drydock-cli 3.0.61__tar.gz → 3.0.63__tar.gz

{drydock_cli-3.0.61/drydock_cli.egg-info → drydock_cli-3.0.63}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.61
+Version: 3.0.63
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -18,6 +18,8 @@ Requires-Dist: pytest; extra == "dev"
 Requires-Dist: pytest-timeout; extra == "dev"
 Requires-Dist: ruff; extra == "dev"
 Requires-Dist: pyright; extra == "dev"
+Provides-Extra: pdf
+Requires-Dist: pypdf>=4; extra == "pdf"
 Dynamic: license-file
 
 # ⚓ Drydock
@@ -87,6 +89,8 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/<name>` | Run a skill |
 | `/loop <count> <prompt>` | Repeat a prompt N times (Esc stops) |
 | `/mcp` | List connected MCP servers + their tools |
+| `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
+| `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
 | `/model` · `/cwd` | Show/set model & endpoint · working directory |
 | `/undo` · `/back` | Revert the last write · rewind the last turn |
 | `/compact` · `/status` · `/clear` | Shrink context · session stats · reset |
@@ -103,9 +107,10 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 
 Once built, the agent **automatically** retrieves from it (read-only `Knowledge`
 tool) when a question touches your material. Ingests text formats
-(`.md .txt .py .js .json .yaml .sql …`); convert PDFs/Word to text first
-(e.g. `pdftotext file.pdf file.txt`). The index is a single JSON at
-`<project>/.drydock/graphrag.json` — clean-room, stdlib-only, no embeddings.
+(`.md .txt .py .js .json .yaml .sql …`) **plus PDF and Word (`.docx`)**. `.docx`
+needs nothing extra; PDF uses the `pdftotext` binary (poppler) if present, else
+`pip install drydock-cli[pdf]` (pypdf). The index is a single JSON at
+`<project>/.drydock/graphrag.json` — clean-room, no embeddings.
 
 ### Custom skills
 
@@ -117,6 +122,21 @@ tool) when a question touches your material. Ingests text formats
 Skills are markdown files in `~/.drydock/skills/` (personal) or
 `<project>/.drydock/skills/` (project); `/skills new` writes one for you.
 
+### RMF automation (NIST SP 800-53)
+
+For Risk Management Framework work, Drydock can ingest the NIST SP 800-53 Rev 5
+control catalog into the knowledge base and ships four RMF skills — all
+**100% local** for CUI/sensitive systems.
+
+```
+/rmf bootstrap            # one-time: fetch + ingest the 800-53 catalog (offline after)
+/graphrag build ./ssp     # ingest your own SSP/POA&M (PDF/Word/text)
+/rmf-control AC-2         # look up a control
+/rmf-categorize ...       # FIPS 199 categorization + tailored baseline
+/rmf-review AC-2          # review an SSP implementation statement vs 800-53A
+/rmf-poam <finding>       # generate a POA&M entry from a scan/STIG finding
+```
+
 ## Install
 
 ```bash

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/README.md

@@ -65,6 +65,8 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/<name>` | Run a skill |
 | `/loop <count> <prompt>` | Repeat a prompt N times (Esc stops) |
 | `/mcp` | List connected MCP servers + their tools |
+| `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
+| `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
 | `/model` · `/cwd` | Show/set model & endpoint · working directory |
 | `/undo` · `/back` | Revert the last write · rewind the last turn |
 | `/compact` · `/status` · `/clear` | Shrink context · session stats · reset |
@@ -81,9 +83,10 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 
 Once built, the agent **automatically** retrieves from it (read-only `Knowledge`
 tool) when a question touches your material. Ingests text formats
-(`.md .txt .py .js .json .yaml .sql …`); convert PDFs/Word to text first
-(e.g. `pdftotext file.pdf file.txt`). The index is a single JSON at
-`<project>/.drydock/graphrag.json` — clean-room, stdlib-only, no embeddings.
+(`.md .txt .py .js .json .yaml .sql …`) **plus PDF and Word (`.docx`)**. `.docx`
+needs nothing extra; PDF uses the `pdftotext` binary (poppler) if present, else
+`pip install drydock-cli[pdf]` (pypdf). The index is a single JSON at
+`<project>/.drydock/graphrag.json` — clean-room, no embeddings.
 
 ### Custom skills
 
@@ -95,6 +98,21 @@ tool) when a question touches your material. Ingests text formats
 Skills are markdown files in `~/.drydock/skills/` (personal) or
 `<project>/.drydock/skills/` (project); `/skills new` writes one for you.
 
+### RMF automation (NIST SP 800-53)
+
+For Risk Management Framework work, Drydock can ingest the NIST SP 800-53 Rev 5
+control catalog into the knowledge base and ships four RMF skills — all
+**100% local** for CUI/sensitive systems.
+
+```
+/rmf bootstrap            # one-time: fetch + ingest the 800-53 catalog (offline after)
+/graphrag build ./ssp     # ingest your own SSP/POA&M (PDF/Word/text)
+/rmf-control AC-2         # look up a control
+/rmf-categorize ...       # FIPS 199 categorization + tailored baseline
+/rmf-review AC-2          # review an SSP implementation statement vs 800-53A
+/rmf-poam <finding>       # generate a POA&M entry from a scan/STIG finding
+```
+
 ## Install
 
