@allansantos-dev/smart-tool 0.9.5 → 0.9.7

package/router.py

@@ -1,235 +1,27 @@
 #!/usr/bin/env python3
-"""Roteador de tool calls do Smart Tool. V1 não tem classificador mecânico de "tem
-escopo": toda chamada de tool nativa casada pelo hook passa por aqui, que pergunta a um
-modelo pequeno se deve deixar passar ou redirecionar pra `smart_search`. Cada decisão é
-logada em `router-metrics.jsonl` pra orientar um classificador mais fino depois, com
-base em uso real — não numa suposição a priori.
-"""
+"""Routing of the native tool calls the PreToolUse hook matches (Grep, Glob, Bash, Read). Deterministic: calls that
+neither search nor read code, or that change files, run; accepted block patterns redirect; the rest follows
+redirect_rule. Searches the rule lets run are reviewed in the background by the router model, which may propose new
+block patterns (block_patterns). Every decision is logged in router-metrics.jsonl. Also holds the router-model
+helpers of the web search (tier order and result assessment)."""
 import contextvars
 import json
 import os
 import paths
 import re
+import sys
 import time
 
 import atomic_io
+import block_patterns
 import model_client
-import index_scope
-import indexer
+import redirect_rule
 import web_search_adapters
 
 # Per request: the daemon serves each hook call on its own thread, so a module global mixed up clients.
 CLIENT = contextvars.ContextVar("router_client", default=None)
 METRICS_PATH = os.path.join(paths.DATA_DIR, "router-metrics.jsonl")
 
