feat: grant first setup agent gateway operator access

cmd/setup_agent.go

@@ -16,6 +16,7 @@ func setupAgentStep() {
 		return
 	}
 
+	grantGatewayOperatorAccess := false
 	if len(agents) > 0 {
 		fmt.Printf("  Found %d existing agent(s):\n", len(agents))
 		for _, a := range agents {
@@ -30,12 +31,31 @@ func setupAgentStep() {
 	} else {
 		fmt.Println("  No agents yet. Let's create your first one.")
 		fmt.Println()
+		grant, err := promptConfirm("Grant this first agent local gateway operator access via the goclaw CLI?", false)
+		if err != nil {
+			return
+		}
+		grantGatewayOperatorAccess = grant
+		if grantGatewayOperatorAccess {
+			fmt.Println("  The agent will get revocable SecureCLI access to run local gateway commands.")
+			fmt.Println()
+		}
 	}
 
-	createAgent()
+	createAgent(grantGatewayOperatorAccess)
 }
 
-func createAgent() {
+type setupAgentCreateResponse struct {
+	httpAgent
+	GatewayOperatorBootstrap *gatewayOperatorBootstrapResponse `json:"gateway_operator_bootstrap,omitempty"`
+}
+
+type gatewayOperatorBootstrapResponse struct {
+	Status  string `json:"status"`
+	Warning string `json:"warning,omitempty"`
+}
+
+func createAgent(grantGatewayOperatorAccess bool) {
 	agentKey, err := promptString("Agent key (slug)", "e.g. assistant, coder", "assistant")
 	if err != nil {
 		return
@@ -80,19 +100,43 @@ func createAgent() {
 		return
 	}
 
-	body := map[string]any{
-		"agent_key":    agentKey,
-		"display_name": displayName,
-		"agent_type":   agentType,
-		"provider":     findProviderType(providers, providerID),
-		"model":        model,
-	}
+	body := setupAgentCreatePayload(agentKey, displayName, agentType, findProviderType(providers, providerID), model, grantGatewayOperatorAccess)
 
-	_, err = gatewayHTTPPost("/v1/agents", body)
+	result, err := gatewayHTTPPostTyped[setupAgentCreateResponse]("/v1/agents", body)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "  Error: %v\n", err)
 		return
 	}
 
-	fmt.Printf("  Agent %q created (%s).\n\n", agentKey, model)
+	fmt.Printf("  Agent %q created (%s).\n", agentKey, model)
+	printGatewayOperatorBootstrapResult(result.GatewayOperatorBootstrap)
+	fmt.Println()
+}
+
+func setupAgentCreatePayload(agentKey, displayName, agentType, providerType, model string, grantGatewayOperatorAccess bool) map[string]any {
+	body := map[string]any{
+		"agent_key":    agentKey,
+		"display_name": displayName,
+		"agent_type":   agentType,
+		"provider":     providerType,
+		"model":        model,
+	}
+	if grantGatewayOperatorAccess {
+		body["grant_gateway_operator_access"] = true
+	}
+	return body
+}
+
+func printGatewayOperatorBootstrapResult(result *gatewayOperatorBootstrapResponse) {
+	if result == nil {
+		return
+	}
+	switch result.Status {
+	case "granted":
+		fmt.Println("  Gateway operator access granted. Try: goclaw agent list")
+	case "warning", "skipped":
+		if result.Warning != "" {
+			fmt.Printf("  Warning: %s\n", result.Warning)
+		}
+	}
 }