langwatch 0.32.0 → 0.33.0

package/dist/chunk-STHIUDKV.mjs

@@ -1,996 +0,0 @@
-import {
-  writeCodexGatewayBlock,
-  writeCodexOtelBlock
-} from "./chunk-EGOB3GIL.mjs";
-import {
-  runDeviceFlowLogin
-} from "./chunk-M566XQWU.mjs";
-import {
-  GovernanceCliError,
-  getCliBootstrap,
-  mintIngestionKey
-} from "./chunk-KJMU7OIX.mjs";
-import {
-  isLoggedIn,
-  loadConfig,
-  saveConfig
-} from "./chunk-U47MQ6CS.mjs";
-import {
-  __spreadProps,
-  __spreadValues
-} from "./chunk-BAX4W3AY.mjs";
-
-// src/cli/utils/governance/wrapper.ts
-import { spawn } from "child_process";
-
-// src/cli/utils/governance/brand.ts
-import chalk from "chalk";
-var LANGWATCH_ORANGE = "#ED8926";
-function lwTag() {
-  return chalk.hex(LANGWATCH_ORANGE).bold("\u2726 langwatch");
-}
-
-// src/cli/utils/governance/budget.ts
-async function checkBudget(cfg, opts = {}) {
-  var _a, _b;
-  if (!cfg.access_token) return null;
-  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
-  const url = cfg.control_plane_url.replace(/\/+$/, "") + "/api/auth/cli/budget/status";
-  let res;
-  try {
-    res = await f(url, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${cfg.access_token}`,
-        Accept: "application/json"
-      }
-    });
-  } catch (e) {
-    return null;
-  }
-  if (res.status === 200) return null;
-  if (res.status === 404) return null;
-  if (res.status === 402) {
-    try {
-      const body = await res.json();
-      if (((_b = body.error) == null ? void 0 : _b.type) && body.error.scope) return body.error;
-    } catch (e) {
-    }
-  }
-  return null;
-}
-var PERIOD_LABEL = {
-  minute: "per-minute",
-  hour: "hourly",
-  day: "daily",
-  week: "weekly",
-  month: "monthly",
-  total: "total"
-};
-function renderBudgetExceeded(e) {
-  var _a;
-  const period = (e.period || "month").toLowerCase();
-  const periodLabel = (_a = PERIOD_LABEL[period]) != null ? _a : period;
-  const lines = [];
-  lines.push("\u26A0  Budget limit reached");
-  lines.push("");
-  lines.push(`   You've used $${e.spent_usd} of your $${e.limit_usd} ${periodLabel} budget.`);
-  lines.push("   To continue, ask your team admin to raise your limit.");
-  lines.push("");
-  if (e.admin_email) {
-    lines.push(`   Admin: ${e.admin_email}`);
-    lines.push("");
-  }
-  lines.push("   Need urgent access? Run:");
-  lines.push("     langwatch request-increase");
-  return lines.join("\n") + "\n";
-}
-
-// src/cli/utils/governance/platform-tool-policy.ts
-var DEFAULTS = {
-  allowVk: true,
-  allowOtelDirect: true
-};
-var PLATFORM_TOOL_POLICIES = {
-  claude: __spreadValues({}, DEFAULTS),
-  codex: __spreadValues({}, DEFAULTS),
-  gemini: __spreadValues({}, DEFAULTS),
-  opencode: __spreadValues({}, DEFAULTS),
-  // cursor is GUI-only; Path B is not meaningful (no terminal env
-  // reaches the agent panel). The wrapper still gates on this so
-  // future GUI integrations can flip allowOtelDirect to true.