-_SYSTEM_PROMPT = (
-    "You decide whether a tool call (native: Grep, Glob, Read, or Bash running a "
-    "search/read command such as grep/find/cat/ls -R/rg) should execute directly or "
-    "be redirected to an indexed semantic search (smart_search), because it is "
-    "potentially expensive or imprecise (e.g. no path filter, a large directory like "
-    "node_modules, an unscoped recursive command, or a question better answered by "
-    "semantic search than by regex/raw listing). For Bash, judge by the command's "
-    "content (the tool_input 'command' field): only consider redirecting commands "
-    "whose purpose is to search/read source code — never redirect commands with any "
-    "other effect (build, git, install, running a script, etc.), even if grep/cat/find "
-    "appear mid-pipeline.\n\n"
-    "The 'target' object is measured on disk right now — prefer it over any guess you "
-    "would make from the path string alone:\n"
-    "- target.files / target.truncated: files found under the target, ignoring the "
-    "directories listed in target.heavy_dirs and target.ignored_by_default. 'truncated': "
-    "true means the scan hit its budget, so the tree is big.\n"
-    "- target.heavy_dirs: dependency/build trees present under the target (node_modules, "
-    ".venv, dist...). A raw recursive search may reach them, unless the project's ignore "
-    "rules already exclude them.\n"
-    "- target.ignored_by_default: directories the native search tool skips on its own "
-    "(.git, __pycache__, dot-directories). Their presence is NOT a cost signal.\n"
-    "- target.scope: present when the target could not be derived from the call itself, "
-    "so the measurement describes the session directory and not what the command reads.\n"
-    "- target.outside_project: the target is outside the project root; no index covers "
-    "it, so never redirect.\n"
-    "- target.indexed: whether a semantic index already exists for this project. When it "
-    "is false, redirecting forces a cold index build inside the call (embedding every "
-    "file, tens of seconds) — only worth it when the search really is broad.\n"
-    "- target.missing: true when the path does not exist; never redirect those, the "
-    "native tool's own error is the useful answer.\n\n"
-    "Reading one specific file is never redirected. When in doubt, answer 'allow'. "
-    "Call submit_decision with your answer."
-)
-
-# Toda chamada de Grep/Glob/Read/Bash do agente espera por esta decisão, e o desfecho de
-# falha é `allow` — então esperar mais só atrasa o agente sem mudar o resultado. O valor
-# pressupõe `router_model` sem cadeia de raciocínio: um modelo "thinking" gasta mais de mil
-# tokens numa decisão binária e estoura isto sempre, abrindo o breaker e deixando o
-# roteamento desligado de forma permanente.
-DECISION_TIMEOUT_S = 8
-
-_SCAN_MAX_FILES = 4000
-_SCAN_MAX_SECONDS = 0.25
-# Percorridos pela tool nativa: a presença deles é sinal de custo de verdade.
-_HEAVY_DIR_NAMES = frozenset({
-    "node_modules", ".venv", "venv", "vendor", "target", "dist", "build", "out",
-    ".next", ".nuxt", ".gradle", "Pods",
-})
-# Grep/Glob do Claude Code são ripgrep, que já pula estes por padrão — listá-los junto
-# dos de cima superestimaria o custo e enviesaria a decisão pra `redirect`.
-_IGNORED_BY_DEFAULT_DIRS = frozenset({".git", "__pycache__", ".mypy_cache", ".pytest_cache"})
-_PATH_FIELDS = ("path", "file_path", "notebook_path")
-
-
-def _resolve_path(raw, cwd):
-    """Path do `tool_input` normalizado para o disco. Relativo resolve contra o `cwd` do
-    payload (não o do processo do hook, que é outro), e a forma MSYS `/c/...` — que o
-    agente emite com frequência em shell POSIX no Windows — é convertida, senão
-    `os.path.exists` responde `False` sobre um arquivo que existe."""
-    if not raw:
-        return None
-    path = raw.strip().replace("\\", "/")
-    msys = re.fullmatch(r"/([A-Za-z])(/.*)?", path)
-    if msys:
-        path = f"{msys.group(1).upper()}:{msys.group(2) or '/'}"
-    if not os.path.isabs(path) and cwd:
-        path = os.path.join(cwd, path)
-    return os.path.normpath(path)
-
-
-def _target_path(tool_input, cwd):
-    for field in _PATH_FIELDS:
-        value = tool_input.get(field)
-        if isinstance(value, str) and value.strip():
-            return value
-    return None
-
-
-def _command_paths(command, cwd):
-    """Paths que aparecem como argumento do comando e existem em disco. Sem isto, um
-    `grep -n foo arquivo.py` num monorepo seria medido como se varresse o repo todo."""
-    found = []
-    previous, base = "", cwd
-    for token in re.findall(r'"([^"]+)"|\'([^\']+)\'|(\S+)', command or ""):
-        raw = next((t for t in token if t), "")
-        after_cd, previous = previous.lower() in ("cd", "pushd", "set-location", "sl"), raw
-        if after_cd:
-            # The directory of a `cd` is where the command runs (base for what follows), not what it searches.
-            base = _resolve_path(raw, base) or base
-            continue
-        if not raw or raw.startswith("-"):
-            continue
-        resolved = _resolve_path(raw, base)
-        if resolved and os.path.exists(resolved):
-            found.append(resolved)
-    return found
-
-
-def _scan_target(path):
-    files = 0
-    heavy = set()
-    ignored = set()
-    truncated = False
-    deadline = time.monotonic() + _SCAN_MAX_SECONDS
-    for dirpath, dirnames, filenames in os.walk(path):
-        for name in list(dirnames):
