[ffantl-ld]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

• Supersedes Install LD MCP in existing aws devops agent space #853. Its two commits are in this branch, rebased onto main, with @Andrewjeska as author.

Describe the solution you've provided

• Setup asks which existing agent space to connect LaunchDarkly to (from Install LD MCP in existing aws devops agent space #853). --agent-space-id and --new-agent-space are mutually exclusive.
• Setup decides by who made the space. It finds its own spaces by the description Managed by the LaunchDarkly CLI, and the list marks them made by ldcli. A space that setup made gets the full setup. Another space only gets the MCP server, unless you pass --auth-flow.
• --agent-space-name has no default. With a name, Enter at the list picks the space with that name, or a new space with that name. Without a name, the list has no default, and a new space makes setup ask for a name. Setup does not create a space with a name that a space already uses.
• An unattended run with --agent-space-name X uses X, or creates X if no space has that name. Without a name, it reuses the one space that setup made, or stops.
• Setup prints a plan before the first AWS write: account, region, profile, IAM roles, agent space, operator app, and MCP server. In a terminal it asks Continue? [y/N]. --yes skips every question.
• The plan, the space list, the prompts, and the progress go to stderr. Stdout has only the result, so a json run shows the plan and keeps valid JSON.
• A connect run reads the operator app. If the app is off, setup does not print its URL, and the result has "operatorAppEnabled": false. This needs aidevops:GetOperatorApp.
• Progress lines and status show names and plain states, not ARNs and raw IDs.
• The credential error is short, with at most 5 profile names. Only SSO profiles get the aws sso login advice. Other profiles get the SDK cause, but not the cause from the EC2 metadata service.
• Setup and status offer to run aws sso login when the SSO session of a profile expired.
• 15 supported regions, up from 11 (us-east-2, ap-northeast-2, eu-west-3, eu-north-1 were missing).
• The token check sends LD-API-Version: 20240415.

Behavior change from main: --agent-space-id on a space that setup did not make now only connects the MCP server. On main, it ran the full setup. No release has the command yet.

Describe alternatives you've considered

Commit 3654d6e1 (service token creation) is not included on purpose.

A tag on new agent spaces would be a stronger ownership marker than the description. Setup does not use one, because it must call ListTagsForResource once for each space to read tags.

Additional context

Testing: go test ./... and golangci-lint pass. I ran setup against a sandbox AWS account. These cases worked: a new space with a typed name, a new space next to existing spaces, and a second EnableOperatorApp call (IAM to IAM) on a space whose app is on.

Not tested against real AWS:

• A change of sign-in method on an app that is on, for example IAM to IdC.
• Role creation in an account without DevOpsAgentRole-AgentSpace and DevOpsAgentRole-WebappAdmin.

@Andrewjeska, can you review the space selection parts? They carry the #853 behavior, with the changes above.

🤖 Generated with Claude Code

---

Note

Overview
ldcli aws-devops-agent setup is reworked for existing AWS accounts: it can list agent spaces, let you pick one (or provision another via --agent-space-id / --new-agent-space), and choose full provisioning only for spaces managed by ldcli (or when --auth-flow is set); other spaces get MCP connect-only. A setup plan prints to stderr before any AWS write, with Continue? [y/N] in interactive mode; --yes and non-TTY/json runs skip prompts. Progress and prompts go to stderr so --output json keeps parseable stdout; missing tokens fail early in non-interactive runs unless an MCP server already exists. Results can report operatorAppEnabled: false when the operator app is off (uses GetOperatorApp).

status and setup share loadClients, which can offer aws sso login for expired SSO profiles. Credential errors are shorter and SSO-aware; four regions are added to the supported list. Token validation sends LD-API-Version: 20240415. Human status output uses plain labels instead of ARNs. README documents the new flows. Extensive tests cover planning, confirmation, space selection, and plan-drift (ErrPlanChanged).

^{Reviewed by Cursor Bugbot for commit 807c8f7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

First review pass at 9d85a32. The build and go test pass. I ran the binary in a real terminal against a local mock of the DevOps Agent, STS, and IAM APIs (AWS_ENDPOINT_URL and fake keys). Nobody has run it against real AWS yet.

