langwatch 0.33.0 → 0.33.2

package/dist/chunk-35TLPU6Q.mjs

@@ -1,1411 +0,0 @@
-import {
-  writeCodexGatewayBlock,
-  writeCodexOtelBlock
-} from "./chunk-EGOB3GIL.mjs";
-import {
-  runDeviceFlowLogin
-} from "./chunk-KTETIIUG.mjs";
-import {
-  GovernanceCliError,
-  getCliBootstrap,
-  mintIngestionKey
-} from "./chunk-G7XWPZVF.mjs";
-import {
-  isLoggedIn,
-  loadConfig,
-  saveConfig
-} from "./chunk-U47MQ6CS.mjs";
-import {
-  __spreadProps,
-  __spreadValues
-} from "./chunk-BAX4W3AY.mjs";
-
-// src/cli/utils/governance/wrapper.ts
-import { spawn } from "child_process";
-
-// src/cli/utils/governance/brand.ts
-import chalk from "chalk";
-var LANGWATCH_ORANGE = "#ED8926";
-function lwTag() {
-  return chalk.hex(LANGWATCH_ORANGE).bold("\u2726 langwatch");
-}
-
-// src/cli/utils/governance/budget.ts
-async function checkBudget(cfg, opts = {}) {
-  var _a, _b;
-  if (!cfg.access_token) return null;
-  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
-  const url = cfg.control_plane_url.replace(/\/+$/, "") + "/api/auth/cli/budget/status";
-  let res;
-  try {
-    res = await f(url, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${cfg.access_token}`,
-        Accept: "application/json"
-      }
-    });
-  } catch (e) {
-    return null;
-  }
-  if (res.status === 200) return null;
-  if (res.status === 404) return null;
-  if (res.status === 402) {
-    try {
-      const body = await res.json();
-      if (((_b = body.error) == null ? void 0 : _b.type) && body.error.scope) return body.error;
-    } catch (e) {
-    }
-  }
-  return null;
-}
-var PERIOD_LABEL = {
-  minute: "per-minute",
-  hour: "hourly",
-  day: "daily",
-  week: "weekly",
-  month: "monthly",
-  total: "total"
-};
-function renderBudgetExceeded(e) {
-  var _a;
-  const period = (e.period || "month").toLowerCase();
-  const periodLabel = (_a = PERIOD_LABEL[period]) != null ? _a : period;
-  const lines = [];
-  lines.push("\u26A0  Budget limit reached");
-  lines.push("");
-  lines.push(`   You've used $${e.spent_usd} of your $${e.limit_usd} ${periodLabel} budget.`);
-  lines.push("   To continue, ask your team admin to raise your limit.");
-  lines.push("");
-  if (e.admin_email) {
-    lines.push(`   Admin: ${e.admin_email}`);
-    lines.push("");
-  }
-  lines.push("   Need urgent access? Run:");
-  lines.push("     langwatch request-increase");
-  return lines.join("\n") + "\n";
-}
-
-// src/cli/utils/governance/platform-tool-policy.ts
-var DEFAULTS = {
-  allowVk: true,
-  allowOtelDirect: true
-};
-var PLATFORM_TOOL_POLICIES = {
-  claude: __spreadValues({}, DEFAULTS),
-  codex: __spreadValues({}, DEFAULTS),
-  gemini: __spreadValues({}, DEFAULTS),
-  opencode: __spreadValues({}, DEFAULTS),
-  // cursor is GUI-only; Path B is not meaningful (no terminal env
-  // reaches the agent panel). The wrapper still gates on this so
-  // future GUI integrations can flip allowOtelDirect to true.
-  cursor: { allowVk: true, allowOtelDirect: false }
-};
-function hardcodedPolicy(toolSlug) {
-  if (toolSlug in PLATFORM_TOOL_POLICIES) {
-    return PLATFORM_TOOL_POLICIES[toolSlug];
-  }
-  return DEFAULTS;
-}
-function resolvePlatformToolPolicy(toolSlug, cachedPolicies) {
-  const cached = cachedPolicies == null ? void 0 : cachedPolicies[toolSlug];
-  if (cached) return cached;
-  return hardcodedPolicy(toolSlug);
-}
-
-// src/cli/utils/governance/shell-rc.ts
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import * as readline from "readline";
-import chalk2 from "chalk";
-var BLOCK_BEGIN = "# >>> langwatch begin >>>";
-var BLOCK_END = "# <<< langwatch end <<<";
-function detectShell() {
-  var _a;
-  const raw = ((_a = process.env.SHELL) != null ? _a : "").toLowerCase();
-  if (raw.includes("fish")) return "fish";
-  if (raw.includes("zsh")) return "zsh";
-  if (raw.includes("bash")) return "bash";
-  if (process.platform === "darwin") return "zsh";
-  if (process.platform === "linux") return "bash";
-  return null;
-}
-function rcPath(shell) {
-  const home = os.homedir();
-  switch (shell) {
-    case "zsh":
-      return path.join(home, ".zshrc");
-    case "bash":
-      return path.join(home, ".bashrc");
-    case "fish":
-      return path.join(home, ".config", "fish", "config.fish");
-  }
-}
-function rcHasLangwatchBlock({
-  shell,
-  requiredKeys
-}) {
-  try {
-    const content = fs.readFileSync(rcPath(shell), "utf8");
-    const begin = content.indexOf(BLOCK_BEGIN);
-    const end = content.indexOf(BLOCK_END);
-    if (begin === -1 || end === -1 || end < begin) return false;
-    if (!requiredKeys || requiredKeys.length === 0) return true;
-    const block = content.slice(begin, end);
-    return requiredKeys.every((k) => block.includes(k));
-  } catch (e) {
-    return false;
-  }
-}
-function quote(s) {
-  if (!/[ \t\n'"$\\]/.test(s)) return s;
-  return "'" + s.replace(/'/g, "'\\''") + "'";
-}
-function buildOtelExportBlock(vars, shell) {
-  const entries = Object.entries(vars);
-  const fmt = shell === "fish" ? ([k, v]) => `set -gx ${k} ${quote(v)}` : ([k, v]) => `export ${k}=${quote(v)}`;
-  return entries.map(fmt).join("\n");
-}
-function persistBlockToRc(shell, block) {
-  const file = rcPath(shell);
-  const dir = path.dirname(file);
-  fs.mkdirSync(dir, { recursive: true });
-  const wrapped = `${BLOCK_BEGIN}
-${block}
-${BLOCK_END}
-`;
-  let existing = "";
-  try {
-    existing = fs.readFileSync(file, "utf8");
