[camielvs]

Description

Tangent's project dock gains a Secrets window when the project's workspace maps to a team. It lists the workspace's secrets, the ones runs in the project use when they act as the team. Your own secrets stay in Settings → Secrets. The copy calls the team the workspace: a team takes its workspace's name, and the workspace is what people know it by.

• In a team's project, the window is headed "Workspace: {workspace}", with the team id as its tooltip. Add ("Add a workspace secret"), replace and delete act as the team. A member whose role can't write sees the list without those actions. Hiding them is the only guard, since the backend doesn't check write access on /api/secrets/.
• A project whose workspace has no team gets no Secrets window, since it has no workspace secrets. The window opens once the team is known, so it never appears and then vanishes, and it closes when you move to a project without a team.
• When the project has a team you can't act as (not a member, refused by the backend, or the lookup failed), the window says the workspace's secrets aren't available, and why. It doesn't list your own secrets in their place, where they would pass for the workspace's.

A team's name carries the workspace icon wherever it's written into copy, with the team id on hover, the icon centred on the text. TeamName does this for the add dialog, the delete confirmation and the window's notice. The replace dialog shows the secret's key icon at its top left, like the secret's row.

Deleting a workspace secret is titled Delete shared secret "{name}"? and says it's removed for the whole workspace, naming it in bold: "This removes the secret from the {workspace} workspace. Runs that use it will fail. This can't be undone." ConfirmationDialog takes any node as its description, so the name carries its icon there, and TeamName's bold sets the name in semibold and the icon at a matching stroke. Settings → Secrets keeps its wording, which has no workspace.

The add and replace controls take an optional team id, and the delete control an optional team. Each invalidates that team's cache key. Their failure toasts now show the backend's reason, which matters once a request can be refused for acting as a team.

Related Issue and Pull requests

• Stacked on feat(teams): the acting team for a page #2940.
• Takes from feat(projects): manage workspace secrets from a Tangent project #2886: the dock registration and its order test, ListRowIcon, and the secret row's look. Replace and delete are inline buttons rather than a menu, so the row can reuse the confirming delete button from feat(secrets): harden the secret form #2939. Settings → Secrets stays your own secrets.

Type of Change

• New feature

Line Breakdown

Category	Added	Removed
Production code	506	38
Tests	746	25
Config / CI / tooling	1	0
Total	1253	63

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Screenshots (if applicable)

None yet.

Test Instructions

pnpm vitest run src/routes/v2/pages/Tangent src/components/shared/Teams src/components/shared/SecretsManagement

On a deployment with team impersonation, you need:

• the host page setting window.__TANGLE_TEAM_IMPERSONATION__;
• a workspace whose teamId metadata is a team's id;
• you as a member of that team.

Then:

1. Open a Tangent project in that workspace and open the Secrets window. It's headed "Workspace: {workspace}". Adding a secret there adds it to the team. Deleting one asks first, saying it's removed from the workspace.
2. Open a project in a workspace with no team. There's no Secrets window, and coming from step 1 it closes.
3. Open a project whose team you're not in. The window says the workspace's secrets aren't available because you're not in it, and lists none.

Without the impersonation config, no project has a Secrets window.

Additional Comments

The React Compiler now covers src/components/shared/Teams.

🤖 Generated with Claude Code

[github-actions]

🎩 Preview

A preview build has been created at: cvs/tangent-secrets-window/f3d06a4