From 1bd84b7b58bbb262fa3f3251045af03cfb920abf Mon Sep 17 00:00:00 2001
From: Mark IJbema <mark@kilocode.ai>
Date: Mon, 25 May 2026 09:39:52 +0200
Subject: [PATCH 1/4] fix(gateway): persist provider-funded route billing
 decision

---
 .../src/app/api/dev/consume-credits/route.ts  |   1 +
 apps/web/src/app/api/fim/completions/route.ts |   1 +
 .../src/app/api/openrouter/[...path]/route.ts | 177 ++++++++++--------
 .../openrouter/audio/transcriptions/route.ts  |   1 +
 .../app/api/openrouter/embeddings/route.ts    |   1 +
 apps/web/src/lib/ai-gateway/is-free-model.ts  |  16 +-
 apps/web/src/lib/ai-gateway/models.test.ts    |   1 +
 .../src/lib/ai-gateway/processUsage.test.ts   |  76 ++++++++
 apps/web/src/lib/ai-gateway/processUsage.ts   |  25 ++-
 .../src/lib/ai-gateway/processUsage.types.ts  |   2 +
 .../lib/ai-gateway/providers/get-provider.ts  |  17 +-
 .../tests/helpers/microdollar-usage.helper.ts |   2 +
 12 files changed, 222 insertions(+), 98 deletions(-)

diff --git a/apps/web/src/app/api/dev/consume-credits/route.ts b/apps/web/src/app/api/dev/consume-credits/route.ts
index 167b0dcb51..22206d6bbe 100644
--- a/apps/web/src/app/api/dev/consume-credits/route.ts
+++ b/apps/web/src/app/api/dev/consume-credits/route.ts
@@ -89,6 +89,7 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       editor_name: null,
       machine_id: null,
       user_byok: false,
+      provider_funded: false,
       has_tools: false,
       feature: null,
       session_id: null,
diff --git a/apps/web/src/app/api/fim/completions/route.ts b/apps/web/src/app/api/fim/completions/route.ts
index dfb1181756..914d4f57e0 100644
--- a/apps/web/src/app/api/fim/completions/route.ts
+++ b/apps/web/src/app/api/fim/completions/route.ts
@@ -177,6 +177,7 @@ export async function POST(request: NextRequest) {
     editor_name: extractHeaderAndLimitLength(request, 'x-kilocode-editorname'),
     machine_id: extractHeaderAndLimitLength(request, 'x-kilocode-machineid'),
     user_byok: !!userByok,
+    provider_funded: false,
     has_tools: false,
     feature: validateFeatureHeader(request.headers.get(FEATURE_HEADER)),
     session_id: taskId ?? null,
diff --git a/apps/web/src/app/api/openrouter/[...path]/route.ts b/apps/web/src/app/api/openrouter/[...path]/route.ts
index ee49a96162..33b8aa2765 100644
--- a/apps/web/src/app/api/openrouter/[...path]/route.ts
+++ b/apps/web/src/app/api/openrouter/[...path]/route.ts
@@ -104,6 +104,19 @@ const MAX_TOKENS_LIMIT = 99999999999; // GPT4.1 default is ~32k
 const PAID_MODEL_AUTH_REQUIRED = 'PAID_MODEL_AUTH_REQUIRED';
 const PROMOTION_MODEL_LIMIT_REACHED = 'PROMOTION_MODEL_LIMIT_REACHED';
 
+function paidModelAuthRequiredResponse() {
+  return NextResponse.json(
+    {
+      error: {
+        code: PAID_MODEL_AUTH_REQUIRED,
+        message: 'You need to sign in to use this model.',
+      },
+      error_type: ProxyErrorType.paid_model_auth_required,
+    },
+    { status: 401 }
+  );
+}
+
 function validatePath(
   url: URL
 ):
@@ -274,33 +287,9 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     );
   }
 
-  // For FREE models: check rate limit, log at start.
-  // Server-side products (cloud-agent, code-review, app-builder) rate-limit
-  // per user when the request comes from Cloudflare IPs (Kilo infrastructure).
-  // All other products rate-limit per IP (fast pre-auth path).
-  const isRateLimitedFreeModelRequest =
-    isKiloExclusiveFreeModel(originalModelIdLowerCased) ||
-    autoModel === KILO_AUTO_FREE_MODEL.id ||
-    (await isPublicIdExperimented(originalModelIdLowerCased));
-  if (isRateLimitedFreeModelRequest) {
-    const rateLimit = await resolveRateLimit(feature, ipAddress, authPromise);
-    if (rateLimit instanceof NextResponse) return rateLimit;
-
-    if (!rateLimit.result.allowed) {
-      console.warn(
-        `Free model rate limit exceeded, ${rateLimit.subject}, model: ${originalModelIdLowerCased}, request count: ${rateLimit.result.requestCount}`
-      );
-      return NextResponse.json(
-        {
-          error: 'Rate limit exceeded',
-          error_type: ProxyErrorType.rate_limit_exceeded,
-          message:
-            'Free model usage limit reached. Please try again later or upgrade to a paid model.',
-        },
-        { status: 429 }
-      );
-    }
-  }
+  // Membership is only a routing eligibility snapshot. A request is not
+  // provider-funded unless provider selection resolves an active variant.
+  const isExperimentCandidate = await isPublicIdExperimented(originalModelIdLowerCased);
 
   // Now check auth
   const authSpan = startInactiveSpan({ name: 'auth-check' });
@@ -319,46 +308,13 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
   let tokenSource: string | undefined = authTokenSource;
 
   if (authFailedResponse) {
-    // No valid auth
-    if (!(await isFreeModel(originalModelIdLowerCased))) {
-      // Paid model requires authentication
-      return NextResponse.json(
-        {
-          error: {
-            code: PAID_MODEL_AUTH_REQUIRED,
-            message: 'You need to sign in to use this model.',
-          },
-          error_type: ProxyErrorType.paid_model_auth_required,
-        },
-        { status: 401 }
-      );
-    }
-
-    const promotionLimit = await checkPromotionLimit(ipAddress);
-
-    if (!promotionLimit.allowed) {
-      console.warn(
-        `Promotion model limit exceeded, ip: ${ipAddress}, ` +
-          `model: ${originalModelIdLowerCased}, ` +
-          `requests: ${promotionLimit.requestCount}/${PROMOTION_MAX_REQUESTS} ` +
-          `in ${PROMOTION_WINDOW_HOURS}h window`
-      );
-
-      return NextResponse.json(
-        {
-          error: {
-            code: PROMOTION_MODEL_LIMIT_REACHED,
-            message:
-              'Sign up for free to continue and explore 500 other models. ' +
-              'Takes 2 minutes, no credit card required. Or come back later.',
-          },
-          error_type: ProxyErrorType.promotion_limit_reached,
-        },
-        { status: 401 } // TODO: Change to 429 once the extension supports it (see kilocode errorUtils.ts)
-      );
+    // A potential experiment request must reach provider selection before we
+    // know whether this specific request is provider-funded.
+    if (!(await isFreeModel(originalModelIdLowerCased)) && !isExperimentCandidate) {
+      return paidModelAuthRequiredResponse();
     }
 