-  cursor: { allowVk: true, allowOtelDirect: false }
-};
-function hardcodedPolicy(toolSlug) {
-  if (toolSlug in PLATFORM_TOOL_POLICIES) {
-    return PLATFORM_TOOL_POLICIES[toolSlug];
-  }
-  return DEFAULTS;
-}
-function resolvePlatformToolPolicy(toolSlug, cachedPolicies) {
-  const cached = cachedPolicies == null ? void 0 : cachedPolicies[toolSlug];
-  if (cached) return cached;
-  return hardcodedPolicy(toolSlug);
-}
-
-// src/cli/utils/governance/shell-rc.ts
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import * as readline from "readline";
-import chalk2 from "chalk";
-var BLOCK_BEGIN = "# >>> langwatch begin >>>";
-var BLOCK_END = "# <<< langwatch end <<<";
-function detectShell() {
-  var _a;
-  const raw = ((_a = process.env.SHELL) != null ? _a : "").toLowerCase();
-  if (raw.includes("fish")) return "fish";
-  if (raw.includes("zsh")) return "zsh";
-  if (raw.includes("bash")) return "bash";
-  if (process.platform === "darwin") return "zsh";
-  if (process.platform === "linux") return "bash";
-  return null;
-}
-function rcPath(shell) {
-  const home = os.homedir();
-  switch (shell) {
-    case "zsh":
-      return path.join(home, ".zshrc");
-    case "bash":
-      return path.join(home, ".bashrc");
-    case "fish":
-      return path.join(home, ".config", "fish", "config.fish");
-  }
-}
-function rcHasLangwatchBlock({
-  shell,
-  requiredKeys
-}) {
-  try {
-    const content = fs.readFileSync(rcPath(shell), "utf8");
-    const begin = content.indexOf(BLOCK_BEGIN);
-    const end = content.indexOf(BLOCK_END);
-    if (begin === -1 || end === -1 || end < begin) return false;
-    if (!requiredKeys || requiredKeys.length === 0) return true;
-    const block = content.slice(begin, end);
-    return requiredKeys.every((k) => block.includes(k));
-  } catch (e) {
-    return false;
-  }
-}
-function quote(s) {
-  if (!/[ \t\n'"$\\]/.test(s)) return s;
-  return "'" + s.replace(/'/g, "'\\''") + "'";
-}
-function buildOtelExportBlock(vars, shell) {
-  const entries = Object.entries(vars);
-  const fmt = shell === "fish" ? ([k, v]) => `set -gx ${k} ${quote(v)}` : ([k, v]) => `export ${k}=${quote(v)}`;
-  return entries.map(fmt).join("\n");
-}
-function persistBlockToRc(shell, block) {
-  const file = rcPath(shell);
-  const dir = path.dirname(file);
-  fs.mkdirSync(dir, { recursive: true });
-  const wrapped = `${BLOCK_BEGIN}
-${block}
-${BLOCK_END}
-`;
-  let existing = "";
-  try {
-    existing = fs.readFileSync(file, "utf8");
-  } catch (e) {
-  }
-  const marker = new RegExp(
-    `${escapeRegex(BLOCK_BEGIN)}[\\s\\S]*?${escapeRegex(BLOCK_END)}\\n?`,
-    "m"
-  );
-  let next;
-  if (marker.test(existing)) {
-    next = existing.replace(marker, wrapped);
-  } else {
-    const needsNewline = existing.length > 0 && !existing.endsWith("\n");
-    next = existing + (needsNewline ? "\n" : "") + "\n" + wrapped;
-  }
-  fs.writeFileSync(file, next);
-  return file;
-}
-function escapeRegex(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-async function askPersistChoice(rcPathHint, tool) {
-  if (!process.stdin.isTTY) return "skip";
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  const ans = await new Promise((resolve) => {
-    rl.question(
-      `Install env vars to ${rcPathHint} so that next time the plain \`${tool}\` command keeps capturing telemetry data? [Y/n/never] `,
-      (a) => resolve(a)
-    );
-  });
-  rl.close();
-  const norm = ans.trim().toLowerCase();
-  if (norm === "" || norm === "y" || norm === "yes") return "yes";
-  if (norm === "never") return "never";
-  return "no";
-}
-async function maybeOfferIngestionShellRcPersist({
-  cfg,
-  tool,
-  vars
-}) {
-  if (cfg.shell_rc_preference === "skip") return;
-  if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) return;
-  const shell = detectShell();
-  if (!shell) return;
-  if (Object.keys(vars).length === 0) return;
-  if (rcHasLangwatchBlock({ shell, requiredKeys: Object.keys(vars) })) return;
-  const block = buildOtelExportBlock(vars, shell);
-  const target = rcPath(shell);
-  console.log();
-  const choice = await askPersistChoice(target, tool);
-  if (choice === "skip" || choice === "no") return;
-  if (choice === "never") {
-    cfg.shell_rc_preference = "skip";
-    try {
-      saveConfig(cfg);
-    } catch (e) {
-    }
-    return;
-  }
-  try {
-    const wrote = persistBlockToRc(shell, block);
-    console.log(
-      chalk2.green(`  \u2713 Installed langwatch telemetry exports to ${wrote}`)
-    );
