The chat owner on `POST /api/experimental/chats` is always the
`coder-token` holder; the API has no owner override. The action
previously framed `coder-username` as picking "the Coder user the
chat runs as", which is incorrect.

What changed:
- Add CoderClient.getAuthenticatedUser() backed by GET /api/v2/users/me.
- resolveCoderUsername falls back to users/me when no input is set and
  the trust gate returns no-signal (schedule, workflow_dispatch with
  no sender or actor, custom repository_dispatch chains). The gate
  still refuses untrusted triggers and does not fall through to
  users/me.
- Warn when the resolved acting user (from coder-username or
  github-user-id) differs from the token owner. Suppressed for
  auto-resolved sources.
- Rewrite README "Security model" to make clear the trust gate
  protects the acting user (org pick, reuse label), not the chat
  owner. The chat owner is the token holder.
- generateChatUrl and buildDeploymentChatsUrl now build /agents and
  /agents/<id> paths, matching the real Coder frontend routes
  (site/src/pages/AgentsPage/utils/navigation.ts).
- Update inline docs on coder-username and github-user-id inputs and
  outputs to stop calling them "the chat runs as".

Closes CODAGT-437
Closes CODAGT-394
Closes CODAGT-438

🤖 Authored by Coder Agents.

Addresses the round-1 review findings on PR #32. The PR's own error
messages and one README paragraph still carried the pre-rename framing
("the user the chat should run as"), and the deployment-list URL
identity ("chats") was not renamed when the URL migrated to
`/agents`.

What changed:
- Rewrite three error-message strings to match the README's "acting
  user (for org pick and the per-user reuse label)" framing
  (DEREM-2: action.ts trust-gate refusal, action.ts users/me failure,
  comment.ts user_ambiguous).
- Rename `buildDeploymentChatsUrl` -> `buildDeploymentAgentsUrl`,
  `chatsUrl` field on `FailureCommentContext` -> `agentsUrl`, "View
  chats in the Coder deployment" link text -> "View agents", and the
  surrounding comment (DEREM-3). Update the call site in action.ts and
  the comment.test.ts tests.
- Rewrite the README quickstart paragraph to stop using "runs under"
  language for the acting user (DEREM-4).
- Add a divergence catch-path test: when `getAuthenticatedUser`
  rejects, action.run completes, a `core.warning` is emitted naming
  the fetch failure, and createChat is still reached (DEREM-5).
- Add a `core.info` for the `no-signal` trust-gate verdict so an
  operator debugging identity resolution can see the gate ran and
  deferred (DEREM-8).
- Fix the stale doc comment on `resolveOrganizationID` that claimed
  the username lookup happens here (DEREM-9). The lookup now always
  happens in `resolveCoderUsername`.
- Migrate the missed `/chats/` URL fixture in schemas.test.ts:331 to
  `/agents/` (DEREM-1).
- Drop the duplicate `Coder username: ...` info log; the new
  `Resolved acting Coder user: ... (source: ...)` line above already
  covers it (DEREM-7).

DEREM-6 (P4) declined: the `users/me` throw uses the same plain
`new Error(...)` shape as the sender/actor sibling throws on
purpose. Fixing only this site would create an inconsistency; the
cleanup is best landed as a separate pass across all four throws.

🤖 Authored by Coder Agents.

…losed

A security review of PR #32 found that the trust gate, the per-user
reuse label, and the `acting-*` identity inputs each protect a
different invariant. The orchestrator's earlier collapse treated them
as one and lost both (F2 and F3 in the review). This rewrites the
identity model so the gate stays top-level and fail-closed, the
reuse-label query is simplified safely, and the `acting-*` surface is
dropped.

