drydock-cli 3.0.74__tar.gz → 3.0.75__tar.gz

{drydock_cli-3.0.74/drydock_cli.egg-info → drydock_cli-3.0.75}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.74
+Version: 3.0.75
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -91,10 +91,14 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/mcp` | List connected MCP servers + their tools |
 | `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
 | `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
+| `/stig new <xccdf>` | Generate a blank `.ckl` from a DISA STIG benchmark |
+| `/stig <ckl>` · `/stig <ckl> open` | Summarize a checklist · list findings by status |
+| `/stig graph <ckl>` | Ingest a checklist into the RMF graph (auto-links rules→controls via CCI) |
+| `/stig-assess <ckl>` · `/stig-remediate <ckl> <rule>` | Assess a rule vs evidence · write a fix script |
 | `/model` · `/cwd` | Show/set model & endpoint · working directory |
 | `/undo` · `/back` | Revert the last write · rewind the last turn |
-| `/compact` · `/status` · `/clear` | Shrink context · session stats · reset |
-| `/help` · `/quit` | Help · exit |
+| `/compact` · `/context [n]` | Shrink context now · view/set the context-window budget |
+| `/status` · `/clear` · `/help` · `/quit` | Session stats · reset · help · exit |
 
 ### Knowledge base (GraphRAG) — ingesting your documents
 
@@ -107,9 +111,11 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 
 Once built, the agent **automatically** retrieves from it (read-only `Knowledge`
 tool) when a question touches your material. Ingests text formats
-(`.md .txt .py .js .json .yaml .sql …`) **plus PDF and Word (`.docx`)**. `.docx`
-needs nothing extra; PDF uses the `pdftotext` binary (poppler) if present, else
-`pip install drydock-cli[pdf]` (pypdf). The index is a single JSON at
+(`.md .txt .py .js .json .yaml .sql …`), **PDF and Word (`.docx`)**, and **STIG
+checklists (`.ckl`/`.cklb`)** — checklists are flattened to per-rule findings so
+you can ask "which findings are open?". `.docx`/`.ckl` need nothing extra; PDF
+uses the `pdftotext` binary (poppler) if present, else `pip install
+drydock-cli[pdf]` (pypdf). The index is a single JSON at
 `<project>/.drydock/graphrag.json` — clean-room, no embeddings.
 
 ### Custom skills
@@ -144,6 +150,26 @@ relationships with `GraphQuery` — including **control inheritance** ("which
 servers inherit physical controls from their enclave?"). Stdlib in-memory graph,
 no Neo4j.
 
