morpheus-cli 0.4.12 → 0.4.14

package/dist/channels/telegram.js

@@ -5,7 +5,6 @@ import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
 import { spawn } from 'child_process';
-import { convert } from 'telegram-markdown-v2';
 import { ConfigManager } from '../config/manager.js';
 import { DisplayManager } from '../runtime/display.js';
 import { createTelephonist } from '../runtime/telephonist.js';
@@ -21,8 +20,20 @@ import { Construtor } from '../runtime/tools/factory.js';
  * Truncates to Telegram's 4096-char hard limit.
  * Use for dynamic LLM/Oracle output.
  */
-function toMd(text) {
+// Cached dynamic import of telegram-markdown-v2 (ESM-safe, loaded once on first use)
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let _convertFn = null;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+async function getConvert() {
+    if (!_convertFn) {
+        const mod = await import('telegram-markdown-v2');
+        _convertFn = mod.convert;
+    }
+    return _convertFn;
+}
+async function toMd(text) {
     const MAX = 4096;
+    const convert = await getConvert();
     const converted = convert(text, 'escape');
     const safe = converted.length > MAX ? converted.slice(0, MAX - 3) + '\\.\\.\\.' : converted;
     return { text: safe, parse_mode: 'MarkdownV2' };
@@ -116,7 +127,7 @@ export class TelegramAdapter {
                     const response = await this.oracle.chat(text);
                     if (response) {
                         try {
-                            await ctx.reply(toMd(response).text, { parse_mode: 'MarkdownV2' });
+                            await ctx.reply((await toMd(response)).text, { parse_mode: 'MarkdownV2' });
                         }
                         catch {
                             await ctx.reply(response);
@@ -200,7 +211,7 @@ export class TelegramAdapter {
                     // }
                     if (response) {
                         try {
-                            await ctx.reply(toMd(response).text, { parse_mode: 'MarkdownV2' });
+                            await ctx.reply((await toMd(response)).text, { parse_mode: 'MarkdownV2' });
                         }
                         catch {
                             await ctx.reply(response);
@@ -264,7 +275,7 @@ export class TelegramAdapter {
                 const data = ctx.callbackQuery.data;
                 const sessionId = data.replace('ask_archive_session_', '');
                 // Fetch session title for better UX (optional, but nice) - for now just use ID
-                await ctx.reply(`⚠️ **ARCHIVE SESSION?**\n\nAre you sure you want to archive session \`${sessionId}\`?\n\nIt will be moved to long-term memory (SATI) and removed from the active list. This action cannot be easily undone via Telegram.`, {
+                await ctx.reply(`⚠️ *ARCHIVE SESSION?*\n\nAre you sure you want to archive session \`${escMd(sessionId)}\`?\n\nIt will be moved to long\\-term memory \\(SATI\\) and removed from the active list\\. This action cannot be easily undone via Telegram\\.`, {
                     parse_mode: 'MarkdownV2',
                     reply_markup: {
                         inline_keyboard: [
@@ -287,7 +298,7 @@ export class TelegramAdapter {
                     if (ctx.updateType === 'callback_query') {
                         ctx.deleteMessage().catch(() => { });
                     }
-                    await ctx.reply(`✅ Session \`${sessionId}\` has been archived and moved to long-term memory.`, { parse_mode: 'MarkdownV2' });
+                    await ctx.reply(`✅ Session \`${escMd(sessionId)}\` has been archived and moved to long\\-term memory\\.`, { parse_mode: 'MarkdownV2' });
                 }
                 catch (error) {
                     await ctx.answerCbQuery(`Error archiving: ${error.message}`, { show_alert: true });
