drydock-cli 3.0.69__tar.gz → 3.0.70__tar.gz

{drydock_cli-3.0.69/drydock_cli.egg-info → drydock_cli-3.0.70}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.69
+Version: 3.0.70
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

{drydock_cli-3.0.69 → drydock_cli-3.0.70}/drydock/stig.py

@@ -12,6 +12,7 @@ Stdlib only (xml.etree + json). All logic original to Drydock.
 from __future__ import annotations
 
 import json
+import re
 import xml.etree.ElementTree as ET
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -124,10 +125,10 @@ def _set_child_text(el: ET.Element, tag: str, text: str) -> None:
 
 
 # ── parsing ─────────────────────────────────────────────────────────────────
-def parse_ckl(path: str | Path) -> Checklist:
+def _checklist_from_tree(tree: Any) -> Checklist:
     cl = Checklist("ckl")
-    cl._tree = ET.parse(path)
-    root = cl._tree.getroot()
+    cl._tree = tree
+    root = tree.getroot()
     asset = root.find("ASSET")
     if asset is not None:
         cl.asset = {c.tag: (c.text or "") for c in asset}
@@ -149,6 +150,106 @@ def parse_ckl(path: str | Path) -> Checklist:
     return cl
 
 
+def parse_ckl(path: str | Path) -> Checklist:
+    return _checklist_from_tree(ET.parse(path))
+
+
+# ── XCCDF benchmark (the raw STIG) → a blank .ckl ───────────────────────────
+_VULN_DISCUSS = re.compile(r"<VulnDiscussion>(.*?)</VulnDiscussion>", re.S | re.I)
+
+
+def _lname(el) -> str:
+    return el.tag.split("}")[-1]
+
+
+def _kids(parent, name):
+    return [c for c in parent if _lname(c) == name]
+
+
+def _ktext(parent, name) -> str:
+    for c in parent:
+        if _lname(c) == name:
+            return (c.text or "").strip()
+    return ""
+
+
+def parse_xccdf(path: str | Path) -> dict:
+    """Parse a DISA STIG XCCDF benchmark (namespace-agnostic) into
+    {title, version, release, stigid, rules:[...]}."""
+    root = ET.parse(path).getroot()
+    title = _ktext(root, "title")
+    version = _ktext(root, "version")
+    stigid = root.get("id", "")
+    release = ""
+    for pt in _kids(root, "plain-text"):
+        if pt.get("id") == "release-info":
+            release = (pt.text or "").strip()
+    rules = []
+    for group in _kids(root, "Group"):
+        gid = group.get("id", "")
+        gtitle = _ktext(group, "title")
+        for rule in _kids(group, "Rule"):
+            desc = _ktext(rule, "description")
+            m = _VULN_DISCUSS.search(desc)
+            check = ""
+            for ch in _kids(rule, "check"):
+                check = _ktext(ch, "check-content") or check
+            rules.append({
+                "group_id": gid, "group_title": gtitle,
+                "rule_id": rule.get("id", ""), "rule_ver": _ktext(rule, "version"),
+                "severity": rule.get("severity", ""), "weight": rule.get("weight", ""),
+                "title": _ktext(rule, "title"),
+                "discussion": (m.group(1).strip() if m else desc),
+                "check": check, "fix": _ktext(rule, "fixtext"),
+                "ccis": [(c.text or "").strip() for c in _kids(rule, "ident")
+                         if "cci" in (c.get("system", "") + (c.text or "")).lower()],
+            })
+    return {"title": title, "version": version, "release": release,
+            "stigid": stigid, "rules": rules}
+
+
+def xccdf_to_checklist(path: str | Path, *, host: str = "") -> Checklist:
+    """Build a blank .ckl (all rules Not_Reviewed) from a STIG XCCDF benchmark —
+    the inverse of what STIG Viewer does, so the catalog can be assessed directly."""
+    bench = parse_xccdf(path)
+    stigref = f"{bench['title']} :: Version {bench['version']}, {bench['release']}".strip(" :,")
+    root = ET.Element("CHECKLIST")
+    asset = ET.SubElement(root, "ASSET")
+    for tag, val in [("ROLE", "None"), ("ASSET_TYPE", "Computing"), ("HOST_NAME", host),
+                     ("HOST_IP", ""), ("HOST_MAC", ""), ("HOST_FQDN", ""),
+                     ("TARGET_COMMENT", ""), ("TECH_AREA", ""), ("TARGET_KEY", ""),
+                     ("WEB_OR_DATABASE", "false"), ("WEB_DB_SITE", ""), ("WEB_DB_INSTANCE", "")]:
+        ET.SubElement(asset, tag).text = val
+    istig = ET.SubElement(ET.SubElement(root, "STIGS"), "iSTIG")
+    info = ET.SubElement(istig, "STIG_INFO")
+    for name, data in [("version", bench["version"]), ("classification", "UNCLASSIFIED"),
+                       ("stigid", bench["stigid"]), ("description", ""),
+                       ("releaseinfo", bench["release"]), ("title", bench["title"])]:
+        sid = ET.SubElement(info, "SI_DATA")
+        ET.SubElement(sid, "SID_NAME").text = name
+        ET.SubElement(sid, "SID_DATA").text = data
+    for rd in bench["rules"]:
+        vuln = ET.SubElement(istig, "VULN")
+        for attr, val in [("Vuln_Num", rd["group_id"]), ("Severity", rd["severity"]),
+                          ("Group_Title", rd["group_title"]), ("Rule_ID", rd["rule_id"]),
+                          ("Rule_Ver", rd["rule_ver"]), ("Rule_Title", rd["title"]),
+                          ("Vuln_Discuss", rd["discussion"]), ("Check_Content", rd["check"]),
+                          ("Fix_Text", rd["fix"]), ("Weight", rd["weight"]), ("STIGRef", stigref)]:
+            sd = ET.SubElement(vuln, "STIG_DATA")
+            ET.SubElement(sd, "VULN_ATTRIBUTE").text = attr
+            ET.SubElement(sd, "ATTRIBUTE_DATA").text = val or ""
+        for cci in rd["ccis"]:
+            sd = ET.SubElement(vuln, "STIG_DATA")
+            ET.SubElement(sd, "VULN_ATTRIBUTE").text = "CCI_REF"
+            ET.SubElement(sd, "ATTRIBUTE_DATA").text = cci
+        ET.SubElement(vuln, "STATUS").text = "Not_Reviewed"
+        ET.SubElement(vuln, "FINDING_DETAILS").text = ""
+        ET.SubElement(vuln, "COMMENTS").text = ""
+        ET.SubElement(vuln, "SEVERITY_OVERRIDE").text = ""
+        ET.SubElement(vuln, "SEVERITY_JUSTIFICATION").text = ""
+    return _checklist_from_tree(ET.ElementTree(root))
+
+
 def parse_cklb(path: str | Path) -> Checklist:
     cl = Checklist("cklb")
     cl._data = json.loads(Path(path).read_text("utf-8"))

