Skip to content

feat(runs): submit as the project's team - #2943

Draft
camielvs wants to merge 2 commits into
cvs/pick-team-secretsfrom
cvs/submit-as-team
Draft

camielvs wants to merge 2 commits into
cvs/pick-team-secretsfrom
cvs/submit-as-team

Conversation

@camielvs

@camielvs camielvs commented Oct 22, 2026 •

Copy link
Copy Markdown
Collaborator

Description

A run now acts as the team of the projects it's filed under. The editor's Submit Run button, the arguments dialog, a project's Run pipeline button and the Tangent agents all send the team header when the team resolves to one you're in. They also write the run's notes and tags as that team, since the backend only lets a run's creator annotate it.

Runs fall back to you rather than fail, and the UI says so before you submit:

  • A run that would run as you instead (you're not in the team, the team can't be acted as, or the team couldn't be checked) doesn't submit straight from Submit Run. The button opens the arguments dialog, which says who the run runs as and why.
  • A run that references a secret the account it runs as doesn't have does the same. The dialog names the missing secrets. They warn rather than block, because the list can lag behind a secret added elsewhere.
  • When the team is active, the button reads "Submit Run as {team}", with the team id as its tooltip.

Agents in Tangent's editor and run view submit through the tool bridge, which now uses the same team. A run that falls back to the user is still submitted, and the result carries a warning saying why, for the agent to pass on. While the team is resolving, or for projects on different teams, the submission is refused with the reason.

Submit waits while the team resolves and while the secrets are checked. It's refused for projects on different teams. The arguments button stays available in that case, so another project can be chosen for the run.

Related Issue and Pull requests

Type of Change

  • New feature

Line Breakdown

Category Added Removed
Production code 284 11
Tests 569 1
Total 853 12

Checklist

  • I have tested this does not break current pipelines / runs functionality
  • I have tested the changes on staging

Screenshots (if applicable)

None yet.

Test Instructions

pnpm vitest run src/components/shared/Submitters src/components/Project src/components/shared/SecretsManagement src/services/teams

With the same setup as #2941:

  1. Submit from a team's project. The button reads "Submit Run as {team}". The run's "Created by" is the team's id, and its notes are saved.
  2. Submit from a project whose team you're not in. The arguments dialog opens with "Runs as you" and a warning. Submitting from there runs as you.
  3. Submit a pipeline that uses a secret the team doesn't have. The dialog names the secret.
  4. Ask the Tangent agent to submit a pipeline that uses a team secret. The run's "Created by" is the team's id, and the secret resolves.
  5. Submit outside any project. It behaves as on master.

Additional Comments

TangleSubmitter had no tests. It now has tests for the team cases.

🤖 Generated with Claude Code

@camielvs
camielvs added this pull request to stack #2930 October 22, 2026 22:34
@github-actions

github-actions Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

🎩 Preview

A preview build has been created at: cvs/submit-as-team/346ee1f

camielvs and others added 2 commits October 23, 2026 16:43
A run now acts as the team of the projects it's filed under. The submit
button, the arguments dialog and a project's Run pipeline button all send
the team header when the team resolves to one you're in, and write the
run's notes and tags as that team too, since the backend only lets the
run's creator annotate it.

When a run would fall back to you (you're not in the team, the team can't
be acted as, or the team couldn't be checked), or a secret the pipeline
references isn't in the secrets the run will see, the quick submit button
opens the arguments dialog instead of submitting. The dialog says who the
run runs as, explains a fallback, and names the missing secrets. Missing
secrets warn rather than block: the list can lag behind a secret added
elsewhere.

Submit waits while the team resolves and while the secrets are checked,
and is refused for projects on different teams. The arguments button stays
available in that case, so another project can be chosen for the run.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A run an agent submitted from a team's Tangent project was created as the
user, so its secrets were looked up in the user's account and a team
secret failed at launch. The Tangent editor and run view agents submit
through the tool bridge, which filed the run under the project but never
sent the team header.

The bridge now takes the project's team from the same
`useTeamForSubmission` the submit button uses:

- An active team: the run acts as it, and the result says so.
- The team is still resolving, or the projects are on different teams:
  the submission is refused with the reason, so the agent can retry or
  explain.
- A fallback (not a member, refused, or the lookup failed): the run is
  submitted as the user, and the result carries a warning saying why and
  that it uses the user's own secrets. It's the same rule as the submit
  dialog, worded for the agent to pass on.

Team names in the submit button and the missing-secrets warning now
carry the team icon, like the rest of the team copy.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant