drydock-cli 3.0.77__tar.gz → 3.0.79__tar.gz

{drydock_cli-3.0.77/drydock_cli.egg-info → drydock_cli-3.0.79}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.77
+Version: 3.0.79
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -61,8 +61,9 @@ A full agentic CLI harness — every tool below is clean-room and dependency-fre
   `Edit`, `Bash`, `Glob`, `Grep`.
 - **Vision (multimodal)** — reference an image path in your message (a `.png`/
   `.jpg` screenshot, mockup, or diagram) and it's attached for a vision-capable
-  model to *see* — describe a UI, read text off a screenshot, debug a diagram.
-  Works with any `--mmproj`-enabled server (e.g. llama.cpp with a vision model).
+  model to *see*; the agent can also call the `ViewImage` tool to look at an
+  image it discovers on its own — describe a UI, read text off a screenshot,
+  debug a diagram. Works with any `--mmproj` server (e.g. llama.cpp + a vision model).
 - **Version control** — `GitStatus`, `GitDiff`, `GitLog`, `GitCommit`
   (structured + truncated; commit is local and reversible).
 - **Internet** — `WebSearch` + `WebFetch` (DuckDuckGo; offline-safe).
@@ -166,13 +167,17 @@ compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
 /stig app.ckl open                                    # list the open findings
 /stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
 /stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+/stig poam app.ckl                                    # eMASS POA&M CSV of the open findings
 ```
 
 `/stig new` parses the XCCDF benchmark (validated against the full 286-rule
 Application STIG); `/stig-assess` reads your evidence and writes status +
 finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
 **auto-links each rule to its NIST 800-53 control** through DISA's CCI map
-(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline. `/stig poam`
+exports the open findings to a deterministic **eMASS POA&M CSV** — Control (from
+the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
+Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
 ## Install
 

{drydock_cli-3.0.77 → drydock_cli-3.0.79}/README.md

@@ -37,8 +37,9 @@ A full agentic CLI harness — every tool below is clean-room and dependency-fre
   `Edit`, `Bash`, `Glob`, `Grep`.
 - **Vision (multimodal)** — reference an image path in your message (a `.png`/
   `.jpg` screenshot, mockup, or diagram) and it's attached for a vision-capable
-  model to *see* — describe a UI, read text off a screenshot, debug a diagram.
-  Works with any `--mmproj`-enabled server (e.g. llama.cpp with a vision model).
+  model to *see*; the agent can also call the `ViewImage` tool to look at an
+  image it discovers on its own — describe a UI, read text off a screenshot,
+  debug a diagram. Works with any `--mmproj` server (e.g. llama.cpp + a vision model).
 - **Version control** — `GitStatus`, `GitDiff`, `GitLog`, `GitCommit`
   (structured + truncated; commit is local and reversible).
 - **Internet** — `WebSearch` + `WebFetch` (DuckDuckGo; offline-safe).
@@ -142,13 +143,17 @@ compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
 /stig app.ckl open                                    # list the open findings
 /stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
 /stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+/stig poam app.ckl                                    # eMASS POA&M CSV of the open findings
 ```
 
 `/stig new` parses the XCCDF benchmark (validated against the full 286-rule
 Application STIG); `/stig-assess` reads your evidence and writes status +
 finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
 **auto-links each rule to its NIST 800-53 control** through DISA's CCI map
-(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline. `/stig poam`
+exports the open findings to a deterministic **eMASS POA&M CSV** — Control (from
+the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
+Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
 ## Install
 

