Add feature-flagged BYOC setup

[matthewlouisbrockman]

Summary

• add a setup-only BYOC page for selecting a Google Cloud project and allowed region
• render Terraform and gcloud setup templates supplied by a team-targeted LaunchDarkly payload
• use the same byoc_setup payload to gate the page and supply the E2B principal, allowed regions, and templates
• keep non-targeted teams out of both the sidebar and the direct route
• keep provider-specific bootstrap contents out of the public dashboard source

Scope

This intentionally stops after rendering the setup instructions. It does not add deployment orchestration, Terraform execution, status polling, or cluster registration.

The dashboard only substitutes the validated PROJECT_ID, REGION, and E2B_PRINCIPAL placeholders into flag-provided templates.

Validation

• bun run test:unit (512 tests)
• bun run next typegen && bunx tsc --noEmit
• bun run knip:ci
• bunx react-doctor --verbose --scope changed --base origin/main --blocking warning --no-score --no-telemetry
• bun run build
• rendered Terraform passes terraform fmt -check
• rendered gcloud script passes bash -n
• desktop and mobile browser smoke of project validation, region selection, and live template updates

[cursor]

PR Summary

Medium Risk
BYOC access and IAM onboarding content are driven by a new payload flag and impersonation templates; misconfiguration or exposing large templates client-side affects who can reach cloud setup flows.

Overview
Replaces the byocEnabled boolean with a team-targeted byocSetup payload (byoc_setup) that gates the BYOC route and sidebar when enabled is true. The BYOC page now renders ByocSetup, which collects GCP project ID and region and fills flag-supplied Terraform and gcloud templates via placeholder substitution. Sidebar visibility uses client hasPayload('byocSetup') instead of a boolean flag.

LaunchDarkly must ship byoc_setup for teams that had byoc_enabled; until then BYOC stays hidden. The full payload, including templates up to 50k characters each, is sent to the browser through evaluateAll for client gating even though only enabled is needed for the nav. The project ID helper text refers only to the Terraform preview while the gcloud tab uses the same input.

^{Reviewed by Cursor Bugbot for commit 32a6982. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web-foxtrot	Ready	Preview, Comment	Jul 17, 2026 2:00am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5a0a38601a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

This PR introduces a new BYOC setup feature (GCP project/region selection, generated Terraform for IAM/impersonation setup) plus a feature-flag payload refactor — no bugs were found, but the scope and IAM role list are worth a human's eyes before merging.

I reviewed the feature-flag payload plumbing (byocSetup discriminated union, page gating, sidebar visibility via hasPayload), the generated Terraform (fixed role list, principal/region/project interpolation, injection safety via the regex-validated inputs), and the new UI component. Also checked the flagged-but-ruled-out memoization concerns in the sidebar hook and feature-flag context provider — those are performance-only, not correctness issues.

Extended reasoning...

Overview

The PR adds a setup-only BYOC page (byoc-setup.tsx), a Terraform generator (terraform.ts) that provisions a GCP service account with a fixed list of project IAM roles and grants an E2B principal impersonation access, and replaces the boolean byocEnabled flag with a team-targeted byocSetup JSON payload flag threaded through the feature-flag server/client modules and the sidebar visibility logic. It also includes a refactor of getPayload typing in feature-flags.server.ts.

Security risks

No app-side auth/authz bypass — access gating (page 404 + sidebar visibility) is driven by the LaunchDarkly-controlled payload, and both project ID and region inputs used in the generated Terraform are regex-validated (alphanumeric/hyphen only), so there's no injection risk into the generated HCL. The actual IAM role list (BYOC_DEPLOYER_ROLES) and impersonation grant only take effect if and when the customer runs terraform apply themselves — this repo doesn't execute or apply the Terraform — but an incorrect role or principal in that list would still be a real-world cloud-permissions mistake for any customer who applies it, so it deserves a careful look.

Level of scrutiny

This is a net-new customer-facing feature (not a mechanical or config-only change), touching a fixed set of GCP IAM roles and impersonation wiring, plus a type-level refactor of the feature-flag payload path shared by other flags (developmentConnections). That combination — new feature scope + a shared infra refactor + IAM content a human should sanity-check — puts this above the bar for compact/mechanical changes, so it should get a human look even though no bugs were found.

Other factors

Tests are solid and cover the new page gating, Terraform content, and sidebar payload-based visibility. The bug hunting system's finder agents raised sidebar-hook and context-provider memoization concerns and verifiers ruled them out as performance-only; I did not find anything to add beyond that.