drydock-cli 3.0.68__tar.gz → 3.0.70__tar.gz

{drydock_cli-3.0.68/drydock_cli.egg-info → drydock_cli-3.0.70}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.68
+Version: 3.0.70
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

drydock_cli-3.0.70/drydock/builtin_skills/stig-remediate.md

@@ -0,0 +1,16 @@
+---
+name: stig-remediate
+description: Generate a remediation script for an Open STIG finding
+---
+Generate a remediation script for an Open STIG finding. Input: $ARGS (a checklist
+path and a rule id, e.g. "sys.ckl V-230222").
+
+1. Call StigRule (the path + rule_id) to read the rule's Fix Text and Check Content.
+2. Determine the target OS — infer from the STIG/checklist name, or ask if unclear.
+3. Translate the prose Fix Text into an IDEMPOTENT, executable remediation script in
+   the requested format (default: Bash for Linux, PowerShell for Windows; Ansible if
+   asked). It must bring the system into compliance with the Check Content. Start it
+   with a comment header citing the rule id and what it fixes.
+4. Write the script to a file (Write tool), e.g. remediate_<rule>.sh, and tell the
+   user the path. Do NOT run it — the operator reviews and runs remediation.
+Only GENERATE the script; never execute remediation yourself.

{drydock_cli-3.0.68 → drydock_cli-3.0.70}/drydock/rmf_graph.py

@@ -118,6 +118,38 @@ def component_id(name: str) -> str:
     return f"component:{name.strip().lower()}"
 
 
+def stig_id(name: str) -> str:
+    return f"stig:{name.strip().lower()}"
+
+
+def rule_node(rid: str) -> str:
+    return f"stigrule:{rid.strip().lower()}"
+
+
+def ingest_checklist(g: "RmfGraph", checklist) -> dict:
+    """Add a parsed STIG Checklist to the typed graph: STIG + STIG-Rule nodes,
+    PART_OF (rule→stig), APPLIES_TO (stig→host), EVALUATES (rule→host). Returns
+    {rules, host}. The Control —SATISFIED_BY→ STIG-Rule link is asserted
+    separately (via GraphAdd 'satisfies') since it needs the CCI→control map."""
+    host = (checklist.asset.get("HOST_NAME") or checklist.asset.get("host_name") or "target")
+    hnode = component_id(host)
+    g.add_node(hnode, "Component", name=host, ip=checklist.asset.get("HOST_IP"))
+    sname = checklist.stig_name or "STIG"
+    snode = stig_id(sname)
+    g.add_node(snode, "STIG", name=sname, version=checklist.stig_version)
+    g.add_edge(snode, "APPLIES_TO", hnode)
+    for r in checklist.rules:
+        rid = r.rule_id or r.group_id
+        if not rid:
+            continue
+        rn = rule_node(rid)
+        g.add_node(rn, "STIGRule", rule_id=r.rule_id, group_id=r.group_id,
+                   severity=r.severity, status=r.status, cci=r.cci, title=r.title)
+        g.add_edge(rn, "PART_OF", snode)
+        g.add_edge(rn, "EVALUATES", hnode)
+    return {"rules": len(checklist.rules), "host": host}
+
+
 def build_from_catalog(catalog: dict, *, families: list[str] | None = None) -> RmfGraph:
     """Deterministically build Control + Objective nodes (and ASSESSES edges) from
     an OSCAL 800-53 catalog. The typed backbone the user's components/vulns attach to."""

