drydock-cli 3.0.65__tar.gz → 3.0.67__tar.gz

{drydock_cli-3.0.65/drydock_cli.egg-info → drydock_cli-3.0.67}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.65
+Version: 3.0.67
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

drydock_cli-3.0.67/drydock/builtin_skills/stig-assess.md

@@ -0,0 +1,24 @@
+---
+name: stig-assess
+description: Assess the next un-reviewed STIG rule against system evidence
+---
+Assess STIG rules in the checklist at: $ARGS
+
+Do exactly ONE rule per run (loop it — /loop N /stig-assess <path> — for the
+whole checklist):
+
+1. Call StigRules with that path and status=not_reviewed. If none remain, say the
+   checklist is fully assessed and STOP without calling other tools.
+2. Take the FIRST not_reviewed rule. Call StigRule (path + rule_id) to read its
+   Check Content and Fix Text.
+3. You MUST gather fresh evidence before deciding — do NOT guess. Read the exact
+   configuration file the Check Content names (Read tool) or run its check command
+   (Bash). Quote the specific line(s) you found. Reason step by step about whether
+   that evidence satisfies the Check Content.
+4. Call StigSet (path + rule_id) with:
+   - status = not_a_finding ONLY if the evidence clearly shows compliance;
+              open if the evidence shows non-compliance;
+              not_applicable if the rule does not apply to this system;
+   - finding_details = the exact evidence you observed and why it does/doesn't
+     comply (quote the config line).
+Give a one-line summary: rule id, the evidence line, and the status you set.

{drydock_cli-3.0.65 → drydock_cli-3.0.67}/drydock/rmf.py

@@ -108,16 +108,23 @@ def rmf_dir(cwd: str) -> Path:
 
 
 def bootstrap(cwd: str, *, families: list[str] | None = None,
-              source: str | Path | None = None) -> dict:
+              source: str | Path | None = None, refresh: bool = False) -> dict:
     """Fetch (if needed) + flatten the 800-53 catalog into <cwd>/.drydock/rmf and
     ingest it into the GraphRAG KB. Returns {families, controls_docs, **kb_stats}.
-    `source` reuses an already-downloaded catalog JSON (offline)."""
+    `source` reuses an already-downloaded catalog JSON (offline). `refresh` pulls
+    the latest from upstream, but falls back to the cached catalog if upstream is
+    unreachable — so a network blip never stalls an assessment (PRD §4)."""
     from drydock import graphrag
 
     base = rmf_dir(cwd)
     cat_path = Path(source) if source else base / "catalog.json"
-    if not cat_path.exists():
-        fetch_catalog(cat_path)
+    if source is None and (refresh or not cat_path.exists()):
+        try:
+            fetch_catalog(cat_path)
+        except Exception:  # noqa: BLE001 — any network/HTTP failure
+            if not cat_path.exists():
+                raise  # nothing cached to fall back to
+            # else: keep using the cached catalog
     catalog = json.loads(Path(cat_path).read_text("utf-8"))
     docs = catalog_to_family_docs(catalog, base / "800-53", families)
     store = graphrag.default_store_path(cwd)

{drydock_cli-3.0.65 → drydock_cli-3.0.67}/drydock/tui/app.py

@@ -496,6 +496,7 @@ class DrydockApp(App):
                 "  /loop            /loop <count> <prompt> — repeat a prompt (Esc stops)\n"
                 "  /mcp             list connected MCP servers and their tools\n"
                 "  /rmf             RMF automation — /rmf bootstrap, then /rmf-control etc.\n"
+                "  /stig            summarize a .ckl/.cklb; assess via /stig-assess\n"
                 "  /clear           reset the conversation\n"
                 "  /quit            exit\n"
                 "Type a task and press Enter. ↑/↓ recall history · Esc stops · Ctrl+O expands tools."
@@ -504,6 +505,8 @@ class DrydockApp(App):
             self._cmd_mcp()
         elif cmd == "/rmf":
             self._cmd_rmf(arg)
+        elif cmd == "/stig":
+            self._cmd_stig(arg)
         elif cmd == "/loop":
             self._cmd_loop(arg)
         elif cmd == "/skills":
@@ -513,6 +516,41 @@ class DrydockApp(App):
         else:
             self._mount(ErrorMessage(f"unknown command: {cmd} (try /help)"))
 
