langwatch 0.34.0 → 0.35.0

package/dist/chunk-D2VRKNFF.js

@@ -1,1672 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-
-
-
-
-
-
-var _chunk6KMX34ZHjs = require('./chunk-6KMX34ZH.js');
-
-
-var _chunk5M6GLAIGjs = require('./chunk-5M6GLAIG.js');
-
-
-
-
-
-
-var _chunkZA5BH7IZjs = require('./chunk-ZA5BH7IZ.js');
-
-
-
-
-var _chunkOGAE7BVQjs = require('./chunk-OGAE7BVQ.js');
-
-
-
-var _chunkBRPEG3YQjs = require('./chunk-BRPEG3YQ.js');
-
-// src/cli/utils/governance/wrapper.ts
-var _child_process = require('child_process');
-
-// src/cli/utils/governance/brand.ts
-var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
-var LANGWATCH_ORANGE = "#ED8926";
-function lwTag() {
-  return _chalk2.default.hex(LANGWATCH_ORANGE).bold("\u2726 langwatch");
-}
-
-// src/cli/utils/governance/budget.ts
-async function checkBudget(cfg, opts = {}) {
-  var _a, _b;
-  if (!cfg.access_token) return null;
-  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
-  const url = cfg.control_plane_url.replace(/\/+$/, "") + "/api/auth/cli/budget/status";
-  let res;
-  try {
-    res = await f(url, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${cfg.access_token}`,
-        Accept: "application/json"
-      }
-    });
-  } catch (e) {
-    return null;
-  }
-  if (res.status === 200) return null;
-  if (res.status === 404) return null;
-  if (res.status === 402) {
-    try {
-      const body = await res.json();
-      if (((_b = body.error) == null ? void 0 : _b.type) && body.error.scope) return body.error;
-    } catch (e) {
-    }
-  }
-  return null;
-}
-var PERIOD_LABEL = {
-  minute: "per-minute",
-  hour: "hourly",
-  day: "daily",
-  week: "weekly",
-  month: "monthly",
-  total: "total"
-};
-function renderBudgetExceeded(e) {
-  var _a;
-  const period = (e.period || "month").toLowerCase();
-  const periodLabel = (_a = PERIOD_LABEL[period]) != null ? _a : period;
-  const lines = [];
-  lines.push("\u26A0  Budget limit reached");
-  lines.push("");
-  lines.push(`   You've used $${e.spent_usd} of your $${e.limit_usd} ${periodLabel} budget.`);
-  lines.push("   To continue, ask your team admin to raise your limit.");
-  lines.push("");
-  if (e.admin_email) {
-    lines.push(`   Admin: ${e.admin_email}`);
-    lines.push("");
-  }
-  lines.push("   Need urgent access? Run:");
-  lines.push("     langwatch request-increase");
-  return lines.join("\n") + "\n";
-}
-
-// src/cli/utils/governance/platform-tool-policy.ts
-var DEFAULTS = {
-  allowVk: true,
-  allowOtelDirect: true
-};
-var PLATFORM_TOOL_POLICIES = {
-  claude: _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, DEFAULTS),
-  codex: _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, DEFAULTS),
-  gemini: _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, DEFAULTS),
-  opencode: _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, DEFAULTS),
-  // cursor is GUI-only; Path B is not meaningful (no terminal env
-  // reaches the agent panel). The wrapper still gates on this so
-  // future GUI integrations can flip allowOtelDirect to true.
-  cursor: { allowVk: true, allowOtelDirect: false }
-};
-function hardcodedPolicy(toolSlug) {
-  if (toolSlug in PLATFORM_TOOL_POLICIES) {
-    return PLATFORM_TOOL_POLICIES[toolSlug];
-  }
-  return DEFAULTS;
-}
-function resolvePlatformToolPolicy(toolSlug, cachedPolicies) {
-  const cached = cachedPolicies == null ? void 0 : cachedPolicies[toolSlug];
-  if (cached) return cached;
-  return hardcodedPolicy(toolSlug);
-}
-
-// src/cli/utils/governance/shell-rc.ts
-var _fs = require('fs'); var fs2 = _interopRequireWildcard(_fs); var fs = _interopRequireWildcard(_fs); var fs4 = _interopRequireWildcard(_fs);
-var _os = require('os'); var os2 = _interopRequireWildcard(_os); var os = _interopRequireWildcard(_os); var os4 = _interopRequireWildcard(_os);
-var _path = require('path'); var path2 = _interopRequireWildcard(_path); var path = _interopRequireWildcard(_path); var path4 = _interopRequireWildcard(_path);
-var _readline = require('readline'); var readline = _interopRequireWildcard(_readline);
-
-
-// src/cli/utils/governance/app-settings.ts
-
-
-
-var TARGETS = {
-  claude: { segments: [".claude", "settings.json"] }
-};
-function appSettingsTargetFor(tool) {
-  const spec = TARGETS[tool];
-  if (!spec) return null;
-  const home = os.homedir();
-  return {
-    tool,
-    path: path.join(home, ...spec.segments),
-    displayPath: `~/${spec.segments.join("/")}`
-  };
-}
-function appEnvHasAllVars(target, vars) {
-  const current = readEnvMap(target.path);
-  for (const [k, v] of Object.entries(vars)) {
-    if (current[k] !== v) return false;
-  }
-  return true;
-}
-function appEnvHasAnyVar(target, keys) {
-  const current = readEnvMap(target.path);
-  return keys.some((k) => k in current);
-}
-function installAppEnv(target, vars) {
-  fs.mkdirSync(path.dirname(target.path), { recursive: true });
-  const settings = readSettings(target.path);
-  const existingEnv = settings.env;
-  const nextEnv = isPlainObject(existingEnv) ? _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, existingEnv) : {};
-  for (const [k, v] of Object.entries(vars)) {
-    nextEnv[k] = v;
-  }
-  settings.env = nextEnv;
-  fs.writeFileSync(target.path, JSON.stringify(settings, null, 2) + "\n");
-}
-function removeAppEnvVars(target, keys) {
-  let raw;
-  try {
-    raw = fs.readFileSync(target.path, "utf8");
-  } catch (e) {
-    return false;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (e) {
-    return false;
-  }
-  if (!isPlainObject(parsed)) return false;
-  const settings = _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, parsed);
-  const env = settings.env;
-  if (!isPlainObject(env)) return false;
-  const nextEnv = _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, env);
-  let removed = false;
-  for (const k of keys) {
-    if (k in nextEnv) {
-      delete nextEnv[k];
-      removed = true;
-    }
-  }
-  if (!removed) return false;
-  if (Object.keys(nextEnv).length === 0) {
-    delete settings.env;
-  } else {
-    settings.env = nextEnv;
-  }
-  fs.writeFileSync(target.path, JSON.stringify(settings, null, 2) + "\n");
-  return true;
-}
-function readSettings(filePath) {
-  try {
-    const raw = fs.readFileSync(filePath, "utf8");
-    const parsed = JSON.parse(raw);
-    if (isPlainObject(parsed)) return _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, parsed);
-    return {};
-  } catch (e) {
-    return {};
-  }
-}
-function readEnvMap(filePath) {
-  const settings = readSettings(filePath);
-  const env = settings.env;
-  if (!isPlainObject(env)) return {};
-  const out = {};
-  for (const [k, v] of Object.entries(env)) {
-    if (typeof v === "string") out[k] = v;
-  }
-  return out;
-}
-function isPlainObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-
-// src/cli/utils/governance/shell-rc.ts
-var BLOCK_BEGIN = "# >>> langwatch begin >>>";
-var BLOCK_END = "# <<< langwatch end <<<";