-  } catch (err) {
-    console.log(
-      chalk2.yellow(`  ! Couldn't write to ${target}: ${err.message}`)
-    );
-  }
-}
-
-// src/cli/utils/opencode-config-flag.ts
-import fs2 from "fs";
-import os2 from "os";
-import path2 from "path";
-function defaultOpencodeConfigPath() {
-  const xdg = process.env.XDG_CONFIG_HOME;
-  const configHome = xdg && xdg.length > 0 ? xdg : path2.join(os2.homedir(), ".config");
-  return path2.join(configHome, "opencode", "opencode.jsonc");
-}
-function stripJsoncComments(s) {
-  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
-}
-function setOpencodeOpenTelemetryFlag(options = {}) {
-  var _a, _b;
-  const filePath = (_a = options.filePath) != null ? _a : defaultOpencodeConfigPath();
-  if (!fs2.existsSync(filePath)) {
-    fs2.mkdirSync(path2.dirname(filePath), { recursive: true });
-    const content = JSON.stringify(
-      {
-        $schema: "https://opencode.ai/config.json",
-        experimental: { openTelemetry: true }
-      },
-      null,
-      2
-    ) + "\n";
-    fs2.writeFileSync(filePath, content, { mode: 384 });
-    return { action: "created", path: filePath };
-  }
-  const raw = fs2.readFileSync(filePath, "utf8");
-  let parsed;
-  try {
-    parsed = JSON.parse(stripJsoncComments(raw));
-  } catch (e) {
-    parsed = { $schema: "https://opencode.ai/config.json" };
-  }
-  const experimental = (_b = parsed.experimental) != null ? _b : {};
-  const prior = experimental.openTelemetry;
-  if (prior === true) return { action: "unchanged", path: filePath };
-  if (prior === false) return { action: "disabled-by-user", path: filePath };
-  parsed.experimental = __spreadProps(__spreadValues({}, experimental), { openTelemetry: true });
-  fs2.writeFileSync(filePath, JSON.stringify(parsed, null, 2) + "\n", {
-    mode: 384
-  });
-  return { action: "updated", path: filePath };
-}
-
-// src/cli/utils/governance/gemini-settings-preflight.ts
-import * as fs3 from "fs";
-import * as os3 from "os";
-import * as path3 from "path";
-function defaultGeminiSettingsPath() {
-  var _a;
-  const home = (_a = process.env.HOME) != null ? _a : os3.homedir();
-  return path3.join(home, ".gemini", "settings.json");
-}
-function stripJsoncComments2(s) {
-  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
-}
-function warnIfGeminiOAuthSelected(options = {}) {
-  var _a, _b;
-  const filePath = (_a = options.filePath) != null ? _a : defaultGeminiSettingsPath();
-  const writeLine = (_b = options.writeLine) != null ? _b : ((line) => process.stderr.write(line + "\n"));
-  if (!fs3.existsSync(filePath)) {
-    return { action: "no-settings", warned: false };
-  }
-  let raw;
-  try {
-    raw = fs3.readFileSync(filePath, "utf8");
-  } catch (e) {
-    return { action: "parse-error", warned: false };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(stripJsoncComments2(raw));
-  } catch (e) {
-    return { action: "parse-error", warned: false };
-  }
-  const selectedType = readSelectedType(parsed);
-  if (selectedType === "gemini-oauth") {
-    writeLine(
-      'warning: ~/.gemini/settings.json has security.auth.selectedType="gemini-oauth". gemini-cli 0.46 will use cached OAuth and ignore GOOGLE_API_KEY / GEMINI_API_KEY, so this `langwatch gemini` call will bypass the gateway. To route through langwatch: edit ~/.gemini/settings.json and set security.auth.selectedType to "gemini-api-key".'
-    );
-    return { action: "oauth-selected", warned: true };
-  }
-  return { action: "api-key-selected", warned: false };
-}
-function readSelectedType(parsed) {
-  if (parsed === null || typeof parsed !== "object") return null;
-  const security = parsed.security;
-  if (security === null || typeof security !== "object") return null;
-  const auth = security.auth;
-  if (auth === null || typeof auth !== "object") return null;
-  const selectedType = auth.selectedType;
-  return typeof selectedType === "string" ? selectedType : null;
-}
-
-// src/cli/utils/governance/wrapper-mode.ts
-var SOURCE_TYPE_BY_TOOL = {
-  claude: "claude_code",
-  codex: "codex",
-  gemini: "gemini",
-  opencode: "opencode"
-};
-async function resolveWrapperMode(cfg, tool, gatewayVars, gatewayClears = [], forcedMode) {
-  var _a, _b, _c, _d, _e, _f, _g;
-  const persistedMode = (_a = cfg.tool_mode) == null ? void 0 : _a[tool];
-  const hasVk = !!((_b = cfg.default_personal_vk) == null ? void 0 : _b.secret);
-  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
-  if (!policy.allowVk && !policy.allowOtelDirect) {
