Sync free endpoint prompt data policies

[chrarnoldus]

Summary

• persist prompt training and prompt retention as true for normalized model/provider offerings when OpenRouter explicitly marks an endpoint is_free
• apply the same policy to public Kilo-exclusive models that are free or flagged requires-data-collection, respecting inference_provider_restriction ([] means every provider)
• exclude forbidden free model families from OpenRouter overrides and forbidden exact Kilo-exclusive IDs from exclusive overrides
• snapshot OpenRouter free offerings before Vercel and Kilo-exclusive injection, then normalize model suffixes and provider variants when applying the policy

Entries changed from live OpenRouter metadata

Fetched from OpenRouter frontend model metadata on 2026-07-27. These normalized provider/model entries change to training and retention true:

• novita / inclusionai/ling-3.0-flash (training false, retention false)
• poolside / poolside/laguna-s-2.1 (training false, retention true)
• poolside / poolside/laguna-xs-2.1 (training false, retention true)
• cohere / cohere/north-mini-code (training false, retention true)
• poolside / poolside/laguna-m.1 (training false, retention true)

Paid zero-token Lyria endpoints are excluded because OpenRouter reports is_free: false. Forbidden free families, including Gemma 4 and GPT-OSS 20B, are also excluded.

Entries changed from Kilo-exclusive models

Only public exclusives participate. IDs are normalized before matching, empty restrictions apply to every displayed provider offering, and forbidden exact IDs are excluded.

Effective changes:

• kwaipilot/kat-coder-pro-v2.5:free -> streamlake / kwaipilot/kat-coder-pro-v2.5
• stepfun/step-3.7-flash:free -> stepfun / stepfun/step-3.7-flash

Covered by public requires-data-collection metadata but already effective true/true:

• deepseek/deepseek-v4-flash:discounted -> deepseek / deepseek/deepseek-v4-flash
• deepseek/deepseek-v4-pro:discounted -> deepseek / deepseek/deepseek-v4-pro
• stealth/claude-opus-4.6 -> stealth / stealth/claude-opus-4.6
• stealth/claude-opus-4.7 -> stealth / stealth/claude-opus-4.7
• stealth/claude-opus-4.8 -> stealth / stealth/claude-opus-4.8
• stealth/claude-sonnet-4.6 -> stealth / stealth/claude-sonnet-4.6
• stealth/gpt-5.6-sol -> stealth / stealth/gpt-5.6-sol
• stealth/qwen3.6-plus -> stealth / stealth/qwen3.6-plus

Hidden Gemma and clawsetup exclusives and the disabled Seed exclusive are excluded.

Validation

• focused policy tests: 14 passed
• web typecheck: passed
• changed-file lint and formatting: passed
• final independent review: no findings
• full web tests deferred to CI at request

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The getOpenRouterFreeEndpointKeys → getOpenRouterFreeEndpoints refactor replaces an O(1) Set lookup with a linear .some() scan inside a nested loop, introducing a performance regression in applyFreeEndpointDataPolicy.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.ts	83	.some() scan over an array replaces an O(1) Set lookup, making the free-endpoint check quadratic across providers/models/free-endpoints

Files Reviewed (3 files)

• apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.ts - 1 issue
• apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/sync-providers.ts

Fix these issues in Kilo Cloud

Previous Review Summaries (5 snapshots, latest commit b8faecf)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit b8faecf)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the latest commit, which is a pure rename of isForbiddenFreeModelFamily to familyHasForbiddenFreeModel (clarifying the helper's purpose) with no logic changes; all call sites and tests were updated consistently.

Files Reviewed (3 files)

• apps/web/src/lib/ai-gateway/forbidden-free-models.ts
• apps/web/src/lib/ai-gateway/forbidden-free-models.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.ts

Previous review (commit a75d40a)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the latest commit, which replaces price-based inference of free OpenRouter endpoints with the explicit is_free endpoint metadata field, adds a new forbidden-free-models.ts family-matching helper (isForbiddenFreeModelFamily) to exclude forbidden free model families from OpenRouter overrides, and excludes forbidden exact Kilo-exclusive IDs from exclusive overrides; the changes are correct and covered by new focused unit tests, including a test proving the free-endpoint key snapshot excludes offerings injected after it is taken.

Files Reviewed (5 files)

• apps/web/src/lib/ai-gateway/forbidden-free-models.ts
• apps/web/src/lib/ai-gateway/forbidden-free-models.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/sync-providers.ts

Previous review (commit cbcc535)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the latest commit, which mechanically splits a per-category flip test suite out of agent-push-preference.test.ts into a new agent-push-preference.categories.test.ts file to satisfy the repository-wide max-lines lint rule; the moved assertions are behaviorally equivalent to the originals.

Files Reviewed (2 files)

• apps/mobile/src/lib/hooks/agent-push-preference.categories.test.ts
• apps/mobile/src/lib/hooks/agent-push-preference.test.ts

Previous review (commit ab656a7)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the follow-up commit that scopes the free-endpoint data-policy logic to public exclusive models and extends it to requires-data-collection paid exclusives; the tightened status !== 'public' filter and the widened !kfm.pricing || flags.includes('requires-data-collection') condition are both correct and covered by new focused unit tests (hidden-model exclusion, public data-collection exclusive application).

Files Reviewed (3 files)

• apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/sync-providers.ts

Previous review (commit 74a27d6)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the new free-endpoint data-policy normalization logic and its integration into sync-providers.ts; found no security, correctness, or reliability issues in the changed lines, and the change is covered by focused unit tests.

Files Reviewed (3 files)

• apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/free-endpoint-data-policy.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/sync-providers.ts

---

_{Reviewed by claude-sonnet-5 · Input: 28 · Output: 5.3K · Cached: 553.1K}

_{Review guidance: REVIEW.md from base branch main}