drydock-cli 3.0.73__tar.gz → 3.0.75__tar.gz

{drydock_cli-3.0.73/drydock_cli.egg-info → drydock_cli-3.0.75}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.73
+Version: 3.0.75
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -91,10 +91,14 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/mcp` | List connected MCP servers + their tools |
 | `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
 | `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
+| `/stig new <xccdf>` | Generate a blank `.ckl` from a DISA STIG benchmark |
+| `/stig <ckl>` · `/stig <ckl> open` | Summarize a checklist · list findings by status |
+| `/stig graph <ckl>` | Ingest a checklist into the RMF graph (auto-links rules→controls via CCI) |
+| `/stig-assess <ckl>` · `/stig-remediate <ckl> <rule>` | Assess a rule vs evidence · write a fix script |
 | `/model` · `/cwd` | Show/set model & endpoint · working directory |
 | `/undo` · `/back` | Revert the last write · rewind the last turn |
-| `/compact` · `/status` · `/clear` | Shrink context · session stats · reset |
-| `/help` · `/quit` | Help · exit |
+| `/compact` · `/context [n]` | Shrink context now · view/set the context-window budget |
+| `/status` · `/clear` · `/help` · `/quit` | Session stats · reset · help · exit |
 
 ### Knowledge base (GraphRAG) — ingesting your documents
 
@@ -107,9 +111,11 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 
 Once built, the agent **automatically** retrieves from it (read-only `Knowledge`
 tool) when a question touches your material. Ingests text formats
-(`.md .txt .py .js .json .yaml .sql …`) **plus PDF and Word (`.docx`)**. `.docx`
-needs nothing extra; PDF uses the `pdftotext` binary (poppler) if present, else
-`pip install drydock-cli[pdf]` (pypdf). The index is a single JSON at
+(`.md .txt .py .js .json .yaml .sql …`), **PDF and Word (`.docx`)**, and **STIG
+checklists (`.ckl`/`.cklb`)** — checklists are flattened to per-rule findings so
+you can ask "which findings are open?". `.docx`/`.ckl` need nothing extra; PDF
+uses the `pdftotext` binary (poppler) if present, else `pip install
+drydock-cli[pdf]` (pypdf). The index is a single JSON at
 `<project>/.drydock/graphrag.json` — clean-room, no embeddings.
 
 ### Custom skills
@@ -144,6 +150,26 @@ relationships with `GraphQuery` — including **control inheritance** ("which
 servers inherit physical controls from their enclave?"). Stdlib in-memory graph,
 no Neo4j.
 