-var GATEWAY_RC_MARKERS = { begin: BLOCK_BEGIN, end: BLOCK_END };
-function toolMarkers(tool) {
-  return {
-    begin: `# >>> langwatch ${tool} begin >>>`,
-    end: `# <<< langwatch ${tool} end <<<`
-  };
-}
-function detectShell() {
-  var _a;
-  const raw = ((_a = process.env.SHELL) != null ? _a : "").toLowerCase();
-  if (raw.includes("fish")) return "fish";
-  if (raw.includes("zsh")) return "zsh";
-  if (raw.includes("bash")) return "bash";
-  if (process.platform === "darwin") return "zsh";
-  if (process.platform === "linux") return "bash";
-  return null;
-}
-function rcPath(shell) {
-  const home = os2.homedir();
-  switch (shell) {
-    case "zsh":
-      return path2.join(home, ".zshrc");
-    case "bash":
-      return path2.join(home, ".bashrc");
-    case "fish":
-      return path2.join(home, ".config", "fish", "config.fish");
-  }
-}
-function rcHasLangwatchBlock({
-  shell,
-  requiredKeys,
-  markers = { begin: BLOCK_BEGIN, end: BLOCK_END }
-}) {
-  try {
-    const content = fs2.readFileSync(rcPath(shell), "utf8");
-    const begin = content.indexOf(markers.begin);
-    const end = content.indexOf(markers.end);
-    if (begin === -1 || end === -1 || end < begin) return false;
-    if (!requiredKeys || requiredKeys.length === 0) return true;
-    const block = content.slice(begin, end);
-    return requiredKeys.every((k) => block.includes(k));
-  } catch (e) {
-    return false;
-  }
-}
-function quote(s) {
-  if (!/[ \t\n'"$\\]/.test(s)) return s;
-  return "'" + s.replace(/'/g, "'\\''") + "'";
-}
-function buildScopedToolFunction(tool, vars, shell) {
-  const entries = Object.entries(vars);
-  if (shell === "fish") {
-    const sets = entries.map(([k, v]) => `    set -lx ${k} ${quote(v)}`).join("\n");
-    return [
-      `function ${tool}`,
-      sets,
-      `    command ${tool} $argv`,
-      "end"
-    ].join("\n");
-  }
-  const assigns = entries.map(([k, v]) => `    ${k}=${quote(v)} \\`).join("\n");
-  return [`${tool}() {`, assigns, `    command ${tool} "$@"`, "}"].join("\n");
-}
-function persistBlockToRc(shell, block, markers = {
-  begin: BLOCK_BEGIN,
-  end: BLOCK_END
-}) {
-  const file = rcPath(shell);
-  const dir = path2.dirname(file);
-  fs2.mkdirSync(dir, { recursive: true });
-  const wrapped = `${markers.begin}
-${block}
-${markers.end}
-`;
-  let existing = "";
-  try {
-    existing = fs2.readFileSync(file, "utf8");
-  } catch (e) {
-  }
-  const marker = new RegExp(
-    `${escapeRegex(markers.begin)}[\\s\\S]*?${escapeRegex(markers.end)}\\n?`,
-    "m"
-  );
-  let next;
-  if (marker.test(existing)) {
-    next = existing.replace(marker, wrapped);
-  } else {
-    const needsNewline = existing.length > 0 && !existing.endsWith("\n");
-    next = existing + (needsNewline ? "\n" : "") + "\n" + wrapped;
-  }
-  fs2.writeFileSync(file, next);
-  return file;
-}
-function escapeRegex(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function removeBlockFromRc(shell, markers = {
-  begin: BLOCK_BEGIN,
-  end: BLOCK_END
-}) {
-  const file = rcPath(shell);
-  let content;
-  try {
-    content = fs2.readFileSync(file, "utf8");
-  } catch (e) {
-    return false;
-  }
-  const re = new RegExp(
-    `\\n?${escapeRegex(markers.begin)}[\\s\\S]*?${escapeRegex(markers.end)}\\n?`,
-    "m"
-  );
-  if (!re.test(content)) return false;
-  fs2.writeFileSync(file, content.replace(re, ""));
-  return true;
-}
-async function askPersistChoice(rcPathHint, tool) {
-  if (!process.stdin.isTTY) return "skip";
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  const ans = await new Promise((resolve) => {
-    rl.question(
-      `Install env vars to ${rcPathHint} so that next time the plain \`${tool}\` command keeps capturing telemetry data? [Y/n/never] `,
-      (a) => resolve(a)
-    );
-  });
-  rl.close();
-  const norm = ans.trim().toLowerCase();
-  if (norm === "" || norm === "y" || norm === "yes") return "yes";
-  if (norm === "never") return "never";
-  return "no";
-}
-async function maybeOfferIngestionShellRcPersist({
-  cfg,
-  tool,
-  vars
-}) {
-  var _a, _b;
-  if (cfg.shell_rc_preference === "skip") return;
-  if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) return;
-  if (Object.keys(vars).length === 0) return;
-  const appTarget = appSettingsTargetFor(tool);
-  if (appTarget) {
-    if (appEnvHasAllVars(appTarget, vars)) return;
-    console.log();
-    const choice2 = await askPersistChoice(appTarget.displayPath, tool);
-    if (choice2 === "skip" || choice2 === "no") return;
-    if (choice2 === "never") {
-      recordNeverChoice(cfg);
-      return;
-    }
-    try {
-      installAppEnv(appTarget, vars);
-      console.log(
-        _chalk2.default.green(
-          `  \u2713 Installed langwatch telemetry exports to ${appTarget.displayPath}`
-        )
-      );
-    } catch (err) {
-      console.log(
-        _chalk2.default.yellow(
-          `  ! Couldn't write to ${appTarget.displayPath}: ${err.message}`
-        )
-      );
-    }
-    return;
-  }
-  if (tool === "codex") {
-    const configPath = _chunk6KMX34ZHjs.defaultCodexConfigPath.call(void 0, );
-    if (_chunk6KMX34ZHjs.codexOtelBlockHasAuthHeader.call(void 0, configPath)) return;
-    const endpointBase = vars.OTEL_EXPORTER_OTLP_ENDPOINT;
-    const token = bearerFromHeaders(vars.OTEL_EXPORTER_OTLP_HEADERS);
-    if (!endpointBase || !token) return;
-    console.log();
-    const choice2 = await askPersistChoice(_chunk6KMX34ZHjs.displayCodexConfigPath.call(void 0, ), tool);
-    if (choice2 === "skip" || choice2 === "no") return;
-    if (choice2 === "never") {
-      recordNeverChoice(cfg);
-      return;
-    }
-    try {
-      _chunk6KMX34ZHjs.writeCodexOtelBlock.call(void 0, 
-        {
-          endpoint: _chunk6KMX34ZHjs.codexTraceEndpoint.call(void 0, endpointBase),
-          ingestionToken: token,
-          environment: (_b = (_a = cfg.organization) == null ? void 0 : _a.slug) != null ? _b : "langwatch"
-        },
-        { persistAuthHeader: true }
-      );
-      console.log(
-        _chalk2.default.green(
-          `  \u2713 Installed langwatch telemetry exports to ${_chunk6KMX34ZHjs.displayCodexConfigPath.call(void 0, )}`
-        )
-      );
-    } catch (err) {
-      console.log(
-        _chalk2.default.yellow(
-          `  ! Couldn't write to ${_chunk6KMX34ZHjs.displayCodexConfigPath.call(void 0, )}: ${err.message}`
-        )
-      );
-    }
-    return;
-  }
-  const shell = detectShell();
-  if (!shell) return;
-  const markers = toolMarkers(tool);
-  if (rcHasLangwatchBlock({
-    shell,
-    requiredKeys: [vars.OTEL_EXPORTER_OTLP_ENDPOINT].filter(
-      Boolean
-    ),
-    markers
-  })) {
-    return;
-  }
-  const target = rcPath(shell);
-  console.log();
-  const choice = await askPersistChoice(target, tool);
-  if (choice === "skip" || choice === "no") return;
-  if (choice === "never") {
-    recordNeverChoice(cfg);
-    return;
-  }
-  try {
-    const wrote = persistBlockToRc(
-      shell,
