[camielvs]

Description

In a team's project, the secret picker now offers the team's secrets alongside your own, so a secret picked for an argument is one the run can reach at launch, whoever it's submitted as.

• From a task argument in either editor, the picker uses the page's team (useActingTeam): the Tangent project of the embedded editor, or ?projectId= in the standalone one. It resolves only while open, so an editor with many argument rows doesn't look up the team for each.
• From the submit dialog, it uses the team of the projects that run will be filed under, which the dialog now receives from its caller. TangleSubmitter gets it from the chosen project plus the page's scope. RunPipelineButton gets it from the project it runs in. Both use the new useTeamForSubmission, and useActingTeam is now that hook applied to the page's linked project.
• Your secrets and the team's are listed apart, under "Your secrets" and "The {workspace} workspace's secrets", the second with the workspace icon.
• "Add Secret" saves to your own secrets by default. When you can write to the team, a Save to choice can put the new secret in the team's instead. So a pipeline built in the standalone editor for a team's project can get a team secret, and use it, without going through Tangent.
• When the project has a team you can't act as, the picker says why and offers your own secrets, which are what the run will use. For projects on different teams, it offers nothing. ActingTeamNotice holds that copy so the submit dialog (feat(runs): submit as yourself or as the project's team #2943) can say the same thing. It names the workspace with its icon, so InfoBox titles now accept rich content.

Related Issue and Pull requests

• Stacked on feat(tangent): manage a project's secrets in a Secrets window #2941.

Type of Change

• New feature

Line Breakdown

Category	Added	Removed
Production code	303	25
Tests	406	41
Total	709	66

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Screenshots (if applicable)

None yet.

Test Instructions

pnpm vitest run src/components/shared/SecretsManagement src/components/shared/Teams src/components/Project src/services/teams

With the same setup as #2941:

1. Edit a pipeline in a team's Tangent project and set a task argument to a secret. The picker lists your secrets and, under the team's name, the team's.
2. Do the same in the standalone editor, opened from that project (?projectId=). The result is the same.
3. Open the picker from "Submit run with arguments". Pick a project on another team in the dialog's project field, and the picker follows that project's team.
4. Add a secret from the picker in the standalone editor, with "Runs go to" set to a team's project. "Save to" offers "Your secrets" and "The {workspace} workspace's secrets". Choose the team's, and the new secret is listed under the team's name. With a role that can't write to the team, there's no choice, and it saves to yours.

Additional Comments

None.

🤖 Generated with Claude Code

[github-actions]

🎩 Preview

A preview build has been created at: cvs/pick-team-secrets/cefb7df