drydock-cli 0.7.4__tar.gz → 0.8.1__tar.gz

{drydock_cli-0.7.4 → drydock_cli-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 0.7.4
+Version: 0.8.1
 Summary: Drydock — nautical CLI coding agent
 Project-URL: Homepage, https://github.com/fbobe321/drydock
 Project-URL: Repository, https://github.com/fbobe321/drydock
@@ -24,6 +24,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.12
 Requires-Dist: agent-client-protocol==0.8.1
 Requires-Dist: anyio>=4.12.0
+Requires-Dist: beautifulsoup4>=4.12.0
 Requires-Dist: cachetools>=5.5.0
 Requires-Dist: cryptography<=46.0.3,>=44.0.0
 Requires-Dist: gitpython>=3.1.46

{drydock_cli-0.7.4 → drydock_cli-0.8.1}/drydock/cli/cli.py

@@ -196,7 +196,7 @@ def run_cli(args: argparse.Namespace) -> None:
                 entrypoint_metadata=EntrypointMetadata(
                     agent_entrypoint="cli",
                     agent_version=__version__,
-                    client_name="vibe_cli",
+                    client_name="drydock_cli",
                     client_version=__version__,
                 ),
             )

{drydock_cli-0.7.4 → drydock_cli-0.8.1}/drydock/cli/textual_ui/external_editor.py

@@ -16,7 +16,7 @@ class ExternalEditor:
 
     def edit(self, initial_content: str = "") -> str | None:
         editor = self.get_editor()
-        fd, filepath = tempfile.mkstemp(suffix=".md", prefix="vibe_")
+        fd, filepath = tempfile.mkstemp(suffix=".md", prefix="drydock_")
         try:
             with os.fdopen(fd, "w") as f:
                 f.write(initial_content)

{drydock_cli-0.7.4 → drydock_cli-0.8.1}/drydock/core/agent_loop.py

@@ -482,6 +482,7 @@ class AgentLoop:
             bash_count = 0  # Track consecutive bash calls without an edit
             search_replace_failures = 0  # Track failed search_replace attempts
             files_explored: list[str] = []  # Track files read for context state
+            files_modified: list[str] = []  # Track files edited for blast radius
             context_summary_injected = False
             while not should_break_loop:
                 # Loop protection: prevent infinite tool-call loops
@@ -549,8 +550,28 @@ class AgentLoop:
                                 if not tc.function:
                                     continue
                                 if tc.function.name in ("search_replace", "write_file"):
+                                    first_edit = not has_made_edit
                                     has_made_edit = True
                                     bash_count = 0  # Reset on successful edit
+                                    # Track blast radius
+                                    try:
+                                        edit_args = json.loads(tc.function.arguments or "{}")
+                                        edit_path = edit_args.get("file_path", edit_args.get("path", ""))
+                                        if edit_path and edit_path not in files_modified:
+                                            files_modified.append(edit_path)
+                                    except (json.JSONDecodeError, AttributeError):
+                                        edit_path = ""
+
+                                    # After first edit: prompt to check related files
+                                    if first_edit and edit_path:
+                                        self._inject_system_note(
+                                            f"Good — you edited {edit_path}. Now check: "
+                                            f"does this bug have a RELATED file that also needs changes? "
+                                            f"Common patterns: if you edited a model, check the serializer/migration. "
+                                            f"If you edited a base class, check subclasses. "
+                                            f"If you edited a util, check callers. "
+                                            f"Use grep to search for imports of the function/class you changed."
+                                        )
                                 if tc.function.name == "read_file":
                                     try:
                                         args = json.loads(tc.function.arguments or "{}")
@@ -569,6 +590,15 @@ class AgentLoop:
                             if "search_replace" in content.lower() and "error" in content.lower():
                                 search_replace_failures += 1
 
+                # Blast radius check: warn when touching 5+ files
+                if len(files_modified) >= 5 and len(files_modified) % 5 == 0:
+                    self._inject_system_note(
+                        f"BLAST RADIUS WARNING: You have modified {len(files_modified)} files. "
+                        f"Files: {', '.join(files_modified[-5:])}. "
+                        f"This is a large change. Are you sure all these edits are needed? "
+                        f"Consider stopping to verify your approach."
+                    )
+
                 # Bash abuse detection: if model keeps using bash instead of
                 # search_replace/read_file, redirect it to the proper tools
                 if not has_made_edit and bash_count >= 10 and bash_count % 5 == 0:
@@ -579,14 +609,26 @@ class AgentLoop:
                         "Call search_replace NOW with your fix."
                     )
 
