morpheus-cli 0.4.13 → 0.4.15

package/dist/channels/telegram.js

@@ -5,7 +5,6 @@ import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
 import { spawn } from 'child_process';
-import { convert } from 'telegram-markdown-v2';
 import { ConfigManager } from '../config/manager.js';
 import { DisplayManager } from '../runtime/display.js';
 import { createTelephonist } from '../runtime/telephonist.js';
@@ -21,8 +20,20 @@ import { Construtor } from '../runtime/tools/factory.js';
  * Truncates to Telegram's 4096-char hard limit.
  * Use for dynamic LLM/Oracle output.
  */
-function toMd(text) {
+// Cached dynamic import of telegram-markdown-v2 (ESM-safe, loaded once on first use)
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let _convertFn = null;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+async function getConvert() {
+    if (!_convertFn) {
+        const mod = await import('telegram-markdown-v2');
+        _convertFn = mod.convert;
+    }
+    return _convertFn;
+}
+async function toMd(text) {
     const MAX = 4096;
+    const convert = await getConvert();
     const converted = convert(text, 'escape');
     const safe = converted.length > MAX ? converted.slice(0, MAX - 3) + '\\.\\.\\.' : converted;
     return { text: safe, parse_mode: 'MarkdownV2' };
@@ -116,10 +127,15 @@ export class TelegramAdapter {
                     const response = await this.oracle.chat(text);
                     if (response) {
                         try {
-                            await ctx.reply(toMd(response).text, { parse_mode: 'MarkdownV2' });
+                            await ctx.reply((await toMd(response)).text, { parse_mode: 'MarkdownV2' });
                         }
                         catch {
-                            await ctx.reply(response);
+                            try {
+                                ctx.reply(response, { parse_mode: 'MarkdownV2' });
+                            }
+                            catch {
+                                await ctx.reply(response);
+                            }
                         }
                         this.display.log(`Responded to @${user}: ${response}`, { source: 'Telegram' });
                     }
@@ -200,7 +216,7 @@ export class TelegramAdapter {
                     // }
                     if (response) {
                         try {
-                            await ctx.reply(toMd(response).text, { parse_mode: 'MarkdownV2' });
+                            await ctx.reply((await toMd(response)).text, { parse_mode: 'MarkdownV2' });
                         }
                         catch {
                             await ctx.reply(response);
@@ -418,7 +434,7 @@ export class TelegramAdapter {
             return;
         }
         // toMd() already truncates to 4096 chars (Telegram's hard limit)
-        const { text: mdText, parse_mode } = toMd(text);
+        const { text: mdText, parse_mode } = await toMd(text);
         for (const userId of allowedUsers) {
             try {
                 await this.bot.telegram.sendMessage(userId, mdText, { parse_mode });
@@ -745,7 +761,7 @@ How can I assist you today?`;
         let response = await this.oracle.chat(prompt);
         if (response) {
             try {
-                await ctx.reply(toMd(response).text, { parse_mode: 'MarkdownV2' });
+                await ctx.reply((await toMd(response)).text, { parse_mode: 'MarkdownV2' });
             }
             catch {
                 await ctx.reply(response);

package/dist/config/paths.js

@@ -11,6 +11,7 @@ export const PATHS = {
     logs: LOGS_DIR,
     memory: path.join(MORPHEUS_ROOT, 'memory'),
     cache: path.join(MORPHEUS_ROOT, 'cache'),
+    browser: path.join(MORPHEUS_ROOT, 'cache', 'browser'),
     commands: path.join(MORPHEUS_ROOT, 'commands'),
     mcps: path.join(MORPHEUS_ROOT, 'mcps.json'),
 };

package/dist/devkit/index.js

@@ -7,4 +7,5 @@ import './tools/network.js';
 import './tools/git.js';
 import './tools/packages.js';
 import './tools/system.js';
+import './tools/browser.js';
 export { buildDevKit } from './registry.js';

