drydock-cli 3.0.71__tar.gz → 3.0.73__tar.gz

{drydock_cli-3.0.71/drydock_cli.egg-info → drydock_cli-3.0.73}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.71
+Version: 3.0.73
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/drydock/extract.py

@@ -19,8 +19,9 @@ import zipfile
 from pathlib import Path
 
 # Extensions we can pull text out of (beyond the plain-text formats GraphRAG
-# already reads directly).
-EXTRACTABLE_EXT = {".pdf", ".docx"}
+# already reads directly). .ckl/.cklb are STIG checklists — we extract the
+# meaningful per-rule text (id/severity/status/finding), not the raw XML/JSON.
+EXTRACTABLE_EXT = {".pdf", ".docx", ".ckl", ".cklb"}
 
 _W = "{http://schemas.openxmlformats.org/wordprocessingml/2006/main}"
 
@@ -70,13 +71,38 @@ def _extract_pdf(path: str | Path) -> str | None:
         return None
 
 
+def _extract_checklist(path: str | Path) -> str | None:
+    """Flatten a STIG .ckl/.cklb to readable, queryable text (per-rule id,
+    severity, status, title, finding details) — so the agent can answer 'which
+    findings are open?' over an ingested checklist."""
+    try:
+        from drydock import stig
+
+        cl = stig.load(path)
+    except Exception:  # noqa: BLE001 — unreadable/unsupported → skip cleanly
+        return None
+    host = cl.asset.get("HOST_NAME") or cl.asset.get("host_name") or "?"
+    lines = [f"STIG Checklist: {cl.stig_name or 'STIG'} (host: {host})",
+             "Counts: " + ", ".join(f"{k}={v}" for k, v in cl.counts().items())]
+    for r in cl.rules:
+        lines.append(f"\n{r.group_id} ({r.rule_id}) severity={r.severity} "
+                     f"STATUS={r.status} — {r.title}")
+        if r.finding_details:
+            lines.append(f"  Finding: {r.finding_details}")
+        if r.check_content:
+            lines.append(f"  Check: {r.check_content[:300]}")
+    return "\n".join(lines) or None
+
+
 def extract_document(path: str | Path) -> str | None:
-    """Extract text from a supported document (.pdf/.docx), or None."""
+    """Extract text from a supported document (.pdf/.docx/.ckl/.cklb), or None."""
     ext = Path(path).suffix.lower()
     if ext == ".docx":
         return _extract_docx(path)
     if ext == ".pdf":
         return _extract_pdf(path)
+    if ext in (".ckl", ".cklb"):
+        return _extract_checklist(path)
     return None
 
 

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/drydock/stig.py

@@ -281,3 +281,32 @@ def load(path: str | Path) -> Checklist:
     # sniff: JSON → cklb, else ckl
     head = Path(path).read_text("utf-8", "ignore").lstrip()[:1]
     return parse_cklb(path) if head == "{" else parse_ckl(path)
+
+
+def summary_lines(cl: "Checklist", label: str, status: str | None = None) -> list[str]:
+    """Build the `/stig` summary view: counts, an optional status listing (never
+    silently truncated), and scale-aware next-step hints. Pure/presentation so it
+    can be unit-tested without the TUI."""
+    host = cl.asset.get("HOST_NAME") or cl.asset.get("host_name") or "?"
+    c = cl.counts()
+    lines = [f"STIG checklist {label}  (host: {host}, format: {cl.fmt})",
+             f"  {len(cl.rules)} rules — " + " · ".join(f"{k}={v}" for k, v in c.items())]
+    if status:
+        sf = canonical_status(status)
+        hits = [r for r in cl.rules if r.status == sf]
+        lines.append(f"\n{sf} ({len(hits)}):")
+        lines += [f"  {r.group_id} ({r.severity}) — {r.title}" for r in hits[:50]]
+        if len(hits) > 50:  # never silently truncate
+            lines.append(f"  … showing first 50 of {len(hits)}; "
+                         "open the .ckl in STIG Viewer for the full list.")
+        return lines
+    nr = c.get("not_reviewed", 0)
+    if nr:
+        lines.append(f"\nAssess the {nr} un-reviewed rule(s) — one focused turn each:"
+                     f"\n  /loop {nr} /stig-assess {label}")
+        if nr > 40:
+            lines.append(f"  (large checklist — that's {nr} model turns; you can run it in "
+                         "batches and re-run /stig to see remaining counts.)")
+    if c.get("open"):
+        lines.append(f"List open findings to remediate:  /stig {label} open")
+    return lines