-    throw new GovernanceCliError(
-      403,
-      "tool_disabled",
-      `Tool '${tool}' is disabled in the platform policy (both gateway and direct OTLP paths off). Ask your org admin to enable allow_vk or allow_otel_direct.`
-    );
-  }
-  let notice;
-  let mode = forcedMode != null ? forcedMode : persistedMode === "gateway" ? "gateway" : persistedMode === "ingestion" ? "ingestion" : hasVk ? "gateway" : "ingestion";
-  if (mode === "gateway" && !policy.allowVk) {
-    mode = "ingestion";
-    notice = `${lwTag()} gateway path is disabled for ${tool} by your org admin; using direct OTLP ingestion instead.`;
-  }
-  if (mode === "ingestion" && !policy.allowOtelDirect) {
-    mode = "gateway";
-    notice = `${lwTag()} direct OTLP ingestion is disabled for ${tool} by your org admin; routing through the gateway instead.`;
-  }
-  if (mode === "gateway") {
-    if (tool === "gemini") {
-      warnIfGeminiOAuthSelected();
-    }
-    if (tool === "codex") {
-      const gw = writeCodexGatewayBlock({
-        gatewayUrl: cfg.gateway_url,
-        envKey: "OPENAI_API_KEY"
-      });
-      return {
-        mode,
-        vars: gatewayVars,
-        clears: gatewayClears,
-        codexConfigPath: gw.path,
-        codexProfilePath: gw.profilePath,
-        extraArgs: ["--profile", gw.profile],
-        notice
-      };
-    }
-    return { mode, vars: gatewayVars, clears: gatewayClears, notice };
-  }
-  const sourceType = SOURCE_TYPE_BY_TOOL[tool];
-  if (!sourceType) {
-    return { mode: "gateway", vars: gatewayVars, clears: gatewayClears, notice };
-  }
-  if (!policy.allowOtelDirect) {
-    throw new GovernanceCliError(
-      403,
-      "otel_direct_disabled",
-      `Direct OTLP ingestion is disabled for '${tool}' by your org admin. Ask them to enable allow_otel_direct, or run with the gateway path.`
-    );
-  }
-  const cached = (_c = cfg.default_personal_ingest_keys) == null ? void 0 : _c[sourceType];
-  let token;
-  let prefix;
-  let endpoint;
-  let minted;
-  if (cached == null ? void 0 : cached.secret) {
-    token = cached.secret;
-    prefix = cached.prefix;
-    endpoint = `${cfg.control_plane_url.replace(/\/+$/, "")}/api/otel`;
-    minted = false;
-  } else {
-    const r = await mintIngestionKey(cfg, sourceType);
-    token = r.token;
-    prefix = r.prefix;
-    endpoint = r.endpoint;
-    minted = true;
-  }
-  const vars = buildOtelEnvBlock(tool, endpoint, token);
-  let codexConfigPath;
-  if (tool === "codex") {
-    const result = writeCodexOtelBlock({
-      endpoint: `${endpoint}/v1/traces`,
-      ingestionToken: token,
-      environment: (_e = (_d = cfg.organization) == null ? void 0 : _d.slug) != null ? _e : "langwatch"
-    });
-    codexConfigPath = result.path;
-  }
-  if (tool === "opencode") {
-    setOpencodeOpenTelemetryFlag();
-  }
-  const next = __spreadProps(__spreadValues({}, cfg), {
-    tool_mode: __spreadProps(__spreadValues({}, (_f = cfg.tool_mode) != null ? _f : {}), { [tool]: "ingestion" })
-  });
-  if (minted) {
-    next.default_personal_ingest_keys = __spreadProps(__spreadValues({}, (_g = cfg.default_personal_ingest_keys) != null ? _g : {}), {
-      [sourceType]: { secret: token, prefix }
-    });
-  }
-  try {
-    saveConfig(next);
-  } catch (e) {
-  }
-  return { mode, vars, codexConfigPath, newKeyMinted: minted, notice };
-}
-function buildOtelEnvBlock(tool, endpoint, token) {
-  const base = {
-    OTEL_EXPORTER_OTLP_ENDPOINT: endpoint,
-    OTEL_EXPORTER_OTLP_HEADERS: `Authorization=Bearer ${token}`
-  };
-  switch (tool) {
-    case "claude":
-      return __spreadProps(__spreadValues({
-        CLAUDE_CODE_ENABLE_TELEMETRY: "1",
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_LOGS_EXPORTER: "otlp",
-        OTEL_METRICS_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json",
-        OTEL_LOG_USER_PROMPTS: "1",
-        OTEL_LOG_TOOL_DETAILS: "1",
-        OTEL_LOG_TOOL_CONTENT: "1",
-        OTEL_LOG_RAW_API_BODIES: "1"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=claude-code"
-      });
-    case "codex":
-      return __spreadProps(__spreadValues({
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=codex"
-      });
-    case "gemini":
-      return __spreadProps(__spreadValues({
-        GEMINI_TELEMETRY_ENABLED: "true",
-        GEMINI_TELEMETRY_TARGET: "local",
-        GEMINI_TELEMETRY_USE_COLLECTOR: "true",
-        GEMINI_TELEMETRY_TRACES_ENABLED: "true",
-        GEMINI_TELEMETRY_OTLP_PROTOCOL: "http",
