drydock-cli 3.1.34__tar.gz → 3.1.36__tar.gz

{drydock_cli-3.1.34/drydock_cli.egg-info → drydock_cli-3.1.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.1.34
+Version: 3.1.36
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -32,11 +32,16 @@ Dynamic: license-file
 
 # ⚓ Drydock
 
-A local-first, provider-agnostic **terminal coding agent** for your own LLM.
-No accounts, no telemetry, no cloud — the only outbound calls are to the model
-endpoint you configure and (optionally) the web-search tools you invoke.
-Primary target: **dense Gemma-4-31B** (QAT, 64K) served by llama.cpp on a
-single workstation.
+**The air-gapped terminal coding agent that automates your NIST compliance** —
+RMF (800-53), CSF 2.0, AI RMF, and DISA STIG — running entirely on your own
+hardware against a local LLM. No accounts, no telemetry, no cloud: your code,
+controls, and CUI never leave the box.
+
+Under the compliance skills it's a full agentic coding harness — the same
+air-gapped agent whether you're assessing a control or shipping a feature. The
+only outbound calls are to the model endpoint you configure and (optionally) the
+web-search tools you invoke. Primary target: **dense Gemma-4-31B** (QAT, 64K)
+served by llama.cpp on a single workstation.
 
 > **v3 — clean-room rebuild.** Drydock is being rebuilt as an original,
 > Apache-2.0 codebase owned end to end (no upstream fork). Every release is
@@ -46,10 +51,14 @@ single workstation.
 
 ## Why
 
-A coding agent should build real projects from your machine without sending
-your code or credentials anywhere. Drydock runs entirely against a local
-model, feels like a first-class terminal agent, and keeps its data plane on
-your box.
+Regulated and air-gapped environments — federal, defense, critical-infrastructure,
+and any org adopting NIST CSF 2.0 — can't send code, controls, or CUI to a cloud
+agent, yet still need real automation. Drydock runs entirely against a local model,
+feels like a first-class terminal agent, ingests the NIST 800-53 catalog and DISA
+STIG benchmarks to assess / remediate / export POA&Ms **offline**, and keeps its
+data plane on your box. It's a governable agent by design: a deterministic control
+loop, a verification gate on "done", and a durable, tamper-evident event trace —
+the audit record for what an autonomous agent did in your environment.
 
 ## Status
 
@@ -60,6 +69,36 @@ line, and a multi-line prompt. The agent loop, OpenAI-compatible provider,
 two-tier compaction, and the full agentic toolset (below) are in, with Gemma
 reliability hardening verified hands-on.
 
+## Quickstart
+
+**One command** — installs Drydock, then either serves a strong local model or points
+at a keyed endpoint, and launches you into the agent:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/fbobe321/drydock/main/scripts/quickstart.sh | bash
+```
+
+It offers two backends:
+
+- **Local (air-gapped)** — downloads **Qwen2.5-Coder-32B** (one time) and serves it with
+  `llama.cpp`, then runs entirely offline. Needs a GPU box with `llama-server` on `PATH`.
+- **Frontier (no GPU)** — try it in a minute against a keyed OpenAI-compatible endpoint;
+  only that call leaves the box:
+  ```bash
+  OPENAI_API_KEY=sk-... DRYDOCK_QUICKSTART_MODE=frontier \
+    curl -fsSL https://raw.githubusercontent.com/fbobe321/drydock/main/scripts/quickstart.sh | bash
+  ```
+
+Prefer to wire it up by hand?
+
+```bash
+pip install drydock-cli
+# point at any OpenAI-compatible server (llama.cpp / vLLM / Ollama / LM Studio):
+drydock --provider vllm --base-url http://localhost:8000/v1 --model <served-model-name>
+# or a keyed frontier model (key via OPENAI_API_KEY or config `api_key`):
+OPENAI_API_KEY=sk-... drydock --provider openai --base-url https://api.openai.com/v1 --model gpt-4o
+```
+
 ## Capabilities
 