-    // Anonymous access for free model (already rate-limited above)
+    // Provider selection validates whether a candidate request is actually funded.
     user = createAnonymousContext(ipAddress);
     organizationId = undefined;
     botId = undefined;
@@ -374,15 +330,6 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     return storeAndPreviousResponseIdIsNotSupported();
   }
 
-  // Log to free_model_usage for rate limiting (at request start, before processing)
-  if (isRateLimitedFreeModelRequest) {
-    await logFreeModelRequest(
-      ipAddress,
-      originalModelIdLowerCased,
-      isAnonymousContext(user) ? undefined : user.id
-    );
-  }
-
   // Use new shared helper for fraud & project headers
   const { fraudHeaders, projectId } = extractFraudAndProjectHeaders(request);
   const providerResult = await getProvider({
@@ -393,6 +340,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     taskId,
     clientIp: ipAddress ?? null,
     machineId: machineIdHeader,
+    isExperimentCandidate,
   });
   if (providerResult.kind === 'not-found') {
     // Paused experiment for this public id — return a local model-unavailable
@@ -410,6 +358,77 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     skipKiloExclusiveModelSettings,
     experiment,
   } = providerResult;
+  const providerFunded = experiment !== undefined;
+
+  // A stale experiment-membership hit can allow an anonymous request as far as
+  // provider selection. It does not make ordinary fallback routing free.
+  if (
+    isAnonymousContext(user) &&
+    !providerFunded &&
+    !(await isFreeModel(originalModelIdLowerCased))
+  ) {
+    return paidModelAuthRequiredResponse();
+  }
+
+  // Provider-funded routes join the free-model rate-limiting path only after
+  // provider selection; stale membership cannot rate-limit or log paid fallback traffic.
+  const isRateLimitedFreeModelRequest =
+    isKiloExclusiveFreeModel(originalModelIdLowerCased) ||
+    autoModel === KILO_AUTO_FREE_MODEL.id ||
+    providerFunded;
+  if (isRateLimitedFreeModelRequest) {
+    const rateLimit = await resolveRateLimit(feature, ipAddress, authPromise);
+    if (rateLimit instanceof NextResponse) return rateLimit;
+
+    if (!rateLimit.result.allowed) {
+      console.warn(
+        `Free model rate limit exceeded, ${rateLimit.subject}, model: ${originalModelIdLowerCased}, request count: ${rateLimit.result.requestCount}`
+      );
+      return NextResponse.json(
+        {
+          error: 'Rate limit exceeded',
+          error_type: ProxyErrorType.rate_limit_exceeded,
+          message:
+            'Free model usage limit reached. Please try again later or upgrade to a paid model.',
+        },
+        { status: 429 }
+      );
+    }
+  }
+
+  if (isAnonymousContext(user)) {
+    const promotionLimit = await checkPromotionLimit(ipAddress);
+
+    if (!promotionLimit.allowed) {
+      console.warn(
+        `Promotion model limit exceeded, ip: ${ipAddress}, ` +
+          `model: ${originalModelIdLowerCased}, ` +
+          `requests: ${promotionLimit.requestCount}/${PROMOTION_MAX_REQUESTS} ` +
+          `in ${PROMOTION_WINDOW_HOURS}h window`
+      );
+
+      return NextResponse.json(
+        {
+          error: {
+            code: PROMOTION_MODEL_LIMIT_REACHED,
+            message:
+              'Sign up for free to continue and explore 500 other models. ' +
+              'Takes 2 minutes, no credit card required. Or come back later.',
+          },
+          error_type: ProxyErrorType.promotion_limit_reached,
+        },
+        { status: 401 } // TODO: Change to 429 once the extension supports it (see kilocode errorUtils.ts)
+      );
+    }
+  }
+
+  if (isRateLimitedFreeModelRequest) {
+    await logFreeModelRequest(
+      ipAddress,
+      originalModelIdLowerCased,
+      isAnonymousContext(user) ? undefined : user.id
+    );
+  }
 
   // Request-level data-collection opt-out: a caller can set
   // `provider.data_collection: 'deny'` or `provider.zdr: true` on any
@@ -482,6 +501,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     editor_name: extractHeaderAndLimitLength(request, 'x-kilocode-editorname'),
     machine_id: machineIdHeader,
     user_byok: !!userByok,
+    provider_funded: providerFunded,
     has_tools: (requestBodyParsed.body.tools?.length ?? 0) > 0,
     botId,
     tokenSource,
@@ -499,7 +519,12 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
   if (!isAnonymousContext(user) && !bypassAccessCheck) {
     const { balance, settings, plan } = await balanceAndSettingsPromise;
 
-    if (balance <= 0 && !(await isFreeModel(originalModelIdLowerCased)) && !userByok) {
+    if (
+      balance <= 0 &&
+      !providerFunded &&
+      !(await isFreeModel(originalModelIdLowerCased)) &&
+      !userByok
+    ) {
       return await usageLimitExceededResponse(user, balance);
     }
 
@@ -540,8 +565,6 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
   if (experiment) {
     usageContext.modelExperimentVariantVersionId = experiment.variantVersionId;
     usageContext.modelExperimentAllocationSubject = experiment.allocationSubject;
-    // Cost zeroing for experiment traffic is handled by `isFreeModel`, which
-    // returns true for experimented public ids.
   }
 
   sentryRootSpan()?.setAttribute(
diff --git a/apps/web/src/app/api/openrouter/audio/transcriptions/route.ts b/apps/web/src/app/api/openrouter/audio/transcriptions/route.ts
index 6eb767b78e..3d77611110 100644
--- a/apps/web/src/app/api/openrouter/audio/transcriptions/route.ts
+++ b/apps/web/src/app/api/openrouter/audio/transcriptions/route.ts
@@ -155,6 +155,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     editor_name: extractHeaderAndLimitLength(request, 'x-kilocode-editorname'),
     machine_id: extractHeaderAndLimitLength(request, 'x-kilocode-machineid'),
     user_byok: !!userByok,
+    provider_funded: false,
     has_tools: false,
     botId,
     tokenSource,
diff --git a/apps/web/src/app/api/openrouter/embeddings/route.ts b/apps/web/src/app/api/openrouter/embeddings/route.ts
index a8d6e2ef0f..6a7731b220 100644
--- a/apps/web/src/app/api/openrouter/embeddings/route.ts
+++ b/apps/web/src/app/api/openrouter/embeddings/route.ts
@@ -183,6 +183,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     editor_name: extractHeaderAndLimitLength(request, 'x-kilocode-editorname'),
     machine_id: extractHeaderAndLimitLength(request, 'x-kilocode-machineid'),
     user_byok: !!userByok,
+    provider_funded: false,
     has_tools: false,
     botId,
     tokenSource,
diff --git a/apps/web/src/lib/ai-gateway/is-free-model.ts b/apps/web/src/lib/ai-gateway/is-free-model.ts
index cbd8eab678..1756c6c616 100644
--- a/apps/web/src/lib/ai-gateway/is-free-model.ts
+++ b/apps/web/src/lib/ai-gateway/is-free-model.ts
@@ -1,16 +1,11 @@
 import { KILO_AUTO_FREE_MODEL } from '@/lib/ai-gateway/auto-model';
 import { isKiloExclusiveFreeModel, isOpenRouterStealthModel } from '@/lib/ai-gateway/models';
-import { isPublicIdExperimented } from '@/lib/ai-gateway/experiments/membership';
 
 /**
- * Returns true if `model` should be treated as free for the requesting user
- * this request — including dedicated experimented public ids, which are
- * partner/Kilo-funded for v1.
- *
- * Server-only: consults a Redis-backed membership set for experiment routing.
- * Lives outside `models.ts` so client bundles importing the model-id
- * constants (`PRIMARY_DEFAULT_MODEL`, `preferredModels`, …) from `models.ts`
- * don't transitively pull in the Redis client.
+ * Returns true when `model` is intrinsically free. Request-specific funding,
+ * such as a selected provider-funded experiment variant, is recorded on the
+ * usage context after routing and must not be inferred from mutable model
+ * membership.
  */
 export async function isFreeModel(model: string): Promise<boolean> {
   return (
@@ -18,7 +13,6 @@ export async function isFreeModel(model: string): Promise<boolean> {
     model === KILO_AUTO_FREE_MODEL.id ||
     (model ?? '').endsWith(':free') ||
     model === 'openrouter/free' ||
-    isOpenRouterStealthModel(model ?? '') ||
-    (await isPublicIdExperimented(model ?? ''))
+    isOpenRouterStealthModel(model ?? '')
   );
 }
diff --git a/apps/web/src/lib/ai-gateway/models.test.ts b/apps/web/src/lib/ai-gateway/models.test.ts
index f527879b9b..ed13733cfd 100644
--- a/apps/web/src/lib/ai-gateway/models.test.ts
+++ b/apps/web/src/lib/ai-gateway/models.test.ts
@@ -114,6 +114,7 @@ describe('isFreeModel', () => {
       expect(await isFreeModel('claude-3.7-sonnet')).toBe(false);
       expect(await isFreeModel('anthropic/claude-sonnet-4')).toBe(false);
       expect(await isFreeModel('google/gemini-2.5-pro')).toBe(false);
+      expect(await isFreeModel('preview/provider-funded-model')).toBe(false);
     });
 
     test('should return false for models with "free" in the middle', async () => {
diff --git a/apps/web/src/lib/ai-gateway/processUsage.test.ts b/apps/web/src/lib/ai-gateway/processUsage.test.ts
index 96215edfd8..c112fe64f2 100644
--- a/apps/web/src/lib/ai-gateway/processUsage.test.ts
+++ b/apps/web/src/lib/ai-gateway/processUsage.test.ts
@@ -8,6 +8,7 @@ import {
   mapToUsageStats,
   logMicrodollarUsage,
   processOpenRouterUsage,
+  processTokenData,
   stripNulBytesInPlace,
   toInsertableDbUsageRecord,
 } from './processUsage';
@@ -383,6 +384,7 @@ describe('logMicrodollarUsage', () => {
       editor_name: null,
       machine_id: null,
       user_byok: false,
+      provider_funded: false,
       has_tools: false,
       feature: 'vscode-extension',
       session_id: null,
@@ -512,6 +514,79 @@ describe('logMicrodollarUsage', () => {
     expect(metadataRecord?.has_middle_out_transform).toBe(false);
   });
 
+  test('zeroes selected provider-funded traffic using the persisted route decision', async () => {
+    const user = await insertTestUser({
+      id: 'test-provider-funded-user',
+      microdollars_used: 2000,
+      google_user_email: 'provider-funded@example.com',
+    });
+    const usageStats: MicrodollarUsageStats = {
+      ...BASE_USAGE_STATS,
+      messageId: 'test-provider-funded-msg',
+      cost_mUsd: 500,
+      cacheDiscount_mUsd: 25,
+      is_byok: false,
+    };
+    const usageContext: MicrodollarUsageContext = {
+      ...createBaseUsageContext(user),
+      requested_model: 'preview/provider-funded-model',
+      provider_funded: true,
+    };
+
+    await processTokenData(usageStats, usageContext);
+
+    const metadataRecord = await db.query.microdollar_usage_metadata.findFirst({
+      where: eq(microdollar_usage_metadata.message_id, 'test-provider-funded-msg'),
+    });
+    const usageRecord = metadataRecord
+      ? await db.query.microdollar_usage.findFirst({
+          where: eq(microdollar_usage.id, metadataRecord.id),
+        })
+      : undefined;
+    const updatedUser = await findUserById(user.id);
+
+    expect(usageRecord?.cost).toBe(0);
+    expect(usageRecord?.cache_discount).toBe(0);
+    expect(metadataRecord?.market_cost).toBe(500);
+    expect(metadataRecord?.is_free).toBe(true);
+    expect(updatedUser?.microdollars_used).toBe(2000);
+  });
+
+  test('bills ordinary traffic without a persisted provider-funded decision', async () => {
+    const user = await insertTestUser({
+      id: 'test-non-funded-preview-user',
+      microdollars_used: 2000,
+      google_user_email: 'non-funded-preview@example.com',
+    });
+    const usageStats: MicrodollarUsageStats = {
+      ...BASE_USAGE_STATS,
+      messageId: 'test-non-funded-preview-msg',
+      cost_mUsd: 500,
+      is_byok: false,
+    };
+    const usageContext: MicrodollarUsageContext = {
+      ...createBaseUsageContext(user),
+      requested_model: 'preview/provider-funded-model',
+      provider_funded: false,
+    };
+
+    await processTokenData(usageStats, usageContext);
+
+    const metadataRecord = await db.query.microdollar_usage_metadata.findFirst({
+      where: eq(microdollar_usage_metadata.message_id, 'test-non-funded-preview-msg'),
+    });
+    const usageRecord = metadataRecord
+      ? await db.query.microdollar_usage.findFirst({
+          where: eq(microdollar_usage.id, metadataRecord.id),
+        })
+      : undefined;
+    const updatedUser = await findUserById(user.id);
+
+    expect(usageRecord?.cost).toBe(500);
+    expect(metadataRecord?.is_free).toBe(false);
+    expect(updatedUser?.microdollars_used).toBe(2500);
+  });
+
   test('stores 3 usage records with overlapping data and tests metadata deduplication', async () => {
     const user = await insertTestUser({
       id: 'test-dedup-user',
@@ -943,6 +1018,7 @@ describe('toInsertableDbUsageRecord NUL-byte sanitization', () => {
       editor_name: 'vscode',
       machine_id: 'machine',
       user_byok: false,
+      provider_funded: false,
       has_tools: false,
       feature: null,
       session_id: 'session',
diff --git a/apps/web/src/lib/ai-gateway/processUsage.ts b/apps/web/src/lib/ai-gateway/processUsage.ts
index 54a46a2c21..682fa0cf43 100644
--- a/apps/web/src/lib/ai-gateway/processUsage.ts
+++ b/apps/web/src/lib/ai-gateway/processUsage.ts
@@ -132,6 +132,7 @@ export function extractUsageContextInfo(usageContext: MicrodollarUsageContext) {
     api_kind: usageContext.api_kind,
     machine_id: usageContext.machine_id,
     is_user_byok: usageContext.user_byok,
+    provider_funded: usageContext.provider_funded,
     has_tools: usageContext.has_tools,
     feature: usageContext.feature,
     session_id: usageContext.session_id,
@@ -178,8 +179,15 @@ export async function toInsertableDbUsageRecord(
   const id = randomUUID();
   const created_at = new Date().toISOString();
 
-  const { kilo_user_id, organization_id, project_id, provider, ttfb_ms, ...metadataFromContext } =
-    usageContextInfo;
+  const {
+    kilo_user_id,
+    organization_id,
+    project_id,
+    provider,
+    ttfb_ms,
+    provider_funded,
+    ...metadataFromContext
+  } = usageContextInfo;
 
   const core: MicrodollarUsage = {
     id,
@@ -215,7 +223,7 @@ export async function toInsertableDbUsageRecord(
     streamed: usageStats.streamed,
     cancelled: usageStats.cancelled,
     market_cost: usageStats.market_cost ?? null,
-    is_free: await isFreeModel(usageContextInfo.requested_model),
+    is_free: provider_funded || (await isFreeModel(usageContextInfo.requested_model)),
   };
 
   // Legacy heuristic classification removed - abuse_classification is now handled
@@ -1018,16 +1026,20 @@ export async function processTokenData(
     usageStats.cost_mUsd = calculateKiloExclusiveCost_mUsd(kiloExclusiveModel, usageStats);
   }
 
-  // Report upstream cost to abuse service BEFORE zeroing for free/BYOK
+  // Report upstream cost to abuse service BEFORE zeroing for free/BYOK/provider-funded traffic
   // (abuse service needs actual spend for heuristics like free_tier_exhausted)
   reportAbuseCost(usageContext, usageStats).catch(error => {
     console.error('[Abuse] Failed to report cost:', error);
   });
 
-  // Preserve the real cost before zeroing for free/BYOK
+  // Preserve the real cost before zeroing for free/BYOK/provider-funded traffic.
   usageStats.market_cost = usageStats.cost_mUsd;
 
-  if ((await isFreeModel(usageContext.requested_model)) || usageContext.user_byok) {
+  if (
+    usageContext.provider_funded ||
+    (await isFreeModel(usageContext.requested_model)) ||
+    usageContext.user_byok
+  ) {
     usageStats.cost_mUsd = 0;
     usageStats.cacheDiscount_mUsd = 0;
   }
@@ -1048,6 +1060,7 @@ async function useGenerationLookup(
   const isSuccessStatusCode = (usageStats?.status_code ?? 200) < 400;
   const hasOutputTokens = (usageStats?.outputTokens ?? 0) > 0;
   const hasCostWhenPaid =
+    usageContext.provider_funded ||
     (await isFreeModel(usageContext.requested_model)) ||
     usageContext.user_byok ||
     (usageStats?.cost_mUsd ?? 0) > 0;
diff --git a/apps/web/src/lib/ai-gateway/processUsage.types.ts b/apps/web/src/lib/ai-gateway/processUsage.types.ts
index 7ac89d06e2..da29316cd1 100644
--- a/apps/web/src/lib/ai-gateway/processUsage.types.ts
+++ b/apps/web/src/lib/ai-gateway/processUsage.types.ts
@@ -129,6 +129,8 @@ export type MicrodollarUsageContext = {
   machine_id: string | null;
   /** True if user/org is using their own API key - cost should be zeroed out */
   user_byok: boolean;
+  /** True when provider selection routed this request through a provider-funded path. */
+  provider_funded: boolean;
   has_tools: boolean;
   botId?: string;
   tokenSource?: string;
diff --git a/apps/web/src/lib/ai-gateway/providers/get-provider.ts b/apps/web/src/lib/ai-gateway/providers/get-provider.ts
index 1d920529ba..9cf84a2816 100644
--- a/apps/web/src/lib/ai-gateway/providers/get-provider.ts
+++ b/apps/web/src/lib/ai-gateway/providers/get-provider.ts
@@ -19,7 +19,6 @@ import {
   buildDirectProvider,
   inferSupportedChatApis,
 } from '@/lib/ai-gateway/experiments/build-direct-provider';
-import { isPublicIdExperimented } from '@/lib/ai-gateway/experiments/membership';
 import {
   pickModelExperimentVariant,
   type AllocationSubject,
@@ -171,10 +170,21 @@ export type GetProviderInput = {
   /** Machine identifier from `x-kilocode-machineid`. Used as the machine-
    *  cohort allocation subject for experiment routing. */
   machineId: string | null;
+  /** Membership snapshot resolved by the route before admission checks. */
+  isExperimentCandidate: boolean;
 };
 
 export async function getProvider(input: GetProviderInput): Promise<GetProviderResult> {
-  const { requestedModel, request, user, organizationId, taskId, clientIp, machineId } = input;
+  const {
+    requestedModel,
+    request,
+    user,
+    organizationId,
+    taskId,
+    clientIp,
+    machineId,
+    isExperimentCandidate,
+  } = input;
 
   const directByokByok = await checkDirectBYOK(user, requestedModel, organizationId);
   if (directByokByok) {
@@ -194,8 +204,7 @@ export async function getProvider(input: GetProviderInput): Promise<GetProviderR
   // Model experiment routing for dedicated preview public ids. Runs before
   // `kilo-internal/...` and the `kiloExclusiveModels` lookup so an
   // experimented public id never falls through to OpenRouter/Vercel.
-  const experimented = await isPublicIdExperimented(requestedModel);
-  if (experimented === true) {
+  if (isExperimentCandidate) {
     const userId = isAnonymousContext(user) ? null : user.id;
     const selection = await pickModelExperimentVariant({
       publicModelId: requestedModel,
diff --git a/apps/web/src/tests/helpers/microdollar-usage.helper.ts b/apps/web/src/tests/helpers/microdollar-usage.helper.ts
index e9bf14e6e4..54ae34344e 100644
--- a/apps/web/src/tests/helpers/microdollar-usage.helper.ts
+++ b/apps/web/src/tests/helpers/microdollar-usage.helper.ts
@@ -61,6 +61,7 @@ function defineDefaultContextInfo(): UsageContextInfo {
     api_kind: 'chat_completions',
     machine_id: null,
     is_user_byok: false,
+    provider_funded: false,
     has_tools: false,
     feature: null,
     session_id: null,
@@ -116,6 +117,7 @@ export function createMockUsageContext(
     editor_name: null,
     machine_id: null,
     user_byok: false,
+    provider_funded: false,
     has_tools: false,
     feature: 'vscode-extension',
     session_id: null,

From 97a3777a61df21effb372905006806fd25048a04 Mon Sep 17 00:00:00 2001
From: Mark IJbema <mark@kilocode.ai>
Date: Mon, 25 May 2026 10:31:46 +0200
Subject: [PATCH 2/4] refactor(gateway): persist effective free request
 decision

---
 .../src/app/api/dev/consume-credits/route.ts  |  2 +-
 apps/web/src/app/api/fim/completions/route.ts |  5 ++--
 .../src/app/api/openrouter/[...path]/route.ts | 27 ++++++++-----------
 .../openrouter/audio/transcriptions/route.ts  |  2 +-
 .../app/api/openrouter/embeddings/route.ts    |  7 ++---
 .../src/lib/ai-gateway/processUsage.test.ts   |  8 +++---
 apps/web/src/lib/ai-gateway/processUsage.ts   | 22 +++++----------
 .../src/lib/ai-gateway/processUsage.types.ts  |  4 +--
 .../tests/helpers/microdollar-usage.helper.ts |  4 +--
 9 files changed, 35 insertions(+), 46 deletions(-)

diff --git a/apps/web/src/app/api/dev/consume-credits/route.ts b/apps/web/src/app/api/dev/consume-credits/route.ts
index 22206d6bbe..3aa24054ce 100644
--- a/apps/web/src/app/api/dev/consume-credits/route.ts
+++ b/apps/web/src/app/api/dev/consume-credits/route.ts
@@ -89,7 +89,7 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       editor_name: null,
       machine_id: null,
       user_byok: false,
-      provider_funded: false,
+      is_free: false,
       has_tools: false,
       feature: null,
       session_id: null,
diff --git a/apps/web/src/app/api/fim/completions/route.ts b/apps/web/src/app/api/fim/completions/route.ts
index 914d4f57e0..584278f64f 100644
--- a/apps/web/src/app/api/fim/completions/route.ts
+++ b/apps/web/src/app/api/fim/completions/route.ts
@@ -158,6 +158,7 @@ export async function POST(request: NextRequest) {
   const userByok = organizationId
     ? await getBYOKforOrganization(readDb, organizationId, [byokProviderKey])
     : await getBYOKforUser(readDb, user.id, [byokProviderKey]);
+  const isFreeRequest = await isFreeModel(requestBody.model);
 
   const usageContext: MicrodollarUsageContext = {
     api_kind: 'fim_completions',
@@ -177,7 +178,7 @@ export async function POST(request: NextRequest) {
     editor_name: extractHeaderAndLimitLength(request, 'x-kilocode-editorname'),
     machine_id: extractHeaderAndLimitLength(request, 'x-kilocode-machineid'),
     user_byok: !!userByok,
-    provider_funded: false,
+    is_free: isFreeRequest,
     has_tools: false,
     feature: validateFeatureHeader(request.headers.get(FEATURE_HEADER)),
     session_id: taskId ?? null,
@@ -191,7 +192,7 @@ export async function POST(request: NextRequest) {
   // slight replication lag, and provides lower latency for US users
   const { balance, settings, plan } = await getBalanceAndOrgSettings(organizationId, user, readDb);
 
-  if (balance <= 0 && !(await isFreeModel(requestBody.model)) && !userByok) {
+  if (balance <= 0 && !isFreeRequest && !userByok) {
     return NextResponse.json(
       {
         error: { message: 'Insufficient credits' },
diff --git a/apps/web/src/app/api/openrouter/[...path]/route.ts b/apps/web/src/app/api/openrouter/[...path]/route.ts
index 33b8aa2765..bd987ce2c1 100644
--- a/apps/web/src/app/api/openrouter/[...path]/route.ts
+++ b/apps/web/src/app/api/openrouter/[...path]/route.ts
@@ -287,9 +287,12 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     );
   }
 
-  // Membership is only a routing eligibility snapshot. A request is not
-  // provider-funded unless provider selection resolves an active variant.
-  const isExperimentCandidate = await isPublicIdExperimented(originalModelIdLowerCased);
+  // Capture model classification once; provider selection may additionally
+  // make this specific request free by resolving a funded experiment route.
+  const [isExperimentCandidate, isIntrinsicallyFreeModel] = await Promise.all([
+    isPublicIdExperimented(originalModelIdLowerCased),
+    isFreeModel(originalModelIdLowerCased),
+  ]);
 
   // Now check auth
   const authSpan = startInactiveSpan({ name: 'auth-check' });
@@ -310,7 +313,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
   if (authFailedResponse) {
     // A potential experiment request must reach provider selection before we
     // know whether this specific request is provider-funded.
-    if (!(await isFreeModel(originalModelIdLowerCased)) && !isExperimentCandidate) {
+    if (!isIntrinsicallyFreeModel && !isExperimentCandidate) {
       return paidModelAuthRequiredResponse();
     }
 
@@ -359,14 +362,11 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     experiment,
   } = providerResult;
   const providerFunded = experiment !== undefined;
+  const isFreeRequest = isIntrinsicallyFreeModel || providerFunded;
 
   // A stale experiment-membership hit can allow an anonymous request as far as
   // provider selection. It does not make ordinary fallback routing free.
-  if (
-    isAnonymousContext(user) &&
-    !providerFunded &&
-    !(await isFreeModel(originalModelIdLowerCased))
-  ) {
+  if (isAnonymousContext(user) && !isFreeRequest) {
     return paidModelAuthRequiredResponse();
   }
 
@@ -501,7 +501,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     editor_name: extractHeaderAndLimitLength(request, 'x-kilocode-editorname'),
     machine_id: machineIdHeader,
     user_byok: !!userByok,
-    provider_funded: providerFunded,
+    is_free: isFreeRequest,
     has_tools: (requestBodyParsed.body.tools?.length ?? 0) > 0,
     botId,
     tokenSource,
@@ -519,12 +519,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
   if (!isAnonymousContext(user) && !bypassAccessCheck) {
     const { balance, settings, plan } = await balanceAndSettingsPromise;
 
-    if (
-      balance <= 0 &&
-      !providerFunded &&
-      !(await isFreeModel(originalModelIdLowerCased)) &&
-      !userByok
-    ) {
+    if (balance <= 0 && !isFreeRequest && !userByok) {
       return await usageLimitExceededResponse(user, balance);
     }
 
diff --git a/apps/web/src/app/api/openrouter/audio/transcriptions/route.ts b/apps/web/src/app/api/openrouter/audio/transcriptions/route.ts
index 3d77611110..f4ceaf8448 100644
--- a/apps/web/src/app/api/openrouter/audio/transcriptions/route.ts
+++ b/apps/web/src/app/api/openrouter/audio/transcriptions/route.ts
@@ -155,7 +155,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     editor_name: extractHeaderAndLimitLength(request, 'x-kilocode-editorname'),
     machine_id: extractHeaderAndLimitLength(request, 'x-kilocode-machineid'),
     user_byok: !!userByok,
-    provider_funded: false,
+    is_free: false,
     has_tools: false,
     botId,
     tokenSource,
diff --git a/apps/web/src/app/api/openrouter/embeddings/route.ts b/apps/web/src/app/api/openrouter/embeddings/route.ts
index 6a7731b220..b290260fc9 100644
--- a/apps/web/src/app/api/openrouter/embeddings/route.ts
+++ b/apps/web/src/app/api/openrouter/embeddings/route.ts
@@ -102,6 +102,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
 
   const requestedModel = requestBodyParsed.model.trim();
   const requestedModelLowerCased = requestedModel.toLowerCase();
+  const isFreeRequest = await isFreeModel(requestedModelLowerCased);
 
   // Extract IP for all requests (needed for free model rate limiting)
   const ipAddress = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim();
@@ -132,7 +133,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
   const tokenSource: string | undefined = authTokenSource;
 
   if (authFailedResponse) {
-    if (!(await isFreeModel(requestedModelLowerCased))) {
+    if (!isFreeRequest) {
       return NextResponse.json(
         {
           error: {
@@ -183,7 +184,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     editor_name: extractHeaderAndLimitLength(request, 'x-kilocode-editorname'),
     machine_id: extractHeaderAndLimitLength(request, 'x-kilocode-machineid'),
     user_byok: !!userByok,
-    provider_funded: false,
+    is_free: isFreeRequest,
     has_tools: false,
     botId,
     tokenSource,
@@ -200,7 +201,7 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
   if (!isAnonymousContext(user)) {
     const { balance, settings, plan } = await getBalanceAndOrgSettings(organizationId, user);
 
-    if (balance <= 0 && !(await isFreeModel(requestedModelLowerCased)) && !userByok) {
+    if (balance <= 0 && !isFreeRequest && !userByok) {
       return await usageLimitExceededResponse(user, balance);
     }
 
diff --git a/apps/web/src/lib/ai-gateway/processUsage.test.ts b/apps/web/src/lib/ai-gateway/processUsage.test.ts
index c112fe64f2..4abadb5afb 100644
--- a/apps/web/src/lib/ai-gateway/processUsage.test.ts
+++ b/apps/web/src/lib/ai-gateway/processUsage.test.ts
@@ -384,7 +384,7 @@ describe('logMicrodollarUsage', () => {
       editor_name: null,
       machine_id: null,
       user_byok: false,
-      provider_funded: false,
+      is_free: false,
       has_tools: false,
       feature: 'vscode-extension',
       session_id: null,
@@ -530,7 +530,7 @@ describe('logMicrodollarUsage', () => {
     const usageContext: MicrodollarUsageContext = {
       ...createBaseUsageContext(user),
       requested_model: 'preview/provider-funded-model',
-      provider_funded: true,
+      is_free: true,
     };
 
     await processTokenData(usageStats, usageContext);
@@ -567,7 +567,7 @@ describe('logMicrodollarUsage', () => {
     const usageContext: MicrodollarUsageContext = {
       ...createBaseUsageContext(user),
       requested_model: 'preview/provider-funded-model',
-      provider_funded: false,
+      is_free: false,
     };
 
     await processTokenData(usageStats, usageContext);
@@ -1018,7 +1018,7 @@ describe('toInsertableDbUsageRecord NUL-byte sanitization', () => {
       editor_name: 'vscode',
       machine_id: 'machine',
       user_byok: false,
-      provider_funded: false,
+      is_free: false,
       has_tools: false,
       feature: null,
       session_id: 'session',
diff --git a/apps/web/src/lib/ai-gateway/processUsage.ts b/apps/web/src/lib/ai-gateway/processUsage.ts
index 682fa0cf43..4dd4bb4ee6 100644
--- a/apps/web/src/lib/ai-gateway/processUsage.ts
+++ b/apps/web/src/lib/ai-gateway/processUsage.ts
@@ -22,7 +22,6 @@ import { sentryRootSpan } from '../getRootSpan';
 import { ingestOrganizationTokenUsage } from '@/lib/organizations/organization-usage';
 import type { ProviderId } from '@/lib/ai-gateway/providers/types';
 import { findKiloExclusiveModel, isKiloStealthModel } from '@/lib/ai-gateway/models';
-import { isFreeModel } from '@/lib/ai-gateway/is-free-model';
 import { sentryLogger } from '@/lib/utils.server';
 import { maybeIssueKiloPassBonusFromUsageThreshold } from '@/lib/kilo-pass/usage-triggered-bonus';
 import { getEffectiveKiloPassThreshold } from '@/lib/kilo-pass/threshold';
@@ -132,7 +131,7 @@ export function extractUsageContextInfo(usageContext: MicrodollarUsageContext) {
     api_kind: usageContext.api_kind,
     machine_id: usageContext.machine_id,
     is_user_byok: usageContext.user_byok,
-    provider_funded: usageContext.provider_funded,
+    is_free: usageContext.is_free,
     has_tools: usageContext.has_tools,
     feature: usageContext.feature,
     session_id: usageContext.session_id,
@@ -185,7 +184,7 @@ export async function toInsertableDbUsageRecord(
     project_id,
     provider,
     ttfb_ms,
-    provider_funded,
+    is_free,
     ...metadataFromContext
   } = usageContextInfo;
 
@@ -223,7 +222,7 @@ export async function toInsertableDbUsageRecord(
     streamed: usageStats.streamed,
     cancelled: usageStats.cancelled,
     market_cost: usageStats.market_cost ?? null,
-    is_free: provider_funded || (await isFreeModel(usageContextInfo.requested_model)),
+    is_free,
   };
 
   // Legacy heuristic classification removed - abuse_classification is now handled
@@ -1026,20 +1025,16 @@ export async function processTokenData(
     usageStats.cost_mUsd = calculateKiloExclusiveCost_mUsd(kiloExclusiveModel, usageStats);
   }
 
-  // Report upstream cost to abuse service BEFORE zeroing for free/BYOK/provider-funded traffic
+  // Report upstream cost to abuse service BEFORE zeroing for free/BYOK traffic
   // (abuse service needs actual spend for heuristics like free_tier_exhausted)
   reportAbuseCost(usageContext, usageStats).catch(error => {
     console.error('[Abuse] Failed to report cost:', error);
   });
 
-  // Preserve the real cost before zeroing for free/BYOK/provider-funded traffic.
+  // Preserve the real cost before zeroing for free/BYOK traffic.
   usageStats.market_cost = usageStats.cost_mUsd;
 
-  if (
-    usageContext.provider_funded ||
-    (await isFreeModel(usageContext.requested_model)) ||
-    usageContext.user_byok
-  ) {
+  if (usageContext.is_free || usageContext.user_byok) {
     usageStats.cost_mUsd = 0;
     usageStats.cacheDiscount_mUsd = 0;
   }
@@ -1060,10 +1055,7 @@ async function useGenerationLookup(
   const isSuccessStatusCode = (usageStats?.status_code ?? 200) < 400;
   const hasOutputTokens = (usageStats?.outputTokens ?? 0) > 0;
   const hasCostWhenPaid =
-    usageContext.provider_funded ||
-    (await isFreeModel(usageContext.requested_model)) ||
-    usageContext.user_byok ||
-    (usageStats?.cost_mUsd ?? 0) > 0;
+    usageContext.is_free || usageContext.user_byok || (usageStats?.cost_mUsd ?? 0) > 0;
   return isGatewayProvider && isSuccessStatusCode && (!hasOutputTokens || !hasCostWhenPaid);
 }
 
diff --git a/apps/web/src/lib/ai-gateway/processUsage.types.ts b/apps/web/src/lib/ai-gateway/processUsage.types.ts
index da29316cd1..1daf20bea7 100644
--- a/apps/web/src/lib/ai-gateway/processUsage.types.ts
+++ b/apps/web/src/lib/ai-gateway/processUsage.types.ts
@@ -129,8 +129,8 @@ export type MicrodollarUsageContext = {
   machine_id: string | null;
   /** True if user/org is using their own API key - cost should be zeroed out */
   user_byok: boolean;
-  /** True when provider selection routed this request through a provider-funded path. */
-  provider_funded: boolean;
+  /** Effective free/billable decision captured during routing and access checks. */
+  is_free: boolean;
   has_tools: boolean;
   botId?: string;
   tokenSource?: string;
diff --git a/apps/web/src/tests/helpers/microdollar-usage.helper.ts b/apps/web/src/tests/helpers/microdollar-usage.helper.ts
index 54ae34344e..f64a3c83ec 100644
--- a/apps/web/src/tests/helpers/microdollar-usage.helper.ts
+++ b/apps/web/src/tests/helpers/microdollar-usage.helper.ts
@@ -61,7 +61,7 @@ function defineDefaultContextInfo(): UsageContextInfo {
     api_kind: 'chat_completions',
     machine_id: null,
     is_user_byok: false,
-    provider_funded: false,
+    is_free: false,
     has_tools: false,
     feature: null,
     session_id: null,
@@ -117,7 +117,7 @@ export function createMockUsageContext(
     editor_name: null,
     machine_id: null,
     user_byok: false,
-    provider_funded: false,
+    is_free: false,
     has_tools: false,
     feature: 'vscode-extension',
     session_id: null,

From a1c8a985ed17059e78be73253f3dafb9c9dcc7e1 Mon Sep 17 00:00:00 2001
From: Mark IJbema <mark@kilocode.ai>
Date: Mon, 25 May 2026 11:39:32 +0200
Subject: [PATCH 3/4] refactor(gateway): keep free decision fix scoped

---
 .../src/app/api/openrouter/[...path]/route.ts | 127 +++++++++---------
 .../lib/ai-gateway/providers/get-provider.ts  |  17 +--
 2 files changed, 67 insertions(+), 77 deletions(-)

diff --git a/apps/web/src/app/api/openrouter/[...path]/route.ts b/apps/web/src/app/api/openrouter/[...path]/route.ts
index bd987ce2c1..0698bea1fa 100644
--- a/apps/web/src/app/api/openrouter/[...path]/route.ts
+++ b/apps/web/src/app/api/openrouter/[...path]/route.ts
@@ -287,13 +287,39 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     );
   }
 
-  // Capture model classification once; provider selection may additionally
-  // make this specific request free by resolving a funded experiment route.
   const [isExperimentCandidate, isIntrinsicallyFreeModel] = await Promise.all([
     isPublicIdExperimented(originalModelIdLowerCased),
     isFreeModel(originalModelIdLowerCased),
   ]);
 
+  // For FREE models: check rate limit, log at start.
+  // Server-side products (cloud-agent, code-review, app-builder) rate-limit
+  // per user when the request comes from Cloudflare IPs (Kilo infrastructure).
+  // All other products rate-limit per IP (fast pre-auth path).
+  const isRateLimitedFreeModelRequest =
+    isKiloExclusiveFreeModel(originalModelIdLowerCased) ||
+    autoModel === KILO_AUTO_FREE_MODEL.id ||
+    isExperimentCandidate;
+  if (isRateLimitedFreeModelRequest) {
+    const rateLimit = await resolveRateLimit(feature, ipAddress, authPromise);
+    if (rateLimit instanceof NextResponse) return rateLimit;
+
+    if (!rateLimit.result.allowed) {
+      console.warn(
+        `Free model rate limit exceeded, ${rateLimit.subject}, model: ${originalModelIdLowerCased}, request count: ${rateLimit.result.requestCount}`
+      );
+      return NextResponse.json(
+        {
+          error: 'Rate limit exceeded',
+          error_type: ProxyErrorType.rate_limit_exceeded,
+          message:
+            'Free model usage limit reached. Please try again later or upgrade to a paid model.',
+        },
+        { status: 429 }
+      );
+    }
+  }
+
   // Now check auth
   const authSpan = startInactiveSpan({ name: 'auth-check' });
   const {
@@ -317,7 +343,32 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
       return paidModelAuthRequiredResponse();
     }
 
-    // Provider selection validates whether a candidate request is actually funded.
+    const promotionLimit = await checkPromotionLimit(ipAddress);
+
+    if (!promotionLimit.allowed) {
+      console.warn(
+        `Promotion model limit exceeded, ip: ${ipAddress}, ` +
+          `model: ${originalModelIdLowerCased}, ` +
+          `requests: ${promotionLimit.requestCount}/${PROMOTION_MAX_REQUESTS} ` +
+          `in ${PROMOTION_WINDOW_HOURS}h window`
+      );
+
+      return NextResponse.json(
+        {
+          error: {
+            code: PROMOTION_MODEL_LIMIT_REACHED,
+            message:
+              'Sign up for free to continue and explore 500 other models. ' +
+              'Takes 2 minutes, no credit card required. Or come back later.',
+          },
+          error_type: ProxyErrorType.promotion_limit_reached,
+        },
+        { status: 401 } // TODO: Change to 429 once the extension supports it (see kilocode errorUtils.ts)
+      );
+    }
+
+    // Anonymous access for a possibly free request; provider selection below
+    // rejects stale experiment membership before any paid fallback is sent.
     user = createAnonymousContext(ipAddress);
     organizationId = undefined;
     botId = undefined;
@@ -333,6 +384,15 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     return storeAndPreviousResponseIdIsNotSupported();
   }
 
