[matt-richardson]

Builds on #239. Part of DPT-3614.

Why

#239 lists spaces only for connections with a literal API key. Connections that authenticate with OIDC, or hold the key in a build parameter, fell back to a typed name — the case that goes stale when a space is renamed. This lists spaces for those too:

• Parameter-held key: resolved the way a build would, from the step's build configuration or the connection's project. A parameter that's only set while a build runs is explained rather than guessed at.
• OIDC: the OIDC plugin issues an edit-time token for the build configuration being edited (teamcity-oidc-plugin#185), and Octopus exchanges it for an access token. Requires edit permission on that build configuration's project.

The dropdown is replaced with a text field that suggests the connection's spaces, because space names can be parameter references (%octopus.space%), which a dropdown can't hold. Choosing a suggestion, or typing a space's exact name, stores the id; anything else is stored as the name and resolved by TeamCity when the build runs.

Notes

• TeamCity internals. A step field can only have one autocomplete, and TeamCity's own one completes % parameter references. The picker drives that widget and delegates to TeamCity's parameter-completion functions after a %. These aren't a public API: if they change, the field falls back to suggesting spaces only, and always accepts typed text. An e2e test breaks them on the page to check this.
• connections-api-core dependency (provided, 2025.11 — the last version compiled for Java 8). The credentials API it holds exists from TeamCity 2023.05; on older servers, or with an OIDC plugin without Octopus-TeamCity vulnerable to CVE-2025-68161 #185, OIDC connections fall back to the text field with an "update the OIDC plugin" reason.
• When spaces can't be listed, the field shows "Unable to retrieve spaces, please enter space name manually" with a help icon whose tooltip gives the reason.
• e2e stack: TeamCity is now fronted by an HTTPS Caddy proxy (https://teamcity-tls), set as the root URL, with Octopus trusting its CA — the OIDC plugin only issues tokens for an HTTPS issuer. The full suite passes with this.
• The OIDC success e2e test is skipped in CI until a teamcity-oidc-plugin release includes Octopus-TeamCity vulnerable to CVE-2025-68161 #185 (CI downloads the latest release; set OIDC_PLUGIN_ZIP to run it).
• SpacePickerManualTest (the manual screenshot driver, skipped in CI) still targets the old dropdown and is left for a follow-up.

Screenshots

With no connection selected, the field is a plain text box with a note saying why there's nothing to suggest.

Choosing a connection loads its spaces, which are suggested as soon as the field is focused.

Picking a suggestion fills in the name and stores the space's id (Spaces-1).

After the space is renamed in Octopus, the step finds it by id and shows the new name, "Swordfish".

Spaces are still listed when the connection's API key comes from a password build parameter.

When the API key parameter is only set during a build, the spaces can't be listed and the field asks for a name.

Hovering over the help icon shows the specific reason.

An OIDC connection lists spaces: Octopus accepted the edit-time token for this build configuration.

The same OIDC connection, on a build configuration Octopus doesn't trust, can't list spaces.

The tooltip gives Octopus's reason for refusing the token.

A saved space that no longer exists in Octopus is flagged, and the saved value is left alone.

Typing % switches the suggestions to TeamCity's own parameter completion, so a space can be a parameter reference.

The connections used in these screenshots.

🤖 Generated with Claude Code