Merge origin/staging into staging-v4

Conflicts resolved:

- workspace-file-folder-manager.ts: staging kept the workflow-alias import while
  ac55b1f deleted that module here, so only staging's collectDescendantFolderIds
  import survives — the alias symbol has no remaining callers.
- check-api-validation-contracts.ts: route baseline is additive on both sides
  (979 base + 6 ours + 2 staging); audit reports exactly 987.
- bun.lock: regenerated from the merged package.json files rather than hand-merged.

Our 0272 was dropped in the preceding commit and regenerated as 0273 on top of
staging's 0272; the emitted SQL is byte-identical to what was dropped.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/docs/content/docs/en/workflows/blocks/pi.mdx

@@ -4,6 +4,7 @@ description: The Pi Coding Agent block runs an autonomous coding agent on a real
 pageType: reference
 ---
 
+import { Callout } from 'fumadocs-ui/components/callout'
 import { BlockPreview } from '@/components/workflow-preview'
 import { FAQ } from '@/components/ui/faq'
 
@@ -37,7 +38,7 @@ Review Code uses a disposable sandbox for the repository, but the Pi harness and
 - Requires sandbox execution. The provider key stays in Sim, so hosted keys and BYOK are both supported.
 - Needs a **GitHub token** that can clone the repo and submit reviews (see [Setup](#setup-cloud-code-review)).
 - Needs the **Pull Request Number** to review.
-- Does not load skills or memory, and never exposes shell, write, edit, or arbitrary network tools to the reviewer.
+- Does not load skills or memory, and never exposes shell, write, or edit tools to the reviewer. Its only network access is [Internet Search](#internet-search), and only when you select a provider.
 - Rechecks the PR immediately before submission and pins the review to the exact checked-out head commit.
 - The deliverable is a **submitted review** — read `reviewUrl` and `commentsPosted`.
 
@@ -63,6 +64,22 @@ The model that drives the agent. Defaults to `claude-sonnet-4-6`. The dropdown c
 
 Your key for the chosen provider. On hosted Sim it is optional for Local Dev and Review Code runs (a hosted key is used and metered to your workspace). **Create PR requires your own key** because its model client runs in the sandbox. When the provider supports workspace BYOK, you can store the key in **Settings → BYOK** instead of entering it on the block.
 
+### Internet Search
+
+Off by default. Pick a provider — **Exa**, **Serper**, **Parallel AI**, or **Firecrawl** — and the agent gains a single `web_search` tool that returns a handful of results, each with a title, URL, snippet, and (where the provider reports one) a publication date. It works the same way in all three modes, and it is the agent's only network access in Review Code. The tool accepts at most 20 calls **per block execution**, which bounds accidental tool loops. A Pi block inside a Loop or Parallel gets that allowance again on every iteration, so bound the iteration count too if you care about what a single workflow run can spend.
+
+Search always uses **your own key** for the selected provider, entered in the block's **Search API Key** field. That field is the only source: there is no workspace BYOK fallback and Sim never supplies a hosted search key, so unlike the model key this field appears on every deployment. Leave it empty and the run fails with a setup error before any sandbox is created. Changing the provider in the editor clears the field, so re-enter the key that belongs to the provider you picked — a workflow you import, fork, or update through the API keeps whatever key was saved, so check it there.
+
+<Callout type="warn">
+  **Create PR exposes both keys to the agent.** Create PR runs the model client and the search client *inside* the sandbox, so the model key and the search key reach it as environment variables — and Pi copies its own environment into every shell command it runs. Your prompt, or instructions injected through the contents of the cloned repository, can therefore read either key and write it anywhere the agent can reach, including into the pull request itself. Sim strips verbatim key text out of run output, but that does not stop an agent that encodes the value first.
+
+  This is why the search key has no **Settings → BYOK** fallback. Workspace BYOK keys belong to the workspace rather than to you — Sim only ever displays them masked, and only workspace admins can add or remove them — so resolving one here would let anyone who can run a Pi block read a credential they cannot otherwise see. Requiring the key on the block keeps the exposure to a key its author already holds. Scope it to something you are willing to rotate.
+</Callout>
+
+Results are third-party data. The agent is instructed to treat them as quoted evidence and never to follow instructions found inside them — the same posture Pi takes toward repository contents.
+
+Traffic goes both ways: the agent writes its own queries after reading the repository, so leave search on **None** in Review Code when the pull request comes from an untrusted fork of a private repo. Injected instructions in a diff could otherwise put repository text into a query sent to the provider.
+
 ### Repository (Create PR / Review Code)
 
