docs(search): document Generic Secrets and clarify source setup

Author: icecrasher321

apps/docs/content/docs/platform/connected-accounts.mdx

@@ -111,7 +111,7 @@ For administrators, the controls have different scopes:
 - **One pool per organization:** there are no additional groups, per-workflow grants, or per-account workspace allowlists.
 - **One Databricks configuration:** multiple tenant endpoints cannot be added as separate Databricks providers in the same pool.
 - **Organization operations are missing:** confirm the feature is enabled for the organization and the workflow's workspace is allowed.
-- **An invitation rejects your sign-in:** use the verified Sim account matching the invitation email. For OAuth providers, connect the provider account with that same email.
+- **An invitation rejects your sign-in:** use the verified Sim account matching the invitation email. The provider account can have a different email; the invitation stays bound to the verified Sim user.
 - **A Find operation fails:** it requires exactly one active matching connection. Check the invitation email, provider, connection status, and workspace access. It never chooses an arbitrary account when there are zero or multiple matches.
 - **A list seems incomplete:** organization list operations return up to 100 connections per page. Follow `nextCursor` while `hasMore` is true.
 - **A legacy Credential Group block fails:** replace it with the appropriate Credential block operation or trigger, update its output references, and redeploy the workflow.

apps/docs/content/docs/search/connect-your-account.mdx

@@ -26,7 +26,7 @@ You do not select repositories, channels, labels, or an indexing method while co
 | Confluence service account | Connect your own Confluence account. Both connections must be able to read the selected content. |
 | Coda | Connect your personal Coda MCP account. In service mode, the source token also verifies the parent document. |
 | GitLab | No personal connection. Your verified Sim email must match current GitLab identity and permissions, or the administrator's CSV mapping and project grant. |
-| Generic Secrets in Member mode | Open the source in Integrations and save your own secrets. These are available to Build mode, not document search. |
+| [Generic Secrets in Member mode](/search/generic-secrets) | Open the source in Integrations and save your own secrets. These are available to Build and Plan, not document search. |
 
 Gmail, Calendar, and Drive are separate connections. Connecting one does not authorize the others. A service account is a resource boundary, not a replacement for your personal connection, except for GitLab's explicit permission model.
 

apps/docs/content/docs/search/generic-secrets.mdx

@@ -0,0 +1,25 @@
+---
+title: Generic Secrets
+description: Share organization secrets or let each member keep their own for Build and Plan
+---
+
+Generic Secrets is a source for values that Build and Plan can use in code and requests. It does not add documents to Search, connect an external account, or start an indexing job. The editor is the same [secrets editor used in workspaces](/platform/credentials).
+
+## Add the source
+
+An organization admin opens **Settings → Sources → Add source → Generic Secrets** and chooses one mode:
+
+| Mode | Who manages the values | Who can use them in Build and Plan |
+| --- | --- | --- |
+| **Organization** | Organization admins open **Secrets** from the source in Settings. | Organization members with Build access use the shared values. Members cannot open the editor to view them. |
+| **Member** | Each person opens **Integrations → Generic Secrets → Manage secrets**. | That person uses only their own values in the organization. |
+
+Only the selected mode is active. The admin can change it through **Configure** on the source. Removing the source deletes its organization and member secrets, so review the confirmation before doing so.
+
+## Use a secret in Build or Plan
+
+Save a name and value in the editor, then ask Build or Plan to run code that needs it. These modes can see available **names** and mount only the names needed by `run_code` or `run_function`. The values become environment variables for that code, so it can use them in a request such as `curl` without putting the value in the prompt.
+
+In an organization Build or Plan conversation targeting a workspace, an organization secret with the same name takes precedence over a workspace secret. In Member mode, the source resolves the current member's values; it does not read another member's secrets.
+
+Generic Secrets are available **only in Build and Plan modes**. Search, the Search assistant, Search MCP, and Sim Search in Slack cannot mount them. Workspace secrets remain a separate resource.

apps/docs/content/docs/search/index.mdx

@@ -5,17 +5,17 @@ description: Search connected sources live with each person's current access
 
 Search queries your connected providers when you ask a question. It does not copy their documents into a Sim vector index or wait for a background sync.
 
-An organization admin adds integrations under **Settings → Sources**. Teammates connect their accounts under **Integrations** in the main sidebar. Credential Groups remain a separate feature for sharing account connections with workflows.
+An organization admin adds sources under **Settings → Sources**. Teammates connect their provider accounts under **Integrations** in the main sidebar. Credential Groups remain a separate feature for sharing account connections with workflows.
 
 ## Add your first source
 
-1. Open **Settings → Sources → Add source** and choose an integration.
-2. Choose **Member accounts** or, when supported, **Service account**. GitHub calls the second mode **GitHub App**. Slack and Jira use member accounts; GitLab uses a service account.
-3. For member mode, save the source. For service mode, add or select a connection and configure its resources. GitHub uses **Add repository** for each repository; GitLab uses **Add project** for each project.
-4. Open **Integrations** and connect your personal account, including when you are the admin. GitLab is the exception: its configured project permissions identify readers without a personal connection.
-5. Open **Search**, or ask the assistant on **Home** about a document you can access.
+1. Open **Settings → Sources → Add source** and choose a provider or Generic Secrets.
+2. For a searchable provider, choose **Member accounts** or, when supported, **Service account**. GitHub calls the second mode **GitHub App**. Slack and Jira use member accounts; GitLab uses a service account. [Generic Secrets](/search/generic-secrets) instead offers **Organization** and **Member**.
+3. For provider member mode, save the source. For service mode, add or select a connection and configure its resources. GitHub uses **Add repository** for each repository; GitLab uses **Add project** for each project.
+4. For provider sources, open **Integrations** and connect your personal account, including when you are the admin. GitLab is the exception: its configured project permissions identify readers without a personal connection. Generic Secrets uses its built-in editor and needs no provider authorization.
+5. For a provider source, open **Search** or ask the assistant on **Home** about a document you can access. For Generic Secrets, use [Build or Plan](/search/generic-secrets).
 
-Adding a source makes that integration available for members to connect. A provider that needs deployment or app configuration must have that configuration completed before account authorization can succeed.
+Adding a member-account provider source makes that integration available for members to connect. A provider that needs deployment or app configuration must have that configuration completed before account authorization can succeed.
 
 ## Choose the right connection method
 
@@ -46,7 +46,7 @@ These nine providers support live Search. Google Docs, Sheets, and Slides are ac
 | [Jira](/search/jira) | Jira Cloud JQL and issue APIs | Member only |
 | [Slack](/search/slack) | Slack real-time search with the member's user token | Member only |
 
-**Generic Secrets** is also available as a source, but does not add searchable documents. Organization mode makes its secrets available across the organization; Member mode lets each person manage their own secrets in Integrations. The Build assistant can use these secrets for requests. Search mode cannot use them to run arbitrary integration calls.
+[Generic Secrets](/search/generic-secrets) is also available as a source, but does not add searchable documents. Organization mode makes its secrets available across the organization; Member mode lets each person manage their own secrets in Integrations. Build and Plan can use these secrets for requests; Search cannot mount them.
 
 ## Access and freshness
 

apps/docs/content/docs/search/meta.json

@@ -2,6 +2,7 @@
   "title": "Search",
   "pages": [
     "connect-your-account",
+    "generic-secrets",
     "mcp",
     "coda",
     "confluence",