From c56d1bbbbb49dea748a89104e1963900edb2c1db Mon Sep 17 00:00:00 2001
From: Peter Steinberger <peter@steipete.me>
Date: Tue, 14 Jul 2026 04:08:36 -0700
Subject: [PATCH] fix(reef): send through the connected gateway (#107373)

* fix(reef): route outbound through gateway

* chore: keep Reef release note in PR
---
 extensions/reef/index.test.ts        | 11 +++++++++++
 extensions/reef/index.ts             |  1 -
 extensions/reef/src/outbound.test.ts |  4 ++++
 extensions/reef/src/outbound.ts      |  3 ++-
 4 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 extensions/reef/index.test.ts

diff --git a/extensions/reef/index.test.ts b/extensions/reef/index.test.ts
new file mode 100644
index 000000000000..78bc4fd27da7
--- /dev/null
+++ b/extensions/reef/index.test.ts
@@ -0,0 +1,11 @@
+import { describe, expect, it } from "vitest";
+import reefEntry from "./index.js";
+import { reefPlugin } from "./src/channel.js";
+import { reefOutboundAdapter } from "./src/outbound.js";
+
+describe("reef bundled entry", () => {
+  it("keeps outbound delivery on the canonical channel plugin", () => {
+    expect(reefEntry.loadChannelOutbound).toBeUndefined();
+    expect(reefPlugin.outbound).toBe(reefOutboundAdapter);
+  });
+});
diff --git a/extensions/reef/index.ts b/extensions/reef/index.ts
index a5671de4be55..bdaaea3a8ff2 100644
--- a/extensions/reef/index.ts
+++ b/extensions/reef/index.ts
@@ -26,7 +26,6 @@ export default defineBundledChannelEntry({
   description: "Guarded end-to-end encrypted claw channel",
   importMetaUrl: import.meta.url,
   plugin: { specifier: "./channel-plugin-api.js", exportName: "reefPlugin" },
-  outbound: { specifier: "./api.js", exportName: "reefOutboundAdapter" },
   runtime: { specifier: "./runtime-api.js", exportName: "setReefRuntime" },
   registerCliMetadata: registerReefCliMetadata,
   registerFull: registerReefFullRuntime,
diff --git a/extensions/reef/src/outbound.test.ts b/extensions/reef/src/outbound.test.ts
index b366c349a30c..d61fcb5cc0e9 100644
--- a/extensions/reef/src/outbound.test.ts
+++ b/extensions/reef/src/outbound.test.ts
@@ -3,6 +3,10 @@ import { reefOutboundAdapter } from "./outbound.js";
 import { setActiveReef } from "./runtime.js";
 
 describe("reefOutboundAdapter", () => {
+  it("delegates delivery to the Gateway that owns the active encrypted flow", () => {
+    expect(reefOutboundAdapter.deliveryMode).toBe("gateway");
+  });
+
   it("normalizes the SDK target and delegates only message content/context to the guarded flow", async () => {
     const send = vi.fn(async () => "01JZ0000000000000000000200");
     setActiveReef({ flow: { send }, friends: {}, reviews: {} } as never);
diff --git a/extensions/reef/src/outbound.ts b/extensions/reef/src/outbound.ts
index 521ffc9a8a81..3763e4db3129 100644
--- a/extensions/reef/src/outbound.ts
+++ b/extensions/reef/src/outbound.ts
@@ -27,7 +27,8 @@ async function send(
 }
 
 export const reefOutboundAdapter: ChannelOutboundAdapter = {
-  deliveryMode: "direct",
+  // The encrypted flow belongs to the Gateway account lifecycle; other processes must delegate.
+  deliveryMode: "gateway",
   textChunkLimit: 32 * 1024,
   deliveryCapabilities: { durableFinal: { text: true, replyTo: true, thread: true } },
   resolveTarget: ({ to }) => {