From ba5fe7130d1ae6efe461cae255bf2e2f1f2a5915 Mon Sep 17 00:00:00 2001
From: Rai Butera <rai@rbutera.com>
Date: Thu, 12 Mar 2026 15:51:13 +0000
Subject: [PATCH] Fix internal gateway attestation for inter-session sends

---
 src/gateway/server-plugins.ts                       |  1 +
 src/gateway/server.sessions-send.test.ts            | 11 ++++++++++-
 src/gateway/server/plugins-http.ts                  |  1 +
 src/gateway/server/ws-connection/message-handler.ts |  3 +++
 4 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/gateway/server-plugins.ts b/src/gateway/server-plugins.ts
index 7d8b2a8a051..3d757409b93 100644
--- a/src/gateway/server-plugins.ts
+++ b/src/gateway/server-plugins.ts
@@ -61,6 +61,7 @@ function createSyntheticOperatorClient(): GatewayRequestOptions["client"] {
       role: "operator",
       scopes: ["operator.admin", "operator.approvals", "operator.pairing"],
     },
+    isInternalBackendClient: true,
   };
 }
 
diff --git a/src/gateway/server.sessions-send.test.ts b/src/gateway/server.sessions-send.test.ts
index 11fae253ff3..ae50eb896d0 100644
--- a/src/gateway/server.sessions-send.test.ts
+++ b/src/gateway/server.sessions-send.test.ts
@@ -140,9 +140,18 @@ describe("sessions_send gateway loopback", () => {
     expect(details.sessionKey).toBe("main");
 
     const firstCall = spy.mock.calls[0]?.[0] as
-      | { lane?: string; inputProvenance?: { kind?: string; sourceTool?: string } }
+      | {
+          lane?: string;
+          channel?: string;
+          messageChannel?: string;
+          runContext?: { messageChannel?: string };
+          inputProvenance?: { kind?: string; sourceTool?: string };
+        }
       | undefined;
     expect(firstCall?.lane).toBe("nested");
+    expect(firstCall?.channel).toBe("inter_session");
+    expect(firstCall?.messageChannel).toBe("inter_session");
+    expect(firstCall?.runContext?.messageChannel).toBe("inter_session");
     expect(firstCall?.inputProvenance).toMatchObject({
       kind: "inter_session",
       sourceTool: "sessions_send",
diff --git a/src/gateway/server/plugins-http.ts b/src/gateway/server/plugins-http.ts
index 6147e1bee99..fc59127037e 100644
--- a/src/gateway/server/plugins-http.ts
+++ b/src/gateway/server/plugins-http.ts
@@ -49,6 +49,7 @@ function createPluginRouteRuntimeClient(params: {
       role: "operator",
       scopes,
     },
+    isInternalBackendClient: true,
   };
 }
 
diff --git a/src/gateway/server/ws-connection/message-handler.ts b/src/gateway/server/ws-connection/message-handler.ts
index f7eec2153ad..4f369f2c14a 100644
--- a/src/gateway/server/ws-connection/message-handler.ts
+++ b/src/gateway/server/ws-connection/message-handler.ts
@@ -990,6 +990,9 @@ export function attachGatewayWsMessageHandler(params: {
           canvasHostUrl,
           canvasCapability,
           canvasCapabilityExpiresAtMs,
+          isInternalBackendClient:
+            connectParams.client.id === GATEWAY_CLIENT_IDS.GATEWAY_CLIENT &&
+            connectParams.client.mode === GATEWAY_CLIENT_MODES.BACKEND,
         };
         setSocketMaxPayload(socket, MAX_PAYLOAD_BYTES);
         setClient(nextClient);