-  } catch (e) {
-  }
-  const marker = new RegExp(
-    `${escapeRegex(BLOCK_BEGIN)}[\\s\\S]*?${escapeRegex(BLOCK_END)}\\n?`,
-    "m"
-  );
-  let next;
-  if (marker.test(existing)) {
-    next = existing.replace(marker, wrapped);
-  } else {
-    const needsNewline = existing.length > 0 && !existing.endsWith("\n");
-    next = existing + (needsNewline ? "\n" : "") + "\n" + wrapped;
-  }
-  fs.writeFileSync(file, next);
-  return file;
-}
-function escapeRegex(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-async function askPersistChoice(rcPathHint, tool) {
-  if (!process.stdin.isTTY) return "skip";
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  const ans = await new Promise((resolve) => {
-    rl.question(
-      `Install env vars to ${rcPathHint} so that next time the plain \`${tool}\` command keeps capturing telemetry data? [Y/n/never] `,
-      (a) => resolve(a)
-    );
-  });
-  rl.close();
-  const norm = ans.trim().toLowerCase();
-  if (norm === "" || norm === "y" || norm === "yes") return "yes";
-  if (norm === "never") return "never";
-  return "no";
-}
-async function maybeOfferIngestionShellRcPersist({
-  cfg,
-  tool,
-  vars
-}) {
-  if (cfg.shell_rc_preference === "skip") return;
-  if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) return;
-  const shell = detectShell();
-  if (!shell) return;
-  if (Object.keys(vars).length === 0) return;
-  if (rcHasLangwatchBlock({ shell, requiredKeys: Object.keys(vars) })) return;
-  const block = buildOtelExportBlock(vars, shell);
-  const target = rcPath(shell);
-  console.log();
-  const choice = await askPersistChoice(target, tool);
-  if (choice === "skip" || choice === "no") return;
-  if (choice === "never") {
-    cfg.shell_rc_preference = "skip";
-    try {
-      saveConfig(cfg);
-    } catch (e) {
-    }
-    return;
-  }
-  try {
-    const wrote = persistBlockToRc(shell, block);
-    console.log(
-      chalk2.green(`  \u2713 Installed langwatch telemetry exports to ${wrote}`)
-    );
-  } catch (err) {
-    console.log(
-      chalk2.yellow(`  ! Couldn't write to ${target}: ${err.message}`)
-    );
-  }
-}
-
-// src/cli/utils/opencode-config-flag.ts
-import fs2 from "fs";
-import os2 from "os";
-import path2 from "path";
-function defaultOpencodeConfigPath() {
-  const xdg = process.env.XDG_CONFIG_HOME;
-  const configHome = xdg && xdg.length > 0 ? xdg : path2.join(os2.homedir(), ".config");
-  return path2.join(configHome, "opencode", "opencode.jsonc");
-}
-function stripJsoncComments(s) {
-  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
-}
-function setOpencodeOpenTelemetryFlag(options = {}) {
-  var _a, _b;
-  const filePath = (_a = options.filePath) != null ? _a : defaultOpencodeConfigPath();
-  if (!fs2.existsSync(filePath)) {
-    fs2.mkdirSync(path2.dirname(filePath), { recursive: true });
-    const content = JSON.stringify(
-      {
-        $schema: "https://opencode.ai/config.json",
-        experimental: { openTelemetry: true }
-      },
-      null,
-      2
-    ) + "\n";
-    fs2.writeFileSync(filePath, content, { mode: 384 });
-    return { action: "created", path: filePath };
-  }
-  const raw = fs2.readFileSync(filePath, "utf8");
-  let parsed;
-  try {
-    parsed = JSON.parse(stripJsoncComments(raw));
-  } catch (e) {
-    parsed = { $schema: "https://opencode.ai/config.json" };
-  }
-  const experimental = (_b = parsed.experimental) != null ? _b : {};
-  const prior = experimental.openTelemetry;
-  if (prior === true) return { action: "unchanged", path: filePath };
-  if (prior === false) return { action: "disabled-by-user", path: filePath };
-  parsed.experimental = __spreadProps(__spreadValues({}, experimental), { openTelemetry: true });
-  fs2.writeFileSync(filePath, JSON.stringify(parsed, null, 2) + "\n", {
-    mode: 384
-  });
-  return { action: "updated", path: filePath };
-}
-
-// src/cli/utils/governance/gemini-settings-preflight.ts
-import * as fs3 from "fs";
-import * as os3 from "os";
-import * as path3 from "path";
-function defaultGeminiSettingsPath() {
-  var _a;
-  const home = (_a = process.env.HOME) != null ? _a : os3.homedir();
-  return path3.join(home, ".gemini", "settings.json");
-}
-function stripJsoncComments2(s) {
-  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
-}
-function warnIfGeminiOAuthSelected(options = {}) {
-  var _a, _b;
-  const filePath = (_a = options.filePath) != null ? _a : defaultGeminiSettingsPath();
-  const writeLine = (_b = options.writeLine) != null ? _b : ((line) => process.stderr.write(line + "\n"));
-  if (!fs3.existsSync(filePath)) {
-    return { action: "no-settings", warned: false };
-  }
-  let raw;
-  try {
-    raw = fs3.readFileSync(filePath, "utf8");
-  } catch (e) {
-    return { action: "parse-error", warned: false };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(stripJsoncComments2(raw));
-  } catch (e) {
-    return { action: "parse-error", warned: false };
-  }
-  const selectedType = readSelectedType(parsed);
-  if (selectedType === "gemini-oauth") {
-    writeLine(
-      'warning: ~/.gemini/settings.json has security.auth.selectedType="gemini-oauth". gemini-cli 0.46 will use cached OAuth and ignore GOOGLE_API_KEY / GEMINI_API_KEY, so this `langwatch gemini` call will bypass the gateway. To route through langwatch: edit ~/.gemini/settings.json and set security.auth.selectedType to "gemini-api-key".'