package/dist/devkit/tools/browser.js

@@ -0,0 +1,388 @@
+import { tool } from '@langchain/core/tools';
+import { z } from 'zod';
+import { truncateOutput } from '../utils.js';
+import { registerToolFactory } from '../registry.js';
+import { PATHS } from '../../config/paths.js';
+// ─── Module-level browser singleton ────────────────────────────────────────
+let browserInstance = null;
+let pageInstance = null;
+let idleTimer = null;
+let installPromise = null;
+const IDLE_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Ensures Chromium is downloaded to ~/.morpheus/cache/browser/.
+ * Downloads only once; subsequent calls return the cached executablePath.
+ */
+async function ensureChromium() {
+    const { install, resolveBuildId, detectBrowserPlatform, computeExecutablePath, Browser: PBrowser, } = await import('@puppeteer/browsers');
+    const platform = detectBrowserPlatform();
+    const buildId = await resolveBuildId(PBrowser.CHROME, platform, 'stable');
+    // Check if already installed
+    const execPath = computeExecutablePath({
+        browser: PBrowser.CHROME,
+        buildId,
+        cacheDir: PATHS.browser,
+    });
+    const { default: fs } = await import('fs-extra');
+    if (await fs.pathExists(execPath)) {
+        return execPath;
+    }
+    // Download with progress indicator
+    process.stdout.write('[Morpheus] Installing Chromium for browser tools (first run, ~150MB)...\n');
+    const installed = await install({
+        browser: PBrowser.CHROME,
+        buildId,
+        cacheDir: PATHS.browser,
+        downloadProgressCallback: (downloaded, total) => {
+            const pct = total > 0 ? Math.round((downloaded / total) * 100) : 0;
+            process.stdout.write(`\r[Morpheus] Downloading Chromium: ${pct}%   `);
+        },
+    });
+    process.stdout.write('\n[Morpheus] Chromium installed successfully.\n');
+    return installed.executablePath;
+}
+/**
+ * Returns (or creates) the browser singleton, resetting the idle timer.
+ * Handles Chromium lazy-install with a lock to prevent concurrent downloads.
+ */
+async function acquireBrowser() {
+    const { launch } = await import('puppeteer-core');
+    const needsLaunch = !browserInstance || !browserInstance.connected;
+    if (needsLaunch) {
+        if (!installPromise) {
+            installPromise = ensureChromium().finally(() => {
+                installPromise = null;
+            });
+        }
+        const executablePath = await installPromise;
+        // Re-check after awaiting (another caller may have launched already)
+        if (!browserInstance || !browserInstance.connected) {
+            browserInstance = await launch({
+                executablePath,
+                headless: true,
+                args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-gpu'],
+            });
+            pageInstance = await browserInstance.newPage();
+        }
+    }
+    else if (!pageInstance || pageInstance.isClosed()) {
+        pageInstance = await browserInstance.newPage();
+    }
+    // Reset idle timeout
+    if (idleTimer)
+        clearTimeout(idleTimer);
+    idleTimer = setTimeout(async () => {
+        try {
+            await pageInstance?.close();
+        }
+        catch { /* ignore */ }
+        try {
+            await browserInstance?.close();
+        }
+        catch { /* ignore */ }
+        pageInstance = null;
+        browserInstance = null;
+        idleTimer = null;
+    }, IDLE_TIMEOUT_MS);
+    return { browser: browserInstance, page: pageInstance };
+}
+// Best-effort cleanup on process exit
+process.on('exit', () => {
+    try {
+        browserInstance?.process()?.kill();
+    }
+    catch { /* ignore */ }
+});
+// ─── Tool Definitions ───────────────────────────────────────────────────────
+const browserNavigateTool = tool(async ({ url, wait_until, timeout_ms, return_html }) => {
+    try {
+        const { page } = await acquireBrowser();
+        await page.goto(url, {
+            waitUntil: (wait_until ?? 'domcontentloaded'),
+            timeout: timeout_ms ?? 30_000,
+        });
+        const title = await page.title();
+        const text = await page.evaluate(() => document.body.innerText);
+        const result = {
+            success: true,
+            url,
+            current_url: page.url(),
+            title,
+            text: truncateOutput(text),
+        };
+        if (return_html) {
+            result.html = truncateOutput(await page.content());
+        }
+        return JSON.stringify(result);
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, url, error: err.message });
+    }
+}, {
+    name: 'browser_navigate',
+    description: 'Navigate to a URL in a real browser (executes JavaScript). Use instead of http_request for SPAs, JS-heavy pages, or sites requiring interaction. Returns page title and text content.',
+    schema: z.object({
+        url: z.string().describe('Full URL to navigate to (must include https://)'),
+        wait_until: z
+            .enum(['load', 'domcontentloaded', 'networkidle0', 'networkidle2'])
+            .optional()
+            .describe('Wait condition. Default: domcontentloaded. Use networkidle0 for SPAs.'),
+        timeout_ms: z.number().optional().describe('Navigation timeout in ms. Default: 30000'),
+        return_html: z
+            .boolean()
+            .optional()
+            .describe('Also return raw HTML in response. Default: false'),
+    }),
+});
+const browserGetDomTool = tool(async ({ selector, include_attributes }) => {
+    try {
+        const { page } = await acquireBrowser();
+        const includeAttrs = include_attributes ?? true;
+        const dom = await page.evaluate(({ sel, attrs }) => {
+            const root = sel
+                ? document.querySelector(sel)
+                : document.body;
+            if (!root)
+                return null;
+            const RELEVANT_ATTRS = [
+                'href', 'src', 'type', 'name', 'value',
+                'placeholder', 'action', 'id', 'role', 'aria-label',
+            ];
+            function serialize(el, depth) {
+                const hasChildren = el.children.length > 0;
+                const node = {
+                    tag: el.tagName.toLowerCase(),
+                };
+                if (el.id)
+                    node.id = el.id;
+                if (el.className)
+                    node.class = el.className;
+                if (!hasChildren) {
+                    const txt = el.textContent?.trim();
+                    if (txt)
+                        node.text = txt.slice(0, 120);
+                }
+                if (attrs && el.attributes.length > 0) {
+                    const attrMap = {};
+                    for (const attr of el.attributes) {
+                        if (RELEVANT_ATTRS.includes(attr.name)) {
+                            attrMap[attr.name] = attr.value;
+                        }
+                    }
+                    if (Object.keys(attrMap).length)
+                        node.attrs = attrMap;
+                }
+                if (depth < 6 && hasChildren) {
+                    node.children = Array.from(el.children)
+                        .slice(0, 40)
+                        .map((c) => serialize(c, depth + 1));
+                }
+                return node;
+            }
+            return serialize(root, 0);
+        }, { sel: selector ?? null, attrs: includeAttrs });
+        if (!dom) {
+            return JSON.stringify({ success: false, error: `Element not found: ${selector}` });
+        }
+        return JSON.stringify({ success: true, current_url: page.url(), dom: truncateOutput(JSON.stringify(dom, null, 2)) });
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, error: err.message });
+    }
+}, {
+    name: 'browser_get_dom',
+    description: 'Get a simplified DOM tree of the current page or a specific element. ' +
+        'ALWAYS call this BEFORE browser_click or browser_fill to inspect page structure and identify the correct CSS selectors. ' +
+        'Never guess selectors — analyze the DOM first.',
+    schema: z.object({
+        selector: z
+            .string()
+            .optional()
+            .describe('CSS selector to scope the DOM tree to. Omit to get the full body.'),
+        include_attributes: z
+            .boolean()
+            .optional()
+            .describe('Include relevant attributes (href, src, type, name, value, placeholder, role, aria-label). Default: true'),
+    }),
+});
+const browserClickTool = tool(async ({ selector, text, timeout_ms, wait_after_ms }) => {
+    try {
+        const { page } = await acquireBrowser();
+        if (!selector && !text) {
+            return JSON.stringify({ success: false, error: 'Provide either selector or text' });
+        }
+        const clickTimeout = timeout_ms ?? 10_000;
+        if (text) {
+            // Use Puppeteer pseudo-selector to find element by visible text
+            await page.locator(`::-p-text(${text})`).setTimeout(clickTimeout).click();
+        }
+        else {
+            await page.locator(selector).setTimeout(clickTimeout).click();
+        }
+        if (wait_after_ms) {
+            await new Promise((r) => setTimeout(r, wait_after_ms));
+        }
+        return JSON.stringify({
+            success: true,
+            current_url: page.url(),
+            title: await page.title(),
+        });
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, error: err.message });
+    }
+}, {
+    name: 'browser_click',
+    description: 'Click an element on the current browser page by CSS selector or visible text. ' +
+        'The page must already be loaded via browser_navigate. ' +
+        'Always inspect the DOM with browser_get_dom first to find the correct selector.',
+    schema: z.object({
+        selector: z
+            .string()
+            .optional()
+            .describe('CSS selector of the element to click (e.g. "button#submit", ".btn-login")'),
+        text: z
+            .string()
+            .optional()
+            .describe('Click element containing this visible text (alternative to selector)'),
+        timeout_ms: z
+            .number()
+            .optional()
+            .describe('Timeout to wait for the element in ms. Default: 10000'),
+        wait_after_ms: z
+            .number()
+            .optional()
+            .describe('Wait this many ms after clicking (for page transitions/animations). Default: 0'),
+    }),
+});
+const browserFillTool = tool(async ({ selector, value, press_enter, timeout_ms }) => {
+    try {
+        const { page } = await acquireBrowser();
+        await page.locator(selector).setTimeout(timeout_ms ?? 10_000).fill(value);
+        if (press_enter) {
+            await page.keyboard.press('Enter');
+        }
+        return JSON.stringify({ success: true, selector, filled: true });
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, selector, error: err.message });
+    }
+}, {
+    name: 'browser_fill',
+    description: 'Fill a form input or textarea field with a value. Clears any existing content first. ' +
+        'Always inspect the DOM with browser_get_dom first to identify the correct CSS selector.',
+    schema: z.object({
+        selector: z.string().describe('CSS selector of the input/textarea element'),
+        value: z.string().describe('Value to type into the field'),
+        press_enter: z
+            .boolean()
+            .optional()
+            .describe('Press Enter after filling (triggers form submit in many cases). Default: false'),
+        timeout_ms: z
+            .number()
+            .optional()
+            .describe('Timeout to find the element in ms. Default: 10000'),
+    }),
+});
+/**
+ * Search via DuckDuckGo Lite (plain HTML, no JS, no bot detection).
+ * Uses a simple POST fetch — no browser required, much faster and more reliable
+ * than headless browser scraping of Google.
+ *
+ * DDG Lite returns results as: href="URL" class='result-link'>TITLE</a>
+ * and <td class='result-snippet'>SNIPPET</td>, paired by index.