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/drydock/tui/app.py

@@ -12,9 +12,10 @@ import threading
 import time
 
 from textual import work
-from textual.app import App, ComposeResult
+from textual.app import App, ComposeResult, ScreenStackError
 from textual.binding import Binding
 from textual.containers import Vertical, VerticalScroll
+from textual.css.query import NoMatches
 from textual.widgets import Static
 
 from drydock.agent import (
@@ -351,8 +352,15 @@ class DrydockApp(App):
         return f"{spin} {self._work_word}…  ({elapsed} · ↓ {toks} tokens{eff}{queued})"
 
     def _refresh_status(self) -> None:
-        self.query_one("#status", Static).update(self._status_text())
-        self.query_one("#working", Static).update(self._working_text())
+        # The 0.18s _tick_work timer can fire one last time DURING app teardown,
+        # after the footer widgets have been removed — query_one would then raise
+        # NoMatches and crash the app (or fail a test). Be defensive: if the
+        # widgets aren't there (shutting down), there's nothing to refresh.
+        try:
+            self.query_one("#status", Static).update(self._status_text())
+            self.query_one("#working", Static).update(self._working_text())
+        except (NoMatches, ScreenStackError):
+            pass
 
     @property
     def _scroll(self) -> VerticalScroll:
@@ -469,6 +477,8 @@ class DrydockApp(App):
                 self._info("Nothing to go back to.")
         elif cmd == "/compact":
             self._cmd_compact()
+        elif cmd == "/context":
+            self._cmd_context(arg)
         elif cmd == "/graphrag":
             self._cmd_graphrag(arg)
         elif cmd == "/status":
@@ -490,6 +500,7 @@ class DrydockApp(App):
                 "  /stop            stop the running turn (or press Esc)\n"
                 "  /status          session model, cwd, turns, tokens\n"
                 "  /compact         shrink old context to free up the window\n"
+                "  /context         view/set the context-window budget (e.g. /context 65536)\n"
                 "  /graphrag        ingest docs into a knowledge base the agent can use\n"
                 "                   build <path> · add <path> · query <q> · status · clear\n"
                 "  /skills          list skills · /skills new <name> <prompt> to create one\n"
@@ -576,19 +587,8 @@ class DrydockApp(App):
         except Exception as e:  # noqa: BLE001
             self._mount(ErrorMessage(f"could not read checklist: {e}"))
             return
-        host = cl.asset.get("HOST_NAME") or cl.asset.get("host_name") or "?"
-        c = cl.counts()
-        lines = [f"STIG checklist {path}  (host: {host}, format: {cl.fmt})",
-                 f"  {len(cl.rules)} rules — " + " · ".join(f"{k}={v}" for k, v in c.items())]
-        if len(parts) > 1:
-            sf = stig.canonical_status(parts[1])
-            hits = [r for r in cl.rules if r.status == sf]
-            lines.append(f"\n{sf} ({len(hits)}):")
-            lines += [f"  {r.group_id} ({r.severity}) — {r.title}" for r in hits[:50]]
-        else:
-            lines.append("Assess un-reviewed rules:  /loop "
-                         f"{c.get('not_reviewed', 0) or 1} /stig-assess {parts[0]}")
-        self._info("\n".join(lines))
+        status = parts[1] if len(parts) > 1 else None
+        self._info("\n".join(stig.summary_lines(cl, parts[0], status)))
 
     def _cmd_rmf(self, arg: str) -> None:
         """RMF automation: bootstrap the NIST 800-53 catalog into the knowledge
@@ -735,6 +735,39 @@ class DrydockApp(App):
         else:
             self._begin(prompt)
 
