drydock-cli 3.0.78__tar.gz → 3.0.79__tar.gz

{drydock_cli-3.0.78/drydock_cli.egg-info → drydock_cli-3.0.79}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.78
+Version: 3.0.79
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -167,13 +167,17 @@ compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
 /stig app.ckl open                                    # list the open findings
 /stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
 /stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+/stig poam app.ckl                                    # eMASS POA&M CSV of the open findings
 ```
 
 `/stig new` parses the XCCDF benchmark (validated against the full 286-rule
 Application STIG); `/stig-assess` reads your evidence and writes status +
 finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
 **auto-links each rule to its NIST 800-53 control** through DISA's CCI map
-(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline. `/stig poam`
+exports the open findings to a deterministic **eMASS POA&M CSV** — Control (from
+the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
+Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
 ## Install
 

{drydock_cli-3.0.78 → drydock_cli-3.0.79}/README.md

@@ -143,13 +143,17 @@ compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
 /stig app.ckl open                                    # list the open findings
 /stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
 /stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+/stig poam app.ckl                                    # eMASS POA&M CSV of the open findings
 ```
 
 `/stig new` parses the XCCDF benchmark (validated against the full 286-rule
 Application STIG); `/stig-assess` reads your evidence and writes status +
 finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
 **auto-links each rule to its NIST 800-53 control** through DISA's CCI map
-(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline. `/stig poam`
+exports the open findings to a deterministic **eMASS POA&M CSV** — Control (from
+the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
+Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
 ## Install
 

drydock_cli-3.0.79/drydock/poam.py

@@ -0,0 +1,73 @@
+"""eMASS-compatible POA&M (Plan of Action & Milestones) export from STIG findings.
+
+Deterministic and stdlib-only: takes the OPEN findings in a parsed checklist,
+maps each to its NIST SP 800-53 control (via the DISA CCI map in cci.py) and its
+eMASS severity (STIG CAT I/II/III), and writes the standard eMASS POA&M CSV. No
+LLM in this path — it's a faithful transform of facts already in the checklist +
+the CCI map, so it's reproducible and ungameable. Complements the `/rmf-poam`
+skill (which writes a narrative entry); this is the bulk machine-importable CSV.
+
+All logic original to Drydock.
+"""
+from __future__ import annotations
+
+import csv
+from pathlib import Path
+
+# STIG severity (CAT I/II/III) → eMASS Severity + the raw CAT label.
+_EMASS_SEVERITY = {"high": "High", "medium": "Moderate", "low": "Low"}
+_CAT = {"high": "CAT I", "medium": "CAT II", "low": "CAT III"}
+
+# eMASS POA&M columns (the prompt's required fields + the standard companions
+# eMASS expects so the CSV imports cleanly).
+EMASS_HEADERS = [
+    "Control",
+    "Vulnerability Description",
+    "Source Identifying Vulnerability",
+    "POA&M Status",
+    "Milestone Description",
+    "Severity",
+    "Raw Severity",
+    "Comments",
+]
+
+
+def poam_rows(checklist, cci_map: dict | None = None) -> list[dict]:
+    """One eMASS POA&M row per OPEN finding. `cci_map` (CCI→control) populates the
+    Control column; missing mappings are marked '(unmapped CCI)' rather than
+    dropped, so nothing is silently lost."""
+    cci_map = cci_map or {}
+    rows: list[dict] = []
+    for r in checklist.rules:
+        if r.status != "open":
+            continue
+        ctl = cci_map.get(r.cci, "")
+        control = ctl.upper() if ctl else (f"(unmapped {r.cci})" if r.cci else "(no CCI)")
+        rows.append({
+            "Control": control,
+            "Vulnerability Description": f"{r.group_id} ({r.rule_id}): {r.title}".strip(),
+            "Source Identifying Vulnerability": r.rule_id or r.group_id,
+            "POA&M Status": "Ongoing",
+            "Milestone Description": (r.fix_text or "").strip() or "See STIG Fix Text.",
+            "Severity": _EMASS_SEVERITY.get(r.severity, "Moderate"),
+            "Raw Severity": _CAT.get(r.severity, "CAT II"),
+            "Comments": (r.finding_details or "").strip(),
+        })
+    return rows
+
+
+def write_csv(rows: list[dict], path: str | Path) -> int:
+    """Write POA&M rows to an eMASS-headered CSV. Returns the row count."""
+    with open(path, "w", newline="", encoding="utf-8") as f:
+        w = csv.DictWriter(f, fieldnames=EMASS_HEADERS)
+        w.writeheader()
+        for row in rows:
+            w.writerow({h: row.get(h, "") for h in EMASS_HEADERS})
+    return len(rows)
+
+
+def export(checklist, cci_map: dict | None, out_path: str | Path) -> dict:
+    """Build + write the POA&M CSV for a checklist's open findings."""
+    rows = poam_rows(checklist, cci_map)
+    write_csv(rows, out_path)
+    return {"rows": len(rows), "path": str(out_path)}