+### STIG checklists (DISA `.ckl`/`.cklb`)
+
+Take a raw DISA STIG benchmark all the way to a completed, eMASS/STIG-Viewer-
+compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
+
+```
+/stig new U_ASD_STIG_V6R1_Manual-xccdf.xml app.ckl   # benchmark → blank .ckl
+/graphrag build ./app                                 # pull in the app's evidence
+/loop 286 /stig-assess app.ckl                        # assess each rule vs evidence
+/stig app.ckl open                                    # list the open findings
+/stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
+/stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+```
+
+`/stig new` parses the XCCDF benchmark (validated against the full 286-rule
+Application STIG); `/stig-assess` reads your evidence and writes status +
+finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
+**auto-links each rule to its NIST 800-53 control** through DISA's CCI map
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+
 ## Install
 
 ```bash
@@ -173,10 +199,11 @@ commands to do the work, showing each as a collapsible tool card.
   `◡ Keelhauling…  (12s · ↓ 6.2k tokens · thinking with high effort)`
 - Submit while it's working and the prompt **queues** (drains in order)
 - Slash commands: `/model` · `/cwd` · `/undo` (revert last write) · `/back`
-  (rewind last turn) · `/status` · `/compact` (shrink context) · `/graphrag`
-  (build/query a knowledge base) · `/skills` (list your `/<name>` skills) ·
-  `/loop` (repeat a prompt) · `/mcp` (list MCP servers) · `/clear` · `/help` ·
-  `/quit`
+  (rewind last turn) · `/status` · `/compact` (shrink context) · `/context`
+  (view/set the context-window budget) · `/graphrag` (build/query a knowledge
+  base) · `/skills` (list your `/<name>` skills) · `/loop` (repeat a prompt) ·
+  `/mcp` (list MCP servers) · `/rmf` & `/stig` (NIST 800-53 / DISA STIG
+  automation) · `/clear` · `/help` · `/quit`
 
 It honors `AGENTS.md` / `DRYDOCK.md` in the working directory for project
 conventions.

{drydock_cli-3.0.73 → drydock_cli-3.0.75}/README.md

@@ -67,10 +67,14 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/mcp` | List connected MCP servers + their tools |
 | `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
 | `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
+| `/stig new <xccdf>` | Generate a blank `.ckl` from a DISA STIG benchmark |
+| `/stig <ckl>` · `/stig <ckl> open` | Summarize a checklist · list findings by status |
+| `/stig graph <ckl>` | Ingest a checklist into the RMF graph (auto-links rules→controls via CCI) |
+| `/stig-assess <ckl>` · `/stig-remediate <ckl> <rule>` | Assess a rule vs evidence · write a fix script |
 | `/model` · `/cwd` | Show/set model & endpoint · working directory |
 | `/undo` · `/back` | Revert the last write · rewind the last turn |
-| `/compact` · `/status` · `/clear` | Shrink context · session stats · reset |
-| `/help` · `/quit` | Help · exit |
+| `/compact` · `/context [n]` | Shrink context now · view/set the context-window budget |
+| `/status` · `/clear` · `/help` · `/quit` | Session stats · reset · help · exit |
 
 ### Knowledge base (GraphRAG) — ingesting your documents
 
@@ -83,9 +87,11 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 
 Once built, the agent **automatically** retrieves from it (read-only `Knowledge`
 tool) when a question touches your material. Ingests text formats
-(`.md .txt .py .js .json .yaml .sql …`) **plus PDF and Word (`.docx`)**. `.docx`
-needs nothing extra; PDF uses the `pdftotext` binary (poppler) if present, else
-`pip install drydock-cli[pdf]` (pypdf). The index is a single JSON at
+(`.md .txt .py .js .json .yaml .sql …`), **PDF and Word (`.docx`)**, and **STIG
+checklists (`.ckl`/`.cklb`)** — checklists are flattened to per-rule findings so
+you can ask "which findings are open?". `.docx`/`.ckl` need nothing extra; PDF
+uses the `pdftotext` binary (poppler) if present, else `pip install
+drydock-cli[pdf]` (pypdf). The index is a single JSON at
 `<project>/.drydock/graphrag.json` — clean-room, no embeddings.
 
 ### Custom skills
@@ -120,6 +126,26 @@ relationships with `GraphQuery` — including **control inheritance** ("which
 servers inherit physical controls from their enclave?"). Stdlib in-memory graph,
 no Neo4j.
 
+### STIG checklists (DISA `.ckl`/`.cklb`)
+
+Take a raw DISA STIG benchmark all the way to a completed, eMASS/STIG-Viewer-
+compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
+
+```
+/stig new U_ASD_STIG_V6R1_Manual-xccdf.xml app.ckl   # benchmark → blank .ckl
+/graphrag build ./app                                 # pull in the app's evidence
+/loop 286 /stig-assess app.ckl                        # assess each rule vs evidence
+/stig app.ckl open                                    # list the open findings
+/stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
+/stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+```
+
+`/stig new` parses the XCCDF benchmark (validated against the full 286-rule
+Application STIG); `/stig-assess` reads your evidence and writes status +
+finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
+**auto-links each rule to its NIST 800-53 control** through DISA's CCI map
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+
 ## Install
 
