feat(setup): read the setup agent config through the gonfalon relay

[atornsii]

This draft adds the Go AI SDK (github.com/launchdarkly/go-ai-sdk) to the CLI. The setup agent reads its instructions and model from the ldcli-setup-agent AI Config, through the SDK relay in gonfalon (launchdarkly/gonfalon#75196 to #75199). No SDK key is on the user's machine.

This PR is stacked on #876, and it also contains the commit of #877, because the SDK needs Go 1.26. Review the last two commits. After #877 merges and #876 picks up main, the upgrade commit leaves this diff.

How it works

1. When the user is logged in, setup starts a loopback proxy on 127.0.0.1 with a random path. The random path is the per-run secret, so OpenCode or another process cannot use the proxy.
2. The CLI points all four SDK addresses at the proxy, and it gives the SDK the key ldcli-placeholder.
3. The proxy adds the user's access token in LD-CLI-Token and forwards each request to <base-uri>/internal/ldcli-setup-agent/sdk/{polling,stream,events,otel}/.... The relay checks the token, adds the real catfood key, and forwards to catfood.
4. The SDK evaluates the config locally with aiserver.InspectConfig. The CLI turns the variation into the OpenCode model and instructions.

The proxy also solves a gap in the SDK: its trace exporter cannot add a custom header, so without the proxy the trace requests would reach the relay without the token.

If the user is not logged in, if the relay refuses or cannot be reached, or if the config is off or missing, the CLI uses the built-in instructions from #876. Setup does not fail because the config is unavailable.

The config decides the task

When the config loads, its instructions are the agent's system prompt. The first user message gives only the facts from setup (BuildFacts): the SDK, the language, the framework, the package manager, the entry point, whether the SDK is installed, the flag key, and the credential variable. The CLI adds no task of its own, so the instructions decide what the agent does. If the config cannot load or has no instructions, the built-in instructions and the CLI's own task message (BuildPrompt) apply.

Details

• Every SDK connection option is set in code. The SDK fills an empty option from an environment variable such as LD_BASE_URI, LD_SDK_KEY, or OTEL_EXPORTER_OTLP_ENDPOINT, and the CLI uses LD_BASE_URI for its own API address.
• The CLI sets LD_ENVIRONMENT_ID for its own process to the client-side ID that the relay sends in the LD-Setup-Agent-Environment-ID response header. If the relay sends no ID, the CLI clears the variable, so a value in the user's shell does not reach the SDK. OpenCode does not get it, because the CLI removes LD_ variables from OpenCode's environment. The relay does not send this header yet. It needs a clientSideId setting in [ldcliSetupAgent]. Until then, the config loads, but runs do not link to the config's Monitoring tab.
• The CLI makes one polling request through the proxy before the SDK starts. The Go server SDK v7.19.1 treats a 403 on the stream as temporary and retries until its 5-second start timeout ends, so a refusal (for example, the kill switch is off) would otherwise delay every setup run. The check returns the relay's code, for example ldcli_setup_agent_disabled, and it reads the environment ID header.
• The CLI creates the SDK's LaunchDarkly client with logging off and diagnostic events off, and passes it with InitWithClient. The SDK's own client logs to the terminal, which breaks the wizard's full-screen view.
• The evaluation context has the kind ldcli-setup, a random key, and these attributes: sdkId, language, framework, packageManager, hasEntryPoint, and sdkInstalled. It has no file paths and no project names.
• go-ai-sdk is pinned to commit 6152dc9 (v0.0.0-20261016194641-6152dc96d702), because the SDK has no release yet.

Test locally against a local gonfalon

1. Run the gonfalon stack with sdkKey set under [ldcliSetupAgent] in gonfalon.override.conf.
2. Turn on enable-ldcli-setup-agent-service in the local flag server: ldcli dev-server add-override --project default --flag enable-ldcli-setup-agent-service --data true.
3. Turn on "Enable generative AI use cases" for the local account.
4. ldcli login --base-uri <local gonfalon URL>, so the CLI has a member token.
5. Run ldcli setup or ldcli setup agent with that base URI.

Cost

• The binary grows from about 70 MB to 80 MB, because of OpenTelemetry, gRPC, and protobuf.
• No model provider SDKs and no LangChain packages are in the build.
• The SDK makes breaking changes before 0.1.0.

Not in this PR

• Run telemetry (spans, token usage, the outcome metric). It needs a Go OpenCode handler in go-ai-sdk.
• Managed inference. OpenCode still uses the model key that the user configured for it.
• A message in the wizard that says why setup used the built-in instructions.

Testing

• TestAIConfigSource_RealSDKThroughTheProxy starts the real AI SDK through the proxy against a fake relay. The SDK sent only GET .../sdk/stream/all and POST .../sdk/events/bulk, both with the placeholder key and the token, and it read the config.
• Tests for the proxy: the token header and the path mapping, a 404 without the secret path, streaming without buffering, and an invalid base URI.
• Tests for a relay refusal and an unreachable relay: both fall back in less than one second.
• Tests for the options, the context attributes, the provider mapping, the fallbacks, and LD_ENVIRONMENT_ID.
• go test ./... and pre-commit run --all-files pass.
• Not tested: a real gonfalon relay and a real catfood config.

🤖 Generated with Claude Code