{drydock_cli-3.0.68 → drydock_cli-3.0.70}/drydock/stig.py

@@ -12,6 +12,7 @@ Stdlib only (xml.etree + json). All logic original to Drydock.
 from __future__ import annotations
 
 import json
+import re
 import xml.etree.ElementTree as ET
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -43,6 +44,7 @@ class Rule:
     status: str              # canonical
     finding_details: str = ""
     comments: str = ""
+    cci: str = ""            # Control Correlation Identifier (maps up to a NIST control)
     _raw: Any = field(default=None, repr=False)  # ET element or dict, for edit-in-place
 
     def summary(self) -> str:
@@ -55,6 +57,8 @@ class Checklist:
     def __init__(self, fmt: str) -> None:
         self.fmt = fmt
         self.asset: dict = {}
+        self.stig_name: str = ""
+        self.stig_version: str = ""
         self.rules: list[Rule] = []
         self._tree: Any = None   # ckl: ElementTree
         self._data: Any = None   # cklb: dict
@@ -121,13 +125,16 @@ def _set_child_text(el: ET.Element, tag: str, text: str) -> None:
 
 
 # ── parsing ─────────────────────────────────────────────────────────────────
-def parse_ckl(path: str | Path) -> Checklist:
+def _checklist_from_tree(tree: Any) -> Checklist:
     cl = Checklist("ckl")
-    cl._tree = ET.parse(path)
-    root = cl._tree.getroot()
+    cl._tree = tree
+    root = tree.getroot()
     asset = root.find("ASSET")
     if asset is not None:
         cl.asset = {c.tag: (c.text or "") for c in asset}
+    info = {si.findtext("SID_NAME"): si.findtext("SID_DATA") for si in root.iter("SI_DATA")}
+    cl.stig_name = info.get("title") or info.get("stigid") or ""
+    cl.stig_version = info.get("version") or ""
     for vuln in root.iter("VULN"):
         data: dict[str, str] = {}
         for sd in vuln.findall("STIG_DATA"):
@@ -138,17 +145,120 @@ def parse_ckl(path: str | Path) -> Checklist:
             check_content=data.get("Check_Content", ""), fix_text=data.get("Fix_Text", ""),
             status=canonical_status(vuln.findtext("STATUS")),
             finding_details=vuln.findtext("FINDING_DETAILS") or "",
-            comments=vuln.findtext("COMMENTS") or "", _raw=vuln,
+            comments=vuln.findtext("COMMENTS") or "", cci=data.get("CCI_REF", ""), _raw=vuln,
         ))
     return cl
 
