli"
+      });
+    case "opencode":
+      return __spreadProps(__spreadValues({
+        OTEL_TRACES_EXPORTER: "otlp",
+        OTEL_LOGS_EXPORTER: "otlp",
+        OTEL_METRICS_EXPORTER: "otlp",
+        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
+      }, base), {
+        OTEL_RESOURCE_ATTRIBUTES: "service.name=opencode"
+      });
+    default:
+      return base;
+  }
+}
+
+// src/cli/utils/governance/codex-rollout-otlp.ts
+import { createHash } from "crypto";
+import { readFile, readdir, stat } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+
+// src/cli/utils/governance/codex-rollout.ts
+var MAX_CONTENT_CHARS = 3e4;
+var MAX_INPUT_CHARS = 12e4;
+var MAX_OUTPUT_CHARS = 3e4;
+function truncate(text, max) {
+  return text.length > max ? `${text.slice(0, max)}\u2026[truncated]` : text;
+}
+function textFromContent(content) {
+  if (!Array.isArray(content)) return "";
+  const parts = [];
+  for (const part of content) {
+    if (part && typeof part === "object") {
+      const t = part.text;
+      const ot = part.output_text;
+      if (typeof t === "string") parts.push(t);
+      else if (typeof ot === "string") parts.push(ot);
+    }
+  }
+  return parts.join("").trim();
+}
+function outputToText(output) {
+  if (typeof output === "string") return output;
+  if (output && typeof output === "object") {
+    const inner = output.output;
+    if (typeof inner === "string") return inner;
+    try {
+      return JSON.stringify(output);
+    } catch (e) {
+      return "";
+    }
+  }
+  if (typeof output === "number" || typeof output === "boolean") {
+    return String(output);
+  }
+  return "";
+}
+function capInputMessages(messages) {
+  var _a;
+  const capped = messages.map(
+    (m) => typeof m.content === "string" && m.content.length > MAX_CONTENT_CHARS ? __spreadProps(__spreadValues({}, m), { content: truncate(m.content, MAX_CONTENT_CHARS) }) : m
+  );
+  const serializedLength = () => JSON.stringify(capped).length;
+  let i = 0;
+  while (serializedLength() > MAX_INPUT_CHARS && i < capped.length) {
+    if (((_a = capped[i]) == null ? void 0 : _a.role) === "system") {
+      i++;
+      continue;
+    }
+    capped.splice(i, 1);
+  }
+  return capped;
+}
+function explicitToolCallId(payload) {
+  if (typeof payload.call_id === "string" && payload.call_id) {
+    return payload.call_id;
+  }
+  if (typeof payload.id === "string" && payload.id) return payload.id;
+  return null;
+}
+var CodexTurnAccumulator = class {
+  constructor() {
+    /** Emitted turns, in rollout order. */
+    this.turns = [];
+    /** Accumulating conversation across the whole rollout (claude-style). */
+    this.history = [];
+    this.sessionModel = null;
+    this.cur = null;
+    /** Latest assistant text not yet committed to history (the final-answer candidate). */
+    this.pendingAssistant = null;
+    /** Authoritative final answer from the agent_message(final_answer) event. */
+    this.agentFinal = null;
+    /**
+     * Synthetic ids minted for tool calls that arrived without a `call_id`, queued
+     * FIFO so the matching (also id-less) function_call_output pairs to the same id
+     * instead of drifting as the running history grows.
