fix(pi): drop the workspace BYOK fallback for the search key

A fallback exists so a key has somewhere to go when the field is unavailable.
The Search API Key field is unconditionally available: unlike the model key,
whose visibility runs through `shouldRequireApiKeyForModel` and its `isHosted`
branch, `getSearchApiKeyCondition` gates only on whether a provider is
selected. So the fallback never had a configuration to cover.

Removing it also closes an escalation. Workspace BYOK keys are admin-managed
and the API only ever returns them masked, yet `resolvePiSearchKey` would
resolve one for any member who could run the block — and in Create PR that key
is handed to the sandbox as an environment variable, which Pi copies into every
bash child. A member could read a credential the product deliberately never
shows them. Requiring the key on the block keeps the sandbox exposure to a key
its author already holds.

Nothing depends on the fallback: it has never shipped.

- `resolvePiSearchKey` is now synchronous and returns the key, since there is
  no lookup left to await. `byokProviderId` leaves the search registry and
  `PiSearchKeySource` / `PiSearchKeyResolution` are gone — with one source,
  `keySource` carried no information, and the logging rationale for it (a block
  field silently shadowing a stored key) no longer exists.
- The field is now `required`. Safe alongside its condition: the serializer's
  required check returns early for fields that are not visible, so a Pi block
  with search off still validates. Pinned by a test.

Docs and the block's tooltip, placeholder, and best practices updated. The
Create PR key-exposure callout now explains the missing fallback rather than
recommending the block field as a way around it.

Author: icecrasher321

apps/docs/content/docs/en/workflows/blocks/pi.mdx

@@ -67,12 +67,12 @@ Your key for the chosen provider. On hosted Sim it is optional for Local Dev and
 
 Off by default. Pick a provider — **Exa**, **Serper**, **Parallel AI**, or **Firecrawl** — and the agent gains a single `web_search` tool that returns a handful of results, each with a title, URL, snippet, and (where the provider reports one) a publication date. It works the same way in all three modes, and it is the agent's only network access in Review Code. The tool accepts at most 20 calls **per block execution**, which bounds accidental tool loops. A Pi block inside a Loop or Parallel gets that allowance again on every iteration, so bound the iteration count too if you care about what a single workflow run can spend.
 
-Search always uses **your own key** for the selected provider, never a Sim-hosted one, because Create PR places the key inside the coding sandbox. Enter it in **Search API Key** or store it in **Settings → BYOK**; the run fails with a setup error before any sandbox is created when neither is present. Changing the provider in the editor clears the key field, so re-enter the key that belongs to the provider you picked — a workflow you import, fork, or update through the API keeps whatever key was saved, so check it there.
+Search always uses **your own key** for the selected provider, entered in the block's **Search API Key** field. That field is the only source: there is no workspace BYOK fallback and Sim never supplies a hosted search key, so unlike the model key this field appears on every deployment. Leave it empty and the run fails with a setup error before any sandbox is created. Changing the provider in the editor clears the field, so re-enter the key that belongs to the provider you picked — a workflow you import, fork, or update through the API keeps whatever key was saved, so check it there.
 
 <Callout type="warn">
   **Create PR exposes both keys to the agent.** Create PR runs the model client and the search client *inside* the sandbox, so the model key and the search key reach it as environment variables — and Pi copies its own environment into every shell command it runs. Your prompt, or instructions injected through the contents of the cloned repository, can therefore read either key and write it anywhere the agent can reach, including into the pull request itself. Sim strips verbatim key text out of run output, but that does not stop an agent that encodes the value first.
 