-        GEMINI_TELEMETRY_OTLP_ENDPOINT: endpoint,
-        GEMINI_TELEMETRY_LOG_PROMPTS: "true",
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=gemini-cli"
-      });
-    case "opencode":
-      return __spreadProps(__spreadValues({
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_LOGS_EXPORTER: "otlp",
-        OTEL_METRICS_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=opencode"
-      });
-    default:
-      return base;
-  }
-}
-
-// src/cli/utils/governance/wrapper-path-choice.ts
-import prompts from "prompts";
-var TOOL_MODE_FLAG = "--tool-mode";
-function tokenToMode(token) {
-  const t = (token != null ? token : "").trim().toLowerCase();
-  if (t === "gateway" || t === "vk") return "gateway";
-  if (t === "otlp" || t === "ingestion" || t === "direct") return "ingestion";
-  return null;
-}
-function parseToolModeFlag(args, env = process.env) {
-  var _a;
-  const out = [];
-  let flagOverride;
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === TOOL_MODE_FLAG) {
-      const value = args[i + 1];
-      const mode = tokenToMode(value);
-      if (mode) flagOverride = mode;
-      if (value !== void 0) i++;
-      continue;
-    }
-    if (arg.startsWith(`${TOOL_MODE_FLAG}=`)) {
-      const value = arg.slice(TOOL_MODE_FLAG.length + 1);
-      const mode = tokenToMode(value);
-      if (mode) flagOverride = mode;
-      continue;
-    }
-    out.push(arg);
-  }
-  const override = (_a = flagOverride != null ? flagOverride : tokenToMode(env.LANGWATCH_TOOL_MODE)) != null ? _a : void 0;
-  return { args: out, override };
-}
-function isForcedAutoLogin(env) {
-  const flag = env.LANGWATCH_AUTO_LOGIN;
-  return flag === "1" || flag === "true";
-}
-function pathChoiceMessage(tool) {
-  return `How should \`langwatch ${tool}\` run?`;
-}
-function gatewayChoiceTitle() {
-  return "Gateway (virtual key) - route LLM calls through LangWatch (usage billed per token)";
-}
-function otlpChoiceTitle(tool) {
-  return `Direct OTLP - use your own ${tool} plan, send only telemetry to LangWatch`;
-}
-async function resolveWrapperPath(opts) {
-  var _a, _b, _c;
-  const {
-    cfg,
-    tool,
-    override,
-    promptImpl = prompts,
-    saveImpl = saveConfig,
-    writeImpl = (s) => void process.stderr.write(s),
-    env = process.env
-  } = opts;
-  const isTTY = (_a = opts.isTTY) != null ? _a : Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
-  if (override) {
-    return { mode: override, prompted: false };
-  }
-  const pinned = (_b = cfg.tool_mode) == null ? void 0 : _b[tool];
-  if (pinned === "gateway" || pinned === "ingestion") {
-    return { mode: pinned, prompted: false };
-  }
-  if (opts.refreshPolicies) {
-    try {
-      const fresh = await opts.refreshPolicies(cfg);
-      if (fresh) {
-        cfg.tool_policies = fresh;
-        try {
-          saveImpl(__spreadProps(__spreadValues({}, cfg), { tool_policies: fresh }));
-        } catch (e) {
-        }
-      }
-    } catch (e) {
-    }
-  }
-  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
-  const allowGateway = policy.allowVk;
-  const allowOtlp = policy.allowOtelDirect;
-  if (allowGateway && !allowOtlp) {
-    return { mode: "gateway", prompted: false };
-  }
-  if (!allowGateway && allowOtlp) {
-    return { mode: "ingestion", prompted: false };
-  }
-  if (!allowGateway && !allowOtlp) {
-    return { mode: "gateway", prompted: false };
-  }
-  const canPrompt = isTTY && !isForcedAutoLogin(env);
-  if (!canPrompt) {
-    return { mode: "gateway", prompted: false };
-  }
-  const res = await promptImpl({
-    type: "select",
-    name: "path",
-    message: pathChoiceMessage(tool),
-    choices: [
-      {
-        title: gatewayChoiceTitle(),
-        value: "gateway"
-      },
-      {
-        title: otlpChoiceTitle(tool),
-        value: "ingestion"
-      }
-    ],
-    initial: 0
-  });
-  const chosen = tokenToMode(res == null ? void 0 : res.path);
-  if (!chosen) {
-    return { mode: "gateway", prompted: false };
-  }
-  const next = __spreadProps(__spreadValues({}, cfg), {
-    tool_mode: __spreadProps(__spreadValues({}, (_c = cfg.tool_mode) != null ? _c : {}), { [tool]: chosen })
-  });
-  try {
-    saveImpl(next);
-    cfg.tool_mode = next.tool_mode;
-  } catch (e) {
-  }
-  const label = chosen === "gateway" ? "gateway" : "otlp";
-  writeImpl(
-    `${lwTag()} saved. \`${tool}\` will use the ${label} path. Override with --tool-mode=${chosen === "gateway" ? "otlp" : "gateway"}, or edit ~/.langwatch/config.json (tool_mode.${tool}).
-`
-  );
-  return { mode: chosen, prompted: true };
-}
-
-// src/cli/utils/governance/wrapper.ts
-function envForTool(cfg, tool) {
-  var _a;
-  const gw = cfg.gateway_url.replace(/\/+$/, "");
-  const auth = (_a = cfg.default_personal_vk) == null ? void 0 : _a.secret;
-  if (!auth) return { vars: {} };
-  switch (tool) {
-    case "claude":
-      return {
-        vars: {
-          ANTHROPIC_BASE_URL: gw,
-          ANTHROPIC_AUTH_TOKEN: auth
-        },
-        clears: ["ANTHROPIC_API_KEY"]
-      };
-    case "codex":
-      return {
-        vars: {
-          OPENAI_BASE_URL: gw,
-          OPENAI_API_KEY: auth
-        }
-      };
-    case "cursor":
-      return {
-        vars: {
-          OPENAI_BASE_URL: gw,
-          OPENAI_API_KEY: auth,
-          ANTHROPIC_BASE_URL: gw,
-          ANTHROPIC_AUTH_TOKEN: auth
-        },
-        clears: ["ANTHROPIC_API_KEY"]
-      };
-    case "gemini":
-      return {
-        vars: {
-          GOOGLE_GEMINI_BASE_URL: gw,
-          GEMINI_API_KEY: auth,
-          GOOGLE_API_KEY: auth
-        }
-      };
-    case "opencode":
-      return {
-        vars: {
-          OPENAI_BASE_URL: `${gw}/v1`,
-          OPENAI_API_KEY: auth,
-          ANTHROPIC_BASE_URL: `${gw}/v1`,
-          ANTHROPIC_AUTH_TOKEN: auth,
-          ANTHROPIC_API_KEY: auth
-        }
-      };
-    default:
-      return { vars: {} };
-  }
-}
-var TOOL_PROVIDER_FAMILIES = {
-  claude: ["anthropic"],
-  codex: ["openai"],
-  cursor: ["anthropic", "openai"],
-  gemini: ["google", "gemini"],
-  opencode: ["anthropic", "openai"]
-};
-function shouldForgetGatewayPin(args) {
-  return args.pinnedMode === "gateway" && args.retryable !== true;
-}
-function renderContactFooter(adminEmail) {
-  if (adminEmail) {
-    return `Need help? Contact your LangWatch admin: ${adminEmail}
-`;
-  }
-  return `If you need help, contact your LangWatch admin.
-`;
-}
-async function preflightWrapper(cfg, tool, opts = {}) {
-  var _a, _b, _c, _d, _e;
-  const cp = cfg.control_plane_url.replace(/\/+$/, "");
-  const bootstrap = await ((_a = opts.bootstrapImpl) != null ? _a : getCliBootstrap)(cfg).catch(
-    () => null
-  );
-  const adminEmail = (_b = bootstrap == null ? void 0 : bootstrap.adminEmail) != null ? _b : null;
-  if (!((_c = cfg.default_personal_vk) == null ? void 0 : _c.secret)) {
-    return {
-      ok: false,
-      message: `No personal virtual key on this account.
-Your organization needs at least one AI provider configured before
-\`langwatch ${tool}\` can route requests.
-If you're an admin, set one up at
-  ${cp}/settings/model-providers
-then run \`langwatch login --device\` to refresh your credentials.
-` + renderContactFooter(adminEmail)
-    };
-  }
-  const gw = cfg.gateway_url.replace(/\/+$/, "");
-  const f = (_d = opts.fetchImpl) != null ? _d : fetch;
-  const timeoutMs = (_e = opts.timeoutMs) != null ? _e : 3e3;
-  try {
-    const res = await f(`${gw}/healthz`, {
-      method: "GET",
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!res.ok) {
-      return {
-        ok: false,
-        retryable: true,
-        message: `AI Gateway at ${gw} returned HTTP ${res.status}.