+     */
+    this.pendingToolCallIds = [];
+    this.autoToolCallSeq = 0;
+  }
+  /** Route one parsed rollout line to the handler for its event type. */
+  handle(obj) {
+    var _a;
+    const payload = (_a = obj.payload) != null ? _a : {};
+    switch (obj.type) {
+      case "session_meta":
+        return this.onSessionMeta(payload);
+      case "turn_context":
+        return this.onTurnContext(payload);
+      case "event_msg":
+        return this.onEventMsg(payload);
+      case "response_item":
+        return this.onResponseItem(payload);
+    }
+  }
+  /** Close the trailing open turn and return every emitted turn. */
+  finish() {
+    this.closeTurn();
+    return this.turns;
+  }
+  onSessionMeta(payload) {
+    const bi = payload.base_instructions;
+    if (typeof bi === "string" && bi.trim()) {
+      this.history.push({ role: "system", content: bi.trim() });
+    }
+  }
+  onTurnContext(payload) {
+    const m = payload.model;
+    if (typeof m === "string" && m) {
+      this.sessionModel = m;
+      if (this.cur) this.cur.model = m;
+    }
+  }
+  onEventMsg(payload) {
+    if (payload.type === "task_started") return this.onTaskStarted(payload);
+    if (payload.type === "task_complete") return this.closeTurn();
+    if (!this.cur) return;
+    if (payload.type === "agent_message") this.onAgentMessage(payload);
+  }
+  onTaskStarted(payload) {
+    this.closeTurn();
+    const traceId = typeof payload.trace_id === "string" ? payload.trace_id : null;
+    if (!traceId) return;
+    this.cur = {
+      traceId,
+      turnId: typeof payload.turn_id === "string" ? payload.turn_id : null,
+      model: this.sessionModel,
+      startedAtMs: typeof payload.started_at === "number" ? payload.started_at * 1e3 : null
+    };
+  }
+  onAgentMessage(payload) {
+    const msg = payload.message;
+    if (typeof msg === "string" && msg.trim() && payload.phase === "final_answer") {
+      this.agentFinal = msg.trim();
+    }
+  }
+  onResponseItem(payload) {
+    if (!this.cur) return;
+    switch (payload.type) {
+      case "message":
+        return this.onMessage(payload);
+      case "function_call":
+        return this.onFunctionCall(payload);
+      case "function_call_output":
+        return this.onFunctionCallOutput(payload);
+    }
+  }
+  onMessage(payload) {
+    const role = payload.role;
+    const text = textFromContent(payload.content);
+    if (!text) return;
+    if (role === "developer") {
+      this.flushPendingAssistant();
+      this.history.push({ role: "system", content: text });
+    } else if (role === "user") {
+      this.flushPendingAssistant();
+      this.history.push({ role: "user", content: text });
+    } else if (role === "assistant") {
+      this.flushPendingAssistant();
+      this.pendingAssistant = text;
+    }
+  }
+  onFunctionCall(payload) {
+    this.flushPendingAssistant();
+    let callId = explicitToolCallId(payload);
+    if (!callId) {
+      callId = `call_auto_${this.autoToolCallSeq++}`;
+      this.pendingToolCallIds.push(callId);
+    }
+    const name = typeof payload.name === "string" ? payload.name : "tool";
+    const args = typeof payload.arguments === "string" ? payload.arguments : payload.arguments != null ? JSON.stringify(payload.arguments) : "";
+    this.history.push({
+      role: "assistant",
+      tool_calls: [
+        {
+          id: callId,
+          type: "function",
+          function: { name, arguments: truncate(args, MAX_CONTENT_CHARS) }
+        }
+      ]
+    });
+  }
+  onFunctionCallOutput(payload) {
+    var _a, _b;
+    this.flushPendingAssistant();
+    const callId = (_b = (_a = explicitToolCallId(payload)) != null ? _a : this.pendingToolCallIds.shift()) != null ? _b : `call_auto_${this.autoToolCallSeq++}`;