drydock_cli-3.0.79/drydock/poam.py

@@ -0,0 +1,73 @@
+"""eMASS-compatible POA&M (Plan of Action & Milestones) export from STIG findings.
+
+Deterministic and stdlib-only: takes the OPEN findings in a parsed checklist,
+maps each to its NIST SP 800-53 control (via the DISA CCI map in cci.py) and its
+eMASS severity (STIG CAT I/II/III), and writes the standard eMASS POA&M CSV. No
+LLM in this path — it's a faithful transform of facts already in the checklist +
+the CCI map, so it's reproducible and ungameable. Complements the `/rmf-poam`
+skill (which writes a narrative entry); this is the bulk machine-importable CSV.
+
+All logic original to Drydock.
+"""
+from __future__ import annotations
+
+import csv
+from pathlib import Path
+
+# STIG severity (CAT I/II/III) → eMASS Severity + the raw CAT label.
+_EMASS_SEVERITY = {"high": "High", "medium": "Moderate", "low": "Low"}
+_CAT = {"high": "CAT I", "medium": "CAT II", "low": "CAT III"}
+
+# eMASS POA&M columns (the prompt's required fields + the standard companions
+# eMASS expects so the CSV imports cleanly).
+EMASS_HEADERS = [
+    "Control",
+    "Vulnerability Description",
+    "Source Identifying Vulnerability",
+    "POA&M Status",
+    "Milestone Description",
+    "Severity",
+    "Raw Severity",
+    "Comments",
+]
+
+
+def poam_rows(checklist, cci_map: dict | None = None) -> list[dict]:
+    """One eMASS POA&M row per OPEN finding. `cci_map` (CCI→control) populates the
+    Control column; missing mappings are marked '(unmapped CCI)' rather than
+    dropped, so nothing is silently lost."""
+    cci_map = cci_map or {}
+    rows: list[dict] = []
+    for r in checklist.rules:
+        if r.status != "open":
+            continue
+        ctl = cci_map.get(r.cci, "")
+        control = ctl.upper() if ctl else (f"(unmapped {r.cci})" if r.cci else "(no CCI)")
+        rows.append({
+            "Control": control,
+            "Vulnerability Description": f"{r.group_id} ({r.rule_id}): {r.title}".strip(),
+            "Source Identifying Vulnerability": r.rule_id or r.group_id,
+            "POA&M Status": "Ongoing",
+            "Milestone Description": (r.fix_text or "").strip() or "See STIG Fix Text.",
+            "Severity": _EMASS_SEVERITY.get(r.severity, "Moderate"),
+            "Raw Severity": _CAT.get(r.severity, "CAT II"),
+            "Comments": (r.finding_details or "").strip(),
+        })
+    return rows
+
+
+def write_csv(rows: list[dict], path: str | Path) -> int:
+    """Write POA&M rows to an eMASS-headered CSV. Returns the row count."""
+    with open(path, "w", newline="", encoding="utf-8") as f:
+        w = csv.DictWriter(f, fieldnames=EMASS_HEADERS)
+        w.writeheader()
+        for row in rows:
+            w.writerow({h: row.get(h, "") for h in EMASS_HEADERS})
+    return len(rows)
+
+
+def export(checklist, cci_map: dict | None, out_path: str | Path) -> dict:
+    """Build + write the POA&M CSV for a checklist's open findings."""
+    rows = poam_rows(checklist, cci_map)
+    write_csv(rows, out_path)
+    return {"rows": len(rows), "path": str(out_path)}

{drydock_cli-3.0.77 → drydock_cli-3.0.79}/drydock/providers.py

@@ -279,32 +279,47 @@ def detect_image_paths(content) -> list[str]:
     return seen
 
 
-def _user_content_with_images(content):
-    """Vision support: if the user's text references image file paths that exist
-    on disk, attach them as OpenAI multimodal image_url blocks (works with any
-    --mmproj-enabled server). Text-only prompts pass through unchanged as a plain
-    string, so display / loop-detection / compaction / token-counting (which all
-    assume string content) are untouched — the multimodal list is built ONLY here,
-    at the API boundary."""
-    seen = detect_image_paths(content)
-    if not seen:
-        return content
+_MAX_IMAGE_BYTES = 20_000_000  # don't base64 a >20MB file into a request
+
+
+def _image_url_block(path: str) -> dict | None:
+    """A base64 data-URL image_url block for an on-disk image, or None if it
+    can't be read / is too large."""
     import base64
     import os
 