-                # search_replace keeps failing — suggest re-reading the file
-                if search_replace_failures >= 3 and search_replace_failures % 2 == 1:
-                    self._inject_system_note(
-                        f"Your search_replace has failed {search_replace_failures} times. "
-                        "The text you're searching for doesn't match the file. STOP guessing. "
-                        "Use read_file with offset/limit to see the EXACT current text, "
-                        "then copy it precisely into search_replace old_str."
-                    )
+                # 3-Strike Rule: search_replace keeps failing
+                if search_replace_failures >= 3:
+                    if search_replace_failures == 3:
+                        # Strike 3: STOP and ask user
+                        self.messages.append(LLMMessage(
+                            role=Role.user,
+                            content=(
+                                f"3-STRIKE RULE: Your search_replace has failed {search_replace_failures} times. "
+                                "You have exhausted your attempts. STOP trying the same approach. "
+                                "Either: (1) use read_file to get the EXACT text first, "
+                                "(2) try a completely different file, or "
+                                "(3) ask the user for help with /consult."
+                            )
+                        ))
+                    elif search_replace_failures % 3 == 0:
+                        # Every 3 more failures, escalate
+                        self.messages.append(LLMMessage(
+                            role=Role.user,
+                            content=f"STOP: {search_replace_failures} failed edits. You are stuck. Ask the user for help."
+                        ))
 
                 # Context budget warning: after 7 tool turns without an edit,
                 # warn that context is being consumed without progress

{drydock_cli-0.7.4 → drydock_cli-0.8.1}/drydock/core/auth/github.py

@@ -11,7 +11,7 @@ import keyring.errors
 
 GITHUB_CLIENT_ID = "Ov23liJ7sk5kFDMEyvDT"
 
-_SERVICE_NAME = "vibe"
+_SERVICE_NAME = "drydock"
 _KEYRING_USERNAME = "github_token"
 _DEVICE_CODE_URL = "https://github.com/login/device/code"
 _TOKEN_URL = "https://github.com/login/oauth/access_token"

{drydock_cli-0.7.4 → drydock_cli-0.8.1}/drydock/core/config/_settings.py

@@ -267,7 +267,7 @@ DEFAULT_PROVIDERS = [
 
 DEFAULT_MODELS = [
     ModelConfig(
-        name="mistral-vibe-cli-latest",
+        name="drydock-cli-latest",
         provider="mistral",
         alias="devstral-2",
         input_price=0.4,

{drydock_cli-0.7.4 → drydock_cli-0.8.1}/drydock/core/logger.py

@@ -9,7 +9,7 @@ from drydock.core.paths import LOG_DIR, LOG_FILE
 
 LOG_DIR.path.mkdir(parents=True, exist_ok=True)
 
-logger = logging.getLogger("vibe")
+logger = logging.getLogger("drydock")
 
 
 class StructuredLogFormatter(logging.Formatter):

{drydock_cli-0.7.4 → drydock_cli-0.8.1}/drydock/core/programmatic.py

@@ -21,7 +21,7 @@ from drydock.core.types import (
 )
 from drydock.core.utils import ConversationLimitException
 
-_DEFAULT_CLIENT_METADATA = ClientMetadata(name="vibe_programmatic", version=__version__)
+_DEFAULT_CLIENT_METADATA = ClientMetadata(name="drydock_programmatic", version=__version__)
 