 - **Repository Owner / Repository Name** — the GitHub repo (for example `your-org` / `your-repo`).
@@ -176,6 +193,7 @@ Enable sandbox execution as for Create PR. BYOK is optional because the model cr
   { question: "Why does Local Dev need a public hostname?", answer: "Sim connects over raw SSH and blocks localhost, LAN, and private/reserved addresses for safety. Expose the machine with a TCP tunnel such as `ngrok tcp 22` and use the tunnel's host and port. Tailscale's private 100.x addresses won't work for the same reason." },
   { question: "What GitHub permissions does Create PR need?", answer: "A token that can clone, push, and open a PR. With a fine-grained token: select the repo and grant Contents: Read and write plus Pull requests: Read and write. With a classic token: the repo scope. For organization repos, the token must be SSO-authorized." },
   { question: "What GitHub permissions does Review Code need?", answer: "A token that can clone the repo and submit a review. With a fine-grained token: Contents: Read plus Pull requests: Read and write. Push permission is not required. With a classic token: the repo scope. For organization repos, the token must be SSO-authorized." },
+  { question: "Can the agent search the web?", answer: "Only if you pick a provider under Internet Search — Exa, Serper, Parallel AI, or Firecrawl. That adds one web_search tool in every mode, backed by your own key for that provider, entered on the block; there is no BYOK fallback and Sim never supplies a search key. Leave it on None and the agent has no search tool at all." },
   { question: "Can I give it Gmail, Slack, or other integrations?", answer: "Yes, in Local Dev via the Tools field. Selected Sim tools run through Sim with your connected credentials, the same as the Agent block, so the agent can act beyond the repo while it codes. MCP and custom tools aren't supported yet." },
   { question: "Where do the changes or feedback go?", answer: "In Create PR, to a new branch and a pull request (read prUrl and branch). In Review Code, to a submitted GitHub review on the existing PR (read reviewUrl and commentsPosted). In Local Dev, the files are edited in place on the target machine — review them with git there. Create PR and Local Dev also return changedFiles and a diff." },
   { question: "What happens when memory or context gets large?", answer: "For Create PR and Local Dev, Sim trims memory before the run based on the memory type, and Pi compacts older turns as needed. Review Code does not load or save memory because a malicious PR could otherwise expose or poison prior context." },

apps/sim/app/api/folders/[id]/duplicate/route.ts

@@ -12,6 +12,7 @@ import { getSession } from '@/lib/auth'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { DbOrTx } from '@/lib/db/types'
+import { toFolderApi } from '@/lib/folders/queries'
 import { duplicateWorkflow } from '@/lib/workflows/persistence/duplicate'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
@@ -33,7 +34,7 @@ export const POST = withRouteHandler(
     try {
       const parsed = await parseRequest(duplicateFolderContract, req, context)
       if (!parsed.success) return parsed.response
-      const { name, workspaceId, parentId, color, newId: clientNewId } = parsed.data.body
+      const { name, workspaceId, parentId, newId: clientNewId } = parsed.data.body
 
       logger.info(`[${requestId}] Duplicating folder ${sourceFolderId} for user ${session.user.id}`)
 
@@ -106,7 +107,7 @@ export const POST = withRouteHandler(
           userId: session.user.id,
           workspaceId: targetWorkspaceId,
           name: deduplicatedName,
-          color: color || sourceFolder.color,
+          color: sourceFolder.color,
           parentId: targetParentId,
           sortOrder,
           isExpanded: false,
@@ -172,7 +173,7 @@ export const POST = withRouteHandler(
         .where(eq(workflowFolder.id, newFolderId))
         .then((rows) => rows[0])
 
-      return NextResponse.json({ folder: duplicatedFolder }, { status: 201 })
+      return NextResponse.json({ folder: toFolderApi(duplicatedFolder) }, { status: 201 })
     } catch (error) {
       if (error instanceof Error) {
         if (error instanceof FolderLockedError) {

apps/sim/app/api/folders/[id]/route.test.ts

@@ -306,7 +306,9 @@ describe('Individual Folder API Route', () => {
   })
 
   describe('Input Validation', () => {
-    it('should handle empty folder name', async () => {
+    it('rejects an empty folder name', async () => {
+      // The contract bounds `name` to 1-255 chars: renaming a folder to '' previously
+      // slipped through as a no-op 200, which silently discarded the user's rename.
       mockAuthenticatedUser()
 
       queueFolderLookup()
@@ -317,7 +319,23 @@ describe('Individual Folder API Route', () => {
 
       const response = await PUT(req, { params })
 