+    this.history.push({
+      role: "tool",
+      tool_call_id: callId,
+      content: truncate(outputToText(payload.output), MAX_CONTENT_CHARS)
+    });
+  }
+  flushPendingAssistant() {
+    if (this.pendingAssistant !== null) {
+      this.history.push({ role: "assistant", content: this.pendingAssistant });
+      this.pendingAssistant = null;
+    }
+  }
+  closeTurn() {
+    var _a, _b;
+    if (this.cur) {
+      const finalAnswer = (_a = this.agentFinal) != null ? _a : this.pendingAssistant;
+      if (finalAnswer == null ? void 0 : finalAnswer.trim()) {
+        this.turns.push({
+          traceId: this.cur.traceId,
+          turnId: this.cur.turnId,
+          model: (_b = this.cur.model) != null ? _b : this.sessionModel,
+          inputMessages: capInputMessages([...this.history]),
+          output: truncate(finalAnswer.trim(), MAX_OUTPUT_CHARS),
+          startedAtMs: this.cur.startedAtMs
+        });
+        this.history.push({ role: "assistant", content: finalAnswer.trim() });
+      }
+    }
+    this.pendingToolCallIds.length = 0;
+    this.cur = null;
+    this.pendingAssistant = null;
+    this.agentFinal = null;
+  }
+};
+function parseCodexRollout(content) {
+  const acc = new CodexTurnAccumulator();
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let obj;
+    try {
+      obj = JSON.parse(trimmed);
+    } catch (e) {
+      continue;
+    }
+    acc.handle(obj);
+  }
+  return acc.finish();
+}
+
+// src/cli/utils/governance/codex-rollout-otlp.ts
+function ioSpanId(traceId) {
+  return createHash("sha256").update(`${traceId}:langwatch.io`).digest("hex").slice(0, 16);
+}
+function attr(key, value) {
+  return { key, value: { stringValue: value } };
+}
+function buildCodexIOExportRequest(turns, nowMs) {
+  const spans = turns.map((turn) => {
+    var _a;
+    const startMs = (_a = turn.startedAtMs) != null ? _a : nowMs;
+    const endMs = Math.max(startMs, nowMs);
+    const attributes = [
+      attr("langwatch.span.type", "llm"),
+      attr(
+        "langwatch.input",
+        JSON.stringify({ type: "chat_messages", value: turn.inputMessages })
+      ),
+      attr("langwatch.output", turn.output)
+    ];
+    if (turn.model) {
+      attributes.push(attr("gen_ai.request.model", turn.model));
+      attributes.push(attr("gen_ai.response.model", turn.model));
+    }
+    return {
+      traceId: turn.traceId,
+      spanId: ioSpanId(turn.traceId),
+      name: "codex.turn.response",
+      kind: 1,
+      startTimeUnixNano: `${startMs}000000`,
+      endTimeUnixNano: `${endMs}000000`,
+      attributes,
+      status: {}
+    };
+  });
+  return {
+    resourceSpans: [
+      {
+        resource: { attributes: [attr("service.name", "codex")] },
+        scopeSpans: [
+          {
+            // A langwatch.* scope (NOT codex_cli_rs) so the ingestion
+            // infra-span filter leaves these content spans alone.
+            scope: { name: "langwatch.codex.rollout" },
+            spans
+          }
+        ]
+      }
+    ]
+  };
+}
+async function findRecentRollouts(sinceMs, sessionsRoot = join3(homedir3(), ".codex", "sessions")) {
+  const out = [];
+  async function walk(dir, depth) {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch (e) {
+      return;
+    }
+    for (const e of entries) {
+      const full = join3(dir, e.name);
+      if (e.isDirectory()) {
+        if (depth < 3) await walk(full, depth + 1);
+      } else if (e.isFile() && e.name.startsWith("rollout-") && e.name.endsWith(".jsonl")) {
+        try {
+          const s = await stat(full);
+          if (s.mtimeMs >= sinceMs) out.push(full);
+        } catch (e2) {
+        }