-      buildScopedToolFunction(tool, vars, shell),
-      markers
-    );
-    console.log(
-      _chalk2.default.green(
-        `  \u2713 Installed a scoped \`${tool}\` telemetry wrapper in ${wrote}`
-      )
-    );
-  } catch (err) {
-    console.log(
-      _chalk2.default.yellow(`  ! Couldn't write to ${target}: ${err.message}`)
-    );
-  }
-}
-function recordNeverChoice(cfg) {
-  cfg.shell_rc_preference = "skip";
-  try {
-    _chunkOGAE7BVQjs.saveConfig.call(void 0, cfg);
-  } catch (e) {
-  }
-}
-function bearerFromHeaders(headers) {
-  if (!headers) return null;
-  const m = /Bearer\s+(\S+)/.exec(headers);
-  return m ? m[1] : null;
-}
-
-// src/cli/utils/opencode-config-flag.ts
-
-
-
-function defaultOpencodeConfigPath() {
-  const xdg = process.env.XDG_CONFIG_HOME;
-  const configHome = xdg && xdg.length > 0 ? xdg : path2.default.join(os2.default.homedir(), ".config");
-  return path2.default.join(configHome, "opencode", "opencode.jsonc");
-}
-function stripJsoncComments(s) {
-  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
-}
-function setOpencodeOpenTelemetryFlag(options = {}) {
-  var _a, _b;
-  const filePath = (_a = options.filePath) != null ? _a : defaultOpencodeConfigPath();
-  if (!fs2.default.existsSync(filePath)) {
-    fs2.default.mkdirSync(path2.default.dirname(filePath), { recursive: true });
-    const content = JSON.stringify(
-      {
-        $schema: "https://opencode.ai/config.json",
-        experimental: { openTelemetry: true }
-      },
-      null,
-      2
-    ) + "\n";
-    fs2.default.writeFileSync(filePath, content, { mode: 384 });
-    return { action: "created", path: filePath };
-  }
-  const raw = fs2.default.readFileSync(filePath, "utf8");
-  let parsed;
-  try {
-    parsed = JSON.parse(stripJsoncComments(raw));
-  } catch (e) {
-    parsed = { $schema: "https://opencode.ai/config.json" };
-  }
-  const experimental = (_b = parsed.experimental) != null ? _b : {};
-  const prior = experimental.openTelemetry;
-  if (prior === true) return { action: "unchanged", path: filePath };
-  if (prior === false) return { action: "disabled-by-user", path: filePath };
-  parsed.experimental = _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, experimental), { openTelemetry: true });
-  fs2.default.writeFileSync(filePath, JSON.stringify(parsed, null, 2) + "\n", {
-    mode: 384
-  });
-  return { action: "updated", path: filePath };
-}
-
-// src/cli/utils/governance/gemini-settings-preflight.ts
-
-
-
-function defaultGeminiSettingsPath() {
-  var _a;
-  const home = (_a = process.env.HOME) != null ? _a : os4.homedir();
-  return path4.join(home, ".gemini", "settings.json");
-}
-function stripJsoncComments2(s) {
-  return s.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
-}
-function warnIfGeminiOAuthSelected(options = {}) {
-  var _a, _b;
-  const filePath = (_a = options.filePath) != null ? _a : defaultGeminiSettingsPath();
-  const writeLine = (_b = options.writeLine) != null ? _b : ((line) => process.stderr.write(line + "\n"));
-  if (!fs4.existsSync(filePath)) {
-    return { action: "no-settings", warned: false };
-  }
-  let raw;
-  try {
-    raw = fs4.readFileSync(filePath, "utf8");
-  } catch (e) {
-    return { action: "parse-error", warned: false };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(stripJsoncComments2(raw));
-  } catch (e) {
-    return { action: "parse-error", warned: false };
-  }
-  const selectedType = readSelectedType(parsed);
-  if (selectedType === "gemini-oauth") {
-    writeLine(
-      'warning: ~/.gemini/settings.json has security.auth.selectedType="gemini-oauth". gemini-cli 0.46 will use cached OAuth and ignore GOOGLE_API_KEY / GEMINI_API_KEY, so this `langwatch gemini` call will bypass the gateway. To route through langwatch: edit ~/.gemini/settings.json and set security.auth.selectedType to "gemini-api-key".'
-    );
-    return { action: "oauth-selected", warned: true };
-  }
-  return { action: "api-key-selected", warned: false };
-}
-function readSelectedType(parsed) {
-  if (parsed === null || typeof parsed !== "object") return null;
-  const security = parsed.security;
-  if (security === null || typeof security !== "object") return null;
-  const auth = security.auth;
-  if (auth === null || typeof auth !== "object") return null;
-  const selectedType = auth.selectedType;
-  return typeof selectedType === "string" ? selectedType : null;
-}
-
-// src/cli/utils/governance/wrapper-mode.ts
-var SOURCE_TYPE_BY_TOOL = {
-  claude: "claude_code",
-  codex: "codex",
-  gemini: "gemini",
-  opencode: "opencode"
-};
-async function resolveWrapperMode(cfg, tool, gatewayVars, gatewayClears = [], forcedMode) {
-  var _a, _b, _c, _d, _e, _f, _g;
-  const persistedMode = (_a = cfg.tool_mode) == null ? void 0 : _a[tool];
-  const hasVk = !!((_b = cfg.default_personal_vk) == null ? void 0 : _b.secret);
-  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
-  if (!policy.allowVk && !policy.allowOtelDirect) {
-    throw new (0, _chunkZA5BH7IZjs.GovernanceCliError)(
-      403,
-      "tool_disabled",
-      `Tool '${tool}' is disabled in the platform policy (both gateway and direct OTLP paths off). Ask your org admin to enable allow_vk or allow_otel_direct.`
-    );
-  }
-  let notice;
-  let mode = forcedMode != null ? forcedMode : persistedMode === "gateway" ? "gateway" : persistedMode === "ingestion" ? "ingestion" : hasVk ? "gateway" : "ingestion";
-  if (mode === "gateway" && !policy.allowVk) {
-    mode = "ingestion";
-    notice = `${lwTag()} gateway path is disabled for ${tool} by your org admin; using direct OTLP ingestion instead.`;
-  }
-  if (mode === "ingestion" && !policy.allowOtelDirect) {
-    mode = "gateway";
-    notice = `${lwTag()} direct OTLP ingestion is disabled for ${tool} by your org admin; routing through the gateway instead.`;
-  }
-  if (mode === "gateway") {
-    if (tool === "gemini") {
-      warnIfGeminiOAuthSelected();
-    }
-    if (tool === "codex") {
-      const gw = _chunk6KMX34ZHjs.writeCodexGatewayBlock.call(void 0, {
-        gatewayUrl: cfg.gateway_url,
-        envKey: "OPENAI_API_KEY"
-      });
-      return {
-        mode,
-        vars: gatewayVars,
-        clears: gatewayClears,
-        codexConfigPath: gw.path,
-        codexProfilePath: gw.profilePath,
-        extraArgs: ["--profile", gw.profile],
-        notice
-      };
-    }
-    return { mode, vars: gatewayVars, clears: gatewayClears, notice };
-  }
-  const sourceType = SOURCE_TYPE_BY_TOOL[tool];
-  if (!sourceType) {
-    return { mode: "gateway", vars: gatewayVars, clears: gatewayClears, notice };
-  }
-  if (!policy.allowOtelDirect) {
-    throw new (0, _chunkZA5BH7IZjs.GovernanceCliError)(
-      403,
-      "otel_direct_disabled",
-      `Direct OTLP ingestion is disabled for '${tool}' by your org admin. Ask them to enable allow_otel_direct, or run with the gateway path.`
-    );
-  }
-  const cached = (_c = cfg.default_personal_ingest_keys) == null ? void 0 : _c[sourceType];
