@cantinasecurity/apex-cli 0.1.0

package/dist/commands.js

@@ -0,0 +1,629 @@
+import { getFlagString, isJsonMode, isNonInteractive } from "./args.js";
+import { logout } from "./auth.js";
+import { ApiError } from "./api-client.js";
+import { openInBrowser } from "./browser.js";
+import { loadConfig, saveConfig } from "./config.js";
+import { fetchScanExport, fetchScanFindings, resolveScanSelection } from "./findings.js";
+import { prepareExplicitScanSources, supportsLegacyRemoteFlow, } from "./local-source-scan.js";
+import { logLine, printJson, withLoadingIndicator } from "./output.js";
+import { confirm } from "./prompt.js";
+import { cancelScan, fetchWorkspaceScans, findMostRelevantActiveScan, getScanDisplayLabel, getScanDisplayId, getTrackedScanId, isActiveScanStatus, matchesScanId, selectDefaultScanToCancel, } from "./scan.js";
+import { chooseCompany, createWorkspaceBinding, ensureAuthenticated, resolveWorkspaceSelection, resolveWorkspaceSelectionLegacy, resolveWorkspaceAllowingMissingConnections, selectWorkspaceTarget, } from "./session.js";
+import { createWorkspaceBindingFromSummary, fetchCompanyCredits, fetchCompanyWorkspaces, findWorkspaceByRef, } from "./workspaces.js";
+import { loadWorkspaceBinding, saveWorkspaceBinding } from "./workspace-binding.js";
+import { commandSetup as runCliSetup } from "./setup.js";
+import { commandUpdate as runCliUpdate } from "./update.js";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+const WORKSPACE_USE_PATTERN = "<workspace-name|workspace-prefix|workspace-id>";
+const WORKSPACE_BINDING_GUIDANCE = "Run `apex workspaces` to list workspace names, prefixes, and IDs, then bind one with `apex workspace use \"<workspace name>\"`, or run `apex scan` to create or resolve one automatically.";
+const WORKSPACE_SELECTION_GUIDANCE = "Run `apex workspaces` to list available workspace names, prefixes, and IDs, then retry `apex workspace use \"<workspace name>\"`.";
+async function saveCompanyDefault(companyId) {
+    const config = await loadConfig();
+    if (config.defaultCompanyId !== companyId) {
+        await saveConfig({
+            ...config,
+            defaultCompanyId: companyId,
+        });
+    }
+}
+function formatCommandArgument(value) {
+    return /\s/.test(value) ? `"${value}"` : value;
+}
+function getSuggestedWorkspaceRef(workspace) {
+    return workspace.prefix?.trim().length ? workspace.prefix : workspace.name;
+}
+function formatWorkspaceUseCommand(workspace) {
+    return `apex workspace use ${formatCommandArgument(getSuggestedWorkspaceRef(workspace))}`;
+}
+async function requireWorkspaceBinding(cwd) {
+    const binding = await loadWorkspaceBinding(cwd);
+    if (binding) {
+        return binding;
+    }
+    throw new Error(`This directory is not bound to an Apex workspace yet. ${WORKSPACE_BINDING_GUIDANCE}`);
+}
+function canPromptForConfirmation(flags) {
+    return !isNonInteractive(flags) && process.stdin.isTTY && process.stdout.isTTY;
+}
+async function findFallbackActiveScan(client, binding) {
+    if (!binding?.lastScanId) {
+        return null;
+    }
+    try {
+        const progress = await client.request(`/api/cli/v1/scans/${encodeURIComponent(binding.lastScanId)}/progress`);
+        if (!isActiveScanStatus(progress.progress?.status)) {
+            return null;
+        }
+        return {
+            scanId: progress.scanId,
+            kernelScanId: progress.kernelScanId,
+            apexScanId: binding.lastScanId,
+            bedrockScanId: null,
+            displayName: null,
+            sequenceNumber: null,
+            status: progress.progress?.status ?? "unknown",
+            mode: null,
+            scanUrl: binding.lastScanUrl ?? null,
+            createdAt: null,
+            startedAt: progress.progress?.startedAt ?? null,
+            updatedAt: null,
+            finishedAt: null,
+        };
+    }
+    catch (error) {
+        if (error instanceof ApiError && error.status === 404) {
+            return null;
+        }
+        throw error;
+    }
+}
+async function findActiveWorkspaceScan(client, workspaceId, binding) {
+    try {
+        const scans = await fetchWorkspaceScans(client, workspaceId);
+        return findMostRelevantActiveScan(scans);
+    }
+    catch (error) {
+        if (error instanceof ApiError && [404, 405].includes(error.status)) {
+            return findFallbackActiveScan(client, binding);
+        }
+        throw error;
+    }
+}
+async function ensureScanRestartConfirmed(flags, activeScan) {
+    if (!activeScan) {
+        return false;
+    }
+    if (flags.force === true) {
+        return true;
+    }
+    const scanId = getScanDisplayId(activeScan);
+    if (!canPromptForConfirmation(flags)) {
