feat: add manually configurable BYOK providers

[chrarnoldus]

Summary

• add owner-scoped manual BYOK providers with collision-safe manual: IDs and encrypted credentials
• support one provider-level base URL, model discovery and overrides, adapter metadata, request customization, and shared model defaults
• allow unrestricted advanced headers as an explicitly user-managed feature
• disable configuration, catalog exposure, and runtime routing on Vercel deployments
• keep the generated database migration in a separate commit

Verification

• pnpm --filter @kilocode/db typecheck
• pnpm --filter @kilocode/db lint
• pnpm --filter web typecheck
• pnpm --filter web lint
• targeted BYOK tests (52 passed)
• gateway route tests (23 passed)
• pnpm drizzle:verify-bootstrap
• git diff --check

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

One previously reported low-severity robustness gap remains open: the outbound fetch to a user-supplied manual BYOK upstream URL in byok-router.ts still has no timeout or response-size guard; the latest commits (rebasing onto current main, regenerating the manual BYOK migration as 0208, and gating name-derived fallback reasoning variants on the model's reasoning capability) introduce no new issues.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
apps/web/src/routers/byok-router.ts	180	fetchManualModels fetches an arbitrary user-supplied URL with no timeout or response-size guard

Files Reviewed (12 files)

• apps/web/src/app/api/openrouter/[...path]/route.ts (rebase-only changes; PR hunk unchanged)
• apps/web/src/components/organizations/byok/BYOKKeysManager.tsx (rebase-only change)
• apps/web/src/lib/ai-gateway/providers/direct-byok/index.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/index.test.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/sync-direct-byok.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/sync-direct-byok.test.ts
• apps/web/src/lib/ai-gateway/providers/get-provider.ts (rebase-only change)
• packages/db/src/migrations/0208_woozy_mindworm.sql (nullable jsonb column add — safe)
• packages/db/src/migrations/meta/_journal.json (generated)
• packages/db/src/schema.ts (rebase-only changes; PR hunk unchanged)
• packages/db/src/schema-types.ts (rebase-only changes; PR hunk unchanged)
• apps/web/src/routers/byok-router.ts - 1 issue

Fix these issues in Kilo Cloud

Previous Review Summaries (4 snapshots, latest commit 6cd17d8)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 6cd17d8)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

One previously reported low-severity robustness gap remains open: outbound fetches to user-supplied manual BYOK upstream URLs in byok-router.ts still have no timeout or response-size guard; the latest commits (regenerating the manual BYOK migration as 0206 and aligning fallback variant test expectations with the base branch) introduce no new issues, and the earlier organization-auto-model.ts dbClient finding is confirmed fixed.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
apps/web/src/routers/byok-router.ts	180	fetchManualModels fetches an arbitrary user-supplied URL with no timeout or response-size guard

Files Reviewed (8 files)

• apps/web/src/lib/ai-gateway/providers/direct-byok/index.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/byteplus-coding.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/sync-direct-byok.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/index.test.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/sync-direct-byok.test.ts
• packages/db/src/migrations/0206_concerned_namora.sql
• packages/db/src/migrations/meta/_journal.json
• apps/web/src/routers/byok-router.ts - 1 issue

Fix these issues in Kilo Cloud

Previous review (commit 5b06ad5)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

One previously reported low-severity robustness gap remains open: outbound fetches to user-supplied manual BYOK upstream URLs in byok-router.ts still have no timeout or response-size guard; the latest commit (removing user-configured manual model variants in favor of derived variants) introduces no new issues.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
apps/web/src/routers/byok-router.ts	180	fetchManualModels (and testManualProvider) fetch arbitrary user-supplied URLs with no timeout or response-size guard

Files Reviewed (5 files)

• apps/web/src/components/organizations/byok/ManualByokProviderFields.tsx
• apps/web/src/lib/ai-gateway/providers/direct-byok/index.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/manual-byok.ts
• packages/db/src/schema-types.ts
• apps/web/src/routers/byok-router.ts - 1 issue

Fix these issues in Kilo Cloud

Previous review (commit 1fdabae)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

One remaining low-severity robustness gap: outbound fetches to user-supplied manual BYOK upstream URLs have no timeout or response-size guard; the previously flagged transaction-client inconsistency in organization auto validation was fixed in the latest commit.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
apps/web/src/routers/byok-router.ts	180	fetchManualModels (and testManualProvider) fetch arbitrary user-supplied URLs with no timeout or response-size guard

Files Reviewed (3 files)

• apps/web/src/lib/ai-gateway/providers/direct-byok/index.ts
• apps/web/src/lib/organizations/organization-auto-model.ts
• apps/web/src/routers/byok-router.ts - 1 issue

Fix these issues in Kilo Cloud

Previous review (commit e71fe71)

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

Two low-severity robustness gaps in the new manual BYOK provider flow: the org-auto validation ignores the caller's transaction, and the server-side fetches to user-supplied upstream URLs lack timeouts.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	2

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
apps/web/src/lib/organizations/organization-auto-model.ts	122	Manual BYOK credential lookup ignores options.dbClient, inconsistent with the transaction-aware direct-BYOK branch
apps/web/src/routers/byok-router.ts	180	fetchManualModels (and testManualProvider) fetch arbitrary user-supplied URLs with no timeout or response-size guard

Files Reviewed (24 files)

• apps/web/src/app/api/openrouter/[...path]/route.ts
• apps/web/src/components/organizations/byok/BYOKKeysManager.tsx
• apps/web/src/components/organizations/byok/ManualByokProviderFields.tsx
• apps/web/src/lib/ai-gateway/byok/index.ts
• apps/web/src/lib/ai-gateway/byok/types.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/constants.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/index.test.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/index.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/manual-byok.test.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/manual-byok.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/openai-compatible-models.ts
• apps/web/src/lib/ai-gateway/providers/direct-byok/sync-direct-byok.ts
• apps/web/src/lib/ai-gateway/providers/get-provider.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.ts
• apps/web/src/lib/ai-gateway/providers/types.ts
• apps/web/src/lib/ai-gateway/providers/upstream-request.ts
• apps/web/src/lib/organizations/organization-auto-model.ts - 1 issue
• apps/web/src/routers/byok-router.test.ts
• apps/web/src/routers/byok-router.ts - 1 issue
• packages/db/src/migrations/0204_plain_marvex.sql (nullable jsonb column add — safe)
• packages/db/src/migrations/meta/0204_snapshot.json (generated)
• packages/db/src/migrations/meta/_journal.json (generated)
• packages/db/src/schema-types.ts
• packages/db/src/schema.ts

Verified: model-ID casing is normalized before manual credential matching; Vercel gating (VERCEL/VERCEL_ENV) consistently disables config, catalog, and runtime paths; role-gating keeps provider_settings to owner/billing_manager; no memory leaks (no un-cleaned listeners/timers); migration is a metadata-only nullable column add.

Fix these issues in Kilo Cloud

---

_{Reviewed by kimi-k3 · Input: 85.7K · Output: 16.4K · Cached: 1.2M}

_{Review guidance: REVIEW.md from base branch main}