 ```bash
@@ -149,10 +175,11 @@ commands to do the work, showing each as a collapsible tool card.
   `◡ Keelhauling…  (12s · ↓ 6.2k tokens · thinking with high effort)`
 - Submit while it's working and the prompt **queues** (drains in order)
 - Slash commands: `/model` · `/cwd` · `/undo` (revert last write) · `/back`
-  (rewind last turn) · `/status` · `/compact` (shrink context) · `/graphrag`
-  (build/query a knowledge base) · `/skills` (list your `/<name>` skills) ·
-  `/loop` (repeat a prompt) · `/mcp` (list MCP servers) · `/clear` · `/help` ·
-  `/quit`
+  (rewind last turn) · `/status` · `/compact` (shrink context) · `/context`
+  (view/set the context-window budget) · `/graphrag` (build/query a knowledge
+  base) · `/skills` (list your `/<name>` skills) · `/loop` (repeat a prompt) ·
+  `/mcp` (list MCP servers) · `/rmf` & `/stig` (NIST 800-53 / DISA STIG
+  automation) · `/clear` · `/help` · `/quit`
 
 It honors `AGENTS.md` / `DRYDOCK.md` in the working directory for project
 conventions.

drydock_cli-3.0.75/drydock/cci.py

@@ -0,0 +1,109 @@
+"""CCI → NIST 800-53 control mapping.
+
+DISA's Control Correlation Identifiers (CCIs) are the bridge between a STIG rule
+and the NIST control it enforces: every STIG rule cites a CCI, and the CCI maps
+to an 800-53 control. This builds that map from DISA's `U_CCI_List.xml` so
+`/stig graph` can auto-create `Control —SATISFIED_BY→ STIG-Rule` edges.
+
+The mappings are U.S. Government public-domain data (facts, not copyrightable).
+The list is fetched once and cached locally; offline-safe. Stdlib only.
+
+All logic original to Drydock.
+"""
+from __future__ import annotations
+
+import json
+import re
+import urllib.error
+import urllib.request
+import xml.etree.ElementTree as ET
+from pathlib import Path
+
+# DISA U_CCI_List.xml (official list, mirrored). Government public-domain data.
+_CCI_URL = ("https://raw.githubusercontent.com/CyberSecDef/Cyber.Trackr.Live/master/"
+            "cyber.trackr.live/resources/data/cci/U_CCI_List.xml")
+_UA = "drydock-cli"
+_RE_CONTROL = re.compile(r"\s*([A-Za-z]{2})-(\d+)(?:\s*\(?(\d+)\)?|\.(\d+))?")
+
+
+def cache_path(cwd: str) -> Path:
+    return Path(cwd) / ".drydock" / "rmf" / "cci_map.json"
+
+
+def _ln(el) -> str:
+    return el.tag.split("}")[-1]
+
+
+def _norm_control(index: str) -> str | None:
+    """'AC-10' -> 'ac-10'; 'AC-2 (1)' / 'AC-2.1' -> 'ac-2.1'; junk -> None."""
+    m = _RE_CONTROL.match(index or "")
+    if not m:
+        return None
+    fam, num = m.group(1).lower(), m.group(2)
+    enh = m.group(3) or m.group(4)
+    return f"{fam}-{num}.{enh}" if enh else f"{fam}-{num}"
+
+
+def parse_cci_list(path: str | Path) -> dict[str, str]:
+    """Parse U_CCI_List.xml -> {CCI-id: control-id}. Picks the highest 800-53
+    revision reference (excludes 800-53A, which lists assessment procedures)."""
+    root = ET.parse(path).getroot()
+    out: dict[str, str] = {}
+    for item in (e for e in root.iter() if _ln(e) == "cci_item"):
+        cid = item.get("id")
+        best: str | None = None
+        best_ver = -1
+        for ref in item.iter():
+            if _ln(ref) != "reference":
+                continue
+            title = ref.get("title", "")
+            if not title.startswith("NIST SP 800-53") or "800-53A" in title:
+                continue
+            try:
+                ver = int(ref.get("version") or 0)
+            except ValueError:
+                ver = 0
+            ctl = _norm_control(ref.get("index", ""))
+            if ctl and ver >= best_ver:
+                best, best_ver = ctl, ver
+        if cid and best:
+            out[cid] = best
+    return out
+
+
+def fetch_to(path: str | Path, *, timeout: float = 60.0) -> None:
+    req = urllib.request.Request(_CCI_URL, headers={"User-Agent": _UA})
+    with urllib.request.urlopen(req, timeout=timeout) as r:  # noqa: S310 (trusted host)
+        data = r.read()
+    Path(path).write_bytes(data)
+
+
+def load_map(cwd: str, *, refresh: bool = False) -> dict[str, str]:
+    """Return the cached {CCI: control} map, building it from U_CCI_List.xml on
+    first use (or --refresh). Offline-safe: returns the cache if the fetch fails,
+    or {} if there's no cache and no network."""
+    cp = cache_path(cwd)
+    if cp.exists() and not refresh:
+        try:
+            return json.loads(cp.read_text("utf-8"))
+        except (OSError, ValueError):
+            pass
+    cp.parent.mkdir(parents=True, exist_ok=True)  # ensure .drydock/rmf/ exists before writing
+    raw = cp.with_suffix(".xml")
+    try:
+        fetch_to(raw)
+    except (urllib.error.URLError, OSError):
+        if cp.exists():
+            try:
+                return json.loads(cp.read_text("utf-8"))
+            except (OSError, ValueError):
+                return {}
+        return {}
+    mapping = parse_cci_list(raw)
+    cp.parent.mkdir(parents=True, exist_ok=True)
+    cp.write_text(json.dumps(mapping), "utf-8")
+    try:
+        raw.unlink()
+    except OSError:
+        pass
+    return mapping