+ * Sponsored links have URLs starting with "https://duckduckgo.com/y.js" and are filtered out.
+ */
+const browserSearchTool = tool(async ({ query, num_results, language }) => {
+    try {
+        const max = num_results ?? 10;
+        // DDG region codes: "br-pt" for Brazil/Portuguese, "us-en" for US/English, etc.
+        // Map from simple lang code to DDG kl param
+        const regionMap = {
+            pt: 'br-pt', br: 'br-pt',
+            en: 'us-en', us: 'us-en',
+            es: 'es-es', fr: 'fr-fr',
+            de: 'de-de', it: 'it-it',
+            jp: 'jp-jp', ar: 'ar-es',
+        };
+        const lang = language ?? 'pt';
+        const kl = regionMap[lang] ?? lang;
+        const body = new URLSearchParams({ q: query, kl }).toString();
+        const res = await fetch('https://lite.duckduckgo.com/lite/', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ' +
+                    '(KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
+            },
+            body,
+            signal: AbortSignal.timeout(20_000),
+        });
+        if (!res.ok) {
+            return JSON.stringify({ success: false, query, error: `HTTP ${res.status}` });
+        }
+        const html = await res.text();
+        // Extract all result-link anchors (href uses double quotes, class uses single quotes)
+        const linkPattern = /href="(https?:\/\/[^"]+)"[^>]*class='result-link'>([^<]+)<\/a>/g;
+        const snippetPattern = /class='result-snippet'>([\s\S]*?)<\/td>/g;
+        const allLinks = [...html.matchAll(linkPattern)];
+        const allSnippets = [...html.matchAll(snippetPattern)];
+        // Pair links with snippets by index, filtering sponsored (DDG y.js redirect URLs)
+        const results = [];
+        for (let i = 0; i < allLinks.length && results.length < max; i++) {
+            const url = allLinks[i][1];
+            const title = allLinks[i][2].trim();
+            // Skip sponsored ads (redirected through duckduckgo.com/y.js)
+            if (url.startsWith('https://duckduckgo.com/'))
+                continue;
+            const snippet = allSnippets[i]
+                ? allSnippets[i][1].replace(/<[^>]+>/g, '').trim()
+                : '';
+            results.push({ title, url, snippet });
+        }
+        if (results.length === 0) {
+            return JSON.stringify({
+                success: false,
+                query,
+                error: 'No results found. The query may be too specific or DDG returned an unexpected response.',
+            });
+        }
+        return JSON.stringify({ success: true, query, results });
+    }
+    catch (err) {
+        return JSON.stringify({ success: false, query, error: err.message });
+    }
+}, {
+    name: 'browser_search',
+    description: 'Search the internet using DuckDuckGo and return structured results (title, URL, snippet). ' +
+        'Use this when you need to find current information, news, articles, documentation, or any web content. ' +
+        'Returns up to 10 results by default. Does NOT require browser_navigate first — it is self-contained and fast.',
+    schema: z.object({
+        query: z.string().describe('Search query'),
+        num_results: z
+            .number()
+            .int()
+            .min(1)
+            .max(20)
+            .optional()
+            .describe('Number of results to return. Default: 10, max: 20'),
+        language: z
+            .string()
+            .optional()
+            .describe('Language/region code (e.g. "pt" for Portuguese/Brazil, "en" for English). Default: "pt"'),
+    }),
+});
+// ─── Factory ────────────────────────────────────────────────────────────────
+export function createBrowserTools(_ctx) {
+    if (process.env.MORPHEUS_BROWSER_ENABLED === 'false') {
+        return [];
+    }
+    return [
+        browserNavigateTool,
+        browserGetDomTool,
+        browserClickTool,
+        browserFillTool,
+        browserSearchTool,
+    ];
+}
+registerToolFactory(createBrowserTools);

