@mycadet/gateway 0.12.10 → 0.13.0

package/src/http/routes/devices-mine.ts

@@ -0,0 +1,103 @@
+import { and, eq, max } from "drizzle-orm";
+
+import { actorTokenRecordHash } from "../../auth/actor-token-revocation.js";
+import { getGatewayDb } from "../../db/connection.js";
+import { actorTokenRecords } from "../../db/schema.js";
+import { errorResponse } from "../loopback-guard.js";
+import {
+  admittedActorTokenRecord,
+  isCloudAuthBypassActive,
+} from "../middleware/auth.js";
+
+/**
+ * `GET /v1/devices/mine` — the caller's own paired-device row.
+ *
+ * Deliberately browser-reachable (no loopback guard, no origin rejection):
+ * the bearer IS the credential, and the route answers only for the token
+ * presenting it. This is how the paired web UI surfaces "this device" so
+ * its row can be matched against the host-side `cadet devices` list — the
+ * gateway stores nothing but the hashed device id, so the hash is the only
+ * matchable identity either side can name. The projection mirrors
+ * `/v1/devices` exactly (including the cross-status `max(lastUsedAt)`, since
+ * a rotation leaves the newest activity stamp on the revoked row), so a
+ * `devices/mine` response matches the same device's row in the list output
+ * field for field.
+ */
+export async function handleGetMyDevice(req: Request): Promise<Response> {
+  if (req.method !== "GET") {
+    return new Response("method not allowed", {
+      status: 405,
+      headers: { Allow: "GET" },
+    });
+  }
+
+  // Cloud-hosted assistants have no paired-device rows to name — the route
+  // only answers for self-hosted gateways.
+  if (isCloudAuthBypassActive()) {
+    return errorResponse(
+      "NOT_AVAILABLE_ON_CLOUD",
+      "this assistant is cloud-hosted — it has no paired-device rows",
+      404,
+    );
+  }
+
+  const authorization = req.headers.get("authorization") ?? "";
+  const bearer = authorization.startsWith("Bearer ")
+    ? authorization.slice("Bearer ".length).trim()
+    : "";
+
+  const db = getGatewayDb();
+  // Edge auth already loaded this row by the bearer's hash while admitting
+  // the token (admitActorToken) — reuse it when present. The fallback query
+  // covers paths where admission produced no row (fail-open on a DB error,
+  // or the handler driven directly in tests).
+  const row =
+    admittedActorTokenRecord(req) ??
+    db
+      .select({
+        guardianPrincipalId: actorTokenRecords.guardianPrincipalId,
+        hashedDeviceId: actorTokenRecords.hashedDeviceId,
+        platform: actorTokenRecords.platform,
+        pairingUserAgent: actorTokenRecords.pairingUserAgent,
+        clientReportedName: actorTokenRecords.clientReportedName,
+        issuedAt: actorTokenRecords.issuedAt,
+        expiresAt: actorTokenRecords.expiresAt,
+      })
+      .from(actorTokenRecords)
+      .where(eq(actorTokenRecords.tokenHash, actorTokenRecordHash(bearer)))
+      .get();
+
+  if (!row) {
+    return errorResponse(
+      "DEVICE_NOT_FOUND",
+      "no paired device row for this token",
+      404,
+    );
+  }
+
+  const lastUsed = db
+    .select({ lastUsedAt: max(actorTokenRecords.lastUsedAt) })
+    .from(actorTokenRecords)
+    .where(
+      and(
+        eq(actorTokenRecords.hashedDeviceId, row.hashedDeviceId),
+        eq(actorTokenRecords.guardianPrincipalId, row.guardianPrincipalId),
+      ),
+    )
+    .get();
+
+  return Response.json(
+    {
+      device: {
+        hashedDeviceId: row.hashedDeviceId,
+        platform: row.platform,
+        pairingUserAgent: row.pairingUserAgent ?? null,
+        clientReportedName: row.clientReportedName ?? null,
+        issuedAt: row.issuedAt,
+        expiresAt: row.expiresAt ?? null,
+        lastUsedAt: lastUsed?.lastUsedAt ?? null,
+      },
+    },
+    { headers: { "Cache-Control": "no-store" } },
+  );
+}