{drydock_cli-3.0.73 → drydock_cli-3.0.75}/drydock/rmf_graph.py

@@ -126,11 +126,11 @@ def rule_node(rid: str) -> str:
     return f"stigrule:{rid.strip().lower()}"
 
 
-def ingest_checklist(g: "RmfGraph", checklist) -> dict:
+def ingest_checklist(g: "RmfGraph", checklist, cci_map: dict | None = None) -> dict:
     """Add a parsed STIG Checklist to the typed graph: STIG + STIG-Rule nodes,
-    PART_OF (rule→stig), APPLIES_TO (stig→host), EVALUATES (rule→host). Returns
-    {rules, host}. The Control —SATISFIED_BY→ STIG-Rule link is asserted
-    separately (via GraphAdd 'satisfies') since it needs the CCI→control map."""
+    PART_OF (rule→stig), APPLIES_TO (stig→host), EVALUATES (rule→host). When a
+    CCI→control map is supplied, also auto-creates Control —SATISFIED_BY→ STIG-Rule
+    edges via each rule's CCI. Returns {rules, host, linked}."""
     host = (checklist.asset.get("HOST_NAME") or checklist.asset.get("host_name") or "target")
     hnode = component_id(host)
     g.add_node(hnode, "Component", name=host, ip=checklist.asset.get("HOST_IP"))
@@ -138,6 +138,7 @@ def ingest_checklist(g: "RmfGraph", checklist) -> dict:
     snode = stig_id(sname)
     g.add_node(snode, "STIG", name=sname, version=checklist.stig_version)
     g.add_edge(snode, "APPLIES_TO", hnode)
+    linked = 0
     for r in checklist.rules:
         rid = r.rule_id or r.group_id
         if not rid:
@@ -147,7 +148,14 @@ def ingest_checklist(g: "RmfGraph", checklist) -> dict:
                    severity=r.severity, status=r.status, cci=r.cci, title=r.title)
         g.add_edge(rn, "PART_OF", snode)
         g.add_edge(rn, "EVALUATES", hnode)
-    return {"rules": len(checklist.rules), "host": host}
+        ctl = (cci_map or {}).get(r.cci)
+        if ctl:
+            cn = control_id(ctl)
+            if not g.get(cn):
+                g.add_node(cn, "Control", control_id=ctl.upper())
+            g.add_edge(cn, "SATISFIED_BY", rn)
+            linked += 1
+    return {"rules": len(checklist.rules), "host": host, "linked": linked}
 
 
 def build_from_catalog(catalog: dict, *, families: list[str] | None = None) -> RmfGraph:

{drydock_cli-3.0.73 → drydock_cli-3.0.75}/drydock/tools/__init__.py

@@ -1017,15 +1017,34 @@ _SUBAGENT_SYSTEM = (
     "tools: Read, Glob, Grep, and Bash (use Bash only to INSPECT — ls, cat, "
     "grep, find, git log — never to modify files). Investigate the task you are "
     "given, then STOP and reply with a concise, factual summary of what you "
-    "found: concrete file:line references and the key code, not narration. Do "
-    "NOT try to edit or create files — the main agent acts on your findings."
+    "found: concrete file:line references and only the few key code snippets that "
+    "matter, not narration and not whole files. Aim for under ~250 words — the "
+    "main agent only gets this summary (not your tool output), so distill, don't "
+    "dump. Do NOT try to edit or create files — the main agent acts on your findings."
 )
 