package/dist/runtime/apoc.js

@@ -41,7 +41,7 @@ export class Apoc {
     }
     async initialize() {
         const apocConfig = this.config.apoc || this.config.llm;
-        console.log(`Apoc configuration: ${JSON.stringify(apocConfig)}`);
+        // console.log(`Apoc configuration: ${JSON.stringify(apocConfig)}`);
         const working_dir = this.config.apoc?.working_dir || process.cwd();
         const timeout_ms = this.config.apoc?.timeout_ms || 30_000;
         // Import all devkit tool factories (side-effect registration)
@@ -86,6 +86,8 @@ Available capabilities:
 - Perform network operations (curl, DNS, ping)
 - Manage packages (npm, yarn)
 - Inspect system information
+- Navigate websites, inspect DOM, click elements, fill forms using a real browser (for JS-heavy pages and SPAs)
+- Search the internet with browser_search (DuckDuckGo, returns structured results)
 
 OPERATING RULES:
 1. Use tools to accomplish the task. Do not speculate.
@@ -94,6 +96,120 @@ OPERATING RULES:
 4. If something fails, report the error and what you tried.
 5. Stay focused on the delegated task only.
 
+
+────────────────────────────────────────
+BROWSER AUTOMATION PROTOCOL
+────────────────────────────────────────
+
+When using browser tools (browser_navigate, browser_get_dom, browser_click, browser_fill), follow this protocol exactly.
+
+GENERAL PRINCIPLES
+- Never guess selectors.
+- Never assume page state.
+- Always verify page transitions.
+- Always extract evidence of success.
+- If required user data is missing, STOP and return to Oracle immediately.
+
+PHASE 1 — Navigation
+1. ALWAYS call browser_navigate first.
+2. Use:
+   - wait_until: "networkidle0" for SPAs or JS-heavy pages.
+   - wait_until: "domcontentloaded" for simple pages.
+3. After navigation, confirm current_url and title.
+4. If navigation fails, report the error and stop.
+
+PHASE 2 — DOM Inspection (MANDATORY BEFORE ACTION)
+1. ALWAYS call browser_get_dom before browser_click or browser_fill.
+2. Identify stable selectors (prefer id > name > role > unique class).
+3. Understand page structure and expected flow before interacting.
+4. Never click or fill blindly.
+
+PHASE 3 — Interaction
+When clicking:
+- Prefer stable selectors.
+- If ambiguous, refine selector.
+- Use visible text only if selector is unstable.
+
+When filling:
+- Confirm correct input field via DOM.
+- Fill field.
+- Submit using press_enter OR clicking submit button.
+
+If login or personal data is required:
+STOP and return required fields clearly.
+
+PHASE 4 — State Verification (MANDATORY)
+After ANY interaction:
+1. Call browser_get_dom again.
+2. Verify URL change or content change.
+3. Confirm success or detect error message.
+
+If expected change did not occur:
+- Reinspect DOM.
+- Attempt one justified alternative.
+- If still failing, report failure clearly.
+
+Maximum 2 attempts per step.
+Never assume success.
+
+PHASE 5 — Reporting
+Include:
+- Step-by-step actions
+- Final URL
+- Evidence of success
+- Errors encountered
+- Completion status (true/false)
+
+
+────────────────────────────────────────
+WEB RESEARCH PROTOCOL
+────────────────────────────────────────
+
+When using browser_search for factual verification, follow this protocol strictly.
+
+PHASE 1 — Query Design
+1. Identify core entity, information type, and time constraint.
+2. Build a precise search query.
+3. If time-sensitive, include the current year.
+
+PHASE 2 — Source Discovery
+1. Call browser_search.
+2. Collect results.
+3. Prioritize:
+   - Official sources
+   - Major authoritative publications
+4. Reformulate query if necessary.
+
+PHASE 3 — Source Validation (MANDATORY)
+1. Open at least 3 distinct URLs with browser_navigate.
+2. Read actual page content.
+3. NEVER rely only on search snippets.
+4. Ignore inaccessible pages.
+
+PHASE 4 — Cross-Verification
+1. Extract relevant information from each source.
+2. Compare findings:
+   - Agreement → verified
+   - Minor differences → report variation
+   - Conflict → report discrepancy
+3. Require confirmation from at least 2 reliable sources.
+4. If not confirmed, state clearly:
+   "Information could not be confidently verified."
+
+PHASE 5 — Structured Report
+Include:
+- Direct answer
+- Short explanation
+- Source URLs
+- Confidence level (High / Medium / Low)
+
+ANTI-HALLUCINATION RULES
+- Never answer from prior knowledge without verification.
+- Never stop after reading only one source.
+- Treat time-sensitive information as volatile.
+
+
+
 ${context ? `CONTEXT FROM ORACLE:\n${context}` : ""}
     `);
         const userMessage = new HumanMessage(task);

package/dist/runtime/oracle.js

@@ -165,6 +165,78 @@ If a tool can compute, fetch, inspect, or verify something, prefer tool usage.
 
