fix(gastown): use the configured BYOK model for review-thread classification

[maphew]

Refs #4268 (does not close it — the issue also asks for disclosure/configurability of the auxiliary model for non-BYOK users).

Problem

areThreadsBlocking() in services/gastown/src/dos/town/town-scm.ts always classified unresolved PR review threads with a hardcoded Cloudflare Workers AI call (@cf/google/gemma-4-26b-a4b-it). A BYOK town therefore had one review-path call that ignored the town's configured model, with no UI control or disclosure.

This is a separate follow-up from the Code Reviewer credit-balance fix. The Workers AI call runs on the Cloudflare binding, not the Kilo gateway, so it does not draw Kilo credits; the motivation here is BYOK users expecting the configured model to be used throughout the flow (and the issue's request that the auxiliary call be honored/configurable).

Change

• When role_models.refinery ?? default_model is a direct-BYOK model and the town has a kilocode_token, classify via POST {KILO_API_URL}/api/openrouter/chat/completions on that model. The call uses the town's Kilo token (the same token injected into the container as KILOCODE_TOKEN), sends X-KiloCode-Feature: gastown and, for org towns, X-KiloCode-OrganizationId. The gateway resolves the direct-BYOK model to the user's own provider key (getDirectByokModel), so the call bills that key.
• Non-BYOK towns keep the existing Workers AI path. Managed users see no change.
• A rejected/failed BYOK call throws and areThreadsBlocking() conservatively returns true (blocks auto-merge) rather than silently substituting a different model.
• New @kilocode/worker-utils/direct-byok-model exports isDirectByokModelId() / DIRECT_BYOK_PROVIDER_IDS, plus a drift-guard test in apps/web that keeps the list equal to DIRECT_BYOK_PROVIDERS_META.

Adversarial review

An independent review pass and a second round of checks found two issues, both fixed in the second commit:

1. Reasoning models could starve content. Reasoning-tagged BYOK models (e.g. zai-coding, the recommended neuralwatt models) can spend the 256-token budget on a thinking trace and return no JSON, which would block auto-merge for BYOK towns. The request now sends reasoning: { enabled: false, effort: 'none' } (the gateway's canonical "none" variant), mirroring the Gemma path's enable_thinking: false. Test asserts it.
2. Failure-rationale wording was inaccurate. The docs/comment claimed Workers AI is "Kilo-billed"; it is infrastructure cost, not user credits. Reworded. Fail-closed is kept so a BYOK town never silently falls back to a different model than the one the user configured.

Also reviewed and accepted:

• Token acceptance: the gateway requires audience KILO_GATEWAY_AUDIENCE, but isKiloResourceAudienceAllowed(..., mode: 'allow-legacy') accepts the town token's missing aud claim, so existing gastown tokens work.
• Org header: X-KiloCode-OrganizationId matches ORGANIZATION_ID_HEADER (case-insensitive); verified against security-auto-analysis and review-memory callers.
• Prefix-only detection: isDirectByokModelId() matches on the provider prefix, while the gateway routes to BYOK only for catalog model ids. The configured model comes from the same picker/catalog that mints these ids; an unknown provider/model under a direct-BYOK prefix is rejected (4xx) by the gateway and fails closed. Documented in the module.
• Rig overrides: resolution is town-level (role_models.refinery ?? default_model), consistent with the rest of the auto-merge path; SCMContext carries no rig. Noted in a code comment.

Verification

• services/gastown: tsgo --noEmit, oxlint (0 warnings/errors), vitest run — 344 passed (9 in the new town-scm.test.ts: BYOK→gateway incl. headers/body/reasoning, refinery-model preference, managed-refinery override of a BYOK default, org header, non-BYOK→Workers AI, no-token→Workers AI, 402→blocking without fallback, network error→blocking without fallback, empty content→blocking).
• packages/worker-utils: tsgo --noEmit, oxlint, vitest run — 602 passed.
• apps/web: tsgo --noEmit passes with the new drift guard. The drift test itself could not run in this sandbox because apps/web Jest's per-worker setup requires a live PostgreSQL (no Docker available); the list equality was validated directly and CI covers the Jest run.
• oxfmt --list-different clean on all changed files.

Notes

• PR fix(code-review): pin a same-vendor small model for BYOK reviews #6033 (same-vendor small model for BYOK Code Reviewer) is still open and unmerged, so its model-selection.ts resolution is not on main; this PR keeps the self-contained provider list + drift guard rather than depending on it.
• Non-BYOK towns still use an undisclosed hardcoded classifier; making it configurable/disclosed is left to nitpick: BYOK Code Reviewer still uses hardcoded Gemma 4 (Kilo credits) alongside the configured BYOK model — please use the BYOK model for everything #4268, hence Refs, not Fixes.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (7 files)

• apps/web/src/lib/ai-gateway/providers/direct-byok/direct-byok-provider-ids.drift.test.ts
• packages/worker-utils/package.json
• packages/worker-utils/src/direct-byok-model.test.ts
• packages/worker-utils/src/direct-byok-model.ts
• services/gastown/docs/local-debug-testing.md
• services/gastown/src/dos/town/town-scm.test.ts
• services/gastown/src/dos/town/town-scm.ts

---

_{Reviewed by grok-4.6 · Input: 100K · Output: 11.3K · Cached: 256.1K}

_{Review guidance: REVIEW.md from base branch main}