BUILD WITHOUT THE BLACK BOX

Setup & documentation

A practical guide to the TOXCI AGENT MVP, source code, and real execution.

The first-prompt workflow

1. Choose Website, React + Node, Python API, Android, or Desktop.
2. Describe your project. The real AI generates a plan and complete source files.
3. Websites run in an isolated, network-disabled preview. The agent executes a DOM/runtime smoke test and attempts up to two automatic repairs when errors are detected. Files are checkpointed individually so interrupted requests can be continued.
4. Save your edits, review the generated README, and export a project ZIP.
5. Connect the included runner for real framework tests and builds. Every execution needs your approval.

Run the platform and configure functions

# Frontend
npm install
npm run dev
npm run build

# Reviewed images on a dedicated Docker host
docker pull node:22-bookworm-slim
docker pull python:3.12-slim

# GenMB backend Secrets
# TOXCI_DOCKER_URL: authenticated HTTPS Docker Engine proxy
# TOXCI_DOCKER_TOKEN: proxy bearer token

AI and realtime use the injected GenMB SDK directly. Backend routes run as GenMB Python functions, not as a Node HTTP server. Frontend-only standalone hosting does not supply the GenMB runtime; publish the app in GenMB to use these services.

Set the dedicated Docker proxy URL and token in backend Secrets, then check the connection in Runner & settings while signed in as the app owner. Docker images must already exist on that host. Configure TOXCI_FLUTTER_IMAGE for APK/AAB or TOXCI_ELECTRON_IMAGE for desktop packages. GenMB functions do not run a Docker daemon or access your browser's localhost. Long native builds are subject to the function runtime deadline; a timeout never counts as success.

Deploy your projects

For static websites, a GenMB function submits a ZIP to a preconfigured Netlify project. Set NETLIFY_TOKEN and NETLIFY_SITE_ID only in backend Secrets. For React projects, first run node-build to produce site.zip. Deploy project asks for approval before overwriting production or using a potentially paid service.

Submission is not proof of publication. Inspect the returned job in your Netlify dashboard. Node and Python backends, databases and realtime services need their own hosting setup, documented in each generated project's README.

What is—and isn't—connected

Real AI generation, realtime workspace events, persistent local source files, editing, ZIP import/export, and browser smoke tests are available in this workspace.

Native commands run through owner-checked GenMB functions after you configure a dedicated HTTPS Docker Engine proxy. Local Docker hosts need a secure network tunnel reachable by the functions. Android builds require a Flutter/Android SDK image; release signing is a separate owner-managed step. Desktop packaging requires a compatible Electron image.

Account sign-in uses GenMB Google/email authentication. Account cloud backups use the private built-in key-value store; local backups remain in IndexedDB. Demo phone OTP never grants account access. Production SMS verifies phone possession separately using configured Twilio credentials. Automatic infrastructure provisioning and arbitrary host terminals are not supplied; no purchases occur without approval.

Live Server, accounts & diagnostics

Run Project offers a network-disabled HTML browser runtime with Start, Stop, Restart and captured console output. Native local HTTP execution requires exporting source and manually following the generated README on your computer. React projects require installed dependencies and a dev script; use the actual localhost URL printed by Vite. Backend logic runs as GenMB functions, not a Node HTTP service; functions cannot host a persistent dev server. Browser lifecycle controls operate only the isolated HTML runtime. Localhost is never advertised as public hosting.

Account includes real Google, email/password, email OTP signup, magic links and password reset. Demo phone code 123456 sends no SMS and grants no privileges. Production SMS needs TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN and TWILIO_VERIFY_SERVICE_SID in editor Secrets and may cost money. It is separate from the GenMB account session.

Errors now include the original message and code in chat and the Error panel. The previous generic failure message discarded those details, so the historical incident cannot be conclusively diagnosed retroactively. Generation now uses a manifest and one raw file per AI call instead of one oversized JSON response. Missing quotas, permissions, credentials and runtime deadlines are surfaced, not called successful builds.

A relational database is a Pro feature. This app keeps cloud backups in built-in storage. Upgrade to Pro for a managed database, or connect your own Supabase project for free from the Database panel. Backend generation writes integration code and setup instructions; it does not automatically provision infrastructure.

Common questions

Are my files saved across devices?

Local backups use IndexedDB. Sign in, choose Save to cloud in Workspace, then Restore cloud projects in Projects on another device. Private cloud backups use the built-in key-value store, not a relational database. Export ZIPs for portable source backups.

What does a passed browser test mean?

The test loaded the generated index.html, observed DOM content, and captured immediate JavaScript errors and unhandled rejections. It does not prove all features work or that the code is secure.

Can the agent execute any shell command?

No. The runner exposes fixed recipes, not an arbitrary host shell. Generated package scripts still execute inside isolated containers and therefore require approval.

Where do AI and realtime run?

The hosted app calls the enabled GenMB AI and realtime SDKs directly. No separate Node model gateway or SSE server is needed, and no model key is shipped in the browser.