{drydock_cli-3.0.78 → drydock_cli-3.0.79}/drydock/tui/app.py

@@ -547,6 +547,7 @@ class DrydockApp(App):
                        "  /stig new <benchmark-xccdf.xml> [out.ckl]  — blank .ckl from a STIG\n"
                        "  /stig <path.ckl|.cklb> [status]            — summary / list by status\n"
                        "  /stig graph <path.ckl>                     — ingest into the RMF graph\n"
+                       "  /stig poam <path.ckl> [out.csv]            — eMASS POA&M CSV (open findings)\n"
                        "Assess:  /loop <n> /stig-assess <path>")
             return
         import os as _os
@@ -569,6 +570,15 @@ class DrydockApp(App):
                 f"  /graphrag build <app-docs>   ·   /loop {len(cl.rules)} /stig-assess {out}"
             )
             return
+        # /stig poam <path> [out.csv] — export open findings to an eMASS POA&M CSV
+        if parts[0].lower() == "poam" and len(parts) > 1:
+            cp = _abs(parts[1])
+            out = _abs(parts[2]) if len(parts) > 2 else \
+                _os.path.splitext(cp)[0] + "_poam.csv"
+            self._info("Building the eMASS POA&M CSV (mapping open findings to NIST "
+                       "controls via the CCI map)…")
+            self.run_worker(lambda: self._stig_poam(cwd, cp, out), thread=True)
+            return
         # /stig graph <path> — ingest the checklist into the RMF typed graph
         if parts[0].lower() == "graph" and len(parts) > 1:
             gp = parts[1] if _os.path.isabs(parts[1]) else _os.path.join(cwd, parts[1])
@@ -640,6 +650,26 @@ class DrydockApp(App):
                    "catalog download; after that it works offline.)")
         self.call_from_thread(self._info, msg)
 
+    def _stig_poam(self, cwd: str, path: str, out: str) -> None:
+        """Worker: export a checklist's open findings to an eMASS POA&M CSV,
+        pulling each finding's NIST control from the CCI map. Deterministic."""
+        from drydock import cci, poam, stig
+
+        try:
+            cl = stig.load(path)
+            cci_map = cci.load_map(cwd)   # offline-safe ({} → Controls show '(unmapped)')
+            r = poam.export(cl, cci_map, out)
+        except Exception as e:  # noqa: BLE001
+            self.call_from_thread(self._mount, ErrorMessage(f"could not build POA&M: {e}"))
+            return
+        note = "" if cci_map else " (CCI map unavailable offline — Control column shows '(unmapped)'; re-run online to populate it)"
+        self.call_from_thread(
+            self._info,
+            f"✓ Wrote {r['rows']} POA&M row(s) for the open findings to {r['path']} "
+            f"(eMASS headers: Control · Vulnerability Description · POA&M Status=Ongoing · "
+            f"Milestone · Severity).{note}"
+        )
+
     def _stig_graph(self, cwd: str, path: str) -> None:
         """Worker-thread body: ingest a checklist into the RMF graph, auto-linking
         rules to NIST controls via the DISA CCI map. Reports back on the UI."""