+      }
+    }
+  }
+  await walk(sessionsRoot, 0);
+  return out;
+}
+async function readRolloutTurns(sinceMs, sessionsRoot) {
+  const files = await findRecentRollouts(sinceMs, sessionsRoot);
+  const turns = [];
+  for (const file of files) {
+    try {
+      turns.push(...parseCodexRollout(await readFile(file, "utf8")));
+    } catch (e) {
+    }
+  }
+  return turns;
+}
+async function postCodexTurns(args) {
+  const { turns, nowMs, endpoint, token, fetchImpl } = args;
+  const body = buildCodexIOExportRequest(turns, nowMs);
+  const doFetch = fetchImpl != null ? fetchImpl : fetch;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 5e3);
+  try {
+    await doFetch(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function createCodexIOStreamer(args) {
+  var _a;
+  const root = (_a = args.sessionsRoot) != null ? _a : join3(homedir3(), ".codex", "sessions");
+  const emitted = /* @__PURE__ */ new Set();
+  return {
+    async harvest(nowMs) {
+      const turns = await readRolloutTurns(args.sinceMs, root);
+      const fresh = turns.filter((t) => t.traceId && !emitted.has(t.traceId));
+      if (fresh.length === 0) return 0;
+      await postCodexTurns({
+        turns: fresh,
+        nowMs,
+        endpoint: args.endpoint,
+        token: args.token,
+        fetchImpl: args.fetchImpl
+      });
+      for (const t of fresh) emitted.add(t.traceId);
+      return fresh.length;
+    }
+  };
+}
+
+// src/cli/utils/governance/wrapper-path-choice.ts
+import prompts from "prompts";
+var TOOL_MODE_FLAG = "--tool-mode";
+function tokenToMode(token) {
+  const t = (token != null ? token : "").trim().toLowerCase();
+  if (t === "gateway" || t === "vk") return "gateway";
+  if (t === "otlp" || t === "ingestion" || t === "direct") return "ingestion";
+  return null;
+}
+function parseToolModeFlag(args, env = process.env) {
+  var _a;
+  const out = [];
+  let flagOverride;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === TOOL_MODE_FLAG) {
+      const value = args[i + 1];
+      const mode = tokenToMode(value);
+      if (mode) flagOverride = mode;
+      if (value !== void 0) i++;
+      continue;
+    }
+    if (arg.startsWith(`${TOOL_MODE_FLAG}=`)) {
+      const value = arg.slice(TOOL_MODE_FLAG.length + 1);
+      const mode = tokenToMode(value);
+      if (mode) flagOverride = mode;
+      continue;
+    }
+    out.push(arg);
+  }
+  const override = (_a = flagOverride != null ? flagOverride : tokenToMode(env.LANGWATCH_TOOL_MODE)) != null ? _a : void 0;
+  return { args: out, override };
+}
+function isForcedAutoLogin(env) {
+  const flag = env.LANGWATCH_AUTO_LOGIN;
+  return flag === "1" || flag === "true";
+}
+function pathChoiceMessage(tool) {
+  return `How should \`langwatch ${tool}\` run?`;
+}
+function gatewayChoiceTitle() {
+  return "Gateway (virtual key) - route LLM calls through LangWatch (usage billed per token)";
+}
+function otlpChoiceTitle(tool) {
+  return `Direct OTLP - use your own ${tool} plan, send only telemetry to LangWatch`;
+}
+async function resolveWrapperPath(opts) {
+  var _a, _b, _c;
+  const {
+    cfg,
+    tool,
+    override,
+    promptImpl = prompts,
+    saveImpl = saveConfig,
+    writeImpl = (s) => void process.stderr.write(s),
+    env = process.env
+  } = opts;
+  const isTTY = (_a = opts.isTTY) != null ? _a : Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+  if (override) {
+    return { mode: override, prompted: false };
+  }
+  const pinned = (_b = cfg.tool_mode) == null ? void 0 : _b[tool];
+  if (pinned === "gateway" || pinned === "ingestion") {
+    return { mode: pinned, prompted: false };
+  }
+  if (opts.refreshPolicies) {
+    try {
+      const fresh = await opts.refreshPolicies(cfg);
