Keep provider-native AI calls out of platform AI usage

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Brooooooklyn

platform/packages/proxy/src/ai.ts

@@ -210,15 +210,13 @@ function applyProviderHeaders({
   headers,
   provider,
   providerKey,
-  usageTag,
   apiKeyHeader,
   apiKeyPrefix,
   contentType,
 }: {
   headers: Headers;
   provider: string;
   providerKey: string;
-  usageTag: string;
   apiKeyHeader?: string | null;
   apiKeyPrefix?: string | null;
   contentType?: string;
@@ -228,15 +226,17 @@ function applyProviderHeaders({
   const keyPrefix = apiKeyPrefix ?? defaults.prefix;
 
   headers.set(keyHeader, `${keyPrefix}${providerKey}`);
-  // Runs after the key header is set, so a caller-chosen key header name
-  // cannot set a gateway control either.
+  // Provider-native calls bill to the app's own provider key, so they carry
+  // no usage tag and do not count toward the platform AI allowance. Caller
+  // gateway headers are dropped after the key header is set, so neither they
+  // nor a caller-chosen key header name can set gateway metadata, logging,
+  // cost or billing.
   const callerGatewayHeaders = [...headers.keys()].filter((name) =>
     GATEWAY_CONTROL_HEADER.test(name),
   );
   for (const name of callerGatewayHeaders) {
     headers.delete(name);
   }
-  headers.set('cf-aig-metadata', JSON.stringify({ projectId: usageTag }));
   if (contentType && !headers.has('content-type')) {
     headers.set('content-type', contentType);
   }
@@ -421,7 +421,6 @@ ai.post('/provider', async (context) => {
       headers: headersFromRecord(body.headers),
       provider,
       providerKey,
-      usageTag: await deriveAiUsageTag(context.env.JWT_SECRET, projectId),
       apiKeyHeader,
       apiKeyPrefix,
       contentType: requestBody.contentType,

platform/packages/proxy/test/unit/proxy.test.ts

@@ -1834,10 +1834,7 @@ describe('proxy worker', () => {
       expect(init.method).toBe('POST');
       const headers = new Headers(init.headers);
       expect(headers.get('authorization')).toBe('Bearer sk-test-key');
-      expect(headers.get('cf-aig-metadata')).toBe(
-        JSON.stringify({ projectId: usageTags['proj_000000000001'] }),
-      );
-      expect(headers.has('cf-aig-metadata-projectId')).toBe(false);
+      expect([...headers.keys()].filter((name) => name.startsWith('cf-aig-'))).toEqual([]);
       expect(headers.get('content-type')).toBe('application/json');
       expect(headers.get('openai-beta')).toBe('assistants=v2');
       expect(JSON.parse(init.body as string)).toEqual({
@@ -1896,16 +1893,13 @@ describe('proxy worker', () => {
       const headers = new Headers(fetchMock.mock.calls[0][1]!.headers);
       expect(headers.get('x-goog-api-key')).toBe('google-key');
       expect(headers.get('authorization')).toBeNull();
-      expect(headers.get('cf-aig-metadata')).toBe(
-        JSON.stringify({ projectId: usageTags['proj_000000000001'] }),
-      );
+      expect([...headers.keys()].filter((name) => name.startsWith('cf-aig-'))).toEqual([]);
     });
 
-    it('keeps gateway control headers under platform control', async () => {
+    it('drops caller gateway control headers on provider-native calls', async () => {
       function gatewayHeaders(headers: Headers): Array<[string, string]> {
         return [...headers].filter(([name]) => name.startsWith('cf-aig-'));
       }
-      const signedMetadata = JSON.stringify({ projectId: usageTags['proj_000000000001'] });
       const fetchMock = mockProviderFetch('{}', {
         headers: { 'content-type': 'application/json' },
       });
@@ -1931,7 +1925,7 @@ describe('proxy worker', () => {
       );
       expect(callerHeaders.status).toBe(200);
       const forwarded = new Headers(fetchMock.mock.calls[0][1]!.headers);
-      expect(gatewayHeaders(forwarded)).toStrictEqual([['cf-aig-metadata', signedMetadata]]);
+      expect(gatewayHeaders(forwarded)).toStrictEqual([]);
       expect(forwarded.get('x-keep')).toBe('yes');
       expect(forwarded.get('authorization')).toBe('Bearer sk-test');
 
@@ -1948,9 +1942,7 @@ describe('proxy worker', () => {
         env,
       );
       expect(keyHeader.status).toBe(200);
-      expect(gatewayHeaders(new Headers(fetchMock.mock.calls[1][1]!.headers))).toStrictEqual([
-        ['cf-aig-metadata', signedMetadata],
-      ]);
+      expect(gatewayHeaders(new Headers(fetchMock.mock.calls[1][1]!.headers))).toStrictEqual([]);
     });
 
     it('reconstructs multipart form data bodies', async () => {