 A full agentic CLI harness — every tool below is clean-room and dependency-free
@@ -282,22 +321,6 @@ exports the open findings to a deterministic **eMASS POA&M CSV** — Control (fr
 the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
 Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
-### FIAR audit-readiness (DoD financial-statement audit)
-
-Model a Financial Improvement and Audit Readiness engagement — a seeded key-control
-matrix per business cycle (FBWT, P2P, PP&E, INV, CIVPAY, REIM, FR, ITGC), the five FS
-assertions, a deterministic **evidence-chain validator** (a control can't be called
-effective on an incomplete population→sample→…→GL→assertion trace), findings (NFRs), and
-CAPs. `python -m drydock.fiar new|controls|control|assess|reconcile|package`; skills
-`/fiar-assess /fiar-evidence /fiar-readiness /fiar-cap`.
-
-**KSD evidence packaging.** `fiar package <engagement> <out> --evidence-dir <dir>` assembles
-an audit binder — `index.md` + `index.json` mapping every control → assertions → KSDs →
-status → evidence-chain completeness → findings — and **collects the actual evidence files
-each test cited**, zipped. Add `--redact "<term>"` (repeatable) to **red-box** names/secrets
-in the evidence *and* the manifest for a releasable version (verified via the Document
-Canvas); the original engagement is never touched. Also exposed as the `FiarPackage` tool.
-
 ### Document Canvas — editing documents far larger than the context window
 
 Edit a 300-, 800-, 1000-page document the way you edit a large codebase: **search,

{drydock_cli-3.1.34 → drydock_cli-3.1.36}/README.md

@@ -1,10 +1,15 @@
 # ⚓ Drydock
 
-A local-first, provider-agnostic **terminal coding agent** for your own LLM.
-No accounts, no telemetry, no cloud — the only outbound calls are to the model
-endpoint you configure and (optionally) the web-search tools you invoke.
-Primary target: **dense Gemma-4-31B** (QAT, 64K) served by llama.cpp on a
-single workstation.
+**The air-gapped terminal coding agent that automates your NIST compliance** —
+RMF (800-53), CSF 2.0, AI RMF, and DISA STIG — running entirely on your own
+hardware against a local LLM. No accounts, no telemetry, no cloud: your code,
+controls, and CUI never leave the box.
+
+Under the compliance skills it's a full agentic coding harness — the same
+air-gapped agent whether you're assessing a control or shipping a feature. The
+only outbound calls are to the model endpoint you configure and (optionally) the
+web-search tools you invoke. Primary target: **dense Gemma-4-31B** (QAT, 64K)
+served by llama.cpp on a single workstation.
 
 > **v3 — clean-room rebuild.** Drydock is being rebuilt as an original,
 > Apache-2.0 codebase owned end to end (no upstream fork). Every release is
@@ -14,10 +19,14 @@ single workstation.
 
 ## Why
 
-A coding agent should build real projects from your machine without sending
-your code or credentials anywhere. Drydock runs entirely against a local
-model, feels like a first-class terminal agent, and keeps its data plane on
-your box.
+Regulated and air-gapped environments — federal, defense, critical-infrastructure,
+and any org adopting NIST CSF 2.0 — can't send code, controls, or CUI to a cloud
+agent, yet still need real automation. Drydock runs entirely against a local model,
+feels like a first-class terminal agent, ingests the NIST 800-53 catalog and DISA
+STIG benchmarks to assess / remediate / export POA&Ms **offline**, and keeps its
+data plane on your box. It's a governable agent by design: a deterministic control
+loop, a verification gate on "done", and a durable, tamper-evident event trace —
+the audit record for what an autonomous agent did in your environment.
 
 ## Status
 
@@ -28,6 +37,36 @@ line, and a multi-line prompt. The agent loop, OpenAI-compatible provider,
 two-tier compaction, and the full agentic toolset (below) are in, with Gemma
 reliability hardening verified hands-on.
 
