[TigerYWang]

What changes

Apps can use a key from Keys (ANTHROPIC_API_KEY, say), so nobody copies it into each new app.

• Keys: "Every app in this workspace can use it", one switch per key on This workspace's own keys. It is never shown on the owner's keys for all their workspaces, or on another workspace's key switched on here. Every app gets the key as a variable of the same name when it's built, new apps included. It needs no app row, so a brand new app gets it with nobody acting and the owner's Mac off. It shows where Your Apps shows (appsShown).
• An app's Variables: "From Keys", the app's keys from Keys by name (every app's, its own, and "Keys has none now" when a key is gone), plus "Use a key from Keys" to give the app one under a name of its choosing. The same part is in a member's settings in a shared workspace. It shows for someone with Keys; adding or removing one app's link there also needs Your Apps at Write.
• Server. lib/server/app-keys.ts and app/api/keys/apps (GET, PUT; Bops window only; under /api/keys, so it works in a shared workspace). It calls orgo-web's /api/projects/{id}/bops-keys/apps with the user's own Orgo key. The project is the open workspace's (keysProject, or the shared copy's), never one from the request. projectKeys in shared-keys.ts is exported and takes PUT. Only names are sent or answered; anything else orgo-web sends is dropped.
• Older orgo-web. A 405 (the path falls into bops-keys/{name}), a 404 that isn't orgo-web's own, or 503 APP_KEYS_UNAVAILABLE makes the list say old. The window then shows "Orgo can't link keys to apps yet." and no switches.
• settingsOf maps orgo-web's new env_from_keys to AppSettingsAnswer.keyed, names only. An older orgo-web leaves it out.
• The work_on_app goal tells the bot that a key from Keys comes as a variable, to read it from the environment, and never to write it into the folder, a commit or a chat.
• New UI lives in components/app/app-key-links.tsx. The mounts are one line each in app-settings.tsx, shared-apps.tsx and keys.tsx, away from Your Apps: review changes before publishing #186's hunks.

Why

A shared workspace's Admin keeps the Anthropic key in Keys, and every new client app needs it as an environment variable. Today the owner pastes it into each app by hand from their own Mac. With this change, orgo-web (OrgoAI/orgo-web#1841) keeps the link and fills the value in at each build from the owner's vault for the workspace. Only names pass through Bops: the owner's Mac, a member's Bops, Bops Cloud and runners never see the value. Deploys from any Mac or runner version get it.

How I checked it

• node --conditions=react-server scripts/test-keys.mjs: 51 passed (3 new). In the owner's workspace: the link goes to the workspace's own project with the user's key, never one from the request, and no value is sent. In a shared workspace: every app's link needs Keys, one app's also needs Write, and both are refused before Orgo is asked. Bad names are refused in plain words. Only from the window, and only where apps are open. Older orgo-web (405, a page 404, 503) reads as old. Anything but names from orgo-web is dropped.
• node --conditions=react-server scripts/test-hosted-apps.mjs: 143 passed (1 new: env_from_keys to keyed, names only).
• node scripts/test-hosted-apps-ui.mjs: 74 passed (1 new). It covers the From Keys rows, Remove only on the app's own links, the picker only for those who may, the Every app switch only on This workspace's own keys, the older Orgo line, no dashes in the copy, and the three mount lines.
• node scripts/test-shared.mjs: 70 passed.
• npx next typegen, npx tsc --noEmit -p ., npx tsc -p cloud/tsconfig.json --noEmit, npm run lint: clean (no warnings in touched files). check-public.sh: OK.

Not done or limits

• The switches do nothing until orgo-web#1841 and its migration are live. Until then the window says "Orgo can't link keys to apps yet."
• No Bops Cloud or protocol change and no new act. orgo-web enforces who may link.
• Built on main while Your Apps: review changes before publishing #186 is open. The mounts are single lines, but the shared-apps.tsx mount sits inside SettingsPart, which Your Apps: review changes before publishing #186 wraps in a disclosure. A rebase there may need a one-line touch.
• Published on GitHub (AppHosting.github) doesn't get keys: the link reaches Orgo deploys only. Keys never go to GitHub.
• A removed app's links stay on orgo-web, and a new app with the same name gets them.

[TigerYWang]

Shipped inside #191 for 0.0.52.