Merge remote-tracking branch 'origin/staging' into staging-v11

Author: icecrasher321

.github/workflows/ci-cache-cleanup.yml

@@ -0,0 +1,32 @@
+name: CI Cache Cleanup
+
+# test-build.yml keys the Next.js build cache sticky disk per branch, so every PR
+# leaves a ~5 GB volume behind. Branches are short-lived; the disks aren't. Only
+# the pull_request disks are reclaimed — the push disks belong to main/staging/dev
+# and must stay warm.
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions:
+  contents: read
+
+jobs:
+  delete-nextjs-cache:
+    name: Delete Next.js build cache disk
+    # Sticky disks only exist on Blacksmith; the GitHub break-glass path uses
+    # actions/cache, which expires on its own.
+    if: vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 5
+
+    steps:
+      # Must stay byte-identical to the Mount Next.js build cache key in
+      # test-build.yml, or this deletes nothing and the disks accumulate.
+      # Non-blocking: PRs skipped by ci.yml's paths-ignore never made a disk.
+      - name: Delete sticky disk
+        uses: useblacksmith/stickydisk-delete@b41313d28b8647d72114c9ba3c96bb04061562b6 # v1
+        continue-on-error: true
+        with:
+          delete-key: ${{ github.repository }}-nextjs-cache-pull_request${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ github.head_ref }}

.github/workflows/test-build.yml

@@ -265,14 +265,21 @@ jobs:
 
       # Turbopack's persistent build cache (NEXT_TURBOPACK_BUILD_CACHE below)
       # writes ~5 GB into .next/cache — a sticky disk mounts it in ~1s where an
-      # actions/cache round-trip would eat the warm-build win. Same event/fork
-      # namespacing as the other mounts; the GitHub fallback inside cache-mount
-      # still uses actions/cache with a run_id-suffixed key.
+      # actions/cache round-trip would eat the warm-build win.
+      #
+      # Keyed per branch, not just per event. A sticky disk is one mutable volume
+      # per key: mounting clones the last committed snapshot, job end commits back
+      # last-write-wins. An event-only key had every open PR restoring a cache
+      # built from a different branch — 14.0 min vs 9.3 min for the single-writer
+      # push disk on the same commit. Branch scoping also keeps us off
+      # cross-commit restore, which turbopackFileSystemCacheForBuild (beta) does
+      # not document as supported (vercel/next.js#87283: stale HTML from a cache
+      # built at another commit). ci-cache-cleanup.yml reclaims the disks.
       - name: Mount Next.js build cache
         uses: ./.github/actions/cache-mount
         with:
           provider: ${{ vars.CI_PROVIDER }}
-          key: ${{ github.repository }}-nextjs-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
+          key: ${{ github.repository }}-nextjs-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ github.head_ref || github.ref_name }}
           path: ./apps/sim/.next/cache
 
       # Running out of RAM kills the whole VM and surfaces only as "the runner
@@ -293,6 +300,13 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile --ignore-scripts
 
+      # The disk mounts successfully whether or not it carried anything and turbo
+      # buffers the build log, so cache warmth is otherwise unobservable — #5859
+      # shipped a cache that carried almost nothing and it took a PR to notice.
+      # Reported, never gated.
+      - name: Report Next.js cache size (pre-build)
+        run: du -sh apps/sim/.next/cache 2>/dev/null || echo 'cold — no cache restored'
+
       - name: Build application
         env:
           NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
@@ -304,7 +318,13 @@ jobs:
           AWS_REGION: 'us-west-2'
           ENCRYPTION_KEY: '7cf672e460e430c1fba707575c2b0e2ad5a99dddf9b7b7e3b5646e630861db1c' # dummy key for CI only
           TURBO_CACHE_DIR: .turbo
-          # Opt into Turbopack's persistent build cache (beta) for this CI
-          # check build only — measured 105s cold vs 22s warm locally.
+          # Opt into Turbopack's persistent build cache (beta) for this CI check
+          # build only. #5869's 105s-cold/22s-warm was measured locally and has
+          # never reproduced in CI (compile has ranged 3.5-17.8 min) — local
+          # numbers, not a CI target.
           NEXT_TURBOPACK_BUILD_CACHE: '1'
         run: bunx turbo run build --filter=sim
+
+      - name: Report Next.js cache size (post-build)
+        if: always()
+        run: du -sh apps/sim/.next/cache 2>/dev/null || echo 'no cache written'

apps/sim/blocks/blocks/pi.ts

@@ -3,10 +3,12 @@ import { getEnv, isTruthy } from '@/lib/core/config/env'
 import type { BlockConfig } from '@/blocks/types'
 import { AuthMode, IntegrationType } from '@/blocks/types'
 import {
+  getApiKeyCondition,
   getPiModelOptions,
   getProviderCredentialSubBlocks,
   PROVIDER_CREDENTIAL_INPUTS,
 } from '@/blocks/utils'
+import { isPiByokOnlyMode } from '@/providers/pi-providers'
 import type { ToolResponse } from '@/tools/types'
 
 interface PiResponse extends ToolResponse {
@@ -110,6 +112,20 @@ function getSearchApiKeyCondition() {
   }
 }
 