+## Quickstart
+
+**One command** — installs Drydock, then either serves a strong local model or points
+at a keyed endpoint, and launches you into the agent:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/fbobe321/drydock/main/scripts/quickstart.sh | bash
+```
+
+It offers two backends:
+
+- **Local (air-gapped)** — downloads **Qwen2.5-Coder-32B** (one time) and serves it with
+  `llama.cpp`, then runs entirely offline. Needs a GPU box with `llama-server` on `PATH`.
+- **Frontier (no GPU)** — try it in a minute against a keyed OpenAI-compatible endpoint;
+  only that call leaves the box:
+  ```bash
+  OPENAI_API_KEY=sk-... DRYDOCK_QUICKSTART_MODE=frontier \
+    curl -fsSL https://raw.githubusercontent.com/fbobe321/drydock/main/scripts/quickstart.sh | bash
+  ```
+
+Prefer to wire it up by hand?
+
+```bash
+pip install drydock-cli
+# point at any OpenAI-compatible server (llama.cpp / vLLM / Ollama / LM Studio):
+drydock --provider vllm --base-url http://localhost:8000/v1 --model <served-model-name>
+# or a keyed frontier model (key via OPENAI_API_KEY or config `api_key`):
+OPENAI_API_KEY=sk-... drydock --provider openai --base-url https://api.openai.com/v1 --model gpt-4o
+```
+
 ## Capabilities
 
 A full agentic CLI harness — every tool below is clean-room and dependency-free
@@ -250,22 +289,6 @@ exports the open findings to a deterministic **eMASS POA&M CSV** — Control (fr
 the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
 Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
-### FIAR audit-readiness (DoD financial-statement audit)
-
-Model a Financial Improvement and Audit Readiness engagement — a seeded key-control
-matrix per business cycle (FBWT, P2P, PP&E, INV, CIVPAY, REIM, FR, ITGC), the five FS
-assertions, a deterministic **evidence-chain validator** (a control can't be called
-effective on an incomplete population→sample→…→GL→assertion trace), findings (NFRs), and
-CAPs. `python -m drydock.fiar new|controls|control|assess|reconcile|package`; skills
-`/fiar-assess /fiar-evidence /fiar-readiness /fiar-cap`.
-
-**KSD evidence packaging.** `fiar package <engagement> <out> --evidence-dir <dir>` assembles
-an audit binder — `index.md` + `index.json` mapping every control → assertions → KSDs →
-status → evidence-chain completeness → findings — and **collects the actual evidence files
-each test cited**, zipped. Add `--redact "<term>"` (repeatable) to **red-box** names/secrets
-in the evidence *and* the manifest for a releasable version (verified via the Document
-Canvas); the original engagement is never touched. Also exposed as the `FiarPackage` tool.
-
 ### Document Canvas — editing documents far larger than the context window
 
 Edit a 300-, 800-, 1000-page document the way you edit a large codebase: **search,

{drydock_cli-3.1.34 → drydock_cli-3.1.36}/drydock/cli.py

@@ -149,6 +149,42 @@ def run_oneshot(prompt: str, config: dict) -> None:
         sys.exit(2)
 