-  This matters most for keys stored in **Settings → BYOK**, which belong to the workspace rather than to you. Sim otherwise only ever displays those masked, and only workspace admins can add or remove them — but anyone who can run a Pi block in Create PR mode can read the raw value. When that is not acceptable for a given key, put a separate key on the block's own **Search API Key** field instead of relying on the BYOK fallback, and scope it to something you are willing to rotate.
+  This is why the search key has no **Settings → BYOK** fallback. Workspace BYOK keys belong to the workspace rather than to you — Sim only ever displays them masked, and only workspace admins can add or remove them — so resolving one here would let anyone who can run a Pi block read a credential they cannot otherwise see. Requiring the key on the block keeps the exposure to a key its author already holds. Scope it to something you are willing to rotate.
 </Callout>
 
 Results are third-party data. The agent is instructed to treat them as quoted evidence and never to follow instructions found inside them — the same posture Pi takes toward repository contents.
@@ -192,7 +192,7 @@ Enable sandbox execution as for Create PR. BYOK is optional because the model cr
   { question: "Why does Local Dev need a public hostname?", answer: "Sim connects over raw SSH and blocks localhost, LAN, and private/reserved addresses for safety. Expose the machine with a TCP tunnel such as `ngrok tcp 22` and use the tunnel's host and port. Tailscale's private 100.x addresses won't work for the same reason." },
   { question: "What GitHub permissions does Create PR need?", answer: "A token that can clone, push, and open a PR. With a fine-grained token: select the repo and grant Contents: Read and write plus Pull requests: Read and write. With a classic token: the repo scope. For organization repos, the token must be SSO-authorized." },
   { question: "What GitHub permissions does Review Code need?", answer: "A token that can clone the repo and submit a review. With a fine-grained token: Contents: Read plus Pull requests: Read and write. Push permission is not required. With a classic token: the repo scope. For organization repos, the token must be SSO-authorized." },
-  { question: "Can the agent search the web?", answer: "Only if you pick a provider under Internet Search — Exa, Serper, Parallel AI, or Firecrawl. That adds one web_search tool in every mode, backed by your own key for that provider (on the block or in Settings → BYOK); Sim never supplies a search key. Leave it on None and the agent has no search tool at all." },
+  { question: "Can the agent search the web?", answer: "Only if you pick a provider under Internet Search — Exa, Serper, Parallel AI, or Firecrawl. That adds one web_search tool in every mode, backed by your own key for that provider, entered on the block; there is no BYOK fallback and Sim never supplies a search key. Leave it on None and the agent has no search tool at all." },
   { question: "Can I give it Gmail, Slack, or other integrations?", answer: "Yes, in Local Dev via the Tools field. Selected Sim tools run through Sim with your connected credentials, the same as the Agent block, so the agent can act beyond the repo while it codes. MCP and custom tools aren't supported yet." },
   { question: "Where do the changes or feedback go?", answer: "In Create PR, to a new branch and a pull request (read prUrl and branch). In Review Code, to a submitted GitHub review on the existing PR (read reviewUrl and commentsPosted). In Local Dev, the files are edited in place on the target machine — review them with git there. Create PR and Local Dev also return changedFiles and a diff." },
   { question: "What happens when memory or context gets large?", answer: "For Create PR and Local Dev, Sim trims memory before the run based on the memory type, and Pi compacts older turns as needed. Review Code does not load or save memory because a malicious PR could otherwise expose or poison prior context." },

apps/sim/blocks/blocks/pi.test.ts

@@ -58,6 +58,16 @@ describe('Pi block search fields', () => {
     expect(searchKeyVisible({ searchProvider: undefined })).toBe(false)
   })
 
+  // The field is the only source for the search key — no workspace BYOK fallback, no hosted key —
+  // so it has to be required. Safe despite the condition: the serializer's required check returns
+  // early for fields that are not visible, which is what keeps a Pi block with search off from
+  // failing validation over a key it does not need.
+  it('requires the key, which the hidden case must not enforce', () => {
+    expect(searchApiKeyField?.required).toBe(true)
+    expect(searchKeyVisible({ searchProvider: 'none' })).toBe(false)
+    expect(searchKeyVisible({})).toBe(false)
+  })
+
   // `inputs` is the block's type map, not the delivery mechanism — the handler reads resolved
   // params — but an undeclared input is a convention break the next block author would copy.
   it('declares both fields in the block input map', () => {