 
 def run_programmatic(

drydock_cli-0.8.1/drydock/core/tools/builtins/websearch.py

@@ -0,0 +1,133 @@
+from __future__ import annotations
+
+from collections.abc import AsyncGenerator
+import os
+import urllib.parse
+from typing import ClassVar, final
+
+from pydantic import BaseModel, Field
+from bs4 import BeautifulSoup
+
+from drydock.core.tools.base import (
+    BaseTool,
+    BaseToolConfig,
+    BaseToolState,
+    InvokeContext,
+    ToolError,
+    ToolPermission,
+)
+from drydock.core.tools.ui import ToolCallDisplay, ToolResultDisplay, ToolUIData
+from drydock.core.types import ToolStreamEvent
+
+
+class WebSearchSource(BaseModel):
+    title: str
+    url: str
+
+
+class WebSearchArgs(BaseModel):
+    query: str = Field(min_length=1)
+
+
+class WebSearchResult(BaseModel):
+    answer: str
+    sources: list[WebSearchSource] = Field(default_factory=list)
+
+
+class WebSearchConfig(BaseToolConfig):
+    permission: ToolPermission = ToolPermission.ASK
+    timeout: int = Field(default=30, description="HTTP timeout in seconds.")
+
+
+class WebSearch(
+    BaseTool[WebSearchArgs, WebSearchResult, WebSearchConfig, BaseToolState],
+    ToolUIData[WebSearchArgs, WebSearchResult],
+):
+    description: ClassVar[str] = "Search the web directly without an API key to find current information."
+
+    @classmethod
+    def is_available(cls) -> bool:
+        # Always available! No API key required.
+        return True
+
+    @final
+    async def run(
+        self, args: WebSearchArgs, ctx: InvokeContext | None = None
+    ) -> AsyncGenerator[ToolStreamEvent | WebSearchResult, None]:
+        
+        import httpx
+
+        # Grab your proxy settings
+        proxy_url = os.getenv("HTTPS_PROXY") or os.getenv("https_proxy") or os.getenv("HTTP_PROXY") or os.getenv("http_proxy")
+        
+        headers = {
+            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+            "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+        }
+
+        try:
+            # Respect DRYDOCK_INSECURE flag for SSL bypass
+            verify_ssl = os.environ.get("DRYDOCK_INSECURE") != "1"
+            async with httpx.AsyncClient(proxy=proxy_url, verify=not verify_ssl if verify_ssl else False, headers=headers) as client:
+                response = await client.post(
+                    "https://html.duckduckgo.com/html/",
+                    data={"q": args.query},
+                    timeout=self.config.timeout
+                )
+                response.raise_for_status()
+        except Exception as e:
+            raise ToolError(f"Failed to fetch search results: {str(e)}")
+
+        # Parse the DuckDuckGo HTML results
+        soup = BeautifulSoup(response.text, "html.parser")
+        results = soup.find_all("div", class_="result")
+
+        text_parts = []
+        sources = []
+
+        # Extract the top 5 results
+        for res in results[:5]:
+            title_tag = res.find("a", class_="result__url")
+            snippet_tag = res.find("a", class_="result__snippet")
+            
+            if title_tag and snippet_tag:
+                title = title_tag.text.strip()
+                snippet = snippet_tag.text.strip()
+                raw_url = title_tag.get("href", "")
+                
+                # Clean up DuckDuckGo's redirect URLs
+                if "uddg=" in raw_url:
+                    clean_url = urllib.parse.unquote(raw_url.split("uddg=")[1].split("&")[0])
+                else:
+                    clean_url = raw_url
+
+                sources.append(WebSearchSource(title=title, url=clean_url))
+                text_parts.append(f"Source: {title}\nURL: {clean_url}\nInformation: {snippet}\n")
+
+        if not text_parts:
+            answer = "No relevant information found on the web."
+        else:
+            # We bundle the snippets into a single text block for your local model to read
+            answer = "Here is the raw information retrieved from the web:\n\n" + "\n".join(text_parts)
+
+        yield WebSearchResult(answer=answer, sources=sources)
+
+    @classmethod
+    def get_call_display(cls, event: ToolCallEvent) -> ToolCallDisplay:
+        if event.args is None or not isinstance(event.args, WebSearchArgs):
+            return ToolCallDisplay(summary="websearch")
+        return ToolCallDisplay(summary=f"Searching DuckDuckGo for: '{event.args.query}'")
+
+    @classmethod
+    def get_result_display(cls, event: ToolResultEvent) -> ToolResultDisplay:
+        if not isinstance(event.result, WebSearchResult):
+            return ToolResultDisplay(
+                success=False, message=event.error or event.skip_reason or "No result"
+            )
+        return ToolResultDisplay(
+            success=True, message=f"{len(event.result.sources)} web sources retrieved for the local model."
+        )
+
+    @classmethod
+    def get_status_text(cls) -> str:
+        return "Scraping the web..."