-  let token;
-  let prefix;
-  let endpoint;
-  let minted;
-  if (cached == null ? void 0 : cached.secret) {
-    const cachedLookupId = _chunkZA5BH7IZjs.extractLookupIdFromToken.call(void 0, cached.secret);
-    let cacheIsLive = true;
-    try {
-      const liveKeys = await _chunkZA5BH7IZjs.listIngestionKeys.call(void 0, cfg);
-      const liveEntry = liveKeys.find(
-        (k) => k.sourceType === sourceType && k.lookupId === cachedLookupId
-      );
-      if (!liveEntry) {
-        cacheIsLive = false;
-      }
-    } catch (e) {
-    }
-    if (cacheIsLive) {
-      token = cached.secret;
-      prefix = cached.prefix;
-      endpoint = `${cfg.control_plane_url.replace(/\/+$/, "")}/api/otel`;
-      minted = false;
-    } else {
-      const r = await _chunkZA5BH7IZjs.mintIngestionKey.call(void 0, cfg, sourceType);
-      token = r.token;
-      prefix = r.prefix;
-      endpoint = r.endpoint;
-      minted = true;
-    }
-  } else {
-    const r = await _chunkZA5BH7IZjs.mintIngestionKey.call(void 0, cfg, sourceType);
-    token = r.token;
-    prefix = r.prefix;
-    endpoint = r.endpoint;
-    minted = true;
-  }
-  const vars = buildOtelEnvBlock(tool, endpoint, token);
-  let codexConfigPath;
-  if (tool === "codex") {
-    const result = _chunk6KMX34ZHjs.writeCodexOtelBlock.call(void 0, {
-      endpoint: _chunk6KMX34ZHjs.codexTraceEndpoint.call(void 0, endpoint),
-      ingestionToken: token,
-      environment: (_e = (_d = cfg.organization) == null ? void 0 : _d.slug) != null ? _e : "langwatch"
-    });
-    codexConfigPath = result.path;
-  }
-  if (tool === "opencode") {
-    setOpencodeOpenTelemetryFlag();
-  }
-  const next = _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, cfg), {
-    tool_mode: _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, (_f = cfg.tool_mode) != null ? _f : {}), { [tool]: "ingestion" })
-  });
-  if (minted) {
-    next.default_personal_ingest_keys = _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, (_g = cfg.default_personal_ingest_keys) != null ? _g : {}), {
-      [sourceType]: { secret: token, prefix }
-    });
-  }
-  try {
-    _chunkOGAE7BVQjs.saveConfig.call(void 0, next);
-  } catch (e) {
-  }
-  return {
-    mode,
-    vars,
-    codexConfigPath,
-    newKeyMinted: minted,
-    notice,
-    endpoint,
-    ingestionToken: token
-  };
-}
-function telemetryEnvVarNames(tool) {
-  return Object.keys(buildOtelEnvBlock(tool, "", ""));
-}
-function buildOtelEnvBlock(tool, endpoint, token) {
-  const base = {
-    OTEL_EXPORTER_OTLP_ENDPOINT: endpoint,
-    OTEL_EXPORTER_OTLP_HEADERS: `Authorization=Bearer ${token}`
-  };
-  switch (tool) {
-    case "claude":
-      return _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {
-        CLAUDE_CODE_ENABLE_TELEMETRY: "1",
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_LOGS_EXPORTER: "otlp",
-        OTEL_METRICS_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json",
-        OTEL_LOG_USER_PROMPTS: "1",
-        OTEL_LOG_TOOL_DETAILS: "1",
-        OTEL_LOG_TOOL_CONTENT: "1",
-        OTEL_LOG_RAW_API_BODIES: "1"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=claude-code"
-      });
-    case "codex":
-      return _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=codex"
-      });
-    case "gemini":
-      return _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {
-        GEMINI_TELEMETRY_ENABLED: "true",
-        GEMINI_TELEMETRY_TARGET: "local",
-        GEMINI_TELEMETRY_USE_COLLECTOR: "true",
-        GEMINI_TELEMETRY_TRACES_ENABLED: "true",
-        GEMINI_TELEMETRY_OTLP_PROTOCOL: "http",
-        GEMINI_TELEMETRY_OTLP_ENDPOINT: endpoint,
-        GEMINI_TELEMETRY_LOG_PROMPTS: "true",
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=gemini-cli"
-      });
-    case "opencode":
-      return _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {
-        OTEL_TRACES_EXPORTER: "otlp",
-        OTEL_LOGS_EXPORTER: "otlp",
-        OTEL_METRICS_EXPORTER: "otlp",
-        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json"
-      }, base), {
-        OTEL_RESOURCE_ATTRIBUTES: "service.name=opencode"
-      });
-    default:
-      return base;
-  }
-}
-
-// src/cli/utils/governance/codex-rollout-otlp.ts
-var _crypto = require('crypto');
-var _promises = require('fs/promises');
-
-
-
-// src/cli/utils/governance/codex-rollout.ts
-var MAX_CONTENT_CHARS = 3e4;
-var MAX_INPUT_CHARS = 12e4;
-var MAX_OUTPUT_CHARS = 3e4;
-function truncate(text, max) {
-  return text.length > max ? `${text.slice(0, max)}\u2026[truncated]` : text;
-}
-function textFromContent(content) {
-  if (!Array.isArray(content)) return "";
-  const parts = [];
-  for (const part of content) {
-    if (part && typeof part === "object") {
-      const t = part.text;
-      const ot = part.output_text;
-      if (typeof t === "string") parts.push(t);
-      else if (typeof ot === "string") parts.push(ot);
-    }
-  }
-  return parts.join("").trim();
-}
-function outputToText(output) {
-  if (typeof output === "string") return output;
-  if (output && typeof output === "object") {
-    const inner = output.output;
-    if (typeof inner === "string") return inner;
-    try {
-      return JSON.stringify(output);
-    } catch (e) {
-      return "";
-    }
-  }
-  if (typeof output === "number" || typeof output === "boolean") {
-    return String(output);
-  }
-  return "";
-}
-function capInputMessages(messages) {
-  var _a;
-  const capped = messages.map(
-    (m) => typeof m.content === "string" && m.content.length > MAX_CONTENT_CHARS ? _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, m), { content: truncate(m.content, MAX_CONTENT_CHARS) }) : m
-  );
-  const serializedLength = () => JSON.stringify(capped).length;
-  let i = 0;
-  while (serializedLength() > MAX_INPUT_CHARS && i < capped.length) {
-    if (((_a = capped[i]) == null ? void 0 : _a.role) === "system") {
-      i++;
-      continue;
-    }
-    capped.splice(i, 1);
-  }
-  return capped;
-}
-function explicitToolCallId(payload) {
-  if (typeof payload.call_id === "string" && payload.call_id) {
-    return payload.call_id;
-  }
-  if (typeof payload.id === "string" && payload.id) return payload.id;
-  return null;
-}
-var CodexTurnAccumulator = class {
-  constructor() {
-    /** Emitted turns, in rollout order. */
-    this.turns = [];
-    /** Accumulating conversation across the whole rollout (claude-style). */
-    this.history = [];
-    this.sessionModel = null;
-    this.cur = null;
-    /** Latest assistant text not yet committed to history (the final-answer candidate). */
-    this.pendingAssistant = null;
-    /** Authoritative final answer from the agent_message(final_answer) event. */
-    this.agentFinal = null;
-    /**
-     * Synthetic ids minted for tool calls that arrived without a `call_id`, queued
-     * FIFO so the matching (also id-less) function_call_output pairs to the same id
-     * instead of drifting as the running history grows.
-     */
-    this.pendingToolCallIds = [];
-    this.autoToolCallSeq = 0;
-  }
-  /** Route one parsed rollout line to the handler for its event type. */
-  handle(obj) {
-    var _a;
-    const payload = (_a = obj.payload) != null ? _a : {};
-    switch (obj.type) {
-      case "session_meta":
-        return this.onSessionMeta(payload);
-      case "turn_context":
-        return this.onTurnContext(payload);
-      case "event_msg":
-        return this.onEventMsg(payload);
-      case "response_item":
-        return this.onResponseItem(payload);
-    }
-  }
-  /** Close the trailing open turn and return every emitted turn. */
-  finish() {
-    this.closeTurn();
-    return this.turns;
-  }
-  onSessionMeta(payload) {
-    const bi = payload.base_instructions;
-    if (typeof bi === "string" && bi.trim()) {
-      this.history.push({ role: "system", content: bi.trim() });
-    }
-  }
-  onTurnContext(payload) {
-    const m = payload.model;
-    if (typeof m === "string" && m) {
-      this.sessionModel = m;
-      if (this.cur) this.cur.model = m;
-    }
-  }
-  onEventMsg(payload) {
-    if (payload.type === "task_started") return this.onTaskStarted(payload);
-    if (payload.type === "task_complete") return this.closeTurn();
-    if (!this.cur) return;
-    if (payload.type === "agent_message") this.onAgentMessage(payload);
-  }
-  onTaskStarted(payload) {
-    this.closeTurn();
-    const traceId = typeof payload.trace_id === "string" ? payload.trace_id : null;
-    if (!traceId) return;
-    this.cur = {
-      traceId,
-      turnId: typeof payload.turn_id === "string" ? payload.turn_id : null,
-      model: this.sessionModel,
-      startedAtMs: typeof payload.started_at === "number" ? payload.started_at * 1e3 : null
-    };
-  }
-  onAgentMessage(payload) {
-    const msg = payload.message;
-    if (typeof msg === "string" && msg.trim() && payload.phase === "final_answer") {
-      this.agentFinal = msg.trim();
-    }
-  }
-  onResponseItem(payload) {
-    if (!this.cur) return;
-    switch (payload.type) {
-      case "message":
-        return this.onMessage(payload);
-      case "function_call":
-        return this.onFunctionCall(payload);
-      case "function_call_output":
-        return this.onFunctionCallOutput(payload);
-    }
-  }
-  onMessage(payload) {
-    const role = payload.role;
-    const text = textFromContent(payload.content);
-    if (!text) return;
-    if (role === "developer") {
-      this.flushPendingAssistant();
-      this.history.push({ role: "system", content: text });
-    } else if (role === "user") {
-      this.flushPendingAssistant();
-      this.history.push({ role: "user", content: text });
-    } else if (role === "assistant") {
-      this.flushPendingAssistant();
-      this.pendingAssistant = text;
-    }
-  }
-  onFunctionCall(payload) {
-    this.flushPendingAssistant();
-    let callId = explicitToolCallId(payload);
-    if (!callId) {
-      callId = `call_auto_${this.autoToolCallSeq++}`;
-      this.pendingToolCallIds.push(callId);
-    }
-    const name = typeof payload.name === "string" ? payload.name : "tool";
-    const args = typeof payload.arguments === "string" ? payload.arguments : payload.arguments != null ? JSON.stringify(payload.arguments) : "";
-    this.history.push({
-      role: "assistant",
-      tool_calls: [
-        {
-          id: callId,
-          type: "function",
-          function: { name, arguments: truncate(args, MAX_CONTENT_CHARS) }
-        }
-      ]
-    });
-  }
-  onFunctionCallOutput(payload) {
-    var _a, _b;
-    this.flushPendingAssistant();
-    const callId = (_b = (_a = explicitToolCallId(payload)) != null ? _a : this.pendingToolCallIds.shift()) != null ? _b : `call_auto_${this.autoToolCallSeq++}`;
-    this.history.push({
-      role: "tool",
-      tool_call_id: callId,
-      content: truncate(outputToText(payload.output), MAX_CONTENT_CHARS)
-    });
-  }
-  flushPendingAssistant() {
-    if (this.pendingAssistant !== null) {
-      this.history.push({ role: "assistant", content: this.pendingAssistant });
-      this.pendingAssistant = null;
-    }
-  }
-  closeTurn() {
-    var _a, _b;
-    if (this.cur) {
-      const finalAnswer = (_a = this.agentFinal) != null ? _a : this.pendingAssistant;
-      if (finalAnswer == null ? void 0 : finalAnswer.trim()) {
-        this.turns.push({
-          traceId: this.cur.traceId,
-          turnId: this.cur.turnId,
-          model: (_b = this.cur.model) != null ? _b : this.sessionModel,
-          inputMessages: capInputMessages([...this.history]),
-          output: truncate(finalAnswer.trim(), MAX_OUTPUT_CHARS),
-          startedAtMs: this.cur.startedAtMs
-        });
-        this.history.push({ role: "assistant", content: finalAnswer.trim() });
-      }
-    }
-    this.pendingToolCallIds.length = 0;
-    this.cur = null;
-    this.pendingAssistant = null;
-    this.agentFinal = null;
-  }
-};
-function parseCodexRollout(content) {
-  const acc = new CodexTurnAccumulator();
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    let obj;
-    try {
-      obj = JSON.parse(trimmed);
-    } catch (e) {
-      continue;
-    }
-    acc.handle(obj);
-  }
-  return acc.finish();
-}
-
-// src/cli/utils/governance/codex-rollout-otlp.ts
-function ioSpanId(traceId) {
-  return _crypto.createHash.call(void 0, "sha256").update(`${traceId}:langwatch.io`).digest("hex").slice(0, 16);
-}
-function attr(key, value) {
-  return { key, value: { stringValue: value } };
-}
-function buildCodexIOExportRequest(turns, nowMs) {
-  const spans = turns.map((turn) => {
-    var _a;
-    const startMs = (_a = turn.startedAtMs) != null ? _a : nowMs;
-    const endMs = Math.max(startMs, nowMs);
-    const attributes = [
-      attr("langwatch.span.type", "llm"),
-      attr(
-        "langwatch.input",
-        JSON.stringify({ type: "chat_messages", value: turn.inputMessages })
-      ),
-      attr("langwatch.output", turn.output)
-    ];
-    if (turn.model) {
-      attributes.push(attr("gen_ai.request.model", turn.model));
-      attributes.push(attr("gen_ai.response.model", turn.model));
-    }
-    return {
-      traceId: turn.traceId,
-      spanId: ioSpanId(turn.traceId),
-      name: "codex.turn.response",
-      kind: 1,
-      startTimeUnixNano: `${startMs}000000`,
-      endTimeUnixNano: `${endMs}000000`,
-      attributes,
-      status: {}
-    };
-  });
-  return {
-    resourceSpans: [
-      {
-        resource: { attributes: [attr("service.name", "codex")] },
-        scopeSpans: [
-          {
-            // A langwatch.* scope (NOT codex_cli_rs) so the ingestion
-            // infra-span filter leaves these content spans alone.
