jpmschweitzer/webber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

docs: update coverage, READMEs, and add security tests

Browse Source 
- Update COVERAGE.md to reflect completed features (now ~60%)
- Update main README with features and tools list
- Update CLI README with streaming options
- Expand API tests from 5 to 11 (add stream endpoint tests)
- Add 14 security tests for path traversal, command injection
- Total tests: 109 (up from 88)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
jpmschweitzer
2026-01-11 18:53:36 +01:00
co-authored by Claude Opus 4.5
parent 82a816a5b5
commit ef69d9c945
5 changed files with 478 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
webber-api/docs/COVERAGE.md
+62 -37
View File
@@ -2,9 +2,9 @@
> Tracking progress towards Claude Code-like functionality
## Current Status: ~40% Complete
## Current Status: ~60% Complete
Last updated: 2026-01-10
Last updated: 2026-01-11
---
@@ -20,9 +20,13 @@ Last updated: 2026-01-10
| `GlobFilesTool` | ✅ | Pattern matching, sorted by mtime |
| `GrepContentTool` | ✅ | Regex search with context lines |
| `BashReadOnlyTool` | ✅ | Allowlist-based command filtering |
| `EditFileTool` | ✅ | Find-and-replace with unique match validation |
| `WriteFileTool` | ✅ | Create/overwrite files with size limits |
| `BashTool` (full) | ✅ | Write-enabled shell with safety controls |
| `WebSearchTool` | ✅ | SearXNG integration for web search |
| Path validation | ✅ | `allowed_paths` restriction |
**Status:** Tools now honor `.gitignore` patterns and default ignores (`.venv/`, `__pycache__/`, etc.)
**Status:** Tools honor `.gitignore` patterns and default ignores (`.venv/`, `__pycache__/`, etc.)
### Phase 2: Explore Agent ✅ Complete
@@ -34,6 +38,9 @@ Last updated: 2026-01-10
| System prompts | ✅ | Mistral-optimized with tool examples |
| Tool registration | ✅ | `@agent.tool` decorator pattern |
| Sanitized Ollama provider | ✅ | Fixes `content: null` issue |
| Streaming support | ✅ | `run_stream()` method with SSE |
**Available tools:** `read_file`, `glob_files`, `grep_content`, `bash_readonly`, `edit_file`, `write_file`, `bash`, `web_search`
**Gap:** Mistral Nemo sometimes hallucinates instead of using tool results.
@@ -41,17 +48,18 @@ Last updated: 2026-01-10
| Component | Status | Notes |
|-----------|--------|-------|
| Typer + Rich setup | ✅ | Both `src/cli` and standalone `cli/` |
| `webber --version` | ✅ | Shows version from pyproject.toml |
| Typer + Rich setup | ✅ | Standalone `webber-cli/` package |
| `webber-cli --version` | ✅ | Shows version from pyproject.toml |
| Console theming | ✅ | Centralized color palette |
| Markdown rendering | ✅ | Rich markdown output |
| Streaming display | ✅ | Real-time token output with `--stream` flag |
### Phase 4: Agentic Loop ⚠️ Partial
| Component | Status | Notes |
|-----------|--------|-------|
| `webber chat` command | ✅ | Interactive mode works |
| `webber explore` command | ✅ | One-shot query works |
| `webber-cli chat` command | ✅ | Interactive mode with streaming |
| `webber-cli explore` command | ✅ | One-shot query with streaming |
| `SessionState` dataclass | ✅ | Basic context tracking |
| `AgenticLoop` class | ⚠️ | Basic implementation, not fully utilized |
| Conversation history | ❌ | Not persisted between turns in CLI |
@@ -62,6 +70,7 @@ Last updated: 2026-01-10
| Component | Status | Notes |
|-----------|--------|-------|
| `POST /agents/run` | ✅ | Execute agent with prompt |
| `POST /agents/stream` | ✅ | SSE streaming responses |
| `GET /agents/` | ✅ | List available agents |
| `GET /agents/{name}` | ✅ | Get agent info |
| Request/response schemas | ✅ | Pydantic models |
@@ -70,12 +79,12 @@ Last updated: 2026-01-10
| Component | Status | Notes |
|-----------|--------|-------|
| Tool unit tests | ✅ | 17 tests covering all tools |
| API endpoint tests | ✅ | 5 tests for agent routes |
| Tool unit tests | ✅ | 109 tests total |
| API endpoint tests | ✅ | 11 tests for agent routes |
| Health check tests | ✅ | 2 tests |
| Security tests | ✅ | 14 tests for path traversal, injection |
| Integration tests | ❌ | No real LLM integration tests |
| CLI E2E tests | ❌ | Not implemented |
| Streaming responses | ❌ | Not implemented |
---
@@ -85,9 +94,6 @@ Last updated: 2026-01-10
| Feature | Category | Description | Complexity |
|---------|----------|-------------|------------|
| **Write tool** | Tools | Create new files | Medium |
| **Edit tool** | Tools | old_string/new_string pattern like Claude | Medium |