 
+# A sub-agent's whole job is to keep its investigation OUT of the main agent's
+# context and hand back only a partition. The system prompt asks for a concise
+# summary, but a runaway model could still return a wall of text — so cap what
+# crosses back into the parent's window. ~4000 chars ≈ ~1000 tokens.
+_SUBAGENT_SUMMARY_CAP = 4000
+
+
+def _cap_summary(text: str) -> str:
+    if len(text) <= _SUBAGENT_SUMMARY_CAP:
+        return text
+    head = text[:_SUBAGENT_SUMMARY_CAP].rsplit("\n", 1)[0] or text[:_SUBAGENT_SUMMARY_CAP]
+    dropped = len(text) - len(head)
+    return (head + f"\n[… sub-agent summary truncated, {dropped} chars dropped to keep it out "
+            "of the main context. Ask a narrower follow-up sub-agent task if you need more.]")
+
+
 def _run_subagent(prompt: str, config: dict) -> str:
     """Run one read-only sub-agent to completion and return its final summary.
     Shared by `task` (one) and `Dispatch` (many in parallel). Hard-capped; never
-    raises (a sub-agent must not crash the parent turn)."""
+    raises (a sub-agent must not crash the parent turn). The returned summary is
+    size-capped (_cap_summary) so a sub-agent can never bloat the main context."""
     from drydock.agent import run as agent_run, AgentState, TurnDone
 
     sub_state = AgentState()
@@ -1048,7 +1067,7 @@ def _run_subagent(prompt: str, config: dict) -> str:
         return f"[sub-agent error: {e}]"
     for msg in reversed(sub_state.messages):
         if msg.get("role") == "assistant" and (msg.get("content") or "").strip():
-            return msg["content"].strip()
+            return _cap_summary(msg["content"].strip())
     return f"[sub-agent finished {steps} step(s) with no summary]"
 
 

{drydock_cli-3.0.73 → drydock_cli-3.0.75}/drydock/tui/app.py

@@ -563,21 +563,10 @@ class DrydockApp(App):
             return
         # /stig graph <path> — ingest the checklist into the RMF typed graph
         if parts[0].lower() == "graph" and len(parts) > 1:
-            from drydock import rmf_graph
             gp = parts[1] if _os.path.isabs(parts[1]) else _os.path.join(cwd, parts[1])
-            try:
-                cl = stig.load(gp)
-                g = rmf_graph.RmfGraph.load(rmf_graph.graph_path(cwd))
-                r = rmf_graph.ingest_checklist(g, cl)
-                g.save(rmf_graph.graph_path(cwd))
-            except Exception as e:  # noqa: BLE001
-                self._mount(ErrorMessage(f"could not graph checklist: {e}"))
-                return
-            self._info(
-                f"✓ Ingested {r['rules']} STIG rules for host '{r['host']}' into the "
-                f"RMF graph (STIG/STIG-Rule nodes, PART_OF/APPLIES_TO/EVALUATES). "
-                "Link rules to controls with GraphAdd satisfies; trace via GraphQuery."
-            )
+            self._info("Ingesting the checklist into the RMF graph "
+                       "(fetching the DISA CCI→800-53 map on first use)…")
+            self.run_worker(lambda: self._stig_graph(cwd, gp), thread=True)
             return
         path = parts[0]
         if not _os.path.isabs(path):
@@ -643,6 +632,30 @@ class DrydockApp(App):
                    "catalog download; after that it works offline.)")
         self.call_from_thread(self._info, msg)
 
