@allansantos-dev/smart-tool 0.9.8 → 0.9.10

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.9.10 - beta
+
+- Browser control for agents, on by default: registering smart-tool in Claude Code or Codex (and every update, for
+  clients where it is registered) also registers Microsoft's Playwright MCP (`@playwright/mcp` 0.0.83, pinned in
+  `web_adapters/node`) as the `playwright` server, driving the Chromium Smart Tool already installs, headless, with an
+  isolated in-memory profile. A probe first starts the server and opens a blank page the way an agent would; where
+  that fails (a corporate policy against remote debugging, a missing browser, the client CLI refusing) nothing is
+  registered, agents keep the read-only browsers of `web_fetch` and `web_search`, and the setup screen shows the
+  reason and a retry button instead of an error. A registration Smart Tool made is refreshed on update (Node and
+  Chromium paths change) and removed when the probe stops passing; a `playwright` server you registered is kept.
+- Block pattern proposals no longer stack one block per proposal (21 pending ones made the setup screen scroll
+  forever): one approval panel shows 8 per page, ordered by how many logged calls each would have blocked, with a
+  filter, a select-page toggle and bulk accept/reject in a single write (all ids or none); reason and example open on
+  demand, and blocking patterns sit in a collapsed list.
+
+## 0.9.9 - beta
+
+- `web_fetch` renders JavaScript pages with [Moli](https://github.com/lexmount/moli) first (a headless browser built
+  for agents: layout and paint only when a page needs them; 43 MB download, SHA-256 checked) and starts Chromium
+  through Crawl4AI only when Moli fails or comes back thin. On 21 pages HTTP could not read: Moli 1.6 s and 90 MB
+  peak (median) against 4.2 s and 581 MB; Moli read 14, Chromium 16, both together 17 (only Chromium read YouTube,
+  Google Maps and Airbnb). With several agent sessions reading at once, measured on N simultaneous rendered reads:
+  aggregate peak memory 448 → 35 MB (1), 1,788 → 194 MB (3), 2,901 → 634 MB (5), 4.4-4.7 GB → 1.0-1.4 GB (10), and
+  the median read time halved (10 at once: 5.0 s → 2.5 s). Pages only Chromium reads now take Moli's 1-4 s more.
+  The `web_fetch` metric records which engine read the page and Moli's error when it fell back.
+
 ## 0.9.8 - beta
 
 - An update could keep running the previous code: npm dates every file in the package 1985-10-26, the installer kept

package/NOTICE

@@ -15,6 +15,7 @@ Python packages (installation venv, from PyPI)
 
 Browser runtime (web_adapters/browser/.venv, from PyPI and the projects' download servers)
 - camoufox Python package (MIT) and the Camoufox browser, a Firefox fork (MPL-2.0), fetched by `camoufox fetch`
+- Moli (Apache-2.0 OR MIT), https://github.com/lexmount/moli: renders JavaScript pages for web_fetch; downloaded at install time from its GitHub release (SHA-256 checked), with its own license files
 - crawl4ai (Apache-2.0), https://github.com/unclecode/crawl4ai: page rendering is powered by Crawl4AI
 - Playwright (Apache-2.0) and the Chromium build it installs (BSD-style, see https://www.chromium.org)
 
@@ -24,6 +25,8 @@ Node runtime and packages (web_adapters/node, from nodejs.org and npm)
 - typescript (Apache-2.0)
 - java-parser (Apache-2.0)
 - @angular/compiler (MIT)
+- @playwright/mcp (Apache-2.0), https://github.com/microsoft/playwright-mcp: browser control for agents, registered as
+  the `playwright` MCP server over the Chromium above
 - their dependencies as pinned in web_adapters/node/package-lock.json (MIT, ISC, BSD and Apache-2.0)
 
 Web search sources

package/README.md

@@ -9,6 +9,9 @@ A local MCP server that gives coding agents (Claude Code, Codex) cheaper, sharpe
 | `web_fetch` | Reads a known URL and returns only the answer to your prompt, written by a small model; pages are cached for 24 h. Pages over 60,000 characters are not cut: the model reads the parts closest to the prompt (needs an `embedding_model`) |
 | `project_manage` | Registers and indexes projects, shows coverage, code maps, duplicated functions and index storage; `graph` with `symbol` tells what changing a function touches: callers, calls, the tests that reach it and the files that import it |
 
+Agents that must click, type or log in also get Microsoft's [Playwright MCP](https://github.com/microsoft/playwright-mcp),
+registered as the `playwright` server where this machine lets a browser be driven (see Set up, step 3).
+
 An optional hook routes the agent's native Grep/Glob/Read/Bash/WebSearch/WebFetch calls to these tools when they
 are cheaper, or just tells the agent what Smart Tool would do.
 
@@ -51,7 +54,18 @@ Open the setup screen from the tray icon ("Open settings") or at `http://127.0.0
    reasoning: web search tier order and result checks), the index classification model (also reviews block patterns) and the research model. Any id the gateway
    accepts works; the catalog is shown as suggestions.
 3. **Agents**: register the MCP server in Claude Code or Codex (runs their official `mcp add` command), install the
-   hook and choose its behavior:
+   hook and choose its behavior.
+
+   **Browser control** comes with the registration, and with every update for clients where smart-tool is registered:
+   the official Playwright MCP (pinned in `web_adapters/node`) is registered as the `playwright` server, driving the
+   Chromium Smart Tool installs, headless, with an isolated in-memory profile (no logins of yours) and its files in
+   `~/.smart-tool/data/playwright-mcp`. Before registering, Smart Tool starts that server and opens a blank page as an
+   agent would; where that fails (a corporate policy that forbids remote debugging, a missing browser) nothing is
+   registered, agents keep reading pages through `web_fetch`, and the setup screen shows the reason with a retry
+   button. A `playwright` server you registered yourself is never touched. Remove it with
+   `claude mcp remove playwright -s user` / `codex mcp remove playwright`.
+
+   The hook behaviors:
    - **Redirect** (default): the native tool is denied with the reason and the Smart Tool tool to use. The decision
      is a fixed rule, under a millisecond and the same every time: a content search over a project folder (`grep -r`,
      `rg`, `git grep`, the Grep tool on a folder) or over more than 20 listed files goes to `smart_search`; reading or
@@ -73,6 +87,10 @@ Open the setup screen from the tray icon ("Open settings") or at `http://127.0.0
    A documented function edited only in its body is not mentioned. `project_manage` with `action=docs` lists the
    public functions still without a docstring, for documenting a project that started without them.
 
+   **Block patterns waiting for you** are shown in one approval panel: 8 per page, the ones that would have blocked
+   the most logged calls first, a filter over pattern, reason and example, and bulk accept or reject of the selected
+   rows; each row opens to its reason and example.
+
    **Duplicate functions on edit** compares the functions an edit writes with the indexed code. **Warn** (default)
    tells the agent when a written function has the same body as an existing one (comments, spacing and docstrings
    ignored) or a near-identical one (only local names, strings and numbers changed), with the path and lines of the
@@ -146,4 +164,4 @@ user` / `codex mcp remove smart-tool`, then delete `%LOCALAPPDATA%\Programs\Smar
 
 Apache License 2.0. See `LICENSE` and `NOTICE` for third-party components.
 