+      if (fresh) {
+        cfg.tool_policies = fresh;
+        try {
+          saveImpl(__spreadProps(__spreadValues({}, cfg), { tool_policies: fresh }));
+        } catch (e) {
+        }
+      }
+    } catch (e) {
+    }
+  }
+  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
+  const allowGateway = policy.allowVk;
+  const allowOtlp = policy.allowOtelDirect;
+  if (allowGateway && !allowOtlp) {
+    return { mode: "gateway", prompted: false };
+  }
+  if (!allowGateway && allowOtlp) {
+    return { mode: "ingestion", prompted: false };
+  }
+  if (!allowGateway && !allowOtlp) {
+    return { mode: "gateway", prompted: false };
+  }
+  const canPrompt = isTTY && !isForcedAutoLogin(env);
+  if (!canPrompt) {
+    return { mode: "gateway", prompted: false };
+  }
+  const res = await promptImpl({
+    type: "select",
+    name: "path",
+    message: pathChoiceMessage(tool),
+    choices: [
+      {
+        title: gatewayChoiceTitle(),
+        value: "gateway"
+      },
+      {
+        title: otlpChoiceTitle(tool),
+        value: "ingestion"
+      }
+    ],
+    initial: 0
+  });
+  const chosen = tokenToMode(res == null ? void 0 : res.path);
+  if (!chosen) {
+    return { mode: "gateway", prompted: false };
+  }
+  const next = __spreadProps(__spreadValues({}, cfg), {
+    tool_mode: __spreadProps(__spreadValues({}, (_c = cfg.tool_mode) != null ? _c : {}), { [tool]: chosen })
+  });
+  try {
+    saveImpl(next);
+    cfg.tool_mode = next.tool_mode;
+  } catch (e) {
+  }
+  const label = chosen === "gateway" ? "gateway" : "otlp";
+  writeImpl(
+    `${lwTag()} saved. \`${tool}\` will use the ${label} path. Override with --tool-mode=${chosen === "gateway" ? "otlp" : "gateway"}, or edit ~/.langwatch/config.json (tool_mode.${tool}).
+`
+  );
+  return { mode: chosen, prompted: true };
+}
+
+// src/cli/utils/governance/wrapper.ts
+var CODEX_IO_POLL_MS = 2500;
+function envForTool(cfg, tool) {
+  var _a;
+  const gw = cfg.gateway_url.replace(/\/+$/, "");
+  const auth = (_a = cfg.default_personal_vk) == null ? void 0 : _a.secret;
+  if (!auth) return { vars: {} };
+  switch (tool) {
+    case "claude":
+      return {
+        vars: {
+          ANTHROPIC_BASE_URL: gw,
+          ANTHROPIC_AUTH_TOKEN: auth
+        },
+        clears: ["ANTHROPIC_API_KEY"]
+      };
+    case "codex":
+      return {
+        vars: {
+          OPENAI_BASE_URL: gw,
+          OPENAI_API_KEY: auth
+        }
+      };
+    case "cursor":
+      return {
+        vars: {
+          OPENAI_BASE_URL: gw,
+          OPENAI_API_KEY: auth,
+          ANTHROPIC_BASE_URL: gw,
+          ANTHROPIC_AUTH_TOKEN: auth
+        },
+        clears: ["ANTHROPIC_API_KEY"]
+      };
+    case "gemini":
+      return {
+        vars: {
+          GOOGLE_GEMINI_BASE_URL: gw,
+          GEMINI_API_KEY: auth,
+          GOOGLE_API_KEY: auth
+        }
+      };
+    case "opencode":
+      return {
+        vars: {
+          OPENAI_BASE_URL: `${gw}/v1`,
+          OPENAI_API_KEY: auth,
+          ANTHROPIC_BASE_URL: `${gw}/v1`,
+          ANTHROPIC_AUTH_TOKEN: auth,
+          ANTHROPIC_API_KEY: auth
+        }
+      };
+    default:
+      return { vars: {} };
+  }
+}
+var TOOL_PROVIDER_FAMILIES = {
+  claude: ["anthropic"],
+  codex: ["openai"],
+  cursor: ["anthropic", "openai"],
+  gemini: ["google", "gemini"],
+  opencode: ["anthropic", "openai"]
+};
+function shouldForgetGatewayPin(args) {
+  return args.pinnedMode === "gateway" && args.retryable !== true;
+}
+function renderContactFooter(adminEmail) {
+  if (adminEmail) {
+    return `Need help? Contact your LangWatch admin: ${adminEmail}
+`;
+  }
+  return `If you need help, contact your LangWatch admin.
