feat(cloud-task): Durable run streaming through agent-proxy

[charlesvien]

Problem

Moves event streaming to agent-proxy

Changes

1. Route the event-ingest POST to the standalone agent-proxy via new POSTHOG_TASK_RUN_EVENT_INGEST_URL
2. Resolve the read leg once via stream_token, then read from the proxy with a run-scoped Bearer token (falls back to Django)
3. Add a stream-end sentinel as the authoritative end-of-stream signal
4. Make the reconnect loop status-unaware: stop only on stream-end or budget exhaustion, never on polled status
5. Speed up reconnect backoff (flat 500ms for 3 attempts, then exponential to 30s; ~1.5s recovery vs ~16s)
6. Cover ingest routing, read-leg routing and stream-end in tests

How did you test this?

Manually

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[charlesvien]

• feat(cloud-task): Durable run streaming through agent-proxy #2519 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

T-Rex Logs

What T-Rex did

• Ran the existing cloud task service test file and all 24 tests passed.
• Added a focused proxy stream edge-case test file with three tests for proxy URL encoding, stream_token fallback, and stream-end during bootstrap.
• Verified that a proxy stream URL with URL-special characters in runId is parsed into the wrong path and query shape when the runId is not encoded.
• Observed that the proxy stream URL test timed out due to the malformed URL not matching the mock URL pattern, confirming the URL handling issue.
• Verified that stream-end during bootstrap deletes the watcher before historical logs finish loading, so the snapshot is not emitted.
• Verified that transient stream_token resolution failures retry resolution on reconnect.
• Verified that event-stream-sender.ts encodes runId with encodeURIComponent, preventing read-leg omissions.

Artifacts

Focused proxy stream edge-case test output

• Shows the edge-case test results for proxy stream behavior to inspect test outcomes.

URL parsing proof for unencoded proxy run IDs

• Demonstrates how unencoded run IDs affect URL path and query shaping.

Generated focused proxy stream edge-case tests

• Contains the TypeScript source for the focused proxy stream edge-case tests.

Vitest output: 1 failed (URL encoding bug), 2 passed, 1 unhandled rejection (bootstrap race)

• Summarizes the test run results for the proxy edge-case tests, including a failure and a bootstrap race.

Node.js proof: proxy stream URL is malformed when runId contains special chars; ingest URL is correct

• Demonstrates how a runId with special characters breaks the constructed URL while the ingestion URL remains correct.

Generated proxy-stream-edge-cases TypeScript tests

• Contains the TypeScript tests used for the proxy-stream-edge-cases run.

_{Ran code and verified through T-Rex}

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
apps/code/src/main/services/cloud-task/service.ts:654-658
**Encode proxy run IDs**

The proxy stream path inserts `watcher.runId` directly into the URL. If a run ID contains URL-special characters such as `/`, `?`, or `&`, `new URL()` treats those characters as path or query delimiters and the request goes to the wrong proxy route. The ingest side already encodes `runId`, so the read side should do the same.

```suggestion
    const url = new URL(
      usingProxy
        ? `${base}/v1/runs/${encodeURIComponent(watcher.runId)}/stream`
        : `${base}/api/projects/${watcher.teamId}/tasks/${watcher.taskId}/runs/${watcher.runId}/stream/`,
    );
```

### Issue 2 of 2
apps/code/src/main/services/cloud-task/service.ts:1188-1191
**Preserve bootstrap snapshot**

When `stream-end` arrives while bootstrap is still fetching historical logs, this branch stops and deletes the watcher before the bootstrap path can emit its snapshot. The pending `bootstrapWatcher()` then sees that the watcher is gone and returns, so subscribers never receive the existing run history. The `streamEnded && isBootstrapping` case needs to defer stopping until after bootstrap finishes.

_{Reviews (1): Last reviewed commit: "Implement agent proxy" | Re-trigger Greptile}

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 7f791ce.}

[greptile-apps]

T-Rex Logs

What T-Rex did

• Generated focused checks for the cloud-task stream read path and bootstrap completion flow.
• Verified that proxy stream URLs are built with the raw run ID when the read leg uses agent-proxy.
• Verified that a stream-end event during bootstrap can stop the watcher before the snapshot is emitted.
• Wrote targeted repro test at apps/code/src/main/services/cloud-task/trex-bugs.test.ts using the same mock patterns as the existing test suite.
• Ran the tests with npx vitest run from the apps/code workspace; both tests failed as expected.
• Test 1 showed that stream-end during bootstrap timed out waiting for the snapshot emission, confirming the watcher was stopped before the snapshot could be emitted.
• Test 2 demonstrated an encoding discrepancy in the proxy URL, where plus and slash characters were not encoded as encodeURIComponent would encode them.
• Full verbose test output was saved to trex-artifacts/trex-test-output.log.

Artifacts

Verbose targeted test output

• Contains the targeted test run output for the cloud-task stream read path repros, used to inspect test results.

Generated repro tests

• Contains the TypeScript repro tests generated using the same mock patterns as the existing test suite.

Verbose vitest output showing both failing repro tests with stack traces

• Contains verbose test output showing both failing repro tests, including stack traces.

trex-bugs.test.ts repro source

• Contains the targeted repro test file trex-bugs.test.ts used for the cloud-task repros.

_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "Implement agent proxy" | Re-trigger Greptile}

[stamphog]

The review agent couldn't reach its LLM backend — an infrastructure or credentials issue, not a problem with this PR. The Stamphog label has been kept; the review retries automatically on the next push, or re-apply the label once the backend recovers.

[stamphog]

The review agent couldn't reach its LLM backend — an infrastructure or credentials issue, not a problem with this PR. The Stamphog label has been kept; the review retries automatically on the next push, or re-apply the label once the backend recovers.

[stamphog]

The review agent couldn't reach its LLM backend — an infrastructure or credentials issue, not a problem with this PR. The Stamphog label has been kept; the review retries automatically on the next push, or re-apply the label once the backend recovers.

[stamphog]

The review agent couldn't reach its LLM backend — an infrastructure or credentials issue, not a problem with this PR. The Stamphog label has been kept; the review retries automatically on the next push, or re-apply the label once the backend recovers.

[greptile-apps]

_{Reviews (3): Last reviewed commit: "log ingest recovery at info not warn" | Re-trigger Greptile}