feat(models): restrict trinity thinking free to kiloclaw and openclaw

[kilo-code-bot]

Summary

• Add exclusive_to: ReadonlyArray<FeatureValue> field to KiloExclusiveModel (required; empty array means no restriction). All existing models get exclusive_to: [].
• Set exclusive_to: ['kiloclaw', 'openclaw'] on trinity large thinking free so it is only available to KiloClaw/OpenClaw clients.
• Add filterByFeature(models, feature) helper used by both /models endpoints to remove models whose exclusive_to list does not include the request's feature header. Models are always included when no feature header is sent (backwards-compatible for clients that don't set the header).
• Block proxy requests in the LLM proxy handler early (before rate limiting) with HTTP 403 when the model's exclusive_to restriction does not match; the error message interpolates the allowed feature values and suggests kilo-auto/free as a free alternative.
• Trinity thinking free was not in preferredModels, so no removal was necessary.

Verification

• CI passes: typecheck, lint, format, build, test all green.

Visual Changes

N/A

Reviewer Notes

• isExcludedForFeature returns false (include the model) when feature is null (no header) — intentional per spec since not all clients set the header.
• The exclusivity check runs before rate limiting so rejected requests do not consume free-model quota.
• The 403 status was chosen as it semantically means "forbidden for your client type", distinct from 404 used for dead/forbidden models.
• BYOK models are not affected since filterByFeature / isExcludedForFeature only check kiloExclusiveModels.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/models.ts	105	Invalid x-kilocode-feature values are collapsed to null, so callers can still bypass the exclusivity restriction by sending any unrecognized feature header.

Other Observations (not in diff)

• No new issues found in the incremental diff.
• Previously reported issue in apps/web/src/app/api/openrouter/[...path]/route.ts remains resolved: the exclusivity check still runs before rate limiting and logFreeModelRequest().

Files Reviewed (1 files)

• apps/web/src/lib/llm-proxy-helpers.ts - 0 new issues

---

_{Reviewed by gpt-5.4-20260305 · 579,559 tokens}