[atornsii]

This sends the setup agent's model calls to a LaunchDarkly Bedrock relay in gonfalon. LaunchDarkly pays for the calls, and no model key is on the user's machine. It is the seventh agent PR, on top of #899.

How it works

1. ldcli reads the ldcli-setup-agent config before it starts OpenCode, because OpenCode reads its configuration only once. The config must be on and must name a Bedrock model, such as Bedrock.anthropic.claude-sonnet-4-6. If it does not, setup stops with an error. It does not use the user's own OpenCode provider.
2. The OpenCode configuration turns on only amazon-bedrock, with region: us-east-1 and endpoint on the loopback proxy. It sets model and small_model to the config's model, because OpenCode's default small model is a global inference profile (global.anthropic.claude-haiku-5-5).
3. OpenCode gets AWS_BEARER_TOKEN_BEDROCK=ldcli-placeholder, which takes priority over every AWS credential. The user's own AWS_ variables do not reach OpenCode.
4. The proxy gives OpenCode a second secret path. That path accepts only POST /model/..., and it reaches only /internal/ldcli-setup-agent/bedrock on gonfalon. OpenCode cannot reach the SDK routes. The proxy removes the bearer placeholder and adds LD-CLI-Token.

OpenCode adds the US inference profile prefix itself, so the request is POST /model/us.anthropic.claude-sonnet-4-6/converse-stream. The gonfalon side, which checks the token and signs the call for Bedrock, is launchdarkly/gonfalon#75426.

Testing

• A test runs the real OpenCode 1.19.3, in the macOS sandbox, against a fake relay through the proxy. Every model call reaches /internal/ldcli-setup-agent/bedrock/model/us.anthropic.claude-sonnet-4-6/converse-stream with the token header and without the bearer placeholder. The test skips if OpenCode is not installed.
• Unit tests cover the OpenCode configuration, the proxy route and its refusals, the removal of AWS_ variables, and the refusal of a config that is off or that names another provider.
• A manual test with the user's real OpenCode login file showed that only amazon-bedrock is on.

Stack

This is the seventh agent PR. Merge it after #894 to #899, which come after #877 (Go 1.26).

🤖 Generated with Claude Code

---

Note

Overview
Routes logged-in setup agent model traffic through LaunchDarkly-managed Amazon Bedrock on gonfalon instead of the user’s OpenCode providers. Setup now requires an enabled ldcli-setup-agent AI Config with a Bedrock model before OpenCode starts; there is no fallback to the user’s own API keys or providers.

OpenCode config (openCodeConfig) optionally pins amazon-bedrock as the only provider, sets model/small_model, and points Bedrock at a loopback proxy endpoint with us-east-1. startServer can inject AWS_BEARER_TOKEN_BEDROCK (placeholder) and strips AWS_* from the child environment so OpenCode never uses local AWS credentials.

The relay proxy gains a second secret bedrockURL that forwards only validated POST /model/{id}/{op} requests to /internal/ldcli-setup-agent/bedrock, strips the placeholder Authorization bearer, and still attaches LD-CLI-Token. AIConfigSource.managedModel resolves the Bedrock model and proxy endpoint using the same runCtx as the AI SDK stream for consistent targeting.

Tests cover managed OpenCode JSON, proxy routing/refusals, env stripping, managed-model errors, and an optional real OpenCode sandbox test.

^{Reviewed by Cursor Bugbot for commit e3c6c40. Bugbot is set up for automated code reviews on this repo. Configure here.}