-            if name in _HEAVY_DIR_NAMES:
-                heavy.add(name)
-                dirnames.remove(name)
-            elif name in _IGNORED_BY_DEFAULT_DIRS or name.startswith("."):
-                ignored.add(name)
-                dirnames.remove(name)
-        for _ in filenames:
-            files += 1
-            # Testar o orçamento só entre diretórios deixaria um único diretório com
-            # centenas de milhares de entradas passar por cima dele.
-            if files > _SCAN_MAX_FILES or time.monotonic() > deadline:
-                return {"files": files, "heavy_dirs": sorted(heavy),
-                        "ignored_by_default": sorted(ignored), "truncated": True}
-        if time.monotonic() > deadline:
-            truncated = True
-            break
-    return {"files": files, "heavy_dirs": sorted(heavy),
-            "ignored_by_default": sorted(ignored), "truncated": truncated}
-
-
-def _index_facts(project_root):
-    try:
-        # A identidade é compartilhada; índices legados continuam visíveis até a migração.
-        db = indexer.existing_db_path(project_root)
-        if db and os.path.isfile(db):
-            return {"indexed": True, "index_kib": os.path.getsize(db) // 1024}
-        return {"indexed": False}
-    except OSError:
-        return {"indexed": False}
-
-
-def _target_facts(tool_name, tool_input, cwd):
-    """Fatos medidos em disco sobre o alvo da chamada. Roda antes de toda tool call
-    casada pelo hook, então é limitado por tempo e por contagem, não desce em diretório
-    pesado e nunca sai da raiz do projeto. Sem isto o modelo julga custo só pelo texto do
-    path."""
-    raw = _target_path(tool_input, cwd)
-    if raw is None and tool_name == "Bash":
-        candidates = _command_paths(tool_input.get("command"), cwd)
-        if candidates:
-            raw = candidates[0]
-    scope_note = None
-    if raw is None:
-        raw, scope_note = cwd, "session cwd, not derived from the command"
-    path = _resolve_path(raw, cwd)
-    if not path:
-        return {}
-    facts = {"path": _display_path(path, cwd)}
-    if scope_note:
-        facts["scope"] = scope_note
-    # Fora da raiz do projeto nada é medido: varrer `C:\` ou o perfil do usuário antes de
-    # uma tool call custaria mais que a própria chamada, e a decisão seria `allow` igual.
-    if cwd and not index_scope._within_root(cwd, path):
-        facts["outside_project"] = True
-        return facts
-    try:
-        if os.path.isfile(path):
-            facts["is_file"] = True
-            facts["kib"] = os.path.getsize(path) // 1024
-            return facts
-        if not os.path.isdir(path):
-            # Só afirma ausência quando o path é inequívoco; adivinhar `missing` faria o
-            # pré-filtro liberar a chamada com um motivo falso no dataset de calibração.
-            facts["missing"] = True
-            return facts
-        facts.update(_scan_target(path))
-    except OSError as exc:
-        facts["scan_error"] = str(exc)
-        return facts
-    facts.update(_index_facts(cwd or path))
-    return facts
-
-
-def _display_path(path, cwd):
-    """Relativo ao projeto quando possível: o path absoluto carrega o nome do usuário do
-    Windows e vai inteiro no prompt enviado ao gateway."""
-    if cwd:
-        try:
-            rel = os.path.relpath(path, cwd)
-            if not rel.startswith(".."):
-                return rel.replace(os.sep, "/")
-        except ValueError:
-            pass
-    return os.path.basename(path) or path
-
-_DECISION_TOOL = {
-    "type": "function",
-    "function": {
-        "name": "submit_decision",
-        "description": "Submit the routing decision for this tool call.",
-        "parameters": {
-            "type": "object",
-            "properties": {
-                "decision": {"type": "string", "enum": ["allow", "redirect"]},
-                "reason": {"type": "string", "description": "Short justification, one sentence."},
-            },
-            "required": ["decision", "reason"],
-        },
-    },
-}
-
-
 METRICS_MAX_BYTES = 4 * 1024 * 1024
 _METRIC_MAX_FIELD_CHARS = 600
 _SECRET_ARG_RE = re.compile(
@@ -303,16 +95,27 @@ _SEARCH_VERB_RE = re.compile(
 )
 # Commands that read code or pages without a search verb at their start: their pipe filters still search content.
 _READ_PRODUCER_RE = re.compile(
-    r"\bgit\s+(grep|ls-files|show|log\s+-p|diff)\b|\b(curl|wget|iwr|invoke-webrequest)\b|\bgh\s+api\b|"
+    r"\bgit\s+(?:-C\s+\S+\s+)?(grep|ls-files|show|log\s+-p|diff)\b|\b(curl|wget|iwr|invoke-webrequest)\b|\bgh\s+api\b|"
     r"readFileSync|read_text\(|open\(",
     re.IGNORECASE,
 )
 _READ_TOOLS = frozenset({"Read", "NotebookRead"})
+# Commands that change files, the repository or dependencies are never redirected (smart_search cannot do the change).
+# Verbs are matched outside quoted strings, so a grep pattern like "pip install" is not one; file writes inside an
+# inline script (node -e, python -c) are matched anywhere.
+_QUOTED_RE = re.compile(r"""'[^']*'|"(?:\\.|[^"\\])*\"""")
+_MUTATING_VERB_RE = re.compile(
+    r"(?:^|[;&|(]|\s)(?:rm|mv|cp|mkdir|rmdir|touch|chmod|tee)\s"
+    r"|\bgit\s+(?:-C\s+\S+\s+)?(?:checkout|commit|add|push|pull|reset|stash|restore|rm|mv|merge|rebase|apply|tag|clean|"
+    r"clone|switch|cherry-pick)\b|\bsed\s+-i"
+    r"|\b(?:npm|pnpm|yarn|pip|uv)\s+(?:install|i|add|run|publish|ci|test)\b"
+)
+_FILE_WRITE_RE = re.compile(r"writeFileSync|writeFile\(|write_text\(|Set-Content|Out-File")
 
