drydock-cli 3.0.64__tar.gz → 3.0.66__tar.gz

{drydock_cli-3.0.64/drydock_cli.egg-info → drydock_cli-3.0.66}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.64
+Version: 3.0.66
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

drydock_cli-3.0.66/drydock/builtin_skills/stig-assess.md

@@ -0,0 +1,24 @@
+---
+name: stig-assess
+description: Assess the next un-reviewed STIG rule against system evidence
+---
+Assess STIG rules in the checklist at: $ARGS
+
+Do exactly ONE rule per run (loop it — /loop N /stig-assess <path> — for the
+whole checklist):
+
+1. Call StigRules with that path and status=not_reviewed. If none remain, say the
+   checklist is fully assessed and STOP without calling other tools.
+2. Take the FIRST not_reviewed rule. Call StigRule (path + rule_id) to read its
+   Check Content and Fix Text.
+3. You MUST gather fresh evidence before deciding — do NOT guess. Read the exact
+   configuration file the Check Content names (Read tool) or run its check command
+   (Bash). Quote the specific line(s) you found. Reason step by step about whether
+   that evidence satisfies the Check Content.
+4. Call StigSet (path + rule_id) with:
+   - status = not_a_finding ONLY if the evidence clearly shows compliance;
+              open if the evidence shows non-compliance;
+              not_applicable if the rule does not apply to this system;
+   - finding_details = the exact evidence you observed and why it does/doesn't
+     comply (quote the config line).
+Give a one-line summary: rule id, the evidence line, and the status you set.