{drydock_cli-3.0.69 → drydock_cli-3.0.70}/drydock/tui/app.py

@@ -496,7 +496,7 @@ class DrydockApp(App):
                 "  /loop            /loop <count> <prompt> — repeat a prompt (Esc stops)\n"
                 "  /mcp             list connected MCP servers and their tools\n"
                 "  /rmf             RMF automation — /rmf bootstrap, then /rmf-control etc.\n"
-                "  /stig            summarize a .ckl/.cklb; assess via /stig-assess\n"
+                "  /stig            /stig new <xccdf> → blank .ckl; summarize; /stig-assess\n"
                 "  /clear           reset the conversation\n"
                 "  /quit            exit\n"
                 "Type a task and press Enter. ↑/↓ recall history · Esc stops · Ctrl+O expands tools."
@@ -524,12 +524,32 @@ class DrydockApp(App):
 
         parts = arg.split()
         if not parts:
-            self._info("usage: /stig <path-to.ckl|.cklb> [status]   "
-                       "(status: open|not_a_finding|not_applicable|not_reviewed)\n"
-                       "Assess it: /loop <n> /stig-assess <path>")
+            self._info("usage:\n"
+                       "  /stig new <benchmark-xccdf.xml> [out.ckl]  — blank .ckl from a STIG\n"
+                       "  /stig <path.ckl|.cklb> [status]            — summary / list by status\n"
+                       "  /stig graph <path.ckl>                     — ingest into the RMF graph\n"
+                       "Assess:  /loop <n> /stig-assess <path>")
             return
         import os as _os
         cwd = self.config.get("cwd") or "."
+        _abs = lambda p: p if _os.path.isabs(p) else _os.path.join(cwd, p)  # noqa: E731
+        # /stig new <xccdf> [out.ckl] — generate a BLANK .ckl from a STIG XCCDF benchmark
+        if parts[0].lower() == "new" and len(parts) > 1:
+            xp = _abs(parts[1])
+            out = _abs(parts[2]) if len(parts) > 2 else \
+                _os.path.splitext(_abs(parts[1]))[0].replace("-xccdf", "") + ".ckl"
+            try:
+                cl = stig.xccdf_to_checklist(xp)
+                cl.save(out)
+            except Exception as e:  # noqa: BLE001
+                self._mount(ErrorMessage(f"could not parse the STIG XCCDF: {e}"))
+                return
+            self._info(
+                f"✓ Generated {out} from the STIG benchmark — {len(cl.rules)} rules, "
+                "all Not_Reviewed. Now pull in the app's evidence and assess:\n"
+                f"  /graphrag build <app-docs>   ·   /loop {len(cl.rules)} /stig-assess {out}"
+            )
+            return
         # /stig graph <path> — ingest the checklist into the RMF typed graph
         if parts[0].lower() == "graph" and len(parts) > 1:
             from drydock import rmf_graph