-BREAKER_PATH = os.path.join(os.path.dirname(METRICS_PATH), "router-breaker.json")
-BREAKER_FAILURES = 3
-BREAKER_COOLDOWN_S = 300
 
+def _mutates(command):
+    """Whether a shell command changes files, the repository or dependencies."""
+    return bool(_FILE_WRITE_RE.search(command) or _MUTATING_VERB_RE.search(_QUOTED_RE.sub("''", command)))
 
 def _mechanical_decision(tool_name, tool_input):
     """`(decisão, motivo)` quando a resposta não depende de julgamento nem de tocar o
@@ -324,7 +127,9 @@ def _mechanical_decision(tool_name, tool_input):
     `offset`/`limit` explícitos, onde só as linhas pedidas servem). Remedido em 2026-10-08
     sobre 2488 Bash que foram ao modelo (mediana 1,5 s, 7,8% redirecionados): ignorar os
     filtros depois de `|` (salvo quando o produtor lê código ou páginas) decide 439 deles
-    sem modelo (13,3 min em 58 h) e perde 1 dos 155 redirecionamentos."""
+    sem modelo (13,3 min em 58 h) e perde 1 dos 155 redirecionamentos. Remedido em 2026-10-09 sobre 3294 Bash decididos
+    pelo modelo: comandos que alteram arquivos, o repositório ou dependências foram 12 dos 283 redirecionamentos (todos
+    errados: o agente contornava o bloqueio) e 566 liberações."""
     if tool_name in _READ_TOOLS:
         return "allow", "Reading a specific file is never replaced by semantic search."
     if tool_name == "Bash":
@@ -333,144 +138,38 @@ def _mechanical_decision(tool_name, tool_input):
             return "allow", "Bash without a readable command."
         if not _SEARCH_VERB_RE.search(command) and not _READ_PRODUCER_RE.search(command):
             return "allow", "The command neither searches nor reads source code."
+        if _mutates(command):
+            return "allow", "The command changes files, the repository or dependencies."
     return None
 
 
-def _mechanical_decision_from_facts(facts):
-    if facts.get("missing"):
-        return "allow", "The path does not exist: the native tool's error is the useful answer."
-    if facts.get("is_file"):
-        return "allow", "Target is a single file, already scoped."
-    if facts.get("outside_project"):
-        return "allow", "Target is outside the project root: no index covers it."
-    return None
-
-
-def _breaker_state():
-    try:
-        with open(BREAKER_PATH, "r", encoding="utf-8") as f:
-            state = json.load(f)
-        return state if isinstance(state, dict) else {}
-    except (OSError, json.JSONDecodeError):
-        return {}
-
-
-def _breaker_write(state):
-    # tmp + replace: processos concorrentes gravam aqui (cada tool call é um processo
-    # novo), e um `open("w")` truncado no meio faz o leitor ver arquivo vazio — ou seja,
-    # breaker fechado justo quando ele deveria estar aberto. Sem `fsync`: perder a última
-    # escrita aqui é inofensivo e este caminho roda antes de cada tool call.
-    try:
-        os.makedirs(os.path.dirname(BREAKER_PATH), exist_ok=True)
-        tmp_path = f"{BREAKER_PATH}.tmp.{os.getpid()}"
-        with open(tmp_path, "w", encoding="utf-8") as f:
-            json.dump(state, f)
-        os.replace(tmp_path, BREAKER_PATH)
-    except OSError:
-        pass
-
-
-def breaker_open_until():
-    """Instante até quando o roteador está desligado por falhas recentes, ou 0.
-
-    Gateway lento é o pior caso de custo: sem isto, cada tool call paga o timeout inteiro
-    para terminar em `allow` de qualquer forma. O estado é compartilhado em arquivo porque
-    cada chamada do hook é um processo novo — nada sobrevive em memória."""
-    now = time.time()
-    try:
-        until = float(_breaker_state().get("open_until") or 0)
-    except (TypeError, ValueError):
-        return 0
-    # Teto pelo próprio cooldown: um salto de relógio (resume de VM, correção de fuso) no
-    # instante da gravação deixaria um `open_until` no futuro distante, e o roteador
-    # ficaria desligado pra sempre — sem erro em lugar nenhum, porque com o breaker aberto
-    # nunca há sucesso pra reabrir.
-    if until - now > BREAKER_COOLDOWN_S:
-        return 0
-    return until if now < until else 0
-
-
-def note_failure():
-    state = _breaker_state()
-    now = time.time()
-    # Janela de tempo em vez de contador: cada hook é um processo, e três falhas
-    # simultâneas leriam todas `failures=0` e gravariam `1`, nunca alcançando o limite.
-    # Falha de semana passada também não pode somar com a de hoje.
-    recent = [t for t in state.get("failures", []) if isinstance(t, (int, float)) and now - t < BREAKER_COOLDOWN_S]
-    recent.append(now)
-    state["failures"] = recent[-BREAKER_FAILURES:]
-    if len(recent) >= BREAKER_FAILURES:
-        state["open_until"] = now + BREAKER_COOLDOWN_S
-        state["failures"] = []
-    _breaker_write(state)
-
+def _log_error(message):
+    print(f"[smart-tool] {message}", file=sys.stderr, flush=True)
 
