[camielvs]

Description

Six fixes to the add and replace secret form. They apply to Settings → Secrets today, and to the team secrets screens later in this stack.

• The value field sets autocomplete="new-password", so browsers stop offering a saved login password for it.
• A name containing /, or a name that is . or .., is refused. The name is a path segment in the replace and delete requests, and the URL parser collapses dot segments, so such a secret could be created but never changed or removed.
• The name and description stop at 255 characters, the size of their backend columns, and say so when the limit is reached. Longer values failed with a bare "Failed to add secret" or were cut off.
• Deleting asks first, with a "Delete" button. A deleted secret makes every run that uses it fail at launch. Once secrets are shared with a team, that's everyone's runs.
• Description and expiry fields. The backend writes either one only when a value is sent, so neither can be cleared once set. Replacing a secret keeps its description and expiry unless new ones are given, and the form says so. The Settings list shows a secret's description under its name.
• The expiry is sent as the last whole second of the chosen day, in UTC. A database that stores datetimes to the second rounds 23:59:59.999 up to midnight, which moved a Dec 25 expiry to Dec 26.

The E2E removeSecret helper now confirms the delete dialog, found by its title.

Related Issue and Pull requests

• Stacked on feat(runs): submit and manage runs as a team #2929.
• Carries over the form fixes and the expiry picker from feat(projects): manage workspace secrets from a Tangent project #2886, which this stack replaces.

Type of Change

• Improvement

Line Breakdown

Category	Added	Removed
Production code	261	30
Tests	342	0
Config / CI / tooling	9	0
Total	612	30

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Screenshots (if applicable)

None yet.

Test Instructions

pnpm vitest run src/components/shared/SecretsManagement

In Settings → Secrets:

1. Add a secret with a description and an expiry date. The description shows under its name.
2. Try a name containing /, then the name ... The form refuses both.
3. Paste 300 characters into the name. The field stops at 255 and says so.
4. Reopen it to replace it. The expiry shown is the day you chose.
5. Replace the secret without filling in the description or expiry. Both are kept, and the form's hints say so.
6. Delete the secret. A confirmation names the secret before anything is removed, and its button reads Delete.

Additional Comments

• ExpiryDatePicker is added to react-compiler.config.js.
• Tests get one ResizeObserver stub in vitest-setup.js instead of a copy per suite.

🤖 Generated with Claude Code

[github-actions]

🎩 Preview

A preview build has been created at: cvs/secret-form-hardening/e0fb413