fix(tui): fill the identity provider pickers past the service page cap

[aidandaly24]

Summary

• The identity oauth2-credential-provider and identity api-key-credential-provider pickers (list, and get which redirects to it) stopped at 20 rows on any taller terminal. The screens clamped maxResults to 20 because ListOauth2CredentialProviders caps it there; ListApiKeyCredentialProviders actually allows 100. On a 60-row terminal that meant 20 rows, page 1 · more →, and blank space below.
• Assemble identity list pages in Core the way listGatewayConnectors does. FilteredPaginator gains an exact-fill mode: with no predicate, each scan asks only for what the page still needs, and a page that lands exactly on maxResults advances past the scan page instead of replaying its token, so a seam never repeats a row. The documented caps (OAuth2 20, API key 100) live in IdentityClient; the TUI no longer carries a maxPageSize.
• A call with no maxResults still passes straight through, so the CLI default and the recorded fixtures are unchanged. --max-results above the cap now works in the CLI instead of surfacing a service ValidationException, and a non-positive value is rejected client-side.

Before / After

60-row terminal, us-west-2 test account with 30 OAuth2 providers:

	rows shown	footer
before	20	page 1 · more → plus 34 blank rows
after	30	none, everything fits

30-row terminal: page 1 shows 23 rows, page 2 starts at item 24 with no duplicates. API key list on 60 rows shows all 46 providers.

Test plan

• bun test (3071 pass), bun run typecheck, oxlint, prettier
• New src/core/identity.test.ts: page assembly across the cap, token continuity, pass-through with no maxResults, API key cap of 100, validation
• filteredPaginator.test.ts: exact-fill and exact-landing cases. The existing "falls back to defaultPageSize" expectation moves from the replayed token to the advanced one; this is the only behavior change for existing callers (connectors, insights) and it removes a duplicated row at seams that land exactly
• Screen tests: a 60-row terminal shows all 25 providers and no more →
• Live on the test account: an OAuth2 token minted at maxResults=3 continues at maxResults=20 with zero overlap; TUI before/after as in the table above

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice refactor. Moving the Identity service's maxResults caps out of the screen and into IdentityClient is a good separation of concerns, and letting FilteredPaginator operate without a predicate (shrinking requestSize toward remaining on each scan) is a clean way to assemble a page larger than the service page.

A couple of things I traced through and confirmed are correct rather than issues:

• The new results.length === pageSize early-return in filteredPaginator.ts also fixes a latent bug in the predicate path: previously, landing exactly on pageSize fell into the surplus branch's else and returned requestToken as the next token, causing the last taken match to repeat on the next page. The updated expectation in the falls back to defaultPageSize test (nextToken "1" → "2") reflects that fix, and the pre-existing overshoot/guard tests still hold. Existing predicate callers in eval.tsx and gateway.tsx benefit from this.
• identity.test.ts mocks at the SDK send() boundary and drives real IdentityClient + FilteredPaginator code — no excessive mocking. maxResults: 0 correctly rejects via InputValidationError (0 passes the undefined short-circuit but fails Number.isInteger(x) && x >= 1 in FilteredPaginator).
• No new user-facing feature here that would warrant telemetry.

Ship it.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.99%. Comparing base (535785c) to head (d561fad).
⚠️ Report is 1 commits behind head on refactor.

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2237   +/-   ##
=========================================
  Coverage     96.98%   96.99%           
=========================================
  Files           564      564           
  Lines         39221    39252   +31     
=========================================
+ Hits          38040    38071   +31     
  Misses         1181     1181           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.