 ```bash

drydock_cli-3.0.63/drydock/builtin_skills/rmf-categorize.md

@@ -0,0 +1,16 @@
+---
+name: rmf-categorize
+description: Categorize a system (FIPS 199) and recommend a tailored 800-53 baseline
+---
+Help categorize a system for RMF Steps 1-3. If the user has not given the system
+description and the data types it handles, ask for them first. Then:
+1. Recommend a FIPS 199 security categorization (Low / Moderate / High) for
+   confidentiality, integrity, and availability, each with a brief justification,
+   and the resulting overall (high-water-mark) impact level.
+2. Recommend the tailored initial NIST SP 800-53 baseline for that level — use the
+   Knowledge tool to cite the relevant control families and key control IDs.
+3. Note controls likely tailored OUT given the system boundary (e.g., wireless
+   access controls for an air-gapped network).
+Be concrete and cite control IDs.
+
+System details: $ARGS

drydock_cli-3.0.63/drydock/builtin_skills/rmf-control.md

@@ -0,0 +1,10 @@
+---
+name: rmf-control
+description: Look up a NIST SP 800-53 control from the knowledge base
+---
+Your FIRST action must be to call the Knowledge tool with the query "$ARGS" —
+do this before writing anything; do not answer from memory. From the passages it
+returns, summarize the control: ID and title, family, the control statement, and
+its key assessment objectives. ONLY if the Knowledge tool returns no passages at
+all may you say the control is not in the knowledge base (then suggest /rmf
+bootstrap). Control to look up: $ARGS

drydock_cli-3.0.63/drydock/builtin_skills/rmf-poam.md

@@ -0,0 +1,11 @@
+---
+name: rmf-poam
+description: Generate a POA&M entry from a finding / vulnerability / failed STIG
+---
+First call the Knowledge tool to map this finding to the impacted system
+component(s) and the specific NIST SP 800-53 control(s) it makes non-compliant:
+$ARGS. Then generate a formatted POA&M (Plan of Action & Milestones) entry with:
+Weakness description; Source (scan / STIG / assessment); Affected component(s);
+Non-compliant control(s); Severity; Recommended remediation with concrete
+technical milestones; estimated remediation timeline. Be specific (e.g., "Apply
+patch X to Server Y to satisfy SI-2"). Consult the Knowledge tool before writing.

drydock_cli-3.0.63/drydock/builtin_skills/rmf-review.md

@@ -0,0 +1,11 @@
+---
+name: rmf-review
+description: Review an SSP implementation statement against 800-53A objectives
+---
+First call the Knowledge tool to retrieve the control statement and assessment
+objectives (NIST SP 800-53A) for: $ARGS. Then review the implementation
+statement(s) for those control(s): flag where they are incomplete, lack
+specificity (who / what / how / how often), fail to address part of the control,
+or omit continuous-monitoring requirements. Output: a one-line verdict
+(adequate / needs work), then bulleted gaps, each mapped to the assessment
+objective it fails to satisfy. Always consult the Knowledge tool before judging.