-    );
-    return { action: "oauth-selected", warned: true };
-  }
-  return { action: "api-key-selected", warned: false };
-}
-function readSelectedType(parsed) {
-  if (parsed === null || typeof parsed !== "object") return null;
-  const security = parsed.security;
-  if (security === null || typeof security !== "object") return null;
-  const auth = security.auth;
-  if (auth === null || typeof auth !== "object") return null;
-  const selectedType = auth.selectedType;
-  return typeof selectedType === "string" ? selectedType : null;
-}
-
-// src/cli/utils/governance/wrapper-mode.ts
-var SOURCE_TYPE_BY_TOOL = {
-  claude: "claude_code",
-  codex: "codex",
-  gemini: "gemini",
-  opencode: "opencode"
-};
-async function resolveWrapperMode(cfg, tool, gatewayVars, gatewayClears = [], forcedMode) {
-  var _a, _b, _c, _d, _e, _f, _g;
-  const persistedMode = (_a = cfg.tool_mode) == null ? void 0 : _a[tool];
-  const hasVk = !!((_b = cfg.default_personal_vk) == null ? void 0 : _b.secret);
-  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
-  if (!policy.allowVk && !policy.allowOtelDirect) {
-    throw new GovernanceCliError(
-      403,
-      "tool_disabled",
-      `Tool '${tool}' is disabled in the platform policy (both gateway and direct OTLP paths off). Ask your org admin to enable allow_vk or allow_otel_direct.`
-    );
-  }
-  let notice;
-  let mode = forcedMode != null ? forcedMode : persistedMode === "gateway" ? "gateway" : persistedMode === "ingestion" ? "ingestion" : hasVk ? "gateway" : "ingestion";
-  if (mode === "gateway" && !policy.allowVk) {
-    mode = "ingestion";
-    notice = `${lwTag()} gateway path is disabled for ${tool} by your org admin; using direct OTLP ingestion instead.`;
-  }
-  if (mode === "ingestion" && !policy.allowOtelDirect) {
-    mode = "gateway";
-    notice = `${lwTag()} direct OTLP ingestion is disabled for ${tool} by your org admin; routing through the gateway instead.`;
-  }
-  if (mode === "gateway") {
-    if (tool === "gemini") {
-      warnIfGeminiOAuthSelected();
-    }
-    if (tool === "codex") {
-      const gw = writeCodexGatewayBlock({
-        gatewayUrl: cfg.gateway_url,
-        envKey: "OPENAI_API_KEY"
-      });
-      return {
-        mode,
-        vars: gatewayVars,
-        clears: gatewayClears,
-        codexConfigPath: gw.path,
-        codexProfilePath: gw.profilePath,
-        extraArgs: ["--profile", gw.profile],
-        notice
-      };
-    }
-    return { mode, vars: gatewayVars, clears: gatewayClears, notice };
-  }
-  const sourceType = SOURCE_TYPE_BY_TOOL[tool];
-  if (!sourceType) {
-    return { mode: "gateway", vars: gatewayVars, clears: gatewayClears, notice };
-  }
-  if (!policy.allowOtelDirect) {
-    throw new GovernanceCliError(
-      403,
-      "otel_direct_disabled",
-      `Direct OTLP ingestion is disabled for '${tool}' by your org admin. Ask them to enable allow_otel_direct, or run with the gateway path.`
-    );
-  }
-  const cached = (_c = cfg.default_personal_ingest_keys) == null ? void 0 : _c[sourceType];
-  let token;
-  let prefix;
-  let endpoint;
-  let minted;
-  if (cached == null ? void 0 : cached.secret) {
-    token = cached.secret;
-    prefix = cached.prefix;
-    endpoint = `${cfg.control_plane_url.replace(/\/+$/, "")}/api/otel`;
-    minted = false;
-  } else {
-    const r = await mintIngestionKey(cfg, sourceType);
-    token = r.token;
-    prefix = r.prefix;
-    endpoint = r.endpoint;
-    minted = true;
-  }
-  const vars = buildOtelEnvBlock(tool, endpoint, token);
-  let codexConfigPath;
-  if (tool === "codex") {
-    const result = writeCodexOtelBlock({
-      endpoint: `${endpoint}/v1/traces`,
-      ingestionToken: token,
-      environment: (_e = (_d = cfg.organization) == null ? void 0 : _d.slug) != null ? _e : "langwatch"
-    });
-    codexConfigPath = result.path;
-  }
-  if (tool === "opencode") {
-    setOpencodeOpenTelemetryFlag();
-  }
-  const next = __spreadProps(__spreadValues({}, cfg), {
-    tool_mode: __spreadProps(__spreadValues({}, (_f = cfg.tool_mode) != null ? _f : {}), { [tool]: "ingestion" })
-  });
-  if (minted) {
-    next.default_personal_ingest_keys = __spreadProps(__spreadValues({}, (_g = cfg.default_personal_ingest_keys) != null ? _g : {}), {
-      [sourceType]: { secret: token, prefix }
-    });
-  }
-  try {
-    saveConfig(next);
-  } catch (e) {
-  }
-  return {
-    mode,
-    vars,
-    codexConfigPath,
-    newKeyMinted: minted,
-    notice,
-    endpoint,
-    ingestionToken: token
-  };
-}
-function buildOtelEnvBlock(tool, endpoint, token) {
-  const base = {
-    OTEL_EXPORTER_OTLP_ENDPOINT: endpoint,
-    OTEL_EXPORTER_OTLP_HEADERS: `Authorization=Bearer ${token}`
-  };
-  switch (tool) {
-    case "claude":
-      return __spreadProps(__spreadValues({
-        CLAUDE_CODE_ENABLE_TELEMETRY: "1",
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_LOGS_EXPORTER: "otlp",
-        OTEL_METRICS_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json",
-        OTEL_LOG_USER_PROMPTS: "1",
-        OTEL_LOG_TOOL_DETAILS: "1",
-        OTEL_LOG_TOOL_CONTENT: "1",
-        OTEL_LOG_RAW_API_BODIES: "1"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=claude-code"
-      });
-    case "codex":
-      return __spreadProps(__spreadValues({
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=codex"
-      });
-    case "gemini":
-      return __spreadProps(__spreadValues({
-        GEMINI_TELEMETRY_ENABLED: "true",
-        GEMINI_TELEMETRY_TARGET: "local",
-        GEMINI_TELEMETRY_USE_COLLECTOR: "true",
-        GEMINI_TELEMETRY_TRACES_ENABLED: "true",
-        GEMINI_TELEMETRY_OTLP_PROTOCOL: "http",
-        GEMINI_TELEMETRY_OTLP_ENDPOINT: endpoint,
-        GEMINI_TELEMETRY_LOG_PROMPTS: "true",
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=gemini-cli"
-      });
-    case "opencode":
-      return __spreadProps(__spreadValues({
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_LOGS_EXPORTER: "otlp",
