feat(agent_harness_service): remove legacy alb

crates/coding_agent_worker/default.macrod.toml

@@ -1,7 +1,7 @@
 # macrod configuration. Pairing adds a bearer token here; keep this file private.
 
 [macro]
-api_url = "https://agent-harness.macro.com"
+api_url = "https://gateway.macro.com/agent-harness"
 storage_url = "https://gateway.macro.com/dss"
 web_url = "https://macro.com/app"
 

crates/coding_agent_worker/src/config/test.rs

@@ -97,13 +97,13 @@ fn the_gateway_url_is_the_api_base_with_a_websocket_scheme() {
     );
 
     let secure = MacroApi {
-        api_url: "https://agent-harness.macro.com/".to_owned(),
+        api_url: "https://gateway.macro.com/agent-harness/".to_owned(),
         storage_url: "https://gateway.macro.com/dss".to_owned(),
         web_url: "https://macro.com/app/".to_owned(),
     };
     assert_eq!(
         secure.gateway_url(),
-        "wss://agent-harness.macro.com/runtime/ws",
+        "wss://gateway.macro.com/agent-harness/runtime/ws",
     );
     assert_eq!(
         secure.pairing_approval_url("KX7M-4QHD"),

crates/coding_agent_worker/src/tui/config_form.rs

@@ -18,7 +18,7 @@ mod environment {
 }
 
 const DEFAULT_CONFIG: &str = include_str!("../../default.macrod.toml");
-const DEV_API_URL: &str = "https://agent-harness-dev.macro.com";
+const DEV_API_URL: &str = "https://dev-gateway.macro.com/agent-harness";
 const DEV_STORAGE_URL: &str = "https://dev-gateway.macro.com/dss";
 const DEV_WEB_URL: &str = "https://dev.macro.com/app";
 

crates/coding_agent_worker/src/tui/config_form/test.rs

@@ -26,7 +26,14 @@ fn creates_a_valid_production_config() {
     assert_eq!(config.harness.command, "hermes");
     assert_eq!(config.harness.args, ["acp"]);
     assert_eq!(config.workspace.path, directory.path());
-    assert_eq!(config.macro_api.api_url, "https://agent-harness.macro.com");
+    assert_eq!(
+        config.macro_api.api_url,
+        "https://gateway.macro.com/agent-harness"
+    );
+    assert_eq!(
+        config.macro_api.gateway_url(),
+        "wss://gateway.macro.com/agent-harness/runtime/ws"
+    );
     assert_eq!(
         config.macro_api.storage_url,
         "https://gateway.macro.com/dss"
@@ -45,7 +52,14 @@ fn creates_a_dev_config_when_dev_mode_is_set() {
         .expect("create config");
     let config = Config::load(&path).expect("load generated config");
 
-    assert_eq!(config.macro_api.api_url, DEV_API_URL);
+    assert_eq!(
+        config.macro_api.api_url,
+        "https://dev-gateway.macro.com/agent-harness"
+    );
+    assert_eq!(
+        config.macro_api.gateway_url(),
+        "wss://dev-gateway.macro.com/agent-harness/runtime/ws"
+    );
     assert_eq!(config.macro_api.storage_url, DEV_STORAGE_URL);
     assert_eq!(config.macro_api.web_url, DEV_WEB_URL);
 }

crates/macro_service_urls/src/lib.rs

@@ -561,6 +561,20 @@ service_url! {
             dev: "https://dev-gateway.macro.com/agent-harness",
             prod: "https://gateway.macro.com/agent-harness",
         },
+        /// Sandbox-facing agent harness egress proxy URL.
+        /// Override the local default when sandbox clients need a Docker-network
+        /// address or a public tunnel rather than the host's loopback address.
+        pub AgentHarnessEgressUrl {
+            local: "http://localhost:8102",
+            dev: "https://dev-gateway.macro.com/agent-harness-egress",
+            prod: "https://gateway.macro.com/agent-harness-egress",
+        },
+        /// Macro MCP service base URL. Append `/mcp` for its transport endpoint.
+        pub McpServiceUrl {
+            local: "http://localhost:8080",
+            dev: "https://dev-gateway.macro.com/mcp",
+            prod: "https://gateway.macro.com/mcp",
+        },
         /// Link unfurl service API URL.
         pub UnfurlServiceUrl {
             local: "http://localhost:8095",

crates/macro_service_urls/src/test.rs

@@ -161,6 +161,82 @@ fn agent_harness_service_url_has_no_trailing_slash() {
     }
 }
 
