feat(providers): xAI hosted keys + BYOK migration

[TheodoreSpeaks]

Summary

• Add xAI to the hosted key rotation pool so hosted grok models run on Sim-provided keys
• Include xai in Pi cloud-mode workspace BYOK read-back
• Add the xai row to the BYOK settings UI
• Extend the block→BYOK migration script with a model-aware mode (--model-map grok=xai) so existing grok keys entered into agent/router/evaluator blocks migrate to workspace BYOK instead of falling back to the rotating key post-launch

Why the migration needed a new mode

The existing --map <blockType>=<providerId> only works for dedicated single-provider blocks. LLM-family blocks (agent, router, evaluator) share one model-gated apiKey subblock across every provider, so a block-type map would misattribute every provider's key as xai. The new --model-map <modelPrefix>=<providerId> only takes the key when the block's selected model matches the prefix.

Type of Change

• New feature

Testing

• Dry run + live run verified against staging; migrated rows well-formed (iv:encrypted:authTag), created_by set, one key per workspace with full coverage of eligible blocks
• bun run check:api-validation:strict passed
• Biome formatting applied

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 11, 2026 6:33pm

[cursor]

PR Summary

Medium Risk
Touches API key resolution, billing (getHostedModels / shouldBillModelUsage), and encrypted BYOK storage paths; incorrect routing could bill wrong or use the wrong key, though changes mirror existing Z.ai/OpenAI patterns and include tests.

Overview
Adds xAI as a first-class hosted provider: grok-4.5 (and other xAI models) join the Sim key rotation pool (XAI_API_KEY_1–3), hosted/billing paths, workspace BYOK (API contract, settings UI), and Pi cloud workspace key read-back alongside OpenAI/Anthropic/Google/Mistral.

BYOK resolution prefers workspace keys for hosted xAI models, then falls back to rotating server keys when no BYOK is stored.

The block→BYOK migration script gains --model-map grok=xai so agent / router / evaluator blocks only migrate API keys when the selected model prefix is grok, avoiding mis-attribution from a shared LLM apiKey subblock.

^{Reviewed by Cursor Bugbot for commit 91fcf75. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds xAI support to hosted keys and BYOK migration paths.

• Adds xAI to the BYOK settings UI and provider schemas.
• Adds xAI hosted model and rotating key support for grok models.
• Allows Pi cloud mode to read workspace xAI BYOK keys.
• Adds --model-map migration support for model-gated LLM blocks.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• The xAI provider id is used consistently across BYOK, hosted key lookup, Pi cloud key resolution, and provider model lookup.
• The migration path keeps the existing workspace/provider conflict checks.

Important Files Changed

Filename	Overview
apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx	Adds xAI to the BYOK provider list and LLM provider section.
apps/sim/executor/handlers/pi/keys.ts	Allows Pi cloud mode to resolve xAI workspace BYOK keys.
apps/sim/lib/api-key/byok.ts	Adds xAI to hosted BYOK fallback handling.
apps/sim/lib/api/contracts/byok-keys.ts	Adds xAI to the BYOK provider contract enum.
apps/sim/lib/core/config/api-keys.ts	Adds rotating hosted key lookup for xAI.
apps/sim/lib/core/config/env.ts	Adds optional numbered xAI hosted key environment variables.
apps/sim/providers/models.ts	Includes xAI provider models in the hosted model list.
apps/sim/providers/utils.ts	Routes hosted xAI models through hosted key resolution.
apps/sim/tools/types.ts	Adds xAI to the shared BYOK provider id type.
packages/db/scripts/migrate-block-api-keys-to-byok.ts	Adds model-prefix mapping for migrating shared LLM block API keys to BYOK.

_{Reviews (1): Last reviewed commit: "feat(byok): migrate agent/router/evaluat..." | Re-trigger Greptile}