fix(providers): respect user-provided key over hosted pool in hosted-key-llm path

Author: TheodoreSpeaks

apps/sim/lib/api-key/byok.ts

@@ -104,8 +104,9 @@ export async function getApiKeyWithBYOK(
   userId?: string | null
 ): Promise<ApiKeyResolution> {
   // Unified hosted-key path (flag-gated). For any provider with a hosting config:
-  // BYOK workspace key wins; otherwise acquire a platform key through the shared
-  // hosted-key framework with no rate limiting. Falls through to the legacy
+  // workspace BYOK key wins, then a user-provided key (never billed via the pool),
+  // otherwise acquire a platform key through the shared hosted-key framework with no
+  // rate limiting. Mirrors tool hosted-key precedence. Falls through to the legacy
   // per-provider logic when the flag is off or no platform keys are configured,
   // keeping flag-off behavior identical.
   if (isHosted && workspaceId) {
@@ -117,6 +118,12 @@ export async function getApiKeyWithBYOK(
         return byokResult
       }
 
+      // A user-supplied key takes precedence over the platform pool — use it as-is
+      // and never bill it through hosted-key metrics/cost.
+      if (userProvidedKey) {
+        return { apiKey: userProvidedKey, isBYOK: false }
+      }
+
       const acquired = await getHostedKeyRateLimiter().acquireKey(
         hosting.byokProviderId,
         hosting.envKeyPrefix,

apps/sim/providers/index.ts

@@ -229,8 +229,9 @@ export async function executeProviderRequest(
     if (isBYOK) {
       zeroCostForBYOK(response)
     } else if (hostedKeyEnvVar) {
-      // Hosted key used: record usage now; cost is settled on stream drain
-      // inside createStreamingExecution (the single streaming cost seam).
+      // Hosted key used: record usage now; cost is settled on stream drain via
+      // settleStreamingLlmCost (from createStreamingExecution, or the provider's
+      // bespoke stream finalizer for gemini).
       hostedKeyMetrics.recordUsed({
         provider: providerId,
         tool: response.execution.output?.model ?? request.model,