-def note_success():
-    state = _breaker_state()
-    if not state:
-        return
-    # Um cooldown aberto por outro processo sobrevive: quem leu o estado antes da abertura
-    # e teve sucesso não pode apagar a decisão de quem já viu o gateway falhar 3 vezes.
-    open_until = breaker_open_until()
-    _breaker_write({"open_until": open_until} if open_until else {})
 
-
-def decide(tool_name, tool_input, router_model, cwd=None):
+def decide(tool_name, tool_input, cwd=None):
+    """(decision, reason, target) for one hook call: decision is redirect or allow, target the folder the redirected
+    search would read (the session folder for an accepted pattern, None when allowed). An allowed search is queued for
+    the router model's review, which never delays the call."""
     safe_input = tool_input if isinstance(tool_input, dict) else {}
-
-    # Ordem importa: tudo que decide sem tocar disco vem antes do snapshot, e o breaker
-    # vem antes dele também — em cooldown o desfecho é `allow` de qualquer forma, então
-    # percorrer diretório ali seria I/O puro por nada.
     mechanical = _mechanical_decision(tool_name, safe_input)
     if mechanical:
         decision, reason = mechanical
         _log_decision(tool_name, tool_input, decision, reason, extra={"mechanical": True})
-        return decision, reason
-
-    if breaker_open_until():
-        reason = "Router in cooldown after recent gateway failures."
-        _log_decision(tool_name, tool_input, "allow", reason, extra={"breaker": True})
-        return "allow", reason
-
-    facts = _target_facts(tool_name, safe_input, cwd)
-    mechanical = _mechanical_decision_from_facts(facts)
-    if mechanical:
-        decision, reason = mechanical
-        _log_decision(tool_name, tool_input, decision, reason, extra={"mechanical": True})
-        return decision, reason
-
-    started = time.monotonic()
-    try:
-        # O orçamento inteiro do hook no host é de poucos segundos: obter token não pode
-        # consumir mais que a própria decisão.
-        token = model_client.get_token()
-        response = model_client.fetch(
-            "/v1/chat/completions", token, method="POST", timeout=DECISION_TIMEOUT_S,
-            body={
-                "model": router_model,
-                "messages": [
-                    {"role": "system", "content": _SYSTEM_PROMPT},
-                    {"role": "user", "content": json.dumps({
-                        # Mesma redação do log: a linha de comando também vai pro gateway.
-                        "tool_name": tool_name, "tool_input": _redacted_input(safe_input),
-                        "target": facts,
-                    }, ensure_ascii=False)},
-                ],
-                "tools": [_DECISION_TOOL],
-                "tool_choice": {"type": "function", "function": {"name": "submit_decision"}},
-                "temperature": 0,
-            },
-        )
-        tool_call = response["choices"][0]["message"]["tool_calls"][0]
-        args = json.loads(tool_call["function"]["arguments"])
-    except Exception:
-        note_failure()
-        raise
-    note_success()
-    decision = args.get("decision", "allow")
-    reason = args.get("reason", "")
-    _log_decision(tool_name, tool_input, decision, reason, extra={"ms": round((time.monotonic() - started) * 1000)})
-    return decision, reason
+        return decision, reason, None
+    learned = block_patterns.matching(tool_name, safe_input)
+    if learned:
+        reason = f"accepted block pattern: {learned['reason']}"
+        _log_decision(tool_name, tool_input, "redirect", reason, extra={"pattern": learned["id"]})
+        return "redirect", reason, cwd
+    decision, target, reason = redirect_rule.decide(tool_name, safe_input, cwd)
+    _log_decision(tool_name, tool_input, decision, reason, extra={"rule": True})
+    if decision == "allow":
+        try:
+            block_patterns.review_later(tool_name, safe_input, reason, METRICS_PATH, _redacted_input, _log_error)
+        except (OSError, ValueError) as exc:
+            _log_error(f"block pattern review not queued: {exc}")
+    return decision, reason, target
 