 
+def run_oneshot_swarm(prompt: str, config: dict) -> None:
+    """One-shot via a competitive SWARM (config `auto_swarm` / --swarm): N agents attempt the
+    task in parallel in isolated worktrees, the verified winner is applied to the working tree.
+    Falls back to a single agent if the swarm can't run or converge."""
+    import subprocess
+    from drydock.swarm import run_swarm
+    cwd = config.get("cwd") or os.getcwd()
+    try:
+        agents = max(2, min(8, int(config.get("auto_swarm_agents", 4) or 4)))
+    except (TypeError, ValueError):
+        agents = 4
+    print(f"⚓ auto-swarm: {agents} parallel agents on: {prompt}", file=sys.stderr, flush=True)
+    try:
+        res = run_swarm(cwd, prompt, agents=agents, base_config=config, share=True, waves=2)
+    except Exception as e:  # noqa: BLE001
+        print(f"(swarm couldn't run: {e} — falling back to single agent)", file=sys.stderr, flush=True)
+        return run_oneshot(prompt, config)
+    if not res.converged or res.winner is None:
+        print(f"(swarm ran {agents} agents, {len(res.candidates)} candidate(s), none converged "
+              f"— falling back to single agent)", file=sys.stderr, flush=True)
+        return run_oneshot(prompt, config)
+    w = res.winner
+    try:
+        r = subprocess.run(["git", "checkout", w.commit, "--", "."], cwd=cwd,
+                           capture_output=True, text=True)
+        if r.returncode != 0:
+            print(f"Swarm winner {w.commit[:12]} not auto-applied ({r.stderr.strip()}). "
+                  f"Apply: git checkout {w.commit} -- .", file=sys.stderr, flush=True)
+            return
+    except Exception as e:  # noqa: BLE001
+        print(f"Swarm converged but apply errored: {e}", file=sys.stderr, flush=True)
+        return
+    print(f"✓ swarm converged: winner by {w.agent}, {w.tests_passed}/{w.tests_total} tests, "
+          f"{w.files_changed} file(s) changed, applied {w.commit[:12]}.", flush=True)
+
+
 def handle_command(cmd: str, state: AgentState, config: dict) -> bool:
     """Handle slash commands. Returns True if handled."""
     raw = cmd.strip()  # case-preserved (paths/args must not be lowercased)
@@ -414,6 +450,10 @@ def main():
                         help="Write the full run transcript (system + messages) here — for harvesting training data")
     parser.add_argument("--force-first-tool", action="store_true", help="Force tool_choice=required on first turn")
     parser.add_argument("--cli", action="store_true", help="Plain readline mode instead of the TUI")
+    parser.add_argument("--swarm", action="store_true", dest="swarm",
+                        help="One-shot: solve the task with a competitive parallel swarm (winner applied)")
+    parser.add_argument("--no-swarm", action="store_true", dest="no_swarm",
+                        help="One-shot: force a single agent even if auto_swarm is on")
     parser.add_argument(
         "--dangerously-skip-permissions",
         dest="dangerously_skip_permissions",
@@ -481,7 +521,19 @@ def main():
     _connect_mcp(config)
 
     if args.prompt:
-        run_oneshot(args.prompt, config)
+        # Route to the swarm when forced (--swarm) or when auto_swarm is on AND the task
+        # looks substantial; --no-swarm and the triviality gate keep single-agent the default.
+        from drydock.swarm import looks_substantial
+        if getattr(args, "no_swarm", False):
+            use_swarm = False
+        elif getattr(args, "swarm", False):
+            use_swarm = True
+        else:
+            use_swarm = bool(config.get("auto_swarm")) and looks_substantial(args.prompt)
+        if use_swarm:
+            run_oneshot_swarm(args.prompt, config)
+        else:
+            run_oneshot(args.prompt, config)
     elif args.cli:
         run_interactive(config)
     else:

{drydock_cli-3.1.34 → drydock_cli-3.1.36}/drydock/config.py

@@ -33,6 +33,12 @@ DEFAULTS: dict[str, object] = {
     # OpenRouter, Together). Mirrors `advisor_api_key`. Can also come from the
     # provider's api_key_env (e.g. OPENAI_API_KEY); the config value wins.
     "api_key": "",
+    # Auto-swarm (opt-in): when true, one-shot `-p` tasks that look like a substantial,
+    # self-contained implementation (swarm.looks_substantial) are solved by a competitive
+    # swarm of `auto_swarm_agents` parallel agents (winner applied), instead of one agent.
+    # Trivial edits/questions/reads always stay single-agent. Off by default.
+    "auto_swarm": False,
+    "auto_swarm_agents": 4,
     "max_tokens": 8192,  # 4096 truncated large file writes mid-JSON (→ _raw fail)
     "temperature": 0.2,
     # The model server's context window (llama.cpp -c / vLLM --max-model-len).