+### STIG checklists (DISA `.ckl`/`.cklb`)
+
+Take a raw DISA STIG benchmark all the way to a completed, eMASS/STIG-Viewer-
+compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
+
+```
+/stig new U_ASD_STIG_V6R1_Manual-xccdf.xml app.ckl   # benchmark → blank .ckl
+/graphrag build ./app                                 # pull in the app's evidence
+/loop 286 /stig-assess app.ckl                        # assess each rule vs evidence
+/stig app.ckl open                                    # list the open findings
+/stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
+/stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+```
+
+`/stig new` parses the XCCDF benchmark (validated against the full 286-rule
+Application STIG); `/stig-assess` reads your evidence and writes status +
+finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
+**auto-links each rule to its NIST 800-53 control** through DISA's CCI map
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+
 ## Install
 
 ```bash
@@ -173,10 +199,11 @@ commands to do the work, showing each as a collapsible tool card.
   `◡ Keelhauling…  (12s · ↓ 6.2k tokens · thinking with high effort)`
 - Submit while it's working and the prompt **queues** (drains in order)
 - Slash commands: `/model` · `/cwd` · `/undo` (revert last write) · `/back`
-  (rewind last turn) · `/status` · `/compact` (shrink context) · `/graphrag`
-  (build/query a knowledge base) · `/skills` (list your `/<name>` skills) ·
-  `/loop` (repeat a prompt) · `/mcp` (list MCP servers) · `/clear` · `/help` ·
-  `/quit`
+  (rewind last turn) · `/status` · `/compact` (shrink context) · `/context`
+  (view/set the context-window budget) · `/graphrag` (build/query a knowledge
+  base) · `/skills` (list your `/<name>` skills) · `/loop` (repeat a prompt) ·
+  `/mcp` (list MCP servers) · `/rmf` & `/stig` (NIST 800-53 / DISA STIG
+  automation) · `/clear` · `/help` · `/quit`
 
 It honors `AGENTS.md` / `DRYDOCK.md` in the working directory for project
 conventions.

{drydock_cli-3.0.74 → drydock_cli-3.0.75}/README.md

@@ -67,10 +67,14 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/mcp` | List connected MCP servers + their tools |
 | `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
 | `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
+| `/stig new <xccdf>` | Generate a blank `.ckl` from a DISA STIG benchmark |
+| `/stig <ckl>` · `/stig <ckl> open` | Summarize a checklist · list findings by status |
+| `/stig graph <ckl>` | Ingest a checklist into the RMF graph (auto-links rules→controls via CCI) |
+| `/stig-assess <ckl>` · `/stig-remediate <ckl> <rule>` | Assess a rule vs evidence · write a fix script |
 | `/model` · `/cwd` | Show/set model & endpoint · working directory |
 | `/undo` · `/back` | Revert the last write · rewind the last turn |
-| `/compact` · `/status` · `/clear` | Shrink context · session stats · reset |
-| `/help` · `/quit` | Help · exit |
+| `/compact` · `/context [n]` | Shrink context now · view/set the context-window budget |
+| `/status` · `/clear` · `/help` · `/quit` | Session stats · reset · help · exit |
 
 ### Knowledge base (GraphRAG) — ingesting your documents
 
@@ -83,9 +87,11 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 
 Once built, the agent **automatically** retrieves from it (read-only `Knowledge`
 tool) when a question touches your material. Ingests text formats
-(`.md .txt .py .js .json .yaml .sql …`) **plus PDF and Word (`.docx`)**. `.docx`
-needs nothing extra; PDF uses the `pdftotext` binary (poppler) if present, else
-`pip install drydock-cli[pdf]` (pypdf). The index is a single JSON at
+(`.md .txt .py .js .json .yaml .sql …`), **PDF and Word (`.docx`)**, and **STIG
+checklists (`.ckl`/`.cklb`)** — checklists are flattened to per-rule findings so
+you can ask "which findings are open?". `.docx`/`.ckl` need nothing extra; PDF
+uses the `pdftotext` binary (poppler) if present, else `pip install
+drydock-cli[pdf]` (pypdf). The index is a single JSON at
 `<project>/.drydock/graphrag.json` — clean-room, no embeddings.
 
 ### Custom skills
@@ -120,6 +126,26 @@ relationships with `GraphQuery` — including **control inheritance** ("which
 servers inherit physical controls from their enclave?"). Stdlib in-memory graph,
 no Neo4j.
 
+### STIG checklists (DISA `.ckl`/`.cklb`)
+
+Take a raw DISA STIG benchmark all the way to a completed, eMASS/STIG-Viewer-
+compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
+
+```
+/stig new U_ASD_STIG_V6R1_Manual-xccdf.xml app.ckl   # benchmark → blank .ckl
+/graphrag build ./app                                 # pull in the app's evidence
+/loop 286 /stig-assess app.ckl                        # assess each rule vs evidence
+/stig app.ckl open                                    # list the open findings
+/stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
+/stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+```
+
+`/stig new` parses the XCCDF benchmark (validated against the full 286-rule
+Application STIG); `/stig-assess` reads your evidence and writes status +
+finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
+**auto-links each rule to its NIST 800-53 control** through DISA's CCI map
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+
 ## Install
 
 ```bash
@@ -149,10 +175,11 @@ commands to do the work, showing each as a collapsible tool card.
   `◡ Keelhauling…  (12s · ↓ 6.2k tokens · thinking with high effort)`
 - Submit while it's working and the prompt **queues** (drains in order)
 - Slash commands: `/model` · `/cwd` · `/undo` (revert last write) · `/back`
-  (rewind last turn) · `/status` · `/compact` (shrink context) · `/graphrag`
-  (build/query a knowledge base) · `/skills` (list your `/<name>` skills) ·
-  `/loop` (repeat a prompt) · `/mcp` (list MCP servers) · `/clear` · `/help` ·
-  `/quit`
+  (rewind last turn) · `/status` · `/compact` (shrink context) · `/context`
+  (view/set the context-window budget) · `/graphrag` (build/query a knowledge
+  base) · `/skills` (list your `/<name>` skills) · `/loop` (repeat a prompt) ·
+  `/mcp` (list MCP servers) · `/rmf` & `/stig` (NIST 800-53 / DISA STIG
+  automation) · `/clear` · `/help` · `/quit`
 
 It honors `AGENTS.md` / `DRYDOCK.md` in the working directory for project
 conventions.