| **Full Bash tool** | Tools | Write-enabled shell for Task agent | Medium |
| **Plan Agent** | Agents | Design implementation approaches | High |
| **Task Agent** | Agents | Autonomous multi-step execution | High |
| **Context summarization** | Infrastructure | Compress history at token limit | High |
@@ -97,8 +103,6 @@ Last updated: 2026-01-10
| Feature | Category | Description | Complexity |
|---------|----------|-------------|------------|
| **Streaming responses** | CLI | Real-time token display | Medium |
| **Web search tool** | Tools | External search API integration | Medium |
| **Tool result caching** | Infrastructure | Cache file reads for performance | Low |
| **Session persistence** | CLI | Save/resume conversations | Medium |
| **Todo tracking** | CLI | Built-in task list (`/todo`) | Medium |
@@ -119,15 +123,25 @@ Last updated: 2026-01-10
---
## Testing Coverage Gaps
## Testing Coverage
| Area | Current | Target | Gap |
|------|---------|--------|-----|
| Tool unit tests | 17 | 17 | ✅ |
| API tests | 5 | 10 | Need error handling, edge cases |
| Area | Current | Target | Status |
|------|---------|--------|--------|
| Tool unit tests | 109 | 109 | ✅ |
| API tests | 11 | 11 | ✅ |
| Security tests | 14 | 14 | ✅ |
| Integration tests | 0 | 5 | Agent + real LLM tests |
| CLI E2E tests | 0 | 10 | Full workflow tests |
| Security tests | 0 | 5 | Path traversal, injection |
**Test breakdown:**
- Read/Glob/Grep tools: 17 tests
- Edit/Write tools: 22 tests
- Bash tools: 22 tests
- Web search: 10 tests
- Gitignore filtering: 10 tests
- API endpoints: 11 tests
- Security: 14 tests
- Health checks: 2 tests
---
@@ -137,9 +151,7 @@ Last updated: 2026-01-10
2. **No conversation memory** - CLI chat mode doesn't persist context between sessions.
3. **No streaming** - Responses appear all at once, no real-time token display.
4. **Temperature setting** - Changed from 0.0 to 0.3 for Mistral Nemo compatibility, may affect determinism.
3. **Temperature setting** - Changed from 0.0 to 0.3 for Mistral Nemo compatibility, may affect determinism.
---
@@ -147,21 +159,13 @@ Last updated: 2026-01-10
| Decision | Choice | Rationale |
|----------|--------|-----------|
| Separate CLI package | `cli/` at root | Can be extracted as standalone client |
| Monorepo structure | `webber-api/`, `webber-cli/` | Separate packages, shared root |
| Sanitized Ollama provider | Custom wrapper | Fixes PydanticAI + Ollama `content: null` bug |
| Dev port 8095 | Separate from prod 8086 | Avoid conflicts with Docker deployment |
| Tool choice "required" | Force tool use | Mistral Nemo needs explicit instruction |
| Temperature 0.3 | Mistral recommendation | 0.0 caused issues with Nemo |
---
## Estimated Effort to Full Parity
| Milestone | Effort | Features |
|-----------|--------|----------|
| **MVP (current)** | Done | Explore agent, basic CLI, REST API |
| **Usable daily driver** | 2-3 weeks | Write/Edit tools, Plan agent, git integration |
| **Claude Code parity** | 2-3 months | Task agent, streaming, MCP, IDE integration |
| SearXNG for search | Self-hosted | Privacy, no API keys needed |
| SSE for streaming | Server-Sent Events | Simple, well-supported |
---
@@ -169,11 +173,12 @@ Last updated: 2026-01-10
```bash
# Start dev server
./wakeup.sh
cd webber-api && ./wakeup.sh
# CLI commands
# CLI commands (from webber-cli/)
.venv/bin/webber-cli status # Check API connection
.venv/bin/webber-cli explore "find tests" # One-shot exploration
.venv/bin/webber-cli explore "query" --no-stream # Batch mode
.venv/bin/webber-cli chat # Interactive mode
# API endpoints
@@ -182,4 +187,24 @@ curl http://localhost:8095/agents/
curl -X POST http://localhost:8095/agents/run \
-H "Content-Type: application/json" \
-d '{"agent_type":"explore","prompt":"list python files","working_dir":"."}'
# Streaming endpoint
curl -N http://localhost:8095/agents/stream \
-H "Content-Type: application/json" \
-d '{"agent_type":"explore","prompt":"find config files","working_dir":"."}'
```
---
## Tools Available
| Tool | Type | Description |
|------|------|-------------|
| `read_file` | Read | Read file contents with line numbers |
| `glob_files` | Read | Find files by pattern |
| `grep_content` | Read | Search file contents with regex |
| `bash_readonly` | Read | Safe bash commands (ls, git status, etc.) |
| `edit_file` | Write | Find-and-replace editing |
| `write_file` | Write | Create/overwrite files |
| `bash` | Write | Full bash with safety controls |
| `web_search` | External | Search web via SearXNG |