-        OTEL_METRICS_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=opencode"
-      });
-    default:
-      return base;
-  }
-}
-
-// src/cli/utils/governance/codex-rollout-otlp.ts
-import { createHash } from "crypto";
-import { readFile, readdir, stat } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-
-// src/cli/utils/governance/codex-rollout.ts
-var MAX_CONTENT_CHARS = 3e4;
-var MAX_INPUT_CHARS = 12e4;
-var MAX_OUTPUT_CHARS = 3e4;
-function truncate(text, max) {
-  return text.length > max ? `${text.slice(0, max)}\u2026[truncated]` : text;
-}
-function textFromContent(content) {
-  if (!Array.isArray(content)) return "";
-  const parts = [];
-  for (const part of content) {
-    if (part && typeof part === "object") {
-      const t = part.text;
-      const ot = part.output_text;
-      if (typeof t === "string") parts.push(t);
-      else if (typeof ot === "string") parts.push(ot);
-    }
-  }
-  return parts.join("").trim();
-}
-function outputToText(output) {
-  if (typeof output === "string") return output;
-  if (output && typeof output === "object") {
-    const inner = output.output;
-    if (typeof inner === "string") return inner;
-    try {
-      return JSON.stringify(output);
-    } catch (e) {
-      return "";
-    }
-  }
-  if (typeof output === "number" || typeof output === "boolean") {
-    return String(output);
-  }
-  return "";
-}
-function capInputMessages(messages) {
-  var _a;
-  const capped = messages.map(
-    (m) => typeof m.content === "string" && m.content.length > MAX_CONTENT_CHARS ? __spreadProps(__spreadValues({}, m), { content: truncate(m.content, MAX_CONTENT_CHARS) }) : m
-  );
-  const serializedLength = () => JSON.stringify(capped).length;
-  let i = 0;
-  while (serializedLength() > MAX_INPUT_CHARS && i < capped.length) {
-    if (((_a = capped[i]) == null ? void 0 : _a.role) === "system") {
-      i++;
-      continue;
-    }
-    capped.splice(i, 1);
-  }
-  return capped;
-}
-function explicitToolCallId(payload) {
-  if (typeof payload.call_id === "string" && payload.call_id) {
-    return payload.call_id;
-  }
-  if (typeof payload.id === "string" && payload.id) return payload.id;
-  return null;
-}
-var CodexTurnAccumulator = class {
-  constructor() {
-    /** Emitted turns, in rollout order. */
-    this.turns = [];
-    /** Accumulating conversation across the whole rollout (claude-style). */
-    this.history = [];
-    this.sessionModel = null;
-    this.cur = null;
-    /** Latest assistant text not yet committed to history (the final-answer candidate). */
-    this.pendingAssistant = null;
-    /** Authoritative final answer from the agent_message(final_answer) event. */
-    this.agentFinal = null;
-    /**
-     * Synthetic ids minted for tool calls that arrived without a `call_id`, queued
-     * FIFO so the matching (also id-less) function_call_output pairs to the same id
-     * instead of drifting as the running history grows.
-     */
-    this.pendingToolCallIds = [];
-    this.autoToolCallSeq = 0;
-  }
-  /** Route one parsed rollout line to the handler for its event type. */
-  handle(obj) {
-    var _a;
-    const payload = (_a = obj.payload) != null ? _a : {};
-    switch (obj.type) {
-      case "session_meta":
-        return this.onSessionMeta(payload);
-      case "turn_context":
-        return this.onTurnContext(payload);
-      case "event_msg":
-        return this.onEventMsg(payload);
-      case "response_item":
-        return this.onResponseItem(payload);
-    }
-  }
-  /** Close the trailing open turn and return every emitted turn. */
-  finish() {
-    this.closeTurn();
-    return this.turns;
-  }
-  onSessionMeta(payload) {
-    const bi = payload.base_instructions;
-    if (typeof bi === "string" && bi.trim()) {
-      this.history.push({ role: "system", content: bi.trim() });
-    }
-  }
-  onTurnContext(payload) {
-    const m = payload.model;
-    if (typeof m === "string" && m) {
-      this.sessionModel = m;
-      if (this.cur) this.cur.model = m;
-    }
-  }
-  onEventMsg(payload) {
-    if (payload.type === "task_started") return this.onTaskStarted(payload);
-    if (payload.type === "task_complete") return this.closeTurn();
-    if (!this.cur) return;
-    if (payload.type === "agent_message") this.onAgentMessage(payload);
-  }
-  onTaskStarted(payload) {
-    this.closeTurn();
-    const traceId = typeof payload.trace_id === "string" ? payload.trace_id : null;
-    if (!traceId) return;
-    this.cur = {
-      traceId,
-      turnId: typeof payload.turn_id === "string" ? payload.turn_id : null,
-      model: this.sessionModel,
-      startedAtMs: typeof payload.started_at === "number" ? payload.started_at * 1e3 : null
-    };
-  }
-  onAgentMessage(payload) {
-    const msg = payload.message;
-    if (typeof msg === "string" && msg.trim() && payload.phase === "final_answer") {
-      this.agentFinal = msg.trim();
-    }
-  }
-  onResponseItem(payload) {
-    if (!this.cur) return;
-    switch (payload.type) {
-      case "message":
-        return this.onMessage(payload);
-      case "function_call":
-        return this.onFunctionCall(payload);
-      case "function_call_output":
-        return this.onFunctionCallOutput(payload);
-    }
-  }
-  onMessage(payload) {
-    const role = payload.role;
-    const text = textFromContent(payload.content);
-    if (!text) return;
-    if (role === "developer") {
-      this.flushPendingAssistant();
-      this.history.push({ role: "system", content: text });
-    } else if (role === "user") {
-      this.flushPendingAssistant();
-      this.history.push({ role: "user", content: text });
-    } else if (role === "assistant") {
-      this.flushPendingAssistant();
-      this.pendingAssistant = text;
-    }
-  }
-  onFunctionCall(payload) {
-    this.flushPendingAssistant();
-    let callId = explicitToolCallId(payload);
-    if (!callId) {
-      callId = `call_auto_${this.autoToolCallSeq++}`;
-      this.pendingToolCallIds.push(callId);
