agent-portal-2 0.1.0

package/.continue/agents/new-config.yaml

@@ -0,0 +1,22 @@
+name: Diff Config
+version: 1.0.0
+schema: v1
+
+models:
+  - name: GLM 5.2 Chat
+    provider: openai
+    model: glm-5.2
+    apiBase: https://api.z.ai/api/paas/v4
+    apiKey: 680bd41483654976867ca460ffa1c605.f8K53MYqu7JbdJFs
+    roles:
+      - chat
+      - edit
+      - apply
+
+  - name: GLM 5.2 Autocomplete
+    provider: openai
+    model: glm-5.2
+    apiBase: https://api.z.ai/api/paas/v4
+    apiKey: 680bd41483654976867ca460ffa1c605.f8K53MYqu7JbdJFs
+    roles:
+      - autocomplete

package/AGENT_STEERING.md

@@ -0,0 +1,36 @@
+# Agent Steering
+
+Agent Steering is the control system that governs what the agent can do.
+
+## Current Controls
+
+- pause agent
+- resume agent
+- stop agent
+- step-by-step mode
+- redirect goal
+- lock to domain
+- lock to current tab
+- approve next action
+- reject next action
+- edit queued action
+
+## Current Policy Rules
+
+- password field typing is blocked
+- billing and payment actions are blocked
+- destructive actions are high risk
+- settings changes are high risk
+- submissions and authentication are medium risk
+- safe and low risk actions can auto-run unless step-by-step mode is enabled
+
+## Action Queue Fields
+
+- action type
+- target
+- reason
+- risk level
+- timestamp
+- result
+- screenshot before
+- screenshot after

package/ARCHITECTURE.md

@@ -0,0 +1,13 @@
+# Architecture
+
+See [docs/architecture.md](docs/architecture.md) for the detailed architecture document.
+
+## Current Layers
+
+- `python/agent_portal`: primary local runtime, Playwright process owner, and REST/WebSocket server scaffold
+- `apps/vscode-extension`: developer control panel for the running runtime
+- `connectors/`: integration entry points for ChatGPT tools, Claude MCP, Gemini, and generic APIs
+- `packages/core`: shared TypeScript-side control logic, policy, reporting, and contracts
+- `packages/sdk`: developer-facing TypeScript API
+- `packages/mcp-server`: tool-facing command surface
+- `apps/desktop`: local proving ground and runtime demo

package/CHANGELOG.md

@@ -0,0 +1,97 @@
+# Changelog
+
+All notable changes to Agent Portal will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.0.3] - 2026-06-26
+
+### Fixed
+- **Critical: ThreadingHTTPServer / Playwright greenlet conflict (#1)**
+  Replaced `ThreadingHTTPServer` with single-threaded `HTTPServer`. Playwright
+  sync greenlets are pinned to the thread that started the browser; the
+  threaded server routed subsequent requests to new threads, crashing every
+  browser action with `greenlet.error: cannot switch to a different thread`.
+
+- **High: Error handler AttributeError (#2)**
+  `fail_action()` accessed `error.message` but `AgentPortalError` exposes the
+  message via `str(error)`, not a `.message` attribute. This caused the error
+  handler itself to crash, swallowing the real error and returning an empty
+  HTTP reply. Changed to `str(error)`.
+
+- **Medium: Stale lock file and port reuse (#3)**
+  - Added PID liveness check (`os.kill(pid, 0)`) to `_ensure_single_instance()`:
+    a stale lock from a crashed runtime is now auto-removed instead of
+    blocking restart.
+  - Added `SO_REUSEADDR` to both the port-probe socket and the HTTP server
+    socket, eliminating the ~60 s `TIME_WAIT` delay after a crash.
+
+---
+
+## [0.1.0] - 2024-01-XX
+
+### Added
+- **Security Features**
+  - Input validation module (`validation.py`) with comprehensive validation for URLs, selectors, scripts, action types, risk levels, and configurations
+  - Rate limiting system (`rate_limit.py`) with configurable per-minute, per-hour, and burst limits
+  - Action throttling to prevent abuse of specific operations (execute, click, type, screenshot)
+  - Thread-safe metrics and telemetry system (`metrics.py`) for observability
+  - Automatic XSS pattern detection in selectors and URLs
+  - Dangerous protocol blocking (javascript:, data:, file:, vbscript:, etc.)
+  
+- **Runtime Improvements**
+  - Metrics collection for actions (total, completed, failed, blocked, approved, rejected)
+  - Browser operation metrics (navigations, screenshots, errors)
+  - Network metrics (requests, failures, console errors)
+  - Timer context manager for performance tracking
+  - Histogram statistics for value distributions
+  - Export metrics to JSON files
+
+- **Testing**
+  - Comprehensive test suite for validation module (29 tests)
+  - Test suite for rate limiting module
+  - Test suite for metrics collection module
+  - All tests pass successfully
+
+- **Enhancements**
+  - Better error handling with structured error messages
+  - Improved security posture with input sanitization
+  - Performance monitoring and observability
+  - Memory-safe sample limiting in metrics
+
+### Security
+- Added URL scheme validation to prevent dangerous protocols
+- Blocked JavaScript execution in page context from untrusted sources
+- Added selector injection protection
+- Implemented rate limiting to prevent DoS
+- Configurable action throttling for high-risk operations
+- Sanitization of text inputs to remove control characters
+
+### Performance
+- Optimized metrics storage with automatic cleanup
+- Sliding window rate limiting algorithm
+- Sample limits to prevent memory leaks
+- Efficient client-based rate tracking
+
+### Documentation
+- Added comprehensive docstrings for all new modules
+- Updated README with security features
+- Added inline documentation for validation rules
+
+---
+
+## [0.0.2] - Previous Release
+- Initial stable release with Python runtime
+- Browser control via Playwright
+- HTTP API server
+- VS Code extension
+- Basic action approval workflow
+- Report generation
+
+---
+
+## [0.0.1] - Initial Release
+- Project scaffolding
+- Basic runtime structure
+- Plugin system foundation

