[cchu-ld]

Summary
This PR runs the plan from #928. RunPlan does a full setup, and ConnectPlan only connects the MCP server. Before each write, setup makes sure that AWS still matches the plan, so a change that another person made in the meantime stops the run. The setup command now uses the plan in place of the old Setup function.

Human note: large PR but it's mostly tests - most logic are in setup.go

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

None.

Describe the solution you've provided

• Problem: AWS can change between the plan and the run, for example if another person creates a role at the same time.
  • Solution: RunPlan runs a full setup plan, and ConnectPlan runs a plan that only connects the MCP server. Before a step writes to AWS, a check makes sure that AWS still matches the plan. If AWS changed, the run stops with ErrPlanChanged. For the operator app, the check compares the sign-in method, not only on or off. The role and association steps can take minutes, so RunPlan checks the app again right before the app step.
• Problem: Setup checked the LaunchDarkly token only when it replaced an MCP server registration. A bad token failed after setup had changed other AWS resources.
  • Solution: The run checks the token before any AWS write. Tests replace CheckToken, so they never call the real API.
• Problem: A space that setup creates must carry the ownership tag.
  • Solution: RunPlan tags a new space with ldcli:managed=aws-devops-agent. AWS can also require aidevops:TagResource to tag a new space.
• Problem: If AWS sent no operator app URL, the result had an empty URL.
  • Solution: RunPlan builds the URL from the space ID. SetupResult also reports operatorAppEnabled.
• Problem: With --replace-mcp-token, a failed association on this space returned at once. The other spaces that lost the old server stayed disconnected, and the error did not name them. One failed reconnect also stopped the rest.
  • Solution: Setup reconnects every other space, even if this space or one of them fails. The error names each space that lost the server, and how to connect it again. If a disassociate, the deregister, or the new register fails part way, the error names the spaces that are already disconnected, and says to run setup with --agent-space-id <id> for each one. The new registration keeps the name of the replaced server, as the plan says.

The setup command now calls PlanSetup and RunPlan in place of Setup, and sets AuthFlowSet when you pass --auth-flow. connectMCPServer also passes the planned MCP step. A later PR replaces these five lines with the full command flow. Setup and ConnectExisting move to export_test.go, because only tests use them. FindAgentSpace is deleted.

Describe alternatives you've considered

None.

Additional context

Testing: go test ./... and golangci-lint pass on this branch.

🤖 Generated with Claude Code

---

Note

Overview
Replaces monolithic AWS DevOps Agent setup with a plan-then-apply flow: PlanSetup describes the run, RunPlan provisions IAM, agent space, associations, operator app, and MCP, and ConnectPlan only wires MCP on an existing space.

Before each write (and again after slow IAM steps), setup re-reads AWS and aborts with ErrPlanChanged if roles, spaces, associations, operator-app sign-in, or MCP state diverged from the plan. LaunchDarkly access tokens are validated before any AWS mutation; operator-app changes honor AuthFlowSet so sign-in is only changed when --auth-flow is passed.

New agent spaces get the ldcli:managed tag; results add operatorAppEnabled and synthesize an operator URL when AWS omits one. MCP token replace reconnects other agent spaces more safely and surfaces clearer errors. The setup CLI now calls PlanSetup + RunPlan; Setup/ConnectExisting move to test exports. Large runplan_test coverage exercises races and edge cases.

^{Reviewed by Cursor Bugbot for commit 2106a4c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7683a40. Configure here.}

[cchu-ld]

@Andrewjeska thanks! checkApp now has a comment on the sign-in check (2106a4c1). If someone else makes the planned change after the plan, for example IAM to IdC, the run still stops with "sign-in changed after the plan". EnableOperatorApp would work then, but a new plan is safe and finds that nothing is left to change.