drydock_cli-3.0.66/drydock/stig.py

@@ -0,0 +1,173 @@
+"""STIG checklist engine — parse + generate DISA `.ckl` (XML) and `.cklb` (JSON).
+
+These checklists carry hostnames, IPs, and finding statuses that are almost
+always CUI, so all parsing/generation stays local. The model never sees raw XML:
+this exposes a compact per-rule view (id, severity, check content, fix text,
+status) for the LLM to assess one at a time, and writes results back by editing
+the parsed structure IN PLACE — so regenerating produces a well-formed file that
+re-imports into STIG Viewer / eMASS without breaking the schema.
+
+Stdlib only (xml.etree + json). All logic original to Drydock.
+"""
+from __future__ import annotations
+
+import json
+import xml.etree.ElementTree as ET
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+# Canonical statuses + how each format spells them.
+STATUSES = ("open", "not_a_finding", "not_applicable", "not_reviewed")
+_CKL_OUT = {"open": "Open", "not_a_finding": "NotAFinding",
+            "not_applicable": "Not_Applicable", "not_reviewed": "Not_Reviewed"}
+
+
+def canonical_status(s: str | None) -> str:
+    k = (s or "").strip().lower().replace(" ", "_")
+    return {
+        "open": "open", "notafinding": "not_a_finding", "not_a_finding": "not_a_finding",
+        "not_applicable": "not_applicable", "notapplicable": "not_applicable",
+        "not_reviewed": "not_reviewed", "notreviewed": "not_reviewed",
+    }.get(k, "not_reviewed")
+
+
+@dataclass
+class Rule:
+    group_id: str            # Vuln_Num, e.g. V-230222
+    rule_id: str             # SV-230222r...
+    title: str
+    severity: str            # high/medium/low (CAT I/II/III)
+    check_content: str
+    fix_text: str
+    status: str              # canonical
+    finding_details: str = ""
+    comments: str = ""
+    _raw: Any = field(default=None, repr=False)  # ET element or dict, for edit-in-place
+
+    def summary(self) -> str:
+        return f"{self.group_id} ({self.rule_id}) sev={self.severity} status={self.status} — {self.title}"
+
+
+class Checklist:
+    """A parsed checklist with edit-in-place fidelity. Format is 'ckl' or 'cklb'."""
+
+    def __init__(self, fmt: str) -> None:
+        self.fmt = fmt
+        self.asset: dict = {}
+        self.rules: list[Rule] = []
+        self._tree: Any = None   # ckl: ElementTree
+        self._data: Any = None   # cklb: dict
+
+    def by_id(self, ident: str) -> Rule | None:
+        ident = ident.strip().lower()
+        for r in self.rules:
+            if ident in (r.group_id.lower(), r.rule_id.lower()):
+                return r
+        # tolerate a base rule id without the trailing revision (SV-230222 vs SV-230222r1)
+        for r in self.rules:
+            if r.rule_id.lower().startswith(ident) or r.group_id.lower().startswith(ident):
+                return r
+        return None
+
+    def update(self, ident: str, *, status: str | None = None,
+               finding_details: str | None = None, comments: str | None = None) -> bool:
+        r = self.by_id(ident)
+        if r is None:
+            return False
+        if status is not None:
+            r.status = canonical_status(status)
+        if finding_details is not None:
+            r.finding_details = finding_details
+        if comments is not None:
+            r.comments = comments
+        self._write_back(r)
+        return True
+
+    def counts(self) -> dict:
+        c = {s: 0 for s in STATUSES}
+        for r in self.rules:
+            c[r.status] = c.get(r.status, 0) + 1
+        return c
+
+    # ── per-format write-back (edit the raw structure) ──────────────────────
+    def _write_back(self, r: Rule) -> None:
+        if self.fmt == "cklb":
+            d = r._raw
+            d["status"] = r.status
+            d["finding_details"] = r.finding_details
+            d["comments"] = r.comments
+        else:  # ckl
+            vuln = r._raw
+            _set_child_text(vuln, "STATUS", _CKL_OUT[r.status])
+            _set_child_text(vuln, "FINDING_DETAILS", r.finding_details)
+            _set_child_text(vuln, "COMMENTS", r.comments)
+
+    def to_text(self) -> str:
+        if self.fmt == "cklb":
+            return json.dumps(self._data, indent=2)
+        ET.indent(self._tree, space="  ")
+        return ET.tostring(self._tree.getroot(), encoding="unicode")
+
+    def save(self, path: str | Path) -> None:
+        Path(path).write_text(self.to_text(), encoding="utf-8")
+
+
+def _set_child_text(el: ET.Element, tag: str, text: str) -> None:
+    child = el.find(tag)
+    if child is None:
+        child = ET.SubElement(el, tag)
+    child.text = text or ""
+
+
+# ── parsing ─────────────────────────────────────────────────────────────────
+def parse_ckl(path: str | Path) -> Checklist:
+    cl = Checklist("ckl")
+    cl._tree = ET.parse(path)
+    root = cl._tree.getroot()
+    asset = root.find("ASSET")
+    if asset is not None:
+        cl.asset = {c.tag: (c.text or "") for c in asset}
+    for vuln in root.iter("VULN"):
+        data: dict[str, str] = {}
+        for sd in vuln.findall("STIG_DATA"):
+            data[sd.findtext("VULN_ATTRIBUTE") or ""] = sd.findtext("ATTRIBUTE_DATA") or ""
+        cl.rules.append(Rule(
+            group_id=data.get("Vuln_Num", ""), rule_id=data.get("Rule_ID", ""),
+            title=data.get("Rule_Title", ""), severity=data.get("Severity", ""),
+            check_content=data.get("Check_Content", ""), fix_text=data.get("Fix_Text", ""),
+            status=canonical_status(vuln.findtext("STATUS")),
+            finding_details=vuln.findtext("FINDING_DETAILS") or "",
+            comments=vuln.findtext("COMMENTS") or "", _raw=vuln,
+        ))
+    return cl
+
+
+def parse_cklb(path: str | Path) -> Checklist:
+    cl = Checklist("cklb")
+    cl._data = json.loads(Path(path).read_text("utf-8"))
+    cl.asset = cl._data.get("target_data", {}) or {}
+    for stig in cl._data.get("stigs", []) or []:
+        for rule in stig.get("rules", []) or []:
+            cl.rules.append(Rule(
+                group_id=rule.get("group_id", ""), rule_id=rule.get("rule_id", ""),
+                title=rule.get("rule_title", rule.get("group_title", "")),
+                severity=rule.get("severity", ""),
+                check_content=rule.get("check_content", ""), fix_text=rule.get("fix_text", ""),
+                status=canonical_status(rule.get("status")),
+                finding_details=rule.get("finding_details", ""),
+                comments=rule.get("comments", ""), _raw=rule,
+            ))
+    return cl
+
+
+def load(path: str | Path) -> Checklist:
+    """Parse a .ckl (XML) or .cklb (JSON) checklist."""
+    ext = Path(path).suffix.lower()
+    if ext == ".cklb":
+        return parse_cklb(path)
+    if ext == ".ckl":
+        return parse_ckl(path)
+    # sniff: JSON → cklb, else ckl
+    head = Path(path).read_text("utf-8", "ignore").lstrip()[:1]
+    return parse_cklb(path) if head == "{" else parse_ckl(path)