-    }
-    const name = typeof payload.name === "string" ? payload.name : "tool";
-    const args = typeof payload.arguments === "string" ? payload.arguments : payload.arguments != null ? JSON.stringify(payload.arguments) : "";
-    this.history.push({
-      role: "assistant",
-      tool_calls: [
-        {
-          id: callId,
-          type: "function",
-          function: { name, arguments: truncate(args, MAX_CONTENT_CHARS) }
-        }
-      ]
-    });
-  }
-  onFunctionCallOutput(payload) {
-    var _a, _b;
-    this.flushPendingAssistant();
-    const callId = (_b = (_a = explicitToolCallId(payload)) != null ? _a : this.pendingToolCallIds.shift()) != null ? _b : `call_auto_${this.autoToolCallSeq++}`;
-    this.history.push({
-      role: "tool",
-      tool_call_id: callId,
-      content: truncate(outputToText(payload.output), MAX_CONTENT_CHARS)
-    });
-  }
-  flushPendingAssistant() {
-    if (this.pendingAssistant !== null) {
-      this.history.push({ role: "assistant", content: this.pendingAssistant });
-      this.pendingAssistant = null;
-    }
-  }
-  closeTurn() {
-    var _a, _b;
-    if (this.cur) {
-      const finalAnswer = (_a = this.agentFinal) != null ? _a : this.pendingAssistant;
-      if (finalAnswer == null ? void 0 : finalAnswer.trim()) {
-        this.turns.push({
-          traceId: this.cur.traceId,
-          turnId: this.cur.turnId,
-          model: (_b = this.cur.model) != null ? _b : this.sessionModel,
-          inputMessages: capInputMessages([...this.history]),
-          output: truncate(finalAnswer.trim(), MAX_OUTPUT_CHARS),
-          startedAtMs: this.cur.startedAtMs
-        });
-        this.history.push({ role: "assistant", content: finalAnswer.trim() });
-      }
-    }
-    this.pendingToolCallIds.length = 0;
-    this.cur = null;
-    this.pendingAssistant = null;
-    this.agentFinal = null;
-  }
-};
-function parseCodexRollout(content) {
-  const acc = new CodexTurnAccumulator();
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    let obj;
-    try {
-      obj = JSON.parse(trimmed);
-    } catch (e) {
-      continue;
-    }
-    acc.handle(obj);
-  }
-  return acc.finish();
-}
-
-// src/cli/utils/governance/codex-rollout-otlp.ts
-function ioSpanId(traceId) {
-  return createHash("sha256").update(`${traceId}:langwatch.io`).digest("hex").slice(0, 16);
-}
-function attr(key, value) {
-  return { key, value: { stringValue: value } };
-}
-function buildCodexIOExportRequest(turns, nowMs) {
-  const spans = turns.map((turn) => {
-    var _a;
-    const startMs = (_a = turn.startedAtMs) != null ? _a : nowMs;
-    const endMs = Math.max(startMs, nowMs);
-    const attributes = [
-      attr("langwatch.span.type", "llm"),
-      attr(
-        "langwatch.input",
-        JSON.stringify({ type: "chat_messages", value: turn.inputMessages })
-      ),
-      attr("langwatch.output", turn.output)
-    ];
-    if (turn.model) {
-      attributes.push(attr("gen_ai.request.model", turn.model));
-      attributes.push(attr("gen_ai.response.model", turn.model));
-    }
-    return {
-      traceId: turn.traceId,
-      spanId: ioSpanId(turn.traceId),
-      name: "codex.turn.response",
-      kind: 1,
-      startTimeUnixNano: `${startMs}000000`,
-      endTimeUnixNano: `${endMs}000000`,
-      attributes,
-      status: {}
-    };
-  });
-  return {
-    resourceSpans: [
-      {
-        resource: { attributes: [attr("service.name", "codex")] },
-        scopeSpans: [
-          {
-            // A langwatch.* scope (NOT codex_cli_rs) so the ingestion
-            // infra-span filter leaves these content spans alone.
-            scope: { name: "langwatch.codex.rollout" },
-            spans
-          }
-        ]
-      }
-    ]
-  };
-}
-async function findRecentRollouts(sinceMs, sessionsRoot = join3(homedir3(), ".codex", "sessions")) {
-  const out = [];
-  async function walk(dir, depth) {
-    let entries;
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch (e) {
-      return;
-    }
-    for (const e of entries) {
-      const full = join3(dir, e.name);
-      if (e.isDirectory()) {
-        if (depth < 3) await walk(full, depth + 1);
-      } else if (e.isFile() && e.name.startsWith("rollout-") && e.name.endsWith(".jsonl")) {
-        try {
-          const s = await stat(full);
-          if (s.mtimeMs >= sinceMs) out.push(full);
-        } catch (e2) {
-        }
-      }
-    }
-  }
-  await walk(sessionsRoot, 0);
-  return out;
-}
-async function readRolloutTurns(sinceMs, sessionsRoot) {
-  const files = await findRecentRollouts(sinceMs, sessionsRoot);
-  const turns = [];
-  for (const file of files) {
-    try {
-      turns.push(...parseCodexRollout(await readFile(file, "utf8")));
-    } catch (e) {
-    }
-  }
-  return turns;
-}
-async function postCodexTurns(args) {
-  const { turns, nowMs, endpoint, token, fetchImpl } = args;
-  const body = buildCodexIOExportRequest(turns, nowMs);
-  const doFetch = fetchImpl != null ? fetchImpl : fetch;
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 5e3);
-  try {
-    await doFetch(endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${token}`
-      },
-      body: JSON.stringify(body),
-      signal: controller.signal
-    });
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function createCodexIOStreamer(args) {
-  var _a;
-  const root = (_a = args.sessionsRoot) != null ? _a : join3(homedir3(), ".codex", "sessions");
-  const emitted = /* @__PURE__ */ new Set();
-  return {
-    async harvest(nowMs) {
-      const turns = await readRolloutTurns(args.sinceMs, root);
-      const fresh = turns.filter((t) => t.traceId && !emitted.has(t.traceId));
-      if (fresh.length === 0) return 0;
-      await postCodexTurns({
-        turns: fresh,
-        nowMs,
-        endpoint: args.endpoint,
-        token: args.token,
-        fetchImpl: args.fetchImpl
-      });
-      for (const t of fresh) emitted.add(t.traceId);
-      return fresh.length;
-    }
-  };
-}
-