package/src/http/routes/feature-flags.ts

@@ -5,7 +5,6 @@ import {
   isFlagDeclared,
 } from "../../feature-flag-defaults.js";
 import { readEnvFeatureFlagOverrides } from "../../feature-flag-env-overrides.js";
-import { readRemoteFeatureFlags } from "../../feature-flag-remote-store.js";
 import {
   readPersistedFeatureFlags,
   writeFeatureFlag,
@@ -81,19 +80,13 @@ export function createFeatureFlagsGetHandler() {
     try {
       const defaults = loadFeatureFlagDefaults();
       const persisted = readPersistedFeatureFlags();
-      const remote = readRemoteFeatureFlags();
       const envOverrides = readEnvFeatureFlagOverrides();
 
       const entries: FeatureFlagEntry[] = [];
       for (const [key, def] of Object.entries(defaults)) {
         const persistedValue = persisted[key];
-        const remoteValue = remote[key];
         const base =
-          persistedValue !== undefined
-            ? persistedValue
-            : remoteValue !== undefined
-              ? remoteValue
-              : def.defaultEnabled;
+          persistedValue !== undefined ? persistedValue : def.defaultEnabled;
         const envValue = envOverrides[key];
         entries.push({
           key,

package/src/http/routes/guardian-pin.ts

@@ -38,6 +38,7 @@ import type { Logger } from "pino";
 import { authorizeRuntimeAudioStream } from "./runtime-audio-stream.js";
 import { findCadetGuardian } from "../../auth/guardian-bootstrap.js";
 import type { GatewayConfig } from "../../config.js";
+import { getIsCloud } from "../../cloud-url.js";
 import { requestHasTunnelBridgeAuth } from "../../tunnel/bridge-auth.js";
 import { readStoredCloudUserId } from "../../cloud-user-id.js";
 import { isWebsocketUpgradeRequest } from "../utils.js";
@@ -46,16 +47,6 @@ const TUNNEL_USER_ID_HEADER = "x-tunnel-user-id";
 const TUNNEL_ORG_ID_HEADER = "x-tunnel-org-id";
 const TUNNEL_ACTOR_HEADER = "x-tunnel-actor";
 
-/**
- * True when the gateway runs in managed/cloud mode (vembda + tunnel ingress).
- * Mirrors the `IS_CLOUD` check used by the gateway's HTTP edge auth
- * (`src/http/middleware/auth.ts`) and feature-flag resolver.
- */
-export function isPlatformManaged(): boolean {
-  const v = process.env.IS_CLOUD?.trim().toLowerCase();
-  return v === "1" || v === "true";
-}
-
 /**
  * True when a tunnel-attested caller can reach this gateway at all: a cloud
  * pod, or any gateway started with a tunnel (`TUNNEL_BASE_URL`), which is
@@ -68,7 +59,7 @@ export function isPlatformManaged(): boolean {
 export function acceptsTunnelAttestation(
   config: Pick<GatewayConfig, "tunnelBaseUrl">,
 ): boolean {
-  return isPlatformManaged() || config.tunnelBaseUrl !== undefined;
+  return getIsCloud() || config.tunnelBaseUrl !== undefined;
 }
 
 /** Tunnel-attested managed caller context, extracted from injected headers. */

package/src/http/routes/ipc-runtime-proxy.ts

@@ -95,7 +95,7 @@ export async function tryIpcProxy(
       );
       return Response.json({ error: "Unauthorized" }, { status: 401 });
     }
-    if (!admitActorToken(edgeJwt, result.claims)) {
+    if (!admitActorToken(edgeJwt, result.claims).admitted) {
       log.warn(
         { method: req.method, path: new URL(req.url).pathname },
         "IPC proxy auth rejected: actor token revoked",

package/src/http/routes/live-voice-websocket.ts

@@ -168,7 +168,7 @@ async function checkLiveVoiceAuth(
     return { response: new Response("Unauthorized", { status: 401 }) };
   }
 
-  if (!admitActorToken(rawToken, result.claims)) {
+  if (!admitActorToken(rawToken, result.claims).admitted) {
     log.warn("Live voice WS: rejected, actor token revoked");
     return { response: new Response("Unauthorized", { status: 401 }) };
   }

package/src/http/routes/runtime-audio-stream.ts

@@ -122,7 +122,7 @@ export function authorizeRuntimeAudioStream(
     };
   }
 
-  if (!admitActorToken(rawToken, result.claims)) {
+  if (!admitActorToken(rawToken, result.claims).admitted) {
     log.warn("audio stream WS: rejected, actor token revoked");
     return {
       ok: false,

package/src/http/routes/runtime-proxy.ts

@@ -70,7 +70,7 @@ function presentedProxyGrant(authHeader: string | null): TokenClaims | null {
   if (!result.ok || result.claims.scope_profile !== "oauth_proxy_v1") {
     return null;
   }
-  if (!admitActorToken(token, result.claims)) {
+  if (!admitActorToken(token, result.claims).admitted) {
     return null;
   }
   return result.claims;
@@ -149,7 +149,7 @@ export function createRuntimeProxyHandler(config: GatewayConfig) {
         );
         return Response.json({ error: "Unauthorized" }, { status: 401 });
       }
-      if (!admitActorToken(edgeJwt, result.claims)) {
+      if (!admitActorToken(edgeJwt, result.claims).admitted) {
         log.warn(
           { method: req.method, path: url.pathname },
           "Runtime proxy auth rejected: actor token revoked",

package/src/http/routes/speech-relay-websocket.ts

@@ -22,7 +22,7 @@
 
 import type { OutgoingHttpHeaders } from "node:http";
 
-import { tunnelHostForPlatformHost } from "@mycadet/service-contracts/ingress";
+import { tunnelHostForCloudHost } from "@mycadet/service-contracts/ingress";
 
 import { resolveScopeProfile } from "../../auth/scopes.js";
 import { validateEdgeToken } from "../../auth/token-exchange.js";
@@ -163,7 +163,7 @@ function jsonError(status: number, code: string, detail: string): Response {
  * shared with the web live-voice client; this wrapper adds the scheme.
  */
 export function tunnelOriginForPlatformHost(host: string): string | null {
-  const tunnelHost = tunnelHostForPlatformHost(host);
+  const tunnelHost = tunnelHostForCloudHost(host);
   return tunnelHost ? `https://${tunnelHost}` : null;
 }
 

package/src/http/routes/twilio-voice-webhook.test.ts

@@ -394,7 +394,7 @@ describe("resolvePublicBaseWssUrl", () => {
   test("uses tunnelBaseUrl + cloudAssistantId when both are present", () => {
     const config = {
       ...baseConfig,
-      tunnelBaseUrl: "https://tunnel-dev.mycadet.ai",
+      tunnelBaseUrl: "https://dev-tunnel.mycadet.ai",
     };
     const result = resolvePublicBaseWssUrl(
       config,
@@ -402,7 +402,7 @@ describe("resolvePublicBaseWssUrl", () => {
       "abc12345-0000-0000-0000-000000000000",
     );
     expect(result).toBe(
-      "wss://tunnel-dev.mycadet.ai/abc12345-0000-0000-0000-000000000000",
+      "wss://dev-tunnel.mycadet.ai/abc12345-0000-0000-0000-000000000000",
     );
   });
 