{drydock_cli-3.0.64 → drydock_cli-3.0.66}/drydock/tools/__init__.py

@@ -270,6 +270,58 @@ SCHEMAS = [
             "required": ["message"],
         },
     },
+    {
+        "name": "StigRules",
+        "description": (
+            "List the rules in a DISA STIG checklist (.ckl / .cklb) with their "
+            "status, optionally filtered by status (e.g. not_reviewed). Use it to "
+            "see what needs assessing. Pair with StigRule to read one, StigSet to "
+            "record a result."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "path": {"type": "string", "description": "Path to the .ckl/.cklb file."},
+                "status": {"type": "string", "description": "Optional filter: open|not_a_finding|not_applicable|not_reviewed"},
+            },
+            "required": ["path"],
+        },
+    },
+    {
+        "name": "StigRule",
+        "description": (
+            "Read ONE STIG rule's full detail — Check Content + Fix Text — so you "
+            "can assess it against system evidence. Assess one rule at a time."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "path": {"type": "string"},
+                "rule_id": {"type": "string", "description": "Vuln_Num (V-…) or Rule_ID (SV-…)."},
+            },
+            "required": ["path", "rule_id"],
+        },
+    },
+    {
+        "name": "StigSet",
+        "description": (
+            "Record an assessment result for a STIG rule and save the checklist: "
+            "set status (open / not_a_finding / not_applicable / not_reviewed) and "
+            "the finding_details / comments narrative. Regenerates a valid "
+            ".ckl/.cklb that re-imports into STIG Viewer / eMASS."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "path": {"type": "string"},
+                "rule_id": {"type": "string"},
+                "status": {"type": "string", "description": "open | not_a_finding | not_applicable | not_reviewed"},
+                "finding_details": {"type": "string"},
+                "comments": {"type": "string"},
+            },
+            "required": ["path", "rule_id"],
+        },
+    },
     {
         "name": "GraphQuery",
         "description": (
@@ -1102,6 +1154,78 @@ def _rmf_graph(config):
     return rmf_graph, rmf_graph.RmfGraph.load(path), path
 
 
+def _gattrs(g, nid) -> dict:
+    n = g.get(nid)
+    return n["attrs"] if n else {}
+
+
+def _stig_path(params, config):
+    p = (params.get("path") or "").strip()
+    return _resolve_path(p, config) if p else None
+
+
+def tool_stigrules(params: dict, config: dict) -> str:
+    """List the rules in a STIG checklist (.ckl/.cklb), optionally by status."""
+    from drydock import stig
+    path = _stig_path(params, config)
+    if not path:
+        return "Error: StigRules needs a `path` to a .ckl/.cklb checklist."
+    try:
+        cl = stig.load(path)
+    except Exception as e:  # noqa: BLE001
+        return f"Could not read checklist: {e}"
+    status = params.get("status")
+    sf = stig.canonical_status(status) if status else None
+    rules = [r for r in cl.rules if sf is None or r.status == sf]
+    head = (f"{path}: {len(cl.rules)} rules — " +
+            ", ".join(f"{k}={v}" for k, v in cl.counts().items()))
+    lines = [head] + [f"  {r.summary()}" for r in rules[:400]]
+    if len(rules) > 400:
+        lines.append(f"  … +{len(rules) - 400} more")
+    return "\n".join(lines)
+
+
+def tool_stigrule(params: dict, config: dict) -> str:
+    """Full detail of ONE STIG rule (check content + fix text) for assessment."""
+    from drydock import stig
+    path = _stig_path(params, config)
+    rid = (params.get("rule_id") or "").strip()
+    if not path or not rid:
+        return "Error: StigRule needs `path` and `rule_id`."
+    try:
+        cl = stig.load(path)
+    except Exception as e:  # noqa: BLE001
+        return f"Could not read checklist: {e}"
+    r = cl.by_id(rid)
+    if r is None:
+        return f"No rule {rid} in {path}."
+    return (f"{r.group_id} ({r.rule_id}) — {r.title}\nSeverity: {r.severity}\n"
+            f"Status: {r.status}\nCheck Content:\n{r.check_content}\n\n"
+            f"Fix Text:\n{r.fix_text}")
+
+
+def tool_stigset(params: dict, config: dict) -> str:
+    """Set a STIG rule's status + finding details/comments and save the file."""
+    from drydock import stig
+    path = _stig_path(params, config)
+    rid = (params.get("rule_id") or "").strip()
+    if not path or not rid:
+        return "Error: StigSet needs `path` and `rule_id`."
+    status = params.get("status")
+    if status and stig.canonical_status(status) not in stig.STATUSES:
+        return f"status must be one of {stig.STATUSES}."
+    try:
+        cl = stig.load(path)
+        ok = cl.update(rid, status=status, finding_details=params.get("finding_details"),
+                       comments=params.get("comments"))
+        if not ok:
+            return f"No rule {rid} in {path}."
+        cl.save(path)
+    except Exception as e:  # noqa: BLE001
+        return f"Could not update checklist: {e}"
+    return f"✓ {rid} set to {stig.canonical_status(status) if status else 'unchanged'} in {path}."
+
+
 def tool_graphquery(params: dict, config: dict) -> str:
     """Traverse the RMF typed ontology graph (read-only)."""
     rmf_graph, g, _ = _rmf_graph(config)
@@ -1115,8 +1239,8 @@ def tool_graphquery(params: dict, config: dict) -> str:
         n = g.get(node)
         if not n:
             return f"No control {ident} in the graph."
-        objs = [g.get(o)["attrs"].get("prose", "") for o in g.neighbors(node, "ASSESSES", direction="in")]
-        impl = [g.get(c)["attrs"].get("name", c) for c in g.neighbors(node, "IMPLEMENTS", direction="in")]
+        objs = [_gattrs(g, o).get("prose", "") for o in g.neighbors(node, "ASSESSES", direction="in")]
+        impl = [_gattrs(g, c).get("name", c) for c in g.neighbors(node, "IMPLEMENTS", direction="in")]
         out = [f"{n['attrs'].get('control_id', ident)} — {n['attrs'].get('title','')} "
                f"(Family: {n['attrs'].get('family','')})"]
         if objs:
@@ -1124,28 +1248,28 @@ def tool_graphquery(params: dict, config: dict) -> str:
         out.append("Implemented by: " + (", ".join(impl) if impl else "(no components recorded)"))