 
 def _web_search_tier_system_prompt():

package/setup_ui.py

@@ -19,6 +19,7 @@ import re
 import secrets
 
 import autostart
+import block_patterns
 import client_hooks
 import config
 import daemon_launcher
@@ -185,19 +186,36 @@ def handle_integration_get():
         duplicate_mode, duplicate_error = config.duplicate_mode(), ""
     except ValueError as exc:
         duplicate_mode, duplicate_error = "", str(exc)
+    try:
+        proposals_mode, proposals_error = config.pattern_proposals(), ""
+    except ValueError as exc:
+        proposals_mode, proposals_error = "", str(exc)
+    try:
+        stored, patterns_error = block_patterns.load(), ""
+    except ValueError as exc:
+        stored, patterns_error = block_patterns._empty(), str(exc)
     return {"daemon_url": setup_origin(), "clients": clients, "hook_mode": mode, "hook_mode_error": mode_error,
             "hook_modes": list(config.HOOK_MODES), "doc_mode": doc_mode, "doc_mode_error": doc_error,
             "doc_modes": list(config.DOC_MODES), "duplicate_mode": duplicate_mode,
-            "duplicate_mode_error": duplicate_error, "duplicate_modes": list(config.DUPLICATE_MODES)}
+            "duplicate_mode_error": duplicate_error, "duplicate_modes": list(config.DUPLICATE_MODES),
+            "pattern_proposals": proposals_mode, "pattern_proposals_error": proposals_error,
+            "block_patterns": {"proposals": stored["proposals"], "accepted": stored["accepted"],
+                               "rejected": len(stored["rejected"]), "error": patterns_error}}
 