drydock_cli-3.0.63/drydock/extract.py

@@ -0,0 +1,94 @@
+"""Document text extraction for GraphRAG ingestion — PDF + Word (.docx).
+
+Kept clean-room and dependency-light:
+  • .docx is a zip of XML, so we read it with STDLIB only (zipfile + ElementTree)
+    — no dependency.
+  • .pdf uses whatever the system already has: the `pdftotext` binary (poppler)
+    if present, else the optional `pypdf` package (`pip install drydock-cli[pdf]`).
+
+Returns None when a document can't be read (unsupported, corrupt, or no PDF
+backend available) so ingestion skips it cleanly instead of failing.
+
+All logic original to Drydock.
+"""
+from __future__ import annotations
+
+import subprocess
+import xml.etree.ElementTree as ET
+import zipfile
+from pathlib import Path
+
+# Extensions we can pull text out of (beyond the plain-text formats GraphRAG
+# already reads directly).
+EXTRACTABLE_EXT = {".pdf", ".docx"}
+
+_W = "{http://schemas.openxmlformats.org/wordprocessingml/2006/main}"
+
+
+def _extract_docx(path: str | Path) -> str | None:
+    """Pull paragraph text from a .docx (stdlib only). Each <w:p> is a paragraph;
+    its text lives in <w:t> runs."""
+    try:
+        with zipfile.ZipFile(path) as z:
+            xml = z.read("word/document.xml")
+    except (zipfile.BadZipFile, KeyError, OSError):
+        return None
+    try:
+        root = ET.fromstring(xml)
+    except ET.ParseError:
+        return None
+    paras: list[str] = []
+    for p in root.iter(f"{_W}p"):
+        runs = [t.text for t in p.iter(f"{_W}t") if t.text]
+        if runs:
+            paras.append("".join(runs))
+    text = "\n\n".join(paras).strip()
+    return text or None
+
+
+def _extract_pdf(path: str | Path) -> str | None:
+    """Extract text from a PDF: try the `pdftotext` binary first, then `pypdf`.
+    Returns None if neither is available or the PDF has no extractable text."""
+    # 1) pdftotext (poppler) — fast and common on Linux/macOS.
+    try:
+        r = subprocess.run(
+            ["pdftotext", "-q", str(path), "-"],
+            capture_output=True, text=True, timeout=120,
+        )
+        if r.returncode == 0 and r.stdout.strip():
+            return r.stdout
+    except (FileNotFoundError, subprocess.TimeoutExpired, OSError):
+        pass
+    # 2) pypdf (optional dependency: drydock-cli[pdf]).
+    try:
+        import pypdf
+
+        reader = pypdf.PdfReader(str(path))
+        text = "\n\n".join((pg.extract_text() or "") for pg in reader.pages).strip()
+        return text or None
+    except Exception:  # noqa: BLE001 — optional dep missing / unreadable PDF
+        return None
+
+
+def extract_document(path: str | Path) -> str | None:
+    """Extract text from a supported document (.pdf/.docx), or None."""
+    ext = Path(path).suffix.lower()
+    if ext == ".docx":
+        return _extract_docx(path)
+    if ext == ".pdf":
+        return _extract_pdf(path)
+    return None
+
+
+def pdf_backend_available() -> bool:
+    """Whether a PDF can be extracted at all (pdftotext binary or pypdf)."""
+    from shutil import which
+
+    if which("pdftotext"):
+        return True
+    try:
+        import pypdf  # noqa: F401
+
+        return True
+    except ImportError:
+        return False

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/drydock/graphrag.py

@@ -26,6 +26,8 @@ import json
 import os
 import re
 from collections import Counter, defaultdict
+
+from drydock import extract
 from pathlib import Path
 
 # Files we ingest as text. Everything else (binaries, images) is skipped.
@@ -50,6 +52,9 @@ _RE_IDENT = re.compile(r"\b([a-zA-Z_][a-zA-Z0-9_]*(?:[_./][a-zA-Z0-9_]+)+)\b")
 _RE_CAMEL = re.compile(r"\b([A-Z][a-z0-9]+(?:[A-Z][a-z0-9]+)+)\b")
 _RE_PROPER = re.compile(r"\b([A-Z][a-zA-Z0-9]+(?:[ \t]+[A-Z][a-zA-Z0-9]+){0,3})\b")
 _RE_ACRONYM = re.compile(r"\b([A-Z]{2,6})\b")
+# Dotted/hyphenated codes like control IDs (AC-2, AC-2.1, SI-4), CVEs, STIG IDs —
+# these tokenize into too-short pieces otherwise, so a lookup by the code misses.
+_RE_CODE = re.compile(r"\b([A-Za-z]{1,6}-\d+(?:\.\d+)*)\b")
 _RE_WORD = re.compile(r"[a-zA-Z0-9_]+")
 
 
@@ -61,7 +66,7 @@ def default_store_path(cwd: str) -> Path:
 def extract_entities(text: str) -> list[str]:
     """Heuristic entity extraction → normalized (lowercased) entity keys."""
     found: set[str] = set()
-    for rx in (_RE_BACKTICK, _RE_IDENT, _RE_CAMEL, _RE_PROPER, _RE_ACRONYM):
+    for rx in (_RE_BACKTICK, _RE_IDENT, _RE_CAMEL, _RE_PROPER, _RE_ACRONYM, _RE_CODE):
         for m in rx.findall(text):
             e = m.strip().lower()
             # Drop trivial / stopword-only entities and overlong noise.
@@ -106,7 +111,8 @@ def _iter_text_files(paths: list[str]):
                 dirs[:] = [d for d in dirs if d not in _SKIP_DIRS]
                 for f in files:
                     fp = Path(root) / f
-                    if fp.suffix.lower() in _TEXT_EXT or fp.suffix == "":
+                    ext = fp.suffix.lower()
+                    if ext in _TEXT_EXT or ext in extract.EXTRACTABLE_EXT or fp.suffix == "":
                         yield fp
 