+`;
+}
+async function preflightWrapper(cfg, tool, opts = {}) {
+  var _a, _b, _c, _d, _e, _f, _g;
+  const cp = cfg.control_plane_url.replace(/\/+$/, "");
+  const bootstrap = await ((_a = opts.bootstrapImpl) != null ? _a : getCliBootstrap)(cfg).catch(
+    () => null
+  );
+  const adminEmail = (_b = bootstrap == null ? void 0 : bootstrap.adminEmail) != null ? _b : null;
+  if (!((_c = cfg.default_personal_vk) == null ? void 0 : _c.secret)) {
+    return {
+      ok: false,
+      message: `No personal virtual key on this account.
+Your organization needs at least one AI provider configured before
+\`langwatch ${tool}\` can route requests.
+If you're an admin, set one up at
+  ${cp}/settings/model-providers
+then run \`langwatch login --device\` to refresh your credentials.
+` + renderContactFooter(adminEmail)
+    };
+  }
+  const gw = cfg.gateway_url.replace(/\/+$/, "");
+  const f = (_d = opts.fetchImpl) != null ? _d : fetch;
+  const timeoutMs = (_e = opts.timeoutMs) != null ? _e : 3e3;
+  try {
+    const res = await f(`${gw}/healthz`, {
+      method: "GET",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) {
+      return {
+        ok: false,
+        retryable: true,
+        message: `AI Gateway at ${gw} returned HTTP ${res.status}.
+The wrapper cannot route \`langwatch ${tool}\` requests until the
+data plane is healthy. Check that the LangWatch gateway is running.
+` + renderContactFooter(adminEmail)
+      };
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      retryable: true,
+      message: `Cannot reach AI Gateway at ${gw}
+  ${err.message}
+Check that the LangWatch gateway is running, or set LANGWATCH_GATEWAY_URL
+if you've deployed it elsewhere.
+` + renderContactFooter(adminEmail)
+    };
+  }
+  if (Array.isArray(bootstrap == null ? void 0 : bootstrap.tools)) {
+    const published = bootstrap.tools.some((t) => t.slug === tool);
+    if (!published) {
+      return {
+        ok: false,
+        message: `The gateway isn't enabled for \`${tool}\` in your organization.
+An admin needs to publish a ${tool} coding-assistant tile in the
+AI Tools catalog (with the gateway path enabled):
+  ${cp}/settings/governance/tool-catalog
+` + renderContactFooter(adminEmail)
+      };
+    }
+  }
+  const need = TOOL_PROVIDER_FAMILIES[tool];
+  const configured = (_g = bootstrap == null ? void 0 : bootstrap.gatewayProviders) != null ? _g : (_f = bootstrap == null ? void 0 : bootstrap.providers) == null ? void 0 : _f.map((p) => p.name);
+  if (need && need.length > 0 && Array.isArray(configured)) {
+    const have = new Set(configured.map((n) => n.toLowerCase()));
+    const matches = need.filter((n) => have.has(n));
+    if (matches.length === 0) {
+      const list = need.map((n) => `\`${n}\``).join(" or ");
+      return {
+        ok: false,
+        message: `No ${list} provider credential is configured for your organization.