-Page rendering is powered by [Crawl4AI](https://github.com/unclecode/crawl4ai) (Apache-2.0).
+Page rendering is powered by [Moli](https://github.com/lexmount/moli) (Apache-2.0 / MIT), with [Crawl4AI](https://github.com/unclecode/crawl4ai) (Apache-2.0) as its fallback.

package/block_patterns.py

@@ -247,20 +247,27 @@ def review_later(tool_name, tool_input, rule_reason, metrics_path, redact, log):
     return True
 
 
-def decide_proposal(entry_id, action):
-    """accept moves a proposal to accepted; reject moves it to rejected; remove deletes an accepted pattern."""
+def decide_proposals(entry_ids, action):
+    """accept moves proposals to accepted; reject moves them to rejected; remove deletes accepted patterns. All ids are
+    decided in one write, or none when any id is unknown (ValueError naming it)."""
+    if action not in ("accept", "reject", "remove"):
+        raise ValueError("Invalid action: use accept, reject or remove.")
+    wanted = list(dict.fromkeys(entry_ids))
+    if not wanted:
+        raise ValueError("No pattern selected.")
     with _LOCK:
         data = load()
         source = "accepted" if action == "remove" else "proposals"
-        entry = next((e for e in data[source] if e["id"] == entry_id), None)
-        if entry is None:
-            raise ValueError(f"No {source[:-1]} with id {entry_id}.")
-        data[source] = [e for e in data[source] if e["id"] != entry_id]
-        if action == "accept":
-            data["accepted"].append({**entry, "accepted_at": time.time()})
-        elif action == "reject":
-            data["rejected"].append({**entry, "rejected_by": "user"})
-        elif action != "remove":
-            raise ValueError("Invalid action: use accept, reject or remove.")
+        found = {e["id"]: e for e in data[source] if e["id"] in wanted}
+        missing = [entry_id for entry_id in wanted if entry_id not in found]
+        if missing:
+            raise ValueError(f"No {source[:-1]} with id {', '.join(missing)}.")
+        data[source] = [e for e in data[source] if e["id"] not in found]
+        now = time.time()
+        for entry_id in wanted:
+            if action == "accept":
+                data["accepted"].append({**found[entry_id], "accepted_at": now})
+            elif action == "reject":
+                data["rejected"].append({**found[entry_id], "rejected_by": "user"})
         _save(data)
         return data

package/browser_control.py

@@ -0,0 +1,202 @@
+"""Browser control for agents: the official Playwright MCP server, registered by default next to smart-tool.
+
+Smart Tool's own browsers only read pages (web_fetch, web_search). Agents that must click, type or log in get
+Microsoft's Playwright MCP (pinned in web_adapters/node), driving the Chromium Smart Tool already installs, in an
+isolated in-memory profile, headless. Before registering, a probe launches that browser through the server exactly
+as the agent would: machines whose policy forbids it (corporate IT blocking remote debugging, a missing browser)
+keep today's read-only behavior, and the reason is shown in the setup screen instead of an error. A server named
+`playwright` the user already registered is left untouched.
+"""
+import json
+import os
+import queue
+import subprocess
+import tempfile
+import threading
+import time
+
+import atomic_io
+import endpoint_sync
+import install_runtime
+import paths
+
+SERVER = "playwright"
+CLI = install_runtime.PLAYWRIGHT_MCP_CLI
+STATUS_PATH = os.path.join(paths.DATA_DIR, "browser-control.json")
+OUTPUT_DIR = os.path.join(paths.DATA_DIR, "playwright-mcp")
+OUTPUT_MAX_BYTES = 100 * 1024 * 1024
+PROBE_TIMEOUT_S = 60
+_CHROMIUM_PROBE = ("from playwright.sync_api import sync_playwright\n"
+                   "with sync_playwright() as p: print(p.chromium.executable_path)")
+
+
+def chromium_executable():
+    """The Chromium that `playwright install chromium` put in place for the browser venv; RuntimeError when absent."""
+    if not install_runtime.BROWSER_PYTHON.is_file():
+        raise RuntimeError(f"Browser runtime missing ({install_runtime.BROWSER_PYTHON}).")
+    done = subprocess.run([str(install_runtime.BROWSER_PYTHON), "-c", _CHROMIUM_PROBE], capture_output=True,
+                          text=True, encoding="utf-8", errors="replace", timeout=60,
+                          creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0))
+    path = (done.stdout.strip().splitlines() or [""])[-1]
+    if done.returncode or not os.path.isfile(path):
+        raise RuntimeError(f"Chromium not found: {(done.stderr or done.stdout).strip()[-300:] or path}")
+    return path
+
+
+def server_command():
+    """Absolute command line of the Playwright MCP server, as registered in the clients."""
+    node, _npm = install_runtime._node_commands()
+    if not node:
+        raise RuntimeError("Supported Node.js not found for Playwright MCP.")
+    if not CLI.is_file():
+        raise RuntimeError(f"Playwright MCP is not installed ({CLI}); reinstall Smart Tool.")
+    return [node, str(CLI), "--isolated", "--headless", "--executable-path", chromium_executable(),
+            "--output-dir", OUTPUT_DIR, "--output-max-size", str(OUTPUT_MAX_BYTES)]
+
+
+def probe(command, timeout=PROBE_TIMEOUT_S):
+    """Starts the server over stdio, opens about:blank and closes it, as an agent's first call would.
+    Returns None when the browser opened, else the reason it did not (a policy block, a crash, a timeout)."""
+    with tempfile.TemporaryDirectory(prefix="st-browser-probe-", ignore_cleanup_errors=True) as workdir:
+        return _probe(command, workdir, timeout)
+
+
+def _probe(command, workdir, timeout):
+    """probe() inside workdir, the server's working folder."""
+    flags = getattr(subprocess, "CREATE_NO_WINDOW", 0)
+    try:
+        proc = subprocess.Popen(command, cwd=workdir, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                                stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace",
+                                creationflags=flags)
+    except OSError as exc:
+        return f"server did not start: {exc}"
+    lines, errors = queue.Queue(), []
+    threading.Thread(target=lambda: [lines.put(line) for line in proc.stdout] + [lines.put(None)], daemon=True).start()
+    threading.Thread(target=lambda: errors.extend(proc.stderr), daemon=True).start()
+    deadline = time.monotonic() + timeout
+
+    def call(request_id, method, params):
+        proc.stdin.write(json.dumps({"jsonrpc": "2.0", "id": request_id, "method": method, "params": params}) + "\n")
+        proc.stdin.flush()
+        while True:
+            try:
+                line = lines.get(timeout=max(0.1, deadline - time.monotonic()))
+            except queue.Empty:
+                raise TimeoutError(f"no answer to {method} in {timeout}s") from None
+            if line is None:
+                raise RuntimeError(f"server exited: {''.join(errors).strip()[-300:] or 'no output'}")
+            try:
+                message = json.loads(line)
+            except ValueError:
+                continue
+            if message.get("id") == request_id:
+                if "error" in message:
+                    raise RuntimeError(str(message["error"].get("message") or message["error"])[:300])
+                return message["result"]
+
+    try:
+        call(1, "initialize", {"protocolVersion": "2025-06-18", "capabilities": {},
+                               "clientInfo": {"name": "smart-tool-probe", "version": "1"}})
+        proc.stdin.write(json.dumps({"jsonrpc": "2.0", "method": "notifications/initialized"}) + "\n")
+        result = call(2, "tools/call", {"name": "browser_navigate", "arguments": {"url": "about:blank"}})
+        if result.get("isError"):
+            text = " ".join(part.get("text", "") for part in result.get("content") or [])
+            return f"browser did not open: {' '.join(text.split())[:300]}"
+        call(3, "tools/call", {"name": "browser_close", "arguments": {}})
+        return None
+    except (OSError, RuntimeError, TimeoutError) as exc:
+        return str(exc)
+    finally:
+        if os.name == "nt":
+            subprocess.run(["taskkill", "/PID", str(proc.pid), "/T", "/F"], capture_output=True, creationflags=flags)
+        else:
+            proc.kill()
+        proc.wait(timeout=10)
+        for stream in (proc.stdin, proc.stdout, proc.stderr):
+            try:
+                stream.close()
+            except OSError:
+                pass
+
+
+def registered():
+    """Whether each client already has a `playwright` MCP server (registered by Smart Tool or by the user)."""
+    found = {"claude": False, "codex": False}
+    try:
+        with open(endpoint_sync.claude_json(), encoding="utf-8") as stream:
+            found["claude"] = SERVER in (json.load(stream).get("mcpServers") or {})
+    except (OSError, ValueError, AttributeError):
+        pass
+    try:
+        with open(os.path.join(os.path.expanduser("~"), ".codex", "config.toml"), encoding="utf-8") as stream:
+            found["codex"] = f"[mcp_servers.{SERVER}]" in stream.read()
+    except OSError:
+        pass
+    return found
+
+
+def register_command(client, command):
+    """Official CLI command that registers a stdio server (Claude Code: user scope, every project)."""
+    if client == "claude":
+        return ["claude", "mcp", "add", "--scope", "user", SERVER, "--", *command]
+    if client == "codex":
+        return ["codex", "mcp", "add", SERVER, "--", *command]
+    raise ValueError(f"Client without MCP registration: {client!r}")
+
+
+def remove_command(client):
+    """Official CLI command that removes the server registered by register_command."""
+    if client == "claude":
+        return ["claude", "mcp", "remove", SERVER, "--scope", "user"]
+    if client == "codex":
+        return ["codex", "mcp", "remove", SERVER]
+    raise ValueError(f"Client without MCP registration: {client!r}")
+
+
+def status():
+    """Last outcome per client: {"claude": {"state": "registered"|"unavailable"|"kept", "reason", "at"}, ...}."""
+    try:
+        with open(STATUS_PATH, encoding="utf-8") as stream:
+            data = json.load(stream)
+    except FileNotFoundError:
+        return {}
+    if not isinstance(data, dict):
+        raise ValueError(f"{STATUS_PATH} is not a browser control status file: fix or delete it.")
+    return data
+
+
+def _record(client, state, reason="", log=None):
+    if log and reason:
+        log(f"browser control {state} for {client}: {reason}")
+    data = status()
+    data[client] = {"state": state, "reason": reason, "at": time.time()}
+    os.makedirs(os.path.dirname(STATUS_PATH), exist_ok=True)
+    atomic_io.write_secret_text(STATUS_PATH, json.dumps(data, indent=1, ensure_ascii=False))
+    return data[client]
+
+
+def ensure(client, log=None):
+    """Registers Playwright MCP in the client, or refreshes the registration Smart Tool made before (Node, Chromium
+    and install paths change between versions). A `playwright` server the user registered is kept. When the browser
+    cannot be driven on this machine (probe failed, CLI refused) records `unavailable` with the reason, removes a
+    registration of ours that would no longer work and returns: agents keep the read-only browsers of web_fetch and
+    web_search. Only an unreadable status file raises (ValueError). log (optional) also gets the reason."""
+    ours = status().get(client, {}).get("state") == "registered"
+    if registered().get(client) and not ours:
+        return _record(client, "kept", "a playwright MCP server you registered is kept")
+    try:
+        command = server_command()
+        problem = probe(command)
+    except (OSError, RuntimeError, subprocess.SubprocessError) as exc:
+        problem = str(exc)
+    try:
+        if ours and registered().get(client):
+            endpoint_sync.run_cli(remove_command(client))
+        if problem:
+            return _record(client, "unavailable", problem[:300], log)
+        endpoint_sync.run_cli(register_command(client, command))
+    except RuntimeError as exc:
+        return _record(client, "unavailable", str(exc)[:300], log)
+    if not registered().get(client):
+        return _record(client, "unavailable", "the client CLI finished, but the server did not appear in its configuration", log)
+    return _record(client, "registered")

