@vellumai/cli 0.11.2 → 0.11.3-staging.2

package/src/__tests__/wake.test.ts

@@ -161,25 +161,25 @@ mock.module("../lib/ingress-config.js", () => ({
   loadRawConfig: loadRawConfigMock,
 }));
 
+const ensureTunnelEdgeMock = mock<typeof nginxIngress.ensureTunnelEdge>(
+  async () => ({ port: 7840, started: true, includesWebApp: true }),
+);
 const isIngressRunningMock = mock<typeof nginxIngress.isIngressRunning>(
   () => false,
 );
-const startRemoteWebIngressMock = mock<
-  typeof nginxIngress.startRemoteWebIngress
->(async () => ({
-  status: "started",
-  listenPort: 7840,
-  webDistDir: "/tmp/web/dist",
-  version: "nginx/1.25.3",
-}));
+const readIngressStateMock = mock<typeof nginxIngress.readIngressState>(
+  () => null,
+);
 
 mock.module("../lib/nginx-ingress.js", () => ({
   ...realNginxIngress,
+  ensureTunnelEdge: ensureTunnelEdgeMock,
   isIngressRunning: isIngressRunningMock,
-  startRemoteWebIngress: startRemoteWebIngressMock,
+  readIngressState: readIngressStateMock,
 }));
 
-const { wake, WEB_INGRESS_FLAG_RETRY } = await import("../commands/wake.js");
+const { wake } = await import("../commands/wake.js");
+const { WEB_INGRESS_FLAG_RETRY } = await import("../lib/tunnel-edge.js");
 
 let tempDir: string;
 let originalArgv: string[];
@@ -260,15 +260,16 @@ beforeEach(() => {
   isAssistantFeatureFlagEnabledMock.mockResolvedValue(true);
   loadRawConfigMock.mockReset();
   loadRawConfigMock.mockReturnValue({});
+  ensureTunnelEdgeMock.mockReset();
+  ensureTunnelEdgeMock.mockResolvedValue({
+    port: 7840,
+    started: true,
+    includesWebApp: true,
+  });
   isIngressRunningMock.mockReset();
   isIngressRunningMock.mockReturnValue(false);
-  startRemoteWebIngressMock.mockReset();
-  startRemoteWebIngressMock.mockResolvedValue({
-    status: "started",
-    listenPort: 7840,
-    webDistDir: "/tmp/web/dist",
-    version: "nginx/1.25.3",
-  });
+  readIngressStateMock.mockReset();
+  readIngressStateMock.mockReturnValue(null);
 });
 
 afterEach(() => {
@@ -403,157 +404,223 @@ describe("vellum wake", () => {
   });
 });
 
-describe("vellum wake — web ingress restore", () => {
+
+describe("vellum wake — tunnel edge restore", () => {
+  const webhookConfig = { telegram: { botUsername: "bot" } };
   const enabledConfig = {
     ingress: { enabled: true, publicBaseUrl: "https://assistant.example.com" },
   };
-
-  const originalRetry = { ...WEB_INGRESS_FLAG_RETRY };
+  const workspaceDirOf = (dir: string) => join(dir, ".vellum", "workspace");
 
   beforeEach(() => {
     process.argv = ["bun", "vellum", "wake", "local-assistant"];
-    // Shrink the startup-window retry so failure-path tests stay fast.
-    WEB_INGRESS_FLAG_RETRY.attempts = 3;
-    WEB_INGRESS_FLAG_RETRY.intervalMs = 5;
   });
 
-  afterEach(() => {
-    WEB_INGRESS_FLAG_RETRY.attempts = originalRetry.attempts;
-    WEB_INGRESS_FLAG_RETRY.intervalMs = originalRetry.intervalMs;
+  test("webhook-configured wake ensures the edge with the startup flag retry and tunnels the edge port", async () => {
+    loadRawConfigMock.mockReturnValue(webhookConfig);
+
+    await wake();
+
+    expect(ensureTunnelEdgeMock).toHaveBeenCalledWith({
+      assistantId: "local-assistant",
+      workspaceDir: workspaceDirOf(tempDir),
+      gatewayPort: 7830,
+      flagRetry: WEB_INGRESS_FLAG_RETRY,
+    });
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7840,
+      workspaceDirOf(tempDir),
+    );
+    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
   });
 
