[chore] Extend ngrok to split general ingress and mounts

[junaway]

Context

Development has one ngrok tunnel. It points at the object store, so that Daytona sandboxes can mount their durable working folder over a public URL. Nothing publishes the deployment itself.

That blocks every integration where a provider has to call us. Slack posts events and interactions to a Request URL. An authorization server fetches a client identity document from us. Neither can reach a local stack. The two workarounds we already have do not generalize: Stripe uses its own CLI to forward events, and Composio subscribes over its own WebSocket. Both depend on the provider offering a subscribe call, and an arbitrary platform offers nothing equivalent.

Changes

A second tunnel, ngrok-ingress, forwards to traefik:80. It publishes the whole deployment rather than one service, so every inbound route arrives on its normal path. /api/ is already routed in development, in the self-host compose files, and in production, which means no integration needs a tunnel or a route of its own.

/api/channels/slack/events/       a platform event or interaction
/api/triggers/composio/events/    already the production path
/api/billing/stripe/events/       today served by the vendor CLI instead

ngrok is renamed to ngrok-mounts, so each service is named for what it publishes. Its target, token gate and startup behaviour are unchanged. The runner addresses that service by name, so its compiled in default moves with it.

The tunnel selector now matches on upstream instead of list order. This is the part worth reviewing. discoverTunnelEndpoint returned the first https tunnel it found, with no check on what that tunnel forwarded to. That was correct only while exactly one tunnel existed.

Before:

const https = tunnels.find((t) => t.proto === "https" && !!t.public_url)?.public_url;

After:

const wanted = upstreamAuthority(deps.storeEndpoint);
const match = tunnels.find((t) => upstreamAuthority(t.config.addr) === wanted);
if (!match) return null;  // never another tunnel's URL

Without this, adding a second tunnel could hand a sandbox the platform's HTTP API as an object store, and that failure would surface far from its cause. Returning null is already handled: the caller skips the mount, warns the operator, and tells the model the durable folder is unreachable this turn. Callers that pass no store endpoint keep the old behaviour.

AGENTA_MOUNTS_TUNNEL_API is removed. It overrode the address of the ngrok daemon the runner queries. It was never set in any compose file, env example or deployment, and the compose service name it defaulted to already resolves. Tests inject through the existing deps seam, which stays.

NGROK_DOMAIN_INGRESS is new and optional. Without it the public address rotates on every restart, which matters because that address gets registered by hand in a provider's dashboard. There is no matching variable for the store tunnel on purpose: the runner rediscovers that address at the start of every run, so nothing outside remembers it.

Design notes for the change live under docs/design/dev-ingress/.

Tests and notes

• pnpm test in services/runner: 2117 passed. The 19 failures in commit-authorization, sandbox-agent-acp-interactions and workspace-import are pre existing, confirmed by running the suite on the base commit with this work stashed. pnpm run typecheck is clean.
• Three new selector tests: two tunnels present and the store's is picked, no matching tunnel returns null, and the upstream matches however the daemon spells it.
• docker compose config validates for both editions, and with the with-tunnel profile each lists exactly ngrok-mounts and ngrok-ingress.
• Verified on a live EE dev stack: both tunnels come up, each daemon lists one tunnel with the right upstream, the runner resolves ngrok-mounts and reads its API, and /api/health answers 200 through the ingress tunnel.
• Nothing in production changes. No tunnel exists there and none is added.
• The development deployment becomes publicly reachable while the tunnel is up. It is off without a token, and it is still a real change in exposure.

What to QA

Written for a clean start: fresh checkout, no existing stack.

Setup. Copy the edition's env.*.dev.example to your env file and set NGROK_AUTHTOKEN. Set NGROK_DOMAIN_INGRESS too if you have a reserved domain. Both now live under their own ngrok section. Bring the stack up as usual. The tunnel profile is on by default, so nothing extra is needed to get both tunnels.

• docker ps shows ngrok-mounts and ngrok-ingress both up. Two tunnels need two ngrok agent sessions, so watch for the second failing to start on a restricted plan. That is the most likely way this fails on someone else's account.
• curl https://<ingress-url>/api/health answers {"status":"ok"} as JSON. HTML means it reached web and the path is wrong. Get the address from the ngrok dashboard or the ngrok-ingress container logs.
• Regression, and the one that matters most: run an agent turn on a Daytona sandbox with the bundled store and confirm the durable working folder still mounts. Expect no mount SKIPPED warning. An earlier draft of this change broke exactly this.
• Regression: a local sandbox run still works. Local sandboxes never tunnelled, so this shows the compose edit broke nothing else.
• With NGROK_AUTHTOKEN unset, neither service publishes anything and neither loops. Each should exit 0 once and stay exited.

Only if you are upgrading a stack that is already running, pass --remove-orphans on the first bring up. The service rename leaves an orphaned ngrok container behind otherwise, which is confusing rather than harmful. A clean start never sees this.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agenta-documentation	Error		Aug 14, 2026 5:47pm

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 2c2cdba7-cb99-4e3f-be2d-caca2b355969

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the local dev stack to support two ngrok tunnels: one for the object-store mounts used by remote sandboxes and a second for general ingress (Traefik) so external providers can reach /api/... webhooks during development. It also hardens the runner’s tunnel discovery so it selects the correct tunnel when multiple are present.

Changes:

• Add ngrok-ingress (tunnels traefik:80) and rename the existing store tunnel service to ngrok-mounts.
• Update discoverTunnelEndpoint to match tunnels by upstream (store endpoint) and wire the store endpoint through the call sites; add unit tests.
• Remove AGENTA_MOUNTS_TUNNEL_API usage and document the new optional NGROK_DOMAIN_INGRESS.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
services/runner/tests/unit/sandbox-agent-mount.test.ts	Adds tests for multi-tunnel selection behavior and updates the default ngrok API hostname used in tests.
services/runner/src/engines/sandbox_agent/mount.ts	Renames default ngrok API to ngrok-mounts and matches tunnels by upstream endpoint for correctness with multiple tunnels.
services/runner/src/engines/sandbox_agent/environment.ts	Passes storeEndpoint into tunnel discovery at both call sites.
hosting/docker-compose/oss/env.oss.dev.example	Documents the two-tunnel setup and introduces optional NGROK_DOMAIN_INGRESS.
hosting/docker-compose/oss/docker-compose.dev.yml	Renames ngrok → ngrok-mounts and adds new ngrok-ingress service forwarding to Traefik.
hosting/docker-compose/ee/env.ee.dev.example	Same env documentation updates as OSS.
hosting/docker-compose/ee/docker-compose.dev.yml	Same compose service rename/addition as OSS.
docs/designs/platform/store-generalization/tasks.md	Notes that AGENTA_MOUNTS_TUNNEL_API guidance has been superseded by later removal.
docs/designs/platform/store-generalization/specs.md	Adds superseding note documenting removal rationale for AGENTA_MOUNTS_TUNNEL_API.
docs/designs/platform/runner-rename/specs.md	Notes AGENTA_MOUNTS_TUNNEL_API mention is superseded by later removal.
docs/design/dev-ingress/tasks.md	Adds task checklist for the dev ingress tunnel change and verification steps.
docs/design/dev-ingress/specs.md	Adds design spec for two tunnels and the upstream-matching selector behavior.
docs/design/dev-ingress/research.md	Adds research notes motivating why ingress tunneling is needed (provider callbacks) and why store tunneling can’t share a host by path.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.