+    try:
+        if os.path.getsize(path) > _MAX_IMAGE_BYTES:
+            return None
+        with open(path, "rb") as f:
+            b64 = base64.b64encode(f.read()).decode()
+    except OSError:
+        return None
+    mime = _IMAGE_MIME.get(os.path.splitext(path)[1].lower(), "image/png")
+    return {"type": "image_url", "image_url": {"url": f"data:{mime};base64,{b64}"}}
+
+
+def _content_with_images(content):
+    """Turn text that references on-disk image paths into a multimodal content
+    list ([text, image_url…]); text without resolvable images passes through
+    unchanged. Used for BOTH user messages (the user names an image) and
+    ViewImage tool results (the AGENT chose to view one) — built ONLY here at the
+    API boundary so display/compaction/token-counting still see plain strings."""
+    seen = detect_image_paths(content)
+    if not seen:
+        return content
     blocks: list[dict] = [{"type": "text", "text": content}]
     for p in seen:
-        mime = _IMAGE_MIME.get(os.path.splitext(p)[1].lower(), "image/png")
-        try:
-            with open(p, "rb") as f:
-                b64 = base64.b64encode(f.read()).decode()
-        except OSError:
-            continue
-        blocks.append({"type": "image_url",
-                       "image_url": {"url": f"data:{mime};base64,{b64}"}})
+        block = _image_url_block(p)
+        if block:
+            blocks.append(block)
     return blocks if len(blocks) > 1 else content
 
 
+# Back-compat alias (user-message vision).
+_user_content_with_images = _content_with_images
+
+
 def messages_to_openai(messages: list, system: str) -> list:
     """Convert neutral messages to OpenAI API format."""
     # value type is mixed (str content, multimodal list content, tool_calls list)
@@ -331,10 +346,17 @@ def messages_to_openai(messages: list, system: str) -> list:
                 ]
             result.append(msg)
         elif role == "tool":
+            content = m["content"]
+            # Agent-side vision: a ViewImage result names an image the agent chose
+            # to look at — attach it so the model SEES it (servers read images
+            # from tool messages too, verified). Only ViewImage, so an unrelated
+            # tool mentioning a .png path never balloons the request.
+            if m.get("name") == "ViewImage" and isinstance(content, str):
+                content = _content_with_images(content)
             result.append({
                 "role": "tool",
                 "tool_call_id": m["tool_call_id"],
-                "content": m["content"],
+                "content": content,
             })
     return result
 

{drydock_cli-3.0.77 → drydock_cli-3.0.79}/drydock/tools/__init__.py

@@ -83,6 +83,17 @@ SCHEMAS = [
             "required": ["file_path"],
         },
     },
+    {
+        "name": "ViewImage",
+        "description": "Look at an image file with your vision — use this when you need to SEE a screenshot, mockup, diagram, photo, or rendered output (.png/.jpg/.jpeg/.gif/.webp/.bmp). The image is shown to you so you can describe it, read text from it, or debug it. (Reading an image with the Read tool gives binary garbage; use ViewImage instead.)",
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "path": {"type": "string", "description": "Path to the image file"},
+            },
+            "required": ["path"],
+        },
+    },
     {
         "name": "Write",
         "description": "Write content to a file, creating parent directories as needed.",
@@ -474,6 +485,33 @@ def _file_index(lines: list[str], fp: str) -> str:
     return f"{head}\nKey locations ({len(anchors)}):\n{body}"
 