+        throw new Error(`A scan is already ${activeScan.status} for this workspace (${scanId}). Re-run with --force to start another scan.`);
+    }
+    const approved = await confirm(`Scan ${scanId} is already ${activeScan.status} for this workspace. Start another scan anyway?`, false);
+    if (!approved) {
+        throw new Error("Scan start cancelled.");
+    }
+    return true;
+}
+export async function initializeInteractiveSession(client, cwd, flags) {
+    const me = await ensureAuthenticated(client, flags);
+    const selection = await selectWorkspaceTarget(cwd, me, flags);
+    return withLoadingIndicator("Setting up Apex for this directory...", flags, async () => {
+        const result = await resolveWorkspaceSelection(client, selection);
+        const binding = createWorkspaceBinding(result, result.binding);
+        await saveWorkspaceBinding(cwd, binding);
+        await saveCompanyDefault(result.company.id);
+        return {
+            baseUrl: await client.getBaseUrl(),
+            me,
+            company: result.company,
+            workspaceName: result.workspaceName,
+            sources: result.sources,
+            binding,
+        };
+    });
+}
+export async function commandLogin(client, flags) {
+    const me = await ensureAuthenticated(client, flags);
+    if (isJsonMode(flags)) {
+        printJson(me);
+        return me;
+    }
+    logLine(`Authenticated as ${me.user.username ?? me.user.id}`, flags);
+    return me;
+}
+export async function commandCredits(client, cwd, flags) {
+    const me = await ensureAuthenticated(client, flags);
+    const binding = await loadWorkspaceBinding(cwd);
+    const company = await chooseCompany(me, flags, binding);
+    const payload = await withLoadingIndicator("Loading company credits...", flags, () => fetchCompanyCredits(client, company.id));
+    if (isJsonMode(flags)) {
+        printJson(payload);
+        return payload;
+    }
+    logLine(`Company: ${payload.company.handle ?? payload.company.id}`, flags);
+    logLine(`Credits: ${payload.scanBalance.remaining} remaining (${payload.scanBalance.purchased} purchased, ${payload.scanBalance.used} used)`, flags);
+    logLine(`Scans enabled: ${payload.scansEnabled ? "yes" : "no"}`, flags);
+    return payload;
+}
+export async function commandLogout(client, flags) {
+    await logout(client);
+    if (!isJsonMode(flags)) {
+        logLine("Logged out", flags);
+    }
+}
+export async function commandUpdate(flags) {
+    return runCliUpdate(flags);
+}
+export async function commandSetup(cwd, flags, target) {
+    return runCliSetup(cwd, flags, target);
+}
+export async function commandDoctor(client, cwd, flags) {
+    const me = await ensureAuthenticated(client, flags);
+    try {
+        const result = await withLoadingIndicator("Inspecting this directory and checking Apex setup...", flags, () => resolveWorkspaceAllowingMissingConnections(client, cwd, me, flags));
+        const localSnapshotCount = result.resolve.plannedSources.filter((source) => source.sourceKind === "local_archive").length;
+        const payload = {
+            authenticatedAs: me.user.username ?? me.user.id,
+            company: result.company,
+            workspaceName: result.workspaceName,
+            binding: result.binding,
+            sources: result.sources,
+            plannedSources: result.resolve.plannedSources,
+        };
+        if (isJsonMode(flags)) {
+            printJson(payload);
+            return payload;
+        }
+        logLine(`Authenticated as ${payload.authenticatedAs}`, flags);
+        logLine(`Company: ${payload.company.handle ?? payload.company.id}`, flags);
+        logLine(`Workspace name Apex will use: ${payload.workspaceName}`, flags);
+        logLine(`Sources detected locally: ${payload.sources.length}`, flags);
+        logLine(`Plan: ${payload.plannedSources.length - localSnapshotCount} remote, ${localSnapshotCount} local snapshot`, flags);
+        return payload;
+    }
+    catch (error) {
+        if (isJsonMode(flags)) {
+            const payload = {
+                ok: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+            printJson(payload);
+            if (error instanceof Error) {
+                error.reported = true;
+            }
+            throw error;
+        }
+        throw error;
+    }
+}
+export async function commandStatus(client, cwd, flags) {
+    await ensureAuthenticated(client, flags);
+    const binding = await requireWorkspaceBinding(cwd);
+    if (!binding.lastScanId) {
+        throw new Error("No scan has been started from this directory yet. Run `apex scan` first.");
+    }
+    const progress = await withLoadingIndicator("Loading scan status...", flags, () => client.request(`/api/cli/v1/scans/${binding.lastScanId}/progress`));
