popagent

public
Latest change 6edc7e928c57dab23c0973ed3f7ee70b3ebb72d5 - Initial popagent baseline by AkurAI Build
# Browser workspace implementation

Popagent uses Mastra AgentBrowser for deterministic, accessibility-first web automation. Browser changes follow red-green-refactor and retain the existing workspace, request-context, hook, and network safety boundaries.

## 1. Runtime settings and policy

- [ ] Expand the singleton browser settings contract and migration with scope, viewport, timeout, concurrency, idle timeout, screencast, recording, retention, and capability controls.
- [ ] Add persisted allow/deny host rules while keeping private/local destinations denied unless explicitly allowed.
- [ ] Validate DNS resolution and every navigation path, including redirects, clicks, history, and new tabs.
- [ ] Make read-only mode incapable of typing, clicking, dialogs, dragging, evaluation, tab creation/closing, recording, or injected input.
- [ ] Add contract tests before each store/runtime behavior.

## 2. Session lifecycle and observability

- [ ] Track browser sessions by Mastra thread, agent/access class, status, URL, tabs, creation time, and last activity.
- [ ] Enforce maximum concurrent sessions and idle cleanup.
- [ ] Close thread sessions on permanent chat deletion and terminal background-task completion.
- [ ] Add authenticated APIs for settings, active sessions, session state, close, screencast, and admin input.
- [ ] Ensure browser failures and policy blocks remain visible through existing tool hooks/audits.

## 3. Chat browser workspace

- [ ] Detect an active browser session for the current chat.
- [ ] Slide a compact browser panel in from the right without obscuring the transcript.
- [ ] Stream actual Mastra screencast frames, URL, tab state, status, and agent ownership.
- [ ] Support explicit admin takeover with pointer/keyboard injection, refresh, and close controls.
- [ ] Keep the panel read-only until takeover is deliberately enabled.
- [ ] Provide a compact mobile full-screen sheet and accessible close/focus behavior.

## 4. Browser settings UI

- [ ] Keep a simple overview with global enablement and provider health.
- [ ] Add structured Runtime, Capabilities, Network policy, Sessions, Recordings, and Profiles sections.
- [ ] Expose only supported settings; keep headless execution and safety exclusions fixed.
- [ ] Add test-browser, close-session, recording download/delete, and profile-management flows.

## 5. Recordings and authenticated profiles

- [ ] Enable Mastra beta recording tools with a contained output directory.
- [ ] Correlate recordings to thread/task/agent and enforce count/age retention.
- [ ] Store uploaded Playwright storage state encrypted, materialize it only while launching, and clean temporary plaintext.
- [ ] Support local AgentBrowser first and optional encrypted CDP configuration without exposing secrets in APIs/logs.
- [ ] Do not add hosted Stagehand/Browserbase or Firecrawl dependencies by default.

## 6. Verification

- [ ] Run narrow policy, settings, runtime, route, and UI tests first.
- [ ] Run `bunx tsc --noEmit` and full `bun test`.
- [ ] Verify desktop and mobile chat/settings paths in a real browser.
- [ ] Update `AGENTS_AGENT.md`, `AGENTS_UI.md`, repository skills, and this checklist.
- [ ] Restart `popagent.service` and verify the managed instance.