+  // Log to free_model_usage for rate limiting (at request start, before processing)
+  if (isRateLimitedFreeModelRequest) {
+    await logFreeModelRequest(
+      ipAddress,
+      originalModelIdLowerCased,
+      isAnonymousContext(user) ? undefined : user.id
+    );
+  }
+
   // Use new shared helper for fraud & project headers
   const { fraudHeaders, projectId } = extractFraudAndProjectHeaders(request);
   const providerResult = await getProvider({
@@ -343,7 +403,6 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     taskId,
     clientIp: ipAddress ?? null,
     machineId: machineIdHeader,
-    isExperimentCandidate,
   });
   if (providerResult.kind === 'not-found') {
     // Paused experiment for this public id — return a local model-unavailable
@@ -370,66 +429,6 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     return paidModelAuthRequiredResponse();
   }
 
-  // Provider-funded routes join the free-model rate-limiting path only after
-  // provider selection; stale membership cannot rate-limit or log paid fallback traffic.
-  const isRateLimitedFreeModelRequest =
-    isKiloExclusiveFreeModel(originalModelIdLowerCased) ||
-    autoModel === KILO_AUTO_FREE_MODEL.id ||
-    providerFunded;
-  if (isRateLimitedFreeModelRequest) {
-    const rateLimit = await resolveRateLimit(feature, ipAddress, authPromise);
-    if (rateLimit instanceof NextResponse) return rateLimit;
-
-    if (!rateLimit.result.allowed) {
-      console.warn(
-        `Free model rate limit exceeded, ${rateLimit.subject}, model: ${originalModelIdLowerCased}, request count: ${rateLimit.result.requestCount}`
-      );
-      return NextResponse.json(
-        {
-          error: 'Rate limit exceeded',
-          error_type: ProxyErrorType.rate_limit_exceeded,
-          message:
-            'Free model usage limit reached. Please try again later or upgrade to a paid model.',
-        },
-        { status: 429 }
-      );
-    }
-  }
-
-  if (isAnonymousContext(user)) {
-    const promotionLimit = await checkPromotionLimit(ipAddress);
-
-    if (!promotionLimit.allowed) {
-      console.warn(
-        `Promotion model limit exceeded, ip: ${ipAddress}, ` +
-          `model: ${originalModelIdLowerCased}, ` +
-          `requests: ${promotionLimit.requestCount}/${PROMOTION_MAX_REQUESTS} ` +
-          `in ${PROMOTION_WINDOW_HOURS}h window`
-      );
-
-      return NextResponse.json(
-        {
-          error: {
-            code: PROMOTION_MODEL_LIMIT_REACHED,
-            message:
-              'Sign up for free to continue and explore 500 other models. ' +
-              'Takes 2 minutes, no credit card required. Or come back later.',
-          },
-          error_type: ProxyErrorType.promotion_limit_reached,
-        },
-        { status: 401 } // TODO: Change to 429 once the extension supports it (see kilocode errorUtils.ts)
-      );
-    }
-  }
-
-  if (isRateLimitedFreeModelRequest) {
-    await logFreeModelRequest(
-      ipAddress,
-      originalModelIdLowerCased,
-      isAnonymousContext(user) ? undefined : user.id
-    );
-  }
-
   // Request-level data-collection opt-out: a caller can set
   // `provider.data_collection: 'deny'` or `provider.zdr: true` on any
   // request to opt that single request out of training/data-retention.
diff --git a/apps/web/src/lib/ai-gateway/providers/get-provider.ts b/apps/web/src/lib/ai-gateway/providers/get-provider.ts
index 9cf84a2816..1d920529ba 100644
--- a/apps/web/src/lib/ai-gateway/providers/get-provider.ts
+++ b/apps/web/src/lib/ai-gateway/providers/get-provider.ts
@@ -19,6 +19,7 @@ import {
   buildDirectProvider,
   inferSupportedChatApis,
 } from '@/lib/ai-gateway/experiments/build-direct-provider';
+import { isPublicIdExperimented } from '@/lib/ai-gateway/experiments/membership';
 import {
   pickModelExperimentVariant,
   type AllocationSubject,
@@ -170,21 +171,10 @@ export type GetProviderInput = {
   /** Machine identifier from `x-kilocode-machineid`. Used as the machine-
    *  cohort allocation subject for experiment routing. */
   machineId: string | null;
-  /** Membership snapshot resolved by the route before admission checks. */
-  isExperimentCandidate: boolean;
 };
 
 export async function getProvider(input: GetProviderInput): Promise<GetProviderResult> {
-  const {
-    requestedModel,
-    request,
-    user,
-    organizationId,
-    taskId,
-    clientIp,
-    machineId,
-    isExperimentCandidate,
-  } = input;
+  const { requestedModel, request, user, organizationId, taskId, clientIp, machineId } = input;
 
   const directByokByok = await checkDirectBYOK(user, requestedModel, organizationId);
   if (directByokByok) {
@@ -204,7 +194,8 @@ export async function getProvider(input: GetProviderInput): Promise<GetProviderR
   // Model experiment routing for dedicated preview public ids. Runs before
   // `kilo-internal/...` and the `kiloExclusiveModels` lookup so an
   // experimented public id never falls through to OpenRouter/Vercel.
-  if (isExperimentCandidate) {
+  const experimented = await isPublicIdExperimented(requestedModel);
+  if (experimented === true) {
     const userId = isAnonymousContext(user) ? null : user.id;
     const selection = await pickModelExperimentVariant({
       publicModelId: requestedModel,

From 5d9b37cc6f01f4e7c05c8ca47e87d0ba1224182c Mon Sep 17 00:00:00 2001
From: Mark IJbema <mark@kilocode.ai>
Date: Mon, 25 May 2026 11:46:47 +0200
Subject: [PATCH 4/4] fix(gateway): do not count rejected preview traffic

---
 .../src/app/api/openrouter/[...path]/route.ts   | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/apps/web/src/app/api/openrouter/[...path]/route.ts b/apps/web/src/app/api/openrouter/[...path]/route.ts
index 0698bea1fa..a73ee58392 100644
--- a/apps/web/src/app/api/openrouter/[...path]/route.ts
+++ b/apps/web/src/app/api/openrouter/[...path]/route.ts
@@ -384,15 +384,6 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     return storeAndPreviousResponseIdIsNotSupported();
   }
 
-  // Log to free_model_usage for rate limiting (at request start, before processing)
-  if (isRateLimitedFreeModelRequest) {
-    await logFreeModelRequest(
-      ipAddress,
-      originalModelIdLowerCased,
-      isAnonymousContext(user) ? undefined : user.id
-    );
-  }
-
   // Use new shared helper for fraud & project headers
   const { fraudHeaders, projectId } = extractFraudAndProjectHeaders(request);
   const providerResult = await getProvider({
@@ -429,6 +420,14 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     return paidModelAuthRequiredResponse();
   }
 
+  if (isRateLimitedFreeModelRequest) {
+    await logFreeModelRequest(
+      ipAddress,
+      originalModelIdLowerCased,
+      isAnonymousContext(user) ? undefined : user.id
+    );
+  }
+
   // Request-level data-collection opt-out: a caller can set
   // `provider.data_collection: 'deny'` or `provider.zdr: true` on any
   // request to opt that single request out of training/data-retention.