-The wrapper cannot route \`langwatch ${tool}\` requests until the
-data plane is healthy. Check that the LangWatch gateway is running.
-` + renderContactFooter(adminEmail)
-      };
-    }
-  } catch (err) {
-    return {
-      ok: false,
-      retryable: true,
-      message: `Cannot reach AI Gateway at ${gw}
-  ${err.message}
-Check that the LangWatch gateway is running, or set LANGWATCH_GATEWAY_URL
-if you've deployed it elsewhere.
-` + renderContactFooter(adminEmail)
-    };
-  }
-  const need = TOOL_PROVIDER_FAMILIES[tool];
-  if (need && need.length > 0 && bootstrap && Array.isArray(bootstrap.providers)) {
-    const have = new Set(bootstrap.providers.map((p) => p.name.toLowerCase()));
-    const matches = need.filter((n) => have.has(n));
-    if (matches.length === 0) {
-      const list = need.map((n) => `\`${n}\``).join(" or ");
-      return {
-        ok: false,
-        message: `No ${list} provider is configured for your organization.
-\`langwatch ${tool}\` needs at least one to route requests through the gateway.
-If you're an admin, configure one at
-  ${cp}/settings/model-providers
-` + renderContactFooter(adminEmail)
-      };
-    }
-  }
-  return { ok: true };
-}
-function shouldAutoLogin() {
-  const flag = process.env.LANGWATCH_AUTO_LOGIN;
-  if (flag === "1" || flag === "true") return true;
-  if (flag === "0" || flag === "false") return false;
-  return Boolean(process.stdin.isTTY);
-}
-async function runWrapped(tool, args) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i;
-  let cfg = loadConfig();
-  if (!isLoggedIn(cfg)) {
-    if (!shouldAutoLogin()) {
-      process.stderr.write(
-        "Not logged in. Run `langwatch login --device` first.\n"
-      );
-      process.exit(1);
-    }
-    process.stderr.write(
-      "Not logged in. Starting device-flow login...\n"
-    );
-    try {
-      cfg = await runDeviceFlowLogin({ cfg });
-    } catch (err) {
-      process.stderr.write(
-        `login failed: ${(_a = err.message) != null ? _a : "unknown error"}
-`
-      );
-      process.exit(1);
-    }
-    if (!isLoggedIn(cfg)) {
-      process.stderr.write("login did not complete - exiting\n");
-      process.exit(1);
-    }
-  }
-  const exceeded = await checkBudget(cfg);
-  if (exceeded) {
-    process.stderr.write(renderBudgetExceeded(exceeded));
-    if (exceeded.request_increase_url) {
-      cfg.last_request_increase_url = exceeded.request_increase_url;
-      try {
-        saveConfig(cfg);
-      } catch (e) {
-      }
-    }
-    process.exit(2);
-  }
-  const { args: toolArgs, override: pathOverride } = parseToolModeFlag(args);
-  let pathChoice;
-  try {
-    pathChoice = await resolveWrapperPath({
-      cfg,
-      tool,
-      args: toolArgs,
-      override: pathOverride,
-      // Re-check the org policy at run time so a path the admin disabled
-      // after login is respected without a re-login. Best-effort: on any
-      // failure resolveWrapperPath keeps the login-cached policy map.
-      refreshPolicies: (c) => getCliBootstrap(c).then((b) => {
-        var _a2;
-        return (_a2 = b == null ? void 0 : b.toolPolicies) != null ? _a2 : null;
-      })
-    });
-  } catch (err) {
-    process.stderr.write(`path selection failed: ${err.message}
-`);
-    process.exit(2);
-  }
-  const toolEnv = envForTool(cfg, tool);
-  const gatewayVars = toolEnv.vars;
-  const gatewayClears = (_b = toolEnv.clears) != null ? _b : [];
-  let modeResult;
-  try {
-    modeResult = await resolveWrapperMode(
-      cfg,
-      tool,
-      gatewayVars,
-      gatewayClears,
-      pathChoice.mode
-    );
-  } catch (err) {
-    const isToolDisabled = err instanceof GovernanceCliError && err.code === "tool_disabled";
-    const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
-    if (pathChoice.mode === "ingestion" && policy.allowVk && !isToolDisabled) {
-      process.stderr.write(
-        `${lwTag()} couldn't set up direct OTLP ingestion for ${tool} (${err.message}). Falling back to the gateway path.