+\`langwatch ${tool}\` needs at least one enabled provider to route
+requests through the gateway. If you're an admin, add one at
+  ${cp}/settings/model-providers
+` + renderContactFooter(adminEmail)
+      };
+    }
+  }
+  return { ok: true };
+}
+function shouldAutoLogin() {
+  const flag = process.env.LANGWATCH_AUTO_LOGIN;
+  if (flag === "1" || flag === "true") return true;
+  if (flag === "0" || flag === "false") return false;
+  return Boolean(process.stdin.isTTY);
+}
+async function runWrapped(tool, args) {
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+  let cfg = loadConfig();
+  if (!isLoggedIn(cfg)) {
+    if (!shouldAutoLogin()) {
+      process.stderr.write(
+        "Not logged in. Run `langwatch login --device` first.\n"
+      );
+      process.exit(1);
+    }
+    process.stderr.write(
+      "Not logged in. Starting device-flow login...\n"
+    );
+    try {
+      cfg = await runDeviceFlowLogin({ cfg });
+    } catch (err) {
+      process.stderr.write(
+        `login failed: ${(_a = err.message) != null ? _a : "unknown error"}
+`
+      );
+      process.exit(1);
+    }
+    if (!isLoggedIn(cfg)) {
+      process.stderr.write("login did not complete - exiting\n");
+      process.exit(1);
+    }
+  }
+  const exceeded = await checkBudget(cfg);
+  if (exceeded) {
+    process.stderr.write(renderBudgetExceeded(exceeded));
+    if (exceeded.request_increase_url) {
+      cfg.last_request_increase_url = exceeded.request_increase_url;
+      try {
+        saveConfig(cfg);
+      } catch (e) {
+      }
+    }
+    process.exit(2);
+  }
+  const { args: toolArgs, override: pathOverride } = parseToolModeFlag(args);
+  let pathChoice;
+  try {
+    pathChoice = await resolveWrapperPath({
+      cfg,
+      tool,
+      args: toolArgs,
+      override: pathOverride,
+      // Re-check the org policy at run time so a path the admin disabled
+      // after login is respected without a re-login. Best-effort: on any
+      // failure resolveWrapperPath keeps the login-cached policy map.
+      refreshPolicies: (c) => getCliBootstrap(c).then((b) => {
+        var _a2;
+        return (_a2 = b == null ? void 0 : b.toolPolicies) != null ? _a2 : null;
+      })
+    });
+  } catch (err) {
+    process.stderr.write(`path selection failed: ${err.message}
+`);
+    process.exit(2);
+  }
+  const toolEnv = envForTool(cfg, tool);
+  const gatewayVars = toolEnv.vars;
+  const gatewayClears = (_b = toolEnv.clears) != null ? _b : [];
+  let modeResult;
+  try {
+    modeResult = await resolveWrapperMode(
+      cfg,
+      tool,
+      gatewayVars,
+      gatewayClears,
+      pathChoice.mode
+    );
+  } catch (err) {
+    const isToolDisabled = err instanceof GovernanceCliError && err.code === "tool_disabled";
+    const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
+    if (pathChoice.mode === "ingestion" && policy.allowVk && !isToolDisabled) {
+      process.stderr.write(
+        `${lwTag()} couldn't set up direct OTLP ingestion for ${tool} (${err.message}). Falling back to the gateway path.
+`
+      );
+      try {
+        modeResult = await resolveWrapperMode(
+          cfg,
+          tool,
+          gatewayVars,
+          gatewayClears,
+          "gateway"
+        );
+      } catch (err2) {
+        process.stderr.write(
+          `mode resolution failed: ${err2.message}
+`
+        );
+        process.exit(2);
+      }
+    } else {
+      process.stderr.write(
+        `mode resolution failed: ${err.message}
+`
+      );
+      process.exit(2);
+    }
+  }
+  if (modeResult.notice) {
+    process.stderr.write(`${modeResult.notice}
+`);
+  }
+  if (modeResult.mode === "gateway") {
+    const probe = await preflightWrapper(cfg, tool);
+    if (!probe.ok) {
+      process.stderr.write((_c = probe.message) != null ? _c : "preflight failed\n");
+      if (shouldForgetGatewayPin({
+        pinnedMode: (_d = cfg.tool_mode) == null ? void 0 : _d[tool],
+        retryable: probe.retryable
+      })) {
+        const toolMode = __spreadValues({}, cfg.tool_mode);
+        delete toolMode[tool];
+        cfg.tool_mode = toolMode;
+        try {
+          saveConfig(cfg);
+          process.stderr.write(
+            `${lwTag()} cleared the saved gateway path for \`${tool}\`; you'll be asked again next time so you can pick direct OTLP.
+`
+          );
+        } catch (e) {
+        }
+      }
+      process.exit(2);
+    }
+    if (modeResult.codexConfigPath) {
+      process.stderr.write(
+        `${lwTag()} wired [model_providers.langwatch] in ${modeResult.codexConfigPath}.
+`
+      );
+    }
+    if (modeResult.codexProfilePath) {
+      process.stderr.write(
+        `${lwTag()} wrote profile body to ${modeResult.codexProfilePath}.