package/endpoint_sync.py

@@ -117,6 +117,15 @@ def register_command(client, base):
 def register(client, base):
     """Runs the client's own CLI (it owns its config file; ~/.claude.json is rewritten by Claude Code all the time)."""
     command = register_command(client, base)
+    run_cli(command)
+    if registrations().get(client) != f"{base}/mcp":
+        raise RuntimeError(f"'{' '.join(command)}' finished, but the registration did not appear in the client's configuration.")
+    return " ".join(command)
+
+
+def run_cli(command):
+    """Runs a client CLI command (claude, codex) found on PATH, killing its whole shim tree after REGISTER_TIMEOUT_S.
+    Raises RuntimeError with the command and the CLI's own message when it is missing, hangs or exits non-zero."""
     executable = shutil.which(command[0])
     if not executable:
         raise RuntimeError(f"CLI '{command[0]}' not found in Smart Tool's PATH. Register it manually: {' '.join(command)}")
@@ -140,9 +149,6 @@ def register(client, base):
     if proc.returncode != 0:
         detail = (stderr or stdout).strip()[-400:]
         raise RuntimeError(f"'{' '.join(command)}' failed (code {proc.returncode}): {detail}")
-    if registrations().get(client) != f"{base}/mcp":
-        raise RuntimeError(f"'{' '.join(command)}' finished, but the registration did not appear in the client's configuration.")
-    return " ".join(command)
 
 
 def known_port():

package/install.py

@@ -291,6 +291,25 @@ def verify(target, python):
         raise RuntimeError(f"The active daemon (pid {pid}) does not belong to this installation: {command.strip()[:200]}")
 
 
+def enable_browser_control(target, python):
+    """Registers Playwright MCP (browser_control.ensure) in each client where smart-tool is registered. Never fails the
+    installation: a machine that cannot drive a browser keeps the read-only browsers, and the outcome is printed."""
+    script = ("import json, browser_control, endpoint_sync; "
+              "print(json.dumps({c: browser_control.ensure(c) for c, url in endpoint_sync.registrations().items() if url}))")
+    try:
+        result = subprocess.run([str(python), "-c", script], cwd=target, capture_output=True, text=True,
+                                encoding="utf-8", errors="replace", timeout=300)
+        outcome = json.loads(result.stdout.strip().splitlines()[-1]) if not result.returncode else None
+    except (OSError, subprocess.TimeoutExpired, ValueError, IndexError) as exc:
+        result, outcome = None, f"{type(exc).__name__}: {exc}"
+    if not isinstance(outcome, dict):
+        detail = outcome or ((result.stderr or result.stdout).strip().splitlines() or ["no output"])[-1]
+        print(f"Browser control not set up: {detail}")
+        return
+    for client, state in outcome.items():
+        print(f"Browser control in {client}: {state['state']}" + (f" ({state['reason']})" if state.get("reason") else ""))
+
+
 MIN_PYTHON = (3, 11)
 
 
@@ -363,6 +382,8 @@ def main():
         shutil.rmtree(backup, ignore_errors=True)
         raise SystemExit(1)
     shutil.rmtree(backup)
+    if not args.no_start:
+        enable_browser_control(target, python)
     print("Smart Tool ready." if not args.no_start else "Files installed; daemon not restarted (--no-start).")
 
