[thisisryanswift]

Adds launch-control, a 10-minute browser challenge built on LaunchDarkly AgentControl. A travel booker climbs four variations of one agent-mode config (prompt, then tools, then model) while it keeps running; each rung is one session target set by the package's switch_travel_agent MCP tool. Closes #43.

Pi (guide) ──switch_travel_agent──▶ LaunchDarkly targeting (this session's key only)
                                          │ streaming SDK, events off
page ──/api/chat──▶ page server ──inspectConfig──▶ model, instructions, tools
                         └─▶ Gemini (via vault) ─▶ fake inventory ─▶ itinerary.json
demo mode: the page server mounts a stand-in that serves ladder.json in LaunchDarkly's own formats

First checkpoint

Run on a LaunchDarkly trial account, not the free Developer plan the issue names:

Check	Result
Agent-mode config whose variations differ in model, instructions, and attached tools	Pass. The SDK delivers each variation's model, provider Gemini, and full tool schemas.
addTargets / removeTargets on PATCH …/ai-configs/{key}/targeting	Pass. Changes one context key only; another context stayed on the default. Removing an absent key is a no-op.
@launchdarkly/ai-server 1.0.x sees a change within about 2 s over streaming	Pass: 244–370 ms from sending the PATCH, across 6 switches. With sendEvents: false and diagnostics off, the SDK opened only GET stream.launchdarkly.com/all.

@launchdarkly/ai-server 1.0.0 is enough, and the older @launchdarkly/server-sdk-ai is not needed. Its initClient takes no events option, so the page server passes it a @launchdarkly/node-server-sdk client built with events off. Several targeting PATCHes in quick succession return 429, so the switch tool waits out rate limits.

Small model

The suggested request on each rung; "correct" means it booked NV310 + NV311 + Alfama Riverside Guesthouse, 4 nights, $818:

Rung	Model	Runs	Outcome
v3	gemini-3.1-flash-lite	5	3 correct, 2 stopped before booking
v3	gemini-3.5-flash-lite	5	5 correct (too good for v3)
v3	gemini-2.5-flash-lite	10	0 correct: 8 never booked, 2 booked $995 (over budget)
v1	gemini-2.5-flash-lite	3	Never booked; asked for details
v2	gemini-2.5-flash-lite	3	Never booked; asked for the origin or year. One empty answer
v4	gemini-3.8-flash	8	8 correct, 12–24 s per reply

v1–v3 use gemini-2.5-flash-lite; v4 uses gemini-3.8-flash.

Decide

• Credential names. boothstrap dev passes only *_API_KEY and *_AUTH_TOKEN variables, so the issue's LAUNCHDARKLY_SDK_KEY and LAUNCHDARKLY_API_TOKEN would never reach the package in dev. Recommend: LAUNCHDARKLY_SDK_API_KEY and LAUNCHDARKLY_API_AUTH_TOKEN (what this PR uses), because they work in dev and on stations alike.
• launchdarkly-api vault auth. LaunchDarkly's REST API answers 401 to Authorization: Bearer api-… and accepts only the bare token. Recommend: api-key with header Authorization, the same as launchdarkly-sdk, because bearer cannot work.
• Who reads the API token. setup and cleanup need it to reset and remove this session's target, besides the MCP tool. The page server never receives it. Recommend: accept this, because the reset and removal the issue asks for are API calls.
• v4 latency. gemini-3.8-flash takes 12–24 s per reply, long for a booth. Recommend: try a lower thinking setting in the v4 variation's model parameters as a follow-up, because it is a config change with no deploy, which is the lesson itself.
• Human steps (out of scope): create MLH's LaunchDarkly project, run provision.mjs there, fill launchdarkly.json, and add launchdarkly-sdk and launchdarkly-api to the event vault, as the package README describes. Recommend: do these before the first event that lists the challenge, because without them it runs in demo mode.

Ready gate

Step	Evidence
Tests and lint	npm test: 333 tests, 331 pass, 0 fail, 2 skipped. npm run verify: ok …/challenges/launch-control and the other four packages. npm run lint: 0 issues.	✓
Red run	The standalone-workspace test failed with "Launch Control is not set up in this workspace" before the PWD fallback. Making setup pass the API token to the page server turns the credential test red ("the page server received the API token").	✓
Sibling sweep	New package. server/workspace-file.mjs is copied from glitch-invaders, as packages cannot share code. Root README index lists the challenge.	✓
Docs and specs	Package README (demo and live modes, vault services, provisioning, standalone run); root README index row.	✓
Standalone run	Plain Pi with pi-mcp-adapter, demo mode: Pi guided all four rungs, switched only after a "yes", acknowledged each step from travel-desk-state.json, and reported debrief after the participant's explanation. cleanup left the workspace empty.	✓
Editorial pass	Reread against docs/style/; dropped a base-skill duplicate (Cmd+Tab) from the guide skill.	✓
Skipped tests	None in this package. The 2 skips are pre-existing, in other packages.	✓
Secrets, permissions	New vault services launchdarkly-sdk and launchdarkly-api (see Decide). Tests prove neither key nor the Gemini key appears in any page asset, response, workspace file, tool result, or hook output, and the page server's environment holds no API token.	✓

Also verified:

• boothstrap dev --verify --live, demo mode, headless Chromium: a script sent the trip on the page whenever a new rung went live. Telemetry shows meet-booker, add-prompt, add-tools, and add-model reported by the monitor, each after the booker had answered on that rung. debrief was missed, as nobody answers Pi in that mode.
• Live mode against a test LaunchDarkly project: v1 → v4 booked the $818 trip, the rollback to v1 worked, and cleanup left no targets, including when run twice.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.