 
 def handle_integration_save(body):
     """`hook_mode` sets redirect/advise/off for every client; `register_mcp` runs the client's CLI; hook in two steps:
     `preview` shows the exact change, `install` writes it (with backup)."""
-    if isinstance(body, dict) and body.get("action") in ("hook_mode", "doc_mode", "duplicate_mode"):
+    if isinstance(body, dict) and body.get("action") == "block_pattern":
+        try:
+            block_patterns.decide_proposal(str(body.get("id") or ""), body.get("decision"))
+        except (OSError, ValueError) as exc:
+            raise SetupError(str(exc))
+        return handle_integration_get()
+    if isinstance(body, dict) and body.get("action") in ("hook_mode", "doc_mode", "duplicate_mode", "pattern_proposals"):
         action = body["action"]
         allowed = {"hook_mode": config.HOOK_MODES, "doc_mode": config.DOC_MODES,
-                   "duplicate_mode": config.DUPLICATE_MODES}[action]
+                   "duplicate_mode": config.DUPLICATE_MODES, "pattern_proposals": config.PATTERN_PROPOSAL_MODES}[action]
         if body.get("mode") not in allowed:
             raise SetupError(f"Invalid mode: use {', '.join(allowed)}.")
         try:
@@ -593,6 +611,14 @@ _PAGE_TEMPLATE = """<!doctype html>
           </select>
           <span class="hint">Compares functions the edit writes with the indexed code: identical bodies, and near-identical ones with only local names changed. Never blocks.</span></div>
         <div class="actions"><button type="button" id="btn-save-duplicate-mode">Save duplicates</button></div>
+        <div class="field" style="margin-top:16px"><label for="sel-pattern-proposals">Block patterns proposed by a model</label>
+          <select id="sel-pattern-proposals">
+            <option value="on">On: searches the rule lets run are reviewed in the background and may become proposals (default)</option>
+            <option value="off">Off: no review</option>
+          </select>
+          <span class="hint">The hook decides with a fixed rule: content searches over a project folder go to smart_search. The scope model (else the router model) never delays a call: it reviews, afterwards, bulk reads the rule could not measure and proposes patterns, each checked against the logged calls. Nothing blocks until you accept it here.</span></div>
+        <div class="actions"><button type="button" id="btn-save-pattern-proposals">Save proposals setting</button></div>
+        <div id="patterns-list"></div>
         <div class="msg" id="agents-msg" role="status"></div>
         <div id="agents-list"></div>
       </section>
@@ -882,6 +908,9 @@ async function loadAgents() {
     if (data.hook_mode_error) setMsg("agents-msg", "error", data.hook_mode_error);
     if (data.doc_mode_error) setMsg("agents-msg", "error", data.doc_mode_error);
     if (data.duplicate_mode_error) setMsg("agents-msg", "error", data.duplicate_mode_error);
+    if (document.activeElement !== $("sel-pattern-proposals")) $("sel-pattern-proposals").value = data.pattern_proposals;
+    if (data.pattern_proposals_error) setMsg("agents-msg", "error", data.pattern_proposals_error);
+    renderPatterns(data.block_patterns);
     const list = $("agents-list");
     list.textContent = "";
     for (const item of data.clients) {
@@ -944,7 +973,59 @@ async function loadAgents() {
     setMsg("agents-msg", "error", "Agent status unavailable: " + error.message);
   }
 }
+function renderPatterns(patterns) {
+  const box = $("patterns-list");
+  box.textContent = "";
+  if (patterns.error) { const p = document.createElement("p"); p.className = "msg error"; p.textContent = patterns.error; box.appendChild(p); return; }
+  const groups = [["proposals", "Proposed", [["accept", "Accept"], ["reject", "Reject"]]], ["accepted", "Blocking", [["remove", "Remove"]]]];
+  for (const [key, title, actions] of groups) {
+    if (!patterns[key].length) continue;
+    const head = document.createElement("h3");
+    head.textContent = title + " (" + patterns[key].length + ")";
+    box.appendChild(head);
+    for (const item of patterns[key]) {
+      const row = document.createElement("div");
+      row.className = "provider";
+      const code = document.createElement("code");
+      code.textContent = item.tool + ": " + item.pattern;
+      const why = document.createElement("p");
+      const seen = item.history_total ? " Would have blocked " + item.history_matches + " of " + item.history_total + " logged " + item.tool + " calls." : "";
+      why.textContent = item.reason + seen;
+      const example = document.createElement("p");
+      example.className = "hint";
+      example.textContent = "Example: " + item.example;
+      row.append(code, why, example);
+      const buttons = document.createElement("div");
+      buttons.className = "actions";
+      for (const [decision, label] of actions) {
+        const button = document.createElement("button");
+        button.type = "button";
+        button.textContent = label;
+        button.addEventListener("click", async () => {
+          try {
+            renderPatterns((await post("/setup/integration", { action: "block_pattern", id: item.id, decision })).block_patterns);
+            setMsg("agents-msg", "ok", label + ": " + item.pattern);
+          } catch (error) {
+            setMsg("agents-msg", "error", error.message);
+          }
+        });
+        buttons.appendChild(button);
+      }
+      row.appendChild(buttons);
+      box.appendChild(row);
+    }
+  }
+  if (patterns.rejected) { const p = document.createElement("p"); p.className = "hint"; p.textContent = patterns.rejected + " rejected proposal(s) are not offered again."; box.appendChild(p); }
+}
 loadAgents();
+$("btn-save-pattern-proposals").addEventListener("click", async () => {
+  try {
+    await post("/setup/integration", { action: "pattern_proposals", mode: $("sel-pattern-proposals").value });
+    setMsg("agents-msg", "ok", "Proposals setting saved.");
+  } catch (error) {
+    setMsg("agents-msg", "error", error.message);
+  }
+});
 $("btn-save-doc-mode").addEventListener("click", async () => {
   try {
     await post("/setup/integration", { action: "doc_mode", mode: $("sel-doc-mode").value });