{drydock_cli-3.1.34 → drydock_cli-3.1.36}/drydock/mission_cli.py

@@ -215,6 +215,13 @@ def _parse_budget(argv: list[str]) -> tuple[dict, dict, str, list[str], dict, li
         elif a == "--max-escalations" and nxt:    # ladder climbs before BLOCKED/AWAITING_HUMAN (§23)
             eval_cfg["max_escalations"] = int(nxt) if nxt.isdigit() else 3
             i += 2
+        elif a == "--swarm":                      # solve each task with a SWARM, not one agent
+            eval_cfg["swarm"] = True
+            i += 1
+        elif a == "--swarm-agents" and nxt:       # agents per task's swarm (implies --swarm)
+            eval_cfg["swarm"] = True
+            eval_cfg["swarm_agents"] = int(nxt) if nxt.isdigit() else 4
+            i += 2
         elif a == "--model" and nxt:              # mission carries its own model/endpoint (§33)
             eval_cfg["model"] = nxt
             i += 2
@@ -248,7 +255,7 @@ def run_cli(argv: list, config: dict | None = None) -> int:
         if not objective:
             print('usage: drydock mission create "<objective>" [--target ">=70"] '
                   '[--verify CMD] [--protect GLOB]... [--samples N] [--noise-band F] '
-                  '[--time-budget 48h] [--max-experiments N]')
+                  '[--swarm | --swarm-agents N] [--time-budget 48h] [--max-experiments N]')
             return 1
         mconf = {"verify_cmd": verify, "model": config.get("model", ""),
                  "base_url": config.get("base_url", ""), "provider": config.get("provider", "vllm"),
@@ -337,6 +344,14 @@ def _run(store: M.MissionStore, mid: str, cwd: str, config: dict, *, resume: boo
         if mconf.get(key):
             base_config[key] = mconf[key]
     print(f"   model: {base_config.get('model')} @ {base_config.get('base_url')}")
+    # Worker: one bounded agent per task (default), OR a swarm per task (--swarm) — parallel
+    # diversified agents + blackboard cross-pollination, KEEP/REVERT on the swarm winner (§Phase-4).
+    if mconf.get("swarm"):
+        n = int(mconf.get("swarm_agents") or 4)
+        worker = R.make_swarm_worker(agents=n, share=True, waves=2)
+        print(f"   worker: SWARM ({n} agents/task, shared blackboard)")
+    else:
+        worker = R.default_worker
     if evaluator is not None:
         b = R.establish_baseline(store, mid, cwd, evaluator)
         if b is not None:
@@ -352,7 +367,7 @@ def _run(store: M.MissionStore, mid: str, cwd: str, config: dict, *, resume: boo
             print(f"  ⚑ {kind}: {d}")
         write_views(store, mid, cwd)
 
-    R.run_mission(store, mid, cwd=cwd, repo=cwd, evaluator=evaluator,
+    R.run_mission(store, mid, cwd=cwd, repo=cwd, worker=worker, evaluator=evaluator,
                   planner=decomposing_planner(m["objective"], verify, cwd), base_config=base_config,
                   stagnation_limit=int(mconf.get("stagnation_limit") or 5),
                   max_escalations=int(mconf.get("max_escalations") or 3),

{drydock_cli-3.1.34 → drydock_cli-3.1.36}/drydock/mission_run.py

@@ -191,6 +191,36 @@ def default_worker(task: dict, mission: dict, cwd: str, base_config: dict) -> Wo
                         out_tokens=int(getattr(state, "total_output_tokens", 0) or 0))
 