-            scope: { name: "langwatch.codex.rollout" },
-            spans
-          }
-        ]
-      }
-    ]
-  };
-}
-async function findRecentRollouts(sinceMs, sessionsRoot = _path.join.call(void 0, _os.homedir.call(void 0, ), ".codex", "sessions")) {
-  const out = [];
-  async function walk(dir, depth) {
-    let entries;
-    try {
-      entries = await _promises.readdir.call(void 0, dir, { withFileTypes: true });
-    } catch (e) {
-      return;
-    }
-    for (const e of entries) {
-      const full = _path.join.call(void 0, dir, e.name);
-      if (e.isDirectory()) {
-        if (depth < 3) await walk(full, depth + 1);
-      } else if (e.isFile() && e.name.startsWith("rollout-") && e.name.endsWith(".jsonl")) {
-        try {
-          const s = await _promises.stat.call(void 0, full);
-          if (s.mtimeMs >= sinceMs) out.push(full);
-        } catch (e2) {
-        }
-      }
-    }
-  }
-  await walk(sessionsRoot, 0);
-  return out;
-}
-async function readRolloutTurns(sinceMs, sessionsRoot) {
-  const files = await findRecentRollouts(sinceMs, sessionsRoot);
-  const turns = [];
-  for (const file of files) {
-    try {
-      turns.push(...parseCodexRollout(await _promises.readFile.call(void 0, file, "utf8")));
-    } catch (e) {
-    }
-  }
-  return turns;
-}
-async function postCodexTurns(args) {
-  const { turns, nowMs, endpoint, token, fetchImpl } = args;
-  const body = buildCodexIOExportRequest(turns, nowMs);
-  const doFetch = fetchImpl != null ? fetchImpl : fetch;
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 5e3);
-  try {
-    await doFetch(endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${token}`
-      },
-      body: JSON.stringify(body),
-      signal: controller.signal
-    });
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function createCodexIOStreamer(args) {
-  var _a;
-  const root = (_a = args.sessionsRoot) != null ? _a : _path.join.call(void 0, _os.homedir.call(void 0, ), ".codex", "sessions");
-  const emitted = /* @__PURE__ */ new Set();
-  return {
-    async harvest(nowMs) {
-      const turns = await readRolloutTurns(args.sinceMs, root);
-      const fresh = turns.filter((t) => t.traceId && !emitted.has(t.traceId));
-      if (fresh.length === 0) return 0;
-      await postCodexTurns({
-        turns: fresh,
-        nowMs,
-        endpoint: args.endpoint,
-        token: args.token,
-        fetchImpl: args.fetchImpl
-      });
-      for (const t of fresh) emitted.add(t.traceId);
-      return fresh.length;
-    }
-  };
-}
-
-// src/cli/utils/governance/wrapper-path-choice.ts
-var _prompts = require('prompts'); var _prompts2 = _interopRequireDefault(_prompts);
-var TOOL_MODE_FLAG = "--tool-mode";
-function tokenToMode(token) {
-  const t = (token != null ? token : "").trim().toLowerCase();
-  if (t === "gateway" || t === "vk") return "gateway";
-  if (t === "otlp" || t === "ingestion" || t === "direct") return "ingestion";
-  return null;
-}
-function parseToolModeFlag(args, env = process.env) {
-  var _a;
-  const out = [];
-  let flagOverride;
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === TOOL_MODE_FLAG) {
-      const value = args[i + 1];
-      const mode = tokenToMode(value);
-      if (mode) flagOverride = mode;
-      if (value !== void 0) i++;
-      continue;
-    }
-    if (arg.startsWith(`${TOOL_MODE_FLAG}=`)) {
-      const value = arg.slice(TOOL_MODE_FLAG.length + 1);
-      const mode = tokenToMode(value);
-      if (mode) flagOverride = mode;
-      continue;
-    }
-    out.push(arg);
-  }
-  const override = (_a = flagOverride != null ? flagOverride : tokenToMode(env.LANGWATCH_TOOL_MODE)) != null ? _a : void 0;
-  return { args: out, override };
-}
-function isForcedAutoLogin(env) {
-  const flag = env.LANGWATCH_AUTO_LOGIN;
-  return flag === "1" || flag === "true";
-}
-function pathChoiceMessage(tool) {
-  return `How should \`langwatch ${tool}\` run?`;
-}
-function gatewayChoiceTitle() {
-  return "Gateway (virtual key) - route LLM calls through LangWatch (usage billed per token)";
-}
-function otlpChoiceTitle(tool) {
-  return `Direct OTLP - use your own ${tool} plan, send only telemetry to LangWatch`;
-}
-async function resolveWrapperPath(opts) {
-  var _a, _b, _c;
-  const {
-    cfg,
-    tool,
-    override,
-    promptImpl = _prompts2.default,
-    saveImpl = _chunkOGAE7BVQjs.saveConfig,
-    writeImpl = (s) => void process.stderr.write(s),
-    env = process.env
-  } = opts;
-  const isTTY = (_a = opts.isTTY) != null ? _a : Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
-  if (override) {
-    return { mode: override, prompted: false };
-  }
-  const pinned = (_b = cfg.tool_mode) == null ? void 0 : _b[tool];
-  if (pinned === "gateway" || pinned === "ingestion") {
-    return { mode: pinned, prompted: false };
-  }
-  if (opts.refreshPolicies) {
-    try {
-      const fresh = await opts.refreshPolicies(cfg);
-      if (fresh) {
-        cfg.tool_policies = fresh;
-        try {
-          saveImpl(_chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, cfg), { tool_policies: fresh }));
-        } catch (e) {
-        }
-      }
-    } catch (e) {
-    }
-  }
-  const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
-  const allowGateway = policy.allowVk;
-  const allowOtlp = policy.allowOtelDirect;
-  if (allowGateway && !allowOtlp) {
-    return { mode: "gateway", prompted: false };
-  }
-  if (!allowGateway && allowOtlp) {
-    return { mode: "ingestion", prompted: false };
-  }
-  if (!allowGateway && !allowOtlp) {
-    return { mode: "gateway", prompted: false };
-  }
-  const canPrompt = isTTY && !isForcedAutoLogin(env);
-  if (!canPrompt) {
-    return { mode: "gateway", prompted: false };
-  }
-  const res = await promptImpl({
-    type: "select",
-    name: "path",
-    message: pathChoiceMessage(tool),
-    choices: [
-      {
-        title: gatewayChoiceTitle(),
-        value: "gateway"
-      },
-      {
-        title: otlpChoiceTitle(tool),
-        value: "ingestion"
-      }
-    ],
-    initial: 0
-  });
-  const chosen = tokenToMode(res == null ? void 0 : res.path);
-  if (!chosen) {
-    return { mode: "gateway", prompted: false };
-  }
-  const next = _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, cfg), {
-    tool_mode: _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, (_c = cfg.tool_mode) != null ? _c : {}), { [tool]: chosen })
-  });
-  try {
-    saveImpl(next);
-    cfg.tool_mode = next.tool_mode;
-  } catch (e) {
-  }
-  const label = chosen === "gateway" ? "gateway" : "otlp";
-  writeImpl(
-    `${lwTag()} saved. \`${tool}\` will use the ${label} path. Override with --tool-mode=${chosen === "gateway" ? "otlp" : "gateway"}, or edit ~/.langwatch/config.json (tool_mode.${tool}).
