Visible credential target selector for secret writes; SDK Result import cleanup

[RhysSullivan]

Adds CredentialTargetSelector to the secret-create dialog, exposing the
full URL-context stack with the labels the plan in
notes/cloud-workspaces-and-global-sources-plan.md calls for:

• Only me in this workspace → user-workspace
• Everyone in → workspace
• Only me across this org → user-org
• Everyone in → org

Default selection is the URL context's active write scope (workspace in
workspace context, org in global). Local CLI hosts run a single-scope
stack and the selector renders one disabled option labeled with that
scope.

Server side, assertScopedWrite already rejects writes whose scope_id
is outside the URL-resolved stack as a typed StorageError; the new
credential-target.node.test.ts exercises both halves of the contract:

• All four legal targets in workspace context succeed and list back
  tagged with the correct scope id.
• A cross-org write from workspace context is rejected.

Connection writes in v1 still default to the source-add form's
configured tokenScope and bindingScope (per-user); a future change
can layer this selector into the OAuth setup flow without changing the
server contract.

[RhysSullivan]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Policies expose the full storage stack with target selector #513
• Visible credential target selector for secret writes; SDK Result import cleanup #512 👈 (View in Graphite)
• Reject source writes to personal scopes; visible target selector in add-source forms #511
• Surface overridden sources in sources.list, split sidebar by scope #510
• Add activeWriteScopeId to scope.info, expose useActiveWriteScopeId #509
• Add /:org/:workspace context for web and API #508
• WIP: move file routes under /$org and reshape auth.me #507 : 1 other dependent PR (#514 )
• Add scope-stack builders, URL-context resolver, workspace executor #506
• Add workspaces CRUD API under OrgHttpApi #505
• Cut over scope ids to deterministic prefixed form #504
• Add organizations.handle and workspaces table #503
• Add cloud id helpers: prefixed local ids, scope id constructors, handle slugifier #502
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	5b7d768	Commit Preview URL Branch Preview URL	May 04 2026, 05:12 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	5b7d768	May 04 2026, 05:13 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@512

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@512

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@512

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@512

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@512

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@512

@executor-js/storage-core

npm i https://pkg.pr.new/@executor-js/storage-core@512

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@512

@executor-js/plugin-google-discovery

npm i https://pkg.pr.new/@executor-js/plugin-google-discovery@512

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@512

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@512

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@512

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@512

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@512

executor

npm i https://pkg.pr.new/executor@512

commit: 5b7d768