Integrate Agents Core Web into the Core monorepo

.env.example

@@ -0,0 +1,54 @@
+# Server-side Vite development proxy target. This value is never exposed to
+# browser JavaScript. Keep the browser-facing API base at /v1.
+AGENTS_API_PROXY_TARGET=http://127.0.0.1:8091
+
+# Preferred: plaintext execution-tenant bearer file read only by the local
+# Vite server. If unset, Web also checks this conventional path automatically.
+AGENTS_API_PROXY_TOKEN_FILE=~/.parsar/agents-api/web-token
+
+# Alternative server-side value. Never use a VITE_ prefix, and do not set this
+# together with AGENTS_API_PROXY_TOKEN_FILE.
+# AGENTS_API_PROXY_TOKEN=
+
+# Public, non-secret opt-in for the reviewed Codex self_hosted Session profile.
+# Leave unset unless Core execution, its executor registry, and executor origin
+# are configured. This flag is presentation policy, not capability discovery.
+# AGENTS_CORE_WEB_SELF_HOSTED_SESSIONS=1
+
+# Public, non-secret opt-in for the operator-qualified basic Codex
+# openai_hosted Session profile. Leave unset unless Core was started with a
+# qualified managed Runtime provider. This flag does not probe runtime readiness.
+# AGENTS_CORE_WEB_OPENAI_HOSTED_SESSIONS=1
+
+# Public, non-secret opt-in for the complete Environment Files profile. Leave
+# unset for older Core revisions. Enable only after the connected Core has been
+# qualified for Files.list and managed Files.create; self_hosted reads use its
+# exact workspace_directory root.
+# AGENTS_CORE_WEB_ENVIRONMENT_FILES=1
+
+# Optional local-only Docker backend recovery guide shown in the connection
+# panel. Web renders copyable `docker start` and loopback health commands; it
+# never accesses the Docker socket or executes them. Values are compiled into
+# the browser bundle and must contain non-secret container names only.
+# AGENTS_CORE_WEB_DOCKER_BACKEND_GUIDE=1
+# AGENTS_CORE_WEB_DOCKER_DATABASE_CONTAINER=parsar-agents-api-web-smoke-db
+# AGENTS_CORE_WEB_DOCKER_API_CONTAINER=agents-core-web-api
+# AGENTS_CORE_WEB_DOCKER_DAEMON_CONTAINER=agents-core-web-daemon
+# AGENTS_CORE_WEB_DOCKER_CORE_PORT=8091
+
+# Optional local-only Docker connection recipe. This renders a copyable command;
+# it never gives the browser Docker access or reads the credential file. Every
+# value below is compiled into the browser bundle, so values must be non-secret.
+# Enable only for the matching operator-controlled local stack.
+# AGENTS_CORE_WEB_DOCKER_GUIDE=1
+# AGENTS_CORE_WEB_DOCKER_IMAGE=agents-core-web-executor:2b34ea46-codex-0.153.4
+# AGENTS_CORE_WEB_DOCKER_API_CONTAINER=agents-core-web-api
+# AGENTS_CORE_WEB_DOCKER_USER=501:20
+# AGENTS_CORE_WEB_DOCKER_CREDENTIALS_HOME_PATH=.parsar/agents-api-web-smoke/executor-key.json
+# AGENTS_CORE_WEB_DOCKER_RUNTIME_HOME_PATH=.parsar/agents-api-web-smoke/executors
+
+# Public, non-secret suggestions shown by the Create Agent model picker. The
+# first entry is the default unless VITE_AGENT_DEFAULT_MODEL overrides it. These
+# do not claim live availability; the connected runtime remains authoritative.
+VITE_AGENT_MODEL_PRESETS=gpt-6-astra,gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna,gpt-5.5,gpt-5.3-codex-spark
+VITE_AGENT_DEFAULT_MODEL=gpt-5.6-sol

.github/workflows/check.yml

@@ -54,6 +54,10 @@ jobs:
             ~/.parsar/cache/executor-cargo
             ~/.parsar/cache/executor-target
           key: core-executor-${{ runner.os }}-${{ hashFiles('packages/codex-executor/Cargo.lock') }}
+      - name: Install Web acceptance browser
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm exec playwright install --with-deps chrome
       - name: Check standalone repository
         env:
           PARSAR_AGENTS_API_TEST_DATABASE_URL: postgres://agents_api:core_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/parsar_agents_api_core_ci_tests?sslmode=disable

.gitignore

@@ -17,3 +17,8 @@ __pycache__/
 /state/
 /cache/
 /target/
+/playwright-report/
+/test-results/
+/.agents/
+/.issue-agent/
+/ISSUE_AGENT.md

AGENTS.md

@@ -4,8 +4,11 @@ Read [CONTRIBUTING.md](CONTRIBUTING.md) before changing code. Work in an isolate
 Git worktree and submit a PR. Keep product business code in the Parsar repository.
 
 Preserve the pinned public Agent API and documented extensions. Do not add product
-database dependencies or bypass Core execution ownership. Update architecture and
-generated contracts with changes. Run `make check` before reporting completion.
+database dependencies or bypass Core execution ownership. Core Web must consume
+that public contract through `packages/agents-client`; it must not reproduce Core
+execution truth or expose server-side credentials in the browser. Update
+architecture and generated contracts with changes. Run `make check` before
+reporting completion.
 
 After implementation and verification, request an independent blind review with
 only requirements, acceptance criteria, boundaries, repository path and baseline.

CONTRIBUTING.md

@@ -4,10 +4,11 @@
 
 This repository is the standalone execution substrate copied from Parsar at the
 revision in `provenance/source.json`. Keep the API, its migrations, protocol,
-execution daemon, runtime adapters, shared execution packages and build/test tools
-here. Product users, workspaces, model catalogs, business assets, web UI, product
-API and product migrations remain in Parsar. Do not import `server/`, `apps/web/`,
-`apps/parsar/`, product CLI/plugin packages or their deployment stack.
+execution daemon, runtime adapters, shared execution packages, the standalone Core
+Web console and build/test tools here. Product users, workspaces, model catalogs,
+business assets, the Parsar product Web, product API and product migrations remain
+in Parsar. Do not import `server/`, `apps/parsar/`, product CLI/plugin packages or
+their deployment stack.
 
 Preserve copied runtime and protocol behavior. Existing Go import paths, binary
 names and runtime environment variables remain unchanged for this copy; they do
@@ -33,7 +34,8 @@ split oversized components before extending them. Use `internal/obs/log` for log
 ## Required checks
 
 Run `make check` before completion. The standalone gate includes all daemon/shared
-Go tests, Core contract/client/service tests, a real dedicated PostgreSQL test
+Go tests, Core contract/client/service tests, Core Web and TypeScript client
+checks (including fixture-only Playwright acceptance), a real dedicated PostgreSQL test
 database, byte-for-byte sqlc regeneration checks, standalone API builds, Claude SDK
 tests and packaging, MiniMax companion checks, and Rust filesystem-helper
 tests/format/Clippy. It intentionally has no product Web/server/installer gates. The full gate fails when the database variable is missing.

Makefile

@@ -3,12 +3,12 @@ SQLC_VERSION ?= v1.29.0
 SQLC ?= go run github.com/sqlc-dev/sqlc/cmd/sqlc@$(SQLC_VERSION)
 SWAG_VERSION ?= v1.16.4
 
-.PHONY: help check check-database check-go check-sqlc sqlc-generate node-deps check-claude-sdk check-mcode-harness build-daemon build-agents-api build-agents-api-release check-agents-api docker-build-agents-api check-agents-api-container build-agents-executor check-agents-executor build-agents-runtime build-claude-runtime build-claude-sdk-runtime build-mcode-harness build-mcode-runtime
+.PHONY: help check check-database check-go check-sqlc sqlc-generate node-deps check-claude-sdk check-web check-mcode-harness build-daemon build-agents-api build-agents-api-release check-agents-api docker-build-agents-api check-agents-api-container build-agents-executor check-agents-executor build-agents-runtime build-claude-runtime build-claude-sdk-runtime build-mcode-harness build-mcode-runtime
 
 help:
 	@printf '%s\n' 'make build-agents-api  Build standalone Core commands' 'make build-daemon      Build the execution daemon' 'make check             Run Core, persistence and runtime checks' 'See README.md for runtime prerequisites and deployment.'
 
-check: check-database check-sqlc check-go check-agents-api check-claude-sdk check-mcode-harness check-agents-executor
+check: check-database check-sqlc check-go check-agents-api check-claude-sdk check-web check-mcode-harness check-agents-executor
 	@printf 'Parsar Core checks passed.\n'
 
 check-database:
@@ -62,6 +62,13 @@ check-claude-sdk: node-deps
 	pnpm --filter @parsar/claude-sdk-adapter test
 	$(MAKE) build-claude-sdk-runtime
 
+check-web: node-deps
+	pnpm typecheck
+	pnpm test:core-doctor
+	pnpm test:web
+	pnpm --filter @agents-core-web/web build
+	pnpm test:web:acceptance
+
 build-claude-sdk-runtime:
 	./scripts/build-claude-sdk-runtime.sh
 

README.md

@@ -7,9 +7,10 @@ The source repository retains both its product and its existing Core copy.
 
 This repository contains the API service, PostgreSQL migrations, pinned public
 protocol, execution daemon, the Docker provider, native Harness adapters,
-runtime image builders, client library, tests and operator documentation.
-It does not contain the Parsar web application, product backend, product database,
-business CLI or product deployment stack.
+runtime image builders, Go and TypeScript client libraries, the standalone Core
+Web console, tests and operator documentation. It does not contain the Parsar
+product application, product backend, product database, business CLI or product
+deployment stack.
 
 V1 user-managed deployments colocate our daemon, selected harness, tools and
 `/workspace`. Core manages Docker only; users provision, renew and destroy E2B
@@ -26,12 +27,16 @@ for tested deployments and remaining limits.
 - [Docker Runtime](services/agents-api/deploy/codex/README.md)
 - [Protocol coverage and known gaps](contracts/agents-api/README.md)
 - [Harness selection](contracts/agents-api/harness-selection.md)
+- [Core Web overview](docs/web/README.md)
+- [Core Web 中文说明](docs/web/README.zh-CN.md)
+- [Connect Core Web to Core](docs/web/core-connection.md)
 - [Contributor rules](CONTRIBUTING.md)
 - [Copy provenance and validation](provenance/README.md)
 
 ```sh
 make build-agents-api
 make build-daemon
+pnpm dev:web
 ```
 
 These builds require the Go version pinned in `go.mod`. Output goes under
@@ -40,6 +45,12 @@ Provision a dedicated Core PostgreSQL database and caller credentials using the
 operator guide before starting the service. Native execution also needs the
 appropriate Runtime image and provider configuration.
 
+Core Web lives in `apps/web` and talks only to the public `/v1/agents/**`
+HTTP/SSE contract through the TypeScript implementation in
+`packages/agents-client`. The Go client remains in
+`packages/agents-client/v1`; both clients live next to the contract they consume
+without coupling browser state to Core execution internals.
+
 The copied Go module/import paths, executable names and `PARSAR_*` environment
 variables intentionally retain their existing names. They resolve to source in
 this checkout, not a dependency on the Parsar product repository. This extraction
@@ -49,13 +60,19 @@ sources and packages remain pinned dependencies, not vendored binaries.
 ## Validate
 
 On Linux with Go, Node 22, pnpm 10.30.3, Python 3.9+, Rust 1.95.0 (including
-rustfmt/Clippy), OpenSSL development libraries and a dedicated test PostgreSQL:
+rustfmt/Clippy), OpenSSL development libraries, Chrome for Playwright, and a
+dedicated test PostgreSQL:
 
 ```sh
 export PARSAR_AGENTS_API_TEST_DATABASE_URL='postgres://.../parsar_agents_api_core_tests?sslmode=disable'
 make check
 ```
 
+Install the pinned Playwright browser on a fresh validation host with
+`pnpm exec playwright install --with-deps chrome`. Fixture acceptance uses
+loopback ports `18092` and `4174`; set `AGENTS_FIXTURE_PORT` and
+`AGENTS_WEB_PORT` to unused ports when either default is occupied.
+
 The full gate requires the test database rather than silently skipping persistence
 tests. Native model/provider fixtures remain explicit, credential-dependent
 acceptance checks; see the [coverage ledger](contracts/agents-api/README.md).