 

package/install_runtime.py

@@ -30,7 +30,17 @@ OPEN_WEBSEARCH_CLI = NODE_DIR / "node_modules" / "open-websearch" / "build" / "i
 TYPESCRIPT_PARSER = NODE_DIR / "node_modules" / "typescript" / "lib" / "typescript.js"
 JAVA_PARSER = NODE_DIR / 'node_modules' / 'java-parser' / 'src' / 'index.js'
 ANGULAR_PARSER = NODE_DIR / 'node_modules' / '@angular' / 'compiler' / 'fesm2022' / 'compiler.mjs'
+# Browser control for agents (browser_control.py): Microsoft's Playwright MCP over the Chromium installed below.
+PLAYWRIGHT_MCP_CLI = NODE_DIR / "node_modules" / "@playwright" / "mcp" / "cli.js"
 NODE_RUNTIME = NODE_DIR / ".node-runtime"
+# Moli renders the JavaScript pages web_fetch cannot read over HTTP; Chromium (Crawl4AI) stays as its fallback.
+# Measured on 2026-10-10 over 21 such pages: 1.6 s and 90 MB peak (median) against 4.2 s and 581 MB for Chromium.
+MOLI_VERSION = "1.1.15"
+MOLI_FOLDER = f"moli-v{MOLI_VERSION}-x86_64-pc-windows-msvc"
+MOLI_URL = f"https://github.com/lexmount/moli/releases/download/v{MOLI_VERSION}/moli-x86_64-pc-windows-msvc.zip"
+MOLI_SHA256 = "64c00ce02d6db8e1c22c55e88fbcaaf3e7517e930f24c25ff46a457b421040c8"
+MOLI_DIR = BROWSER_DIR / "moli"
+MOLI_EXE = MOLI_DIR / "moli.exe"
 
 
 def _node_supported(node):
@@ -58,6 +68,49 @@ def _node_commands():
     return (node, npm) if node and npm and _node_supported(node) else (None, None)
 
 
+def _download_verified(url, expected_sha256, path):
+    """Downloads url to path and fails when its SHA-256 differs from the published one."""
+    digest = hashlib.sha256()
+    with urllib.request.urlopen(url, timeout=60) as response, path.open("wb") as out:
+        while block := response.read(1024 * 1024):
+            digest.update(block)
+            out.write(block)
+    if digest.hexdigest().lower() != expected_sha256.lower():
+        raise RuntimeError(f"SHA-256 of {url} does not match the published checksum.")
+
+
+def _extract_folder(zip_path, top, destination):
+    """Extracts the files under the archive's single top folder into destination, refusing any other path."""
+    destination.mkdir()
+    with zipfile.ZipFile(zip_path) as zf:
+        for member in zf.infolist():
+            parts = Path(member.filename.replace("\\", "/")).parts
+            if parts == (top,) and member.is_dir():
+                continue
+            if len(parts) < 2 or parts[0] != top or ".." in parts:
+                raise RuntimeError(f"{zip_path.name} contains an unexpected path: {member.filename}")
+            target = destination.joinpath(*parts[1:])
+            if member.is_dir():
+                target.mkdir(parents=True, exist_ok=True)
+            else:
+                target.parent.mkdir(parents=True, exist_ok=True)
+                with zf.open(member) as source, target.open("wb") as out:
+                    shutil.copyfileobj(source, out)
+
+
+def _replace_folder(unpacked, final, temp_dir):
+    """Swaps final for unpacked, putting the previous folder back if the swap fails."""
+    previous = temp_dir / "previous"
+    if final.exists():
+        os.replace(final, previous)
+    try:
+        os.replace(unpacked, final)
+    except OSError:
+        if previous.exists() and not final.exists():
+            os.replace(previous, final)
+        raise
+
+
 def _install_node():
     """Baixa o Node LTS oficial e confere SHA-256 antes de extrair."""
     print("Downloading Node LTS for the Smart Tool web runtime...", flush=True)
@@ -79,43 +132,38 @@ def _install_node():
     with tempfile.TemporaryDirectory(prefix="node-setup-", dir=NODE_DIR) as temp:
         temp_dir = Path(temp)
         zip_path = temp_dir / archive
-        digest = hashlib.sha256()
-        with urllib.request.urlopen(base + archive, timeout=60) as response, zip_path.open("wb") as out:
-            while block := response.read(1024 * 1024):
-                digest.update(block)
-                out.write(block)
-        if digest.hexdigest().lower() != expected.lower():
-            raise RuntimeError("Node SHA-256 checksum does not match the official index.")
+        _download_verified(base + archive, expected, zip_path)
         unpacked = temp_dir / "runtime"
-        unpacked.mkdir()
-        with zipfile.ZipFile(zip_path) as zf:
-            for member in zf.infolist():
-                parts = Path(member.filename.replace("\\", "/")).parts
-                if parts == (f"node-{version}-win-x64",) and member.is_dir():
-                    continue
-                if len(parts) < 2 or parts[0] != f"node-{version}-win-x64" or ".." in parts:
-                    raise RuntimeError("Node archive contains an unexpected path.")
-                destination = unpacked.joinpath(*parts[1:])
-                if member.is_dir():
-                    destination.mkdir(parents=True, exist_ok=True)
-                else:
-                    destination.parent.mkdir(parents=True, exist_ok=True)
-                    with zf.open(member) as source, destination.open("wb") as target:
-                        shutil.copyfileobj(source, target)
+        _extract_folder(zip_path, f"node-{version}-win-x64", unpacked)
         if not (unpacked / "node.exe").is_file() or not (unpacked / "npm.cmd").is_file():
             raise RuntimeError("Node package does not contain the expected executables.")
-        previous = temp_dir / "previous-node-runtime"
-        if NODE_RUNTIME.exists():
-            os.replace(NODE_RUNTIME, previous)
-        try:
-            os.replace(unpacked, NODE_RUNTIME)
-        except OSError:
-            if previous.exists() and not NODE_RUNTIME.exists():
-                os.replace(previous, NODE_RUNTIME)
-            raise
+        _replace_folder(unpacked, NODE_RUNTIME, temp_dir)
     print(f"Node {version} installed inside Smart Tool.")
 
 
+def _moli_ready():
+    try:
+        return MOLI_EXE.is_file() and (MOLI_DIR / "VERSION").read_text(encoding="utf-8").strip() == MOLI_VERSION
+    except OSError:
+        return False
+
+
+def _install_moli():
+    """Downloads the pinned Moli release from GitHub, checks its SHA-256 and unpacks it into web_adapters/browser."""
+    print(f"Downloading Moli {MOLI_VERSION} (structured-first headless browser, 43 MB)...", flush=True)
+    BROWSER_DIR.mkdir(parents=True, exist_ok=True)
+    with tempfile.TemporaryDirectory(prefix="moli-setup-", dir=BROWSER_DIR) as temp:
+        temp_dir = Path(temp)
+        zip_path = temp_dir / "moli.zip"
+        _download_verified(MOLI_URL, MOLI_SHA256, zip_path)
+        unpacked = temp_dir / "moli"
+        _extract_folder(zip_path, MOLI_FOLDER, unpacked)
+        if not (unpacked / "moli.exe").is_file():
+            raise RuntimeError("The Moli package does not contain moli.exe.")
+        _replace_folder(unpacked, MOLI_DIR, temp_dir)
+    print(f"Moli {MOLI_VERSION} installed inside Smart Tool.")
+
+
 def _run(args, *, cwd=None, label="Web dependency", idle_s=600, stream=False, attempts=1):
     """Runs a step with UTF-8 output and closed stdin (a prompt fails at once instead of hanging); it is stopped only
     after idle_s without any output, and stream shows the output live."""
@@ -193,10 +241,12 @@ def _check():
         "typescript_parser": bool(node and TYPESCRIPT_PARSER.is_file()),
         "java_parser":bool(node and JAVA_PARSER.is_file()),
         "angular_parser":bool(node and ANGULAR_PARSER.is_file()),
+        "playwright_mcp": bool(node and PLAYWRIGHT_MCP_CLI.is_file()),
         "browser_python": BROWSER_PYTHON.is_file(),
         "browser_packages": False,
         "camoufox_browser": False,
         "chromium_browser": False,
+        "moli_browser": _moli_ready(),
     }
     if status["browser_python"]:
         try:
@@ -262,7 +312,8 @@ def install(reuse_browser_runtime=None):
     if not node or not npm:
         _install_node()
         node, npm = _node_commands()
-    if not all(path.is_file() for path in (OPEN_WEBSEARCH_CLI,TYPESCRIPT_PARSER,JAVA_PARSER,ANGULAR_PARSER)):
+    if not all(path.is_file() for path in (OPEN_WEBSEARCH_CLI, TYPESCRIPT_PARSER, JAVA_PARSER, ANGULAR_PARSER,
+                                               PLAYWRIGHT_MCP_CLI)):
         _run([npm, "ci", "--omit=dev", "--no-audit", "--no-fund"], cwd=NODE_DIR,
              label="Web adapters and code parser via npm", idle_s=300)
     if reuse_browser_runtime:
@@ -286,10 +337,12 @@ def install(reuse_browser_runtime=None):
              idle_s=180, stream=True, attempts=3)
         _run([str(BROWSER_PYTHON), "-m", "playwright", "install", "chromium"],
              label="Chromium browser", idle_s=180, stream=True, attempts=3)
+    if not _moli_ready():
+        _install_moli()
     status = _check()
     if not all(status.values()):
         raise RuntimeError(f"Incomplete web runtime: {status}")
-    print("Smart Tool runtime installed: Node, open-websearch, TypeScript, Java, Angular, Camoufox and Crawl4AI.")
+    print("Smart Tool runtime installed: Node, open-websearch, TypeScript, Java, Angular, Playwright MCP, Camoufox, Crawl4AI and Moli.")
 
