v13

What's Changed

Custom (BYOK) review models are honoured under an org model allow list

• The pre-flight model policy check no longer drops custom models (#188)
  • review_model, security_model, and fill_model set to a BYOK custom model (for example bedrock-sonnet-5-5, or custom:...) were rejected whenever the organization's model policy used an allow list, because custom models never appear in allowedModelIds. The review then ran on the organization's default model with the note "The code review model ... is not allowed by your organization's model policy". The server and CLI accept the model, so the action was stricter than the policy.
  • Custom models are now gated on the policy's allowCustomModels setting, matching the server. Factory model handling is unchanged.
  • A BYOK entry whose provider model name matches a Factory model id (for example a proxy for gpt-5.2) can no longer cause that Factory model to be dropped.

If you worked around this by passing --model through droid_args, you can move it back to review_model.

Full Changelog: v12...v13