{drydock_cli-3.0.74 → drydock_cli-3.0.75}/drydock/tools/__init__.py

@@ -1017,15 +1017,34 @@ _SUBAGENT_SYSTEM = (
     "tools: Read, Glob, Grep, and Bash (use Bash only to INSPECT — ls, cat, "
     "grep, find, git log — never to modify files). Investigate the task you are "
     "given, then STOP and reply with a concise, factual summary of what you "
-    "found: concrete file:line references and the key code, not narration. Do "
-    "NOT try to edit or create files — the main agent acts on your findings."
+    "found: concrete file:line references and only the few key code snippets that "
+    "matter, not narration and not whole files. Aim for under ~250 words — the "
+    "main agent only gets this summary (not your tool output), so distill, don't "
+    "dump. Do NOT try to edit or create files — the main agent acts on your findings."
 )
 
 
+# A sub-agent's whole job is to keep its investigation OUT of the main agent's
+# context and hand back only a partition. The system prompt asks for a concise
+# summary, but a runaway model could still return a wall of text — so cap what
+# crosses back into the parent's window. ~4000 chars ≈ ~1000 tokens.
+_SUBAGENT_SUMMARY_CAP = 4000
+
+
+def _cap_summary(text: str) -> str:
+    if len(text) <= _SUBAGENT_SUMMARY_CAP:
+        return text
+    head = text[:_SUBAGENT_SUMMARY_CAP].rsplit("\n", 1)[0] or text[:_SUBAGENT_SUMMARY_CAP]
+    dropped = len(text) - len(head)
+    return (head + f"\n[… sub-agent summary truncated, {dropped} chars dropped to keep it out "
+            "of the main context. Ask a narrower follow-up sub-agent task if you need more.]")
+
+
 def _run_subagent(prompt: str, config: dict) -> str:
     """Run one read-only sub-agent to completion and return its final summary.
     Shared by `task` (one) and `Dispatch` (many in parallel). Hard-capped; never
-    raises (a sub-agent must not crash the parent turn)."""
+    raises (a sub-agent must not crash the parent turn). The returned summary is
+    size-capped (_cap_summary) so a sub-agent can never bloat the main context."""
     from drydock.agent import run as agent_run, AgentState, TurnDone
 
     sub_state = AgentState()
@@ -1048,7 +1067,7 @@ def _run_subagent(prompt: str, config: dict) -> str:
         return f"[sub-agent error: {e}]"
     for msg in reversed(sub_state.messages):
         if msg.get("role") == "assistant" and (msg.get("content") or "").strip():
-            return msg["content"].strip()
+            return _cap_summary(msg["content"].strip())
     return f"[sub-agent finished {steps} step(s) with no summary]"
 
 

{drydock_cli-3.0.74 → drydock_cli-3.0.75/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.74
+Version: 3.0.75
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -91,10 +91,14 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 | `/mcp` | List connected MCP servers + their tools |
 | `/rmf bootstrap [families]` | Ingest the NIST SP 800-53 catalog (RMF automation) |
 | `/rmf-control` · `/rmf-categorize` · `/rmf-review` · `/rmf-poam` | Bundled RMF skills |
+| `/stig new <xccdf>` | Generate a blank `.ckl` from a DISA STIG benchmark |
+| `/stig <ckl>` · `/stig <ckl> open` | Summarize a checklist · list findings by status |
+| `/stig graph <ckl>` | Ingest a checklist into the RMF graph (auto-links rules→controls via CCI) |
+| `/stig-assess <ckl>` · `/stig-remediate <ckl> <rule>` | Assess a rule vs evidence · write a fix script |
 | `/model` · `/cwd` | Show/set model & endpoint · working directory |
 | `/undo` · `/back` | Revert the last write · rewind the last turn |
-| `/compact` · `/status` · `/clear` | Shrink context · session stats · reset |
-| `/help` · `/quit` | Help · exit |
+| `/compact` · `/context [n]` | Shrink context now · view/set the context-window budget |
+| `/status` · `/clear` · `/help` · `/quit` | Session stats · reset · help · exit |
 
 ### Knowledge base (GraphRAG) — ingesting your documents
 
@@ -107,9 +111,11 @@ Typed into the prompt. The agent also knows these, so you can just **ask it**
 