@@ -297,7 +308,7 @@ export class TelegramAdapter {
             this.bot.action(/^ask_delete_session_/, async (ctx) => {
                 const data = ctx.callbackQuery.data;
                 const sessionId = data.replace('ask_delete_session_', '');
-                await ctx.reply(`🚫 **DELETE SESSION?**\n\nAre you sure you want to PERMANENTLY DELETE session \`${sessionId}\`?\n\nThis action is **IRREVERSIBLE**. All data will be lost.`, {
+                await ctx.reply(`🚫 *DELETE SESSION?*\n\nAre you sure you want to PERMANENTLY DELETE session \`${escMd(sessionId)}\`?\n\nThis action is *IRREVERSIBLE*\\. All data will be lost\\.`, {
                     parse_mode: 'MarkdownV2',
                     reply_markup: {
                         inline_keyboard: [
@@ -320,7 +331,7 @@ export class TelegramAdapter {
                     if (ctx.updateType === 'callback_query') {
                         ctx.deleteMessage().catch(() => { });
                     }
-                    await ctx.reply(`🗑️ Session \`${sessionId}\` has been permanently deleted.`, { parse_mode: 'MarkdownV2' });
+                    await ctx.reply(`🗑️ Session \`${escMd(sessionId)}\` has been permanently deleted\\.`, { parse_mode: 'MarkdownV2' });
                 }
                 catch (error) {
                     await ctx.answerCbQuery(`Error deleting: ${error.message}`, { show_alert: true });
@@ -418,7 +429,7 @@ export class TelegramAdapter {
             return;
         }
         // toMd() already truncates to 4096 chars (Telegram's hard limit)
-        const { text: mdText, parse_mode } = toMd(text);
+        const { text: mdText, parse_mode } = await toMd(text);
         for (const userId of allowedUsers) {
             try {
                 await this.bot.telegram.sendMessage(userId, mdText, { parse_mode });
@@ -506,7 +517,7 @@ export class TelegramAdapter {
     }
     async handleNewSessionCommand(ctx, user) {
         try {
-            await ctx.reply("Are you ready to start a new session? Please confirm.", {
+            await ctx.reply("Are you ready to start a new session\\? Please confirm\\.", {
                 parse_mode: 'MarkdownV2', reply_markup: {
                     inline_keyboard: [
                         [{ text: 'Yes, start new session', callback_data: 'confirm_new_session' }, { text: 'No, cancel', callback_data: 'cancel_new_session' }]
@@ -533,7 +544,7 @@ export class TelegramAdapter {
             const history = new SQLiteChatMessageHistory({ sessionId: "" });
             const sessions = await history.listSessions();
             if (sessions.length === 0) {
-                await ctx.reply('No active or paused sessions found.', { parse_mode: 'MarkdownV2' });
+                await ctx.reply('No active or paused sessions found\\.', { parse_mode: 'MarkdownV2' });
                 return;
             }
             let response = '*Sessions:*\n\n';
@@ -608,10 +619,10 @@ How can I assist you today?`;
         const nodeVersion = process.version;
         const majorVersion = parseInt(nodeVersion.replace('v', '').split('.')[0], 10);
         if (majorVersion >= 18) {
-            response += '✅ Node.js: ' + nodeVersion + '\n';
+            response += `✅ Node\\.js: ${escMd(nodeVersion)}\n`;
         }
         else {
-            response += '❌ Node.js: ' + nodeVersion + ' (Required: >=18)\n';
+            response += `❌ Node\\.js: ${escMd(nodeVersion)} \\(Required: >=18\\)\n`;
         }
         if (config) {
             response += '✅ Configuration: Valid\n';
@@ -633,10 +644,10 @@ How can I assist you today?`;
             const llmProvider = config.llm?.provider;
             if (llmProvider && llmProvider !== 'ollama') {
                 if (hasApiKey(llmProvider, config.llm?.api_key)) {
-                    response += `✅ Oracle API key (${llmProvider})\n`;