+    def _cmd_stig(self, arg: str) -> None:
+        """Summarize a STIG checklist (.ckl/.cklb): asset + status counts, or list
+        rules of a given status. Assess it with /stig-assess (loop for the whole
+        checklist)."""
+        from drydock import stig
+
+        parts = arg.split()
+        if not parts:
+            self._info("usage: /stig <path-to.ckl|.cklb> [status]   "
+                       "(status: open|not_a_finding|not_applicable|not_reviewed)\n"
+                       "Assess it: /loop <n> /stig-assess <path>")
+            return
+        import os as _os
+        path = parts[0]
+        if not _os.path.isabs(path):
+            path = _os.path.join(self.config.get("cwd") or ".", path)
+        try:
+            cl = stig.load(path)
+        except Exception as e:  # noqa: BLE001
+            self._mount(ErrorMessage(f"could not read checklist: {e}"))
+            return
+        host = cl.asset.get("HOST_NAME") or cl.asset.get("host_name") or "?"
+        c = cl.counts()
+        lines = [f"STIG checklist {path}  (host: {host}, format: {cl.fmt})",
+                 f"  {len(cl.rules)} rules — " + " · ".join(f"{k}={v}" for k, v in c.items())]
+        if len(parts) > 1:
+            sf = stig.canonical_status(parts[1])
+            hits = [r for r in cl.rules if r.status == sf]
+            lines.append(f"\n{sf} ({len(hits)}):")
+            lines += [f"  {r.group_id} ({r.severity}) — {r.title}" for r in hits[:50]]
+        else:
+            lines.append("Assess un-reviewed rules:  /loop "
+                         f"{c.get('not_reviewed', 0) or 1} /stig-assess {parts[0]}")
+        self._info("\n".join(lines))
+
     def _cmd_rmf(self, arg: str) -> None:
         """RMF automation: bootstrap the NIST 800-53 catalog into the knowledge
         base and surface the bundled RMF skills."""

{drydock_cli-3.0.65 → drydock_cli-3.0.67}/drydock/tui/widgets.py

@@ -153,7 +153,8 @@ class PromptHistory:
 # completes the prefix.
 SLASH_COMMANDS = [
     "/help", "/model", "/cwd", "/undo", "/back", "/stop", "/status",
-    "/compact", "/graphrag", "/skills", "/loop", "/mcp", "/rmf", "/clear", "/quit",
+    "/compact", "/graphrag", "/skills", "/loop", "/mcp", "/rmf", "/stig",
+    "/clear", "/quit",
 ]
 
 

{drydock_cli-3.0.65 → drydock_cli-3.0.67/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.65
+Version: 3.0.67
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

{drydock_cli-3.0.65 → drydock_cli-3.0.67}/drydock_cli.egg-info/SOURCES.txt

@@ -29,6 +29,7 @@ drydock/builtin_skills/rmf-categorize.md
 drydock/builtin_skills/rmf-control.md
 drydock/builtin_skills/rmf-poam.md
 drydock/builtin_skills/rmf-review.md
+drydock/builtin_skills/stig-assess.md
 drydock/tools/__init__.py
 drydock/tui/__init__.py
 drydock/tui/app.py
@@ -55,6 +56,7 @@ tests/test_config_migration.py
 tests/test_context_limit_config.py
 tests/test_detect.py
 tests/test_dispatch.py
+tests/test_e2e_connected.py
 tests/test_empty_response.py
 tests/test_extract.py
 tests/test_failure_loop.py

{drydock_cli-3.0.65 → drydock_cli-3.0.67}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.65"
+version = "3.0.67"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

