StatePort
Download

StatePort Desktop

Current Public Beta scope.

This is the boundary to rely on today: what is implemented in the Public Beta source, what it deliberately does not promise, and what remains unavailable or unverified.

Availability

Public Beta availability

  • macOS arm64 (DMG) — 1.0.0-beta.107
  • Windows x64 (EXE) — 1.0.0-beta.107
  • Linux x64 (DEB) — 1.0.0-beta.107

3 approved Public Beta installers are available for testing. Other platform and architecture packages remain unavailable until they are published.

Create

Create a State Card

Manual Capture

  1. Open the application in the StatePort-managed browser
  2. Reproduce the state you want to keep
  3. Capture supported page, browser, form, storage, and API evidence
  4. Stop and review before saving

Automated Test Capture

  1. Choose one supported CodeceptJS browser test
  2. Rerun it once under Capture
  3. Save a State Card only when the expected failure reproduces

CodeceptJS is the currently implemented test-runner integration. Playwright Test, Cypress, Selenium, Jest, Vitest, CI providers, and arbitrary runners are not integrated today, and StatePort is not a generic test runner. Availability follows the exact published Desktop artifacts listed above.

Agent-controlled Capture

  1. Confirm that the connected runtime advertises the complete Capture capability
  2. Check Capture permission and the separate automatic-save preference in Settings → Coding agents
  3. Use the managed Clean Session and bounded semantic actions; supplied login uses the protected credential route
  4. Stop into mandatory Review, confirm the symptom, then save or discard

Setup does not authorize a task. Capture is allowed by default when no preference is stored; explicit permission choices remain in Settings → Coding agents until changed. Task-scoped authorization covers necessary in-scope steps without repeated prompts, subject to permissions and host approvals. Supplied credentials remain local and excluded from ordinary Cards and tool responses. Agent Capture cannot use a Development Profile, retrieve arbitrary secrets, or use arbitrary JavaScript, browser debugging protocols, or coordinate scripting. Review and required local authentication flows remain mandatory.

Review before you save

  • Selected saved state or checkpoint
  • Recorded Journey coverage — full, partial, or unavailable
  • Manual barriers in the Journey
  • Replayable API exchanges
  • Browser console and page errors
  • Optional description with Observed / Expected context
  • Protected-value decisions and sharing readiness

Developer access

Work from the State Card against current code

One unified Reproduce screen: pick the current loopback/local target, a saved state or Recorded Journey, a Development Profile or Clean Session, whether DevTools start open, and optional per-run protected-value authorization — then Reproduce.

Captured source
Captured source opens the eligible saved page with matching captured HTTP material. It does not prove that current local code ran.
Local app
Local app uses your running local app, current code, and selected target. Separate local auth is required when the application needs it.
  • Reopen a selected saved state against current localhost and current code
  • Replay a full or partial Recorded Journey
  • Pause at a manual barrier, then resume the remaining automatic steps
  • Use a persistent StatePort-owned Development Profile for everyday work
  • Switch to a clean isolated browser session when a clean run matters
  • Start with browser DevTools open in interactive Desktop
  • Keep captured supporting HTTP responses controlled
  • Block an unmatched request instead of silently contacting the source environment; the saved-material attempt may continue and records the miss
  • Inspect Journey, console, network, application-state, and safety evidence
  • Create immutable supported response revisions and compare later runs where current behavior allows it
  • Reopen the same State Card after a restart

What the result means

  • Save does not run an automatic reproduction proof
  • A launched browser or completed process does not prove that the expected checkpoint was reached
  • Compare reports observed differences; it does not declare that the bug is fixed
  • A Clean Session result applies to that Card, revision, target, and allowed authentication — not every future environment

Handoff

Share one State Card

  1. The sender creates one encrypted temporary share
  2. The recipient opens the generic secure landing
  3. The recipient imports it locally without an account
  4. The recipient uses the imported State Card under current access rules
  • Ordinary shares exclude machine-local protected values and Development Profile or authentication state
  • The sender can copy and revoke the link
  • Shares expire
  • Receiving and importing is free
  • Opening or replaying the imported Card against current code requires Developer access
  • Expiry or revocation blocks a future link fetch; it does not delete a downloaded or imported copy
  • Sharing is atomic and one Card at a time

Team workspaces, persistent shared libraries, RBAC, organization policies, and seats are future capabilities — one-card sharing is not a Team workspace or cloud execution.

Sensitive data

What happens to sensitive values

Sensitive values are excluded by default.

If you choose to retain a protected value locally

  • A supported protected value can be retained only when you explicitly choose it
  • A retained value is stored through the OS-protected machine-local boundary and is available only on that device
  • Each reproduction run requires explicit authorization before a retained value is used
  • Ordinary sharing is unavailable while a reproduction still requires retained protected data

If you discard it

  • Discard a protected value to remove it from the local protected reference path
  • The Journey gains a manual barrier for the missing step
  • Ordinary credential-free Share becomes available when no other blocker remains

If you explicitly send an eligible protected Persona

  • An eligible authenticated session can be sent only as a separately encrypted Protected Persona after explicit sender selection and confirmation
  • The recipient can review safe scope and expiry information, then accept into recipient-local protected storage or keep the Card only
  • Production, customer, and payment contexts keep elevated warnings and policy controls; availability still depends on the installed build

Boundary

Capability boundaries

Generic external surfaces

When a dependency is missing, the unmatched request is blocked and recorded. A saved-material attempt may continue its actions, but a failed action or wrong state still fails. The Card is Partial or Unsupported when retained evidence says a required capability is missing; StatePort does not silently fall back to the live provider or source system.

Anti-bot protected sites

  • Cloudflare, Turnstile, and other anti-bot or CAPTCHA-protected sites may not complete verification inside the managed Capture browser
  • StatePort does not solve or bypass anti-bot controls

Data and environment boundary

  • Database snapshots
  • Server-memory snapshots
  • Arbitrary backend virtualization
  • Production-environment cloning
  • Universal reproduction of every app and protocol

Deferred product surfaces

  • Team workspace and shared organization library
  • Customer Capture SDK
  • Browser-extension capture in your own browser
  • Remote Capture worker
  • Native direct CI-provider integration
  • Runner integrations beyond CodeceptJS
  • Autonomous root-cause detection or bug fixing
  • Universal or expanded Verified reproduction semantics

Before you rely on it

Confirm the edge case first

  • SSR-specific behavior
  • GraphQL subscriptions
  • SSE/WebSocket streaming
  • OAuth and external redirects
  • Shared or service workers
  • File upload and download
  • Large binary and media flows
  • DRM and WebRTC
  • Arbitrary browser extensions
  • Current bounded support covers safely captured HTTP resources and requests, redirects, CORS/preflight, iframe or popup documents, injected or open-shadow DOM, finite SSE, bounded WebSocket transcripts, bounded workers, and bounded non-DRM media when the Card's evidence admits them
  • Provider state outside captured HTTP material, dynamic or unbounded WebSocket and SSE behavior, shared or service workers, and large or unbounded media/upload/download flows still need explicit review
Contact support

Vocabulary

One saved boundary, named clearly.

Setup
The supported browser, application, and API conditions StatePort can save and reopen — not a machine, database, or production environment.
State Card
A named product record that points to a State Capsule and may declare a non-secret Auth Persona requirement.
State Capsule
The credential-free technical artifact containing the portable captured application state behind a State Card.