feat(agent-platform): identities, users + inline approvals in agent config UI

[benjackwhite]

Surfaces the per-principal identity + approvals work in the agent configuration UI. Backend / runtime side: PostHog/posthog#64997 (feat(agent-platform): per-principal identity, credentials + approvals authority).

What's here

Identities section in the config pane

• New identities node listing spec.identity_providers[] (kind · binding · consumer count).
• Each provider cross-links to the custom tools (requires_identity) and MCP servers (auth.provider) that use it; those tool/MCP detail bodies link back to the identity — easy two-way nav.
• Flags undeclared references (a tool/MCP points at an identity not in identity_providers) and unused providers.
• Notes that native @posthog/* tools declare their provider intrinsically in the registry, so they don't appear in the spec (otherwise their absence reads as a bug).

Users / connections pane (per agent)

• Lists the agent's end-users (agent_user) and each user's linked external identities (connection metadata only — credentials are never sent to the client). Revoke a connection inline; "ban user" stubbed for later.
• Sessions tab gains a by-user filter. Shared userDisplayName helper; the API client throws on non-2xx for the list + revoke calls (no false-success toasts).

Approval decisions (inline chat + console)

• Inline AgentChatPendingApprovalCard in the live chat / builder dock branches on approver_scope.type: principal approvals are decided right there (the person driving the chat is the session principal) — posting to the ingress via the chat session (preview token + the user's bearer → principal-match), and the open /listen stream resumes the chat on approve. agent approvals show "an owner/admin must decide in the console" + link to the Approvals view rather than offering buttons.
• approver_scope is now a typed field on AgentApprovalRequest ({ type, allow_edit }), so the card branches without an inline cast.
• The owner-console Approvals view continues to decide agent-type approvals via Django.

Nicer trigger config

• Replaces the raw JSON.stringify dump with a value-typed renderer: on/off pills for booleans, chips for string arrays (e.g. trusted_workspaces), wrapped blocks for long text (cron prompt), inline scalars — each with a short hint for the well-known fields.

Slug next to the app name

• Mono slug chip beside the title in the agent detail header.

Notes

• The Identities + Users sections only render for agents whose spec declares identity_providers / has end-users (i.e. those built on #64997).
• Touched files pass tsc + Biome. The pre-commit hook (full-repo typecheck) was bypassed where it fails on pre-existing errors in canvas/ and code-review/ on the base branch, unrelated to this change.

(Folds in the stacked approval-decision-UI PR (#2851) — now a single PR.)

Follow-up (not in this PR)

Make these sections spec-schema-driven — overlay the revision's values on the JSON Schema (z.toJSONSchema(AgentSpecSchema), already powering @posthog/agent-applications-spec-schema) so defaults / enums / new fields render automatically. The new value-typed trigger renderer is the nucleus; happy to take that on separately.

🤖 Generated with Claude Code

[github-actions]

React Doctor found 1 issue in 1 file · 1 warning.

1 warning

src/features/agent-applications/components/AgentConfigurationPane.tsx

• ⚠️ src/features/agent-applications/components/AgentConfigurationPane.tsx:921 Array index used as a key no-array-index-as-key

_{Reviewed by React Doctor for commit 85483e0.}

[greptile-apps]

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
packages/ui/src/features/agent-applications/components/AgentConfigurationPane.tsx:919-923
Using the item value as the React key means duplicate entries in the array (e.g. a workspace ID listed twice in `trusted_workspaces`) will trigger a React duplicate-key warning and the second item will silently not render. A stable index key avoids this for display-only chips.

```suggestion
            items.map((x, i) => (
              <Badge key={i} color="gray">
                {x}
              </Badge>
            ))
```

### Issue 2 of 2
packages/ui/src/features/agent-applications/components/AgentConfigurationPane.tsx:661
**`identityProviders()` helper bypassed here**

The `identityProviders(spec)` wrapper introduced in this PR is used everywhere else (`identityConsumers`, `buildTree`, `IdentityLink`, `IdentitiesOverview`), but this one call site uses `arr(spec.identity_providers)` directly. Replacing it with `identityProviders(spec)` keeps the field name in one place (OnceAndOnlyOnce).

_{Reviews (1): Last reviewed commit: "feat(agent-platform): identities section..." | Re-trigger Greptile}

[dmarticus]

Thorough review pass — left inline comments on the findings below. Most are low-priority; #1 (the disconnect not checking response.ok) is the only one close to a blocker.

Scope heads-up: the diff is larger than the title implies — it also includes the full Users/Connections pane + sessions-by-user filter, and a fourth commit that is #2840 (observability MetricCards + cost clamp). That last one only exists on this branch and shows up here as a stacking artifact because the base is posthog-code/m3a-final (which doesn't yet contain #2840). Worth confirming it reconciles on rebase; I didn't re-review the AgentAnalyticsView.tsx/format.ts changes as part of this PR.

What's done well (genuinely)

• The loosely-typed spec readers (rec/str/arr) are reused consistently with the existing convention, and slash-containing ids survive the idParts.join("/") path round-trip.
• Two-way identity cross-linking (tool/MCP ↔ provider) with undeclared and unused flagging is real, useful operator tooling.
• The credentials-never-serialized boundary is clearly documented in both the types and the client comment — good thing to make explicit.
• Confirm-before-revoke + a disabled stubbed "Ban" with an explanatory title is the right level of caution for a destructive surface.
• The session query key includes params, so the new agent_user_id filter caches/refetches correctly.
• Commit 2's index-key fix for duplicate array chips, with a clear biome-ignore rationale, is a nice catch.

Nice work overall — the identities UX is a solid addition.

[dmarticus]

Here's my feedback, but I have nothing blocking — left some inline comments (the disconnect response.ok check is the one I'd most want addressed, but it's not a gate). Nice work on the identities UX. 🚀