@@ -430,24 +430,24 @@ describe("resolvePublicBaseWssUrl", () => {
   test("falls back to configFile publicBaseUrl when cloudAssistantId is missing", () => {
     const config = {
       ...baseConfig,
-      tunnelBaseUrl: "https://tunnel-dev.mycadet.ai",
+      tunnelBaseUrl: "https://dev-tunnel.mycadet.ai",
     };
     const mockConfigFile = {
       getString: (section: string, key: string) =>
         section === "ingress" && key === "publicBaseUrl"
-          ? "https://tunnel-dev.mycadet.ai/abc12345-0000-0000-0000-000000000000"
+          ? "https://dev-tunnel.mycadet.ai/abc12345-0000-0000-0000-000000000000"
           : undefined,
     } as Parameters<typeof resolvePublicBaseWssUrl>[1];
     const result = resolvePublicBaseWssUrl(config, mockConfigFile, undefined);
     expect(result).toBe(
-      "wss://tunnel-dev.mycadet.ai/abc12345-0000-0000-0000-000000000000",
+      "wss://dev-tunnel.mycadet.ai/abc12345-0000-0000-0000-000000000000",
     );
   });
 
   test("uses assistant ID from validated platform callback URL with Tunnel", () => {
     const config = {
       ...baseConfig,
-      tunnelBaseUrl: "https://tunnel-staging.mycadet.ai",
+      tunnelBaseUrl: "https://staging-tunnel.mycadet.ai",
     };
     const result = resolvePublicBaseWssUrl(
       config,
@@ -456,14 +456,14 @@ describe("resolvePublicBaseWssUrl", () => {
       "https://staging-cloud.mycadet.ai/v1/gateway/callbacks/019e2d0d-f355-744c-a12c-d7e7dcefcf1e/webhooks/twilio/voice/?callSessionId=37b47ade-2eaf-469a-bede-6f2454875e6e",
     );
     expect(result).toBe(
-      "wss://tunnel-staging.mycadet.ai/019e2d0d-f355-744c-a12c-d7e7dcefcf1e",
+      "wss://staging-tunnel.mycadet.ai/019e2d0d-f355-744c-a12c-d7e7dcefcf1e",
     );
   });
 
   test("prefers validated platform callback URL over stale configFile publicBaseUrl", () => {
     const config = {
       ...baseConfig,
-      tunnelBaseUrl: "https://tunnel-staging.mycadet.ai",
+      tunnelBaseUrl: "https://staging-tunnel.mycadet.ai",
     };
     const mockConfigFile = {
       getString: (section: string, key: string) =>
@@ -478,14 +478,14 @@ describe("resolvePublicBaseWssUrl", () => {
       "https://staging-cloud.mycadet.ai/v1/gateway/callbacks/019e2d0d-f355-744c-a12c-d7e7dcefcf1e/webhooks/twilio/voice?callSessionId=sess-1",
     );
     expect(result).toBe(
-      "wss://tunnel-staging.mycadet.ai/019e2d0d-f355-744c-a12c-d7e7dcefcf1e",
+      "wss://staging-tunnel.mycadet.ai/019e2d0d-f355-744c-a12c-d7e7dcefcf1e",
     );
   });
 
   test("does not use a cloud callback URL as the websocket base", () => {
     const config = {
       ...baseConfig,
-      tunnelBaseUrl: "https://tunnel-staging.mycadet.ai",
+      tunnelBaseUrl: "https://staging-tunnel.mycadet.ai",
     };
     const mockConfigFile = {
       getString: (section: string, key: string) =>
@@ -495,14 +495,14 @@ describe("resolvePublicBaseWssUrl", () => {
     } as Parameters<typeof resolvePublicBaseWssUrl>[1];
     const result = resolvePublicBaseWssUrl(config, mockConfigFile, undefined);
     expect(result).toBe(
-      "wss://tunnel-staging.mycadet.ai/019e2d0d-f355-744c-a12c-d7e7dcefcf1e",
+      "wss://staging-tunnel.mycadet.ai/019e2d0d-f355-744c-a12c-d7e7dcefcf1e",
     );
   });
 
   test("strips trailing slash from tunnelBaseUrl before joining assistant ID", () => {
     const config = {
       ...baseConfig,
-      tunnelBaseUrl: "https://tunnel-dev.mycadet.ai/",
+      tunnelBaseUrl: "https://dev-tunnel.mycadet.ai/",
     };
     const result = resolvePublicBaseWssUrl(
       config,
@@ -510,7 +510,7 @@ describe("resolvePublicBaseWssUrl", () => {
       "abc12345-0000-0000-0000-000000000000",
     );
     expect(result).toBe(
-      "wss://tunnel-dev.mycadet.ai/abc12345-0000-0000-0000-000000000000",
+      "wss://dev-tunnel.mycadet.ai/abc12345-0000-0000-0000-000000000000",
     );
   });
 });

package/src/index.ts

@@ -17,12 +17,10 @@ import {
 } from "./auth/token-service.js";
 import { validateEdgeToken, mintServiceToken } from "./auth/token-exchange.js";
 import { findGuardianForChannelActor } from "./auth/guardian-bootstrap.js";
-import { AuthFallbackReporter } from "./auth-fallback-reporter.js";
-import { loopbackFallbackCountTracker } from "./http/middleware/auth.js";
 import { ConfigFileCache } from "./config-file-cache.js";
 import { ConfigFileWatcher } from "./config-file-watcher.js";
 import { FeatureFlagWatcher } from "./feature-flag-watcher.js";
-import { RemoteFeatureFlagSync } from "./remote-feature-flag-sync.js";
+
 import { loadConfig } from "./config.js";
 import { CredentialCache } from "./credential-cache.js";
 import { credentialKey } from "./credential-key.js";
@@ -104,6 +102,7 @@ import {
   handleListDevices,
   handleRevokeDevice,
 } from "./http/routes/devices.js";
+import { handleGetMyDevice } from "./http/routes/devices-mine.js";
 import { handleSaveIngressDomain } from "./http/routes/ingress-domains.js";
 import { handlePair } from "./http/routes/pair.js";
 import { handleCredentialEntryPage } from "./http/routes/credential-entry-page.js";
@@ -129,20 +128,7 @@ import { createPsHandler } from "./http/routes/ps.js";
 import { createTunnelStatusHandler } from "./http/routes/tunnel-status.js";
 import { createRuntimeHealthProxyHandler } from "./http/routes/runtime-health-proxy.js";
 import { createUpgradeBroadcastProxyHandler } from "./http/routes/upgrade-broadcast-proxy.js";
-import {
-  createMigrationExportProxyHandler,
-  createMigrationExportToGcsProxyHandler,
-  createMigrationImportFromGcsProxyHandler,
-  createMigrationImportProxyHandler,
-  createMigrationImportStatusProxyHandler,
-  createMigrationJobStatusProxyHandler,
-} from "./http/routes/migration-proxy.js";
 import { createMigrationRollbackProxyHandler } from "./http/routes/migration-rollback-proxy.js";
-import {
-  createListBackupsHandler,
-  createBackupSnapshotHandler,
-} from "./backup/backup-routes.js";
-import { startBackupWorker } from "./backup/backup-worker.js";
 import { createWorkspaceCommitProxyHandler } from "./http/routes/workspace-commit-proxy.js";
 import { createDesktopSetupProxyHandler } from "./http/routes/desktop-setup-proxy.js";
 import { createBrainGraphProxyHandler } from "./http/routes/brain-graph-proxy.js";
@@ -256,7 +242,6 @@ import { admissionPolicyRoutes } from "./ipc/admission-policy-handlers.js";
 import { channelPermissionRoutes } from "./ipc/channel-permission-handlers.js";
 import { trustVerdictRoutes } from "./ipc/trust-verdict-handlers.js";
 import { guardianDeliveryRoutes } from "./ipc/guardian-delivery-handlers.js";
-import { createDebugExportRoutes } from "./ipc/debug-export-handlers.js";
 import { createLogTailRoutes } from "./ipc/log-tail-handlers.js";
 import { createChannelSocketHealthRoutes } from "./ipc/channel-socket-health-handlers.js";
 import { createCredentialRequestIpcRoutes } from "./ipc/credential-request-handlers.js";
@@ -675,15 +660,6 @@ async function main() {
   const tunnelStatusHandler = createTunnelStatusHandler(tunnelClient);
   const runtimeHealthProxy = createRuntimeHealthProxyHandler(config);
   const upgradeBroadcastProxy = createUpgradeBroadcastProxyHandler(config);
-  const migrationExportProxy = createMigrationExportProxyHandler(config);
-  const migrationImportProxy = createMigrationImportProxyHandler(config);
-  const migrationImportStatusProxy =
-    createMigrationImportStatusProxyHandler(config);
-  const migrationExportToGcsProxy =
-    createMigrationExportToGcsProxyHandler(config);
-  const migrationImportFromGcsProxy =
-    createMigrationImportFromGcsProxyHandler(config);
-  const migrationJobStatusProxy = createMigrationJobStatusProxyHandler(config);
   const migrationRollbackProxy = createMigrationRollbackProxyHandler(config);
   const workspaceCommitProxy = createWorkspaceCommitProxyHandler(config);
   const desktopSetupProxy = createDesktopSetupProxyHandler(config);
@@ -743,12 +719,6 @@ async function main() {
 
   const audioProxy = createAudioProxyHandler(config);
 
-  const backupDeps = {
-    assistantRuntimeBaseUrl: config.assistantRuntimeBaseUrl,
-  };
-  const handleListBackups = createListBackupsHandler(backupDeps);
-  const handleCreateBackup = createBackupSnapshotHandler(backupDeps);
-
   const handleRuntimeProxy = createRuntimeProxyHandler(config);
 
   // Helper to reject when an integration isn't configured
@@ -1100,6 +1070,14 @@ async function main() {
         handleRevokeDevice(req, getClientIp()),
     },
 
+    // ── The caller's own paired-device row (bearer-authed, browser-legit) ──
+    {
+      path: "/v1/devices/mine",
+      method: "GET",
+      auth: "edge",
+      handler: (req) => handleGetMyDevice(req),
+    },
+
     // ── Channel verification sessions ──
     {
       // Bootstrap endpoint — may be replaced with an SSH-based exchange in the
@@ -1324,73 +1302,6 @@ async function main() {
       handler: (req) => upgradeBroadcastProxy(req),
     },
 
-    // ── Migration export/import ──
-    {
-      path: "/v1/migrations/export",
-      method: "POST",
-      auth: "edge-scoped",
-      scope: "settings.write",
-      handler: (req) => migrationExportProxy(req),
-    },
-    {
-      path: "/v1/migrations/import",
-      method: "POST",
-      auth: "edge-scoped",
-      scope: "settings.write",
-      handler: (req) => migrationImportProxy(req),
-    },
-    {
-      // Async-job status endpoint for URL-based imports. The gateway keeps
-      // an in-memory job map keyed by the jobId it handed back in the
-      // 202 response; this lets callers poll for progress without holding
-      // an HTTP connection open for the full import duration.
-      //
-      // Trailing slash is optional to preserve compatibility with existing
-      // pollers. PlatformMigrationClient.pollImportStatus (macOS) and
-      // cli/src/lib/cloud-client.ts both hit `.../status/` against the
-      // platform API today; other callers may follow the bare-path
-      // convention (`.../status`). Regex routes in the gateway router are
-      // NOT trailing-slash-normalized, so the optionality is encoded here.
-      path: /^\/v1\/migrations\/import\/([^/]+)\/status\/?$/,
-      method: "GET",
-      auth: "edge-scoped",
-      // Read-only polling endpoint — read scope, not write. Matches the
-      // convention used for other GET endpoints in this router (OAuth
-      // providers GET, OAuth apps GET) so a token
-      // profile with `settings.read` only (e.g. the `ui_page_v1`
-      // profile) can still poll import progress.
-      scope: "settings.read",
-      handler: (req, params) =>
-        migrationImportStatusProxy(req, params[0] ?? ""),
-    },
-
-    // ── Teleport-GCS migration (unified daemon-async flow) ──
-    // Registered as explicit routes (not via the runtime-proxy catch-all)
-    // for dedicated auth and timeout handling. The daemon returns 202
-    // { job_id } on POST and cheap JSON on GET, so the gateway just
-    // transparently forwards without wrapping.
-    {
-      path: "/v1/migrations/export-to-gcs",
-      method: "POST",
-      auth: "edge-scoped",
-      scope: "settings.write",
-      handler: (req) => migrationExportToGcsProxy(req),
-    },
-    {
-      path: "/v1/migrations/import-from-gcs",
-      method: "POST",
-      auth: "edge-scoped",
-      scope: "settings.write",
-      handler: (req) => migrationImportFromGcsProxy(req),
-    },
-    {
-      path: /^\/v1\/migrations\/jobs\/([^/]+)\/?$/,
-      method: "GET",
-      auth: "edge-scoped",
-      scope: "settings.read",
-      handler: (req, params) => migrationJobStatusProxy(req, params[0] ?? ""),
-    },
-
     // ── Workspace commit ──
     {
       path: "/v1/admin/workspace-commit",
@@ -1409,45 +1320,6 @@ async function main() {
       handler: (req) => migrationRollbackProxy(req),
     },
 