What changed:
- Drop input `acting-coder-username` and input `acting-github-user-id`.
  The chats API binds chat ownership to the `coder-token` holder; the
  `acting-*` inputs only selected the org and the per-user reuse label,
  which post-rewrite the action no longer scopes by acting user.
- Rename output `acting-coder-username` -> `coder-username`. The value
  now always reports the token owner from `users/me`.
- Drop the sender/actor auto-resolve chain entirely. `users/me` is the
  only identity path.
- Drop `warnOnTokenOwnerDivergence`, `getTokenOwner`, the tokenOwner
  memoization, the `IdentitySource` type, the `describeError` helper,
  and the `getCoderUserByGitHubId` / `getCoderUserByUsername` methods
  from `CoderClient`.
- Move `classifyAutoResolveTrust` from inside `resolveCoderUsername`
  to a top-level `assertTrustedTrigger` call in `runInner`, executed
  before `users/me` and `createChat`. The gate is always-on; no input
  bypasses it. `untrusted` throws, `trusted` and `no-signal` log and
  proceed.
- Drop the per-user reuse label (`coder-agents-chat-action-user`).
  All chats are owned by the token holder so per-actor labelling
  added no isolation. Workflows that want per-actor separation pass
  `idempotency-key: ${{ github.actor }}` themselves.
- Restructure the idempotency label: the sanitized user value is now
  the VALUE of a fixed `coder-agents-chat-action-idempotency` key,
  not the key itself. User input can no longer collide with action-
  owned keys; the runtime `RESERVED_LABEL_KEYS` collision check is
  retained only as a defensive export for future keys.
- Validate `github-url` host in `parseGithubURL` (F6). The shared
  `parseGithubItemURL` helper anchors the regex to `github.com` and
  rejects non-github hosts before either the action's create-comment
  call or `deriveCommentKey`'s marker derivation.
- Wrap `detail.message` and `chat.last_error` in a 4-backtick fenced
  code block in failure comments (F9). The block strips C0 control
  bytes (keeping newline and tab), downgrades embedded 4+-backtick
  runs so the surrounding fence stays closable, and caps the message
  at 4000 chars.
- Rewrite the README: identity-resolution section collapses to one
  paragraph; security-model section documents ownership, trust-gate,
  and indirect prompt injection (F1) as three separate concerns; the
  `pull_request_target` recipe gates fork PRs via an `if:` on
  `head.repo.full_name`; inputs and outputs tables match the new
  surface.

Tests:
- Drop the entire `Identity resolution` and `Token-owner divergence`
  describe blocks (sender/actor auto-resolve and divergence-warning
  tests).
- Drop tests that exercised the now-removed `getCoderUserByGitHubId`,
  `getCoderUserByUsername`, and `parseGithubUserID` paths.
- Update reuse-label tests: no per-user label is emitted; the new
  fixed-key idempotency scheme is asserted in place of the old
  user-input-as-key scheme; the reserved-key collision test is
  flipped to assert that collision is no longer possible.
- Add a new `Trust gate (top-level, always-on)` describe block
  pinning fork-PR refusal, NONE-association refusal, trusted-MEMBER
  acceptance, no-signal acceptance, and the absence of an input
  bypass.
- Add `parseGithubURL` tests for F6: non-github.com host refusal and
  attacker-redirect refusal.
- Add `renderDetailBlock` tests for F9: plain wrap, fence
  neutralization, control-byte stripping, length cap.
- Update the `deriveCommentKey` enterprise-URL test to assert the new
  raw-URL fallback (no parse on non-github hosts).

Closes CODAGT-437
Closes CODAGT-394
Closes CODAGT-438

🤖 Authored by Coder Agents.

The previous commit removed a single named import. Biome's format
check collapses 2-name imports onto one line. The local
`bun run format` should have caught this but only ran on the
file before the manual edit. CI caught it.

🤖 Authored by Coder Agents.

…me sanitizedKey

Remove the user_not_found and user_ambiguous ChatErrorKind variants:
the action no longer resolves an acting Coder user, so these branches
were unreachable. Update the enum, the FailureDetail union, the
classifyError fallthrough, mapErrorCodeToKind (removed), the two
buildFailureCommentBody cases, the action.yaml output description,
and the tests that exercised the dead paths.

Rename sanitizedKey to sanitizedIdempotency in action.ts; with the
fixed label key, the variable is an idempotency VALUE, not a key.
Have deriveCommentKey go through parseGithubItemURL instead of
matching GITHUB_URL_REGEX directly so host validation stays in one
place. Fix two JSDoc/comment paragraphs that still mentioned the
removed identity-resolution path, and replace stray escaped
apostrophes in two JSDoc comments. Add a schema test for the
existing-chat-id + force-new-chat mutex.