apps/sim/blocks/blocks/pi.ts

@@ -91,7 +91,7 @@ export const PiBlock: BlockConfig<PiResponse> = {
   - Use Review Code to analyze an existing PR and leave summary + inline review comments.
   - Use Local Dev to edit a repo on your own machine; expose the machine on a public hostname/tunnel so Sim can reach it over SSH.
   - Create PR requires your own provider API key because the model runs in the sandbox. Review Code keeps the model key in Sim and can use either BYOK or a hosted key.
-  - Internet Search is off by default and always needs your own key for the selected provider, from the block field or Settings > BYOK. Leave it on None unless the task genuinely needs external information.
+  - Internet Search is off by default and always needs your own key for the selected provider, entered on the block. There is no workspace BYOK fallback and no hosted key. Leave it on None unless the task genuinely needs external information.
   `,
   category: 'blocks',
   integrationType: IntegrationType.AI,
@@ -165,7 +165,11 @@ export const PiBlock: BlockConfig<PiResponse> = {
       password: true,
       paramVisibility: 'user-only',
       connectionDroppable: false,
-      placeholder: 'Falls back to the key stored in Settings > BYOK',
+      placeholder: 'Your key for the selected provider',
+      // The only source: search has no workspace BYOK fallback and never uses a Sim-hosted key, and
+      // unlike the model key this field is shown on every deployment. Marking it required is what
+      // surfaces that in the editor rather than at the start of a run.
+      required: true,
       // Scoped to the editor on purpose: the clear-on-switch is driven by `dependsOn` through the
       // collaborative setter, so a workflow imported, forked, or updated through the API keeps
       // whatever key was stored. Promising an unconditional clear would be wrong in exactly the

apps/sim/executor/handlers/pi/backend.ts

@@ -11,7 +11,7 @@ import type { TSchema } from 'typebox'
 import type { SSHConnectionConfig } from '@/app/api/tools/ssh/utils'
 import type { Message } from '@/executor/handlers/agent/types'
 import type { PiEvent, PiRunTotals } from '@/executor/handlers/pi/events'
-import type { PiSearchKeySource, PiSearchProvider } from '@/executor/handlers/pi/keys'
+import type { PiSearchProvider } from '@/executor/handlers/pi/keys'
 import type { PiSupportedProvider } from '@/providers/pi-provider-configs'
 
 /** A conversation message seeded into the Pi run (subset of the Agent block's message). */
@@ -59,7 +59,6 @@ export interface PiToolSpec {
 export interface PiSearchConfig {
   provider: PiSearchProvider
   apiKey: string
-  keySource: PiSearchKeySource
   /**
    * Host-side tool for the two SDK modes. Absent for `cloud`, which has no host in the loop and
    * registers a sandbox extension instead, so a spec built there could never execute.

apps/sim/executor/handlers/pi/cloud-backend.test.ts

@@ -252,7 +252,7 @@ describe('runCloudPi', () => {
   })
 
   describe('optional web search', () => {
-    const search = { provider: 'exa' as const, apiKey: 'sk-search', keySource: 'byok' as const }
+    const search = { provider: 'exa' as const, apiKey: 'sk-search' }
 
     it('runs the stock Pi command with no extension when search is off', async () => {
       await runCloudPi(baseParams(), { onEvent: vi.fn() })

apps/sim/executor/handlers/pi/keys.test.ts

@@ -245,53 +245,37 @@ describe('resolvePiSearchKey', () => {
     vi.clearAllMocks()
   })
 
-  it('prefers the block field and reports its source', async () => {
-    await expect(
-      resolvePiSearchKey({ provider: 'exa', workspaceId: 'ws-1', apiKey: 'exa-field' })
-    ).resolves.toEqual({ apiKey: 'exa-field', source: 'block' })
-    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+  it('returns the trimmed block field, the only source', () => {
+    expect(resolvePiSearchKey({ provider: 'exa', apiKey: '  exa-field  ' })).toBe('exa-field')
   })
 