+                    response += `✅ Oracle API key \\(${escMd(llmProvider)}\\)\n`;
                 }
                 else {
-                    response += `❌ Oracle API key missing (${llmProvider})\n`;
+                    response += `❌ Oracle API key missing \\(${escMd(llmProvider)}\\)\n`;
                 }
             }
             // Sati
@@ -644,10 +655,10 @@ How can I assist you today?`;
             const satiProvider = sati?.provider || llmProvider;
             if (satiProvider && satiProvider !== 'ollama') {
                 if (hasApiKey(satiProvider, sati?.api_key ?? config.llm?.api_key)) {
-                    response += `✅ Sati API key (${satiProvider})\n`;
+                    response += `✅ Sati API key \\(${escMd(satiProvider)}\\)\n`;
                 }
                 else {
-                    response += `❌ Sati API key missing (${satiProvider})\n`;
+                    response += `❌ Sati API key missing \\(${escMd(satiProvider)}\\)\n`;
                 }
             }
             // Apoc
@@ -655,10 +666,10 @@ How can I assist you today?`;
             const apocProvider = apoc?.provider || llmProvider;
             if (apocProvider && apocProvider !== 'ollama') {
                 if (hasApiKey(apocProvider, apoc?.api_key ?? config.llm?.api_key)) {
-                    response += `✅ Apoc API key (${apocProvider})\n`;
+                    response += `✅ Apoc API key \\(${escMd(apocProvider)}\\)\n`;
                 }
                 else {
-                    response += `❌ Apoc API key missing (${apocProvider})\n`;
+                    response += `❌ Apoc API key missing \\(${escMd(apocProvider)}\\)\n`;
                 }
             }
             // Telegram token
@@ -745,7 +756,7 @@ How can I assist you today?`;
         let response = await this.oracle.chat(prompt);
         if (response) {
             try {
-                await ctx.reply(toMd(response).text, { parse_mode: 'MarkdownV2' });
+                await ctx.reply((await toMd(response)).text, { parse_mode: 'MarkdownV2' });
             }
             catch {
                 await ctx.reply(response);
@@ -754,12 +765,7 @@ How can I assist you today?`;
         // await ctx.reply(`Command not recognized. Type /help to see available commands.`);
     }
     async handleHelpCommand(ctx, user) {
-        const helpMessage = `
-*Available Commands:*
-
-${this.HELP_MESSAGE}
-
-How can I assist you today?`;
+        const helpMessage = `*Available Commands:*\n\n${this.HELP_MESSAGE}\n\nHow can I assist you today\\?`;
         await ctx.reply(helpMessage, { parse_mode: 'MarkdownV2' });
     }
     async handleZaionCommand(ctx, user) {
@@ -937,7 +943,7 @@ How can I assist you today?`;
                 Construtor.probe(),
             ]);
             if (servers.length === 0) {
-                await ctx.reply('*No MCP Servers Configured*\n\nThere are currently no MCP servers configured in the system.', { parse_mode: 'MarkdownV2' });
+                await ctx.reply('*No MCP Servers Configured*\n\nThere are currently no MCP servers configured in the system\\.', { parse_mode: 'MarkdownV2' });
                 return;
             }
             const probeMap = new Map(probeResults.map(r => [r.name, r]));
@@ -984,7 +990,7 @@ How can I assist you today?`;
         }
         catch (error) {
             this.display.log('Error listing MCP servers: ' + (error instanceof Error ? error.message : String(error)), { source: 'Telegram', level: 'error' });
-            await ctx.reply('An error occurred while retrieving the list of MCP servers. Please check the logs for more details.', { parse_mode: 'MarkdownV2' });
+            await ctx.reply('An error occurred while retrieving the list of MCP servers\\. Please check the logs for more details\\.', { parse_mode: 'MarkdownV2' });
         }
     }
 }