Main issues

1. No plan and no prompt when stdout is not a terminal. ldcli sets --output to json when stdout is not a TTY (cmd/root.go:353). So in CI, or with ldcli aws-devops-agent setup | tee log, setup shows no plan, no picker, and no progress, and it changes AWS at once. The README says "Without a terminal, setup shows the plan". That is true only with --output plaintext. Fix the README, or base interactive on stdin/stderr and not on the output kind.
2. Enter at the picker picks the first space that AWS returns (setup.go:285). In my run, that was another team's prod-ops space. I suggest a default of the space that matches --agent-space-name, and no default when no space matches:

   defaultChoice := 0
   for i, space := range spaces {
       if strings.EqualFold(space.Name, agentSpaceName) {
           defaultChoice = i + 1
       }
   }
   // prompt "[N]" only when defaultChoice > 0; when it is 0, an empty answer asks again

3. The launchdarkly space gets different treatment in each mode. If you pick it in the picker, setup only connects the MCP server ("IAM role: No change", "Operator app: No change"). A non-interactive run finds the same space by name (setup.go:189) and does the full provisioning on it. These two paths must agree.

Smaller issues

• If a launchdarkly space exists, "provision a new agent space" still plans "Create agent space launchdarkly". Then two spaces have the same name.
• The credential error always says "Run aws sso login", and the cause is no longer shown. For a credential_process profile, this is the wrong advice. Also, the InvalidIdentityToken error still goes to stderr. Use HasSSOConfig to give the SSO advice only to SSO profiles, and show the cause for other profiles.
• Each prompt makes a new bufio.NewReader on stdin (setup.go:241, :276, readLine). The shared reader at :119 skips *os.File, which is the real terminal case. It works now because a TTY gives one line for each read. Typed-ahead answers still worked in my test.
• The plan and prompts go to stdout, and the progress goes to stderr.

Works as expected: the plan output, the [y/N] cancel path, the retry after an invalid picker answer, --yes, the mutually exclusive --agent-space-id/--new-agent-space, the new regions, the shortened profile list, the expired-SSO prompt, and the new status layout.

Written by Devin

[cchu-ld]

Taking over this PR -- these commits (235ba77..e5a2342) fix the issues from the earlier review.

• 76ffd7f: The plan, the space list, and all prompts go to stderr. Stdout has only the result. A json run now shows the plan, and stdout stays valid JSON.
• b4764a5: Setup decides by who made the space. It finds its own spaces by the description Managed by the LaunchDarkly CLI. A space that setup made gets the full setup. Another space gets only the MCP server, unless you pass --auth-flow.
• 909818a: A connect run reads the operator app. If the app is off, setup does not print a URL that does not work. The connect path now needs aidevops:GetOperatorApp.
• 88c8cf6: Only SSO profiles get the aws sso login advice. Other profiles get the SDK cause, but not the IMDS cause.
• 84a1575: Setup does not create a second space with a name that a space already uses.
• 03eab02: Setup and ConnectExisting moved to export_test.go. This commit deletes FindAgentSpace and authFlagSet.
• d6f1267: --agent-space-name has no default. In a terminal, setup asks for the name of a new space. With a name, Enter picks the space with that name, or a new space with that name.
• 560e245: A kept operator app always gets a URL.
• 2b672e3: An unattended run with --agent-space-name X uses X, or creates X if no space has that name. Thus one command works on every CI run.
• e5a2342: The result has operatorAppEnabled.

Behavior change from main: --agent-space-id on a space that setup did not make now only connects the MCP server. No release has the command yet.

Testing: go test ./... and golangci-lint pass. I ran setup against a sandbox account. A new space with a typed name worked. A second EnableOperatorApp call (IAM to IAM) worked.

Not tested against real AWS:

• A change of sign-in method on an app that is on, for example IAM to IdC.
• Role creation in an account without DevOpsAgentRole-AgentSpace and DevOpsAgentRole-WebappAdmin.

/this is a robot

[cchu-ld]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e5a2342. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e5a2342. Configure here.}