feat(providers): add Fireworks AI provider integration

[waleedlatif1]

Summary

• Add Fireworks AI as a new LLM provider with OpenAI-compatible API
• Dynamic model fetching via optional FIREWORKS_API_KEY env var
• Full feature parity with other providers: streaming, tool calling, structured outputs, cost tracking

Type of Change

• New feature

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[cursor]

PR Summary

Medium Risk
Adds a new LLM provider with dynamic model fetching and new API key/BYOK resolution paths, which could impact model selection and request execution flows if misconfigured. Main risk is around provider execution parity (streaming/tool calls/structured outputs) and workspace-scoped key handling.

Overview
Adds Fireworks AI as a first-class LLM provider, including a full provider executor (providers/fireworks) with OpenAI-compatible chat completions support (streaming, tool calling with iteration handling, structured outputs, timing, and cost accounting).

Introduces a new dynamic model-listing endpoint (/api/providers/fireworks/models) that fetches models from Fireworks using either a workspace BYOK key (permission-checked via workspaceId) or the optional FIREWORKS_API_KEY, with provider/model blacklist filtering.

Wires Fireworks into the rest of the app: provider registry/types, providers store and model combobox aggregation, workspace model loader/query caching keyed by workspaceId, and BYOK settings/API validation to allow storing fireworks keys; also marks Fireworks as a dynamic provider in copilot/VFS static model fallbacks and adds FireworksIcon plus env docs for FIREWORKS_API_KEY.

^{Written by Cursor Bugbot for commit abae75f. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 1, 2026 1:24am

[greptile-apps]

Greptile Summary

This PR integrates Fireworks AI as a new LLM provider with full OpenAI-compatible support: dynamic model listing (with optional env-key or workspace BYOK), streaming, multi-turn tool calling, and structured outputs via json_schema. The implementation closely mirrors the existing OpenRouter/vLLM provider patterns throughout the codebase.

Key changes:

• New provider (providers/fireworks/index.ts): full executeRequest covering non-streaming, streaming-only, and streaming-after-tool-calls paths with proper timing/cost accounting
• Model listing route (app/api/providers/fireworks/models/route.ts): workspace membership is checked via getUserEntityPermissions before BYOK key access — the security gap flagged in previous review iterations has been properly resolved
• BYOK integration: Fireworks added to BYOKProviderId, VALID_PROVIDERS, BYOK settings UI, and getApiKeyWithBYOK with the standard workspace-BYOK → user-key → env-key → throw resolution chain
• Store & query plumbing: workspaceId is now a dimension of the Fireworks query cache key so that different workspaces (with different BYOK keys) fetch the correct model list independently
• Pricing: all dynamically fetched models are stored with input: 0 / output: 0 — consistent with how OpenRouter and vLLM handle runtime-discovered models in this codebase

Confidence Score: 5/5

Safe to merge — no P0/P1 issues; the security concern from prior reviews has been fully addressed.

The implementation is consistent with established provider patterns, the workspace-membership authorization fix is in place, and all remaining observations are P2 style/informational notes that do not block correctness or safety.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/providers/fireworks/index.ts	New Fireworks provider implementing streaming, tool calling, and structured outputs via OpenAI-compatible client. Follows established patterns from OpenRouter/vLLM providers closely.
apps/sim/app/api/providers/fireworks/models/route.ts	Dynamic model listing route with session auth and workspace membership check (getUserEntityPermissions) before BYOK key access — security gap from prior review has been fixed.
apps/sim/lib/api-key/byok.ts	Adds Fireworks BYOK key resolution (workspace BYOK → user-provided key → env var → throw) following the same guard chain pattern as other dynamic providers.
apps/sim/hooks/queries/providers.ts	Adds workspaceId to query keys; for non-Fireworks providers this appends a stable empty string, causing a one-time cache bust on upgrade but no correctness issues.
apps/sim/providers/models.ts	Adds Fireworks provider definition with empty static model list and zero pricing (same pattern as OpenRouter/vLLM dynamic providers); updateFireworksModels populates at runtime.
apps/sim/providers/fireworks/utils.ts	Thin utility layer delegating to shared OpenAI-compatible helpers; supportsNativeStructuredOutputs unconditionally returns true per Fireworks API guarantee.
apps/sim/app/workspace/[workspaceId]/providers/provider-models-loader.tsx	Adds Fireworks to the model sync loop, passing workspaceId from URL params for BYOK-aware fetching.
apps/sim/providers/utils.ts	Registers Fireworks metadata and async updateFireworksProviderModels, and correctly excludes it from getBaseModelProviders.

_{Reviews (4): Last reviewed commit: "fix(providers): add workspace membership..." | Re-trigger Greptile}

[waleedlatif1]

Thanks for the thorough review! Both P2 findings addressed in fc2c7f3:

• Removed unused logger from utils.ts
• Removed dead modelInfo construction from the API route — since all Fireworks models uniformly support structured outputs and tools, per-model capability tracking isn't needed (unlike OpenRouter where it varies per model)

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared a fix for 1 of the 2 issues found in the latest run.

• ✅ Fixed: Fetch cache shared across different user API keys
  • Replaced next.revalidate with cache: 'no-store' to prevent Next.js data cache from serving cached responses across different user API keys.
• ⚠️ Could not fix: Fireworks provider duplicates entire OpenRouter implementation
  • Creating a shared OpenAI-compatible provider factory would require substantial refactoring across multiple providers and goes beyond minimal bugfix scope.

Or push these changes by commenting:

@cursor push 7939867000

Preview (7939867000)

diff --git a/apps/sim/app/api/providers/fireworks/models/route.ts b/apps/sim/app/api/providers/fireworks/models/route.ts
--- a/apps/sim/app/api/providers/fireworks/models/route.ts
+++ b/apps/sim/app/api/providers/fireworks/models/route.ts
@@ -53,7 +53,7 @@
         Authorization: `Bearer ${apiKey}`,
         'Content-Type': 'application/json',
       },
-      next: { revalidate: 300 },
+      cache: 'no-store',
     })
 
     if (!response.ok) {

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR