`router/index.ts:62-67` declares `WEBHOOK_WORKER_PATHS` as the exact paths the webhook worker handles:
- `/api/v1/webhooks/composio`
- `/api/v1/webhooks/github`
- `/api/v1/webhooks/hookdeck`
- `/api/v1/webhooks/nango`
The actual worker (`cloud/packages/webhook-worker/src/index.ts:24-26`) has an exact-match handler map for composio + nango only; every other path 404s.
Nothing is broken today: the live gate `shouldUseWebhookWorker` → `shouldUseNangoWebhookWorkerRoute` (router/index.ts:274-301) forwards only the nango path, so github/hookdeck webhooks still reach cloud-web's Next.js routes. But the comment above the set (router/index.ts:58-61) presents it as the worker's real capability list — anyone widening the gate to consult `WEBHOOK_WORKER_PATHS` forwards github/hookdeck webhook traffic into a 404.
Fix direction: trim the set to the worker's actual capabilities (composio, nango), or derive it from a contract the worker exports, so the set can't drift from the handler map again.
Related cleanup in the same file: the comment in `shouldUseWebhookWorker` (router/index.ts:291-296) describes the redelivery-loop forward as targeting `origin.agentrelay.cloud` — that hostname was deleted with the Phase 5 Lambda/CloudFront teardown (cloud#1949). The deployed forward target is `CLOUD_WEB_WEBHOOK_ORIGIN = https://` (cloud `infra/webhook-worker.ts:113`); the comment should describe that.
Surfaced by relaycron-cloud during migration recon; verified against both repos 2026-07-29.
🤖 Generated with Claude Code
`router/index.ts:62-67` declares `WEBHOOK_WORKER_PATHS` as the exact paths the webhook worker handles:
The actual worker (`cloud/packages/webhook-worker/src/index.ts:24-26`) has an exact-match handler map for composio + nango only; every other path 404s.
Nothing is broken today: the live gate `shouldUseWebhookWorker` → `shouldUseNangoWebhookWorkerRoute` (router/index.ts:274-301) forwards only the nango path, so github/hookdeck webhooks still reach cloud-web's Next.js routes. But the comment above the set (router/index.ts:58-61) presents it as the worker's real capability list — anyone widening the gate to consult `WEBHOOK_WORKER_PATHS` forwards github/hookdeck webhook traffic into a 404.
Fix direction: trim the set to the worker's actual capabilities (composio, nango), or derive it from a contract the worker exports, so the set can't drift from the handler map again.
Related cleanup in the same file: the comment in `shouldUseWebhookWorker` (router/index.ts:291-296) describes the redelivery-loop forward as targeting `origin.agentrelay.cloud` — that hostname was deleted with the Phase 5 Lambda/CloudFront teardown (cloud#1949). The deployed forward target is `CLOUD_WEB_WEBHOOK_ORIGIN = https://` (cloud `infra/webhook-worker.ts:113`); the comment should describe that.
Surfaced by relaycron-cloud during migration recon; verified against both repos 2026-07-29.
🤖 Generated with Claude Code