 
+_IMAGE_EXTS = (".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp")
+_MAX_VIEW_IMAGE_BYTES = 20_000_000
+
+
+def tool_viewimage(params: dict, config: dict) -> str:
+    """Validate an image path and return a result that names it; the API boundary
+    (providers.messages_to_openai) attaches the actual image to THIS tool result
+    so the vision model sees it. Returns a plain error string on any problem
+    (never an attachable path) so a bad call can't try to attach nothing."""
+    raw = (params.get("path") or params.get("file_path") or "").strip()
+    if not raw:
+        return "Error: ViewImage needs a `path` to an image file."
+    fp = _resolve_path(raw, config)
+    if os.path.splitext(fp)[1].lower() not in _IMAGE_EXTS:
+        return (f"Error: {raw} is not a supported image. ViewImage handles "
+                f"{', '.join(_IMAGE_EXTS)}.")
+    if not os.path.isfile(fp):
+        return f"Error: no image file at {raw} (resolved to {fp})."
+    size = os.path.getsize(fp)
+    if size > _MAX_VIEW_IMAGE_BYTES:
+        return f"Error: {raw} is {size // 1_000_000}MB — too large to view (limit 20MB)."
+    kind = os.path.splitext(fp)[1].lstrip(".").upper()
+    # The absolute path in this text is what the API boundary attaches.
+    return (f"Loaded image {fp} ({kind}, {size // 1024 or 1}KB) — it is now visible "
+            "to you. Describe it, read any text in it, or use it to answer the task.")
+
+
 def tool_read(params: dict, config: dict) -> str:
     fp = _resolve_path(params["file_path"], config)
     limit = params.get("limit")  # None = caller didn't specify a window
@@ -1010,7 +1048,7 @@ def tool_todo(params: dict, config: dict) -> str:
 # Tools a sub-agent may use. Excludes Write/Edit/todo (no silent mutations the
 # parent can't see) and `task` itself (no recursion). Bash is included for real
 # exploration (ls/cat/grep/find/git log) and is bounded by the same bash_safety.
-SUBAGENT_TOOLS = ("Read", "Glob", "Grep", "Bash")
+SUBAGENT_TOOLS = ("Read", "ViewImage", "Glob", "Grep", "Bash")
 
 _SUBAGENT_SYSTEM = (
     "You are a focused exploration sub-agent inside Drydock. You have read-only "
@@ -1428,7 +1466,8 @@ def register_all():
     for schema in SCHEMAS:
         name = schema["name"]
         func = {
-            "Read": tool_read, "Write": tool_write, "Edit": tool_edit,
+            "Read": tool_read, "ViewImage": tool_viewimage,
+            "Write": tool_write, "Edit": tool_edit,
             "Bash": tool_bash, "Glob": tool_glob, "Grep": tool_grep,
             "todo": tool_todo, "task": tool_task, "Dispatch": tool_dispatch,
             "Knowledge": tool_knowledge,
@@ -1441,8 +1480,8 @@ def register_all():
         # Read-only w.r.t. the parent's files (GitStatus/Diff/Log inspect only;
         # GitCommit + GraphAdd write).
         read_only = name in (
-            "Read", "Glob", "Grep", "task", "Dispatch", "Knowledge", "GraphQuery",
-            "StigRules", "StigRule",
+            "Read", "ViewImage", "Glob", "Grep", "task", "Dispatch", "Knowledge",
+            "GraphQuery", "StigRules", "StigRule",
             "WebSearch", "WebFetch", "GitStatus", "GitDiff", "GitLog",
         )
         register(ToolDef(name=name, schema=schema, func=func, read_only=read_only))

{drydock_cli-3.0.77 → drydock_cli-3.0.79}/drydock/tui/app.py

@@ -547,6 +547,7 @@ class DrydockApp(App):
                        "  /stig new <benchmark-xccdf.xml> [out.ckl]  — blank .ckl from a STIG\n"
                        "  /stig <path.ckl|.cklb> [status]            — summary / list by status\n"
                        "  /stig graph <path.ckl>                     — ingest into the RMF graph\n"
+                       "  /stig poam <path.ckl> [out.csv]            — eMASS POA&M CSV (open findings)\n"
                        "Assess:  /loop <n> /stig-assess <path>")
             return
         import os as _os
@@ -569,6 +570,15 @@ class DrydockApp(App):
                 f"  /graphrag build <app-docs>   ·   /loop {len(cl.rules)} /stig-assess {out}"
             )
             return
+        # /stig poam <path> [out.csv] — export open findings to an eMASS POA&M CSV
+        if parts[0].lower() == "poam" and len(parts) > 1:
+            cp = _abs(parts[1])
+            out = _abs(parts[2]) if len(parts) > 2 else \
+                _os.path.splitext(cp)[0] + "_poam.csv"
+            self._info("Building the eMASS POA&M CSV (mapping open findings to NIST "
+                       "controls via the CCI map)…")
+            self.run_worker(lambda: self._stig_poam(cwd, cp, out), thread=True)
+            return
         # /stig graph <path> — ingest the checklist into the RMF typed graph
         if parts[0].lower() == "graph" and len(parts) > 1:
             gp = parts[1] if _os.path.isabs(parts[1]) else _os.path.join(cwd, parts[1])
@@ -640,6 +650,26 @@ class DrydockApp(App):
                    "catalog download; after that it works offline.)")
         self.call_from_thread(self._info, msg)
 