 
@@ -119,10 +125,15 @@ def _ingest_files(paths, cwd, chunks, entity_chunks, edges, skip_sources):
         rel = os.path.relpath(str(fp), cwd)
         if rel in skip_sources:
             continue
-        try:
-            text = fp.read_text("utf-8", "ignore")
-        except OSError:
-            continue
+        if fp.suffix.lower() in extract.EXTRACTABLE_EXT:
+            text = extract.extract_document(fp)  # PDF/Word → text (or None)
+            if not text:
+                continue  # unreadable / no PDF backend — skip cleanly
+        else:
+            try:
+                text = fp.read_text("utf-8", "ignore")
+            except OSError:
+                continue
         if not text.strip():
             continue
         added += 1

drydock_cli-3.0.63/drydock/rmf.py

@@ -0,0 +1,126 @@
+"""RMF automation — NIST SP 800-53 catalog ingestion for GraphRAG.
+
+Local-first: fetch the machine-readable OSCAL catalog once (over the network),
+flatten each control to readable text (id, family, statement, guidance,
+assessment objective), and ingest it into the project GraphRAG knowledge base so
+the agent can look up and reason over controls offline via the `Knowledge` tool.
+
+Pairs with the bundled RMF skills (rmf-categorize / rmf-review / rmf-poam /
+rmf-control) and the user's own ingested SSP / POA&M / scan artifacts.
+
+Stdlib only (urllib + json). All logic original to Drydock.
+"""
+from __future__ import annotations
+
+import json
+import re
+import urllib.request
+from pathlib import Path
+
+# NIST's official OSCAL content (public domain). Rev 5 catalog.
+DEFAULT_CATALOG_URL = (
+    "https://raw.githubusercontent.com/usnistgov/oscal-content/main/"
+    "nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json"
+)
+
+_INSERT = re.compile(r"\{\{\s*insert:\s*param,\s*([A-Za-z0-9_.\-]+)\s*\}\}")
+# Part names worth surfacing to the model, in order, with a readable label.
+_PART_LABELS = [
+    ("statement", "Statement"),
+    ("guidance", "Guidance"),
+    ("assessment-objective", "Assessment objective"),
+]
+
+
+def fetch_catalog(dest: str | Path, *, url: str = DEFAULT_CATALOG_URL,
+                  timeout: float = 60.0) -> Path:
+    """Download the OSCAL catalog JSON to dest. Returns the path."""
+    dest = Path(dest)
+    dest.parent.mkdir(parents=True, exist_ok=True)
+    req = urllib.request.Request(url, headers={"User-Agent": "drydock-rmf"})
+    with urllib.request.urlopen(req, timeout=timeout) as r:  # noqa: S310 (NIST, trusted)
+        dest.write_bytes(r.read())
+    return dest
+
+
+def _resolve(prose: str, params: dict) -> str:
+    """Replace OSCAL {{ insert: param, id }} markers with the param's label."""
+    def sub(m):
+        p = params.get(m.group(1))
+        return f"[{p}]" if p else "[assignment]"
+    return _INSERT.sub(sub, prose or "")
+
+
+def _part_prose(part: dict, params: dict) -> str:
+    """All prose in a part and its sub-parts, joined."""
+    bits = []
+    if part.get("prose"):
+        bits.append(_resolve(part["prose"], params))
+    for sub in part.get("parts", []) or []:
+        t = _part_prose(sub, params)
+        if t:
+            bits.append(t)
+    return "\n".join(bits).strip()
+
+
+def flatten_control(control: dict, family: str) -> str:
+    """Render one control as a readable text block for ingestion."""
+    params = {p["id"]: p.get("label") or (p.get("select") or {}).get("how-many")
+              for p in control.get("params", []) or []}
+    cid = control.get("id", "").upper()
+    lines = [f"{cid} — {control.get('title', '')}  (Family: {family})"]
+    parts = {p.get("name"): p for p in control.get("parts", []) or []}
+    for name, label in _PART_LABELS:
+        if name in parts:
+            prose = _part_prose(parts[name], params)
+            if prose:
+                lines.append(f"{label}: {prose}")
+    return "\n".join(lines)
+
+
+def catalog_to_family_docs(catalog: dict, dest_dir: str | Path,
+                           families: list[str] | None = None) -> list[Path]:
+    """Write one markdown doc per control family (e.g. ac.md). Returns paths.
+    `families` (lowercase ids like 'ac') filters which to write; None = all."""
+    dest_dir = Path(dest_dir)
+    dest_dir.mkdir(parents=True, exist_ok=True)
+    want = {f.lower() for f in families} if families else None
+    written: list[Path] = []
+    for group in catalog.get("catalog", {}).get("groups", []) or []:
+        fid = group.get("id", "")
+        if want is not None and fid.lower() not in want:
+            continue
+        title = group.get("title", fid)
+        blocks = [f"# {title} ({fid.upper()}) — NIST SP 800-53 Rev 5\n"]
+        for control in group.get("controls", []) or []:
+            blocks.append(flatten_control(control, title))
+            # nested enhancements
+            for enh in control.get("controls", []) or []:
+                blocks.append(flatten_control(enh, title))
+        out = dest_dir / f"{fid}.md"
+        out.write_text("\n\n".join(blocks), encoding="utf-8")
+        written.append(out)
+    return written
+
+
+def rmf_dir(cwd: str) -> Path:
+    return Path(cwd) / ".drydock" / "rmf"
+
+
+def bootstrap(cwd: str, *, families: list[str] | None = None,
+              source: str | Path | None = None) -> dict:
+    """Fetch (if needed) + flatten the 800-53 catalog into <cwd>/.drydock/rmf and
+    ingest it into the GraphRAG KB. Returns {families, controls_docs, **kb_stats}.
+    `source` reuses an already-downloaded catalog JSON (offline)."""
+    from drydock import graphrag
+
+    base = rmf_dir(cwd)
+    cat_path = Path(source) if source else base / "catalog.json"
+    if not cat_path.exists():
+        fetch_catalog(cat_path)
+    catalog = json.loads(Path(cat_path).read_text("utf-8"))
+    docs = catalog_to_family_docs(catalog, base / "800-53", families)
+    store = graphrag.default_store_path(cwd)
+    stats = graphrag.add_to_index([str(d) for d in docs], store, cwd=cwd)
+    stats["family_docs"] = len(docs)
+    return stats