-// src/cli/utils/governance/wrapper-path-choice.ts
-import prompts from "prompts";
-var TOOL_MODE_FLAG = "--tool-mode";
-function tokenToMode(token) {
-  const t = (token != null ? token : "").trim().toLowerCase();
-  if (t === "gateway" || t === "vk") return "gateway";
-  if (t === "otlp" || t === "ingestion" || t === "direct") return "ingestion";
-  return null;
-}
-function parseToolModeFlag(args, env = process.env) {
-  var _a;
-  const out = [];
-  let flagOverride;
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === TOOL_MODE_FLAG) {
-      const value = args[i + 1];
-      const mode = tokenToMode(value);
-      if (mode) flagOverride = mode;
-      if (value !== void 0) i++;
-      continue;
-    }
-    if (arg.startsWith(`${TOOL_MODE_FLAG}=`)) {
-      const value = arg.slice(TOOL_MODE_FLAG.length + 1);
-      const mode = tokenToMode(value);
-      if (mode) flagOverride = mode;
-      continue;
-    }
-    out.push(arg);
-  }
-  const override = (_a = flagOverride != null ? flagOverride : tokenToMode(env.LANGWATCH_TOOL_MODE)) != null ? _a : void 0;
-  return { args: out, override };
-}
-function isForcedAutoLogin(env) {
-  const flag = env.LANGWATCH_AUTO_LOGIN;
-  return flag === "1" || flag === "true";
-}
-function pathChoiceMessage(tool) {
-  return `How should \`langwatch ${tool}\` run?`;
-}
-function gatewayChoiceTitle() {
-  return "Gateway (virtual key) - route LLM calls through LangWatch (usage billed per token)";
-}
-function otlpChoiceTitle(tool) {
-  return `Direct OTLP - use your own ${tool} plan, send only telemetry to LangWatch`;
-}
-async function resolveWrapperPath(opts) {
-  var _a, _b, _c;
-  const {
-    cfg,
-    tool,
-    override,
-    promptImpl = prompts,
-    saveImpl = saveConfig,
-    writeImpl = (s) => void process.stderr.write(s),
-    env = process.env
-  } = opts;
-  const isTTY = (_a = opts.isTTY) != null ? _a : Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
-  if (override) {
-    return { mode: override, prompted: false };
-  }
-  const pinned = (_b = cfg.tool_mode) == null ? void 0 : _b[tool];
-  if (pinned === "gateway" || pinned === "ingestion") {
-    return { mode: pinned, prompted: false };
-  }
-  if (opts.refreshPolicies) {
-    try {
-      const fresh = await opts.refreshPolicies(cfg);
-      if (fresh) {
-        cfg.tool_policies = fresh;
-        try {
-          saveImpl(__spreadProps(__spreadValues({}, cfg), { tool_policies: fresh }));
-        } catch (e) {
-        }
-      }
-    } catch (e) {
-    }
-  }
-  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
-  const allowGateway = policy.allowVk;
-  const allowOtlp = policy.allowOtelDirect;
-  if (allowGateway && !allowOtlp) {
-    return { mode: "gateway", prompted: false };
-  }
-  if (!allowGateway && allowOtlp) {
-    return { mode: "ingestion", prompted: false };
-  }
-  if (!allowGateway && !allowOtlp) {
-    return { mode: "gateway", prompted: false };
-  }
-  const canPrompt = isTTY && !isForcedAutoLogin(env);
-  if (!canPrompt) {
-    return { mode: "gateway", prompted: false };
-  }
-  const res = await promptImpl({
-    type: "select",
-    name: "path",
-    message: pathChoiceMessage(tool),
-    choices: [
-      {
-        title: gatewayChoiceTitle(),
-        value: "gateway"
-      },
-      {
-        title: otlpChoiceTitle(tool),
-        value: "ingestion"
-      }
-    ],
-    initial: 0
-  });
-  const chosen = tokenToMode(res == null ? void 0 : res.path);
-  if (!chosen) {
-    return { mode: "gateway", prompted: false };
-  }
-  const next = __spreadProps(__spreadValues({}, cfg), {
-    tool_mode: __spreadProps(__spreadValues({}, (_c = cfg.tool_mode) != null ? _c : {}), { [tool]: chosen })
-  });
-  try {
-    saveImpl(next);
-    cfg.tool_mode = next.tool_mode;
-  } catch (e) {
-  }
-  const label = chosen === "gateway" ? "gateway" : "otlp";
-  writeImpl(
-    `${lwTag()} saved. \`${tool}\` will use the ${label} path. Override with --tool-mode=${chosen === "gateway" ? "otlp" : "gateway"}, or edit ~/.langwatch/config.json (tool_mode.${tool}).
-`
-  );
-  return { mode: chosen, prompted: true };
-}
-
-// src/cli/utils/governance/wrapper.ts
-var CODEX_IO_POLL_MS = 2500;
-function envForTool(cfg, tool) {
-  var _a;
-  const gw = cfg.gateway_url.replace(/\/+$/, "");
-  const auth = (_a = cfg.default_personal_vk) == null ? void 0 : _a.secret;
-  if (!auth) return { vars: {} };
-  switch (tool) {
-    case "claude":
-      return {
-        vars: {
-          ANTHROPIC_BASE_URL: gw,
-          ANTHROPIC_AUTH_TOKEN: auth
-        },
-        clears: ["ANTHROPIC_API_KEY"]
-      };
-    case "codex":
-      return {
-        vars: {
-          OPENAI_BASE_URL: gw,
-          OPENAI_API_KEY: auth
-        }
-      };
-    case "cursor":
-      return {
-        vars: {
-          OPENAI_BASE_URL: gw,
-          OPENAI_API_KEY: auth,
-          ANTHROPIC_BASE_URL: gw,
-          ANTHROPIC_AUTH_TOKEN: auth
-        },
-        clears: ["ANTHROPIC_API_KEY"]
-      };
-    case "gemini":
-      return {
-        vars: {
-          GOOGLE_GEMINI_BASE_URL: gw,
-          GEMINI_API_KEY: auth,
-          GOOGLE_API_KEY: auth
-        }
-      };
-    case "opencode":
-      return {
-        vars: {
-          OPENAI_BASE_URL: `${gw}/v1`,
-          OPENAI_API_KEY: auth,
-          ANTHROPIC_BASE_URL: `${gw}/v1`,
-          ANTHROPIC_AUTH_TOKEN: auth,
-          ANTHROPIC_API_KEY: auth
-        }
-      };
-    default:
-      return { vars: {} };
-  }
-}
-var TOOL_PROVIDER_FAMILIES = {
-  claude: ["anthropic"],
-  codex: ["openai"],
-  cursor: ["anthropic", "openai"],
-  gemini: ["google", "gemini"],
-  opencode: ["anthropic", "openai"]
-};
-function shouldForgetGatewayPin(args) {
-  return args.pinnedMode === "gateway" && args.retryable !== true;
-}
-function renderContactFooter(adminEmail) {
-  if (adminEmail) {
-    return `Need help? Contact your LangWatch admin: ${adminEmail}
-`;
-  }
-  return `If you need help, contact your LangWatch admin.