+    def _cmd_context(self, arg: str) -> None:
+        """View or change the context-window budget (tokens) — the cap that drives
+        the ctx gauge + auto-compaction. `/context` shows it + its source; `/context
+        <n>` sets and PERSISTS it to ~/.drydock/config.toml. This is the lever for
+        'stuck at 32k': an old config.toml value (drydock never rewrites an existing
+        one) or a smaller model-server -c silently caps you."""
+        limit = self.config.get("context_limit", 65536) or 65536
+        arg = (arg or "").strip()
+        if not arg:
+            self._info(
+                f"context_limit: {limit:,} tokens (the '/{limit // 1024}k' in the ctx gauge).\n"
+                "Source order: built-in default 65536 < ~/.drydock/config.toml < --context-limit.\n"
+                "If you're stuck below this, your MODEL SERVER's context is smaller — raise its\n"
+                "`-c`/`--ctx-size`/`max_model_len` to match. To change drydock's budget:\n"
+                "  /context <tokens>      e.g. /context 65536   (saved to config.toml)"
+            )
+            return
+        try:
+            n = int(arg.replace(",", "").replace("k", "000").replace("K", "000"))
+            if n < 4096 or n > 2_000_000:
+                raise ValueError
+        except ValueError:
+            self._mount(ErrorMessage("usage: /context <tokens>  (4096–2000000, e.g. /context 65536)"))
+            return
+        self.config["context_limit"] = n
+        self._persist_config()
+        self._refresh_status()  # repaint the gauge against the new budget
+        self._info(
+            f"✓ context_limit set to {n:,} tokens and saved to ~/.drydock/config.toml.\n"
+            "Make sure your model server's context (-c / --ctx-size / max_model_len) is at\n"
+            "least this, or the server will still cap you below it."
+        )
+
     def _cmd_compact(self) -> None:
         """Manually compact the conversation to reclaim context NOW, without
         waiting for the automatic 60%-of-window threshold (agent.maybe_compact).

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/drydock/tui/widgets.py

@@ -153,7 +153,7 @@ class PromptHistory:
 # completes the prefix.
 SLASH_COMMANDS = [
     "/help", "/model", "/cwd", "/undo", "/back", "/stop", "/status",
-    "/compact", "/graphrag", "/skills", "/loop", "/mcp", "/rmf", "/stig",
+    "/compact", "/context", "/graphrag", "/skills", "/loop", "/mcp", "/rmf", "/stig",
     "/clear", "/quit",
 ]
 

{drydock_cli-3.0.71 → drydock_cli-3.0.73/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.71
+Version: 3.0.73
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.71"
+version = "3.0.73"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/tests/test_extract.py

@@ -69,3 +69,27 @@ def test_graphrag_ingests_docx_and_pdf(tmp_path):
     if extract.pdf_backend_available():
         assert "manual.pdf" in srcs
         assert graphrag.query_index(idx, "refunds Zephyr gateway")["chunks"][0]["source"] == "manual.pdf"
+
+
+def test_extract_ckl_checklist(tmp_path):
+    p = tmp_path / "sys.ckl"
+    p.write_text('<?xml version="1.0"?><CHECKLIST><ASSET><HOST_NAME>web01</HOST_NAME></ASSET>'
+                 '<STIGS><iSTIG><STIG_INFO></STIG_INFO><VULN>'
+                 '<STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-1</ATTRIBUTE_DATA></STIG_DATA>'
+                 '<STIG_DATA><VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE><ATTRIBUTE_DATA>disable debug</ATTRIBUTE_DATA></STIG_DATA>'
+                 '<STATUS>Open</STATUS><FINDING_DETAILS>debug=true found</FINDING_DETAILS></VULN></iSTIG></STIGS></CHECKLIST>')
+    out = extract.extract_document(p)
+    assert out and "V-1" in out and "STATUS=open" in out and "debug=true found" in out
+
+
+def test_graphrag_ingests_ckl(tmp_path):
+    (tmp_path / "sys.ckl").write_text('<?xml version="1.0"?><CHECKLIST><STIGS><iSTIG><STIG_INFO></STIG_INFO>'
+        '<VULN><STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-42</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE><ATTRIBUTE_DATA>SSH root login disabled</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STATUS>NotAFinding</STATUS></VULN></iSTIG></STIGS></CHECKLIST>')
+    store = graphrag.default_store_path(str(tmp_path))
+    stats = graphrag.build_index(["."], store, cwd=str(tmp_path))
+    assert stats["files"] == 1
+    idx = graphrag.load_index(store)
+    assert "sys.ckl" in graphrag.sources(idx)
+    assert graphrag.query_index(idx, "SSH root login")["chunks"]