-      expect(response.status).toBe(200)
+      expect(response.status).toBe(400)
+    })
+
+    it('rejects a whitespace-only folder name', async () => {
+      // The write path trims before persisting, so validating the raw string would let
+      // '   ' through and store an empty name — the same failure the '' case closes.
+      mockAuthenticatedUser()
+
+      queueFolderLookup()
+      const req = createMockRequest('PUT', {
+        name: '   ',
+      })
+      const params = Promise.resolve({ id: 'folder-1' })
+
+      const response = await PUT(req, { params })
+
+      expect(response.status).toBe(400)
     })
 
     it('should handle invalid JSON payload', async () => {

apps/sim/app/api/folders/[id]/route.ts

@@ -8,6 +8,7 @@ import { updateFolderContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { toFolderApi } from '@/lib/folders/queries'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { performDeleteFolder, performUpdateFolder } from '@/lib/workflows/orchestration'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
@@ -38,7 +39,7 @@ export const PUT = withRouteHandler(
       if (!parsed.success) return parsed.response
 
       const { id } = parsed.data.params
-      const { name, color, isExpanded, locked, parentId, sortOrder } = parsed.data.body
+      const { name, locked, parentId, sortOrder } = parsed.data.body
 
       // Verify the folder exists
       const existingFolder = await db
@@ -85,8 +86,6 @@ export const PUT = withRouteHandler(
         workspaceId: existingFolder.workspaceId,
         userId: session.user.id,
         name,
-        color,
-        isExpanded,
         locked,
         parentId,
         sortOrder,
@@ -100,7 +99,7 @@ export const PUT = withRouteHandler(
 
       logger.info('Updated folder:', { id, updates: parsed.data.body })
 
-      return NextResponse.json({ folder: result.folder })
+      return NextResponse.json({ folder: toFolderApi(result.folder) })
     } catch (error) {
       if (error instanceof FolderLockedError) {
         return NextResponse.json({ error: error.message }, { status: error.status })

apps/sim/app/api/folders/route.ts

@@ -5,7 +5,7 @@ import { createFolderContract, listFoldersContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { listFoldersForWorkspace } from '@/lib/folders/queries'
+import { listFoldersForWorkspace, toFolderApi } from '@/lib/folders/queries'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { performCreateFolder } from '@/lib/workflows/orchestration'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
@@ -29,7 +29,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
 
     const parsed = await parseRequest(listFoldersContract, request, {})
     if (!parsed.success) return parsed.response
-    const { workspaceId, scope } = parsed.data.query
+    const { workspaceId, resourceType, scope } = parsed.data.query
 
     // Check if user has workspace permissions
     const workspacePermission = await getUserEntityPermissions(
@@ -42,7 +42,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ error: 'Access denied to this workspace' }, { status: 403 })
     }
 
-    const folders = await listFoldersForWorkspace(workspaceId, scope)
+    const folders = await listFoldersForWorkspace(workspaceId, scope, resourceType)
 
     return NextResponse.json({ folders })
   } catch (error) {
@@ -66,7 +66,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       name,
       workspaceId,
       parentId,
-      color,
       sortOrder: providedSortOrder,
     } = parsed.data.body
 
@@ -91,7 +90,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       workspaceId,
       name,
       parentId,
-      color,
       sortOrder: providedSortOrder,
     })
 
@@ -113,7 +111,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       { groups: { workspace: workspaceId } }
     )
 
-    return NextResponse.json({ folder: newFolder })
+    return NextResponse.json({ folder: toFolderApi(newFolder) })
   } catch (error) {
     if (error instanceof FolderLockedError) {
       return NextResponse.json({ error: error.message }, { status: error.status })

apps/sim/app/api/knowledge/[id]/connectors/[connectorId]/route.ts

@@ -1,12 +1,6 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import {
-  document,
-  embedding,
-  knowledgeBase,
-  knowledgeConnector,
-  knowledgeConnectorSyncLog,
-} from '@sim/db/schema'
+import { document, embedding, knowledgeConnector, knowledgeConnectorSyncLog } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, desc, eq, inArray, isNull, sql } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
@@ -17,6 +11,7 @@ import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { hasWorkspaceLiveSyncAccess } from '@/lib/billing/core/subscription'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { resolveCredentialTokenIdentity } from '@/lib/credentials/access'
 import { deleteDocumentStorageFiles } from '@/lib/knowledge/documents/service'
 import { cleanupUnusedTagDefinitions } from '@/lib/knowledge/tags/service'
 import { captureServerEvent } from '@/lib/posthog/server'
@@ -157,16 +152,6 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Rout
         )
       }
 