 Never hallucinate values retrievable via tools.
 
+--------------------------------------------------
+DELEGATION DECISION PROTOCOL
+--------------------------------------------------
+
+Before responding, classify the request into one of the following categories:
+
+CATEGORY A — Execution / System / External State
+If the request involves:
+- Filesystem access
+- Code execution
+- Git operations
+- Package management
+- Process inspection
+- Networking
+- Environment state
+- Browser automation
+- Web navigation
+- Web research
+- Fact verification
+- Current or time-sensitive data
+
+You MUST delegate to the appropriate tool (e.g., apoc_delegate).
+
+CATEGORY B — Factual Question Requiring Verification
+If the question involves:
+- Rankings
+- Results
+- Versions
+- News
+- Public figures
+- Statistics
+- Events
+- Anything that may have changed over time
+
+You MUST delegate to Apoc for verification.
+
+CATEGORY C — Pure Reasoning / Conceptual
+If the request can be fully answered through reasoning alone without external validation,
+you may answer directly without delegating.
+
+If uncertainty exists about whether verification is required,
+DELEGATE.
+
+--------------------------------------------------
+APOC DELEGATION STANDARD
+--------------------------------------------------
+
+When delegating to Apoc:
+
+- Provide a clear objective.
+- Specify verification requirements if factual.
+- Define expected output structure if needed.
+- Pass relevant context from the conversation.
+- Never send vague tasks.
+
+Weak delegation example (forbidden):
+"Search who won the championship."
+
+Correct delegation example:
+"Find who won the 2023 NBA Championship. Verify using at least 3 reliable sources. Provide URLs and confidence level."
+
+--------------------------------------------------
+UNCERTAINTY RULE
+--------------------------------------------------
+
+If the answer cannot be produced with high confidence without external verification,
+you MUST delegate.
+
+Never fabricate certainty.
+Never simulate tool results.
+When in doubt, delegate.
+
 
 7. FINAL ANSWER POLICY
 

package/dist/runtime/tools/apoc-tool.js

@@ -33,6 +33,8 @@ Use this tool when the user asks for ANY of the following:
 - Process management: list processes, kill processes, check ports
 - Network: ping hosts, curl URLs, DNS lookups
 - System info: environment variables, OS info, disk space, memory
+- Internet search: search DuckDuckGo and verify facts by reading at least 3 sources via browser_navigate before reporting results.
+- Browser automation: navigate websites (JS/SPA), inspect DOM, click elements, fill forms. Apoc will ask for missing user input (e.g. credentials, form fields) before proceeding.
 
 Provide a clear natural language task description. Optionally provide context
 from the current conversation to help Apoc understand the broader goal.`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "morpheus-cli",
-  "version": "0.4.13",
+  "version": "0.4.15",
   "description": "Morpheus is a local AI agent for developers, running as a CLI daemon that connects to LLMs, local tools, and MCPs, enabling interaction via Terminal, Telegram, and Discord. Inspired by the character Morpheus from *The Matrix*, the project acts as an intelligent orchestrator, bridging the gap between the developer and complex systems.",
   "bin": {
     "morpheus": "./bin/morpheus.js"
@@ -50,6 +50,7 @@
     "mcp-remote": "^0.1.38",
     "open": "^11.0.0",
     "ora": "^9.1.0",
+    "puppeteer-core": "^23.11.1",
     "sqlite-vec": "^0.1.7-alpha.2",
     "telegraf": "^4.16.3",
     "telegram-markdown-v2": "^0.0.4",