-  it('falls back to the stored workspace key for the selected provider', async () => {
-    mockGetBYOKKey.mockResolvedValue({ apiKey: 'serper-stored', isBYOK: true })
-
-    await expect(resolvePiSearchKey({ provider: 'serper', workspaceId: 'ws-1' })).resolves.toEqual({
-      apiKey: 'serper-stored',
-      source: 'byok',
-    })
-    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'serper')
-  })
-
-  it('maps Parallel to its BYOK provider id', async () => {
-    mockGetBYOKKey.mockResolvedValue({ apiKey: 'parallel-stored', isBYOK: true })
-
-    await resolvePiSearchKey({ provider: 'parallel', workspaceId: 'ws-1' })
-    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'parallel_ai')
+  // The field is shown on every deployment, so there is no configuration where a fallback would be
+  // needed — and reading one would pull a workspace credential the runner cannot otherwise see into
+  // the Create PR sandbox.
+  it('never reads a stored workspace BYOK key', () => {
+    expect(() => resolvePiSearchKey({ provider: 'serper' })).toThrow(
+      /Serper search requires your own Serper API key/
+    )
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
   })
 
-  it('treats a whitespace-only key as absent, so no hosted key can be injected later', async () => {
-    mockGetBYOKKey.mockResolvedValue({ apiKey: '  firecrawl-stored  ', isBYOK: true })
-
-    await expect(
-      resolvePiSearchKey({ provider: 'firecrawl', workspaceId: 'ws-1', apiKey: '   ' })
-    ).resolves.toEqual({ apiKey: 'firecrawl-stored', source: 'byok' })
-    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'firecrawl')
+  it('treats a whitespace-only key as absent, so no hosted key can be injected later', () => {
+    expect(() => resolvePiSearchKey({ provider: 'firecrawl', apiKey: '   ' })).toThrow(
+      /Firecrawl search requires your own Firecrawl API key/
+    )
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
   })
 
-  it('never falls back to a Sim-hosted key', async () => {
-    mockGetBYOKKey.mockResolvedValue(null)
-
-    await expect(resolvePiSearchKey({ provider: 'exa', workspaceId: 'ws-1' })).rejects.toThrow(
+  it('never falls back to a Sim-hosted key', () => {
+    expect(() => resolvePiSearchKey({ provider: 'exa' })).toThrow(
       /Exa search requires your own Exa API key/
     )
     expect(mockGetApiKeyWithBYOK).not.toHaveBeenCalled()
   })
 
-  it('reports a blank stored key as missing rather than passing it on', async () => {
-    mockGetBYOKKey.mockResolvedValue({ apiKey: '   ', isBYOK: true })
-
-    await expect(resolvePiSearchKey({ provider: 'serper', workspaceId: 'ws-1' })).rejects.toThrow(
-      /Serper search requires your own Serper API key/
+  it('names the selected provider in the setup error, matching the dropdown label', () => {
+    expect(() => resolvePiSearchKey({ provider: 'parallel' })).toThrow(
+      /Parallel AI search requires your own Parallel AI API key/
     )
   })
 })

apps/sim/executor/handlers/pi/keys.ts

@@ -20,7 +20,6 @@ import {
   getPiWorkspaceBYOKProviderId,
   isPiSupportedProvider,
 } from '@/providers/pi-providers'
-import type { BYOKProviderId } from '@/tools/types'
 
 /** Resolved provider key and BYOK flag for a Pi run. */
 interface PiKeyResolution {
@@ -73,29 +72,20 @@ export async function resolvePiModelKey(params: ResolvePiModelKeyParams): Promis
 interface PiSearchProviderConfig {
   /** User-facing name, used in setup errors and the review prompt. */
   label: string
-  byokProviderId: BYOKProviderId
   /** Sim tool the host-side adapter executes; also the id checked against workspace tool denylists. */
   toolId: string
 }
 
