[yordis]

Problem

Stacked on #27756, whose commits this branch carries until they merge, so only the last commit is new here. A usage-limit source's management key still has to be pasted into T3 Code, so teams that keep credentials in 1Password cannot read it from there.

Change

• The management key of a usage-limit source accepts a secret reference as well as a literal, picked with the existing source input in the add-source dialog.
• A reference is stored as written and shown as written to clients; a literal still goes to the secret store.
• The server reads the reference when it queries the source. If the provider cannot read it, the source reports that the key could not be read from its secret provider rather than querying with an empty key.

Scope and approval

Third step of the stack that starts at #27746, reusing SecretResolver and SecretSourceInput unchanged and gated by the same secrets feature flag. It adds no provider kind and no new setting.

Verification

• vp test run src/usage/UsageLimitSources.test.ts src/serverSettings.test.ts in apps/server: pass. Covers reading a key from a reference, and the clear failure when the provider cannot read it.
• vp run typecheck: pass. vp run check:changed: format, lint, knip, typecheck, react compiler pass. Eight tests in ProviderEventIngestor.test.ts and CodexAdapterV2.test.ts fail in this environment; neither file is touched by this change.
• Not checked: a live 1Password account.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

This change lacks the UI evidence required by verification. AddUsageLimitSourceDialog replaces the management-key input with SecretSourceInput, but the PR supplies no before/after screenshots of that dialog or recording of choosing a reference and saving it. The focused resolver tests and parent source-control-host captures do not demonstrate the changed usage-source flow. Please attach matching dialog captures and a short recording of selection, save and the resulting source status, report the lookup check and any live-provider limits, and request reconsideration. Reusing an established secret-resolver capability does not remove this evidence requirement.

[maria-rcks]

Note

Written by claude-opus-5-5 on behalf of Maria

Reopening. An automated triage pass closed this by mistake; the closing comment above does not apply. Sorry for the noise.