 
+def parse_ckl(path: str | Path) -> Checklist:
+    return _checklist_from_tree(ET.parse(path))
+
+
+# ── XCCDF benchmark (the raw STIG) → a blank .ckl ───────────────────────────
+_VULN_DISCUSS = re.compile(r"<VulnDiscussion>(.*?)</VulnDiscussion>", re.S | re.I)
+
+
+def _lname(el) -> str:
+    return el.tag.split("}")[-1]
+
+
+def _kids(parent, name):
+    return [c for c in parent if _lname(c) == name]
+
+
+def _ktext(parent, name) -> str:
+    for c in parent:
+        if _lname(c) == name:
+            return (c.text or "").strip()
+    return ""
+
+
+def parse_xccdf(path: str | Path) -> dict:
+    """Parse a DISA STIG XCCDF benchmark (namespace-agnostic) into
+    {title, version, release, stigid, rules:[...]}."""
+    root = ET.parse(path).getroot()
+    title = _ktext(root, "title")
+    version = _ktext(root, "version")
+    stigid = root.get("id", "")
+    release = ""
+    for pt in _kids(root, "plain-text"):
+        if pt.get("id") == "release-info":
+            release = (pt.text or "").strip()
+    rules = []
+    for group in _kids(root, "Group"):
+        gid = group.get("id", "")
+        gtitle = _ktext(group, "title")
+        for rule in _kids(group, "Rule"):
+            desc = _ktext(rule, "description")
+            m = _VULN_DISCUSS.search(desc)
+            check = ""
+            for ch in _kids(rule, "check"):
+                check = _ktext(ch, "check-content") or check
+            rules.append({
+                "group_id": gid, "group_title": gtitle,
+                "rule_id": rule.get("id", ""), "rule_ver": _ktext(rule, "version"),
+                "severity": rule.get("severity", ""), "weight": rule.get("weight", ""),
+                "title": _ktext(rule, "title"),
+                "discussion": (m.group(1).strip() if m else desc),
+                "check": check, "fix": _ktext(rule, "fixtext"),
+                "ccis": [(c.text or "").strip() for c in _kids(rule, "ident")
+                         if "cci" in (c.get("system", "") + (c.text or "")).lower()],
+            })
+    return {"title": title, "version": version, "release": release,
+            "stigid": stigid, "rules": rules}
+
+
+def xccdf_to_checklist(path: str | Path, *, host: str = "") -> Checklist:
+    """Build a blank .ckl (all rules Not_Reviewed) from a STIG XCCDF benchmark —
+    the inverse of what STIG Viewer does, so the catalog can be assessed directly."""
+    bench = parse_xccdf(path)
+    stigref = f"{bench['title']} :: Version {bench['version']}, {bench['release']}".strip(" :,")
+    root = ET.Element("CHECKLIST")
+    asset = ET.SubElement(root, "ASSET")
+    for tag, val in [("ROLE", "None"), ("ASSET_TYPE", "Computing"), ("HOST_NAME", host),
+                     ("HOST_IP", ""), ("HOST_MAC", ""), ("HOST_FQDN", ""),
+                     ("TARGET_COMMENT", ""), ("TECH_AREA", ""), ("TARGET_KEY", ""),
+                     ("WEB_OR_DATABASE", "false"), ("WEB_DB_SITE", ""), ("WEB_DB_INSTANCE", "")]:
+        ET.SubElement(asset, tag).text = val
+    istig = ET.SubElement(ET.SubElement(root, "STIGS"), "iSTIG")
+    info = ET.SubElement(istig, "STIG_INFO")
+    for name, data in [("version", bench["version"]), ("classification", "UNCLASSIFIED"),
+                       ("stigid", bench["stigid"]), ("description", ""),
+                       ("releaseinfo", bench["release"]), ("title", bench["title"])]:
+        sid = ET.SubElement(info, "SI_DATA")
+        ET.SubElement(sid, "SID_NAME").text = name
+        ET.SubElement(sid, "SID_DATA").text = data
+    for rd in bench["rules"]:
+        vuln = ET.SubElement(istig, "VULN")
+        for attr, val in [("Vuln_Num", rd["group_id"]), ("Severity", rd["severity"]),
+                          ("Group_Title", rd["group_title"]), ("Rule_ID", rd["rule_id"]),
+                          ("Rule_Ver", rd["rule_ver"]), ("Rule_Title", rd["title"]),
+                          ("Vuln_Discuss", rd["discussion"]), ("Check_Content", rd["check"]),
+                          ("Fix_Text", rd["fix"]), ("Weight", rd["weight"]), ("STIGRef", stigref)]:
+            sd = ET.SubElement(vuln, "STIG_DATA")
+            ET.SubElement(sd, "VULN_ATTRIBUTE").text = attr
+            ET.SubElement(sd, "ATTRIBUTE_DATA").text = val or ""
+        for cci in rd["ccis"]:
+            sd = ET.SubElement(vuln, "STIG_DATA")
+            ET.SubElement(sd, "VULN_ATTRIBUTE").text = "CCI_REF"
+            ET.SubElement(sd, "ATTRIBUTE_DATA").text = cci
+        ET.SubElement(vuln, "STATUS").text = "Not_Reviewed"
+        ET.SubElement(vuln, "FINDING_DETAILS").text = ""
+        ET.SubElement(vuln, "COMMENTS").text = ""
+        ET.SubElement(vuln, "SEVERITY_OVERRIDE").text = ""
+        ET.SubElement(vuln, "SEVERITY_JUSTIFICATION").text = ""
+    return _checklist_from_tree(ET.ElementTree(root))
+
+
 def parse_cklb(path: str | Path) -> Checklist:
     cl = Checklist("cklb")
     cl._data = json.loads(Path(path).read_text("utf-8"))
     cl.asset = cl._data.get("target_data", {}) or {}
     for stig in cl._data.get("stigs", []) or []:
+        cl.stig_name = cl.stig_name or stig.get("stig_name", stig.get("display_name", ""))
+        cl.stig_version = cl.stig_version or str(stig.get("version", ""))
         for rule in stig.get("rules", []) or []:
+            ccis = rule.get("ccis") or ([rule["cci"]] if rule.get("cci") else [])
             cl.rules.append(Rule(
                 group_id=rule.get("group_id", ""), rule_id=rule.get("rule_id", ""),
                 title=rule.get("rule_title", rule.get("group_title", "")),
@@ -156,7 +266,7 @@ def parse_cklb(path: str | Path) -> Checklist:
                 check_content=rule.get("check_content", ""), fix_text=rule.get("fix_text", ""),
                 status=canonical_status(rule.get("status")),
                 finding_details=rule.get("finding_details", ""),
-                comments=rule.get("comments", ""), _raw=rule,
+                comments=rule.get("comments", ""), cci=(ccis[0] if ccis else ""), _raw=rule,
             ))
     return cl
 