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/drydock/skills.py

@@ -74,7 +74,13 @@ def _parse(path: Path) -> Skill | None:
 
 
 def skills_dirs(cwd: str) -> list[Path]:
-    return [Path.home() / ".drydock" / "skills", Path(cwd) / ".drydock" / "skills"]
+    # Built-in skills ship with the package (e.g. the RMF skills); user + project
+    # dirs come AFTER so they override a built-in of the same name.
+    return [
+        Path(__file__).parent / "builtin_skills",
+        Path.home() / ".drydock" / "skills",
+        Path(cwd) / ".drydock" / "skills",
+    ]
 
 
 def create_skill(name: str, body: str, *, description: str = "", scope: str = "user",

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/drydock/tui/app.py

@@ -495,12 +495,15 @@ class DrydockApp(App):
                 "  /skills          list skills · /skills new <name> <prompt> to create one\n"
                 "  /loop            /loop <count> <prompt> — repeat a prompt (Esc stops)\n"
                 "  /mcp             list connected MCP servers and their tools\n"
+                "  /rmf             RMF automation — /rmf bootstrap, then /rmf-control etc.\n"
                 "  /clear           reset the conversation\n"
                 "  /quit            exit\n"
                 "Type a task and press Enter. ↑/↓ recall history · Esc stops · Ctrl+O expands tools."
             )
         elif cmd == "/mcp":
             self._cmd_mcp()
+        elif cmd == "/rmf":
+            self._cmd_rmf(arg)
         elif cmd == "/loop":
             self._cmd_loop(arg)
         elif cmd == "/skills":
@@ -510,6 +513,57 @@ class DrydockApp(App):
         else:
             self._mount(ErrorMessage(f"unknown command: {cmd} (try /help)"))
 
+    def _cmd_rmf(self, arg: str) -> None:
+        """RMF automation: bootstrap the NIST 800-53 catalog into the knowledge
+        base and surface the bundled RMF skills."""
+        from drydock import rmf
+
+        parts = arg.split()
+        sub = parts[0].lower() if parts else ""
+        cwd = self.config.get("cwd") or "."
+        if sub == "bootstrap":
+            families = [f.lower() for f in parts[1:]] or None
+            scope = ("families " + ", ".join(families)) if families else "all 20 families"
+            self._info(
+                f"Ingesting the NIST SP 800-53 Rev 5 catalog ({scope}) into the "
+                "knowledge base — one-time download + index, this can take ~30s…"
+            )
+            self.run_worker(lambda: self._rmf_bootstrap(cwd, families), thread=True)
+        elif sub in ("", "help", "status"):
+            cat = rmf.rmf_dir(cwd) / "catalog.json"
+            have = "downloaded" if cat.exists() else "not downloaded yet"
+            self._info(
+                "RMF automation — automate Risk Management Framework work.\n"
+                f"  Catalog (NIST 800-53 Rev 5): {have} ({cat})\n"
+                "  /rmf bootstrap [families…]   ingest the control catalog (e.g. "
+                "/rmf bootstrap ac si, or no args for all)\n"
+                "Skills (run as /<name>):\n"
+                "  /rmf-control <id>      look up a control (e.g. /rmf-control AC-2)\n"
+                "  /rmf-categorize …      FIPS 199 categorization + tailored baseline\n"
+                "  /rmf-review <control>  review an SSP implementation statement\n"
+                "  /rmf-poam <finding>    generate a POA&M entry\n"
+                "Ingest your own SSPs/POA&Ms (PDF/Word/text) with /graphrag build "
+                "<path> so the skills can cross-reference them."
+            )
+        else:
+            self._info("usage:  /rmf bootstrap [families…]  ·  /rmf status")
+
+    def _rmf_bootstrap(self, cwd: str, families) -> None:
+        """Worker-thread body: fetch + ingest the catalog, report back on the UI."""
+        from drydock import rmf
+
+        try:
+            stats = rmf.bootstrap(cwd, families=families)
+            msg = (
+                f"✓ RMF catalog ingested: {stats['family_docs']} family doc(s), "
+                f"{stats['chunks']} chunks total in the knowledge base. Controls are "
+                "now queryable — try /rmf-control AC-2 or ask about a control."
+            )
+        except Exception as e:  # noqa: BLE001
+            msg = (f"RMF bootstrap failed: {e}. (Needs internet for the one-time "
+                   "catalog download; after that it works offline.)")
+        self.call_from_thread(self._info, msg)
+
     def _cmd_mcp(self) -> None:
         """List connected MCP servers and the tools they expose."""
         from drydock import mcp