-    // ── Backups ──
-    {
-      path: "/v1/backups",
-      method: "GET",
-      auth: "edge-scoped",
-      scope: "settings.read",
-      handler: (req) => handleListBackups(req),
-    },
-    {
-      path: "/v1/backups/create",
-      method: "POST",
-      auth: "edge-scoped",
-      scope: "settings.write",
-      handler: (req) => handleCreateBackup(req),
-    },
-
-    // ── Backups — assistant-scoped variants ──
-    // Mirror the flat /v1/backups routes for clients that use the daemon
-    // SDK's assistant-scoped URLs (/v1/assistants/<id>/backups/...).
-    // Without these, the request falls through to the runtime-proxy
-    // catch-all and the daemon rejects create ("moved to gateway").
-    // Backups are gateway-global, so the assistant id is matched and
-    // discarded. Same precedent as the trust-rules assistant-scoped
-    // variants below.
-    {
-      path: /^\/v1\/assistants\/[^/]+\/backups\/?$/,
-      method: "GET",
-      auth: "edge-scoped",
-      scope: "settings.read",
-      handler: (req) => handleListBackups(req),
-    },
-    {
-      path: /^\/v1\/assistants\/[^/]+\/backups\/create\/?$/,
-      method: "POST",
-      auth: "edge-scoped",
-      scope: "settings.write",
-      handler: (req) => handleCreateBackup(req),
-    },
-
     // ── Platform push / Live Activity tokens ──
     // Django-owned registration. Remote-gateway clients hit these
     // same-origin; without a dedicated route they fall through to the
@@ -2022,7 +1894,7 @@ async function main() {
     port: config.port,
     idleTimeout: 0,
     // Match the daemon's 512 MB limit (assistant/src/runtime/http-server.ts)
-    // so large .vbundle imports proxied through the gateway aren't rejected.
+    // to accommodate large app package uploads.
     maxRequestBodySize: 512 * 1024 * 1024,
     websocket: {
       open(ws) {
@@ -2851,14 +2723,6 @@ async function main() {
     log.info("Discord Gateway client started");
   }
 
-  // Lazily bound below, once `remoteFeatureFlagSync` is constructed, so the
-  // credential-change callback can trigger an immediate per-assistant flag
-  // re-sync. On a warm-pool claim the `cadet` credentials change to the
-  // newly-assigned identity; without forcing a re-sync, flag values would not
-  // refresh until the next scheduled poll (up to 5 min), so the onboarding
-  // first message evaluates flags against stale values (see JARVIS-1018).
-  let remoteFeatureFlagSyncRef: RemoteFeatureFlagSync | null = null;
-
   /**
    * Fingerprint of the Telegram bot token the dedup cache's watermark belongs
    * to. Null while no token is stored, which is itself a bot change: the next
@@ -2981,21 +2845,6 @@ async function main() {
           );
         });
       }
-
-      // Force an immediate per-assistant feature-flag re-sync. A `cadet`
-      // credential change means a warm-pool claim / key rotation / late
-      // provisioning — the assistant identity the cloud evaluates flags
-      // for just changed. Without this, flags stay at their previous (often
-      // registry-default) values until the next ~5-min poll, which the
-      // onboarding auto-greet beats, so first-message flags read stale
-      // (JARVIS-1018). The ref is null only during the initial credential
-      // poll at startup, which `start()` already covers.
-      remoteFeatureFlagSyncRef?.syncNow().catch((err) => {
-        log.error(
-          { err },
-          "Failed to sync remote feature flags after cadet credential change",
-        );
-      });
     }
   });
 