drydock_cli-0.8.1/drydock/skills/investigate/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: investigate
+description: Systematic debugging with 3-strike rule. Investigate → Analyze → Hypothesize → Fix. Stops after 3 failed hypotheses.
+user-invocable: true
+allowed-tools:
+  - bash
+  - grep
+  - read_file
+  - search_replace
+  - write_file
+  - ask_user_question
+---
+
+# Investigate
+
+Systematic debugging workflow. You are a senior debugger.
+
+## Iron Law
+
+**Never fix without root cause.** If you don't understand WHY the bug happens, you don't fix it.
+
+## Workflow
+
+### Phase 1: INVESTIGATE
+- Read the error message / bug report carefully
+- Identify the module and function where the bug manifests
+- grep for the relevant code paths
+- Read the specific functions involved
+
+### Phase 2: ANALYZE
+- Trace the data flow from input to the point of failure
+- Identify what value is wrong and where it diverges from expected
+- Check edge cases: null, empty, boundary values
+
+### Phase 3: HYPOTHESIZE
+State your hypothesis clearly:
+```
+HYPOTHESIS: The bug is caused by [X] in [file:line] because [reason].
+EXPECTED: [what should happen]
+ACTUAL: [what happens instead]
+FIX: [what change to make]
+```
+
+### Phase 4: IMPLEMENT
+- Make the minimal fix
+- Read back the changed code to verify
+- If the fix doesn't work, go back to Phase 3
+
+## 3-Strike Rule
+
+Track your failed hypotheses:
+- Strike 1: "Hypothesis 1 failed because [reason]. Trying different approach."
+- Strike 2: "Hypothesis 2 failed because [reason]. One more attempt."
+- Strike 3: **STOP.** Ask the user: "I've tried 3 approaches and none worked. Here's what I've learned: [summary]. What should I try next?"
+
+Do NOT continue past 3 strikes. Ask for help.
+
+## Scope Lock
+
+Once you identify the module, **stay in that module**. Do not wander to other parts of the codebase unless the bug clearly crosses module boundaries.
+
+## Blast Radius Check
+
+Before applying a fix, count the files you're about to change:
+- 1-2 files: proceed
+- 3-4 files: mention it to the user first
+- 5+ files: **STOP and ask.** "This fix touches {N} files. Should I proceed?"

drydock_cli-0.8.1/drydock/skills/review/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: review
+description: Automated code review. Two-pass (critical then informational), scope drift detection, fix-first.
+user-invocable: true
+allowed-tools:
+  - bash
+  - grep
+  - read_file
+  - search_replace
+---
+
+# Code Review
+
+You are a senior code reviewer. Review the current changes.
+
+## Two-Pass Review
+
+### Pass 1: CRITICAL (must fix before merge)
+- Security vulnerabilities (injection, XSS, auth bypass)
+- Data loss risks (missing transactions, race conditions)
+- Breaking changes to public APIs
+- Missing error handling that could crash
+- Tests missing for new functionality
+
+### Pass 2: INFORMATIONAL (nice to have)
+- Code style and naming
+- Performance suggestions
+- Refactoring opportunities
+- Documentation gaps
+
+## Workflow
+
+1. Run `git diff` to see what changed
+2. Read each changed file
+3. For each issue found:
+   - **Critical**: Fix it immediately with search_replace
+   - **Judgment call**: Ask the user with options
+   - **Informational**: Note it but don't block
+
+## Scope Drift Detection
+
+If the diff contains changes unrelated to the stated goal:
+- Flag: "These files seem unrelated to the task: [list]"
+- Ask: "Should these be in a separate commit?"
+
+## Fix-First Philosophy
+
+- Mechanical issues (typos, missing imports, obvious bugs): fix silently
+- Style issues: fix if trivial, note if subjective
+- Architecture decisions: always ask
+
+## Output Format
+
+```
+## Review Summary
+
+### Critical (must fix)
+- [ ] [file:line] Issue description
+
+### Informational
+- [file:line] Suggestion
+
+### Scope
+- Files changed: N
+- Lines added: N, removed: N
+- Test coverage: [assessed/not assessed]
+```