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/drydock/tui/widgets.py

@@ -153,7 +153,7 @@ class PromptHistory:
 # completes the prefix.
 SLASH_COMMANDS = [
     "/help", "/model", "/cwd", "/undo", "/back", "/stop", "/status",
-    "/compact", "/graphrag", "/skills", "/loop", "/mcp", "/clear", "/quit",
+    "/compact", "/graphrag", "/skills", "/loop", "/mcp", "/rmf", "/clear", "/quit",
 ]
 
 

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/drydock/tuning.py

@@ -217,7 +217,7 @@ _DRYDOCK_COMMANDS_HELP = (
     "folder), `/graphrag add <path>` to add more, `/graphrag query <q>` to test "
     "it, `/graphrag status`, `/graphrag clear`. Once built, you automatically use "
     "the `Knowledge` tool to draw on it. It ingests text formats (md/txt/code/"
-    "json/yaml/…); PDFs/Word must be converted to text first.\n"
+    "json/yaml/…) plus PDF and Word (.docx) directly.\n"
     "- Custom skills (reusable `/<name>` prompts): `/skills new <name> <prompt "
     "text>` creates one (use $ARGS in the prompt for trailing input); `/skills` "
     "lists them; then they run it as `/<name>`.\n"

{drydock_cli-3.0.61 → drydock_cli-3.0.63/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.61
+Version: 3.0.63
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -18,6 +18,8 @@ Requires-Dist: pytest; extra == "dev"
 Requires-Dist: pytest-timeout; extra == "dev"
 Requires-Dist: ruff; extra == "dev"
 Requires-Dist: pyright; extra == "dev"
+Provides-Extra: pdf
+Requires-Dist: pypdf>=4; extra == "pdf"
 Dynamic: license-file
 
 # ⚓ Drydock
@@ -87,6 +89,8 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/<name>` | Run a skill |
 | `/loop <count> <prompt>` | Repeat a prompt N times (Esc stops) |
 | `/mcp` | List connected MCP servers + their tools |
+| `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
+| `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
 | `/model` · `/cwd` | Show/set model & endpoint · working directory |
 | `/undo` · `/back` | Revert the last write · rewind the last turn |
 | `/compact` · `/status` · `/clear` | Shrink context · session stats · reset |
@@ -103,9 +107,10 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 
 Once built, the agent **automatically** retrieves from it (read-only `Knowledge`
 tool) when a question touches your material. Ingests text formats
-(`.md .txt .py .js .json .yaml .sql …`); convert PDFs/Word to text first
-(e.g. `pdftotext file.pdf file.txt`). The index is a single JSON at
-`<project>/.drydock/graphrag.json` — clean-room, stdlib-only, no embeddings.
+(`.md .txt .py .js .json .yaml .sql …`) **plus PDF and Word (`.docx`)**. `.docx`
+needs nothing extra; PDF uses the `pdftotext` binary (poppler) if present, else
+`pip install drydock-cli[pdf]` (pypdf). The index is a single JSON at
+`<project>/.drydock/graphrag.json` — clean-room, no embeddings.
 
 ### Custom skills
 
@@ -117,6 +122,21 @@ tool) when a question touches your material. Ingests text formats
 Skills are markdown files in `~/.drydock/skills/` (personal) or
 `<project>/.drydock/skills/` (project); `/skills new` writes one for you.
 