-`
-  );
-  return { mode: chosen, prompted: true };
-}
-
-// src/cli/utils/governance/wrapper.ts
-var CODEX_IO_POLL_MS = 2500;
-function envForTool(cfg, tool) {
-  var _a;
-  const gw = cfg.gateway_url.replace(/\/+$/, "");
-  const auth = (_a = cfg.default_personal_vk) == null ? void 0 : _a.secret;
-  if (!auth) return { vars: {} };
-  switch (tool) {
-    case "claude":
-      return {
-        vars: {
-          ANTHROPIC_BASE_URL: gw,
-          ANTHROPIC_AUTH_TOKEN: auth
-        },
-        clears: ["ANTHROPIC_API_KEY"]
-      };
-    case "codex":
-      return {
-        vars: {
-          OPENAI_BASE_URL: gw,
-          OPENAI_API_KEY: auth
-        }
-      };
-    case "cursor":
-      return {
-        vars: {
-          OPENAI_BASE_URL: gw,
-          OPENAI_API_KEY: auth,
-          ANTHROPIC_BASE_URL: gw,
-          ANTHROPIC_AUTH_TOKEN: auth
-        },
-        clears: ["ANTHROPIC_API_KEY"]
-      };
-    case "gemini":
-      return {
-        vars: {
-          GOOGLE_GEMINI_BASE_URL: gw,
-          GEMINI_API_KEY: auth,
-          GOOGLE_API_KEY: auth
-        }
-      };
-    case "opencode":
-      return {
-        vars: {
-          OPENAI_BASE_URL: `${gw}/v1`,
-          OPENAI_API_KEY: auth,
-          ANTHROPIC_BASE_URL: `${gw}/v1`,
-          ANTHROPIC_AUTH_TOKEN: auth,
-          ANTHROPIC_API_KEY: auth
-        }
-      };
-    default:
-      return { vars: {} };
-  }
-}
-var TOOL_PROVIDER_FAMILIES = {
-  claude: ["anthropic"],
-  codex: ["openai"],
-  cursor: ["anthropic", "openai"],
-  gemini: ["google", "gemini"],
-  opencode: ["anthropic", "openai"]
-};
-function shouldForgetGatewayPin(args) {
-  return args.pinnedMode === "gateway" && args.retryable !== true;
-}
-function renderContactFooter(adminEmail) {
-  if (adminEmail) {
-    return `Need help? Contact your LangWatch admin: ${adminEmail}
-`;
-  }
-  return `If you need help, contact your LangWatch admin.
-`;
-}
-async function preflightWrapper(cfg, tool, opts = {}) {
-  var _a, _b, _c, _d, _e, _f, _g;
-  const cp = cfg.control_plane_url.replace(/\/+$/, "");
-  const bootstrap = await ((_a = opts.bootstrapImpl) != null ? _a : (0, _chunkZA5BH7IZjs.getCliBootstrap))(cfg).catch(
-    () => null
-  );
-  const adminEmail = (_b = bootstrap == null ? void 0 : bootstrap.adminEmail) != null ? _b : null;
-  if (!((_c = cfg.default_personal_vk) == null ? void 0 : _c.secret)) {
-    return {
-      ok: false,
-      message: `No personal virtual key on this account.
-Your organization needs at least one AI provider configured before
-\`langwatch ${tool}\` can route requests.
-If you're an admin, set one up at
-  ${cp}/settings/model-providers
-then run \`langwatch login --device\` to refresh your credentials.
-` + renderContactFooter(adminEmail)
-    };
-  }
-  const gw = cfg.gateway_url.replace(/\/+$/, "");
-  const f = (_d = opts.fetchImpl) != null ? _d : fetch;
-  const timeoutMs = (_e = opts.timeoutMs) != null ? _e : 3e3;
-  try {
-    const res = await f(`${gw}/healthz`, {
-      method: "GET",
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!res.ok) {
-      return {
-        ok: false,
-        retryable: true,
-        message: `AI Gateway at ${gw} returned HTTP ${res.status}.
-The wrapper cannot route \`langwatch ${tool}\` requests until the
-data plane is healthy. Check that the LangWatch gateway is running.
-` + renderContactFooter(adminEmail)
-      };
-    }
-  } catch (err) {
-    return {
-      ok: false,
-      retryable: true,
-      message: `Cannot reach AI Gateway at ${gw}
-  ${err.message}
-Check that the LangWatch gateway is running, or set LANGWATCH_GATEWAY_URL
-if you've deployed it elsewhere.
-` + renderContactFooter(adminEmail)
-    };
-  }
-  if (Array.isArray(bootstrap == null ? void 0 : bootstrap.tools)) {
-    const published = bootstrap.tools.some((t) => t.slug === tool);
-    if (!published) {
-      return {
-        ok: false,
-        message: `The gateway isn't enabled for \`${tool}\` in your organization.
-An admin needs to publish a ${tool} coding-assistant tile in the
-AI Tools catalog (with the gateway path enabled):
-  ${cp}/settings/governance/tool-catalog
-` + renderContactFooter(adminEmail)
-      };
-    }
-  }
-  const need = TOOL_PROVIDER_FAMILIES[tool];
-  const configured = (_g = bootstrap == null ? void 0 : bootstrap.gatewayProviders) != null ? _g : (_f = bootstrap == null ? void 0 : bootstrap.providers) == null ? void 0 : _f.map((p) => p.name);
-  if (need && need.length > 0 && Array.isArray(configured)) {
-    const have = new Set(configured.map((n) => n.toLowerCase()));
-    const matches = need.filter((n) => have.has(n));
-    if (matches.length === 0) {
-      const list = need.map((n) => `\`${n}\``).join(" or ");
-      return {
-        ok: false,
-        message: `No ${list} provider credential is configured for your organization.
-\`langwatch ${tool}\` needs at least one enabled provider to route
-requests through the gateway. If you're an admin, add one at
-  ${cp}/settings/model-providers
-` + renderContactFooter(adminEmail)
-      };
-    }
-  }
-  return { ok: true };
-}
-function shouldAutoLogin() {
-  const flag = process.env.LANGWATCH_AUTO_LOGIN;
-  if (flag === "1" || flag === "true") return true;
-  if (flag === "0" || flag === "false") return false;
-  return Boolean(process.stdin.isTTY);
-}
-async function runWrapped(tool, args) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
-  let cfg = _chunkOGAE7BVQjs.loadConfig.call(void 0, );
-  if (!_chunkOGAE7BVQjs.isLoggedIn.call(void 0, cfg)) {
-    if (!shouldAutoLogin()) {
-      process.stderr.write(
-        "Not logged in. Run `langwatch login --device` first.\n"
-      );
-      process.exit(1);
-    }
-    process.stderr.write(
-      "Not logged in. Starting device-flow login...\n"
-    );
-    try {
-      cfg = await _chunk5M6GLAIGjs.runDeviceFlowLogin.call(void 0, { cfg });
-    } catch (err) {
-      process.stderr.write(
-        `login failed: ${(_a = err.message) != null ? _a : "unknown error"}
-`
-      );
-      process.exit(1);
-    }
-    if (!_chunkOGAE7BVQjs.isLoggedIn.call(void 0, cfg)) {
-      process.stderr.write("login did not complete - exiting\n");
-      process.exit(1);
-    }
-  }
-  const exceeded = await checkBudget(cfg);
-  if (exceeded) {
-    process.stderr.write(renderBudgetExceeded(exceeded));
-    if (exceeded.request_increase_url) {
-      cfg.last_request_increase_url = exceeded.request_increase_url;
-      try {
-        _chunkOGAE7BVQjs.saveConfig.call(void 0, cfg);
-      } catch (e) {
-      }
-    }
-    process.exit(2);
-  }
-  const { args: toolArgs, override: pathOverride } = parseToolModeFlag(args);
-  let pathChoice;
-  try {
-    pathChoice = await resolveWrapperPath({
-      cfg,
-      tool,
-      args: toolArgs,
-      override: pathOverride,
-      // Re-check the org policy at run time so a path the admin disabled
-      // after login is respected without a re-login. Best-effort: on any
-      // failure resolveWrapperPath keeps the login-cached policy map.