{drydock_cli-3.0.78 → drydock_cli-3.0.79/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.78
+Version: 3.0.79
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -167,13 +167,17 @@ compatible checklist — entirely local (hostnames, IPs, and findings are CUI):
 /stig app.ckl open                                    # list the open findings
 /stig-remediate app.ckl SV-900010r1_rule              # write an idempotent fix script
 /stig graph app.ckl                                   # ingest + auto-link rules → NIST controls
+/stig poam app.ckl                                    # eMASS POA&M CSV of the open findings
 ```
 
 `/stig new` parses the XCCDF benchmark (validated against the full 286-rule
 Application STIG); `/stig-assess` reads your evidence and writes status +
 finding-details back in place; `/stig graph` builds `STIG`/`STIG-Rule` nodes and
 **auto-links each rule to its NIST 800-53 control** through DISA's CCI map
-(`Control —SATISFIED_BY→ rule`), fetched once and cached offline.
+(`Control —SATISFIED_BY→ rule`), fetched once and cached offline. `/stig poam`
+exports the open findings to a deterministic **eMASS POA&M CSV** — Control (from
+the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
+Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
 ## Install
 

{drydock_cli-3.0.78 → drydock_cli-3.0.79}/drydock_cli.egg-info/SOURCES.txt

@@ -17,6 +17,7 @@ drydock/graphrag.py
 drydock/guards.py
 drydock/loop_detect.py
 drydock/mcp.py
+drydock/poam.py
 drydock/providers.py
 drydock/rmf.py
 drydock/rmf_graph.py
@@ -73,6 +74,7 @@ tests/test_loop_detect.py
 tests/test_mcp.py
 tests/test_oneshot_unreachable.py
 tests/test_plan_autocontinue.py
+tests/test_poam.py
 tests/test_providers_unreachable.py
 tests/test_read_index.py
 tests/test_rmf.py

{drydock_cli-3.0.78 → drydock_cli-3.0.79}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.78"
+version = "3.0.79"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

drydock_cli-3.0.79/tests/test_poam.py

@@ -0,0 +1,50 @@
+"""eMASS POA&M CSV export from open STIG findings (deterministic)."""
+from __future__ import annotations
+
+import csv
+
+from drydock import poam, stig
+
+_CKL = ('<?xml version="1.0"?><CHECKLIST><ASSET><HOST_NAME>h1</HOST_NAME></ASSET><STIGS><iSTIG><STIG_INFO></STIG_INFO>'
+        '<VULN><STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-1</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE><ATTRIBUTE_DATA>SV-1</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE><ATTRIBUTE_DATA>Disable debug</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE><ATTRIBUTE_DATA>high</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE><ATTRIBUTE_DATA>Set debug=false.</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE><ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STATUS>Open</STATUS></VULN>'
+        '<VULN><STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-2</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STATUS>NotAFinding</STATUS></VULN></iSTIG></STIGS></CHECKLIST>')
+
+
+def test_poam_rows_only_open_with_control_and_severity(tmp_path):
+    p = tmp_path / "s.ckl"; p.write_text(_CKL)
+    cl = stig.load(p)
+    rows = poam.poam_rows(cl, {"CCI-000366": "cm-6"})
+    assert len(rows) == 1                                   # only the Open finding
+    row = rows[0]
+    assert row["Control"] == "CM-6"                         # from the CCI map
+    assert row["Severity"] == "High" and row["Raw Severity"] == "CAT I"   # high → CAT I/High
+    assert row["POA&M Status"] == "Ongoing"
+    assert "Set debug=false." in row["Milestone Description"]
+    assert "V-1" in row["Vulnerability Description"]
+
+
+def test_poam_unmapped_cci_is_marked_not_dropped(tmp_path):
+    p = tmp_path / "s.ckl"; p.write_text(_CKL)
+    cl = stig.load(p)
+    rows = poam.poam_rows(cl, {})                           # no map
+    assert rows[0]["Control"] == "(unmapped CCI-000366)"    # marked, not silently lost
+
+
+def test_write_csv_has_emass_headers(tmp_path):
+    p = tmp_path / "s.ckl"; p.write_text(_CKL)
+    cl = stig.load(p)
+    out = tmp_path / "poam.csv"
+    n = poam.export(cl, {"CCI-000366": "cm-6"}, out)["rows"]
+    assert n == 1
+    with open(out, newline="") as f:
+        reader = csv.DictReader(f)
+        assert reader.fieldnames == poam.EMASS_HEADERS
+        row = next(reader)
+        assert row["Control"] == "CM-6" and row["Severity"] == "High"