 
 def main():

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allansantos-dev/smart-tool",
-  "version": "0.9.8",
+  "version": "0.9.10",
   "description": "Local MCP server that gives coding agents (Claude Code, Codex) cheaper, sharper tools than their built-in search. Windows.",
   "license": "Apache-2.0",
   "author": "Allan Santos",

package/setup_ui.py

@@ -20,6 +20,7 @@ import secrets
 
 import autostart
 import block_patterns
+import browser_control
 import client_hooks
 import config
 import daemon_launcher
@@ -168,12 +169,17 @@ def handle_local_models_save(body):
 
 def handle_integration_get():
     registered = endpoint_sync.registrations()
+    try:
+        browser, browser_error = browser_control.status(), ""
+    except ValueError as exc:
+        browser, browser_error = {}, str(exc)
     clients = []
     for key, info in AGENT_CLIENTS.items():
         spec, state = client_hooks.CLIENTS[key], client_hooks.status(info)
         clients.append({"client": key, "label": spec["label"], "mcp_url": registered.get(key), "hook": state["installed"],
                         "hook_error": state["error"], "file": spec["files"][0], "docs": spec["docs"],
-                        "register_command": " ".join(endpoint_sync.register_command(key, setup_origin()))})
+                        "register_command": " ".join(endpoint_sync.register_command(key, setup_origin())),
+                        "browser_control": browser.get(key), "browser_control_error": browser_error})
     try:
         mode, mode_error = config.hook_mode(), ""
     except ValueError as exc:
@@ -206,9 +212,12 @@ def handle_integration_get():
 def handle_integration_save(body):
     """`hook_mode` sets redirect/advise/off for every client; `register_mcp` runs the client's CLI; hook in two steps:
     `preview` shows the exact change, `install` writes it (with backup)."""
-    if isinstance(body, dict) and body.get("action") == "block_pattern":
+    if isinstance(body, dict) and body.get("action") == "block_patterns":
+        ids = body.get("ids")
+        if not isinstance(ids, list) or not all(isinstance(i, str) for i in ids):
+            raise SetupError("ids must be a list of pattern ids.")
         try:
-            block_patterns.decide_proposal(str(body.get("id") or ""), body.get("decision"))
+            block_patterns.decide_proposals(ids, body.get("decision"))
         except (OSError, ValueError) as exc:
             raise SetupError(str(exc))
         return handle_integration_get()
@@ -228,14 +237,18 @@ def handle_integration_save(body):
     info = AGENT_CLIENTS[body["client"]]
     try:
         if body.get("action") == "register_mcp":
-            return {"command": endpoint_sync.register(body["client"], setup_origin()), **handle_integration_get()}
+            command = endpoint_sync.register(body["client"], setup_origin())
+            return {"command": command, "browser_control": browser_control.ensure(body["client"]),
+                    **handle_integration_get()}
+        if body.get("action") == "browser_control":
+            return {"browser_control": browser_control.ensure(body["client"]), **handle_integration_get()}
         if body.get("action") == "preview":
             return client_hooks.preview(info)
         if body.get("action") == "install":
             return {**client_hooks.install(info, body.get("token"), True), **handle_integration_get()}
     except (ValueError, RuntimeError) as exc:
         raise SetupError(str(exc))
-    raise SetupError("Invalid action: use hook_mode, register_mcp, preview or install.")
+    raise SetupError("Invalid action: use hook_mode, register_mcp, browser_control, preview or install.")
 
 
 def handle_providers_get():
@@ -462,6 +475,29 @@ _PAGE_TEMPLATE = """<!doctype html>
   .provider-head { display: flex; justify-content: space-between; align-items: baseline; gap: 10px; margin-bottom: 8px; }
   .provider-head strong { font: 600 .98rem var(--display); letter-spacing: .02em; }
   .blocked { color: var(--muted); font-size: .88rem; border: 1px dashed var(--line); border-radius: 10px; padding: 14px 16px; }
+  .pattern-panel, .pattern-blocking { margin-top: 16px; border: 1px solid var(--line); border-radius: 10px; padding: 14px 16px; }
+  .pattern-head { display: flex; flex-direction: column; gap: 2px; }
+  .pattern-tools { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 10px; margin-top: 12px; }
+  .pattern-bulk { margin-top: 10px; }
+  .pattern-list { list-style: none; margin: 10px 0 0; padding: 0; border-top: 1px solid var(--line); }
+  .pattern-row { display: grid; grid-template-columns: auto minmax(0, 1fr); gap: 10px; align-items: start;
+    padding: 10px 0; border-bottom: 1px solid var(--line); }
+  .pattern-blocking .pattern-row { grid-template-columns: minmax(0, 1fr); }
+  .pattern-row input[type=checkbox] { margin-top: 6px; }
+  .pattern-body summary { display: flex; gap: 8px; align-items: baseline; cursor: pointer; min-width: 0; }
+  .pattern-tool { font: 600 .74rem var(--display); letter-spacing: .06em; text-transform: uppercase; color: var(--muted); flex: none; }
+  .pattern-code { font: .78rem/1.4 var(--mono); overflow-wrap: anywhere; min-width: 0; display: -webkit-box;
+    -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; }
+  .pattern-body[open] .pattern-code { -webkit-line-clamp: unset; }
+  .pattern-main { min-width: 0; }
+  .pattern-meta { display: flex; justify-content: space-between; align-items: center; gap: 10px; margin-top: 6px; flex-wrap: wrap; }
+  .pattern-detail { font-size: .84rem; padding: 4px 0 2px; }
+  .pattern-detail p { margin: 4px 0; }
+  .pattern-reach { font: .78rem var(--mono); color: var(--muted); white-space: nowrap; }
+  .pattern-actions { display: flex; gap: 6px; }
+  .pattern-actions button { padding: 4px 10px; font-size: .78rem; }
+  .pattern-pager { justify-content: space-between; }
+  .pattern-blocking > summary { cursor: pointer; font: 600 .9rem var(--display); }
 
   body:not(.ready) .station[data-live="1"] .wire::after { transform: scaleX(0); }
   @media (max-width: 900px) { .panels { grid-template-columns: minmax(0, 1fr); } }
@@ -897,6 +933,14 @@ $("btn-save-local-models").addEventListener("click", async () => {
   }
 });
 