+    def _stig_graph(self, cwd: str, path: str) -> None:
+        """Worker-thread body: ingest a checklist into the RMF graph, auto-linking
+        rules to NIST controls via the DISA CCI map. Reports back on the UI."""
+        from drydock import cci, rmf_graph, stig
+
+        try:
+            cl = stig.load(path)
+            cci_map = cci.load_map(cwd)        # fetch+cache once; offline-safe ({} on failure)
+            g = rmf_graph.RmfGraph.load(rmf_graph.graph_path(cwd))
+            r = rmf_graph.ingest_checklist(g, cl, cci_map)
+            g.save(rmf_graph.graph_path(cwd))
+            link_note = (
+                f"auto-linked {r['linked']}/{r['rules']} rules to NIST controls via CCI "
+                "(Control —SATISFIED_BY→ rule). Trace with GraphQuery control <id>."
+                if r["linked"] else
+                "(no CCI→control links — the CCI map was unavailable offline; rules are "
+                "still in the graph. Re-run online, or use GraphAdd satisfies.)"
+            )
+            msg = (f"✓ Ingested {r['rules']} STIG rules for host '{r['host']}' into the "
+                   f"RMF graph (STIG/STIG-Rule + PART_OF/APPLIES_TO/EVALUATES); {link_note}")
+        except Exception as e:  # noqa: BLE001
+            msg = f"could not graph checklist: {e}"
+        self.call_from_thread(self._info, msg)
+
     def _cmd_mcp(self) -> None:
         """List connected MCP servers and the tools they expose."""
         from drydock import mcp

{drydock_cli-3.0.73 → drydock_cli-3.0.75/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.73
+Version: 3.0.75
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -91,10 +91,14 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/mcp` | List connected MCP servers + their tools |
 | `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
 | `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
+| `/stig new <xccdf>` | Generate a blank `.ckl` from a DISA STIG benchmark |
+| `/stig <ckl>` · `/stig <ckl> open` | Summarize a checklist · list findings by status |
+| `/stig graph <ckl>` | Ingest a checklist into the RMF graph (auto-links rules→controls via CCI) |
+| `/stig-assess <ckl>` · `/stig-remediate <ckl> <rule>` | Assess a rule vs evidence · write a fix script |
 | `/model` · `/cwd` | Show/set model & endpoint · working directory |
 | `/undo` · `/back` | Revert the last write · rewind the last turn |
-| `/compact` · `/status` · `/clear` | Shrink context · session stats · reset |
-| `/help` · `/quit` | Help · exit |
+| `/compact` · `/context [n]` | Shrink context now · view/set the context-window budget |
+| `/status` · `/clear` · `/help` · `/quit` | Session stats · reset · help · exit |
 
 ### Knowledge base (GraphRAG) — ingesting your documents
 
@@ -107,9 +111,11 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 
 Once built, the agent **automatically** retrieves from it (read-only `Knowledge`
 tool) when a question touches your material. Ingests text formats
-(`.md .txt .py .js .json .yaml .sql …`) **plus PDF and Word (`.docx`)**. `.docx`
-needs nothing extra; PDF uses the `pdftotext` binary (poppler) if present, else
-`pip install drydock-cli[pdf]` (pypdf). The index is a single JSON at
+(`.md .txt .py .js .json .yaml .sql …`), **PDF and Word (`.docx`)**, and **STIG
+checklists (`.ckl`/`.cklb`)** — checklists are flattened to per-rule findings so
+you can ask "which findings are open?". `.docx`/`.ckl` need nothing extra; PDF
+uses the `pdftotext` binary (poppler) if present, else `pip install
+drydock-cli[pdf]` (pypdf). The index is a single JSON at
 `<project>/.drydock/graphrag.json` — clean-room, no embeddings.
 
 ### Custom skills
@@ -144,6 +150,26 @@ relationships with `GraphQuery` — including **control inheritance** ("which
 servers inherit physical controls from their enclave?"). Stdlib in-memory graph,
 no Neo4j.
 
