feat: Implement TUI for identity (#1886)

* feat: implement TUI for identity

* chore: use ResourceDetail screen and display failure reason in details

Author: nborges-aws

README.md

@@ -9,8 +9,8 @@ It gives you two ways to work, from the same binary:
 - **A scriptable CLI** — every operation is a flag-driven subcommand that emits
   JSON (`--json`), so it can be used by codeing agents and can drop cleanly into
   scripts, CI, and automation.
-- **An interactive TUI** — bare Harness, Runtime, and Memory branches and leaves open
-  their corresponding menus and selection flows.
+- **An interactive TUI** — bare Harness, Runtime, Memory, and Identity branches
+  and leaves open their corresponding menus and selection flows.
 
 ```bash
 agentcore                      # launch the interactive TUI
@@ -26,8 +26,8 @@ responses. `agentcore` wraps all of that behind one ergonomic tool.
 
 ## Command surface
 
-Commands with operation flags run headlessly. Bare Harness, Runtime, and Memory branches
-and leaves open their interactive flows.
+Commands with operation flags run headlessly. Bare Harness, Runtime, Memory, and
+Identity branches and leaves open their interactive flows.
 
 ```
 agentcore                          # interactive TUI
@@ -49,12 +49,18 @@ agentcore                          # interactive TUI
 │       ├── update
 │       └── delete
 ├── identity                       # manage AgentCore Identity resources
-│   └── api-key-credential-provider
-│       ├── create                 # create an API key credential provider
-│       ├── get                    # get an API key credential provider
-│       ├── list                   # list API key credential providers
-│       ├── update                 # update an API key credential provider
-│       └── delete                 # delete an API key credential provider
+│   ├── api-key-credential-provider
+│   │   ├── create                 # create an API key credential provider
+│   │   ├── get                    # get an API key credential provider
+│   │   ├── list                   # list API key credential providers
+│   │   ├── update                 # update an API key credential provider
+│   │   └── delete                 # delete an API key credential provider
+│   └── oauth2-credential-provider
+│       ├── create                 # create an OAuth2 credential provider
+│       ├── get                    # get an OAuth2 credential provider
+│       ├── list                   # list OAuth2 credential providers
+│       ├── update                 # update an OAuth2 credential provider
+│       └── delete                 # delete an OAuth2 credential provider
 ├── runtime                        # inspect deployed AgentCore Runtimes
 │   ├── get                        # fetch a Runtime by id
 │   ├── list                       # list Runtimes (server-side paginated)
@@ -162,6 +168,17 @@ agentcore identity api-key-credential-provider list --max-results 10
 agentcore identity api-key-credential-provider update --name my-provider --api-key <new-key>
 agentcore identity api-key-credential-provider delete --name my-provider
 
+# Manage OAuth2 credential providers (guided Custom OAuth2, or --provider-configuration for other vendors)
+agentcore identity oauth2-credential-provider create \
+  --name my-oauth-provider \
+  --vendor CustomOauth2 \
+  --client-id <client-id> \
+  --discovery-url https://issuer.example.com/.well-known/openid-configuration \
+  --client-secret -
+agentcore identity oauth2-credential-provider get --name my-oauth-provider
+agentcore identity oauth2-credential-provider list --max-results 10
+agentcore identity oauth2-credential-provider delete --name my-oauth-provider
+
 # Manage evaluators
 # Create an LLM-as-a-Judge evaluator with a rating-scale preset.
 agentcore eval evaluator llm-as-a-judge create \
@@ -311,6 +328,18 @@ agentcore memory event
 agentcore memory record
 ```
 
+The Identity TUI is read-only: bare `identity` branches and the `get`/`list`
+leaves open interactive menus and detail views. Mutations (`create`, `update`,
+`delete`) remain available through the CLI and are omitted from the TUI menus.
+
+```bash
+agentcore identity
+agentcore identity api-key-credential-provider list
+agentcore identity api-key-credential-provider get
+agentcore identity oauth2-credential-provider list
+agentcore identity oauth2-credential-provider get
+```
+
 ---
 
 # Architecture & patterns

src/components/PaginatedTablePicker.tsx

@@ -26,6 +26,7 @@ export interface PaginatedTablePickerProps<TItem, TRow extends Record<string, un
   errorMessage: (error: Error) => string;
   emptyMessage: string;
   emptyPageMessage: string;
+  maxPageSize?: number;
 }
 
 export function PaginatedTablePicker<TItem, TRow extends Record<string, unknown>>({
@@ -43,8 +44,9 @@ export function PaginatedTablePicker<TItem, TRow extends Record<string, unknown>
   errorMessage,
   emptyMessage,
   emptyPageMessage,
+  maxPageSize,
 }: PaginatedTablePickerProps<TItem, TRow>) {
-  const paging = usePagedList();
+  const paging = usePagedList(maxPageSize);
   const list = useQuery({
     queryKey: [...queryKey, paging.pageSize, paging.token],
     queryFn: () => loadPage(paging.token, paging.pageSize),

src/components/Root.tsx

@@ -48,6 +48,19 @@ import {
 import { MemoryEventScreen } from "../handlers/memory/event/screen.tsx";
 import { MemoryEventGetScreen } from "../handlers/memory/event/get/screen.tsx";
 import { MemoryEventListScreen } from "../handlers/memory/event/list/screen.tsx";
+import { IdentityScreen } from "../handlers/identity/screen.tsx";
+import { ApiKeyCredentialProviderScreen } from "../handlers/identity/api-key-credential-provider/screen.tsx";
+import { ApiKeyCredentialProviderListScreen } from "../handlers/identity/api-key-credential-provider/list/screen.tsx";
+import {
+  ApiKeyCredentialProviderGetScreen,
+  ApiKeyCredentialProviderGetJsonScreen,
+} from "../handlers/identity/api-key-credential-provider/get/screen.tsx";
+import { Oauth2CredentialProviderScreen } from "../handlers/identity/oauth2-credential-provider/screen.tsx";
+import { Oauth2CredentialProviderListScreen } from "../handlers/identity/oauth2-credential-provider/list/screen.tsx";
+import {
+  Oauth2CredentialProviderGetScreen,
+  Oauth2CredentialProviderGetJsonScreen,
+} from "../handlers/identity/oauth2-credential-provider/get/screen.tsx";
 import { RootScreen, HelpScreen } from "../handlers/screen.tsx";
 import type { Context } from "../router";
 
@@ -374,6 +387,48 @@ export function Root({ path, ctx, core, queryClient }: RootProps) {
             path="agentcore/memory/event/list/:memoryId/:actorId/:sessionId"
             element={<MemoryEventListScreen ctx={ctx} core={core} />}
           />
+          <Route path="agentcore/identity" element={<IdentityScreen ctx={ctx} core={core} />} />
+          <Route
+            path="agentcore/identity/api-key-credential-provider"
+            element={<ApiKeyCredentialProviderScreen ctx={ctx} core={core} />}
+          />
+          {/* Bare `get` (no name) has nothing to show — send the user to the list. */}
+          <Route
+            path="agentcore/identity/api-key-credential-provider/get"
+            element={<Navigate to="/agentcore/identity/api-key-credential-provider/list" replace />}
+          />
+          <Route
+            path="agentcore/identity/api-key-credential-provider/list"
+            element={<ApiKeyCredentialProviderListScreen ctx={ctx} core={core} />}
+          />
+          <Route
+            path="agentcore/identity/api-key-credential-provider/get/:name"
+            element={<ApiKeyCredentialProviderGetScreen ctx={ctx} core={core} />}
+          />
+          <Route
+            path="agentcore/identity/api-key-credential-provider/get/:name/json"
+            element={<ApiKeyCredentialProviderGetJsonScreen ctx={ctx} core={core} />}
+          />
+          <Route
+            path="agentcore/identity/oauth2-credential-provider"
+            element={<Oauth2CredentialProviderScreen ctx={ctx} core={core} />}
+          />
+          <Route
+            path="agentcore/identity/oauth2-credential-provider/get"
+            element={<Navigate to="/agentcore/identity/oauth2-credential-provider/list" replace />}
+          />
+          <Route
+            path="agentcore/identity/oauth2-credential-provider/list"
+            element={<Oauth2CredentialProviderListScreen ctx={ctx} core={core} />}
+          />
+          <Route
+            path="agentcore/identity/oauth2-credential-provider/get/:name"
+            element={<Oauth2CredentialProviderGetScreen ctx={ctx} core={core} />}
+          />
+          <Route
+            path="agentcore/identity/oauth2-credential-provider/get/:name/json"
+            element={<Oauth2CredentialProviderGetJsonScreen ctx={ctx} core={core} />}
+          />
           <Route path="*" element={<HelpScreen ctx={ctx} core={core} />} />
         </Routes>
       </MemoryRouter>

src/components/usePagedList.tsx

@@ -37,9 +37,13 @@ function initialPagination(pageSize: number): PaginationState {
 // usePagedList holds the server-side pagination state shared by the picker
 // tables: a terminal-height-derived page size and the trail of nextTokens
 // leading to the current page, so ←/h can walk back through cached pages.
-export function usePagedList(): PagedList {
+//
+// maxPageSize caps the terminal-derived page size for APIs that constrain
+// maxResults (e.g. identity list operation capped at 20)
+export function usePagedList(maxPageSize?: number): PagedList {
   const { rows } = useWindowSize();
-  const pageSize = Math.max(3, rows - CHROME_ROWS);
+  const fitsTerminal = Math.max(3, rows - CHROME_ROWS);
+  const pageSize = maxPageSize ? Math.min(fitsTerminal, maxPageSize) : fitsTerminal;
 
   const [state, setState] = useState<PaginationState>(() => initialPagination(pageSize));
   const pageSizeChanged = state.pageSize !== pageSize;