+`
+      );
+    }
+  } else {
+    if (modeResult.newKeyMinted) {
+      process.stderr.write(
+        `${lwTag()} minted a personal ingestion key for ${tool}.
+`
+      );
+    }
+    if (modeResult.codexConfigPath) {
+      process.stderr.write(
+        `${lwTag()} wrote [otel] activation block to ${modeResult.codexConfigPath}.
+`
+      );
+    }
+    await maybeOfferIngestionShellRcPersist({
+      cfg,
+      tool,
+      vars: modeResult.vars
+    });
+  }
+  const parentEnv = __spreadValues({}, process.env);
+  for (const key of (_e = modeResult.clears) != null ? _e : []) {
+    delete parentEnv[key];
+  }
+  const env = __spreadValues(__spreadValues({}, parentEnv), modeResult.vars);
+  const finalArgs = [...(_f = modeResult.extraArgs) != null ? _f : [], ...toolArgs];
+  const shellName = (_h = ((_g = process.env.SHELL) != null ? _g : "").split("/").pop()) != null ? _h : "";
+  const aliasShell = process.platform !== "win32" && (shellName === "zsh" || shellName === "bash") ? process.env.SHELL : null;
+  const notFoundMessage = `${tool} not found in PATH - install it first (https://docs.langwatch.ai/ai-gateway/governance/admin-setup#cli-device-flow-rest-api)`;
+  const sessionStartMs = Date.now();
+  const codexStreamer = tool === "codex" && modeResult.mode === "ingestion" && modeResult.endpoint && modeResult.ingestionToken ? createCodexIOStreamer({
+    sinceMs: sessionStartMs,
+    endpoint: `${modeResult.endpoint.replace(/\/+$/, "")}/v1/traces`,
+    token: modeResult.ingestionToken
+  }) : null;
+  let codexPoll = null;
+  if (codexStreamer) {
+    let inFlight = false;
+    codexPoll = setInterval(() => {
+      if (inFlight) return;
+      inFlight = true;
+      void codexStreamer.harvest(Date.now()).catch(() => 0).finally(() => {
+        inFlight = false;
+      });
+    }, CODEX_IO_POLL_MS);
+    (_i = codexPoll.unref) == null ? void 0 : _i.call(codexPoll);
+  }
+  let child;
+  if (aliasShell) {
+    const q = (s) => `'${s.replace(/'/g, "'\\''")}'`;
+    const reapply = [
+      ...((_j = modeResult.clears) != null ? _j : []).map((k) => `unset ${k}`),
+      ...Object.entries(modeResult.vars).map(([k, v]) => `export ${k}=${q(v)}`)
+    ].join("; ");
+    const guard = `command -v -- ${q(tool)} >/dev/null 2>&1 || { printf '%s\\n' ${q(notFoundMessage)} >&2; exit 127; }`;
+    const command = `${reapply ? `${reapply}; ` : ""}${guard}; ${tool} "$@"`;
+    child = spawn(aliasShell, ["-i", "-c", command, tool, ...finalArgs], {
+      stdio: "inherit",
+      env
+    });
+  } else {
+    child = spawn(tool, finalArgs, {
+      stdio: "inherit",
+      env,
+      shell: process.platform === "win32"
+    });
+  }
+  child.on("error", (err) => {
+    if (err.code === "ENOENT") {
+      process.stderr.write(`${notFoundMessage}
+`);
+      process.exit(127);
+    }
+    process.stderr.write(`exec ${tool}: ${err.message}
+`);
+    process.exit(1);
+  });
+  const exitCode = await new Promise((resolve) => {
+    child.on("close", (code) => resolve(code != null ? code : 1));
+  });
+  if (codexPoll) clearInterval(codexPoll);
+  if (codexStreamer) {
+    try {
+      await codexStreamer.harvest(Date.now());
+    } catch (e) {
+    }
+  }
+  process.exit(exitCode);
+}
+
+export {
+  envForTool,
+  runWrapped
+};
+//# sourceMappingURL=chunk-35TLPU6Q.mjs.map