-`
-      );
-      try {
-        modeResult = await resolveWrapperMode(
-          cfg,
-          tool,
-          gatewayVars,
-          gatewayClears,
-          "gateway"
-        );
-      } catch (err2) {
-        process.stderr.write(
-          `mode resolution failed: ${err2.message}
-`
-        );
-        process.exit(2);
-      }
-    } else {
-      process.stderr.write(
-        `mode resolution failed: ${err.message}
-`
-      );
-      process.exit(2);
-    }
-  }
-  if (modeResult.notice) {
-    process.stderr.write(`${modeResult.notice}
-`);
-  }
-  if (modeResult.mode === "gateway") {
-    const probe = await preflightWrapper(cfg, tool);
-    if (!probe.ok) {
-      process.stderr.write((_c = probe.message) != null ? _c : "preflight failed\n");
-      if (shouldForgetGatewayPin({
-        pinnedMode: (_d = cfg.tool_mode) == null ? void 0 : _d[tool],
-        retryable: probe.retryable
-      })) {
-        const toolMode = __spreadValues({}, cfg.tool_mode);
-        delete toolMode[tool];
-        cfg.tool_mode = toolMode;
-        try {
-          saveConfig(cfg);
-          process.stderr.write(
-            `${lwTag()} cleared the saved gateway path for \`${tool}\`; you'll be asked again next time so you can pick direct OTLP.
-`
-          );
-        } catch (e) {
-        }
-      }
-      process.exit(2);
-    }
-    if (modeResult.codexConfigPath) {
-      process.stderr.write(
-        `${lwTag()} wired [model_providers.langwatch] in ${modeResult.codexConfigPath}.
-`
-      );
-    }
-    if (modeResult.codexProfilePath) {
-      process.stderr.write(
-        `${lwTag()} wrote profile body to ${modeResult.codexProfilePath}.
-`
-      );
-    }
-  } else {
-    if (modeResult.newKeyMinted) {
-      process.stderr.write(
-        `${lwTag()} minted a personal ingestion key for ${tool}.
-`
-      );
-    }
-    if (modeResult.codexConfigPath) {
-      process.stderr.write(
-        `${lwTag()} wrote [otel] activation block to ${modeResult.codexConfigPath}.
-`
-      );
-    }
-    await maybeOfferIngestionShellRcPersist({
-      cfg,
-      tool,
-      vars: modeResult.vars
-    });
-  }
-  const parentEnv = __spreadValues({}, process.env);
-  for (const key of (_e = modeResult.clears) != null ? _e : []) {
-    delete parentEnv[key];
-  }
-  const env = __spreadValues(__spreadValues({}, parentEnv), modeResult.vars);
-  const finalArgs = [...(_f = modeResult.extraArgs) != null ? _f : [], ...toolArgs];
-  const shellName = (_h = ((_g = process.env.SHELL) != null ? _g : "").split("/").pop()) != null ? _h : "";
-  const aliasShell = process.platform !== "win32" && (shellName === "zsh" || shellName === "bash") ? process.env.SHELL : null;
-  const notFoundMessage = `${tool} not found in PATH - install it first (https://docs.langwatch.ai/ai-gateway/governance/admin-setup#cli-device-flow-rest-api)`;
-  let child;
-  if (aliasShell) {
-    const q = (s) => `'${s.replace(/'/g, "'\\''")}'`;
-    const reapply = [
-      ...((_i = modeResult.clears) != null ? _i : []).map((k) => `unset ${k}`),
-      ...Object.entries(modeResult.vars).map(([k, v]) => `export ${k}=${q(v)}`)
-    ].join("; ");
-    const guard = `command -v -- ${q(tool)} >/dev/null 2>&1 || { printf '%s\\n' ${q(notFoundMessage)} >&2; exit 127; }`;
-    const command = `${reapply ? `${reapply}; ` : ""}${guard}; ${tool} "$@"`;
-    child = spawn(aliasShell, ["-i", "-c", command, tool, ...finalArgs], {
-      stdio: "inherit",
-      env
-    });
-  } else {
-    child = spawn(tool, finalArgs, {
-      stdio: "inherit",
-      env,
-      shell: process.platform === "win32"
-    });
-  }
-  child.on("error", (err) => {
-    if (err.code === "ENOENT") {
-      process.stderr.write(`${notFoundMessage}
-`);
-      process.exit(127);
-    }
-    process.stderr.write(`exec ${tool}: ${err.message}
-`);
-    process.exit(1);
-  });
-  await new Promise((resolve) => {
-    child.on("close", (code) => {
-      process.exit(code != null ? code : 1);
-      resolve();
-    });
-  });
-  process.exit(0);
-}
-
-export {
-  envForTool,
-  runWrapped
-};
-//# sourceMappingURL=chunk-STHIUDKV.mjs.map