         return "\n".join(out)
     if op == "family":
-        ctrls = [g.get(c)["attrs"].get("control_id", c)
+        ctrls = [_gattrs(g, c).get("control_id", c)
                  for c in g.of_type("Control")
-                 if g.get(c)["attrs"].get("family", "").lower().startswith(ident.lower())
-                 or ident.lower() in g.get(c)["attrs"].get("family", "").lower()]
+                 if _gattrs(g, c).get("family", "").lower().startswith(ident.lower())
+                 or ident.lower() in _gattrs(g, c).get("family", "").lower()]
         return f"Controls in '{ident}': " + (", ".join(sorted(ctrls)) or "(none)")
     if op in ("component", "implementers", "inherited"):
         comp = rmf_graph.component_id(ident)
         if op == "implementers":
             node = rmf_graph.control_id(ident)
-            comps = [g.get(c)["attrs"].get("name", c) for c in g.neighbors(node, "IMPLEMENTS", direction="in")]
+            comps = [_gattrs(g, c).get("name", c) for c in g.neighbors(node, "IMPLEMENTS", direction="in")]
             return f"Components implementing {ident}: " + (", ".join(comps) or "(none)")
         if op == "inherited":
             inh = g.inherited_controls(comp)
-            names = [g.get(c)["attrs"].get("control_id", c) if g.get(c) else c for c in inh]
+            names = [_gattrs(g, c).get("control_id", c) if g.get(c) else c for c in inh]
             return (f"{ident} inherits {len(names)} control(s) from its parent system(s): "
                     + (", ".join(names) or "(none — no RESIDES_ON recorded)"))
         n = g.get(comp)
         if not n:
             return f"No component '{ident}' in the graph (add it with GraphAdd)."
-        impl = [g.get(c)["attrs"].get("control_id", c) for c in g.neighbors(comp, "IMPLEMENTS", direction="out")]
-        res = [g.get(p)["attrs"].get("name", p) for p in g.neighbors(comp, "RESIDES_ON", direction="out")]
-        vulns = [g.get(v)["attrs"].get("vuln_id", v) for v in g.neighbors(comp, "AFFECTS", direction="in")]
+        impl = [_gattrs(g, c).get("control_id", c) for c in g.neighbors(comp, "IMPLEMENTS", direction="out")]
+        res = [_gattrs(g, p).get("name", p) for p in g.neighbors(comp, "RESIDES_ON", direction="out")]
+        vulns = [_gattrs(g, v).get("vuln_id", v) for v in g.neighbors(comp, "AFFECTS", direction="in")]
         return (f"Component {ident} ({n['attrs'].get('os','')}): implements "
                 f"{', '.join(impl) or 'none'}; resides on {', '.join(res) or 'nothing'}; "
                 f"flaws {', '.join(vulns) or 'none'}.")
@@ -1258,6 +1382,9 @@ _TOOLS = [
     ("Knowledge", tool_knowledge, True),
     ("GraphQuery", tool_graphquery, True),
     ("GraphAdd", tool_graphadd, False),
+    ("StigRules", tool_stigrules, True),
+    ("StigRule", tool_stigrule, True),
+    ("StigSet", tool_stigset, False),
     ("WebSearch", tool_websearch, True),
     ("WebFetch", tool_webfetch, True),
     ("GitStatus", tool_gitstatus, True),
@@ -1275,6 +1402,7 @@ def register_all():
             "todo": tool_todo, "task": tool_task, "Dispatch": tool_dispatch,
             "Knowledge": tool_knowledge,
             "GraphQuery": tool_graphquery, "GraphAdd": tool_graphadd,
+            "StigRules": tool_stigrules, "StigRule": tool_stigrule, "StigSet": tool_stigset,
             "WebSearch": tool_websearch, "WebFetch": tool_webfetch,
             "GitStatus": tool_gitstatus, "GitDiff": tool_gitdiff,
             "GitLog": tool_gitlog, "GitCommit": tool_gitcommit,
@@ -1283,6 +1411,7 @@ def register_all():
         # GitCommit + GraphAdd write).
         read_only = name in (
             "Read", "Glob", "Grep", "task", "Dispatch", "Knowledge", "GraphQuery",
+            "StigRules", "StigRule",
             "WebSearch", "WebFetch", "GitStatus", "GitDiff", "GitLog",
         )
         register(ToolDef(name=name, schema=schema, func=func, read_only=read_only))