-`;
-}
-async function preflightWrapper(cfg, tool, opts = {}) {
-  var _a, _b, _c, _d, _e, _f, _g;
-  const cp = cfg.control_plane_url.replace(/\/+$/, "");
-  const bootstrap = await ((_a = opts.bootstrapImpl) != null ? _a : getCliBootstrap)(cfg).catch(
-    () => null
-  );
-  const adminEmail = (_b = bootstrap == null ? void 0 : bootstrap.adminEmail) != null ? _b : null;
-  if (!((_c = cfg.default_personal_vk) == null ? void 0 : _c.secret)) {
-    return {
-      ok: false,
-      message: `No personal virtual key on this account.
-Your organization needs at least one AI provider configured before
-\`langwatch ${tool}\` can route requests.
-If you're an admin, set one up at
-  ${cp}/settings/model-providers
-then run \`langwatch login --device\` to refresh your credentials.
-` + renderContactFooter(adminEmail)
-    };
-  }
-  const gw = cfg.gateway_url.replace(/\/+$/, "");
-  const f = (_d = opts.fetchImpl) != null ? _d : fetch;
-  const timeoutMs = (_e = opts.timeoutMs) != null ? _e : 3e3;
-  try {
-    const res = await f(`${gw}/healthz`, {
-      method: "GET",
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!res.ok) {
-      return {
-        ok: false,
-        retryable: true,
-        message: `AI Gateway at ${gw} returned HTTP ${res.status}.
-The wrapper cannot route \`langwatch ${tool}\` requests until the
-data plane is healthy. Check that the LangWatch gateway is running.
-` + renderContactFooter(adminEmail)
-      };
-    }
-  } catch (err) {
-    return {
-      ok: false,
-      retryable: true,
-      message: `Cannot reach AI Gateway at ${gw}
-  ${err.message}
-Check that the LangWatch gateway is running, or set LANGWATCH_GATEWAY_URL
-if you've deployed it elsewhere.
-` + renderContactFooter(adminEmail)
-    };
-  }
-  if (Array.isArray(bootstrap == null ? void 0 : bootstrap.tools)) {
-    const published = bootstrap.tools.some((t) => t.slug === tool);
-    if (!published) {
-      return {
-        ok: false,
-        message: `The gateway isn't enabled for \`${tool}\` in your organization.
-An admin needs to publish a ${tool} coding-assistant tile in the
-AI Tools catalog (with the gateway path enabled):
-  ${cp}/settings/governance/tool-catalog
-` + renderContactFooter(adminEmail)
-      };
-    }
-  }
-  const need = TOOL_PROVIDER_FAMILIES[tool];
-  const configured = (_g = bootstrap == null ? void 0 : bootstrap.gatewayProviders) != null ? _g : (_f = bootstrap == null ? void 0 : bootstrap.providers) == null ? void 0 : _f.map((p) => p.name);
-  if (need && need.length > 0 && Array.isArray(configured)) {
-    const have = new Set(configured.map((n) => n.toLowerCase()));
-    const matches = need.filter((n) => have.has(n));
-    if (matches.length === 0) {
-      const list = need.map((n) => `\`${n}\``).join(" or ");
-      return {
-        ok: false,
-        message: `No ${list} provider credential is configured for your organization.
-\`langwatch ${tool}\` needs at least one enabled provider to route
-requests through the gateway. If you're an admin, add one at
-  ${cp}/settings/model-providers
-` + renderContactFooter(adminEmail)
-      };
-    }
-  }
-  return { ok: true };
-}
-function shouldAutoLogin() {
-  const flag = process.env.LANGWATCH_AUTO_LOGIN;
-  if (flag === "1" || flag === "true") return true;
-  if (flag === "0" || flag === "false") return false;
-  return Boolean(process.stdin.isTTY);
-}
-async function runWrapped(tool, args) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
-  let cfg = loadConfig();
-  if (!isLoggedIn(cfg)) {
-    if (!shouldAutoLogin()) {
-      process.stderr.write(
-        "Not logged in. Run `langwatch login --device` first.\n"
-      );
-      process.exit(1);
-    }
-    process.stderr.write(
-      "Not logged in. Starting device-flow login...\n"
-    );
-    try {
-      cfg = await runDeviceFlowLogin({ cfg });
-    } catch (err) {
-      process.stderr.write(
-        `login failed: ${(_a = err.message) != null ? _a : "unknown error"}
-`
-      );
-      process.exit(1);
-    }
-    if (!isLoggedIn(cfg)) {
-      process.stderr.write("login did not complete - exiting\n");
-      process.exit(1);
-    }
-  }
-  const exceeded = await checkBudget(cfg);
-  if (exceeded) {
-    process.stderr.write(renderBudgetExceeded(exceeded));
-    if (exceeded.request_increase_url) {
-      cfg.last_request_increase_url = exceeded.request_increase_url;
-      try {
-        saveConfig(cfg);
-      } catch (e) {
-      }
-    }
-    process.exit(2);
-  }
-  const { args: toolArgs, override: pathOverride } = parseToolModeFlag(args);
-  let pathChoice;
-  try {
-    pathChoice = await resolveWrapperPath({
-      cfg,
-      tool,
-      args: toolArgs,
-      override: pathOverride,
-      // Re-check the org policy at run time so a path the admin disabled
-      // after login is respected without a re-login. Best-effort: on any
-      // failure resolveWrapperPath keeps the login-cached policy map.