+const hostedModelApiKeyCondition = getApiKeyCondition()
+
+/**
+ * API Key visibility for the Pi block.
+ *
+ * Create PR hands the model key to the sandbox as an environment variable, so
+ * Sim never supplies a hosted key there — the field is shown for every model,
+ * including ones that are hosted elsewhere in Sim. Review Code and Local Dev
+ * keep the model client inside Sim, so they follow the standard hosted-model
+ * rule and hide the field when Sim covers the key.
+ */
+const piApiKeyCondition = (values?: Record<string, unknown>) =>
+  isPiByokOnlyMode(values?.mode) ? CLOUD : hostedModelApiKeyCondition(values)
+
 export const PiBlock: BlockConfig<PiResponse> = {
   type: 'pi',
   name: 'Pi Coding Agent',
@@ -122,7 +138,7 @@ export const PiBlock: BlockConfig<PiResponse> = {
   - Enable Babysit Mode on Create PR when trusted review bots and required checks should be monitored and fixed in bounded rounds.
   - Use Review Code to analyze an existing PR and leave summary + inline review comments.
   - Use Local Dev to edit a repo on your own machine; expose the machine on a public hostname/tunnel so Sim can reach it over SSH.
-  - Create PR requires your own provider API key because the model runs in the sandbox. Review Code keeps the model key in Sim and can use either BYOK or a hosted key.
+  - Create PR requires your own provider API key for every model, including ones Sim hosts, because the model runs in the sandbox. Review Code and Local Dev keep the model key in Sim and can use either BYOK or a hosted key.
   - Internet Search is off by default and always needs your own key for the selected provider, entered on the block. There is no workspace BYOK fallback and no hosted key. Leave it on None unless the task genuinely needs external information.
   `,
   category: 'blocks',
@@ -178,8 +194,15 @@ export const PiBlock: BlockConfig<PiResponse> = {
       options: getPiModelOptions,
       commandSearchable: true,
     },
-
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks().map((subBlock) =>
+      subBlock.id === 'apiKey'
+        ? {
+            ...subBlock,
+            placeholder: 'Enter your API key for the selected model',
+            condition: piApiKeyCondition,
+          }
+        : subBlock
+    ),
 
     {
       id: 'searchProvider',

apps/sim/blocks/pi-api-key-condition.test.ts

@@ -0,0 +1,58 @@
+/**
+ * @vitest-environment node
+ */
+import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing'
+import { afterAll, afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { evaluateSubBlockCondition } from '@/lib/workflows/subblocks/visibility'
+import { PiBlock } from '@/blocks/blocks/pi'
+import { getHostedModels } from '@/providers/utils'
+
+const apiKeySubBlock = PiBlock.subBlocks.find((subBlock) => subBlock.id === 'apiKey')
+const hostedModel = getHostedModels()[0]
+
+function isApiKeyVisible(values: Record<string, unknown>): boolean {
+  return evaluateSubBlockCondition(apiKeySubBlock?.condition, values)
+}
+
+describe('Pi API Key visibility', () => {
+  beforeEach(() => {
+    setEnvFlags({ isHosted: true })
+  })
+
+  afterEach(() => {
+    setEnvFlags({ isHosted: false })
+  })
+
+  afterAll(resetEnvFlagsMock)
+
+  it('exposes an apiKey subblock that is required when visible', () => {
+    expect(apiKeySubBlock).toBeDefined()
+    expect(apiKeySubBlock?.required).toBe(true)
+  })
+
+  // The bug this guards: the field used to hide for hosted models in every mode,
+  // and Create PR then failed at execution demanding a BYOK key the user was
+  // never asked for.
+  it('shows the field in Create PR even for a model Sim hosts', () => {
+    expect(hostedModel).toBeDefined()
+    expect(isApiKeyVisible({ mode: 'cloud', model: hostedModel })).toBe(true)
+  })
+
+  it('shows the field in Create PR for a model Sim does not host', () => {
+    expect(isApiKeyVisible({ mode: 'cloud', model: 'some-unhosted-model' })).toBe(true)
+  })
+
+  it.each([['local'], ['cloud_review']])(
+    'hides the field in %s mode for a model Sim hosts',
+    (mode) => {
+      expect(isApiKeyVisible({ mode, model: hostedModel })).toBe(false)
+    }
+  )
+
+  it.each([['local'], ['cloud_review']])(
+    'shows the field in %s mode for a model Sim does not host',
+    (mode) => {
+      expect(isApiKeyVisible({ mode, model: 'some-unhosted-model' })).toBe(true)
+    }
+  )
+})

apps/sim/executor/handlers/pi/keys.ts

@@ -18,6 +18,7 @@ import type { PiSupportedProvider } from '@/providers/pi-provider-configs'
 import {
   getPiProviderApiKeyEnvVar,
   getPiWorkspaceBYOKProviderId,
+  isPiByokOnlyMode,
   isPiSupportedProvider,
 } from '@/providers/pi-providers'
 
@@ -45,7 +46,7 @@ export async function resolvePiModelKey(params: ResolvePiModelKeyParams): Promis
     return { apiKey: params.apiKey, isBYOK: true }
   }
 
-  if (params.mode === 'cloud') {
+  if (isPiByokOnlyMode(params.mode)) {
     const workspaceBYOKProviderId = getPiWorkspaceBYOKProviderId(providerId)
     if (params.workspaceId && workspaceBYOKProviderId) {
       const byok = await getBYOKKey(params.workspaceId, workspaceBYOKProviderId)