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/tests/test_mcp.py

@@ -55,3 +55,33 @@ def test_bad_server_is_skipped(tmp_path):
     schemas = mcp.connect_all(str(tmp_path), log=logs.append)
     assert schemas == []
     assert any("failed to start" in m for m in logs)
+
+
+def test_content_to_text_joins_text_blocks():
+    out = mcp._content_to_text({"content": [{"type": "text", "text": "line1"},
+                                            {"type": "text", "text": "line2"}]})
+    assert out == "line1\nline2"
+
+
+def test_content_to_text_non_text_block_is_json():
+    out = mcp._content_to_text({"content": [{"type": "image", "data": "abc"}]})
+    assert '"type": "image"' in out and '"data": "abc"' in out
+
+
+def test_content_to_text_error_and_empty_and_nondict():
+    assert mcp._content_to_text({"content": [{"type": "text", "text": "boom"}],
+                                 "isError": True}).startswith("[tool reported an error]")
+    assert mcp._content_to_text({"content": []}) == "(empty result)"
+    assert mcp._content_to_text("raw string") == "raw string"
+
+
+def test_load_config_project_overrides_user(tmp_path, monkeypatch):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    user = tmp_path / ".drydock"; user.mkdir()
+    (user / "mcp.json").write_text('{"mcpServers": {"db": {"command": "user-cmd"}}}')
+    proj = tmp_path / "proj" / ".drydock"; proj.mkdir(parents=True)
+    (proj / "mcp.json").write_text('{"mcpServers": {"db": {"command": "proj-cmd"},'
+                                   ' "nocmd": {"args": []}}}')
+    cfg = mcp.load_config(str(tmp_path / "proj"))
+    assert cfg["db"]["command"] == "proj-cmd"   # project wins
+    assert "nocmd" not in cfg                    # missing command → skipped

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/tests/test_rmf_graph.py

@@ -60,3 +60,29 @@ def test_graphadd_and_graphquery_tools(tmp_path):
 
 def test_graphquery_empty_graph_is_graceful(tmp_path):
     assert "empty" in tool_graphquery({"op": "control", "id": "AC-2"}, {"cwd": str(tmp_path)}).lower()
+
+
+def test_inherited_controls_handles_cycle():
+    """A RESIDES_ON cycle (misconfigured topology) must not infinite-loop."""
+    g = G.RmfGraph()
+    a, b = G.component_id("a"), G.component_id("b")
+    g.add_node(a, "Component"); g.add_node(b, "Component")
+    g.add_edge(a, "RESIDES_ON", b)
+    g.add_edge(b, "RESIDES_ON", a)            # cycle
+    g.add_edge(b, "IMPLEMENTS", G.control_id("pe-3"))
+    got = g.inherited_controls(a)             # must terminate
+    assert G.control_id("pe-3") in got
+
+
+def test_inherited_controls_missing_node_is_empty():
+    g = G.RmfGraph()
+    assert g.inherited_controls(G.component_id("ghost")) == []
+
+
+def test_neighbors_direction_and_missing():
+    g = G.RmfGraph()
+    g.add_edge("x", "REL", "y")
+    assert g.neighbors("x", "REL") == ["y"]
+    assert g.neighbors("y", "REL", direction="in") == ["x"]
+    assert g.neighbors("y", "REL", direction="out") == []
+    assert g.neighbors("nope") == []