package/CLI.md

@@ -0,0 +1,38 @@
+# CLI
+
+The Python package installs the `agent-portal` command.
+
+## Commands
+
+```bash
+agent-portal start
+agent-portal stop
+agent-portal status
+agent-portal doctor
+agent-portal open http://localhost:3000
+agent-portal screenshot --label homepage
+agent-portal report
+agent-portal plugins list
+agent-portal plugins validate
+```
+
+## Global Options
+
+```bash
+agent-portal --json --host 127.0.0.1 --port 8765 status
+```
+
+Supported options:
+
+- `--json` for machine-readable output
+- `--host` to override the runtime host
+- `--port` to override the runtime port
+- `--verbose`
+- `--debug`
+- `--profile`
+
+## Notes
+
+- `start` writes a default `agent-portal.config.json` if one does not exist.
+- runtime-facing commands call the local HTTP runtime.
+- if the runtime is unavailable, the CLI returns a helpful error with a suggested start command.

package/CONTRIBUTING.md

@@ -0,0 +1,55 @@
+# Contributing
+
+Contributing to Agent Portal
+
+Thank you for your interest in Agent Portal.
+
+Agent Portal is proprietary software owned by Magnexis. At this time, public code contributions, forks, modified versions, redistribution, or derivative works are not permitted unless explicitly authorized in writing by Magnexis.
+
+Contribution Policy
+
+Magnexis is not currently accepting direct source code contributions from the public.
+
+You may not:
+
+Fork this repository for modification or redistribution.
+Submit modified versions of the software.
+Repackage or redistribute Agent Portal.
+Create derivative works based on Agent Portal.
+Use the Agent Portal source code in another project.
+Remove or alter copyright, license, or branding notices.
+What You Can Submit
+
+You may still help by submitting:
+
+Bug reports
+Feature requests
+Documentation corrections
+Security issue reports
+Compatibility feedback
+Usability feedback
+Bug Reports
+
+Please include:
+
+Operating system
+Agent Portal version
+Steps to reproduce
+Expected behavior
+Actual behavior
+Screenshots or logs, if helpful
+Security Reports
+
+Do not publicly disclose security vulnerabilities.
+
+Send security reports directly to Magnexis through the official contact method listed in the project documentation.
+
+Ownership
+
+Any feedback, ideas, reports, suggestions, or other submissions provided to Magnexis may be used by Magnexis to improve Agent Portal without restriction or obligation.
+
+License Reminder
+
+Agent Portal is not open-source software.
+
+All rights are reserved by Magnexis. Use, modification, distribution, sublicensing, hosting, reverse engineering, or creation of derivative works is prohibited without prior written permission from Magnexis.