 
+def make_swarm_worker(agents: "int | str" = 4, share: bool = True, waves: int = 2,
+                      max_turns: int = 30, runner=None) -> WorkerFn:
+    """A WorkerFn that solves each mission task with a SWARM (parallel diversified agents +
+    blackboard cross-pollination) instead of a single agent — the long-horizon mission dispatches
+    a swarm per task (ASR Phase-4: durable depth × parallel breadth). The winning candidate's
+    commit is checked out into the mission's working tree (no commit of its own — the mission's
+    KEEP/REVERT handles that), so the mission evaluator scores the swarm's best result."""
+    def worker(task: dict, mission: dict, cwd: str, base_config: dict) -> WorkerResult:
+        from drydock import swarm as S
+        objective = task.get("objective", "")
+        verify_cmd = (mission.get("config") or {}).get("verify_cmd") or None
+        kw: dict = dict(agents=agents, base_config=base_config or {}, base_ref="HEAD",
+                        verify_cmd=verify_cmd, share=share, waves=waves, max_turns=max_turns)
+        if runner is not None:
+            kw["runner"] = runner
+        try:
+            res = S.run_swarm(cwd, objective, **kw)
+        except Exception as e:  # noqa: BLE001 — a swarm crash is contained like any worker (§32)
+            return WorkerResult(ok=False, error=f"swarm failed: {type(e).__name__}: {e}")
+        w = res.winner
+        if w is not None and w.commit:
+            # bring the winner's tree into the mission's working dir; the mission's checkpoint
+            # (KEEP) or restore (REVERT) commits/discards it, so no extra commit here.
+            _git(["checkout", w.commit, "--", "."], cwd)
+            return WorkerResult(ok=True, summary=(f"swarm winner {w.agent} "
+                                f"{w.tests_passed}/{w.tests_total}: {(w.summary or '')[:200]}"))
+        return WorkerResult(ok=True, summary="swarm produced no winning candidate")
+    return worker
+
+
 def _median(xs: list[float]) -> float:
     s = sorted(xs)
     n = len(s)

{drydock_cli-3.1.34 → drydock_cli-3.1.36}/drydock/swarm.py

@@ -734,6 +734,29 @@ class SwarmResult:
     candidates: list[Candidate]
 
 
+# Auto-swarm triviality gate: route a task to the swarm only when it looks like a
+# substantial, self-contained implementation — never a one-line fix, question, or read.
+_SUBSTANTIAL = ("implement", "build the", "build a", "refactor", "rewrite", "create the",
+                "all functions", "each function", "whole module", "entire", "feature",
+                "make the tests", "tests pass", "test suite", "port ", "migrate",
+                "add support", "write the", "flesh out", "scaffold", "from scratch")
+_TRIVIAL = ("typo", "rename", "one line", "one-line", "single line", "the comment",
+            "what is", "what's", "explain", "why ", "show me", "read ", "print the",
+            "list the", "how do", "how does", "?")
+
+
+def looks_substantial(task: str) -> bool:
+    """Heuristic gate for auto-swarm (config `auto_swarm`): True only when the task is a
+    substantial, self-contained implementation worth parallel attempts — not a trivial edit,
+    a question, or a read. Conservative: unsure → False (single agent stays the default)."""
+    t = (task or "").lower().strip()
+    if len(t.split()) < 4:
+        return False
+    if any(x in t for x in _TRIVIAL):
+        return False
+    return any(x in t for x in _SUBSTANTIAL)
+
+
 def run_swarm(cwd: str | Path, objective: str, *, agents: "int | str" = 4,
               base_config: dict | None = None,
               base_ref: str = "HEAD", verify_cmd: str | None = None, fitness: str = "auto",

{drydock_cli-3.1.34 → drydock_cli-3.1.36}/drydock/tool_select.py

@@ -44,6 +44,13 @@ _FAMILIES: list[tuple[frozenset[str], tuple[str, ...]]] = [
     (frozenset({"Jobs"}),
      ("job", "background", "training", "still running", "long-running", "long running",
       "status of", "check on", "how is the", "how's the", "in the background")),
+    # Multi-agent delegation/parallelism: surface Swarm (competitive parallel agents),
+    # Worker (delegate a subtask), and Dispatch (parallel investigation) when the task is
+    # a substantial implementation/refactor where parallel attempts or delegation help.
+    (frozenset({"Swarm", "Worker", "Dispatch"}),
+     ("implement", "module", "feature", "refactor", "rewrite", "build the", "all functions",
+      "each function", "tests pass", "make the tests", "parallel", "swarm", "several",
+      "whole", "entire", "port ", "migrate")),
 ]
 
 # External/mutating tools deprioritised while merely exploring (PRD F1.4: read &