-      refreshPolicies: (c) => _chunkZA5BH7IZjs.getCliBootstrap.call(void 0, c).then((b) => {
-        var _a2;
-        return (_a2 = b == null ? void 0 : b.toolPolicies) != null ? _a2 : null;
-      })
-    });
-  } catch (err) {
-    process.stderr.write(`path selection failed: ${err.message}
-`);
-    process.exit(2);
-  }
-  const toolEnv = envForTool(cfg, tool);
-  const gatewayVars = toolEnv.vars;
-  const gatewayClears = (_b = toolEnv.clears) != null ? _b : [];
-  let modeResult;
-  try {
-    modeResult = await resolveWrapperMode(
-      cfg,
-      tool,
-      gatewayVars,
-      gatewayClears,
-      pathChoice.mode
-    );
-  } catch (err) {
-    const isToolDisabled = err instanceof _chunkZA5BH7IZjs.GovernanceCliError && err.code === "tool_disabled";
-    const policy = resolvePlatformToolPolicy(tool, cfg.tool_policies);
-    if (pathChoice.mode === "ingestion" && policy.allowVk && !isToolDisabled) {
-      process.stderr.write(
-        `${lwTag()} couldn't set up direct OTLP ingestion for ${tool} (${err.message}). Falling back to the gateway path.
-`
-      );
-      try {
-        modeResult = await resolveWrapperMode(
-          cfg,
-          tool,
-          gatewayVars,
-          gatewayClears,
-          "gateway"
-        );
-      } catch (err2) {
-        process.stderr.write(
-          `mode resolution failed: ${err2.message}
-`
-        );
-        process.exit(2);
-      }
-    } else {
-      process.stderr.write(
-        `mode resolution failed: ${err.message}
-`
-      );
-      process.exit(2);
-    }
-  }
-  if (modeResult.notice) {
-    process.stderr.write(`${modeResult.notice}
-`);
-  }
-  if (modeResult.mode === "gateway") {
-    const probe = await preflightWrapper(cfg, tool);
-    if (!probe.ok) {
-      process.stderr.write((_c = probe.message) != null ? _c : "preflight failed\n");
-      if (shouldForgetGatewayPin({
-        pinnedMode: (_d = cfg.tool_mode) == null ? void 0 : _d[tool],
-        retryable: probe.retryable
-      })) {
-        const toolMode = _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, cfg.tool_mode);
-        delete toolMode[tool];
-        cfg.tool_mode = toolMode;
-        try {
-          _chunkOGAE7BVQjs.saveConfig.call(void 0, cfg);
-          process.stderr.write(
-            `${lwTag()} cleared the saved gateway path for \`${tool}\`; you'll be asked again next time so you can pick direct OTLP.
-`
-          );
-        } catch (e) {
-        }
-      }
-      process.exit(2);
-    }
-    if (modeResult.codexConfigPath) {
-      process.stderr.write(
-        `${lwTag()} wired [model_providers.langwatch] in ${modeResult.codexConfigPath}.
-`
-      );
-    }
-    if (modeResult.codexProfilePath) {
-      process.stderr.write(
-        `${lwTag()} wrote profile body to ${modeResult.codexProfilePath}.
-`
-      );
-    }
-  } else {
-    if (modeResult.newKeyMinted) {
-      process.stderr.write(
-        `${lwTag()} minted a personal ingestion key for ${tool}.
-`
-      );
-    }
-    if (modeResult.codexConfigPath) {
-      process.stderr.write(
-        `${lwTag()} wrote [otel] activation block to ${modeResult.codexConfigPath}.
-`
-      );
-    }
-    await maybeOfferIngestionShellRcPersist({
-      cfg,
-      tool,
-      vars: modeResult.vars
-    });
-  }
-  const parentEnv = _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, process.env);
-  for (const key of (_e = modeResult.clears) != null ? _e : []) {
-    delete parentEnv[key];
-  }
-  const env = _chunkBRPEG3YQjs.__spreadValues.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, parentEnv), modeResult.vars);
-  const finalArgs = [...(_f = modeResult.extraArgs) != null ? _f : [], ...toolArgs];
-  const shellName = (_h = ((_g = process.env.SHELL) != null ? _g : "").split("/").pop()) != null ? _h : "";
-  const aliasShell = process.platform !== "win32" && (shellName === "zsh" || shellName === "bash") ? process.env.SHELL : null;
-  const notFoundMessage = `${tool} not found in PATH - install it first (https://docs.langwatch.ai/ai-gateway/governance/admin-setup#cli-device-flow-rest-api)`;
-  const sessionStartMs = Date.now();
-  const codexStreamer = tool === "codex" && modeResult.mode === "ingestion" && modeResult.endpoint && modeResult.ingestionToken ? createCodexIOStreamer({
-    sinceMs: sessionStartMs,
-    endpoint: `${modeResult.endpoint.replace(/\/+$/, "")}/v1/traces`,
-    token: modeResult.ingestionToken
-  }) : null;
-  let codexPoll = null;
-  if (codexStreamer) {
-    let inFlight = false;
-    codexPoll = setInterval(() => {
-      if (inFlight) return;
-      inFlight = true;
-      void codexStreamer.harvest(Date.now()).catch(() => 0).finally(() => {
-        inFlight = false;
-      });
-    }, CODEX_IO_POLL_MS);
-    (_i = codexPoll.unref) == null ? void 0 : _i.call(codexPoll);
-  }
-  let child;
-  if (aliasShell) {
-    const q = (s) => `'${s.replace(/'/g, "'\\''")}'`;
-    const reapply = [
-      ...((_j = modeResult.clears) != null ? _j : []).map((k) => `unset ${k}`),
-      ...Object.entries(modeResult.vars).map(([k, v]) => `export ${k}=${q(v)}`)
-    ].join("; ");
-    const guard = `command -v -- ${q(tool)} >/dev/null 2>&1 || { printf '%s\\n' ${q(notFoundMessage)} >&2; exit 127; }`;
-    const command = `${reapply ? `${reapply}; ` : ""}${guard}; ${tool} "$@"`;
-    child = _child_process.spawn.call(void 0, aliasShell, ["-i", "-c", command, tool, ...finalArgs], {
-      stdio: "inherit",
-      env
-    });
-  } else {
-    child = _child_process.spawn.call(void 0, tool, finalArgs, {
-      stdio: "inherit",
-      env,
-      shell: process.platform === "win32"
-    });
-  }
-  child.on("error", (err) => {
-    if (err.code === "ENOENT") {
-      process.stderr.write(`${notFoundMessage}
-`);
-      process.exit(127);
-    }
-    process.stderr.write(`exec ${tool}: ${err.message}
-`);
-    process.exit(1);
-  });
-  const exitCode = await new Promise((resolve) => {
-    child.on("close", (code) => resolve(code != null ? code : 1));
-  });
-  if (codexPoll) clearInterval(codexPoll);
-  if (codexStreamer) {
-    try {
-      await codexStreamer.harvest(Date.now());
-    } catch (e) {
-    }
-  }
-  process.exit(exitCode);
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-exports.appSettingsTargetFor = appSettingsTargetFor; exports.appEnvHasAnyVar = appEnvHasAnyVar; exports.removeAppEnvVars = removeAppEnvVars; exports.GATEWAY_RC_MARKERS = GATEWAY_RC_MARKERS; exports.toolMarkers = toolMarkers; exports.rcPath = rcPath; exports.rcHasLangwatchBlock = rcHasLangwatchBlock; exports.removeBlockFromRc = removeBlockFromRc; exports.telemetryEnvVarNames = telemetryEnvVarNames; exports.envForTool = envForTool; exports.runWrapped = runWrapped;
-//# sourceMappingURL=chunk-D2VRKNFF.js.map