drydock_cli-3.0.67/tests/test_e2e_connected.py

@@ -0,0 +1,70 @@
+"""Connected E2E tests (RMF E2E PRD). The DETERMINISTIC + integration parts:
+schema fidelity, and network-resilience fallback. The LIVE upstream fetch is
+opt-in (set DRYDOCK_E2E_NETWORK=1) so the normal suite stays fast + offline-safe.
+Model-accuracy suites (assessment/remediation correctness) are verified hands-on
+in the TUI, not here (see the operator's TUI-only rule)."""
+from __future__ import annotations
+
+import json
+import os
+import xml.etree.ElementTree as ET
+
+import pytest
+
+from drydock import rmf, rmf_graph, stig
+
+_CAT = {"catalog": {"groups": [{"id": "ac", "title": "Access Control", "controls": [
+    {"id": "ac-2", "title": "Account Management",
+     "parts": [{"name": "statement", "prose": "Manage accounts."}]}]}]}}
+
+
+def test_network_resilience_falls_back_to_cache(tmp_path, monkeypatch):
+    # Seed a cached catalog, then make upstream fetch fail on refresh.
+    base = rmf.rmf_dir(str(tmp_path)); base.mkdir(parents=True)
+    (base / "catalog.json").write_text(json.dumps(_CAT))
+
+    def boom(*a, **k):
+        raise OSError("upstream unreachable")
+    monkeypatch.setattr(rmf, "fetch_catalog", boom)
+    # refresh=True tries upstream, fails, but falls back to the cache → no crash
+    stats = rmf.bootstrap(str(tmp_path), refresh=True)
+    assert stats["family_docs"] == 1 and stats["chunks"] >= 1
+
+
+def test_first_bootstrap_offline_with_no_cache_raises(tmp_path, monkeypatch):
+    monkeypatch.setattr(rmf, "fetch_catalog", lambda *a, **k: (_ for _ in ()).throw(OSError("down")))
+    with pytest.raises(OSError):
+        rmf.bootstrap(str(tmp_path))  # nothing cached to fall back to
+
+
+def test_ckl_regenerates_wellformed_and_status_enum(tmp_path):
+    p = tmp_path / "r.ckl"
+    p.write_text('<?xml version="1.0"?><CHECKLIST><ASSET><HOST_NAME>h</HOST_NAME></ASSET>'
+                 '<STIGS><iSTIG><STIG_INFO></STIG_INFO><VULN>'
+                 '<STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-1</ATTRIBUTE_DATA></STIG_DATA>'
+                 '<STIG_DATA><VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE><ATTRIBUTE_DATA>SV-1</ATTRIBUTE_DATA></STIG_DATA>'
+                 '<STATUS>Not_Reviewed</STATUS><FINDING_DETAILS></FINDING_DETAILS><COMMENTS></COMMENTS>'
+                 '</VULN></iSTIG></STIGS></CHECKLIST>')
+    cl = stig.load(p); cl.update("V-1", status="open", finding_details="x"); cl.save(p)
+    root = ET.parse(p).getroot()                       # re-parses = well-formed
+    statuses = [v.findtext("STATUS") for v in root.iter("VULN")]
+    valid = {"Open", "NotAFinding", "Not_Applicable", "Not_Reviewed"}
+    assert all(s in valid for s in statuses)           # DISA status enum preserved
+    assert root.find(".//VULN/STIG_DATA/ATTRIBUTE_DATA").text == "V-1"  # data fidelity
+
+
+def test_graph_relationship_semantics(tmp_path):
+    # Suite A semantics: COMPONENT -IMPLEMENTS-> CONTROL resolves.
+    g = rmf_graph.build_from_catalog(_CAT)
+    g.add_edge(rmf_graph.component_id("srv"), "IMPLEMENTS", rmf_graph.control_id("ac-2"))
+    assert rmf_graph.control_id("ac-2") in g.neighbors(rmf_graph.component_id("srv"), "IMPLEMENTS")
+
+
+@pytest.mark.skipif(os.environ.get("DRYDOCK_E2E_NETWORK") != "1",
+                    reason="live network test; set DRYDOCK_E2E_NETWORK=1 to run")
+def test_live_nist_catalog_fetch_and_parse(tmp_path):
+    # Suite A: pull the REAL NIST 800-53 catalog from upstream and parse it.
+    cat = rmf.fetch_catalog(tmp_path / "cat.json")
+    catalog = json.loads(cat.read_text())
+    docs = rmf.catalog_to_family_docs(catalog, tmp_path / "out", families=["ac"])
+    assert docs and "AC-2" in docs[0].read_text()

{drydock_cli-3.0.65 → drydock_cli-3.0.67}/tests/test_skills.py

@@ -55,7 +55,7 @@ def test_empty_body_skipped(tmp_path):
 def test_no_user_or_project_skills_yields_only_builtins(tmp_path):
     # With no user/project skills, only the bundled built-ins (RMF) are present.
     loaded = skills.load_skills(str(tmp_path))
-    assert set(loaded) == {"rmf-control", "rmf-categorize", "rmf-review", "rmf-poam"}
+    assert set(loaded) == {"rmf-control", "rmf-categorize", "rmf-review", "rmf-poam", "stig-assess"}
 
 
 def test_create_skill_user_scope(tmp_path, monkeypatch):