+function browserText(item) {
+  if (item.browser_control_error) return "Browser control status unreadable: " + item.browser_control_error;
+  const state = item.browser_control || {};
+  if (state.state === "registered") return "Browser control on: Playwright MCP drives an isolated, headless Chromium";
+  if (state.state === "kept") return "Browser control: your own playwright MCP server is kept";
+  if (state.state === "unavailable") return "Browser control unavailable on this machine (" + state.reason + "); pages are still read by web_fetch";
+  return "Browser control is set up when the MCP is registered";
+}
 async function loadAgents() {
   try {
     const resp = await fetch("/setup/integration");
@@ -918,13 +962,28 @@ async function loadAgents() {
       row.className = "provider";
       const mcp = item.mcp_url ? "MCP registered: " + item.mcp_url : "smart-tool MCP not registered in this client";
       const hook = item.hook_error ? "Hook unreadable: " + item.hook_error : item.hook ? "Hook installed and up to date" : "Hook missing or outdated";
-      row.innerHTML = `<div class="provider-head"><strong></strong><span class="state"></span></div><p class="hint mcp"></p><p class="hint mono cmd"></p><p class="hint file"></p>
-        <div class="actions"><button type="button" class="register">Register MCP</button><button type="button" class="hook">Install or update hook</button></div>
+      row.innerHTML = `<div class="provider-head"><strong></strong><span class="state"></span></div><p class="hint mcp"></p><p class="hint browser"></p><p class="hint mono cmd"></p><p class="hint file"></p>
+        <div class="actions"><button type="button" class="register">Register MCP</button><button type="button" class="hook">Install or update hook</button><button type="button" class="quiet browser-retry">Set up browser control</button></div>
         <div class="plan" hidden><span class="hint plan-file"></span><pre class="code-preview"></pre>
           <div class="actions"><button type="button" class="confirm">Confirm and write</button><button type="button" class="quiet cancel">Cancel</button></div></div>`;
       row.querySelector("strong").textContent = item.label;
       row.querySelector(".state").textContent = hook;
       row.querySelector(".mcp").textContent = mcp;
+      row.querySelector(".browser").textContent = browserText(item);
+      const retry = row.querySelector(".browser-retry");
+      retry.hidden = !item.mcp_url || ["registered", "kept"].includes((item.browser_control || {}).state);
+      retry.addEventListener("click", async () => {
+        retry.disabled = true;
+        setMsg("agents-msg", "", "Checking whether agents can drive a browser here…");
+        try {
+          const result = await post("/setup/integration", { client: item.client, action: "browser_control" });
+          setMsg("agents-msg", "ok", item.label + ": " + browserText({ browser_control: result.browser_control }));
+          await loadAgents();
+        } catch (error) {
+          setMsg("agents-msg", "error", error.message);
+          retry.disabled = false;
+        }
+      });
       row.querySelector(".file").textContent = item.file;
       row.querySelector(".cmd").textContent = item.mcp_url ? "" : "Or in a terminal: " + item.register_command;
       const register = row.querySelector(".register");
@@ -934,7 +993,7 @@ async function loadAgents() {
         setMsg("agents-msg", "", "Registering the MCP in " + item.label + "…");
         try {
           const result = await post("/setup/integration", { client: item.client, action: "register_mcp" });
-          setMsg("agents-msg", "ok", "MCP registered with: " + result.command + ". Reconnect open sessions (/mcp).");
+          setMsg("agents-msg", "ok", "MCP registered with: " + result.command + ". " + browserText({ browser_control: result.browser_control }) + ". Reconnect open sessions (/mcp).");
           await loadAgents();
         } catch (error) {
           setMsg("agents-msg", "error", error.message);
@@ -973,49 +1032,163 @@ async function loadAgents() {
     setMsg("agents-msg", "error", "Agent status unavailable: " + error.message);
   }
 }
+const PATTERN_PAGE_SIZE = 8;
+const patternView = { page: 0, filter: "", sort: "impact", selected: new Set(), open: false };
+let lastPatterns = null;
+function patternPage(items, view) {
+  const needle = view.filter.trim().toLowerCase();
+  const matched = items.filter((item) => !needle || [item.tool, item.pattern, item.reason, item.example]
+    .some((text) => String(text || "").toLowerCase().includes(needle)));
+  const sorted = matched.slice().sort(view.sort === "newest"
+    ? (a, b) => (b.proposed_at || 0) - (a.proposed_at || 0)
+    : (a, b) => (b.history_matches || 0) - (a.history_matches || 0) || (b.proposed_at || 0) - (a.proposed_at || 0));
+  const pages = Math.max(1, Math.ceil(sorted.length / PATTERN_PAGE_SIZE));
+  const page = Math.min(Math.max(0, view.page), pages - 1);
+  return { rows: sorted.slice(page * PATTERN_PAGE_SIZE, (page + 1) * PATTERN_PAGE_SIZE), page, pages,
+           matched: sorted.length, total: items.length,
+           calls: items.reduce((sum, item) => sum + (item.history_matches || 0), 0) };
+}
+function patternEl(tag, className, text) {
+  const el = document.createElement(tag);
+  if (className) el.className = className;
+  if (text !== undefined) el.textContent = text;
+  return el;
+}
+async function decidePatterns(ids, decision, label) {
+  try {
+    const result = await post("/setup/integration", { action: "block_patterns", ids, decision });
+    for (const id of ids) patternView.selected.delete(id);
+    renderPatterns(result.block_patterns);
+    setMsg("agents-msg", "ok", label + ": " + ids.length + " pattern(s).");
+  } catch (error) {
+    setMsg("agents-msg", "error", error.message);
+  }
+}
+function patternRow(item, actions, selectable) {
+  const row = patternEl("li", "pattern-row");
+  if (selectable) {
+    const check = patternEl("input");
+    check.type = "checkbox";
+    check.checked = patternView.selected.has(item.id);
+    check.setAttribute("aria-label", "Select " + item.pattern);
+    check.addEventListener("change", () => {
+      if (check.checked) patternView.selected.add(item.id); else patternView.selected.delete(item.id);
+      renderPatterns(lastPatterns);
+    });
+    row.appendChild(check);
+  }
+  const body = patternEl("details", "pattern-body");
+  const summary = patternEl("summary");
+  const code = patternEl("code", "pattern-code", item.pattern);
+  code.title = item.pattern;
+  summary.append(patternEl("span", "pattern-tool", item.tool), code);
+  const detail = patternEl("div", "pattern-detail");
+  detail.append(patternEl("p", "", item.reason), patternEl("p", "hint mono", "Example: " + item.example),
+                patternEl("p", "hint mono", item.pattern));
+  body.append(summary, detail);
+  const reach = patternEl("span", "pattern-reach", item.history_total ? item.history_matches + " / " + item.history_total : "–");
+  reach.title = item.history_total ? "Would have blocked " + item.history_matches + " of " + item.history_total + " logged " + item.tool + " calls" : "No logged calls to compare";
+  const buttons = patternEl("span", "pattern-actions");
+  for (const [decision, label] of actions) {
+    const button = patternEl("button", "quiet", label);
+    button.type = "button";
+    button.addEventListener("click", () => decidePatterns([item.id], decision, label));
+    buttons.appendChild(button);
+  }
+  const meta = patternEl("div", "pattern-meta");