+    def _stig_poam(self, cwd: str, path: str, out: str) -> None:
+        """Worker: export a checklist's open findings to an eMASS POA&M CSV,
+        pulling each finding's NIST control from the CCI map. Deterministic."""
+        from drydock import cci, poam, stig
+
+        try:
+            cl = stig.load(path)
+            cci_map = cci.load_map(cwd)   # offline-safe ({} → Controls show '(unmapped)')
+            r = poam.export(cl, cci_map, out)
+        except Exception as e:  # noqa: BLE001
+            self.call_from_thread(self._mount, ErrorMessage(f"could not build POA&M: {e}"))
+            return
+        note = "" if cci_map else " (CCI map unavailable offline — Control column shows '(unmapped)'; re-run online to populate it)"
+        self.call_from_thread(
+            self._info,
+            f"✓ Wrote {r['rows']} POA&M row(s) for the open findings to {r['path']} "
+            f"(eMASS headers: Control · Vulnerability Description · POA&M Status=Ongoing · "
+            f"Milestone · Severity).{note}"
+        )
+
     def _stig_graph(self, cwd: str, path: str) -> None:
         """Worker-thread body: ingest a checklist into the RMF graph, auto-linking
         rules to NIST controls via the DISA CCI map. Reports back on the UI."""

{drydock_cli-3.0.77 → drydock_cli-3.0.79}/drydock/tuning.py

@@ -93,8 +93,10 @@ _DEFAULT_SYSTEM_PROMPT = (
     "every step is done. Don't write a TODO.md file for this.\n"
     "You have VISION: when the user references an image file path (.png/.jpg/"
     ".jpeg/.gif/.webp/.bmp on disk — a screenshot, mockup, diagram, or photo), it "
-    "is attached and you can SEE it; describe it, read text from it, or debug "
-    "with it — never claim you cannot view images."
+    "is attached and you can SEE it; you can also call the `ViewImage` tool to "
+    "look at any image you find yourself (Read gives binary garbage for images — "
+    "use ViewImage). Describe it, read text from it, or debug with it — never "
+    "claim you cannot view images."
 )
 
 # Short, imperative prompt. Small local models do better with "act now" than
@@ -119,8 +121,10 @@ _GEMMA_SYSTEM_PROMPT = (
     "write a TODO.md file for this.\n"
     "You have VISION: when the user's message references an image file path "
     "(.png/.jpg/.jpeg/.gif/.webp/.bmp that exists on disk — a screenshot, mockup, "
-    "diagram, or photo), that image is attached and you can SEE it. Describe it, "
-    "read text from it, or use it to debug — never claim you cannot view images."
+    "diagram, or photo), that image is attached and you can SEE it. You can also "
+    "call the `ViewImage` tool to look at any image you find yourself (Read gives "
+    "binary garbage for images — use ViewImage). Describe it, read text from it, "
+    "or use it to debug — never claim you cannot view images."
 )
 
 