{drydock_cli-3.0.64 → drydock_cli-3.0.66}/drydock/tui/app.py

@@ -496,6 +496,7 @@ class DrydockApp(App):
                 "  /loop            /loop <count> <prompt> — repeat a prompt (Esc stops)\n"
                 "  /mcp             list connected MCP servers and their tools\n"
                 "  /rmf             RMF automation — /rmf bootstrap, then /rmf-control etc.\n"
+                "  /stig            summarize a .ckl/.cklb; assess via /stig-assess\n"
                 "  /clear           reset the conversation\n"
                 "  /quit            exit\n"
                 "Type a task and press Enter. ↑/↓ recall history · Esc stops · Ctrl+O expands tools."
@@ -504,6 +505,8 @@ class DrydockApp(App):
             self._cmd_mcp()
         elif cmd == "/rmf":
             self._cmd_rmf(arg)
+        elif cmd == "/stig":
+            self._cmd_stig(arg)
         elif cmd == "/loop":
             self._cmd_loop(arg)
         elif cmd == "/skills":
@@ -513,6 +516,41 @@ class DrydockApp(App):
         else:
             self._mount(ErrorMessage(f"unknown command: {cmd} (try /help)"))
 
+    def _cmd_stig(self, arg: str) -> None:
+        """Summarize a STIG checklist (.ckl/.cklb): asset + status counts, or list
+        rules of a given status. Assess it with /stig-assess (loop for the whole
+        checklist)."""
+        from drydock import stig
+
+        parts = arg.split()
+        if not parts:
+            self._info("usage: /stig <path-to.ckl|.cklb> [status]   "
+                       "(status: open|not_a_finding|not_applicable|not_reviewed)\n"
+                       "Assess it: /loop <n> /stig-assess <path>")
+            return
+        import os as _os
+        path = parts[0]
+        if not _os.path.isabs(path):
+            path = _os.path.join(self.config.get("cwd") or ".", path)
+        try:
+            cl = stig.load(path)
+        except Exception as e:  # noqa: BLE001
+            self._mount(ErrorMessage(f"could not read checklist: {e}"))
+            return
+        host = cl.asset.get("HOST_NAME") or cl.asset.get("host_name") or "?"
+        c = cl.counts()
+        lines = [f"STIG checklist {path}  (host: {host}, format: {cl.fmt})",
+                 f"  {len(cl.rules)} rules — " + " · ".join(f"{k}={v}" for k, v in c.items())]
+        if len(parts) > 1:
+            sf = stig.canonical_status(parts[1])
+            hits = [r for r in cl.rules if r.status == sf]
+            lines.append(f"\n{sf} ({len(hits)}):")
+            lines += [f"  {r.group_id} ({r.severity}) — {r.title}" for r in hits[:50]]
+        else:
+            lines.append("Assess un-reviewed rules:  /loop "
+                         f"{c.get('not_reviewed', 0) or 1} /stig-assess {parts[0]}")
+        self._info("\n".join(lines))
+
     def _cmd_rmf(self, arg: str) -> None:
         """RMF automation: bootstrap the NIST 800-53 catalog into the knowledge
         base and surface the bundled RMF skills."""

{drydock_cli-3.0.64 → drydock_cli-3.0.66}/drydock/tui/widgets.py

@@ -153,7 +153,8 @@ class PromptHistory:
 # completes the prefix.
 SLASH_COMMANDS = [
     "/help", "/model", "/cwd", "/undo", "/back", "/stop", "/status",
-    "/compact", "/graphrag", "/skills", "/loop", "/mcp", "/rmf", "/clear", "/quit",
+    "/compact", "/graphrag", "/skills", "/loop", "/mcp", "/rmf", "/stig",
+    "/clear", "/quit",
 ]
 
 

{drydock_cli-3.0.64 → drydock_cli-3.0.66/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.64
+Version: 3.0.66
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

{drydock_cli-3.0.64 → drydock_cli-3.0.66}/drydock_cli.egg-info/SOURCES.txt

@@ -20,6 +20,7 @@ drydock/providers.py
 drydock/rmf.py
 drydock/rmf_graph.py
 drydock/skills.py
+drydock/stig.py
 drydock/tool_registry.py
 drydock/tuning.py
 drydock/web.py
@@ -28,6 +29,7 @@ drydock/builtin_skills/rmf-categorize.md
 drydock/builtin_skills/rmf-control.md
 drydock/builtin_skills/rmf-poam.md
 drydock/builtin_skills/rmf-review.md
+drydock/builtin_skills/stig-assess.md
 drydock/tools/__init__.py
 drydock/tui/__init__.py
 drydock/tui/app.py
@@ -73,6 +75,7 @@ tests/test_rmf.py
 tests/test_rmf_graph.py
 tests/test_runaway_repetition.py
 tests/test_skills.py
+tests/test_stig.py
 tests/test_stop.py
 tests/test_streaming_newlines.py
 tests/test_subagent.py

{drydock_cli-3.0.64 → drydock_cli-3.0.66}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.64"
+version = "3.0.66"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

{drydock_cli-3.0.64 → drydock_cli-3.0.66}/tests/test_skills.py

@@ -55,7 +55,7 @@ def test_empty_body_skipped(tmp_path):
 def test_no_user_or_project_skills_yields_only_builtins(tmp_path):
     # With no user/project skills, only the bundled built-ins (RMF) are present.
     loaded = skills.load_skills(str(tmp_path))
-    assert set(loaded) == {"rmf-control", "rmf-categorize", "rmf-review", "rmf-poam"}
+    assert set(loaded) == {"rmf-control", "rmf-categorize", "rmf-review", "rmf-poam", "stig-assess"}
 
 
 def test_create_skill_user_scope(tmp_path, monkeypatch):