+### STIG checklists (DISA `.ckl`/`.cklb`)
+
+Take a raw DISA STIG benchmark all the way to a completed, eMASS/STIG-Viewer-
+compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
+
+```
+/stig new U_ASD_STIG_V6R1_Manual-xccdf.xml app.ckl   # benchmark → blank .ckl
+/graphrag build ./app                                 # pull in the app's evidence
+/loop 286 /stig-assess app.ckl                        # assess each rule vs evidence
+/stig app.ckl open                                    # list the open findings
+/stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
+/stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+```
+
+`/stig new` parses the XCCDF benchmark (validated against the full 286-rule
+Application STIG); `/stig-assess` reads your evidence and writes status +
+finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
+**auto-links each rule to its NIST 800-53 control** through DISA's CCI map
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+
 ## Install
 
 ```bash
@@ -173,10 +199,11 @@ commands to do the work, showing each as a collapsible tool card.
   `◡ Keelhauling…  (12s · ↓ 6.2k tokens · thinking with high effort)`
 - Submit while it's working and the prompt **queues** (drains in order)
 - Slash commands: `/model` · `/cwd` · `/undo` (revert last write) · `/back`
-  (rewind last turn) · `/status` · `/compact` (shrink context) · `/graphrag`
-  (build/query a knowledge base) · `/skills` (list your `/<name>` skills) ·
-  `/loop` (repeat a prompt) · `/mcp` (list MCP servers) · `/clear` · `/help` ·
-  `/quit`
+  (rewind last turn) · `/status` · `/compact` (shrink context) · `/context`
+  (view/set the context-window budget) · `/graphrag` (build/query a knowledge
+  base) · `/skills` (list your `/<name>` skills) · `/loop` (repeat a prompt) ·
+  `/mcp` (list MCP servers) · `/rmf` & `/stig` (NIST 800-53 / DISA STIG
+  automation) · `/clear` · `/help` · `/quit`
 
 It honors `AGENTS.md` / `DRYDOCK.md` in the working directory for project
 conventions.

{drydock_cli-3.0.73 → drydock_cli-3.0.75}/drydock_cli.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ drydock/__init__.py
 drydock/__main__.py
 drydock/agent.py
 drydock/bash_safety.py
+drydock/cci.py
 drydock/cli.py
 drydock/compaction.py
 drydock/config.py
@@ -49,6 +50,7 @@ tests/test_bash_output_bounding.py
 tests/test_bash_process_group.py
 tests/test_bash_safety.py
 tests/test_bash_timeout_network.py
+tests/test_cci.py
 tests/test_cli_agents.py
 tests/test_compact_command.py
 tests/test_compaction.py

{drydock_cli-3.0.73 → drydock_cli-3.0.75}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.73"
+version = "3.0.75"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

drydock_cli-3.0.75/tests/test_cci.py

@@ -0,0 +1,82 @@
+"""CCI → NIST 800-53 control map (the STIG-rule ↔ control bridge)."""
+from __future__ import annotations
+
+from drydock import cci, rmf_graph, stig
+
+_CCI_XML = '''<?xml version="1.0"?><cci_list><cci_items>
+<cci_item id="CCI-000366"><references>
+<reference title="NIST SP 800-53" version="3" index="CM-6"/>
+<reference title="NIST SP 800-53A" version="1" index="CM-6.1 (ii)"/>
+<reference title="NIST SP 800-53 Revision 4" version="4" index="CM-6 b"/></references></cci_item>
+<cci_item id="CCI-000054"><references>
+<reference title="NIST SP 800-53 Revision 5" version="5" index="AC-10"/></references></cci_item>
+<cci_item id="CCI-001133"><references>
+<reference title="NIST SP 800-53 Revision 4" version="4" index="SC-10 (1)"/></references></cci_item>
+<cci_item id="CCI-999999"><references>
+<reference title="NIST SP 800-53A" version="1" index="ZZ-9.9"/></references></cci_item>
+</cci_items></cci_list>'''
+
+
+def test_parse_picks_highest_rev_excludes_53A(tmp_path):
+    p = tmp_path / "cci.xml"; p.write_text(_CCI_XML)
+    m = cci.parse_cci_list(p)
+    assert m["CCI-000366"] == "cm-6"        # rev4 base, 800-53A excluded