package/dist/config/paths.js

@@ -11,6 +11,7 @@ export const PATHS = {
     logs: LOGS_DIR,
     memory: path.join(MORPHEUS_ROOT, 'memory'),
     cache: path.join(MORPHEUS_ROOT, 'cache'),
+    browser: path.join(MORPHEUS_ROOT, 'cache', 'browser'),
     commands: path.join(MORPHEUS_ROOT, 'commands'),
     mcps: path.join(MORPHEUS_ROOT, 'mcps.json'),
 };

package/dist/devkit/index.js

@@ -7,4 +7,5 @@ import './tools/network.js';
 import './tools/git.js';
 import './tools/packages.js';
 import './tools/system.js';
+import './tools/browser.js';
 export { buildDevKit } from './registry.js';

package/dist/devkit/tools/browser.js

@@ -0,0 +1,388 @@
+import { tool } from '@langchain/core/tools';
+import { z } from 'zod';
+import { truncateOutput } from '../utils.js';
+import { registerToolFactory } from '../registry.js';
+import { PATHS } from '../../config/paths.js';
+// ─── Module-level browser singleton ────────────────────────────────────────
+let browserInstance = null;
+let pageInstance = null;
+let idleTimer = null;
+let installPromise = null;
+const IDLE_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Ensures Chromium is downloaded to ~/.morpheus/cache/browser/.
+ * Downloads only once; subsequent calls return the cached executablePath.
+ */
+async function ensureChromium() {
+    const { install, resolveBuildId, detectBrowserPlatform, computeExecutablePath, Browser: PBrowser, } = await import('@puppeteer/browsers');
+    const platform = detectBrowserPlatform();
+    const buildId = await resolveBuildId(PBrowser.CHROME, platform, 'stable');
+    // Check if already installed
+    const execPath = computeExecutablePath({
+        browser: PBrowser.CHROME,
+        buildId,
+        cacheDir: PATHS.browser,
+    });
+    const { default: fs } = await import('fs-extra');
+    if (await fs.pathExists(execPath)) {
+        return execPath;
+    }
+    // Download with progress indicator
+    process.stdout.write('[Morpheus] Installing Chromium for browser tools (first run, ~150MB)...\n');
+    const installed = await install({
+        browser: PBrowser.CHROME,
+        buildId,
+        cacheDir: PATHS.browser,
+        downloadProgressCallback: (downloaded, total) => {
+            const pct = total > 0 ? Math.round((downloaded / total) * 100) : 0;
+            process.stdout.write(`\r[Morpheus] Downloading Chromium: ${pct}%   `);
+        },
+    });
+    process.stdout.write('\n[Morpheus] Chromium installed successfully.\n');
+    return installed.executablePath;
+}
+/**
+ * Returns (or creates) the browser singleton, resetting the idle timer.
+ * Handles Chromium lazy-install with a lock to prevent concurrent downloads.
+ */
+async function acquireBrowser() {
+    const { launch } = await import('puppeteer-core');
+    const needsLaunch = !browserInstance || !browserInstance.connected;
+    if (needsLaunch) {
+        if (!installPromise) {
+            installPromise = ensureChromium().finally(() => {
+                installPromise = null;
+            });
+        }
+        const executablePath = await installPromise;
+        // Re-check after awaiting (another caller may have launched already)
+        if (!browserInstance || !browserInstance.connected) {
+            browserInstance = await launch({
+                executablePath,
+                headless: true,
+                args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-gpu'],
+            });
+            pageInstance = await browserInstance.newPage();
+        }
+    }
+    else if (!pageInstance || pageInstance.isClosed()) {
+        pageInstance = await browserInstance.newPage();
+    }
+    // Reset idle timeout
+    if (idleTimer)
+        clearTimeout(idleTimer);
+    idleTimer = setTimeout(async () => {
+        try {
+            await pageInstance?.close();
+        }
+        catch { /* ignore */ }
+        try {
+            await browserInstance?.close();
+        }
+        catch { /* ignore */ }
+        pageInstance = null;
+        browserInstance = null;
+        idleTimer = null;
+    }, IDLE_TIMEOUT_MS);
+    return { browser: browserInstance, page: pageInstance };
+}
+// Best-effort cleanup on process exit
+process.on('exit', () => {
+    try {
+        browserInstance?.process()?.kill();
+    }
+    catch { /* ignore */ }
+});
+// ─── Tool Definitions ───────────────────────────────────────────────────────
+const browserNavigateTool = tool(async ({ url, wait_until, timeout_ms, return_html }) => {
+    try {
+        const { page } = await acquireBrowser();
+        await page.goto(url, {
+            waitUntil: (wait_until ?? 'domcontentloaded'),
+            timeout: timeout_ms ?? 30_000,
+        });
+        const title = await page.title();
+        const text = await page.evaluate(() => document.body.innerText);
+        const result = {
+            success: true,
+            url,
+            current_url: page.url(),
+            title,
+            text: truncateOutput(text),
+        };
+        if (return_html) {
+            result.html = truncateOutput(await page.content());
+        }
+        return JSON.stringify(result);
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, url, error: err.message });
+    }
+}, {
+    name: 'browser_navigate',
+    description: 'Navigate to a URL in a real browser (executes JavaScript). Use instead of http_request for SPAs, JS-heavy pages, or sites requiring interaction. Returns page title and text content.',
+    schema: z.object({
+        url: z.string().describe('Full URL to navigate to (must include https://)'),