{drydock_cli-3.0.77 → drydock_cli-3.0.79/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.77
+Version: 3.0.79
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -61,8 +61,9 @@ A full agentic CLI harness — every tool below is clean-room and dependency-fre
   `Edit`, `Bash`, `Glob`, `Grep`.
 - **Vision (multimodal)** — reference an image path in your message (a `.png`/
   `.jpg` screenshot, mockup, or diagram) and it's attached for a vision-capable
-  model to *see* — describe a UI, read text off a screenshot, debug a diagram.
-  Works with any `--mmproj`-enabled server (e.g. llama.cpp with a vision model).
+  model to *see*; the agent can also call the `ViewImage` tool to look at an
+  image it discovers on its own — describe a UI, read text off a screenshot,
+  debug a diagram. Works with any `--mmproj` server (e.g. llama.cpp + a vision model).
 - **Version control** — `GitStatus`, `GitDiff`, `GitLog`, `GitCommit`
   (structured + truncated; commit is local and reversible).
 - **Internet** — `WebSearch` + `WebFetch` (DuckDuckGo; offline-safe).
@@ -166,13 +167,17 @@ compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
 /stig app.ckl open                                    # list the open findings
 /stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
 /stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+/stig poam app.ckl                                    # eMASS POA&M CSV of the open findings
 ```
 
 `/stig new` parses the XCCDF benchmark (validated against the full 286-rule
 Application STIG); `/stig-assess` reads your evidence and writes status +
 finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
 **auto-links each rule to its NIST 800-53 control** through DISA's CCI map
-(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline. `/stig poam`
+exports the open findings to a deterministic **eMASS POA&M CSV** — Control (from
+the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
+Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
 ## Install
 

{drydock_cli-3.0.77 → drydock_cli-3.0.79}/drydock_cli.egg-info/SOURCES.txt

@@ -17,6 +17,7 @@ drydock/graphrag.py
 drydock/guards.py
 drydock/loop_detect.py
 drydock/mcp.py
+drydock/poam.py
 drydock/providers.py
 drydock/rmf.py
 drydock/rmf_graph.py
@@ -73,6 +74,7 @@ tests/test_loop_detect.py
 tests/test_mcp.py
 tests/test_oneshot_unreachable.py
 tests/test_plan_autocontinue.py
+tests/test_poam.py
 tests/test_providers_unreachable.py
 tests/test_read_index.py
 tests/test_rmf.py
@@ -91,6 +93,7 @@ tests/test_tool_arg_parsing.py
 tests/test_tools_undo.py
 tests/test_tui.py
 tests/test_tuning.py
+tests/test_viewimage.py
 tests/test_vision_input.py
 tests/test_web_tools.py
 tests/test_xccdf.py

{drydock_cli-3.0.77 → drydock_cli-3.0.79}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.77"
+version = "3.0.79"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

drydock_cli-3.0.79/tests/test_poam.py

@@ -0,0 +1,50 @@
+"""eMASS POA&M CSV export from open STIG findings (deterministic)."""
+from __future__ import annotations
+
+import csv
+
+from drydock import poam, stig
+
+_CKL = ('<?xml version="1.0"?><CHECKLIST><ASSET><HOST_NAME>h1</HOST_NAME></ASSET><STIGS><iSTIG><STIG_INFO></STIG_INFO>'
+        '<VULN><STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-1</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE><ATTRIBUTE_DATA>SV-1</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE><ATTRIBUTE_DATA>Disable debug</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE><ATTRIBUTE_DATA>high</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE><ATTRIBUTE_DATA>Set debug=false.</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE><ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STATUS>Open</STATUS></VULN>'
+        '<VULN><STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-2</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STATUS>NotAFinding</STATUS></VULN></iSTIG></STIGS></CHECKLIST>')