drydock_cli-3.0.66/tests/test_stig.py

@@ -0,0 +1,70 @@
+"""STIG .ckl/.cklb engine — parse, edit-in-place, round-trip; + the tools."""
+from __future__ import annotations
+
+import json
+
+from drydock import stig
+from drydock.tools import tool_stigrules, tool_stigrule, tool_stigset
+
+_CKL = '''<?xml version="1.0" encoding="UTF-8"?>
+<CHECKLIST><ASSET><HOST_NAME>web01</HOST_NAME><HOST_IP>10.0.0.5</HOST_IP></ASSET>
+<STIGS><iSTIG><STIG_INFO></STIG_INFO>
+<VULN>
+<STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-230222</ATTRIBUTE_DATA></STIG_DATA>
+<STIG_DATA><VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE><ATTRIBUTE_DATA>SV-230222r1</ATTRIBUTE_DATA></STIG_DATA>
+<STIG_DATA><VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE><ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA></STIG_DATA>
+<STIG_DATA><VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE><ATTRIBUTE_DATA>Enable FIPS</ATTRIBUTE_DATA></STIG_DATA>
+<STIG_DATA><VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE><ATTRIBUTE_DATA>Run fips-mode-setup --check</ATTRIBUTE_DATA></STIG_DATA>
+<STIG_DATA><VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE><ATTRIBUTE_DATA>Run fips-mode-setup --enable</ATTRIBUTE_DATA></STIG_DATA>
+<STATUS>Not_Reviewed</STATUS><FINDING_DETAILS></FINDING_DETAILS><COMMENTS></COMMENTS></VULN>
+</iSTIG></STIGS></CHECKLIST>'''
+
+_CKLB = {"title": "RHEL9", "target_data": {"host_name": "web01"}, "stigs": [{"stig_name": "RHEL 9",
+    "rules": [{"group_id": "V-230222", "rule_id": "SV-230222r1", "rule_title": "Enable FIPS",
+               "severity": "medium", "check_content": "fips-mode-setup --check",
+               "fix_text": "fips-mode-setup --enable", "status": "not_reviewed",
+               "finding_details": "", "comments": ""}]}]}
+
+
+def test_ckl_roundtrip_edit_in_place(tmp_path):
+    p = tmp_path / "r.ckl"; p.write_text(_CKL)
+    cl = stig.load(p)
+    assert cl.fmt == "ckl" and cl.asset["HOST_NAME"] == "web01"
+    assert cl.rules[0].check_content == "Run fips-mode-setup --check"
+    assert cl.update("V-230222", status="open", finding_details="FIPS off.", comments="by drydock")
+    cl.save(p)
+    re = stig.load(p)
+    assert re.rules[0].status == "open" and re.rules[0].finding_details == "FIPS off."
+    # other STIG_DATA preserved (schema fidelity)
+    assert "Vuln_Num" in p.read_text() and "<STATUS>Open</STATUS>" in p.read_text()
+
+
+def test_cklb_roundtrip(tmp_path):
+    p = tmp_path / "r.cklb"; p.write_text(json.dumps(_CKLB))
+    cl = stig.load(p)
+    assert cl.fmt == "cklb"
+    cl.update("SV-230222r1", status="not_a_finding", finding_details="FIPS on.")
+    cl.save(p)
+    data = json.loads(p.read_text())  # still valid JSON
+    assert data["stigs"][0]["rules"][0]["status"] == "not_a_finding"
+    assert stig.load(p).rules[0].finding_details == "FIPS on."
+
+
+def test_status_canonicalization():
+    assert stig.canonical_status("NotAFinding") == "not_a_finding"
+    assert stig.canonical_status("Not_Applicable") == "not_applicable"
+    assert stig.canonical_status("garbage") == "not_reviewed"
+
+
+def test_stig_tools(tmp_path):
+    p = tmp_path / "r.ckl"; p.write_text(_CKL); cfg = {"cwd": str(tmp_path)}
+    out = tool_stigrules({"path": "r.ckl"}, cfg)
+    assert "V-230222" in out and "not_reviewed=1" in out
+    detail = tool_stigrule({"path": "r.ckl", "rule_id": "V-230222"}, cfg)
+    assert "Check Content" in detail and "fips-mode-setup --check" in detail
+    set_out = tool_stigset({"path": "r.ckl", "rule_id": "V-230222", "status": "open",
+                            "finding_details": "FIPS disabled."}, cfg)
+    assert "set to open" in set_out
+    assert stig.load(p).rules[0].status == "open"
+    # filter by status
+    assert "not_reviewed=0" in tool_stigrules({"path": "r.ckl"}, cfg)