{drydock_cli-3.0.68 → drydock_cli-3.0.70}/drydock/tools/__init__.py

@@ -353,10 +353,11 @@ SCHEMAS = [
         "input_schema": {
             "type": "object",
             "properties": {
-                "op": {"type": "string", "description": "component | implements | resides_on | vulnerability"},
+                "op": {"type": "string", "description": "component | implements | resides_on | vulnerability | satisfies"},
                 "component": {"type": "string"},
-                "control": {"type": "string", "description": "control id, for op=implements"},
+                "control": {"type": "string", "description": "control id, for op=implements/satisfies"},
                 "parent": {"type": "string", "description": "parent component/boundary, for op=resides_on"},
+                "rule": {"type": "string", "description": "STIG rule id, for op=satisfies"},
                 "id": {"type": "string", "description": "vulnerability/STIG/CVE id, for op=vulnerability"},
                 "severity": {"type": "string"},
                 "os": {"type": "string"}, "ip": {"type": "string"}, "data_type": {"type": "string"},
@@ -1246,6 +1247,9 @@ def tool_graphquery(params: dict, config: dict) -> str:
         if objs:
             out.append("Assessment objectives:\n" + "\n".join(f"  - {o}" for o in objs))
         out.append("Implemented by: " + (", ".join(impl) if impl else "(no components recorded)"))
+        rules = [_gattrs(g, rn).get("rule_id", rn) for rn in g.neighbors(node, "SATISFIED_BY", direction="out")]
+        if rules:
+            out.append("Satisfied by STIG rules: " + ", ".join(rules))
         return "\n".join(out)
     if op == "family":
         ctrls = [_gattrs(g, c).get("control_id", c)
@@ -1301,8 +1305,16 @@ def tool_graphadd(params: dict, config: dict) -> str:
             g.add_node(rmf_graph.component_id(comp), "Component", name=comp)
             g.add_edge(vid, "AFFECTS", rmf_graph.component_id(comp))
         g.save(path); return f"Recorded vulnerability {params['id']}" + (f" affecting {comp}." if comp else ".")
-    return ("GraphAdd ops: component (name in `component`) | implements (`component`,`control`) "
-            "| resides_on (`component`,`parent`) | vulnerability (`id`, optional `component`,`severity`).")
+    if op == "satisfies" and params.get("control") and params.get("rule"):
+        cn, rn = rmf_graph.control_id(params["control"]), rmf_graph.rule_node(params["rule"])
+        if not g.get(cn):  # ref node if the catalog isn't bootstrapped
+            g.add_node(cn, "Control", control_id=params["control"].upper())
+        g.add_node(rn, "STIGRule", rule_id=params["rule"])
+        g.add_edge(cn, "SATISFIED_BY", rn)
+        g.save(path); return f"Recorded: {params['control'].upper()} SATISFIED_BY {params['rule']}."
+    return ("GraphAdd ops: component (`component`) | implements (`component`,`control`) | "
+            "resides_on (`component`,`parent`) | vulnerability (`id`, optional `component`) | "
+            "satisfies (`control`,`rule` — a STIG rule satisfies a NIST control).")
 
