popagent

public
Latest change 7f0ff66d6d9fb6468416c58bee46bd3d08169501 - Checkpoint browser channels and memory work by AkurAI Build
# Browser workspace implementation

Popagent uses Mastra AgentBrowser for deterministic, accessibility-first web automation. Browser changes follow red-green-refactor and retain the existing workspace, request-context, hook, and network safety boundaries.

## 1. Runtime settings and policy

- [x] Expand the singleton browser settings contract and migration with scope, viewport, timeout, concurrency, idle timeout, screencast, recording, retention, and capability controls.
- [x] Add persisted allow/deny host rules while keeping private/local destinations denied unless explicitly allowed.
- [x] Validate DNS resolution and every navigation path, including redirects, clicks, history, and new tabs.
- [x] Make read-only mode incapable of typing, clicking, dialogs, dragging, evaluation, tab creation/closing, recording, or injected input.
- [x] Add contract tests before each store/runtime behavior.

## 2. Session lifecycle and observability

- [x] Track browser sessions by Mastra thread and access class, including status, URL, tabs, creation time, and last activity.
- [x] Enforce maximum concurrent sessions and idle cleanup.
- [x] Close thread sessions on permanent chat deletion and terminal background-task completion.
- [x] Add authenticated APIs for settings, active sessions, session state, close, screencast, and admin input.
- [x] Ensure browser failures and policy blocks remain visible through existing tool hooks/audits.

## 3. Chat browser workspace

- [x] Detect an active browser session for the current chat.
- [x] Slide a compact browser panel in from the right without obscuring the transcript.
- [x] Stream actual Mastra screencast frames, URL, tab state, status, and access class.
- [x] Support explicit admin takeover with pointer/keyboard injection, refresh, and close controls.
- [x] Keep the panel read-only until takeover is deliberately enabled.
- [x] Provide a compact mobile full-screen sheet and accessible close/focus behavior.

## 4. Browser settings UI

- [x] Keep a simple overview with global enablement and provider health.
- [x] Add structured Runtime, Capabilities, Network policy, Sessions, Recordings, and Profiles sections.
- [x] Expose only supported settings; keep headless execution and safety exclusions fixed.
- [x] Add test-browser, close-session, recording download/delete, and profile-management flows.

## 5. Recordings and authenticated profiles

- [x] Enable Mastra beta recording tools with a contained output directory.
- [x] Enforce recording count/age retention.
- [ ] Add richer recording-to-thread/task/agent metadata when Mastra's beta recording API exposes stable lifecycle metadata.
- [x] Store uploaded Playwright storage state encrypted, materialize it only while launching, and clean temporary plaintext.
- [x] Keep local AgentBrowser as the supported provider; defer optional remote CDP until a concrete provider is selected.
- [x] Do not add hosted Stagehand/Browserbase or Firecrawl dependencies by default.

## 6. Verification

- [x] Run narrow policy, settings, runtime, route, and UI tests first.
- [x] Run `bunx tsc --noEmit` and full `bun test`.
- [x] Verify desktop and mobile chat/settings paths in a real browser.
- [x] Update `AGENTS_AGENT.md`, `AGENTS_UI.md`, repository skills, and this checklist.
- [x] Restart `popagent.service` and verify the managed instance.