Every POST through /api/vault died with 502 sidecar unreachable while bodyless
GETs worked. Nothing was unreachable: the platform bodyParser reads JSON and
form bodies on the protected router, disturbing the request stream, and the
catch-all proxy then forwards ctx.req.raw.body — an already-consumed stream that
Bun fetch throws on. The throw is caught and reported as the sidecar being down.
Core sidecars never hit this because createSidecarProxy registers the prefix for
them. This router proxies by hand, and the extraction dropped that registration.
Safe across the whole prefix: no handler here reads ctx.get(body), they all call
ctx.req.json() themselves.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude
11a63e52fd