{drydock_cli-3.0.69 → drydock_cli-3.0.70/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.69
+Version: 3.0.70
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

{drydock_cli-3.0.69 → drydock_cli-3.0.70}/drydock_cli.egg-info/SOURCES.txt

@@ -89,4 +89,5 @@ tests/test_tools_undo.py
 tests/test_tui.py
 tests/test_tuning.py
 tests/test_vision_input.py
-tests/test_web_tools.py
+tests/test_web_tools.py
+tests/test_xccdf.py

{drydock_cli-3.0.69 → drydock_cli-3.0.70}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.69"
+version = "3.0.70"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

drydock_cli-3.0.70/tests/test_xccdf.py

@@ -0,0 +1,56 @@
+"""XCCDF benchmark (raw STIG) -> blank .ckl generator — the inverse of STIG
+Viewer, closing the loop: STIG benchmark -> assess -> completed .ckl."""
+from __future__ import annotations
+
+import xml.etree.ElementTree as ET
+
+from drydock import stig
+
+# A minimal but real-shaped DISA STIG XCCDF (namespaced, like the live files).
+_XCCDF = '''<?xml version="1.0"?>
+<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" id="ASD_STIG">
+  <title>Application Security and Development STIG</title>
+  <version>6</version>
+  <plain-text id="release-info">Release: 1 Benchmark Date: 24 Jan 2024</plain-text>
+  <Group id="V-222387">
+    <title>SRG-APP-000001</title>
+    <Rule id="SV-222387r879511_rule" severity="medium" weight="10.0">
+      <version>APSC-DV-000010</version>
+      <title>The application must limit the number of concurrent sessions.</title>
+      <description>&lt;VulnDiscussion&gt;Limiting sessions reduces risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;</description>
+      <ident system="http://cyber.mil/cci">CCI-000054</ident>
+      <fixtext fixref="F-1">Configure the application to limit concurrent sessions.</fixtext>
+      <check system="C-1"><check-content>Review the application configuration for a session limit.</check-content></check>
+    </Rule>
+  </Group>
+</Benchmark>'''
+
+
+def test_parse_xccdf(tmp_path):
+    p = tmp_path / "b-xccdf.xml"; p.write_text(_XCCDF)
+    b = stig.parse_xccdf(p)
+    assert b["title"].startswith("Application Security") and b["version"] == "6"
+    assert "Release: 1" in b["release"]
+    r = b["rules"][0]
+    assert r["group_id"] == "V-222387" and r["rule_id"] == "SV-222387r879511_rule"
+    assert r["rule_ver"] == "APSC-DV-000010" and r["severity"] == "medium"
+    assert r["discussion"] == "Limiting sessions reduces risk."   # VulnDiscussion extracted
+    assert "session limit" in r["check"] and "concurrent sessions" in r["fix"]
+    assert r["ccis"] == ["CCI-000054"]
+
+
+def test_xccdf_to_blank_ckl(tmp_path):
+    p = tmp_path / "b-xccdf.xml"; p.write_text(_XCCDF)
+    cl = stig.xccdf_to_checklist(p, host="appsrv1")
+    assert len(cl.rules) == 1 and cl.counts()["not_reviewed"] == 1
+    assert cl.rules[0].rule_id == "SV-222387r879511_rule" and cl.rules[0].cci == "CCI-000054"
+    out = tmp_path / "gen.ckl"; cl.save(out)
+    ET.parse(out)  # valid XML
+    # round-trips through the engine and is assessable
+    re = stig.load(out)
+    assert re.rules[0].check_content.startswith("Review the application")
+    assert re.asset["HOST_NAME"] == "appsrv1"
+    re.update("V-222387", status="open", finding_details="no limit configured"); re.save(out)
+    assert stig.load(out).rules[0].status == "open"
+    # the regenerated .ckl preserves the DISA status enum
+    assert "<STATUS>Open</STATUS>" in out.read_text()