+### RMF automation (NIST SP 800-53)
+
+For Risk Management Framework work, Drydock can ingest the NIST SP 800-53 Rev 5
+control catalog into the knowledge base and ships four RMF skills — all
+**100% local** for CUI/sensitive systems.
+
+```
+/rmf bootstrap            # one-time: fetch + ingest the 800-53 catalog (offline after)
+/graphrag build ./ssp     # ingest your own SSP/POA&M (PDF/Word/text)
+/rmf-control AC-2         # look up a control
+/rmf-categorize ...       # FIPS 199 categorization + tailored baseline
+/rmf-review AC-2          # review an SSP implementation statement vs 800-53A
+/rmf-poam <finding>       # generate a POA&M entry from a scan/STIG finding
+```
+
 ## Install
 
 ```bash

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/drydock_cli.egg-info/SOURCES.txt

@@ -10,16 +10,23 @@ drydock/cli.py
 drydock/compaction.py
 drydock/config.py
 drydock/detect.py
+drydock/extract.py
 drydock/gittools.py
 drydock/graphrag.py
 drydock/guards.py
 drydock/loop_detect.py
 drydock/mcp.py
 drydock/providers.py
+drydock/rmf.py
 drydock/skills.py
 drydock/tool_registry.py
 drydock/tuning.py
 drydock/web.py
+drydock/builtin_skills/__init__.py
+drydock/builtin_skills/rmf-categorize.md
+drydock/builtin_skills/rmf-control.md
+drydock/builtin_skills/rmf-poam.md
+drydock/builtin_skills/rmf-review.md
 drydock/tools/__init__.py
 drydock/tui/__init__.py
 drydock/tui/app.py
@@ -47,6 +54,7 @@ tests/test_context_limit_config.py
 tests/test_detect.py
 tests/test_dispatch.py
 tests/test_empty_response.py
+tests/test_extract.py
 tests/test_failure_loop.py
 tests/test_first_run_setup.py
 tests/test_gittools.py
@@ -60,6 +68,7 @@ tests/test_oneshot_unreachable.py
 tests/test_plan_autocontinue.py
 tests/test_providers_unreachable.py
 tests/test_read_index.py
+tests/test_rmf.py
 tests/test_runaway_repetition.py
 tests/test_skills.py
 tests/test_stop.py

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/drydock_cli.egg-info/requires.txt

@@ -6,3 +6,6 @@ pytest
 pytest-timeout
 ruff
 pyright
+
+[pdf]
+pypdf>=4

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.61"
+version = "3.0.63"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -24,11 +24,18 @@ Issues = "https://github.com/fbobe321/drydock/issues"
 [tool.setuptools.packages.find]
 include = ["drydock*"]
 
+[tool.setuptools.package-data]
+# Ship the bundled skill prompts (RMF, etc.) inside the wheel.
+"drydock.builtin_skills" = ["*.md"]
+
 [project.scripts]
 drydock = "drydock.cli:main"
 
 [project.optional-dependencies]
 dev = ["pytest", "pytest-timeout", "ruff", "pyright"]
+# PDF ingestion fallback when the `pdftotext` binary (poppler) isn't installed.
+# .docx needs nothing extra (stdlib zip/xml). `pip install drydock-cli[pdf]`.
+pdf = ["pypdf>=4"]
 
 [tool.ruff]
 target-version = "py312"

drydock_cli-3.0.63/tests/test_extract.py

@@ -0,0 +1,71 @@
+"""PDF + Word (.docx) document extraction for GraphRAG ingestion."""
+from __future__ import annotations
+
+import zipfile
+
+import pytest
+
+from drydock import extract, graphrag
+
+
+def _make_docx(path, text):
+    doc = ('<?xml version="1.0"?><w:document xmlns:w='
+           '"http://schemas.openxmlformats.org/wordprocessingml/2006/main">'
+           f'<w:body><w:p><w:r><w:t>{text}</w:t></w:r></w:p></w:body></w:document>')
+    with zipfile.ZipFile(path, "w") as z:
+        z.writestr("word/document.xml", doc)
+
+
+def _make_pdf(path, text):
+    objs = [b"<< /Type /Catalog /Pages 2 0 R >>",
+            b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+            b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R "
+            b"/Resources << /Font << /F1 5 0 R >> >> >>"]
+    stream = b"BT /F1 18 Tf 72 700 Td (" + text.encode() + b") Tj ET"
+    objs.append(b"<< /Length " + str(len(stream)).encode() + b" >>\nstream\n" + stream + b"\nendstream")
+    objs.append(b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>")
+    out = b"%PDF-1.4\n"; offs = []
+    for i, o in enumerate(objs, 1):
+        offs.append(len(out)); out += str(i).encode() + b" 0 obj\n" + o + b"\nendobj\n"
+    x = len(out); out += b"xref\n0 " + str(len(objs) + 1).encode() + b"\n0000000000 65535 f \n"
+    for o in offs:
+        out += ("%010d 00000 n \n" % o).encode()
+    out += (b"trailer\n<< /Size " + str(len(objs) + 1).encode() + b" /Root 1 0 R >>\n"
+            b"startxref\n" + str(x).encode() + b"\n%%EOF")
+    path.write_bytes(out)
+
+
+def test_docx_extraction(tmp_path):
+    p = tmp_path / "d.docx"