@@ -3102,7 +2951,6 @@ async function main() {
     ...guardianDeliveryRoutes,
     ...riskClassificationRoutes,
     ...createLogTailRoutes(config),
-    ...createDebugExportRoutes(config),
     ...createChannelSocketHealthRoutes({
       slack: () => slackSocketClient,
       discord: () => discordGatewayClient,
@@ -3120,11 +2968,6 @@ async function main() {
 
   void refreshRouteSchema();
 
-  // ── Backup worker ──
-  const backupWorkerHandle = startBackupWorker({
-    assistantRuntimeBaseUrl: config.assistantRuntimeBaseUrl,
-  });
-
   let tunnelWebhooksEnabled = isFeatureFlagEnabled("tunnel-webhooks");
   emitFlagChanged = () => {
     ipcServer.emit("feature_flags_changed");
@@ -3153,26 +2996,6 @@ async function main() {
   });
   featureFlagWatcher.start();
 
-  const remoteFeatureFlagSync = new RemoteFeatureFlagSync({
-    credentials: credentialCache,
-    onChanged: emitFlagChanged,
-  });
-  // Bind the ref so the credential-change callback above can force an
-  // immediate re-sync when the assistant's `cadet` identity changes
-  // (warm-pool claim / key rotation) instead of waiting for the next poll.
-  remoteFeatureFlagSyncRef = remoteFeatureFlagSync;
-  // Intentionally fire-and-forget: remote flag fetch is best-effort;
-  // the gateway continues with registry defaults if it fails.
-  void remoteFeatureFlagSync.start();
-
-  // Periodically ship legacy-loopback auth-fallback counts to the daemon
-  // telemetry route. Best-effort background work; never blocks auth.
-  const authFallbackReporter = new AuthFallbackReporter({
-    tracker: loopbackFallbackCountTracker,
-    baseUrl: config.assistantRuntimeBaseUrl,
-  });
-  authFallbackReporter.start();
-
   // ── Sleep/wake detection ──
   // Detect system sleep/wake transitions and force-reconnect channels
   // that may have stale connections after the OS suspended the process.
@@ -3186,12 +3009,6 @@ async function main() {
     configFileCache.invalidate();
     credentialCache.invalidate();
 
-    // Immediately refresh remote feature flags so the gateway doesn't run
-    // with stale values until the next scheduled poll (up to 5 min away).
-    remoteFeatureFlagSync.syncNow().catch((err) => {
-      log.error({ err }, "Failed to sync remote feature flags after wake");
-    });
-
     // Re-register Telegram webhook with current ingress URL
     if (telegramReady) {
       reconcileTelegramWebhook(telegramCaches).catch((err) => {
@@ -3206,13 +3023,9 @@ async function main() {
     draining = true;
     const shutdownTasks: Promise<void>[] = [];
     sleepWakeDetector.stop();
-    backupWorkerHandle.stop();
     credentialWatcher.stop();
     configFileWatcher.stop();
     featureFlagWatcher.stop();
-    remoteFeatureFlagSync.stop();
-    // Stop the timer and flush any buffered auth-fallback counts before exit.
-    shutdownTasks.push(authFallbackReporter.stop());
     const tunnelStop = tunnelClient?.stop();
     if (tunnelStop) shutdownTasks.push(tunnelStop);
     ipcServer.stop();