+#[test]
+fn agent_harness_egress_url_parses() {
+    assert_parses_for_all_environments(AgentHarnessEgressUrl::default_for_environment);
+}
+
+#[test]
+fn agent_harness_egress_url_selects_defaults_without_a_required_config_value() {
+    with_mock_override_env(missing_override, || {
+        for (environment, expected) in [
+            (Environment::Local, "http://localhost:8102"),
+            (
+                Environment::Develop,
+                "https://dev-gateway.macro.com/agent-harness-egress",
+            ),
+            (
+                Environment::Production,
+                "https://gateway.macro.com/agent-harness-egress",
+            ),
+        ] {
+            let url = AgentHarnessEgressUrl::new_for_environment(environment).unwrap();
+            assert_eq!(url.as_str(), expected);
+            assert!(!url.as_str().ends_with('/'));
+        }
+    });
+}
+
+#[test]
+fn agent_harness_egress_url_honors_the_standard_override_for_tunnels() {
+    with_mock_override_env(
+        |name| {
+            assert_eq!(name, "OVERRIDE_AGENT_HARNESS_EGRESS_URL");
+            Ok("https://egress-test.trycloudflare.com".to_owned())
+        },
+        || {
+            for environment in ENVS {
+                let url = AgentHarnessEgressUrl::new_for_environment(environment).unwrap();
+                assert_eq!(url.as_str(), "https://egress-test.trycloudflare.com");
+            }
+        },
+    );
+}
+
+#[test]
+fn mcp_service_url_parses() {
+    assert_parses_for_all_environments(McpServiceUrl::default_for_environment);
+}
+
+#[test]
+fn mcp_service_url_defaults_are_bases_without_a_trailing_slash() {
+    with_mock_override_env(missing_override, || {
+        for (environment, expected) in [
+            (Environment::Local, "http://localhost:8080"),
+            (Environment::Develop, "https://dev-gateway.macro.com/mcp"),
+            (Environment::Production, "https://gateway.macro.com/mcp"),
+        ] {
+            let url = McpServiceUrl::new_for_environment(environment).unwrap();
+            assert_eq!(url.as_str(), expected);
+            assert!(!url.as_str().ends_with('/'));
+        }
+    });
+}
+
+#[test]
+fn mcp_service_url_honors_the_standard_override() {
+    with_mock_override_env(
+        |name| {
+            assert_eq!(name, "OVERRIDE_MCP_SERVICE_URL");
+            Ok("http://mcp-service:8080".to_owned())
+        },
+        || {
+            let url = McpServiceUrl::new_for_environment(Environment::Local).unwrap();
+            assert_eq!(url.as_str(), "http://mcp-service:8080");
+        },
+    );
+}
+
 #[test]
 fn unfurl_service_url_parses() {
     assert_parses_for_all_environments(UnfurlServiceUrl::default_for_environment);
@@ -413,6 +489,14 @@ fn exported_service_urls_match_local_values() {
         service_urls.static_file_service_url.as_ref(),
         "http://localhost:8100",
     );
+    assert_eq!(
+        service_urls.agent_harness_egress_url.as_ref(),
+        "http://localhost:8102",
+    );
+    assert_eq!(
+        service_urls.mcp_service_url.as_ref(),
+        "http://localhost:8080"
+    );
     assert_eq!(
         service_urls.unfurl_service_url.as_ref(),
         "http://localhost:8095"
@@ -487,6 +571,14 @@ fn exported_service_urls_match_dev_values() {
         service_urls.agent_harness_service_url.as_ref(),
         "https://dev-gateway.macro.com/agent-harness",
     );
+    assert_eq!(
+        service_urls.agent_harness_egress_url.as_ref(),
+        "https://dev-gateway.macro.com/agent-harness-egress",
+    );
+    assert_eq!(
+        service_urls.mcp_service_url.as_ref(),
+        "https://dev-gateway.macro.com/mcp",
+    );
     assert_eq!(
         service_urls.unfurl_service_url.as_ref(),
         "https://dev-gateway.macro.com/unfurl",
@@ -558,6 +650,14 @@ fn exported_service_urls_match_prod_values() {
         service_urls.agent_harness_service_url.as_ref(),
         "https://gateway.macro.com/agent-harness",
     );
+    assert_eq!(
+        service_urls.agent_harness_egress_url.as_ref(),
+        "https://gateway.macro.com/agent-harness-egress",
+    );
+    assert_eq!(
+        service_urls.mcp_service_url.as_ref(),
+        "https://gateway.macro.com/mcp",
+    );
     assert_eq!(
         service_urls.unfurl_service_url.as_ref(),
         "https://gateway.macro.com/unfurl",
@@ -626,6 +726,14 @@ fn exported_service_url_override_names_are_derived_from_env_var_names() {
         StaticFileServiceUrl::local().override_env_var_name(),
         "OVERRIDE_STATIC_FILE_SERVICE_URL",
     );
+    assert_eq!(
+        AgentHarnessEgressUrl::local().override_env_var_name(),
+        "OVERRIDE_AGENT_HARNESS_EGRESS_URL",
+    );
+    assert_eq!(
+        McpServiceUrl::local().override_env_var_name(),
+        "OVERRIDE_MCP_SERVICE_URL",
+    );
     assert_eq!(
         UnfurlServiceUrl::local().override_env_var_name(),
         "OVERRIDE_UNFURL_SERVICE_URL",