+    _make_docx(p, "The Nimbus service uses the Falcon-Token header.")
+    assert extract.extract_document(p) == "The Nimbus service uses the Falcon-Token header."
+
+
+def test_pdf_extraction(tmp_path):
+    if not extract.pdf_backend_available():
+        pytest.skip("no PDF backend (pdftotext/pypdf) available")
+    p = tmp_path / "m.pdf"
+    _make_pdf(p, "Refunds via the Zephyr gateway.")
+    out = extract.extract_document(p)
+    assert out and "Zephyr gateway" in out
+
+
+def test_unsupported_and_corrupt_return_none(tmp_path):
+    assert extract.extract_document(tmp_path / "x.png") is None
+    bad = tmp_path / "bad.docx"; bad.write_text("not a zip")
+    assert extract.extract_document(bad) is None
+
+
+def test_graphrag_ingests_docx_and_pdf(tmp_path):
+    _make_docx(tmp_path / "spec.docx", "The Nimbus API uses the Falcon-Token header for auth.")
+    if extract.pdf_backend_available():
+        _make_pdf(tmp_path / "manual.pdf", "Refunds are issued via the Zephyr gateway.")
+    store = tmp_path / ".drydock" / "graphrag.json"
+    graphrag.build_index(["."], store, cwd=str(tmp_path))
+    idx = graphrag.load_index(store)
+    srcs = graphrag.sources(idx)
+    assert "spec.docx" in srcs
+    assert graphrag.query_index(idx, "Falcon-Token header")["chunks"][0]["source"] == "spec.docx"
+    if extract.pdf_backend_available():
+        assert "manual.pdf" in srcs
+        assert graphrag.query_index(idx, "refunds Zephyr gateway")["chunks"][0]["source"] == "manual.pdf"

drydock_cli-3.0.63/tests/test_rmf.py

@@ -0,0 +1,51 @@
+"""RMF: NIST 800-53 catalog flatten + ingest. Uses a tiny synthetic OSCAL catalog
+so the test is offline + fast (no 10 MB download)."""
+from __future__ import annotations
+
+import json
+
+from drydock import rmf, graphrag, skills
+
+_CATALOG = {"catalog": {"groups": [{
+    "id": "ac", "title": "Access Control", "controls": [
+        {"id": "ac-2", "title": "Account Management",
+         "params": [{"id": "ac-2_prm_1", "label": "organization-defined roles"}],
+         "parts": [
+             {"name": "statement", "prose": "Manage accounts for {{ insert: param, ac-2_prm_1 }}."},
+             {"name": "assessment-objective", "prose": "Determine if accounts are managed."},
+         ],
+         "controls": [
+             {"id": "ac-2.1", "title": "Automated Account Management",
+              "parts": [{"name": "statement", "prose": "Support account management with automation."}]},
+         ]},
+    ]}]}}
+
+
+def test_flatten_resolves_params_and_parts(tmp_path):
+    docs = rmf.catalog_to_family_docs(_CATALOG, tmp_path)
+    text = docs[0].read_text()
+    assert "AC-2 — Account Management" in text
+    assert "[organization-defined roles]" in text          # param resolved
+    assert "Assessment objective:" in text
+    assert "AC-2.1 — Automated Account Management" in text  # enhancement included
+
+
+def test_family_filter(tmp_path):
+    assert rmf.catalog_to_family_docs(_CATALOG, tmp_path, families=["si"]) == []  # no SI in catalog
+    assert len(rmf.catalog_to_family_docs(_CATALOG, tmp_path, families=["ac"])) == 1
+
+
+def test_bootstrap_from_local_source_ingests_into_kb(tmp_path):
+    src = tmp_path / "cat.json"; src.write_text(json.dumps(_CATALOG))
+    stats = rmf.bootstrap(str(tmp_path), source=str(src))
+    assert stats["family_docs"] == 1 and stats["chunks"] >= 1
+    idx = graphrag.load_index(graphrag.default_store_path(str(tmp_path)))
+    assert idx is not None
+    res = graphrag.query_index(idx, "account management automation")
+    assert res["chunks"] and "ac" in res["chunks"][0]["source"].lower()
+
+
+def test_rmf_skills_are_bundled():
+    sk = skills.load_skills("/tmp")
+    for name in ("rmf-control", "rmf-categorize", "rmf-review", "rmf-poam"):
+        assert name in sk and sk[name].body.strip()

{drydock_cli-3.0.61 → drydock_cli-3.0.63}/tests/test_skills.py

@@ -52,8 +52,10 @@ def test_empty_body_skipped(tmp_path):
     assert "empty" not in skills.load_skills(str(tmp_path))
 
 
-def test_no_skills_dir_is_empty(tmp_path):
-    assert skills.load_skills(str(tmp_path)) == {}
+def test_no_user_or_project_skills_yields_only_builtins(tmp_path):
+    # With no user/project skills, only the bundled built-ins (RMF) are present.
+    loaded = skills.load_skills(str(tmp_path))
+    assert set(loaded) == {"rmf-control", "rmf-categorize", "rmf-review", "rmf-poam"}
 
 
 def test_create_skill_user_scope(tmp_path, monkeypatch):