+  meta.append(reach, buttons);
+  const main = patternEl("div", "pattern-main");
+  main.append(body, meta);
+  row.appendChild(main);
+  return row;
+}
 function renderPatterns(patterns) {
+  lastPatterns = patterns;
   const box = $("patterns-list");
   box.textContent = "";
-  if (patterns.error) { const p = document.createElement("p"); p.className = "msg error"; p.textContent = patterns.error; box.appendChild(p); return; }
-  const groups = [["proposals", "Proposed", [["accept", "Accept"], ["reject", "Reject"]]], ["accepted", "Blocking", [["remove", "Remove"]]]];
-  for (const [key, title, actions] of groups) {
-    if (!patterns[key].length) continue;
-    const head = document.createElement("h3");
-    head.textContent = title + " (" + patterns[key].length + ")";
-    box.appendChild(head);
-    for (const item of patterns[key]) {
-      const row = document.createElement("div");
-      row.className = "provider";
-      const code = document.createElement("code");
-      code.textContent = item.tool + ": " + item.pattern;
-      const why = document.createElement("p");
-      const seen = item.history_total ? " Would have blocked " + item.history_matches + " of " + item.history_total + " logged " + item.tool + " calls." : "";
-      why.textContent = item.reason + seen;
-      const example = document.createElement("p");
-      example.className = "hint";
-      example.textContent = "Example: " + item.example;
-      row.append(code, why, example);
-      const buttons = document.createElement("div");
-      buttons.className = "actions";
-      for (const [decision, label] of actions) {
-        const button = document.createElement("button");
-        button.type = "button";
-        button.textContent = label;
-        button.addEventListener("click", async () => {
-          try {
-            renderPatterns((await post("/setup/integration", { action: "block_pattern", id: item.id, decision })).block_patterns);
-            setMsg("agents-msg", "ok", label + ": " + item.pattern);
-          } catch (error) {
-            setMsg("agents-msg", "error", error.message);
-          }
-        });
-        buttons.appendChild(button);
-      }
-      row.appendChild(buttons);
-      box.appendChild(row);
+  if (patterns.error) { box.appendChild(patternEl("p", "msg error", patterns.error)); return; }
+  const proposals = patterns.proposals;
+  const live = new Set(proposals.map((item) => item.id));
+  for (const id of [...patternView.selected]) if (!live.has(id)) patternView.selected.delete(id);
+  if (proposals.length) {
+    const view = patternPage(proposals, patternView);
+    patternView.page = view.page;
+    const panel = patternEl("div", "pattern-panel");
+    const head = patternEl("div", "pattern-head");
+    head.append(patternEl("strong", "", proposals.length + " proposed pattern(s) waiting"),
+                patternEl("span", "hint", "Together they would have blocked " + view.calls + " logged call(s). Open a row for its reason and example."));
+    const tools = patternEl("div", "pattern-tools");
+    const filter = patternEl("input");
+    filter.type = "text";
+    filter.placeholder = "Filter by pattern, reason or example";
+    filter.value = patternView.filter;
+    filter.setAttribute("aria-label", "Filter proposed patterns");
+    filter.addEventListener("input", () => {
+      patternView.filter = filter.value;
+      patternView.page = 0;
+      renderPatterns(lastPatterns);
+      const again = document.querySelector(".pattern-tools input[type=text]");
+      if (again) { again.focus(); again.setSelectionRange(again.value.length, again.value.length); }
+    });
+    const sort = patternEl("select");
+    sort.setAttribute("aria-label", "Order of proposed patterns");
+    for (const [value, label] of [["impact", "Most blocked calls first"], ["newest", "Newest first"]]) {
+      const option = patternEl("option", "", label);
+      option.value = value;
+      sort.appendChild(option);
     }
+    sort.value = patternView.sort;
+    sort.addEventListener("change", () => { patternView.sort = sort.value; patternView.page = 0; renderPatterns(lastPatterns); });
+    tools.append(filter, sort);
+    const bulk = patternEl("div", "actions pattern-bulk");
+    const pageIds = view.rows.map((item) => item.id);
+    const allOnPage = pageIds.length > 0 && pageIds.every((id) => patternView.selected.has(id));
+    const selectPage = patternEl("button", "quiet", allOnPage ? "Clear this page" : "Select this page");
+    selectPage.type = "button";
+    selectPage.disabled = !pageIds.length;
+    selectPage.addEventListener("click", () => {
+      for (const id of pageIds) if (allOnPage) patternView.selected.delete(id); else patternView.selected.add(id);
+      renderPatterns(lastPatterns);
+    });
+    const count = patternView.selected.size;
+    const accept = patternEl("button", "", "Accept selected (" + count + ")");
+    const reject = patternEl("button", "quiet", "Reject selected (" + count + ")");
+    for (const [button, decision, label] of [[accept, "accept", "Accepted"], [reject, "reject", "Rejected"]]) {
+      button.type = "button";
+      button.disabled = !count;
+      button.addEventListener("click", () => decidePatterns([...patternView.selected], decision, label));
+    }
+    bulk.append(selectPage, accept, reject);
+    const list = patternEl("ul", "pattern-list");
+    for (const item of view.rows) list.appendChild(patternRow(item, [["accept", "Accept"], ["reject", "Reject"]], true));
+    if (!view.rows.length) list.appendChild(patternEl("li", "hint", "No proposal matches the filter."));
+    const pager = patternEl("div", "actions pattern-pager");
+    const prev = patternEl("button", "quiet", "Previous");
+    const next = patternEl("button", "quiet", "Next");
+    prev.type = "button";
+    next.type = "button";
+    prev.disabled = view.page === 0;
+    next.disabled = view.page >= view.pages - 1;
+    prev.addEventListener("click", () => { patternView.page -= 1; renderPatterns(lastPatterns); });
+    next.addEventListener("click", () => { patternView.page += 1; renderPatterns(lastPatterns); });
+    const first = view.page * PATTERN_PAGE_SIZE;
+    const shown = view.matched ? (first + 1) + "–" + (first + view.rows.length) : "0";
+    const filtered = view.matched < view.total ? " (filtered from " + view.total + ")" : "";
+    pager.append(prev, patternEl("span", "hint", shown + " of " + view.matched + filtered + " · page " + (view.page + 1) + " of " + view.pages), next);
+    panel.append(head, tools, bulk, list, pager);
+    box.appendChild(panel);
+  }
+  if (patterns.accepted.length) {
+    const blocking = patternEl("details", "pattern-blocking");
+    blocking.open = patternView.open;
+    blocking.addEventListener("toggle", () => { patternView.open = blocking.open; });
+    blocking.appendChild(patternEl("summary", "", "Blocking patterns (" + patterns.accepted.length + ")"));
+    const list = patternEl("ul", "pattern-list");
+    for (const item of patterns.accepted) list.appendChild(patternRow(item, [["remove", "Remove"]], false));
+    blocking.appendChild(list);
+    box.appendChild(blocking);
   }
-  if (patterns.rejected) { const p = document.createElement("p"); p.className = "hint"; p.textContent = patterns.rejected + " rejected proposal(s) are not offered again."; box.appendChild(p); }
+  if (patterns.rejected) box.appendChild(patternEl("p", "hint", patterns.rejected + " rejected proposal(s) are not offered again."));
 }
 loadAgents();
 $("btn-save-pattern-proposals").addEventListener("click", async () => {