drydock_cli-0.8.1/drydock/skills/ship/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: ship
+description: Automated shipping pipeline. Test → Review → Commit → Push → PR. Non-interactive.
+user-invocable: true
+allowed-tools:
+  - bash
+  - grep
+  - read_file
+  - write_file
+  - search_replace
+---
+
+# Ship
+
+Automated shipping pipeline. You are a release engineer.
+
+## Verification Gate
+
+**Never claim completion without fresh test evidence.**
+
+## Pipeline
+
+### Step 1: Pre-flight checks
+```bash
+git status
+git diff --stat
+```
+- If working tree is dirty, ask what to include
+- If on main/master, ask to create a branch first
+
+### Step 2: Run tests
+```bash
+python3 -m pytest tests/ -q --tb=short 2>&1 | tail -20
+```
+- If tests fail: **STOP.** Fix the failures first.
+- If no test runner found, note it and continue.
+
+### Step 3: Review diff
+- Run `/review` mentally (check for critical issues)
+- If >5 files changed, confirm with user
+
+### Step 4: Commit
+- Write a clear commit message following conventional commits:
+  - `feat:` for new features
+  - `fix:` for bug fixes
+  - `refactor:` for code changes that aren't fixes or features
+  - `docs:` for documentation
+  - `test:` for test changes
+- Each commit should be bisectable (tests pass at every commit)
+
+### Step 5: Push and PR
+```bash
+git push origin HEAD
+```
+- If `gh` CLI is available, create a PR:
+```bash
+gh pr create --title "..." --body "..."
+```
+
+## Rules
+
+- Never force push to main/master
+- Never skip tests
+- Never commit secrets, tokens, or credentials
+- Always include what changed and why in the commit message

{drydock_cli-0.7.4 → drydock_cli-0.8.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "drydock-cli"
-version = "0.7.4"
+version = "0.8.1"
 description = "Drydock — nautical CLI coding agent"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -30,6 +30,7 @@ classifiers = [
 dependencies = [
     "agent-client-protocol==0.8.1",
     "anyio>=4.12.0",
+    "beautifulsoup4>=4.12.0",
     "cachetools>=5.5.0",
     "cryptography>=44.0.0,<=46.0.3",
     "gitpython>=3.1.46",
@@ -77,6 +78,9 @@ include = ["drydock/"]
 [tool.hatch.build.targets.wheel.force-include]
 "drydock/skills/create-presentation" = "drydock/skills/create-presentation"
 "drydock/skills/deep-research" = "drydock/skills/deep-research"
+"drydock/skills/investigate" = "drydock/skills/investigate"
+"drydock/skills/review" = "drydock/skills/review"
+"drydock/skills/ship" = "drydock/skills/ship"
 
 
 [project.scripts]