-  test("restores the edge when ingress is enabled, the flag is on, and it is not already running", async () => {
+  test("ingress-enabled wake ensures the edge even without webhook integrations", async () => {
     loadRawConfigMock.mockReturnValue(enabledConfig);
 
     await wake();
 
-    expect(isAssistantFeatureFlagEnabledMock).toHaveBeenCalledWith(
-      "local-assistant",
-      "web-remote-ingress",
-      { runtimeUrl: "http://127.0.0.1:7830" },
-    );
-    expect(startRemoteWebIngressMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        workspaceDir: join(tempDir, ".vellum", "workspace"),
-        gatewayPort: 7830,
-      }),
+    expect(ensureTunnelEdgeMock).toHaveBeenCalledWith({
+      assistantId: "local-assistant",
+      workspaceDir: workspaceDirOf(tempDir),
+      gatewayPort: 7830,
+      flagRetry: WEB_INGRESS_FLAG_RETRY,
+    });
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7840,
+      workspaceDirOf(tempDir),
     );
     expect(logSpy).toHaveBeenCalledWith("Wake complete.");
   });
 
-  test("does not attempt a restore when ingress is disabled", async () => {
-    loadRawConfigMock.mockReturnValue({ ingress: { enabled: false } });
-
+  test("skips the edge and tunnels the gateway port when nothing wants an edge", async () => {
     await wake();
 
     expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
-    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+    expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7830,
+      workspaceDirOf(tempDir),
+    );
   });
 
-  test("does not attempt a restore when ingress config is absent", async () => {
-    loadRawConfigMock.mockReturnValue({});
+  test("skips the edge when ingress is disabled and no webhooks are configured", async () => {
+    loadRawConfigMock.mockReturnValue({ ingress: { enabled: false } });
 
     await wake();
 
-    expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
-    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+    expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7830,
+      workspaceDirOf(tempDir),
+    );
   });
 
-  test("does not attempt a restore when enabled but the public URL is missing", async () => {
+  test("skips the edge when ingress is enabled but the public URL is missing", async () => {
     loadRawConfigMock.mockReturnValue({ ingress: { enabled: true } });
 
     await wake();
 
-    expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
-    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+    expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
   });
 
-  test("does not start a second edge when one is already running", async () => {
-    loadRawConfigMock.mockReturnValue(enabledConfig);
+  test("a running edge recorded against this gateway port is reused with zero flag calls", async () => {
+    loadRawConfigMock.mockReturnValue(webhookConfig);
     isIngressRunningMock.mockReturnValue(true);
+    readIngressStateMock.mockReturnValue({
+      listenPort: 7845,
+      includeWebApp: true,
+      gatewayPort: 7830,
+    });
 
     await wake();
 
-    // Already up — skip the flag probe and the start entirely.
     expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
-    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
+    expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
+    expect(logSpy).toHaveBeenCalledWith(
+      "   Tunnel edge already running on 127.0.0.1:7845 (remote web + webhooks).",
+    );
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7845,
+      workspaceDirOf(tempDir),
+    );
   });
 
-  test("skips the restore quietly with a hint when the flag is off", async () => {
-    loadRawConfigMock.mockReturnValue(enabledConfig);
-    isAssistantFeatureFlagEnabledMock.mockResolvedValue(false);
+  test("a running edge recorded against a different gateway port goes through ensureTunnelEdge", async () => {
+    loadRawConfigMock.mockReturnValue(webhookConfig);
+    isIngressRunningMock.mockReturnValue(true);
+    readIngressStateMock.mockReturnValue({
+      listenPort: 7845,
+      includeWebApp: true,
+      gatewayPort: 7900,
+    });
 
     await wake();
 
-    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("web-remote-ingress"),
+    expect(ensureTunnelEdgeMock).toHaveBeenCalledWith(
+      expect.objectContaining({ gatewayPort: 7830 }),
+    );
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7840,
+      workspaceDirOf(tempDir),
     );
-    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
   });
 
-  test("a thrown restore failure warns but does not fail the wake", async () => {
-    loadRawConfigMock.mockReturnValue(enabledConfig);
-    startRemoteWebIngressMock.mockRejectedValue(new Error("nginx boom"));
+  test("a running edge without a recorded gateway port goes through ensureTunnelEdge", async () => {
+    // An unverified upstream must not be reused blindly; ensureTunnelEdge
+    // restarts it so the running config provably targets the requested port.
+    loadRawConfigMock.mockReturnValue(webhookConfig);
+    isIngressRunningMock.mockReturnValue(true);
+    readIngressStateMock.mockReturnValue({
+      listenPort: 7845,
+      includeWebApp: true,
+    });
 
     await wake();
 
-    expect(startRemoteWebIngressMock).toHaveBeenCalled();
-    expect(warnSpy).toHaveBeenCalled();
+    expect(ensureTunnelEdgeMock).toHaveBeenCalled();
+  });
+
+  test("nginx-missing falls back to the gateway-port tunnel with a warning", async () => {
+    loadRawConfigMock.mockReturnValue(webhookConfig);
+    ensureTunnelEdgeMock.mockRejectedValue(
+      new Error(
+        "nginx is not installed, so the tunnel edge cannot start. Install it (macOS: `brew install nginx`, Linux: `sudo apt install nginx`) or point NGINX_BIN at an existing binary.",
+      ),
+    );
+
+    await wake();
+
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining("brew install nginx"),
+    );
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining("vellum nginx-ingress up"),
+    );
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7830,
+      workspaceDirOf(tempDir),
+    );
     expect(logSpy).toHaveBeenCalledWith("Wake complete.");
   });
 
-  test("an unreachable edge warns but does not fail the wake", async () => {
-    loadRawConfigMock.mockReturnValue(enabledConfig);
-    startRemoteWebIngressMock.mockResolvedValue({
-      status: "unreachable",
-      listenPort: 7840,
-      logPath: "/tmp/nginx-ingress.log",
+  test("flag-off + webhooks-on produces a webhooks-only edge fronting the tunnel", async () => {
+    loadRawConfigMock.mockReturnValue(webhookConfig);
+    ensureTunnelEdgeMock.mockResolvedValue({
+      port: 7840,
+      started: true,
+      includesWebApp: false,
     });
 
     await wake();
 
-    expect(warnSpy).toHaveBeenCalled();
-    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
+    expect(ensureTunnelEdgeMock).toHaveBeenCalledWith(
+      expect.objectContaining({ assistantId: "local-assistant" }),
+    );
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("webhooks only"),
+    );
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7840,
+      workspaceDirOf(tempDir),
+    );
   });
 
-  test("a failed flag probe warns and leaves the edge down without failing the wake", async () => {
+  test("a reused edge still points the tunnel at its listen port", async () => {
     loadRawConfigMock.mockReturnValue(enabledConfig);
-    isAssistantFeatureFlagEnabledMock.mockRejectedValue(
-      new Error("gateway unreachable"),
-    );
+    ensureTunnelEdgeMock.mockResolvedValue({
+      port: 7841,
+      started: false,
+      includesWebApp: true,
+    });
 
     await wake();
 
-    // The probe retries through the startup window before giving up.
-    expect(isAssistantFeatureFlagEnabledMock.mock.calls.length).toBe(3);
-    expect(startRemoteWebIngressMock).not.toHaveBeenCalled();
-    expect(warnSpy).toHaveBeenCalled();
-    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7841,
+      workspaceDirOf(tempDir),
+    );
   });
 
-  test("a flag probe that fails while the gateway is starting retries and then restores", async () => {
-    loadRawConfigMock.mockReturnValue(enabledConfig);
-    isAssistantFeatureFlagEnabledMock
-      .mockRejectedValueOnce(
-        new Error(
-          'Failed to fetch feature flags: HTTP 503 {"status":"starting"}',
-        ),
-      )
-      .mockRejectedValueOnce(
-        new Error(
-          'Failed to fetch feature flags: HTTP 503 {"status":"starting"}',
-        ),
-      )
-      .mockResolvedValueOnce(true);
+  test("an exhausted flag lookup warns and falls back to the gateway-port tunnel", async () => {
+    loadRawConfigMock.mockReturnValue(webhookConfig);
+    ensureTunnelEdgeMock.mockRejectedValue(
+      new Error(
+        "Could not verify the `web-remote-ingress` feature flag before starting the edge. Is the assistant running? Try `vellum wake` and retry. gateway unreachable",
+      ),
+    );
 
     await wake();
 
-    expect(isAssistantFeatureFlagEnabledMock.mock.calls.length).toBe(3);
-    expect(logSpy).toHaveBeenCalledWith(
-      "   Waiting for the gateway before restoring the web ingress edge...",
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining("web-remote-ingress"),
+    );
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining("vellum nginx-ingress up"),
+    );
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7830,
+      workspaceDirOf(tempDir),
     );
-    expect(startRemoteWebIngressMock).toHaveBeenCalled();
     expect(logSpy).toHaveBeenCalledWith("Wake complete.");
   });
 });

package/src/commands/client.ts

@@ -29,18 +29,28 @@ import {
 } from "../lib/client-identity";
 import {
   getLockfileData,
-  upsertLockfileAssistant,
+  upsertRendererLockfileAssistant,
   replacePlatformAssistants,
   isActiveAssistant,
+  isPairedLockfileEntry,
+  PAIRED_GUARDIAN_TOKEN_HOST_ONLY_ERROR,
   runHatch,
   runRetire,
+  connectImport,
+  unpairAssistant,
   getGuardianAccessToken,
+  getPairedGuardianAccessToken,
   parseGatewayUrl,
+  parsePairedGatewayUrl,
   resolveGatewayProxyTarget,
+  resolvePairedGatewayProxyTarget,
   readAllowedGatewayPorts,
+  readPairedGatewayTargets,
+  authorizePairedForwardHeaders,
   isLoopbackAddr,
   headerHostIsLoopback,
   originIsAllowed,
+  hasSameOriginCredentialProof,
   resolveDevCliInvocation,
   resolveLockfilePaths,
   resolveConfigDir,
@@ -445,6 +455,8 @@ function findWebSourceDir(): string | null {
 const LOCKFILE_PATTERN = /^(?:\/assistant)?\/__local\/lockfile$/;
 const HATCH_PATTERN = /^(?:\/assistant)?\/__local\/hatch$/;
 const RETIRE_PATTERN = /^(?:\/assistant)?\/__local\/retire$/;
+const UNPAIR_PATTERN = /^(?:\/assistant)?\/__local\/unpair$/;
+const CONNECT_IMPORT_PATTERN = /^(?:\/assistant)?\/__local\/connect-import$/;
 const GUARDIAN_TOKEN_PATTERN =
   /^(?:\/assistant)?\/__local\/guardian-token\/([^/]+)$/;
 const PLATFORM_SESSION_PATTERN =
@@ -462,15 +474,14 @@ function currentPlatformToken(): string | null {
   return platformSessionToken;
 }
 
-// Whether to attach the platform credential to a proxied request. Only
-// same-origin (SPA) traffic qualifies — a cross-site page must not be able to
-// use the local proxy as a confused deputy for authenticated platform calls.
-// Cross-origin fetches always send an Origin; `Sec-Fetch-Site` is a belt-and-
-// braces check for browsers that send it.
-function isSameOriginRequest(req: Request): boolean {
-  if (!originIsAllowed(req.headers.get("origin") ?? undefined)) return false;
-  const site = req.headers.get("sec-fetch-site");
-  return !site || site === "same-origin" || site === "none";
+// Whether to attach a host-owned credential to a proxied request. The browser
+// must positively identify the request as coming from this server's origin.
+export function isSameOriginRequest(req: Request): boolean {
+  return hasSameOriginCredentialProof(
+    req.headers.get("host") ?? undefined,
+    req.headers.get("origin") ?? undefined,
+    req.headers.get("sec-fetch-site") ?? undefined,
+  );
 }
 
 function getEnvRecord(): Record<string, string> {
@@ -500,9 +511,12 @@ async function handleLocalEndpoints(
     LOCKFILE_PATTERN.test(pathname) ||
     HATCH_PATTERN.test(pathname) ||
     RETIRE_PATTERN.test(pathname) ||
+    UNPAIR_PATTERN.test(pathname) ||
+    CONNECT_IMPORT_PATTERN.test(pathname) ||
     GUARDIAN_TOKEN_PATTERN.test(pathname) ||
     PLATFORM_SESSION_PATTERN.test(pathname) ||
-    parseGatewayUrl(pathname).match;
+    parseGatewayUrl(pathname).match ||
+    parsePairedGatewayUrl(pathname).match;
 
   if (!isLocalRoute) return null;
 
@@ -573,7 +587,7 @@ async function handleLocalEndpoints(
           body.organizationId as string | undefined,
         );
       } else {
-        result = upsertLockfileAssistant(
+        result = upsertRendererLockfileAssistant(
           lockfilePaths,
           body.assistant as Record<string, unknown>,
           body.activeAssistant as string | undefined,
@@ -680,6 +694,74 @@ async function handleLocalEndpoints(
     );
   }
 
+  // Unpair: forget a paired assistant (lockfile entry + guardian token).
+  if (UNPAIR_PATTERN.test(pathname)) {
+    if (req.method !== "POST") {
+      return new Response(null, { status: 405 });
+    }
+
+    let assistantId: string | undefined;
+    try {
+      const body = (await req.json()) as { assistantId?: string };
+      assistantId = body.assistantId;
+    } catch {
+      return Response.json(
+        { ok: false, error: "Invalid JSON body" },
+        { status: 400 },
+      );
+    }
+
+    if (!assistantId) {
+      return Response.json(
+        { ok: false, error: "Missing assistantId" },
+        { status: 400 },
+      );
+    }
+
+    const result = unpairAssistant(lockfilePaths, configDir, assistantId);
+    if (result.ok) {
+      return Response.json({ ok: true, lockfile: result.lockfile });
+    }
+    return Response.json(
+      { ok: false, error: result.error },
+      { status: result.status },
+    );
+  }
+
+  // Connect-import: register a pairing bundle from another machine (guardian
+  // token + paired lockfile entry), the write counterpart of unpair.
+  if (CONNECT_IMPORT_PATTERN.test(pathname)) {
+    if (req.method !== "POST") {
+      return new Response(null, { status: 405 });
+    }
+
+    let body: { bundle?: unknown; name?: unknown };
+    try {
+      body = (await req.json()) as { bundle?: unknown; name?: unknown };
+    } catch {
+      return Response.json(
+        { ok: false, error: "Invalid JSON body" },
+        { status: 400 },
+      );
+    }
+
+    const result = connectImport(lockfilePaths, configDir, {
+      bundle: body.bundle,
+      name: body.name,
+    });
+    if (result.ok) {
+      return Response.json({
+        ok: true,
+        assistantId: result.assistantId,
+        accessOnly: result.accessOnly,
+      });
+    }
+    return Response.json(
+      { ok: false, error: result.error },
+      { status: result.status },
+    );
+  }
+
   // Guardian token
   const guardianMatch = pathname.match(GUARDIAN_TOKEN_PATTERN);
   if (guardianMatch) {
@@ -687,6 +769,13 @@ async function handleLocalEndpoints(
 
     const assistantId = decodeURIComponent(guardianMatch[1]!);
 
+    if (isPairedLockfileEntry(lockfilePaths, assistantId)) {
+      return Response.json(
+        { error: PAIRED_GUARDIAN_TOKEN_HOST_ONLY_ERROR },
+        { status: 403 },
+      );
+    }
+
     let invocation: CliInvocation;
     try {
       invocation = resolveDevCliInvocation(_baseDir);
@@ -703,6 +792,7 @@ async function handleLocalEndpoints(
       invocation,
       true,
       _localEnv,
+      { paired: false },
     );
     if (result.ok) {
       return Response.json({ accessToken: result.accessToken });
@@ -728,30 +818,95 @@ async function handleLocalEndpoints(
     const targetUrl = `http://127.0.0.1:${gatewayTarget.port}${gatewayTarget.path}${url.search}`;
     const headers = new Headers(req.headers);
     headers.set("host", `127.0.0.1:${gatewayTarget.port}`);
+    return proxyGatewayFetch(req, targetUrl, headers, "Gateway proxy error");
+  }
 