 
 def tool_websearch(params: dict, config: dict) -> str:

{drydock_cli-3.0.68 → drydock_cli-3.0.70}/drydock/tui/app.py

@@ -496,7 +496,7 @@ class DrydockApp(App):
                 "  /loop            /loop <count> <prompt> — repeat a prompt (Esc stops)\n"
                 "  /mcp             list connected MCP servers and their tools\n"
                 "  /rmf             RMF automation — /rmf bootstrap, then /rmf-control etc.\n"
-                "  /stig            summarize a .ckl/.cklb; assess via /stig-assess\n"
+                "  /stig            /stig new <xccdf> → blank .ckl; summarize; /stig-assess\n"
                 "  /clear           reset the conversation\n"
                 "  /quit            exit\n"
                 "Type a task and press Enter. ↑/↓ recall history · Esc stops · Ctrl+O expands tools."
@@ -524,14 +524,53 @@ class DrydockApp(App):
 
         parts = arg.split()
         if not parts:
-            self._info("usage: /stig <path-to.ckl|.cklb> [status]   "
-                       "(status: open|not_a_finding|not_applicable|not_reviewed)\n"
-                       "Assess it: /loop <n> /stig-assess <path>")
+            self._info("usage:\n"
+                       "  /stig new <benchmark-xccdf.xml> [out.ckl]  — blank .ckl from a STIG\n"
+                       "  /stig <path.ckl|.cklb> [status]            — summary / list by status\n"
+                       "  /stig graph <path.ckl>                     — ingest into the RMF graph\n"
+                       "Assess:  /loop <n> /stig-assess <path>")
             return
         import os as _os
+        cwd = self.config.get("cwd") or "."
+        _abs = lambda p: p if _os.path.isabs(p) else _os.path.join(cwd, p)  # noqa: E731
+        # /stig new <xccdf> [out.ckl] — generate a BLANK .ckl from a STIG XCCDF benchmark
+        if parts[0].lower() == "new" and len(parts) > 1:
+            xp = _abs(parts[1])
+            out = _abs(parts[2]) if len(parts) > 2 else \
+                _os.path.splitext(_abs(parts[1]))[0].replace("-xccdf", "") + ".ckl"
+            try:
+                cl = stig.xccdf_to_checklist(xp)
+                cl.save(out)
+            except Exception as e:  # noqa: BLE001
+                self._mount(ErrorMessage(f"could not parse the STIG XCCDF: {e}"))
+                return
+            self._info(
+                f"✓ Generated {out} from the STIG benchmark — {len(cl.rules)} rules, "
+                "all Not_Reviewed. Now pull in the app's evidence and assess:\n"
+                f"  /graphrag build <app-docs>   ·   /loop {len(cl.rules)} /stig-assess {out}"
+            )
+            return
+        # /stig graph <path> — ingest the checklist into the RMF typed graph
+        if parts[0].lower() == "graph" and len(parts) > 1:
+            from drydock import rmf_graph
+            gp = parts[1] if _os.path.isabs(parts[1]) else _os.path.join(cwd, parts[1])
+            try:
+                cl = stig.load(gp)
+                g = rmf_graph.RmfGraph.load(rmf_graph.graph_path(cwd))
+                r = rmf_graph.ingest_checklist(g, cl)
+                g.save(rmf_graph.graph_path(cwd))
+            except Exception as e:  # noqa: BLE001
+                self._mount(ErrorMessage(f"could not graph checklist: {e}"))
+                return
+            self._info(
+                f"✓ Ingested {r['rules']} STIG rules for host '{r['host']}' into the "
+                f"RMF graph (STIG/STIG-Rule nodes, PART_OF/APPLIES_TO/EVALUATES). "
+                "Link rules to controls with GraphAdd satisfies; trace via GraphQuery."
+            )
+            return
         path = parts[0]
         if not _os.path.isabs(path):
-            path = _os.path.join(self.config.get("cwd") or ".", path)
+            path = _os.path.join(cwd, path)
         try:
             cl = stig.load(path)
         except Exception as e:  # noqa: BLE001

