[camielvs]

Description

Tangent's project dock gains a Secrets window. It lists the secrets that runs submitted in the project will use: the team's, when the project's workspace maps to a team you can act as, and your own otherwise.

• In a team's project, the window is headed "Team: {workspace}", with the team id as its tooltip. Add ("Add a team secret"), replace and delete act as the team. A member whose role can't write sees the list without those actions. Hiding them is the only guard, since the backend doesn't check write access on /api/secrets/.
• Everywhere else, it's headed "My secrets".
• When the project has a team you can't act as (not a member, refused by the backend, or the lookup failed), the window says so and lists your own secrets. That's who your runs there will be submitted as. ActingTeamNotice holds that copy so the submit dialog can say the same thing.
• For projects on different teams, the window lists nothing and says why. Submitting is blocked in that case (feat(runs): submit as the project's team #2943).

A team's name carries the team icon wherever it's written into copy, with the team id on hover. TeamName does this for the add dialog and the team notices. InfoBox titles now accept rich content so the notices can include it. The replace dialog shows the secret's key icon at its top left, like the secret's row.

The add, replace and delete controls take an optional team id and invalidate that team's cache key. Their failure toasts now show the backend's reason, which matters once a request can be refused for acting as a team.

Related Issue and Pull requests

• Stacked on feat(teams): the acting team for a page #2940.
• Takes from feat(projects): manage workspace secrets from a Tangent project #2886: the dock registration and its order test, ListRowIcon, and the secret row's look. Replace and delete are inline buttons rather than a menu, so the row can reuse the confirming delete button from feat(secrets): harden the secret form #2939. Settings → Secrets stays your own secrets.

Type of Change

• New feature

Line Breakdown

Category	Added	Removed
Production code	507	21
Tests	588	22
Config / CI / tooling	1	0
Total	1096	43

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Screenshots (if applicable)

None yet.

Test Instructions

pnpm vitest run src/routes/v2/pages/Tangent src/components/shared/Teams src/components/shared/SecretsManagement

On a deployment with team impersonation, you need:

• the host page setting window.__TANGLE_TEAM_IMPERSONATION__;
• a workspace whose teamId metadata is a team's id;
• you as a member of that team.

Then:

1. Open a Tangent project in that workspace and open the Secrets window. It's headed "Team: {workspace}". Adding a secret there adds it to the team.
2. Open a project in a workspace with no team. The window is headed "My secrets".
3. Open a project whose team you're not in. A warning says so, and the list is your own secrets.

Without the impersonation config, every project shows "My secrets".

Additional Comments

The React Compiler now covers src/components/shared/Teams.

🤖 Generated with Claude Code

[github-actions]

🎩 Preview

A preview build has been created at: cvs/tangent-secrets-window/49949eb