[sxlijin]

Packed wrapper recordings currently identify the embedded runtime but do not label wrapper operations with the wrapper release. Bake WRAPPER_APP_VERSION from the existing wrapper --version override/default and WRAPPER_BAML_VERSION from the explicit build compiler's baml-cli --version; retain wrapper_version() for PostHog and version display. Version discovery runs once during the build and never executes the target host.

Attach baml.ctx.app_version and baml.ctx.baml_version through ordinary trace.context(...).empty_span() at wrapper_entry, enclosing setup, dispatch, helpers, and error handling. Descendant spans inherit the tags while caller identity, other metadata, command context, capture choices, opt-outs, and exit behavior remain intact. The host-created user.main and process launch context retain their original metadata; the README documents the actual span query scope and ordinary override semantics.

Validation:

• Three wrapper build-generation tests cover independent compiler versions, wrapper override/default behavior, invalid compiler output, and a non-executable foreign target host.
• Packed local recording tests pass for help, a parsing error, the telemetry helper, default/overridden wrapper versions, and delegated CLI versions 0.1.0 and 99.0.0; both retain baked compiler/runtime 0.25.2.
• Queries verify descendant inheritance, caller identity/metadata preservation, entry versus host-main/process scope, and no value capture on the new entry span. PostHog is disabled; recording-off produces no recording. All fixtures use isolated homes and local-only sinks, with no uploads or release downloads.
• Prek hooks, BAML formatting, and Markdown validation pass. The shared CI-profile suite passes both packed variants: 80 enabled and 76 disabled, 156 total. A temporary wrapper-only merge with latest Record wrapper command context and errors without input snapshots #5621 also packs and passes the version recording checks. The shared native wrapper runner includes the new tests.

This focused PR changes wrapper source/build/docs and wrapper-specific tests. The existing scripts/tests/test_baml_pack_wrapper_release.py compiler double now answers exactly --version, retaining all pack/archive/host/telemetry assertions and checking separate generated wrapper/compiler versions across every target and variant; all five release-fixture tests pass locally. It is independent of #5621 and preserves its reduced capture policy when combined; no runtime, artifact format, BCS, SDK, production packaging script, or release-workflow changes are included.

Exact-head CI/review: all checks are settled (60 pass, zero failures or pending checks); standard CI and Kiln shadow workflows succeed, including the new tests and 312 shared wrapper tests across all four candidates. CodeRabbit approved 32a5b3b6e0145d684bd7d87be81c286094418208 with no review comments or unresolved threads. GitHub reports this PR as clean and mergeable.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
developer-docs	Canceled		Nov 13, 2026 12:27am UTC

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The wrapper build now embeds separate app and compiler version constants. The wrapper entry point adds these values to trace context. New tests cover version generation, runtime metadata, delegated CLI behavior, and recording outcomes.

Changes: Wrapper version metadata

Layer / File(s)	Summary
Discover and generate version constants baml_language/wrapper/README.md, baml_language/wrapper/build, baml_language/wrapper/baml_src/build.baml, baml_language/wrapper_tests/test_build_versions.py, baml_language/wrapper_tests/run, scripts/tests/test_baml_pack_wrapper_release.py	The build accepts an optional wrapper version and reads the selected CLI’s version with telemetry disabled. It rejects unrecognized output and generates separate app and BAML version constants. Unit and release-packing tests check generated values and invalid output.
Attach versions to wrapper traces baml_language/wrapper/baml_src/entry.baml, baml_language/wrapper/README.md, baml_language/wrapper_tests/verify_version_tags.py, baml_language/wrapper_tests/run, baml_language/wrapper_tests/README.md	main invokes wrapper_entry within a span carrying both version values. The integration test checks span metadata, process metadata, caller context, delegated CLI arguments, and recording behavior across wrapper scenarios.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Main as main
  participant TraceContext as trace context
  participant Entry as wrapper_entry
  participant Descendants as descendant spans
  Main->>TraceContext: Create empty span with app and BAML version metadata
  TraceContext->>Entry: Invoke wrapper_entry in the span
  Entry->>Descendants: Run wrapper logic within the trace context

Loading

Possibly related PRs

• BoundaryML/baml#5422: Introduces the wrapper files and entry path changed here.
• BoundaryML/baml#5483: Changes the wrapper release-packing path and test contract used by this change.

Suggested reviewers: hellovai, aaronvg

Merge Risk: Minimal · up to 32a5b

This change adds wrapper and compiler version tags to wrapper trace spans, and the evidence shows no concrete merge-blocking risk. Normal checks apply before merge.

Security architecture risk: Minimal · up to 32a5b

The change adds build-time version labels without expanding executable authority or recording function values on the new span. The labels remain ordinary, overridable metadata rather than authenticated identity. No material security risk was found introduced or worsened by this PR.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The introduced exposure is version labeling within the existing wrapper recording scope and an additional build-time invocation of an already trusted compiler. The inspected changes do not introduce another ingestion destination, credential authority or attacker-reachable production endpoint.

Trust Boundaries and Controls

• observed — Version strings are constrained before source generation, and compiler execution uses an argument list rather than shell interpolation. Runtime attachment patches metadata only. These labels are diagnostic data and must not be interpreted as authenticated caller identity or runtime attestation.

Resilience and Maintainability Implications

• observed — Context patches copy primitive metadata into owned values and compose into new options. Applying a patch creates an immutable context version rather than mutating its parent. Spawn snapshots the current context and passes it to the engine, so the new version patch does not introduce shared mutable metadata requiring rollback or cleanup.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "Bake wrapper build versions into root operational span metadata" matches the main change. The PR adds WRAPPER_APP_VERSION and WRAPPER_BAML_VERSION constants at build time and attaches baml.…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

Full details: Title check

Explanation

The title "Bake wrapper build versions into root operational span metadata" matches the main change. The PR adds WRAPPER_APP_VERSION and WRAPPER_BAML_VERSION constants at build time and attaches baml.ctx.app_version and baml.ctx.baml_version to the wrapper_entry span through a new empty_span() call in entry.baml. The objectives describe the same goal, and the changed files (build.baml, entry.baml, build script, tests, README) all support it.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the versions in the build,
Two constants settle, neatly sealed.
The entry span carries tags along,
Through delegated calls and recorded song.
Then hops away, content with the trail.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f3d8c284-be60-4f72-abdd-5c12a8efc00b

Commits

Reviewing files that changed from the base of the PR and between d97c1eb and 32a5b3b.

Files selected for processing: 1

• scripts/tests/test_baml_pack_wrapper_release.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 1 remain after this review.