feat(pi): require the user's own API key for Create PR even on hosted models

[j15z]

Summary

• Create PR mode runs the model inside the sandbox, so Sim can never supply a hosted key for it — the block now always shows (and requires) the API Key field in Create PR mode, even for models Sim hosts
• Added a shared isPiByokOnlyMode predicate in providers/pi-providers.ts consumed by all three enforcement sites (block condition, copilot edit-workflow validation, executor key resolution) so they can't drift
• Copilot edit-workflow validation no longer strips the user's apiKey on a Create PR Pi block; Local Dev and Review Code keep the normal hosted-model rules
• Tests for the field visibility condition and the validation exemption

Type of Change

• New feature

Testing

Tested manually; vitest passing (validation, pi handler, new visibility tests); lint + full audit suite passing

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 29, 2026 6:38pm

[cursor]

PR Summary

Medium Risk
Changes how API keys are collected, validated, and resolved for Pi across editor, copilot, and executor; mistakes could block Create PR runs or leak incorrect key expectations, though scope is limited to Pi modes and is covered by new tests.

Overview
Create PR runs the model inside the sandbox, so Sim cannot inject a hosted key. The Pi block now always shows and requires the model API Key field in Create PR (cloud), even when the selected model is one Sim hosts elsewhere.

A shared isPiByokOnlyMode helper in pi-providers.ts keeps three paths aligned: the block's piApiKeyCondition (UI visibility), resolvePiModelKey (execution still BYOK-only in Create PR), and copilot preValidateCredentialInputs (no longer strips apiKey for hosted models on Create PR Pi blocks). Local Dev and Review Code still hide the field and allow hosted keys when Sim covers the model.

Docs/best-practices on the Pi block were updated, with new tests for visibility and hosted-model validation exemption.

^{Reviewed by Cursor Bugbot for commit 3896d31. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

Require the user's own API key for Pi Create PR mode even when the selected model is Sim-hosted, using one shared BYOK-only mode predicate across UI, copilot validation, and executor key resolution.

• Add isPiByokOnlyMode (mode === 'cloud') in providers/pi-providers.ts
• Always show/require the Pi apiKey field in Create PR; keep hosted-model hide rules for Review Code and Local Dev
• Exempt Create PR Pi blocks from hosted-model apiKey stripping in edit-workflow validation
• Route executor Create PR key resolution through the same predicate; add visibility and validation tests

Confidence Score: 5/5

Safe to merge; the three enforcement sites stay aligned and no blocking defect was found.

Create PR always surfaces and retains a user key for sandbox execution, while Review Code and Local Dev keep normal hosted-key behavior; tests cover visibility and validation, and key resolution already matched this contract.

Important Files Changed

Filename	Overview
apps/sim/providers/pi-providers.ts	Introduces shared isPiByokOnlyMode so Create PR BYOK enforcement cannot drift across call sites.
apps/sim/blocks/blocks/pi.ts	Overrides apiKey condition to always show in Create PR; other modes keep getApiKeyCondition behavior.
apps/sim/lib/copilot/tools/server/workflow/edit-workflow/validation.ts	Skips hosted-model apiKey stripping for Pi Create PR while preserving strip behavior for other Pi modes and LLM blocks.
apps/sim/executor/handlers/pi/keys.ts	Uses the shared predicate for Create PR BYOK-only resolution instead of a raw mode === cloud check.
apps/sim/blocks/pi-api-key-condition.test.ts	Covers Create PR visibility for hosted and unhosted models and hide/show rules for local and cloud_review.
apps/sim/lib/copilot/tools/server/workflow/edit-workflow/validation.test.ts	Adds hosted-model preValidate tests proving Pi Create PR keeps apiKey and other modes still strip it.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Mode[Pi mode value]
  Pred{isPiByokOnlyMode mode === cloud}
  UI[Block API Key field always visible]
  Val[edit-workflow keeps user apiKey]
  Keys[resolvePiModelKey requires BYOK or workspace BYOK]
  Hosted[Normal hosted-model hide/strip + getApiKeyWithBYOK]
  Mode --> Pred
  Pred -->|yes Create PR| UI
  Pred -->|yes| Val
  Pred -->|yes| Keys
  Pred -->|no Review/Local| Hosted

Loading

_{Reviews (1): Last reviewed commit: "feat(pi): require the user's own API key..." | Re-trigger Greptile}