+        wait_until: z
+            .enum(['load', 'domcontentloaded', 'networkidle0', 'networkidle2'])
+            .optional()
+            .describe('Wait condition. Default: domcontentloaded. Use networkidle0 for SPAs.'),
+        timeout_ms: z.number().optional().describe('Navigation timeout in ms. Default: 30000'),
+        return_html: z
+            .boolean()
+            .optional()
+            .describe('Also return raw HTML in response. Default: false'),
+    }),
+});
+const browserGetDomTool = tool(async ({ selector, include_attributes }) => {
+    try {
+        const { page } = await acquireBrowser();
+        const includeAttrs = include_attributes ?? true;
+        const dom = await page.evaluate(({ sel, attrs }) => {
+            const root = sel
+                ? document.querySelector(sel)
+                : document.body;
+            if (!root)
+                return null;
+            const RELEVANT_ATTRS = [
+                'href', 'src', 'type', 'name', 'value',
+                'placeholder', 'action', 'id', 'role', 'aria-label',
+            ];
+            function serialize(el, depth) {
+                const hasChildren = el.children.length > 0;
+                const node = {
+                    tag: el.tagName.toLowerCase(),
+                };
+                if (el.id)
+                    node.id = el.id;
+                if (el.className)
+                    node.class = el.className;
+                if (!hasChildren) {
+                    const txt = el.textContent?.trim();
+                    if (txt)
+                        node.text = txt.slice(0, 120);
+                }
+                if (attrs && el.attributes.length > 0) {
+                    const attrMap = {};
+                    for (const attr of el.attributes) {
+                        if (RELEVANT_ATTRS.includes(attr.name)) {
+                            attrMap[attr.name] = attr.value;
+                        }
+                    }
+                    if (Object.keys(attrMap).length)
+                        node.attrs = attrMap;
+                }
+                if (depth < 6 && hasChildren) {
+                    node.children = Array.from(el.children)
+                        .slice(0, 40)
+                        .map((c) => serialize(c, depth + 1));
+                }
+                return node;
+            }
+            return serialize(root, 0);
+        }, { sel: selector ?? null, attrs: includeAttrs });
+        if (!dom) {
+            return JSON.stringify({ success: false, error: `Element not found: ${selector}` });
+        }
+        return JSON.stringify({ success: true, current_url: page.url(), dom: truncateOutput(JSON.stringify(dom, null, 2)) });
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, error: err.message });
+    }
+}, {
+    name: 'browser_get_dom',
+    description: 'Get a simplified DOM tree of the current page or a specific element. ' +
+        'ALWAYS call this BEFORE browser_click or browser_fill to inspect page structure and identify the correct CSS selectors. ' +
+        'Never guess selectors — analyze the DOM first.',
+    schema: z.object({
+        selector: z
+            .string()
+            .optional()
+            .describe('CSS selector to scope the DOM tree to. Omit to get the full body.'),
+        include_attributes: z
+            .boolean()
+            .optional()
+            .describe('Include relevant attributes (href, src, type, name, value, placeholder, role, aria-label). Default: true'),
+    }),
+});
+const browserClickTool = tool(async ({ selector, text, timeout_ms, wait_after_ms }) => {
+    try {
+        const { page } = await acquireBrowser();
+        if (!selector && !text) {
+            return JSON.stringify({ success: false, error: 'Provide either selector or text' });
+        }
+        const clickTimeout = timeout_ms ?? 10_000;
+        if (text) {
+            // Use Puppeteer pseudo-selector to find element by visible text
+            await page.locator(`::-p-text(${text})`).setTimeout(clickTimeout).click();
+        }
+        else {
+            await page.locator(selector).setTimeout(clickTimeout).click();
+        }
+        if (wait_after_ms) {
+            await new Promise((r) => setTimeout(r, wait_after_ms));
+        }
+        return JSON.stringify({
+            success: true,
+            current_url: page.url(),
+            title: await page.title(),
+        });
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, error: err.message });
+    }
+}, {
+    name: 'browser_click',
+    description: 'Click an element on the current browser page by CSS selector or visible text. ' +
+        'The page must already be loaded via browser_navigate. ' +
+        'Always inspect the DOM with browser_get_dom first to find the correct selector.',
+    schema: z.object({
+        selector: z
+            .string()
+            .optional()
+            .describe('CSS selector of the element to click (e.g. "button#submit", ".btn-login")'),
+        text: z
+            .string()
+            .optional()
+            .describe('Click element containing this visible text (alternative to selector)'),
+        timeout_ms: z
+            .number()
+            .optional()
+            .describe('Timeout to wait for the element in ms. Default: 10000'),
+        wait_after_ms: z
+            .number()
+            .optional()
+            .describe('Wait this many ms after clicking (for page transitions/animations). Default: 0'),
+    }),
+});