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/tests/test_stig.py

@@ -93,3 +93,51 @@ def test_empty_and_minimal_checklists(tmp_path):
     assert stig.load(tmp_path / "e.ckl").rules == []
     (tmp_path / "m.cklb").write_text('{"stigs":[{"rules":[{"group_id":"V-5"}]}]}')
     assert stig.load(tmp_path / "m.cklb").rules[0].group_id == "V-5"
+
+
+def test_cklb_writeback_only_changes_status_fields(tmp_path):
+    """Editing a .cklb must change ONLY status/finding_details/comments and keep
+    everything else byte-stable (eMASS round-trip fidelity)."""
+    import json
+    data = {"title": "t", "stigs": [{"stig_name": "Demo", "version": "1", "rules": [
+        {"group_id": "V-1", "rule_id": "SV-1", "rule_title": "Rule one",
+         "severity": "high", "status": "not_reviewed", "check_content": "do x",
+         "fix_text": "fix x", "finding_details": "", "comments": "", "weight": "10.0"}]}]}
+    p = tmp_path / "a.cklb"; p.write_text(json.dumps(data))
+    cl = stig.load(p)
+    cl.update("V-1", status="open", finding_details="found it")
+    cl.save(p)
+    re = json.loads(p.read_text())
+    rule = re["stigs"][0]["rules"][0]
+    assert rule["status"] == "open" and rule["finding_details"] == "found it"
+    # untouched fields preserved exactly
+    assert rule["severity"] == "high" and rule["check_content"] == "do x"
+    assert rule["weight"] == "10.0" and rule["rule_title"] == "Rule one"
+
+
+def test_summary_lines_scale_and_no_silent_truncation(tmp_path):
+    import json
+    # 60 rules: 55 open, 5 not_reviewed → exercises >40 hint, open hint, >50 cap note
+    rules = [{"group_id": f"V-{i}", "rule_id": f"SV-{i}", "rule_title": f"r{i}",
+              "severity": "medium", "status": "open" if i < 55 else "not_reviewed"}
+             for i in range(60)]
+    (tmp_path / "b.cklb").write_text(json.dumps(
+        {"stigs": [{"stig_name": "S", "version": "1", "rules": rules}]}))
+    cl = stig.load(tmp_path / "b.cklb")
+    summ = "\n".join(stig.summary_lines(cl, "b.cklb"))
+    assert "/loop 5 /stig-assess b.cklb" in summ          # exact not_reviewed count
+    assert "List open findings" in summ                    # open hint shown
+    open_view = "\n".join(stig.summary_lines(cl, "b.cklb", "open"))
+    assert "showing first 50 of 55" in open_view           # no silent truncation
+    assert open_view.count("V-") <= 51                     # capped list + the note
+
+
+def test_summary_lines_large_checklist_hint(tmp_path):
+    import json
+    rules = [{"group_id": f"V-{i}", "rule_id": f"SV-{i}", "rule_title": "x",
+              "severity": "low", "status": "not_reviewed"} for i in range(286)]
+    (tmp_path / "big.cklb").write_text(json.dumps(
+        {"stigs": [{"stig_name": "ASD", "version": "6", "rules": rules}]}))
+    cl = stig.load(tmp_path / "big.cklb")
+    summ = "\n".join(stig.summary_lines(cl, "big.cklb"))
+    assert "/loop 286" in summ and "286 model turns" in summ

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/tests/test_tui.py

@@ -385,3 +385,40 @@ def test_loop_command_iterates_and_stops():
             assert app._repeat is None
 
     asyncio.run(main())
+
+
+def test_refresh_status_survives_missing_widgets():
+    """The 0.18s _tick_work timer can fire one last time during app teardown,
+    after the footer widgets (#status/#working) are gone. _refresh_status must
+    swallow the resulting NoMatches, not crash the app. Regression for a flaky
+    NoMatches('#status') that surfaced under full-suite load."""
+    app = DrydockApp({"model": "gemma4", "provider": "vllm", "cwd": "/tmp"})
+    app._busy = True
+    # No widgets are mounted (no run_test), so query_one('#status') would raise
+    # NoMatches — the guard must make this a safe no-op.
+    app._refresh_status()   # must not raise
+    app._tick_work()        # the timer path that triggered the crash; must not raise
+
+
+def test_context_command_sets_and_persists(tmp_path, monkeypatch):
+    """/context <n> updates the live budget AND writes it to config.toml — the
+    fix for a stale context_limit (e.g. 32768 left from an old install) that
+    silently caps the window."""
+    monkeypatch.setenv("HOME", str(tmp_path))
+
+    async def main():
+        app = DrydockApp({"model": "gemma4", "provider": "vllm", "cwd": "/tmp",
+                          "context_limit": 32768})
+        async with app.run_test() as pilot:
+            await pilot.pause()
+            app._cmd_context("65536")          # set + persist
+            await pilot.pause()
+            assert app.config["context_limit"] == 65536
+            app._cmd_context("not-a-number")   # invalid → unchanged
+            await pilot.pause()
+            assert app.config["context_limit"] == 65536
+
+    asyncio.run(main())
+    import tomllib
+    saved = tomllib.loads((tmp_path / ".drydock" / "config.toml").read_text())
+    assert saved["context_limit"] == 65536   # survived to disk