+  // Paired-gateway proxy: same shared decision as the web (Vite middleware)
+  // and Electron (`app://` handler) hosts, forwarding to the remote gateway an
+  // imported pairing recorded as its `runtimeUrl`. The lockfile's paired
+  // entries are the allowlist. Renderer authorization and browser-ambient
+  // headers are stripped on the server-to-server hop. This CLI host reads the
+  // paired guardian bearer from disk and installs it after sanitization.
+  const pairedDecision = resolvePairedGatewayProxyTarget(
+    pathname + url.search,
+    () => readPairedGatewayTargets(lockfilePaths),
+  );
+  if (pairedDecision.kind === "reject") {
+    return new Response(pairedDecision.message, {
+      status: pairedDecision.status,
+    });
+  }
+  if (pairedDecision.kind === "forward") {
+    if (!isSameOriginRequest(req)) {
+      return Response.json({ error: "Forbidden" }, { status: 403 });
+    }
+    let invocation: CliInvocation;
     try {
-      const hasBody = req.method !== "GET" && req.method !== "HEAD";
-      const proxyRes = await loopbackSafeFetch(targetUrl, {
-        method: req.method,
-        headers,
-        body: hasBody ? req.body : undefined,
-        redirect: "manual",
-      });
-      const resHeaders = new Headers(proxyRes.headers);
-      resHeaders.delete("transfer-encoding");
-      return new Response(proxyRes.body, {
-        status: proxyRes.status,
-        statusText: proxyRes.statusText,
-        headers: resHeaders,
+      invocation = resolveDevCliInvocation(_baseDir);
+    } catch (err) {
+      return new Response(err instanceof Error ? err.message : String(err), {
+        status: 500,
       });
-    } catch {
-      return new Response("Gateway proxy error", { status: 502 });
     }
+    const headers = new Headers(req.headers);
+    const tokenResult = await authorizePairedForwardHeaders(
+      pairedDecision.assistantId,
+      pairedDecision.runtimeUrl,
+      headers,
+      (assistantId, runtimeUrl) =>
+        getPairedGuardianAccessToken(
+          assistantId,
+          runtimeUrl,
+          configDir,
+          invocation,
+          true,
+          _localEnv,
+        ),
+    );
+    if (!tokenResult.ok) {
+      return new Response(tokenResult.error, { status: tokenResult.status });
+    }
+    headers.set("host", new URL(pairedDecision.url).host);
+    return proxyGatewayFetch(
+      req,
+      pairedDecision.url,
+      headers,
+      "Paired gateway proxy error",
+    );
   }
 
   return null;
 }
 
+// One streamed hop for both gateway data-plane proxies. The upstream
+// `transfer-encoding` is dropped so re-serving the streamed body doesn't emit
+// a duplicate chunked header.
+async function proxyGatewayFetch(
+  req: Request,
+  targetUrl: string,
+  headers: Headers,
+  errorMessage: string,
+): Promise<Response> {
+  try {
+    const hasBody = req.method !== "GET" && req.method !== "HEAD";
+    const proxyRes = await loopbackSafeFetch(targetUrl, {
+      method: req.method,
+      headers,
+      body: hasBody ? req.body : undefined,
+      redirect: "manual",
+    });
+    const resHeaders = new Headers(proxyRes.headers);
+    resHeaders.delete("transfer-encoding");
+    return new Response(proxyRes.body, {
+      status: proxyRes.status,
+      statusText: proxyRes.statusText,
+      headers: resHeaders,
+    });
+  } catch {
+    return new Response(errorMessage, { status: 502 });
+  }
+}
+
 function getBaseDir(): string {
   let dir = import.meta.dir;
   for (let depth = 0; depth < 8; depth++) {