…scrub stale doc language

- Rename classifyAutoResolveTrust to classifyTriggerTrust; the action no
  longer auto-resolves anything. Update the four doc paragraphs that
  referenced the dead model, the fork error string, the call site, and
  the README reference. Replace 'resolved Coder user'/'resolved user'
  framing in comment.ts, action.yaml, action.ts JSDoc, and four
  action.test.ts sites; nothing resolves now, the chat owner is the
  token holder.
- Rename sanitizeLabelKey to sanitizeLabelToken (file moved with git
  mv). The platform regex applies to label keys and values; one call
  site uses the result as a label value, the other as a comment-marker
  key.
- Delete RESERVED_LABEL_KEYS export and its tautological tests. With
  the fixed-key idempotency scheme a value can never overwrite an
  action-owned key, so the runtime guard was already gone.
- Delete the kind discriminator on CoderAPIError; classifyError no
  longer reads it and no caller sets it.
- Extract DETAIL_BLOCK_MAX_CHARS for the failure-block 4000-char cap;
  function body and test both reference the named constant.
- Unexport GITHUB_URL_REGEX and rewrite the docstring; the regex is
  internal to parseGithubItemURL now, not consumed by deriveCommentKey
  or any other caller.
- Add two trust-gate tests: head.repo === null (deleted fork) and
  head.repo.full_name diverging from base.repo.full_name with
  fork === false. Both branches were code-only before.
- Drop the placeholder src/index.test.ts; bun test discovery does not
  need a stub file.

…d docs

Drop F1, F6, F9 (security-review tags), DEREM-2, and CODAGT-290
references from doc comments, test descriptions/comments, and a
README heading. The technical justification stays; the
internal-only identifiers do not survive on main.

The action no longer classifies trigger trust. GitHub's secrets-on-fork
rule already gates the load-bearing case for `pull_request`; workflows
that opt into broader trigger surfaces (`pull_request_target`,
`issue_comment`, `pull_request_review`, `pull_request_review_comment`)
restate policy with `if:` themselves. Empirical investigation showed
the gate never reached community fork PRs in practice.

- Delete classifyTriggerTrust, TrustClassification, TRUSTED_AUTHOR_
  ASSOCIATIONS, and ActionContext from src/action.ts.
- Delete assertTrustedTrigger and its runInner call site.
- Drop the context parameter from CoderAgentChatAction's constructor;
  every test call site loses its 4th positional arg.
- Delete the Trust gate describe block from src/action.test.ts (seven
  tests including DEREM-26 and DEREM-27).
- Delete createMockContext and its ActionContext import from
  src/test-helpers.ts.
- Rewrite the README "Security model" section as three subsections:
  Chat ownership, Trigger gating (with three `if:` patterns and a link
  to GitHub's events doc), Indirect prompt injection. Drop stale
  "trust gate" references in Quickstart, the doc-check recipe, and the
  troubleshooting table.

`classifyError` runs in comment.ts and cannot import ActionFailureError
without a cycle, so an ActionFailureError reaching `handleFailure`
fell through the `err instanceof Error` branch and rendered the
api_error body even when the thrown kind was `org_not_found` or
`timeout`. The `chat-error-kind` output already came from
`ActionFailureError.kind`, so the comment disagreed with the output.

Pre-check ActionFailureError in `handleFailure` and pass the kind
through. `spend_exceeded` carries extra fields on the body variant
and is only produced by `classifyError`, never thrown directly, so
the narrow is exhaustive. New test pins the org_not_found body.

Also drop dead weight surfaced by the R5 review:

- Delete `warnUnwiredInputs` and its describe block. The method
  was a no-op and the two tests asserted nothing.
- Delete the duplicate `creates a chat under the token owner
  returned by users/me` test; it was a strict subset of
  `creates new chat successfully` above it.
- Delete `ChatErrorKindSchema` and `ChatErrorKind` from
  coder-client.ts. The canonical definition lives in schemas.ts;
  the duplicate was a sync hazard. `comment.ts` re-exports
  `ChatErrorKind` from schemas.ts now.