 /** The search providers the Pi block offers, keyed by the `searchProvider` field value. */
 export const PI_SEARCH_PROVIDERS = {
-  exa: { label: 'Exa', byokProviderId: 'exa', toolId: 'exa_search' },
-  serper: { label: 'Serper', byokProviderId: 'serper', toolId: 'serper_search' },
-  parallel: { label: 'Parallel AI', byokProviderId: 'parallel_ai', toolId: 'parallel_search' },
-  firecrawl: { label: 'Firecrawl', byokProviderId: 'firecrawl', toolId: 'firecrawl_search' },
+  exa: { label: 'Exa', toolId: 'exa_search' },
+  serper: { label: 'Serper', toolId: 'serper_search' },
+  parallel: { label: 'Parallel AI', toolId: 'parallel_search' },
+  firecrawl: { label: 'Firecrawl', toolId: 'firecrawl_search' },
 } as const satisfies Record<string, PiSearchProviderConfig>
 
 export type PiSearchProvider = keyof typeof PI_SEARCH_PROVIDERS
 
-/** Where a resolved search key came from, carried into logs to diagnose a stale block field. */
-export type PiSearchKeySource = 'block' | 'byok'
-
-export interface PiSearchKeyResolution {
-  apiKey: string
-  source: PiSearchKeySource
-}
-
 /**
  * Resolves the `searchProvider` field, distinguishing absent from invalid.
  *
@@ -115,29 +105,32 @@ export function parsePiSearchProvider(value: unknown): PiSearchProvider | 'none'
 }
 
 /**
- * Resolves the search key: the block's Search API Key field, else a stored workspace BYOK key,
- * else an error. Never a Sim-hosted key in any mode, because Create PR places this key inside the
- * coding sandbox and one uniform rule beats a mode-dependent one.
+ * Resolves the search key from the block's Search API Key field, which is the only source.
  *
- * Both sources are trimmed and a blank treated as absent. `executeTool` only skips hosted-key
- * injection for a key with `trim().length > 0`, so a whitespace-only value would otherwise fall
- * through to a rotating Sim-owned key on hosted deployments.
+ * Deliberately no workspace BYOK fallback, and never a Sim-hosted key. Unlike the model key, the
+ * Search API Key field is shown on every deployment — its visibility depends only on whether a
+ * provider is selected — so there is no configuration where the field is unavailable and a fallback
+ * would be needed. Reading a stored workspace key here would instead mean a member who cannot
+ * otherwise see that credential (the BYOK API only ever returns it masked, and only admins may
+ * manage it) could route it into the Create PR sandbox, where the agent holds bash and can read the
+ * environment. Requiring the key on the block keeps that exposure something the block's author
+ * opted into with a key they already hold.
+ *
+ * Trimmed, with a blank treated as absent: `executeTool` only skips hosted-key injection for a key
+ * with `trim().length > 0`, so a whitespace-only value would otherwise fall through to a rotating
+ * Sim-owned key on hosted deployments.
  */
-export async function resolvePiSearchKey(params: {
+export function resolvePiSearchKey(params: {
   provider: PiSearchProvider
-  workspaceId?: string
   apiKey?: string
-}): Promise<PiSearchKeyResolution> {
-  const { label, byokProviderId } = PI_SEARCH_PROVIDERS[params.provider]
+}): string {
+  const { label } = PI_SEARCH_PROVIDERS[params.provider]
 
   const fieldKey = params.apiKey?.trim()
-  if (fieldKey) return { apiKey: fieldKey, source: 'block' }
-
-  const stored = (await getBYOKKey(params.workspaceId, byokProviderId))?.apiKey.trim()
-  if (stored) return { apiKey: stored, source: 'byok' }
+  if (fieldKey) return fieldKey
 
   throw new Error(
-    `${label} search requires your own ${label} API key. Enter it in the block's Search API Key field, or store one in Settings > BYOK.`
+    `${label} search requires your own ${label} API key. Enter it in the block's Search API Key field.`
   )
 }
 

apps/sim/executor/handlers/pi/local-backend.test.ts

@@ -187,7 +187,6 @@ describe('runLocalPi secret boundaries', () => {
     params.search = {
       provider: 'exa',
       apiKey: 'sk-search-key',
-      keySource: 'byok',
       tool: {
         name: 'web_search',
         description: 'Search the web',