docker/docker-compose.yml

@@ -398,7 +398,7 @@ services:
       services:
         aliases:
           # Hyphenated for the same reason as the harness alias above, and
-          # because it is the host the egress proxy's MACRO_MCP_URL names.
+          # because it is the host OVERRIDE_MCP_SERVICE_URL names.
           - mcp-service
 
   # ============================================================================

infra/packages/shared/src/gateway_priorities.ts

@@ -11,6 +11,7 @@ export enum GatewayService {
   SEARCH_PROCESSING_SERVICE = 'SEARCH_PROCESSING_SERVICE',
   IMAGE_PROXY_SERVICE = 'IMAGE_PROXY_SERVICE',
   AGENT_HARNESS_SERVICE = 'AGENT_HARNESS_SERVICE',
+  AGENT_HARNESS_EGRESS = 'AGENT_HARNESS_EGRESS',
   AGENT_SCHEDULE_SERVICE = 'AGENT_SCHEDULE_SERVICE',
   CONNECTION_GATEWAY = 'CONNECTION_GATEWAY',
   AUTHENTICATION_SERVICE = 'AUTHENTICATION_SERVICE',
@@ -36,6 +37,7 @@ export const GATEWAY_PRIORITIES: GatewayPriorityMap = {
   [GatewayService.SEARCH_PROCESSING_SERVICE]: 50,
   [GatewayService.IMAGE_PROXY_SERVICE]: 60,
   [GatewayService.AGENT_HARNESS_SERVICE]: 70,
+  [GatewayService.AGENT_HARNESS_EGRESS]: 75,
   [GatewayService.AGENT_SCHEDULE_SERVICE]: 80,
   [GatewayService.CONNECTION_GATEWAY]: 90,
   [GatewayService.AUTHENTICATION_SERVICE]: 100,

infra/packages/shared/src/service_urls.ts

@@ -15,6 +15,7 @@ export enum ServiceUrl {
   LEXICAL_SERVICE_URL = 'LEXICAL_SERVICE_URL',
   UNFURL_SERVICE_URL = 'UNFURL_SERVICE_URL',
   AGENT_HARNESS_SERVICE_URL = 'AGENT_HARNESS_SERVICE_URL',
+  AGENT_HARNESS_EGRESS_URL = 'AGENT_HARNESS_EGRESS_URL',
   MCP_SERVER_URL = 'MCP_SERVER_URL',
 }
 
@@ -48,6 +49,8 @@ const DEV_SERVICE_URLS: ServiceUrlMap = {
   [ServiceUrl.UNFURL_SERVICE_URL]: 'https://dev-gateway.macro.com/unfurl',
   [ServiceUrl.AGENT_HARNESS_SERVICE_URL]:
     'https://dev-gateway.macro.com/agent-harness',
+  [ServiceUrl.AGENT_HARNESS_EGRESS_URL]:
+    'https://dev-gateway.macro.com/agent-harness-egress',
   [ServiceUrl.MCP_SERVER_URL]: 'https://dev-gateway.macro.com/mcp',
 };
 
@@ -72,6 +75,8 @@ const PROD_SERVICE_URLS: ServiceUrlMap = {
   [ServiceUrl.UNFURL_SERVICE_URL]: 'https://gateway.macro.com/unfurl',
   [ServiceUrl.AGENT_HARNESS_SERVICE_URL]:
     'https://gateway.macro.com/agent-harness',
+  [ServiceUrl.AGENT_HARNESS_EGRESS_URL]:
+    'https://gateway.macro.com/agent-harness-egress',
   [ServiceUrl.MCP_SERVER_URL]: 'https://gateway.macro.com/mcp',
 };