{drydock_cli-3.0.68 → drydock_cli-3.0.70/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.68
+Version: 3.0.70
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

{drydock_cli-3.0.68 → drydock_cli-3.0.70}/drydock_cli.egg-info/SOURCES.txt

@@ -30,6 +30,7 @@ drydock/builtin_skills/rmf-control.md
 drydock/builtin_skills/rmf-poam.md
 drydock/builtin_skills/rmf-review.md
 drydock/builtin_skills/stig-assess.md
+drydock/builtin_skills/stig-remediate.md
 drydock/tools/__init__.py
 drydock/tui/__init__.py
 drydock/tui/app.py
@@ -74,6 +75,7 @@ tests/test_providers_unreachable.py
 tests/test_read_index.py
 tests/test_rmf.py
 tests/test_rmf_graph.py
+tests/test_rmf_stig_graph.py
 tests/test_runaway_repetition.py
 tests/test_skills.py
 tests/test_stig.py
@@ -87,4 +89,5 @@ tests/test_tools_undo.py
 tests/test_tui.py
 tests/test_tuning.py
 tests/test_vision_input.py
-tests/test_web_tools.py
+tests/test_web_tools.py
+tests/test_xccdf.py

{drydock_cli-3.0.68 → drydock_cli-3.0.70}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.68"
+version = "3.0.70"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

drydock_cli-3.0.70/tests/test_rmf_stig_graph.py

@@ -0,0 +1,39 @@
+"""RMF Phase 2 STIG ontology — ingest a checklist into the typed graph and
+trace Control <-SATISFIED_BY-> STIG-Rule."""
+from __future__ import annotations
+
+from drydock import stig, rmf_graph
+from drydock.tools import tool_graphadd, tool_graphquery
+
+_CKL = ('<?xml version="1.0"?><CHECKLIST><ASSET><HOST_NAME>web01</HOST_NAME></ASSET>'
+        '<STIGS><iSTIG><STIG_INFO><SI_DATA><SID_NAME>title</SID_NAME><SID_DATA>RHEL 9 STIG</SID_DATA></SI_DATA></STIG_INFO>'
+        '<VULN><STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-1</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE><ATTRIBUTE_DATA>SV-1r1</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE><ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STATUS>Open</STATUS></VULN></iSTIG></STIGS></CHECKLIST>')
+
+
+def test_parse_captures_stig_info_and_cci(tmp_path):
+    p = tmp_path / "s.ckl"; p.write_text(_CKL)
+    cl = stig.load(p)
+    assert cl.stig_name == "RHEL 9 STIG" and cl.rules[0].cci == "CCI-000366"
+
+
+def test_ingest_checklist_builds_typed_nodes(tmp_path):
+    (tmp_path / "s.ckl").write_text(_CKL)
+    cl = stig.load(tmp_path / "s.ckl")
+    g = rmf_graph.RmfGraph()
+    r = rmf_graph.ingest_checklist(g, cl)
+    assert r["rules"] == 1 and r["host"] == "web01"
+    rn = rmf_graph.rule_node("SV-1r1")
+    assert g.get(rn)["type"] == "STIGRule"
+    assert rmf_graph.stig_id("RHEL 9 STIG") in g.neighbors(rn, "PART_OF")
+    assert rmf_graph.component_id("web01") in g.neighbors(rn, "EVALUATES")
+
+
+def test_satisfies_links_control_to_rule(tmp_path):
+    rmf_graph.RmfGraph().save(rmf_graph.graph_path(str(tmp_path)))
+    cfg = {"cwd": str(tmp_path)}
+    assert "SATISFIED_BY" in tool_graphadd({"op": "satisfies", "control": "CM-6", "rule": "SV-1r1"}, cfg)
+    out = tool_graphquery({"op": "control", "id": "CM-6"}, cfg)
+    assert "Satisfied by STIG rules" in out and "SV-1r1" in out