+const browserFillTool = tool(async ({ selector, value, press_enter, timeout_ms }) => {
+    try {
+        const { page } = await acquireBrowser();
+        await page.locator(selector).setTimeout(timeout_ms ?? 10_000).fill(value);
+        if (press_enter) {
+            await page.keyboard.press('Enter');
+        }
+        return JSON.stringify({ success: true, selector, filled: true });
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, selector, error: err.message });
+    }
+}, {
+    name: 'browser_fill',
+    description: 'Fill a form input or textarea field with a value. Clears any existing content first. ' +
+        'Always inspect the DOM with browser_get_dom first to identify the correct CSS selector.',
+    schema: z.object({
+        selector: z.string().describe('CSS selector of the input/textarea element'),
+        value: z.string().describe('Value to type into the field'),
+        press_enter: z
+            .boolean()
+            .optional()
+            .describe('Press Enter after filling (triggers form submit in many cases). Default: false'),
+        timeout_ms: z
+            .number()
+            .optional()
+            .describe('Timeout to find the element in ms. Default: 10000'),
+    }),
+});
+/**
+ * Search via DuckDuckGo Lite (plain HTML, no JS, no bot detection).
+ * Uses a simple POST fetch — no browser required, much faster and more reliable
+ * than headless browser scraping of Google.
+ *
+ * DDG Lite returns results as: href="URL" class='result-link'>TITLE</a>
+ * and <td class='result-snippet'>SNIPPET</td>, paired by index.
+ * Sponsored links have URLs starting with "https://duckduckgo.com/y.js" and are filtered out.
+ */
+const browserSearchTool = tool(async ({ query, num_results, language }) => {
+    try {
+        const max = num_results ?? 10;
+        // DDG region codes: "br-pt" for Brazil/Portuguese, "us-en" for US/English, etc.
+        // Map from simple lang code to DDG kl param
+        const regionMap = {
+            pt: 'br-pt', br: 'br-pt',
+            en: 'us-en', us: 'us-en',
+            es: 'es-es', fr: 'fr-fr',
+            de: 'de-de', it: 'it-it',
+            jp: 'jp-jp', ar: 'ar-es',
+        };
+        const lang = language ?? 'pt';
+        const kl = regionMap[lang] ?? lang;
+        const body = new URLSearchParams({ q: query, kl }).toString();
+        const res = await fetch('https://lite.duckduckgo.com/lite/', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ' +
+                    '(KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
+            },
+            body,
+            signal: AbortSignal.timeout(20_000),
+        });
+        if (!res.ok) {
+            return JSON.stringify({ success: false, query, error: `HTTP ${res.status}` });
+        }
+        const html = await res.text();
+        // Extract all result-link anchors (href uses double quotes, class uses single quotes)
+        const linkPattern = /href="(https?:\/\/[^"]+)"[^>]*class='result-link'>([^<]+)<\/a>/g;
+        const snippetPattern = /class='result-snippet'>([\s\S]*?)<\/td>/g;
+        const allLinks = [...html.matchAll(linkPattern)];
+        const allSnippets = [...html.matchAll(snippetPattern)];
+        // Pair links with snippets by index, filtering sponsored (DDG y.js redirect URLs)
+        const results = [];
+        for (let i = 0; i < allLinks.length && results.length < max; i++) {
+            const url = allLinks[i][1];
+            const title = allLinks[i][2].trim();
+            // Skip sponsored ads (redirected through duckduckgo.com/y.js)
+            if (url.startsWith('https://duckduckgo.com/'))
+                continue;
+            const snippet = allSnippets[i]
+                ? allSnippets[i][1].replace(/<[^>]+>/g, '').trim()
+                : '';
+            results.push({ title, url, snippet });
+        }
+        if (results.length === 0) {
+            return JSON.stringify({
+                success: false,
+                query,
+                error: 'No results found. The query may be too specific or DDG returned an unexpected response.',
+            });
+        }
+        return JSON.stringify({ success: true, query, results });
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, query, error: err.message });
+    }
+}, {
+    name: 'browser_search',
+    description: 'Search the internet using DuckDuckGo and return structured results (title, URL, snippet). ' +
+        'Use this when you need to find current information, news, articles, documentation, or any web content. ' +
+        'Returns up to 10 results by default. Does NOT require browser_navigate first — it is self-contained and fast.',
+    schema: z.object({
+        query: z.string().describe('Search query'),
+        num_results: z
+            .number()
+            .int()
+            .min(1)
+            .max(20)
+            .optional()
+            .describe('Number of results to return. Default: 10, max: 20'),
+        language: z
+            .string()
+            .optional()
+            .describe('Language/region code (e.g. "pt" for Portuguese/Brazil, "en" for English). Default: "pt"'),
+    }),
+});
+// ─── Factory ────────────────────────────────────────────────────────────────
+export function createBrowserTools(_ctx) {
+    if (process.env.MORPHEUS_BROWSER_ENABLED === 'false') {
+        return [];
+    }
+    return [
+        browserNavigateTool,
+        browserGetDomTool,
+        browserClickTool,
+        browserFillTool,
+        browserSearchTool,
+    ];
+}
+registerToolFactory(createBrowserTools);

package/dist/runtime/apoc.js

@@ -86,6 +86,8 @@ Available capabilities:
 - Perform network operations (curl, DNS, ping)
 - Manage packages (npm, yarn)
 - Inspect system information
+- Navigate websites, inspect DOM, click elements, fill forms using a real browser (for JS-heavy pages and SPAs)
+- Search the internet with browser_search (DuckDuckGo, returns structured results)
 
 OPERATING RULES:
 1. Use tools to accomplish the task. Do not speculate.
@@ -94,6 +96,21 @@ OPERATING RULES:
 4. If something fails, report the error and what you tried.
 5. Stay focused on the delegated task only.
 
+BROWSER WORKFLOW RULES (when using browser tools):
+1. ALWAYS call browser_navigate first to load the page.
+2. ALWAYS call browser_get_dom before browser_click or browser_fill to inspect the page structure and choose the correct CSS selectors. Never guess selectors — analyze the DOM.
+3. Analyze the DOM to identify interactive elements (inputs, buttons, links), their selectors (id, class, name), and the page flow.
+4. If the task requires information you don't have (e.g. email, password, form fields, personal data), DO NOT proceed. Instead, immediately return to Oracle with a clear message listing exactly what information is needed from the user. Example: "To complete the login form I need: email address and password."
+5. After clicking or filling, call browser_get_dom again to verify the page changed as expected.
+6. Report what was done, the final URL, and any relevant content extracted.
+
+SEARCH & FACT-CHECKING RULES (when using browser_search to answer factual questions):
+1. Call browser_search first to get a list of relevant sources.
+2. ALWAYS open at least 3 of the returned URLs with browser_navigate to read the actual content. Do not rely solely on the snippet — snippets may be outdated or incomplete.
+3. Cross-reference the information across the sources. If they agree, report the fact with confidence. If they disagree, report all versions found and indicate the discrepancy.
+4. Prefer authoritative sources (official team sites, major sports outlets, official event pages) over aggregators.
+5. Include the source URLs in your final report so Oracle can pass them to the user.
+
 ${context ? `CONTEXT FROM ORACLE:\n${context}` : ""}
     `);
         const userMessage = new HumanMessage(task);

package/dist/runtime/tools/apoc-tool.js

@@ -33,6 +33,8 @@ Use this tool when the user asks for ANY of the following:
 - Process management: list processes, kill processes, check ports
 - Network: ping hosts, curl URLs, DNS lookups
 - System info: environment variables, OS info, disk space, memory
+- Internet search: search DuckDuckGo and verify facts by reading at least 3 sources via browser_navigate before reporting results.
+- Browser automation: navigate websites (JS/SPA), inspect DOM, click elements, fill forms. Apoc will ask for missing user input (e.g. credentials, form fields) before proceeding.
 
 Provide a clear natural language task description. Optionally provide context
 from the current conversation to help Apoc understand the broader goal.`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "morpheus-cli",
-  "version": "0.4.12",
+  "version": "0.4.14",
   "description": "Morpheus is a local AI agent for developers, running as a CLI daemon that connects to LLMs, local tools, and MCPs, enabling interaction via Terminal, Telegram, and Discord. Inspired by the character Morpheus from *The Matrix*, the project acts as an intelligent orchestrator, bridging the gap between the developer and complex systems.",
   "bin": {
     "morpheus": "./bin/morpheus.js"
@@ -50,6 +50,7 @@
     "mcp-remote": "^0.1.38",
     "open": "^11.0.0",
     "ora": "^9.1.0",
+    "puppeteer-core": "^23.11.1",
     "sqlite-vec": "^0.1.7-alpha.2",
     "telegraf": "^4.16.3",
     "telegram-markdown-v2": "^0.0.4",