feat(runs): submit as the project's team

src/agent/toolBridgeApi.ts

@@ -73,6 +73,8 @@ export interface RunSubmissionResult {
   success: boolean;
   runId?: string;
   rootExecutionId?: string;
+  actingAsTeam?: string;
+  warning?: string;
   error?: string;
 }
 

src/components/Project/RunPipelineButton.test.tsx

@@ -178,6 +178,46 @@ describe("RunPipelineButton", () => {
       "42",
       "https://backend.test",
       expect.objectContaining({ notes: "why this run" }),
+      undefined,
+    );
+  });
+
+  it("starts the run as the project's team", async () => {
+    vi.mocked(useTeamForSubmission).mockReturnValue({
+      status: "active",
+      team: { id: "ml-team@example.com", label: "ML Research", canWrite: true },
+    });
+    renderButton({});
+    const user = userEvent.setup();
+
+    await user.click(runButton());
+    await user.click(screen.getByRole("button", { name: "Submit Run" }));
+    submit.mock.calls[0][0].onSuccess({ id: 42 });
+
+    expect(submit).toHaveBeenCalledWith(
+      expect.objectContaining({ teamId: "ml-team@example.com" }),
+    );
+    expect(saveAnnotations).toHaveBeenCalledWith(
+      "42",
+      "https://backend.test",
+      expect.objectContaining({ notes: "why this run" }),
+      "ml-team@example.com",
+    );
+  });
+
+  it("starts the run as you when you're not in the project's team", async () => {
+    vi.mocked(useTeamForSubmission).mockReturnValue({
+      status: "not-member",
+      team: { id: "ml-team@example.com", label: "ML Research" },
+    });
+    renderButton({});
+    const user = userEvent.setup();
+
+    await user.click(runButton());
+    await user.click(screen.getByRole("button", { name: "Submit Run" }));
+
+    expect(submit).toHaveBeenCalledWith(
+      expect.objectContaining({ teamId: undefined }),
     );
   });
 

src/components/Project/RunPipelineButton.tsx

@@ -9,6 +9,7 @@ import { Icon } from "@/components/ui/icon";
 import useToastNotification from "@/hooks/useToastNotification";
 import { useAnalytics } from "@/providers/AnalyticsProvider";
 import { useBackend } from "@/providers/BackendProvider";
+import { actingTeamId } from "@/services/teams/teamResolution";
 import { useTeamForSubmission } from "@/services/teams/useTeamForSubmission";
 import type { PipelineRun } from "@/types/pipelineRun";
 import type { ArgumentType, ComponentSpec } from "@/utils/componentSpec";
@@ -35,20 +36,35 @@ export function RunPipelineButton({
   const runTeam = useTeamForSubmission([projectId]);
 
   const { mutate: saveAnnotations } = useMutation({
-    mutationFn: ({ runId, notes }: { runId: string; notes: string }) =>
-      saveRunAnnotations(runId, backendUrl, { notes, componentSpec: spec }),
+    mutationFn: ({
+      runId,
+      notes,
+      teamId,
+    }: {
+      runId: string;
+      notes: string;
+      teamId?: string;
+    }) =>
+      saveRunAnnotations(
+        runId,
+        backendUrl,
+        { notes, componentSpec: spec },
+        teamId,
+      ),
   });
 
   const runnable = pipelineValidity(spec) !== "invalid";
 
   const run = (taskArguments: Record<string, ArgumentType>, notes: string) => {
     setDialogOpen(false);
+    const teamId = actingTeamId(runTeam);
     submit({
       componentSpec: spec,
       taskArguments,
       projectIds: [projectId],
+      teamId,
       onSuccess: (run: PipelineRun) => {
-        saveAnnotations({ runId: run.id.toString(), notes });
+        saveAnnotations({ runId: run.id.toString(), notes, teamId });
         track("projects.run_pipeline_completed", {});
         notify("Run started in this project", "success");
       },

src/components/shared/SecretsManagement/useMissingSecrets.test.tsx

@@ -0,0 +1,109 @@
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { renderHook, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { TeamResolution } from "@/services/teams/types";
+
+import { createSecretArgument, type Secret } from "./types";
+import { useMissingSecrets } from "./useMissingSecrets";
+
+const { fetchSecrets } = vi.hoisted(() => ({ fetchSecrets: vi.fn() }));
+
+vi.mock("./secretsStorage", () => ({
+  secretsListQuery: (teamId?: string) => ({
+    queryKey: ["secrets", teamId ?? "user"],
+    queryFn: () => fetchSecrets(teamId),
+  }),
+}));
+
+const TEAM = { id: "ml-team@example.com", label: "ML Research" };
+const ACTIVE: TeamResolution = {
+  status: "active",
+  team: { ...TEAM, canWrite: true },
+};
+
+const secret = (name: string): Secret => ({
+  id: name,
+  name,
+  createdAt: new Date("2026-10-01T09:00:00Z"),
+  updatedAt: new Date("2026-10-02T09:00:00Z"),
+});
+
+const usingSecrets = (...names: string[]) =>
+  Object.fromEntries(names.map((name) => [name, createSecretArgument(name)]));
+
+function check(resolution: TeamResolution, sources: unknown[]) {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  });
+  return renderHook(() => useMissingSecrets(resolution, sources), {
+    wrapper: ({ children }: { children: ReactNode }) => (
+      <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+    ),
+  });
+}
+
+describe("useMissingSecrets", () => {
+  beforeEach(() => {
+    fetchSecrets.mockResolvedValue([secret("API_KEY")]);
+  });
+
+  afterEach(() => vi.clearAllMocks());
+
+  it("names the referenced secrets the team doesn't have", async () => {
+    const { result } = check(ACTIVE, [usingSecrets("API_KEY", "DB_PASSWORD")]);
+
+    await waitFor(() => expect(result.current.isChecking).toBe(false));
+    expect(result.current.missing).toEqual(["DB_PASSWORD"]);
+    expect(fetchSecrets).toHaveBeenCalledWith(TEAM.id);
+  });
+
+  it("checks your own secrets when the run falls back to you", async () => {
+    const { result } = check({ status: "not-member", team: TEAM }, [
+      usingSecrets("API_KEY"),
+    ]);
+
+    await waitFor(() => expect(result.current.isChecking).toBe(false));
+    expect(result.current.missing).toEqual([]);
+    expect(fetchSecrets).toHaveBeenCalledWith(undefined);
+  });
+
+  it("checks nothing for a run that uses no secrets", () => {
+    const { result } = check(ACTIVE, [{ greeting: "hello" }]);
+
+    expect(result.current).toEqual({ missing: [], isChecking: false });
+    expect(fetchSecrets).not.toHaveBeenCalled();
+  });
+
+  it("waits for the team before checking", () => {
+    const { result } = check({ status: "resolving" }, [
+      usingSecrets("API_KEY"),
+    ]);
+
+    expect(result.current).toEqual({ missing: [], isChecking: true });
+    expect(fetchSecrets).not.toHaveBeenCalled();
+  });
+
+  it("checks nothing for projects on different teams", () => {
+    const { result } = check(
+      {
+        status: "conflict",
+        teams: [TEAM, { id: "data@example.com", label: "Data" }],
+      },
+      [usingSecrets("API_KEY")],
+    );
+
+    expect(result.current).toEqual({ missing: [], isChecking: false });
+    expect(fetchSecrets).not.toHaveBeenCalled();
+  });
+
+  it("names nothing when the secrets can't be listed", async () => {
+    fetchSecrets.mockRejectedValue(new Error("backend down"));
+
+    const { result } = check(ACTIVE, [usingSecrets("API_KEY")]);
+
+    await waitFor(() => expect(result.current.isChecking).toBe(false));
+    expect(result.current.missing).toEqual([]);
+  });
+});

src/components/shared/SecretsManagement/useMissingSecrets.ts

@@ -0,0 +1,39 @@
+import { useQuery } from "@tanstack/react-query";
+
+import { actingTeamId } from "@/services/teams/teamResolution";
+import type { TeamResolution } from "@/services/teams/types";
+
+import { missingSecretNames, referencedSecretNames } from "./secretReferences";
+import { secretsListQuery } from "./secretsStorage";
+
+interface MissingSecrets {
+  missing: string[];
+  isChecking: boolean;
+}
+
+export function useMissingSecrets(
+  resolution: TeamResolution,
+  sources: readonly unknown[],
+): MissingSecrets {
+  const referenced = referencedSecretNames(...sources);
+  const settled =
+    resolution.status !== "resolving" && resolution.status !== "conflict";
+  const shouldCheck = settled && referenced.length > 0;
+
+  const { data: secrets, isPending } = useQuery({
+    ...secretsListQuery(actingTeamId(resolution)),
+    enabled: shouldCheck,
+  });
+
+  if (referenced.length === 0) return { missing: [], isChecking: false };
+  if (resolution.status === "resolving")
+    return { missing: [], isChecking: true };
+  if (!shouldCheck) return { missing: [], isChecking: false };
+  if (isPending) return { missing: [], isChecking: true };
+  if (!secrets) return { missing: [], isChecking: false };
+
+  return {
+    missing: missingSecretNames(referenced, secrets),
+    isChecking: false,
+  };
+}