[camielvs]

Description

A run uses the secrets of whoever submits it, so in a team's project it can go as you or as the project's team. It goes as you by default, and as the team when that's chosen or needed:

The run's secrets	It goes as
None, or all in your secrets	You. The arguments dialog's Run as control can pick the team.
Some only the team has, the rest in both	The team, forced. "You" is disabled, and the dialog names the secrets that force it.
Some only yours, others only the team's	Neither works. The dialog says which are where.
Some in neither	Whoever is chosen, with the missing secrets named.

runIdentity applies that rule, and useRunIdentity lists your secrets and the team's to feed it. The editor's Submit Run button, the arguments dialog and a project's Run pipeline button all follow it. They send the team header only when the run goes as the team, and write the run's notes and tags as whoever submitted it, since the backend only lets a run's creator annotate it.

The UI says who a run goes as before you submit:

• Submit Run reads "Submit Run as {workspace}" only when the run goes as the team. It opens the arguments dialog instead of submitting when the run would fall back to you (you're not in the team, the team can't be acted as, or the team couldn't be checked), when a secret is missing for whoever it goes as, or when its secrets are split.
• The arguments dialog shows the Run as control when the team is active, and "Runs as you" with the reason otherwise. A choice holds for the team it was made for, so switching the dialog to a project in another workspace starts from that workspace's default. The run goes as whoever the dialog shows, including You on a page that would go as the team. Missing secrets are named in bold after a lock icon, with who has them, as in "API_KEY isn't in your secrets; the Search workspace has it". They warn rather than block, because the list can lag behind a secret added elsewhere.
• The secret picker, opened from the dialog, starts its Save to choice (feat(secrets): pick a team's secrets #2942) on whoever the run goes as.
• The v2 editor's Quick Run ▶ button clicks a hidden Submit Run button, so the "as {team}" suffix never shows there. It carries a badge with the workspace icon instead whenever the run goes as the team, and its tooltip reads "Submit run as the {workspace} workspace". The badge is left off when the pipeline has errors, and the tooltip keeps a validation warning when there is one. While the hidden button waits for the team or the secrets check, or refuses projects in different workspaces, ▶ is disabled too, and its tooltip says what it's waiting for.

Agents in Tangent's editor and run view submit through the tool bridge, which follows the same rule. submit_pipeline_run goes as the user unless it's asked to act as the team (asTeam) or a team-only secret forces it, and it decides with the same runAsFor as the UI. Its result's actingAsWorkspace names the workspace it went as, and actingAsTeam is that workspace's team id. It refuses asTeam when the user can't act as the team, and refuses a run whose secrets are split unless asTeam is set. While the team is resolving, or for projects on different teams, the submission is refused with the reason. The tool's description and results call the team the workspace, as the UI does.

Submit waits while the team resolves and while the secrets are checked. It's refused for projects on different teams. The arguments button stays available in that case, so another project can be chosen for the run.

Related Issue and Pull requests

• Stacked on feat(secrets): pick a team's secrets #2942.

Type of Change

• New feature

Line Breakdown

Category	Added	Removed
Production code	824	35
Tests	1584	8
Config / CI / tooling	1	0
Total	2409	43

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Screenshots (if applicable)

None yet.

Test Instructions

pnpm vitest run src/components/shared/Submitters src/components/Project src/components/shared/SecretsManagement src/services/teams src/routes/v2/pages/Editor/components/EditorMenuBar src/routes/v2/shared/components/AiChat/toolBridge src/agent/tools

With the same setup as #2941, plus a secret of your own and one of the team's:

1. Submit a pipeline that uses no secrets, or only yours, from a team's project. It goes as you. In the arguments dialog, choose Workspace: {workspace}, and the run's "Created by" is the team's id instead. Choose the workspace, then switch the dialog's project to one in another workspace: Run as goes back to that workspace's default.
2. Submit a pipeline that uses the team's secret. The button reads "Submit Run as {workspace}", and the run's "Created by" is the team's id. In the arguments dialog, "You" is disabled, with the reason.
3. Submit a pipeline that uses one secret of each. Submit Run opens the dialog, which says which secret is where.
4. Submit from a project whose team you're not in. The arguments dialog opens with "Runs as you" and a warning. Submitting from there runs as you.
5. Ask the Tangent agent to submit a pipeline that uses the team's secret. The run's "Created by" is the team's id, and the secret resolves. One that uses only your secret goes as you.
6. Submit outside any project. It behaves as on master.
7. Open a pipeline that uses the team's secret in the v2 editor. The Quick Run ▶ button has the workspace badge, and its tooltip names the workspace.

Additional Comments

• TangleSubmitter, QuickRunButton and SubmitTaskArgumentsDialog had no tests. They now have tests for the team cases.
• useRunIdentity is added to react-compiler.config.js, since it walks the whole pipeline spec for secret references.

🤖 Generated with Claude Code

[github-actions]

🎩 Preview

A preview build has been created at: cvs/submit-as-team/6888d85