package/smart_tool_daemon.py

@@ -37,6 +37,7 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import capabilities
 import client_hooks
+import install_runtime
 import integration_metrics
 import config
 import freshness
@@ -3187,17 +3188,52 @@ def _tool_result(text, is_error=False):
 
 WEB_FETCH_TIMEOUT_S = 90
 WEB_FETCH_RENDER_TIMEOUT_S = 60
+MOLI_RENDER_TIMEOUT_S = 25
+# Engine of the last render on this request's thread: web_fetch.read_page calls _render_page on the handler's thread.
+_RENDER = threading.local()
 WEB_FETCH_VECTOR_ROOT = os.path.join(paths.DATA_DIR, "web-fetch")
 
 
+def _moli_markdown(url, timeout):
+    """Markdown of a JavaScript page rendered by Moli (layout and paint only when the page needs them)."""
+    if not install_runtime.MOLI_EXE.is_file():
+        raise RuntimeError(f"Moli is not installed ({install_runtime.MOLI_EXE}); reinstall Smart Tool.")
+    done = subprocess.run([str(install_runtime.MOLI_EXE), "fetch", "--dump", "markdown", url], capture_output=True,
+                          timeout=timeout, creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0))
+    if done.returncode:
+        raise RuntimeError(f"moli exited {done.returncode}: {done.stderr.decode('utf-8', 'replace').strip()[-300:]}")
+    return done.stdout.decode("utf-8", "replace")
+
+
 def _render_page(url, deadline):
+    """Moli first; Chromium through Crawl4AI only when Moli fails or comes back thin. Measured on 2026-10-10 over 21
+    pages HTTP could not read: Moli 1.6 s and 90 MB peak (median), Chromium 4.2 s and 581 MB; Moli read 14, Chromium
+    16, both together 17 (only Chromium read YouTube, Google Maps and Airbnb). The engine that answered goes to the
+    web_fetch metric through _RENDER."""
     left = deadline - time.monotonic()
     if left < 5:
         return ""
+    _RENDER.engine, _RENDER.moli_error = None, None
+    try:
+        markdown = _moli_markdown(url, min(MOLI_RENDER_TIMEOUT_S, left - 2))
+    except (OSError, RuntimeError, subprocess.TimeoutExpired) as exc:
+        markdown, _RENDER.moli_error = "", f"{type(exc).__name__}: {exc}"[:200]
+        _log(f"web_fetch Moli render failed, trying Chromium: {_RENDER.moli_error}")
+    if not web_fetch.thin(markdown):
+        _RENDER.engine = "moli"
+        return markdown
+    left = deadline - time.monotonic()
+    if left < 5:
+        return markdown
     raw = _run_search_script(CAMOUFOX_VENV_PYTHON, CRAWL4AI_SEARCH_SCRIPT, [url, "--max-pages", "1"],
                              min(WEB_FETCH_RENDER_TIMEOUT_S, left))
     pages = raw.get("pages") if isinstance(raw, dict) else None
-    return (pages[0].get("markdown") or "") if pages else ""
+    chromium = (pages[0].get("markdown") or "") if pages else ""
+    if len(chromium.strip()) > len(markdown.strip()):
+        _RENDER.engine = "chromium"
+        return chromium
+    _RENDER.engine = "moli"
+    return markdown
 
 
 def _web_fetch_embed(texts, deadline):
@@ -3243,6 +3279,7 @@ def _handle_web_fetch(arguments):
         if problem:
             raise RuntimeError(f"Gateway model unavailable ({problem}).")
         deadline = started + WEB_FETCH_TIMEOUT_S
+        _RENDER.engine, _RENDER.moli_error = None, None
         page = web_fetch.read_page(url, deadline, _render_page)
         selected, pieces = web_fetch.select(page["text"], prompt, lambda texts: _web_fetch_embed(texts, deadline))
         text = web_fetch.answer(config.load_config()["router_model"], prompt, {**page, "text": selected}, deadline)
@@ -3252,6 +3289,7 @@ def _handle_web_fetch(arguments):
         raise RuntimeError(f"web_fetch failed: {str(exc).rstrip('.')}. The native WebFetch is allowed for this URL for "
                            f"{web_fetch.FAILED_TTL_S // 60} min.") from None
     _metric("web_fetch", cached=page["cached"], rendered=page["rendered"], render_error=page.get("render_error"),
+            render_engine=_RENDER.engine if page["rendered"] else None, moli_error=_RENDER.moli_error,
             page_chars=page["chars"], read_chars=len(selected), pieces=pieces,
             answer_chars=len(text), elapsed_s=round(time.monotonic() - started, 2))
     origin = "from cache" if page["cached"] else "rendered in the browser" if page["rendered"] else "downloaded now"

package/version.py

@@ -1,7 +1,7 @@
 """Single source of the Smart Tool version and of the User-Agent sent to public APIs."""
 import re
 
-VERSION = "0.9.8"
+VERSION = "0.9.10"
 _CONTACT_RE = re.compile(r"^(?:[^\s@()<>;]+@[^\s@()<>;]+\.[^\s@()<>;]+|https?://[^\s()<>;]+)$")
 
 

package/web_adapters/node/package-lock.json

@@ -1,14 +1,15 @@
 {
   "name": "smart-tool-web-adapters",
-  "version": "1.0.0",
+  "version": "0.9.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "smart-tool-web-adapters",
-      "version": "1.0.0",
+      "version": "0.9.0",
       "dependencies": {
         "@angular/compiler": "20.3.0",
+        "@playwright/mcp": "0.0.83",
         "java-parser": "3.0.1",
         "open-websearch": "2.1.11",
         "typescript": "5.9.3"
@@ -588,6 +589,22 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/@playwright/mcp": {
+      "version": "0.0.83",
+      "resolved": "https://registry.npmjs.org/@playwright/mcp/-/mcp-0.0.83.tgz",
+      "integrity": "sha512-oNcl+Ae2/IAjhfPeP46BfIkSakfmprY+aOtkv5MjrQ4lPav4/yNtPhL0iq8SlIM90oApWgBDUxaNKvktazUKOg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.64.0-alpha-1790635538000",
+        "playwright-core": "1.64.0-alpha-1790635538000"
+      },
+      "bin": {
+        "playwright-mcp": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@types/cheerio": {
       "version": "0.22.35",
       "resolved": "https://registry.npmjs.org/@types/cheerio/-/cheerio-0.22.35.tgz",
@@ -2087,6 +2104,33 @@
         "node": ">=16.20.0"
       }
     },
+    "node_modules/playwright": {
+      "version": "1.64.0-alpha-1790635538000",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.64.0-alpha-1790635538000.tgz",
+      "integrity": "sha512-/5XDUMxpOd/9AojJtWDFIRV3EJZNQ0AwvK69wgt3CPzy8wTgiBG9pX45VfxtqtvIRGwfWzMhrvawNKreG69Snw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.64.0-alpha-1790635538000"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.64.0-alpha-1790635538000",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.64.0-alpha-1790635538000.tgz",
+      "integrity": "sha512-pNwaXirhXMRLaRQs4NQ18EpTdtDoFwyPH9FOaaDC7YXG4hpwE2xmwCic/1srbuExVQC7zT9LJSJpDBAru+Vo9A==",
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/proxy-addr": {
       "version": "2.0.8",
       "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",

package/web_adapters/node/package.json

@@ -5,6 +5,7 @@
   "description": "Adaptadores Node empacotados com a Smart Tool",
   "dependencies": {
     "@angular/compiler": "20.3.0",
+    "@playwright/mcp": "0.0.83",
     "java-parser": "3.0.1",
     "open-websearch": "2.1.11",
     "typescript": "5.9.3"