attackmap 0.4.5__tar.gz → 0.4.6__tar.gz

{attackmap-0.4.5/src/attackmap.egg-info → attackmap-0.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.5
+Version: 0.4.6
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>

{attackmap-0.4.5 → attackmap-0.4.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.4.5"
+version = "0.4.6"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.4.5 → attackmap-0.4.6}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.4.5"
+__version__ = "0.4.6"

{attackmap-0.4.5 → attackmap-0.4.6}/src/attackmap/llm_review.py

@@ -197,6 +197,14 @@ def _claude_cli_available() -> bool:
     return shutil.which("claude") is not None
 
 
+def _anthropic_sdk_available() -> bool:
+    try:
+        import anthropic  # noqa: F401
+    except ImportError:
+        return False
+    return True
+
+
 def _run_via_claude_cli(
     rendered_system: str,
     rendered_user: str,
@@ -412,6 +420,14 @@ def _codex_cli_available() -> bool:
     return shutil.which("codex") is not None
 
 
+def _openai_sdk_available() -> bool:
+    try:
+        import openai  # noqa: F401
+    except ImportError:
+        return False
+    return True
+
+
 def _run_via_codex_cli(
     rendered_system: str,
     rendered_user: str,
@@ -514,10 +530,18 @@ def _resolve_openai_backend(
             )
         return "cli"
     # auto
-    if client is not None or api_key or os.environ.get("OPENAI_API_KEY"):
+    if client is not None:
+        return "api"
+    has_key = bool(api_key or os.environ.get("OPENAI_API_KEY"))
+    # Prefer the API backend only when the openai SDK is importable; otherwise
+    # fall back to the `codex` CLI (needs no SDK) so a key set against an
+    # SDK-less install still works via subscription auth.
+    if has_key and _openai_sdk_available():
         return "api"
     if _codex_cli_available():
         return "cli"
+    if has_key:
+        return "api"  # no SDK and no CLI — surface the actionable SDK-missing error
     raise LlmReviewError(
         "No OpenAI backend available. Set OPENAI_API_KEY, or install the `codex` "
         "CLI and run `codex login`."
@@ -539,12 +563,23 @@ def _resolve_backend(
             )
         return "cli"
     # auto
-    if client is not None or api_key:
+    if client is not None:
         return "api"
-    if os.environ.get("ANTHROPIC_API_KEY") or os.environ.get("ANTHROPIC_AUTH_TOKEN"):
+    has_key = bool(
+        api_key
+        or os.environ.get("ANTHROPIC_API_KEY")
+        or os.environ.get("ANTHROPIC_AUTH_TOKEN")
+    )
+    # Prefer the API backend only when the SDK is actually importable. Otherwise
+    # fall back to the `claude` CLI (needs no SDK), so a key set against an
+    # SDK-less install (e.g. Homebrew, which doesn't vendor `attackmap[llm]`)
+    # still works via subscription auth instead of erroring.
+    if has_key and _anthropic_sdk_available():
         return "api"
     if _claude_cli_available():
         return "cli"
+    if has_key:
+        return "api"  # no SDK and no CLI — surface the actionable SDK-missing error
     raise LlmReviewError(
         "No LLM backend available. Set ANTHROPIC_API_KEY, set ANTHROPIC_AUTH_TOKEN, "
         "or install the `claude` CLI and run `claude login`."

{attackmap-0.4.5 → attackmap-0.4.6/src/attackmap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.5
+Version: 0.4.6
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>

{attackmap-0.4.5 → attackmap-0.4.6}/tests/test_llm_review.py

@@ -424,6 +424,35 @@ def test_auto_backend_falls_back_to_cli_when_no_creds(monkeypatch) -> None:
     assert result.backend == "cli"
 
 
+def test_auto_backend_falls_back_to_cli_when_key_set_but_sdk_missing(monkeypatch) -> None:
+    # Homebrew installs attackmap without the anthropic SDK. A key set in that
+    # environment must fall back to the `claude` CLI, not error.
+    monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-ant-test")
+    monkeypatch.setattr("attackmap.llm_review._anthropic_sdk_available", lambda: False)
+    monkeypatch.setattr("attackmap.llm_review._claude_cli_available", lambda: True)
+
+    payload = {"type": "result", "is_error": False, "result": "hi"}
+    runner, _ = _make_cli_runner(json.dumps(payload))
+
+    result = generate_llm_review(
+        _trivial_scan(), _surfaces(), _findings(), [], backend="auto", cli_runner=runner
+    )
+    assert result.backend == "cli"
+
+
+def test_openai_auto_falls_back_to_codex_when_key_set_but_sdk_missing(monkeypatch) -> None:
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-openai-test")
+    monkeypatch.setattr("attackmap.llm_review._openai_sdk_available", lambda: False)
+    monkeypatch.setattr("attackmap.llm_review._codex_cli_available", lambda: True)
+    runner, _ = _make_cli_runner("hi")
+
+    result = generate_llm_review(
+        _trivial_scan(), _surfaces(), _findings(), [],
+        provider="openai", backend="auto", codex_runner=runner,
+    )
+    assert result.backend == "cli"
+
+
 def test_auto_backend_raises_when_no_creds_and_no_cli(monkeypatch) -> None:
     monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
     monkeypatch.delenv("ANTHROPIC_AUTH_TOKEN", raising=False)