-      const kbRows = await db
-        .select({ userId: knowledgeBase.userId })
-        .from(knowledgeBase)
-        .where(eq(knowledgeBase.id, knowledgeBaseId))
-        .limit(1)
-
-      if (kbRows.length === 0) {
-        return NextResponse.json({ error: 'Knowledge base not found' }, { status: 404 })
-      }
-
       let accessToken: string | null = null
       if (connectorConfig.auth.mode === 'apiKey') {
         if (!existing.encryptedApiKey) {
@@ -183,9 +168,32 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Rout
             { status: 400 }
           )
         }
+        const connectorWorkspaceId = writeCheck.knowledgeBase.workspaceId
+        if (!connectorWorkspaceId) {
+          return NextResponse.json(
+            { error: 'Knowledge base is missing workspace context' },
+            { status: 409 }
+          )
+        }
+        /**
+         * Resolve the credential's own account owner, not the knowledge base owner:
+         * workspace credentials are shared, and token reads are scoped to
+         * `account.userId`.
+         */
+        const identity = await resolveCredentialTokenIdentity(
+          existing.credentialId,
+          connectorWorkspaceId
+        )
+        if (!identity) {
+          return NextResponse.json(
+            { error: 'Credential is no longer usable in this workspace. Please reconnect it.' },
+            { status: 400 }
+          )
+        }
         accessToken = await refreshAccessTokenIfNeeded(
           existing.credentialId,
-          kbRows[0].userId,
+          // Service accounts mint their own token and ignore the acting user.
+          identity.kind === 'oauth' ? identity.userId : auth.userId,
           `patch-${connectorId}`
         )
       }

apps/sim/app/api/pinned-items/[resourceType]/[resourceId]/route.test.ts

@@ -0,0 +1,91 @@
+/**
+ * Tests for the unpin API route.
+ *
+ * @vitest-environment node
+ */
+import { authMockFns, createMockRequest, schemaMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockLogger, mockDb } = vi.hoisted(() => ({
+  mockLogger: {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn(),
+    trace: vi.fn(),
+    fatal: vi.fn(),
+    child: vi.fn(),
+  },
+  mockDb: { delete: vi.fn() },
+}))
+
+vi.mock('@sim/logger', () => ({
+  createLogger: vi.fn().mockReturnValue(mockLogger),
+  runWithRequestContext: <T>(_ctx: unknown, fn: () => T): T => fn(),
+  getRequestContext: () => undefined,
+}))
+vi.mock('@sim/db', () => ({ db: mockDb, ...schemaMock }))
+
+import { DELETE } from '@/app/api/pinned-items/[resourceType]/[resourceId]/route'
+
+const mockUser = { id: 'user-123', email: 'test@example.com', name: 'Test User' }
+
+function routeContext(resourceType: string, resourceId: string) {
+  return { params: Promise.resolve({ resourceType, resourceId }) }
+}
+
+describe('Unpin API', () => {
+  const mockWhere = vi.fn()
+  const mockReturning = vi.fn()
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+
+    mockDb.delete.mockReturnValue({ where: mockWhere })
+    mockWhere.mockReturnValue({ returning: mockReturning })
+    mockReturning.mockReturnValue([{ id: 'pinned-1' }])
+
+    authMockFns.mockGetSession.mockResolvedValue({ user: mockUser })
+  })
+
+  it('unpins a resource', async () => {
+    const response = await DELETE(
+      createMockRequest('DELETE'),
+      routeContext('workflow', 'workflow-1')
+    )
+
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toEqual({ success: true })
+    expect(mockDb.delete).toHaveBeenCalled()
+  })
+
+  it('returns 404 when no matching pin exists', async () => {
+    mockReturning.mockReturnValue([])
+
+    const response = await DELETE(
+      createMockRequest('DELETE'),
+      routeContext('workflow', 'workflow-1')
+    )
+
+    expect(response.status).toBe(404)
+  })
+
+  it('rejects an unknown resourceType at the contract boundary', async () => {
+    const response = await DELETE(createMockRequest('DELETE'), routeContext('nope', 'resource-1'))
+
+    expect(response.status).toBe(400)
+    expect(mockDb.delete).not.toHaveBeenCalled()
+  })
+
+  it('returns 401 when unauthenticated', async () => {
+    authMockFns.mockGetSession.mockResolvedValue(null)
+
+    const response = await DELETE(
+      createMockRequest('DELETE'),
+      routeContext('workflow', 'workflow-1')
+    )
+
+    expect(response.status).toBe(401)
+    expect(mockDb.delete).not.toHaveBeenCalled()
+  })
+})