+
+
+def test_poam_rows_only_open_with_control_and_severity(tmp_path):
+    p = tmp_path / "s.ckl"; p.write_text(_CKL)
+    cl = stig.load(p)
+    rows = poam.poam_rows(cl, {"CCI-000366": "cm-6"})
+    assert len(rows) == 1                                   # only the Open finding
+    row = rows[0]
+    assert row["Control"] == "CM-6"                         # from the CCI map
+    assert row["Severity"] == "High" and row["Raw Severity"] == "CAT I"   # high → CAT I/High
+    assert row["POA&M Status"] == "Ongoing"
+    assert "Set debug=false." in row["Milestone Description"]
+    assert "V-1" in row["Vulnerability Description"]
+
+
+def test_poam_unmapped_cci_is_marked_not_dropped(tmp_path):
+    p = tmp_path / "s.ckl"; p.write_text(_CKL)
+    cl = stig.load(p)
+    rows = poam.poam_rows(cl, {})                           # no map
+    assert rows[0]["Control"] == "(unmapped CCI-000366)"    # marked, not silently lost
+
+
+def test_write_csv_has_emass_headers(tmp_path):
+    p = tmp_path / "s.ckl"; p.write_text(_CKL)
+    cl = stig.load(p)
+    out = tmp_path / "poam.csv"
+    n = poam.export(cl, {"CCI-000366": "cm-6"}, out)["rows"]
+    assert n == 1
+    with open(out, newline="") as f:
+        reader = csv.DictReader(f)
+        assert reader.fieldnames == poam.EMASS_HEADERS
+        row = next(reader)
+        assert row["Control"] == "CM-6" and row["Severity"] == "High"

drydock_cli-3.0.79/tests/test_viewimage.py

@@ -0,0 +1,58 @@
+"""Agent-side vision: the ViewImage tool + its API-boundary attachment.
+The agent can choose to SEE an image it discovers (not just user-referenced
+ones); the image rides back on the ViewImage tool result."""
+from __future__ import annotations
+
+import struct
+import zlib
+
+import drydock.tools  # noqa: F401 — triggers tool registration
+from drydock import tool_registry as reg
+from drydock.providers import messages_to_openai
+
+
+def _png(path):
+    w = h = 8
+    raw = b"".join(b"\x00" + bytes([10, 20, 200]) * w for _ in range(h))
+    def ch(t, d):
+        c = t + d
+        return struct.pack(">I", len(d)) + c + struct.pack(">I", zlib.crc32(c) & 0xFFFFFFFF)
+    path.write_bytes(b"\x89PNG\r\n\x1a\n"
+                     + ch(b"IHDR", struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0))
+                     + ch(b"IDAT", zlib.compress(raw)) + ch(b"IEND", b""))
+    return str(path)
+
+
+def test_viewimage_validates(tmp_path):
+    _png(tmp_path / "a.png")
+    cfg = {"cwd": str(tmp_path)}
+    assert "now visible to you" in reg.execute("ViewImage", {"path": "a.png"}, cfg)
+    assert "no image file" in reg.execute("ViewImage", {"path": "missing.png"}, cfg)
+    assert "not a supported image" in reg.execute("ViewImage", {"path": str(tmp_path / "x.txt")}, cfg)
+    assert "needs a `path`" in reg.execute("ViewImage", {}, cfg)
+
+
+def test_viewimage_is_read_only_and_subagent_visible():
+    td = reg.get("ViewImage")
+    assert td.read_only is True
+    from drydock.tools import SUBAGENT_TOOLS
+    assert "ViewImage" in SUBAGENT_TOOLS
+
+
+def test_viewimage_result_becomes_multimodal(tmp_path):
+    _png(tmp_path / "shot.png")
+    cfg = {"cwd": str(tmp_path)}
+    res = reg.execute("ViewImage", {"path": "shot.png"}, cfg)
+    out = messages_to_openai([{"role": "tool", "tool_call_id": "c1",
+                               "name": "ViewImage", "content": res}], "sys")
+    content = out[-1]["content"]
+    assert isinstance(content, list)
+    assert any(b.get("type") == "image_url" for b in content)
+    assert content[0]["type"] == "text"
+
+
+def test_non_viewimage_tool_with_png_path_stays_text(tmp_path):
+    img = _png(tmp_path / "shot.png")
+    out = messages_to_openai([{"role": "tool", "tool_call_id": "c2",
+                               "name": "Grep", "content": f"found {img} in code"}], "sys")
+    assert isinstance(out[-1]["content"], str)   # no accidental image ballooning