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/tests/test_web_tools.py

@@ -70,3 +70,36 @@ def test_search_parses_ddg_html(monkeypatch):
     assert res and res[0]["title"] == "Example A"
     assert res[0]["url"] == "https://example.com/a"   # uddg redirect unwrapped
     assert res[0]["snippet"] == "snippet A text"
+
+
+class _FakeResp:
+    def __init__(self, body: bytes, ctype: str):
+        self._body = body
+        self.headers = {"Content-Type": ctype}
+    def read(self, *a): return self._body
+    def __enter__(self): return self
+    def __exit__(self, *a): return False
+
+
+def test_fetch_strips_html_script_and_tags(monkeypatch):
+    import urllib.request
+    html_doc = (b"<html><head><script>var x=1; evil()</script><style>a{}</style></head>"
+                b"<body><h1>Title</h1><p>Hello &amp; welcome</p></body></html>")
+    monkeypatch.setattr(urllib.request, "urlopen",
+                        lambda *a, **k: _FakeResp(html_doc, "text/html"))
+    out = web.fetch("example.com")
+    assert "Title" in out and "Hello & welcome" in out
+    assert "evil()" not in out and "<p>" not in out   # script + tags gone
+
+
+def test_fetch_truncates_long_text(monkeypatch):
+    import urllib.request
+    big = b"<html><body>" + b"x " * 5000 + b"</body></html>"
+    monkeypatch.setattr(urllib.request, "urlopen",
+                        lambda *a, **k: _FakeResp(big, "text/html"))
+    out = web.fetch("example.com", max_chars=500)
+    assert "truncated" in out and len(out) < 700
+
+
+def test_format_search_empty():
+    assert "No web results" in web.format_search("rare query", [])

{drydock_cli-3.0.71 → drydock_cli-3.0.73}/tests/test_xccdf.py

@@ -54,3 +54,32 @@ def test_xccdf_to_blank_ckl(tmp_path):
     assert stig.load(out).rules[0].status == "open"
     # the regenerated .ckl preserves the DISA status enum
     assert "<STATUS>Open</STATUS>" in out.read_text()
+
+
+def test_xccdf_scale_many_rules(tmp_path):
+    """A full DISA STIG (e.g. the ASD STIG) has hundreds of rules. Verify the
+    XCCDF->.ckl path handles scale: all rules parsed, well-formed, round-trips,
+    full id/title fidelity. (Validated live against U_ASD_STIG_V6R1 = 286 rules.)"""
+    rules = "".join(
+        f'<Group id="V-{i:05d}"><title>SRG-APP-{i:06d}</title>'
+        f'<Rule id="SV-{i:05d}r1_rule" severity="medium" weight="10.0">'
+        f'<version>APSC-DV-{i:06d}</version><title>Requirement {i}.</title>'
+        f'<description>&lt;VulnDiscussion&gt;Discussion {i}.&lt;/VulnDiscussion&gt;</description>'
+        f'<ident system="http://cyber.mil/cci">CCI-{i:06d}</ident>'
+        f'<fixtext fixref="F-{i}">Fix {i}.</fixtext>'
+        f'<check system="C-{i}"><check-content>Check {i}.</check-content></check>'
+        f'</Rule></Group>'
+        for i in range(250)
+    )
+    xccdf = ('<?xml version="1.0"?><Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" '
+             'id="BIG"><title>Big STIG</title><version>1</version>'
+             f'<plain-text id="release-info">Release: 1</plain-text>{rules}</Benchmark>')
+    p = tmp_path / "big-xccdf.xml"; p.write_text(xccdf)
+    cl = stig.xccdf_to_checklist(p, host="srv")
+    assert len(cl.rules) == 250
+    assert all(r.rule_id and r.title for r in cl.rules)        # full fidelity
+    out = tmp_path / "big.ckl"; cl.save(out)
+    ET.parse(out)                                              # valid at scale
+    re = stig.load(out)
+    assert len(re.rules) == 250 and re.counts()["not_reviewed"] == 250
+    assert re.rules[123].rule_id == "SV-00123r1_rule"          # order + content preserved