+    assert m["CCI-000054"] == "ac-10"
+    assert m["CCI-001133"] == "sc-10.1"     # enhancement normalized
+    assert "CCI-999999" not in m            # only 800-53A ref → no control
+
+
+def test_norm_control_formats():
+    assert cci._norm_control("AC-10") == "ac-10"
+    assert cci._norm_control("AC-2 (1)") == "ac-2.1"
+    assert cci._norm_control("AC-2.1") == "ac-2.1"
+    assert cci._norm_control("garbage") is None
+
+
+def test_load_map_caches_and_is_offline_safe(tmp_path, monkeypatch):
+    # no network: with no cache, returns {} (never raises)
+    def boom(*a, **k):
+        raise OSError("offline")
+    monkeypatch.setattr(cci, "fetch_to", boom)
+    assert cci.load_map(str(tmp_path)) == {}
+    # seed a cache → load_map returns it without fetching
+    cp = cci.cache_path(str(tmp_path)); cp.parent.mkdir(parents=True, exist_ok=True)
+    cp.write_text('{"CCI-000366": "cm-6"}')
+    assert cci.load_map(str(tmp_path)) == {"CCI-000366": "cm-6"}
+
+
+def test_ingest_auto_links_via_cci(tmp_path):
+    (tmp_path / "s.ckl").write_text(
+        '<?xml version="1.0"?><CHECKLIST><ASSET><HOST_NAME>h1</HOST_NAME></ASSET><STIGS><iSTIG>'
+        '<STIG_INFO></STIG_INFO><VULN>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE><ATTRIBUTE_DATA>SV-9</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE><ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STATUS>Open</STATUS></VULN></iSTIG></STIGS></CHECKLIST>')
+    cl = stig.load(tmp_path / "s.ckl")
+    g = rmf_graph.RmfGraph()
+    r = rmf_graph.ingest_checklist(g, cl, {"CCI-000366": "cm-6"})
+    assert r["linked"] == 1
+    assert rmf_graph.rule_node("SV-9") in g.neighbors(rmf_graph.control_id("cm-6"), "SATISFIED_BY")
+
+
+def test_ingest_without_map_does_not_link(tmp_path):
+    (tmp_path / "s.ckl").write_text(
+        '<?xml version="1.0"?><CHECKLIST><STIGS><iSTIG><STIG_INFO></STIG_INFO><VULN>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE><ATTRIBUTE_DATA>SV-9</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STATUS>Open</STATUS></VULN></iSTIG></STIGS></CHECKLIST>')
+    cl = stig.load(tmp_path / "s.ckl")
+    r = rmf_graph.ingest_checklist(rmf_graph.RmfGraph(), cl)
+    assert r["linked"] == 0
+
+
+def test_load_map_creates_dir_and_caches(tmp_path, monkeypatch):
+    """Regression: the fetch must create .drydock/rmf/ before writing — a real
+    fetch failed because the dir didn't exist yet (found via hands-on TUI test)."""
+    def fake_fetch(path, **kw):
+        # a real fetch writes to .drydock/rmf/cci_map.xml — the dir must exist
+        from pathlib import Path
+        Path(path).write_text(_CCI_XML)
+    monkeypatch.setattr(cci, "fetch_to", fake_fetch)
+    m = cci.load_map(str(tmp_path))
+    assert m["CCI-000366"] == "cm-6"                 # parsed from the "fetched" list
+    assert cci.cache_path(str(tmp_path)).exists()    # cached as json

{drydock_cli-3.0.73 → drydock_cli-3.0.75}/tests/test_dispatch.py

@@ -60,3 +60,14 @@ def test_task_still_works_via_shared_runner(monkeypatch):
     monkeypatch.setattr(T, "_run_subagent", lambda p, c: f"summary:{p}")
     assert T.tool_task({"prompt": "explore X"}, {}) == "summary:explore X"
     assert "needs a `prompt`" in T.tool_task({}, {})
+
+
+def test_subagent_summary_is_capped():
+    """A sub-agent's return is size-capped so its investigation can never bloat
+    the main agent's context — only a bounded partition crosses back."""
+    from drydock.tools import _cap_summary, _SUBAGENT_SUMMARY_CAP
+    assert _cap_summary("brief finding") == "brief finding"        # short passes through
+    big = "\n".join(f"line {i} with some detail" for i in range(2000))
+    out = _cap_summary(big)
+    assert len(out) < _SUBAGENT_SUMMARY_CAP + 200                  # bounded
+    assert "truncated" in out and "main context" in out           # explains the cut