diff --git a/src/renderer/src/components/agent-pane/secret-request-repo-write.ts b/src/renderer/src/components/agent-pane/secret-request-repo-write.ts
new file mode 100644
index 00000000000..7ea5e0db8bb
--- /dev/null
+++ b/src/renderer/src/components/agent-pane/secret-request-repo-write.ts
@@ -0,0 +1,29 @@
+// Repo-scope write check for the S4-b secret request card (use-secret-request-card.ts), split out to keep that
+// hook under the file-length limit.
+/** Whether this person can write the workspace repo's scope; asked once per repo per session. */
+const repoWriteCache = new Map<string, Promise<boolean>>()
+
+export function canWriteRepo(repoKey: string): Promise<boolean> {
+  let pending = repoWriteCache.get(repoKey)
+  if (!pending) {
+    const api = window.api.cloudSecrets
+    pending = api
+      ? api.effective({ repo: repoKey }).then(
+          (result) => result.ok && result.value.caller.canWrite.repo,
+          () => false
+        )
+      : Promise.resolve(false)
+    // A failed read is retried next time rather than cached as "no".
+    void pending.then((value) => {
+      if (!value) {
+        repoWriteCache.delete(repoKey)
+      }
+    })
+    repoWriteCache.set(repoKey, pending)
+  }
+  return pending
+}
+
+export function resetSecretRequestCardCachesForTests(): void {
+  repoWriteCache.clear()
+}
diff --git a/src/renderer/src/components/agent-pane/use-secret-request-card.ts b/src/renderer/src/components/agent-pane/use-secret-request-card.ts
index 9c944273351..c5b23277ad7 100644
--- a/src/renderer/src/components/agent-pane/use-secret-request-card.ts
+++ b/src/renderer/src/components/agent-pane/use-secret-request-card.ts
@@ -29,6 +29,7 @@ import {
 } from '../../../../shared/secret-request-contract'
 import { cloudWorkspaceSecretsMode } from '@/lib/orca-cloud/cloud-workspace-secrets-mode'
 import type { CloudSecretsErrorCode } from '../../../../shared/cloud-secrets/cloud-secrets-wire'
+import { canWriteRepo } from './secret-request-repo-write'
 import type {
   SecretRequestCardActions,
   SecretRequestCardModel,
@@ -46,33 +47,7 @@ const TRANSPORT_FAILURES: ReadonlySet<CloudSecretsErrorCode> = new Set([
   'unknown'
 ])
 
-/** Whether this person can write the workspace repo's scope; asked once per repo per session. */
-const repoWriteCache = new Map<string, Promise<boolean>>()
-
-function canWriteRepo(repoKey: string): Promise<boolean> {
-  let pending = repoWriteCache.get(repoKey)
-  if (!pending) {
-    const api = window.api.cloudSecrets
-    pending = api
-      ? api.effective({ repo: repoKey }).then(
-          (result) => result.ok && result.value.caller.canWrite.repo,
-          () => false
-        )
-      : Promise.resolve(false)
-    // A failed read is retried next time rather than cached as "no".
-    void pending.then((value) => {
-      if (!value) {
-        repoWriteCache.delete(repoKey)
-      }
-    })
-    repoWriteCache.set(repoKey, pending)
-  }
-  return pending
-}
-
-export function resetSecretRequestCardCachesForTests(): void {
-  repoWriteCache.clear()
-}
+export { resetSecretRequestCardCachesForTests } from './secret-request-repo-write'
 
 function useWorkspaceRepoKey(worktreeId: string | null): string | null {
   return useAppStore((state) => {
@@ -220,7 +195,9 @@ export function useSecretRequestCard(args: {
     : repoScope
       ? ['personal', 'repo']
       : ['personal']
-  const effectiveScope: SecretRequestScope = scopes.includes(scope) ? scope : (scopes[0] ?? 'personal')
+  const effectiveScope: SecretRequestScope = scopes.includes(scope)
+    ? scope
+    : (scopes[0] ?? 'personal')
 
   const add = useCallback(async () => {
     const api = window.api.cloudSecrets
@@ -259,7 +236,17 @@ export function useSecretRequestCard(args: {
       requestId,
       outcome === 'provided' ? 'saved' : 'savedAfterExpiry'
     )
-  }, [value, local, scopes.length, environmentId, requestId, effectiveScope, repoKey, event.name, t])
+  }, [
+    value,
+    local,
+    scopes.length,
+    environmentId,
+    requestId,
+    effectiveScope,
+    repoKey,
+    event.name,
+    t
+  ])
 
   const phase: SecretRequestCardPhase =
     local === 'saving'