 Once built, the agent **automatically** retrieves from it (read-only `Knowledge`
 tool) when a question touches your material. Ingests text formats
-(`.md .txt .py .js .json .yaml .sql …`) **plus PDF and Word (`.docx`)**. `.docx`
-needs nothing extra; PDF uses the `pdftotext` binary (poppler) if present, else
-`pip install drydock-cli[pdf]` (pypdf). The index is a single JSON at
+(`.md .txt .py .js .json .yaml .sql …`), **PDF and Word (`.docx`)**, and **STIG
+checklists (`.ckl`/`.cklb`)** — checklists are flattened to per-rule findings so
+you can ask "which findings are open?". `.docx`/`.ckl` need nothing extra; PDF
+uses the `pdftotext` binary (poppler) if present, else `pip install
+drydock-cli[pdf]` (pypdf). The index is a single JSON at
 `<project>/.drydock/graphrag.json` — clean-room, no embeddings.
 
 ### Custom skills
@@ -144,6 +150,26 @@ relationships with `GraphQuery` — including **control inheritance** ("which
 servers inherit physical controls from their enclave?"). Stdlib in-memory graph,
 no Neo4j.
 
+### STIG checklists (DISA `.ckl`/`.cklb`)
+
+Take a raw DISA STIG benchmark all the way to a completed, eMASS/STIG-Viewer-
+compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
+
+```
+/stig new U_ASD_STIG_V6R1_Manual-xccdf.xml app.ckl   # benchmark → blank .ckl
+/graphrag build ./app                                 # pull in the app's evidence
+/loop 286 /stig-assess app.ckl                        # assess each rule vs evidence
+/stig app.ckl open                                    # list the open findings
+/stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
+/stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+```
+
+`/stig new` parses the XCCDF benchmark (validated against the full 286-rule
+Application STIG); `/stig-assess` reads your evidence and writes status +
+finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
+**auto-links each rule to its NIST 800-53 control** through DISA's CCI map
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+
 ## Install
 
 ```bash
@@ -173,10 +199,11 @@ commands to do the work, showing each as a collapsible tool card.
   `◡ Keelhauling…  (12s · ↓ 6.2k tokens · thinking with high effort)`
 - Submit while it's working and the prompt **queues** (drains in order)
 - Slash commands: `/model` · `/cwd` · `/undo` (revert last write) · `/back`
-  (rewind last turn) · `/status` · `/compact` (shrink context) · `/graphrag`
-  (build/query a knowledge base) · `/skills` (list your `/<name>` skills) ·
-  `/loop` (repeat a prompt) · `/mcp` (list MCP servers) · `/clear` · `/help` ·
-  `/quit`
+  (rewind last turn) · `/status` · `/compact` (shrink context) · `/context`
+  (view/set the context-window budget) · `/graphrag` (build/query a knowledge
+  base) · `/skills` (list your `/<name>` skills) · `/loop` (repeat a prompt) ·
+  `/mcp` (list MCP servers) · `/rmf` & `/stig` (NIST 800-53 / DISA STIG
+  automation) · `/clear` · `/help` · `/quit`
 
 It honors `AGENTS.md` / `DRYDOCK.md` in the working directory for project
 conventions.

{drydock_cli-3.0.74 → drydock_cli-3.0.75}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.74"
+version = "3.0.75"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

{drydock_cli-3.0.74 → drydock_cli-3.0.75}/tests/test_dispatch.py

@@ -60,3 +60,14 @@ def test_task_still_works_via_shared_runner(monkeypatch):
     monkeypatch.setattr(T, "_run_subagent", lambda p, c: f"summary:{p}")
     assert T.tool_task({"prompt": "explore X"}, {}) == "summary:explore X"
     assert "needs a `prompt`" in T.tool_task({}, {})
+
+
+def test_subagent_summary_is_capped():
+    """A sub-agent's return is size-capped so its investigation can never bloat
+    the main agent's context — only a bounded partition crosses back."""
+    from drydock.tools import _cap_summary, _SUBAGENT_SUMMARY_CAP
+    assert _cap_summary("brief finding") == "brief finding"        # short passes through
+    big = "\n".join(f"line {i} with some detail" for i in range(2000))
+    out = _cap_summary(big)
+    assert len(out) < _SUBAGENT_SUMMARY_CAP + 200                  # bounded
+    assert "truncated" in out and "main context" in out           # explains the cut