{drydock_cli-3.0.68 → drydock_cli-3.0.70}/tests/test_skills.py

@@ -55,7 +55,7 @@ def test_empty_body_skipped(tmp_path):
 def test_no_user_or_project_skills_yields_only_builtins(tmp_path):
     # With no user/project skills, only the bundled built-ins (RMF) are present.
     loaded = skills.load_skills(str(tmp_path))
-    assert set(loaded) == {"rmf-control", "rmf-categorize", "rmf-review", "rmf-poam", "stig-assess"}
+    assert set(loaded) == {"rmf-control", "rmf-categorize", "rmf-review", "rmf-poam", "stig-assess", "stig-remediate"}
 
 
 def test_create_skill_user_scope(tmp_path, monkeypatch):

drydock_cli-3.0.70/tests/test_xccdf.py

@@ -0,0 +1,56 @@
+"""XCCDF benchmark (raw STIG) -> blank .ckl generator — the inverse of STIG
+Viewer, closing the loop: STIG benchmark -> assess -> completed .ckl."""
+from __future__ import annotations
+
+import xml.etree.ElementTree as ET
+
+from drydock import stig
+
+# A minimal but real-shaped DISA STIG XCCDF (namespaced, like the live files).
+_XCCDF = '''<?xml version="1.0"?>
+<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" id="ASD_STIG">
+  <title>Application Security and Development STIG</title>
+  <version>6</version>
+  <plain-text id="release-info">Release: 1 Benchmark Date: 24 Jan 2024</plain-text>
+  <Group id="V-222387">
+    <title>SRG-APP-000001</title>
+    <Rule id="SV-222387r879511_rule" severity="medium" weight="10.0">
+      <version>APSC-DV-000010</version>
+      <title>The application must limit the number of concurrent sessions.</title>
+      <description>&lt;VulnDiscussion&gt;Limiting sessions reduces risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;</description>
+      <ident system="http://cyber.mil/cci">CCI-000054</ident>
+      <fixtext fixref="F-1">Configure the application to limit concurrent sessions.</fixtext>
+      <check system="C-1"><check-content>Review the application configuration for a session limit.</check-content></check>
+    </Rule>
+  </Group>
+</Benchmark>'''
+
+
+def test_parse_xccdf(tmp_path):
+    p = tmp_path / "b-xccdf.xml"; p.write_text(_XCCDF)
+    b = stig.parse_xccdf(p)
+    assert b["title"].startswith("Application Security") and b["version"] == "6"
+    assert "Release: 1" in b["release"]
+    r = b["rules"][0]
+    assert r["group_id"] == "V-222387" and r["rule_id"] == "SV-222387r879511_rule"
+    assert r["rule_ver"] == "APSC-DV-000010" and r["severity"] == "medium"
+    assert r["discussion"] == "Limiting sessions reduces risk."   # VulnDiscussion extracted
+    assert "session limit" in r["check"] and "concurrent sessions" in r["fix"]
+    assert r["ccis"] == ["CCI-000054"]
+
+
+def test_xccdf_to_blank_ckl(tmp_path):
+    p = tmp_path / "b-xccdf.xml"; p.write_text(_XCCDF)
+    cl = stig.xccdf_to_checklist(p, host="appsrv1")
+    assert len(cl.rules) == 1 and cl.counts()["not_reviewed"] == 1
+    assert cl.rules[0].rule_id == "SV-222387r879511_rule" and cl.rules[0].cci == "CCI-000054"
+    out = tmp_path / "gen.ckl"; cl.save(out)
+    ET.parse(out)  # valid XML
+    # round-trips through the engine and is assessable
+    re = stig.load(out)
+    assert re.rules[0].check_content.startswith("Review the application")
+    assert re.asset["HOST_NAME"] == "appsrv1"
+    re.update("V-222387", status="open", finding_details="no limit configured"); re.save(out)
+    assert stig.load(out).rules[0].status == "open"
+    # the regenerated .ckl preserves the DISA status enum
+    assert "<STATUS>Open</STATUS>" in out.read_text()