feat(ai-gateway): remove gemma-4-26b-a4b-it:free, fall kilo-auto/small back to free rotation

[chrarnoldus]

Summary

• Removes the hidden Kilo-exclusive gemma_4_26b_a4b_it_free_model (google/gemma-4-26b-a4b-it:free) from the codebase. Its public ID was already present in forbiddenFreeModelIds; the stale "usable through kilo-auto" comment is updated.
• When the user has no balance, kilo-auto/small now falls back to the same free model rotation as kilo-auto/free (shared resolveFreeRotation helper) instead of routing to the removed Gemma free model. With balance, kilo-auto/small still resolves to google/gemma-4-26b-a4b-it.

Tests

• Adds kilo-auto/small branch coverage to resolution.test.ts (paid path, free-rotation fallback, free candidate selection).
• Replaces the removed model in existing tests (context-overflow, OpenRouter suppression, rewriteModelResponse cost stripping, mapModelIdToVercel) with the public stepfun_37_flash_free_model or local mocks.
• pnpm --filter web typecheck, oxlint, oxfmt, and all affected jest suites pass.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The incremental commit e123f63 only deletes explanatory comments and introduces no new defects; the one open finding remains the zero-balance kilo-auto/small fallback into the kilo-auto/free rotation escaping the proxy's free-model rate limit (author marked it intentional).

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/ai-gateway/auto-model/resolution.ts	305	The free-model rate limit in apps/web/src/app/api/openrouter/[...path]/route.ts:368-372 is not applied when the zero-balance kilo-auto/small fallback resolves to a non-Kilo-exclusive free model (autoModel is kilo-auto/small, routingTarget is null, isKiloExclusiveFreeModel is false). Author replied that this is intentional; thread left open for a maintainer decision

Files Reviewed (2 files in this incremental pass)

• apps/web/src/lib/ai-gateway/auto-model/resolution.ts - 0 new issues (comment-only deletions)
• apps/web/src/lib/ai-gateway/forbidden-free-models.ts - 0 new issues (comment-only deletion)

Notes

• Incremental review of 0bd3da2..e123f63. That range removes only code comments (the resolveFreeRotation doc comment, the kilo-auto/small fallback comment, and the forbiddenFreeModelIds entry comment); behavior is unchanged.
• Resolved since the previous pass: the kilo-auto/small metadata finding. max_completion_tokens was lowered to 16384 and supports_images to false in 0bd3da2, and apps/web/src/lib/ai-gateway/auto-model/index.ts is unchanged in this increment, so it is no longer reported.
• The rate-limit finding was re-verified against current HEAD (e123f63) in resolution.ts:301-305 and route.ts:368-372; the existing inline comment remains active, so no duplicate was posted.
• No new inline comments were posted in this pass. Tests were not executed (read-only review).

Fix these issues in Kilo Cloud

Previous Review Summaries (2 snapshots, latest commit 0bd3da2)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 0bd3da2)

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

The zero-balance kilo-auto/small fallback into the kilo-auto/free rotation still escapes the proxy's free-model rate limit, and its advertised output/context limits still exceed what the rotation guarantees.

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/ai-gateway/auto-model/resolution.ts	311	Free-model rate limit in api/openrouter/[...path]/route.ts:368-372 is still not applied when the kilo-auto/small fallback resolves to a non-Kilo-exclusive free model (autoModel is kilo-auto/small, routingTarget is null, isKiloExclusiveFreeModel is false)
apps/web/src/lib/ai-gateway/auto-model/resolution.ts	309	kilo-auto/small still advertises limits above the free rotation it can resolve to: max_completion_tokens 16384 and context_length 262144 vs kilo-auto/free's 10000 / 256000. supports_images was correctly lowered to false in 0bd3da2, so only the token/context portion of this finding remains

Files Reviewed (1 file in this incremental pass)

• apps/web/src/lib/ai-gateway/auto-model/index.ts - 0 new issues

Notes

• Incremental review of 8ece2bb..0bd3da2, which only changes KILO_AUTO_SMALL_MODEL metadata (max_completion_tokens 32768 -> 16384, supports_images true -> false) and adds an invariant comment. No new defects introduced by that commit.
• The new invariant comment claims lowest-common-denominator metadata, but context_length (262144) and max_completion_tokens (16384) remain above the values KILO_AUTO_FREE_MODEL advertises for the same rotation; max_completion_tokens for google/gemma-4-26b-a4b-it and the OpenRouter-sourced rotation members could not be verified from repository code.
• Both previously reported findings were re-verified against current HEAD; no test expectations reference the changed 32768 / supports_images values.
• Tests were not executed (read-only review).

Fix these issues in Kilo Cloud

Previous review (commit 8ece2bb)

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

Routing kilo-auto/small to the kilo-auto/free rotation for zero-balance users escapes the free-model rate limit in the OpenRouter proxy route and exposes capabilities (vision, 32k output) the rotation candidates do not guarantee.

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/ai-gateway/auto-model/resolution.ts	311	Free-model rate limit in api/openrouter/[...path]/route.ts is not applied when the kilo-auto/small fallback resolves to a non-Kilo-exclusive free model
apps/web/src/lib/ai-gateway/auto-model/resolution.ts	309	kilo-auto/small advertises supports_images: true / 32768 output tokens while the free rotation advertises supports_images: false / 10000; branch can also now fail with no_free_models_available

Files Reviewed (9 files)

• apps/web/src/lib/ai-gateway/auto-model/resolution.ts - 2 issues
• apps/web/src/lib/ai-gateway/auto-model/resolution.test.ts - 0 issues
• apps/web/src/lib/ai-gateway/context-overflow.test.ts - 0 issues
• apps/web/src/lib/ai-gateway/forbidden-free-models.ts - 0 issues
• apps/web/src/lib/ai-gateway/models.ts - 0 issues
• apps/web/src/lib/ai-gateway/providers/google.ts - 0 issues
• apps/web/src/lib/ai-gateway/providers/openrouter/index.test.ts - 0 issues
• apps/web/src/lib/ai-gateway/providers/vercel/mapModelIdToVercel.test.ts - 0 issues
• apps/web/src/lib/rewriteModelResponse.test.ts - 0 issues

Notes

• Verified no remaining references to gemma_4_26b_a4b_it_free_model or google/gemma-4-26b-a4b-it:free outside forbiddenFreeModelIds, matching the apps/web/src/lib/ai-gateway/AGENTS.md rule for removed free models.
• Test replacements check out: stepfun_37_flash_free_model is public, vercel-routing flagged with internal_id stepfun/step-3.7-flash, and has context_length 262144, so the mapModelIdToVercel and context-overflow expectations hold. shouldSuppressOpenRouterModel is pure, so the locally built hiddenFreeModel mock is valid.
• Tests were not executed (read-only review).

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-opus-5 · Input: 28 · Output: 5.7K · Cached: 549K}

_{Review guidance: REVIEW.md from base branch main}