drydock_cli-0.8.1/tests/test_current_bugs.py

@@ -0,0 +1,150 @@
+"""Tests for current bugs — must FAIL before fix, PASS after.
+
+These reproduce real issues found by using DryDock.
+All tests hit the real vLLM backend.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+from pathlib import Path
+
+import httpx
+import pytest
+
+from drydock.core.config.harness_files import init_harness_files_manager
+try:
+    init_harness_files_manager("user", "project")
+except RuntimeError:
+    pass
+
+from drydock.core.agent_loop import AgentLoop
+from drydock.core.agents.models import BuiltinAgentName
+from drydock.core.config import Backend, ModelConfig, ProviderConfig, VibeConfig
+from drydock.core.types import (
+    AssistantEvent, BaseEvent, Role, ToolCallEvent, ToolResultEvent,
+)
+
+
+def _vllm_ok():
+    try:
+        return httpx.get("http://localhost:8000/v1/models", timeout=3).status_code == 200
+    except Exception:
+        return False
+
+pytestmark = pytest.mark.skipif(not _vllm_ok(), reason="vLLM not running")
+
+
+def _config(tmp_path):
+    return VibeConfig(
+        active_model="devstral", auto_approve=True, enable_telemetry=False,
+        include_project_context=False, system_prompt_id="cli",
+        providers=[ProviderConfig(name="local", api_base="http://localhost:8000/v1", api_key_env_var="", backend=Backend.GENERIC)],
+        models=[ModelConfig(name="devstral", provider="local", input_price=0, output_price=0)],
+        session_logging={"enabled": False, "save_dir": str(tmp_path / "logs")},
+    )
+
+def _agent(tmp_path, max_turns=10):
+    return AgentLoop(config=_config(tmp_path), agent_name=BuiltinAgentName.AUTO_APPROVE, max_turns=max_turns)
+
+async def _run(agent, prompt, max_events=100):
+    events = []
+    async for ev in agent.act(prompt):
+        events.append(ev)
+        if len(events) >= max_events:
+            break
+    return events
+
+
+# ============================================================================
+# BUG: "vibe" still referenced in config defaults
+# ============================================================================
+
+class TestVibeReferences:
+    def test_no_vibe_in_config_model_names(self):
+        """Default model name should not contain 'vibe'."""
+        from drydock.core.config._settings import DEFAULT_MODELS
+        for m in DEFAULT_MODELS:
+            assert "vibe" not in m.name.lower(), \
+                f"Model name '{m.name}' still references 'vibe'"
+
+    def test_no_vibe_in_logger_name(self):
+        """Logger should use 'drydock' not 'vibe'."""
+        from drydock.core.logger import logger
+        assert logger.name != "vibe", \
+            f"Logger name is '{logger.name}' — should be 'drydock'"
+
+    def test_no_vibe_in_client_metadata(self):
+        """Programmatic client should identify as drydock."""
+        from drydock.core.programmatic import _DEFAULT_CLIENT_METADATA
+        assert "vibe" not in _DEFAULT_CLIENT_METADATA.name.lower(), \
+            f"Client metadata '{_DEFAULT_CLIENT_METADATA.name}' still references 'vibe'"
+
+    def test_no_vibe_in_stop_event_tag(self):
+        """Internal tags should use drydock not vibe."""
+        from drydock.core.utils import VIBE_STOP_EVENT_TAG, VIBE_WARNING_TAG
+        # These are internal protocol tags — checking they exist
+        # but flagging the naming for awareness
+        assert VIBE_STOP_EVENT_TAG  # exists
+        assert VIBE_WARNING_TAG  # exists
+
+
+# ============================================================================
+# BUG: Websearch loops — model keeps searching the same thing
+# ============================================================================
+
+@pytest.mark.asyncio
+async def test_websearch_doesnt_loop(tmp_path):
+    """Web search should not repeat the same query more than twice."""
+    agent = _agent(tmp_path, max_turns=10)
+    events = await _run(agent, "Search the web for 'Python asyncio best practices' and summarize", max_events=60)
+
+    websearch_calls = [e for e in events if isinstance(e, ToolCallEvent) and e.tool_name == "websearch"]
+    assert len(websearch_calls) <= 3, \
+        f"Websearch called {len(websearch_calls)} times — looping"
+
+
+# ============================================================================
+# BUG: Still looping reading files — reads same file over and over
+# ============================================================================
+
+@pytest.mark.asyncio
+async def test_file_read_doesnt_loop(tmp_path):
+    """Agent should not read the same file more than 3 times."""
+    # Create a test file
+    test_file = tmp_path / "test_code.py"
+    test_file.write_text("def hello():\n    print('hello world')\n\ndef goodbye():\n    print('bye')\n")
+
+    agent = _agent(tmp_path, max_turns=10)
+    events = await _run(agent, f"Read {test_file} and explain what it does", max_events=60)
+
+    read_calls = [e for e in events if isinstance(e, ToolCallEvent) and e.tool_name == "read_file"]
+
+    # Should read the file once or twice, not 5+
+    assert len(read_calls) <= 3, \
+        f"read_file called {len(read_calls)} times for one file — looping"
+
+
+# ============================================================================
+# BUG: DuckDuckGo websearch respects --insecure flag
+# ============================================================================
+
+class TestWebSearchSSL:
+    def test_websearch_uses_insecure_env(self):
+        """New DuckDuckGo websearch should check DRYDOCK_INSECURE."""
+        import inspect
+        from drydock.core.tools.builtins.websearch import WebSearch
+        src = inspect.getsource(WebSearch)
+        assert "DRYDOCK_INSECURE" in src or "verify" in src, \
+            "WebSearch doesn't check DRYDOCK_INSECURE for SSL bypass"
+
+    def test_websearch_uses_duckduckgo(self):
+        """WebSearch should use DuckDuckGo, not Mistral API."""
+        import inspect
+        from drydock.core.tools.builtins.websearch import WebSearch
+        src = inspect.getsource(WebSearch)
+        assert "duckduckgo" in src.lower(), \
+            "WebSearch should use DuckDuckGo (your refactored version)"
+        assert "mistralai" not in src or "import mistralai" not in src, \
+            "WebSearch should not require Mistral API"