-      refreshPolicies: (c) => getCliBootstrap(c).then((b) => {
-        var _a2;
-        return (_a2 = b == null ? void 0 : b.toolPolicies) != null ? _a2 : null;
-      })
-    });
-  } catch (err) {
-    process.stderr.write(`path selection failed: ${err.message}
-`);
-    process.exit(2);
-  }
-  const toolEnv = envForTool(cfg, tool);
-  const gatewayVars = toolEnv.vars;
-  const gatewayClears = (_b = toolEnv.clears) != null ? _b : [];
-  let modeResult;
-  try {
-    modeResult = await resolveWrapperMode(
-      cfg,
-      tool,
-      gatewayVars,
-      gatewayClears,
-      pathChoice.mode
-    );
-  } catch (err) {
-    const isToolDisabled = err instanceof GovernanceCliError && err.code === "tool_disabled";
-    const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
-    if (pathChoice.mode === "ingestion" && policy.allowVk && !isToolDisabled) {
-      process.stderr.write(
-        `${lwTag()} couldn't set up direct OTLP ingestion for ${tool} (${err.message}). Falling back to the gateway path.
-`
-      );
-      try {
-        modeResult = await resolveWrapperMode(
-          cfg,
-          tool,
-          gatewayVars,
-          gatewayClears,
-          "gateway"
-        );
-      } catch (err2) {
-        process.stderr.write(
-          `mode resolution failed: ${err2.message}
-`
-        );
-        process.exit(2);
-      }
-    } else {
-      process.stderr.write(
-        `mode resolution failed: ${err.message}
-`
-      );
-      process.exit(2);
-    }
-  }
-  if (modeResult.notice) {
-    process.stderr.write(`${modeResult.notice}
-`);
-  }
-  if (modeResult.mode === "gateway") {
-    const probe = await preflightWrapper(cfg, tool);
-    if (!probe.ok) {
-      process.stderr.write((_c = probe.message) != null ? _c : "preflight failed\n");
-      if (shouldForgetGatewayPin({
-        pinnedMode: (_d = cfg.tool_mode) == null ? void 0 : _d[tool],
-        retryable: probe.retryable
-      })) {
-        const toolMode = __spreadValues({}, cfg.tool_mode);
-        delete toolMode[tool];
-        cfg.tool_mode = toolMode;
-        try {
-          saveConfig(cfg);
-          process.stderr.write(
-            `${lwTag()} cleared the saved gateway path for \`${tool}\`; you'll be asked again next time so you can pick direct OTLP.
-`
-          );
-        } catch (e) {
-        }
-      }
-      process.exit(2);
-    }
-    if (modeResult.codexConfigPath) {
-      process.stderr.write(
-        `${lwTag()} wired [model_providers.langwatch] in ${modeResult.codexConfigPath}.
-`
-      );
-    }
-    if (modeResult.codexProfilePath) {
-      process.stderr.write(
-        `${lwTag()} wrote profile body to ${modeResult.codexProfilePath}.
-`
-      );
-    }
-  } else {
-    if (modeResult.newKeyMinted) {
-      process.stderr.write(
-        `${lwTag()} minted a personal ingestion key for ${tool}.
-`
-      );
-    }
-    if (modeResult.codexConfigPath) {
-      process.stderr.write(
-        `${lwTag()} wrote [otel] activation block to ${modeResult.codexConfigPath}.
-`
-      );
-    }
-    await maybeOfferIngestionShellRcPersist({
-      cfg,
-      tool,
-      vars: modeResult.vars
-    });
-  }
-  const parentEnv = __spreadValues({}, process.env);
-  for (const key of (_e = modeResult.clears) != null ? _e : []) {
-    delete parentEnv[key];
-  }
-  const env = __spreadValues(__spreadValues({}, parentEnv), modeResult.vars);
-  const finalArgs = [...(_f = modeResult.extraArgs) != null ? _f : [], ...toolArgs];
-  const shellName = (_h = ((_g = process.env.SHELL) != null ? _g : "").split("/").pop()) != null ? _h : "";
-  const aliasShell = process.platform !== "win32" && (shellName === "zsh" || shellName === "bash") ? process.env.SHELL : null;
-  const notFoundMessage = `${tool} not found in PATH - install it first (https://docs.langwatch.ai/ai-gateway/governance/admin-setup#cli-device-flow-rest-api)`;
-  const sessionStartMs = Date.now();
-  const codexStreamer = tool === "codex" && modeResult.mode === "ingestion" && modeResult.endpoint && modeResult.ingestionToken ? createCodexIOStreamer({
-    sinceMs: sessionStartMs,
-    endpoint: `${modeResult.endpoint.replace(/\/+$/, "")}/v1/traces`,
-    token: modeResult.ingestionToken
-  }) : null;
-  let codexPoll = null;
-  if (codexStreamer) {
-    let inFlight = false;
-    codexPoll = setInterval(() => {
-      if (inFlight) return;
-      inFlight = true;
-      void codexStreamer.harvest(Date.now()).catch(() => 0).finally(() => {
-        inFlight = false;
-      });
-    }, CODEX_IO_POLL_MS);
-    (_i = codexPoll.unref) == null ? void 0 : _i.call(codexPoll);
-  }
-  let child;
-  if (aliasShell) {
-    const q = (s) => `'${s.replace(/'/g, "'\\''")}'`;
-    const reapply = [
-      ...((_j = modeResult.clears) != null ? _j : []).map((k) => `unset ${k}`),
-      ...Object.entries(modeResult.vars).map(([k, v]) => `export ${k}=${q(v)}`)
-    ].join("; ");
-    const guard = `command -v -- ${q(tool)} >/dev/null 2>&1 || { printf '%s\\n' ${q(notFoundMessage)} >&2; exit 127; }`;
-    const command = `${reapply ? `${reapply}; ` : ""}${guard}; ${tool} "$@"`;
-    child = spawn(aliasShell, ["-i", "-c", command, tool, ...finalArgs], {
-      stdio: "inherit",
-      env
-    });
-  } else {
-    child = spawn(tool, finalArgs, {
-      stdio: "inherit",
-      env,
-      shell: process.platform === "win32"
-    });
-  }
-  child.on("error", (err) => {
-    if (err.code === "ENOENT") {
-      process.stderr.write(`${notFoundMessage}
-`);
-      process.exit(127);
-    }
-    process.stderr.write(`exec ${tool}: ${err.message}
-`);
-    process.exit(1);
-  });
-  const exitCode = await new Promise((resolve) => {
-    child.on("close", (code) => resolve(code != null ? code : 1));
-  });
-  if (codexPoll) clearInterval(codexPoll);
-  if (codexStreamer) {
-    try {
-      await codexStreamer.harvest(Date.now());
-    } catch (e) {
-    }
-  }
-  process.exit(exitCode);
-}
-
-export {
-  envForTool,
-  runWrapped
-};
-//# sourceMappingURL=chunk-35TLPU6Q.mjs.map