package/INSTALLATION.md

@@ -0,0 +1,58 @@
+# Installation
+
+## Requirements
+
+- Node.js 20+
+- npm 10+
+- Python 3.10+
+- Playwright browser binaries installed with `npx playwright install chromium`
+
+## Setup
+
+1. Install dependencies:
+
+```bash
+npm install
+```
+
+2. Install Playwright Chromium:
+
+```bash
+npx playwright install chromium
+```
+
+3. Install the Python runtime package:
+
+```bash
+pip install -e ./python
+```
+
+4. Build the workspace:
+
+```bash
+npm run build
+```
+
+## VS Code Extension
+
+The VS Code extension is included in `apps/vscode-extension`.
+
+Build it with:
+
+```bash
+npm run build --workspace @agent-portal/vscode-extension
+```
+
+## Python Runtime
+
+Run a health check first:
+
+```bash
+agent-portal doctor
+```
+
+Start the runtime server with:
+
+```bash
+agent-portal start
+```

package/LICENSE

@@ -0,0 +1,60 @@
+Copyright (c) 2026 Magnexis
+
+All Rights Reserved.
+
+Agent Portal and all associated source code, binaries, documentation, assets,
+designs, interfaces, branding, logos, and related materials are the exclusive
+property of Magnexis.
+
+No person or entity is granted permission to copy, modify, merge, publish,
+distribute, sublicense, sell, lease, rent, host, reverse engineer, create
+derivative works from, or otherwise exploit any portion of the Software
+without the express prior written permission of Magnexis.
+
+Permitted Use
+
+Subject to compliance with this license, Magnexis grants the end user a
+limited, non-exclusive, non-transferable, revocable license to install and
+use the Software solely for its intended purposes.
+
+Restrictions
+
+You may not:
+
+Modify the Software.
+Create derivative works based on the Software.
+Redistribute the Software.
+Resell the Software.
+Repackage the Software.
+Host the Software as a service.
+Remove copyright notices.
+Reverse engineer, decompile, or disassemble the Software except where
+prohibited by applicable law.
+Use Magnexis trademarks, logos, branding, or product names without
+written authorization.
+
+Ownership
+
+All right, title, and interest in and to the Software remain exclusively with
+Magnexis. No ownership rights are transferred under this license.
+
+Termination
+
+This license automatically terminates if any provision is violated. Upon
+termination, all copies of the Software must be permanently removed and
+destroyed.
+
+Disclaimer of Warranty
+
+THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
+
+Limitation of Liability
+
+IN NO EVENT SHALL MAGNEXIS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
+LIABILITY ARISING FROM THE USE OF OR INABILITY TO USE THE SOFTWARE.
+
+Contact
+
+Licensing inquiries and permission requests should be directed to Magnexis.

package/PLUGIN_SYSTEM.md

@@ -0,0 +1,33 @@
+# Plugin System
+
+Agent Portal supports a manifest-driven plugin model.
+
+## Manifest Fields
+
+- `name`
+- `version`
+- `type`
+- `permissions`
+- `entryPoint`
+- `commands`
+- `settings`
+- `panels`
+- `lifecycleHooks`
+
+## Included Plugin Manifests
+
+- `plugins/agent-portal-vscode/plugin.json`
+- `plugins/agent-portal-browser/plugin.json`
+- `plugins/agent-portal-python/plugin.json`
+- `plugins/agent-portal-skills/plugin.json`
+
+## Connector Scaffolds
+
+- `connectors/chatgpt-tools`
+- `connectors/claude-mcp-server`
+- `connectors/gemini-connector`
+- `connectors/rest-websocket-api`
+
+## Validation
+
+The core runtime exports `validatePluginManifest()` for manifest checks.

package/PYTHON_SDK.md

@@ -0,0 +1,22 @@
+# Python Runtime And SDK
+
+The Python runtime package lives in `python/agent_portal`.
+
+## Current Status
+
+- package metadata is in `python/pyproject.toml`
+- runtime models are in `python/agent_portal/models.py`
+- runtime controller is in `python/agent_portal/runtime.py`
+- HTTP runtime server is in `python/agent_portal/server.py`
+- doctor checks are in `python/agent_portal/doctor.py`
+- CLI commands are in `python/agent_portal/cli.py`
+
+## Direction
+
+This package currently owns:
+
+- the local runtime
+- Playwright session ownership
+- browser automation and steering state
+- HTTP transport
+- report retrieval and connector access

package/QUICKSTART.md

@@ -0,0 +1,19 @@
+# Quickstart
+
+1. Run `npm install`
+2. Run `npx playwright install chromium`
+3. Run `pip install -e ./python`
+4. Run `agent-portal doctor`
+5. Start the runtime with `agent-portal start`
+6. Use `agent-portal open http://localhost:3000` or start the desktop demo with `npm run dev`
+7. Run `agent-portal screenshot --label smoke-test`
+8. Run `agent-portal report`
+9. Open the VS Code extension sidebar and use `Agent Portal: Connect To Running Runtime`
+
+## What You Should See
+
+- a local browser workflow opens
+- the agent types, clicks, scrolls, and captures evidence
+- a session report is generated
+- action queue, graph, and memory artifacts are persisted
+- the VS Code extension reads live runtime status from the Python runtime