+    if (isJsonMode(flags)) {
+        printJson({ binding, progress });
+        return { binding, progress };
+    }
+    logLine(`Workspace: ${binding.workspaceName}`, flags);
+    logLine(`Scan: ${binding.lastScanId}`, flags);
+    logLine(`Status: ${progress.progress?.status ?? "unknown"}`, flags);
+    if (typeof progress.progress?.progressPct === "number") {
+        logLine(`Progress: ${progress.progress.progressPct}%`, flags);
+    }
+    if (binding.lastScanUrl) {
+        logLine(`View: ${binding.lastScanUrl}`, flags);
+    }
+    return { binding, progress };
+}
+export async function commandConnect(client, cwd, flags, provider) {
+    const me = await ensureAuthenticated(client, flags);
+    const binding = await loadWorkspaceBinding(cwd);
+    const company = await chooseCompany(me, flags, binding);
+    const route = provider === "github"
+        ? `/api/cli/v1/providers/github/connect?companyId=${encodeURIComponent(company.id)}`
+        : `/api/cli/v1/providers/gitlab/connect?companyId=${encodeURIComponent(company.id)}`;
+    const response = await withLoadingIndicator(`Preparing ${provider} connection link...`, flags, () => client.request(route));
+    if (!isJsonMode(flags)) {
+        logLine(`Connection URL for ${provider}: ${response.url}`, flags);
+    }
+    if (flags["no-open"] !== true) {
+        await openInBrowser(response.url);
+    }
+    if (isJsonMode(flags)) {
+        printJson({ provider, company, url: response.url });
+    }
+    return { provider, company, url: response.url };
+}
+export async function commandScan(client, cwd, flags) {
+    const me = await ensureAuthenticated(client, flags);
+    const selection = await selectWorkspaceTarget(cwd, me, flags);
+    const result = await withLoadingIndicator("Resolving workspace and scan plan...", flags, () => resolveWorkspaceSelection(client, selection));
+    const requestedMode = getFlagString(flags, "mode") === "ultra" ? "ultra" : "standard";
+    if (!result.resolve.workspaceId) {
+        throw new Error("Workspace resolution did not return a workspaceId.");
+    }
+    const resolvedWorkspaceId = result.resolve.workspaceId;
+    const activeScan = await withLoadingIndicator("Checking for existing scans...", flags, () => findActiveWorkspaceScan(client, resolvedWorkspaceId, result.binding));
+    const forceRestart = await ensureScanRestartConfirmed(flags, activeScan);
+    let workspaceId = resolvedWorkspaceId;
+    let scan;
+    if (requestedMode === "ultra") {
+        if (!supportsLegacyRemoteFlow(result.resolve.plannedSources)) {
+            throw new Error("Ultra scans currently require provider-backed GitHub or GitLab repositories without local snapshot fallbacks.");
+        }
+        const legacyResolve = await withLoadingIndicator("Preparing ultra scan...", flags, () => resolveWorkspaceSelectionLegacy(client, selection, resolvedWorkspaceId));
+        if (!legacyResolve.workspaceId) {
+            throw new Error("Workspace resolution did not return a workspaceId.");
+        }
+        workspaceId = legacyResolve.workspaceId;
+        scan = await withLoadingIndicator("Starting ultra scan...", flags, () => client.request(`/api/cli/v1/local-workspaces/${encodeURIComponent(workspaceId)}/scan`, {
+            method: "POST",
+            json: {
+                mode: requestedMode,
+                force: forceRestart || flags.force === true,
+            },
+        }));
+    }
+    else {
+        scan = await withLoadingIndicator("Starting scan...", flags, async () => {
+            const scanSources = await prepareExplicitScanSources({
+                client,
+                workspaceId: resolvedWorkspaceId,
+                plannedSources: result.resolve.plannedSources,
+                detectedSources: result.sources,
+            });
+            return client.request(`/api/cli/v2/local-workspaces/${encodeURIComponent(resolvedWorkspaceId)}/scan`, {
+                method: "POST",
+                json: {
+                    mode: requestedMode,
+                    force: forceRestart || flags.force === true,
+                    scanSources,
+                },
+            });
+        });
+    }
+    const binding = {
+        ...createWorkspaceBinding(result, result.binding),
+        workspaceId,
+        lastScanId: getTrackedScanId(scan),
+        lastScanUrl: scan.scanUrl ?? null,
+    };
+    await saveWorkspaceBinding(cwd, binding);
+    await saveCompanyDefault(result.company.id);
+    const localSnapshotCount = result.resolve.plannedSources.filter((source) => source.sourceKind === "local_archive").length;
+    const payload = {
+        company: result.company,
+        workspaceId,
+        workspaceName: result.workspaceName,
+        sources: result.sources,
+        plannedSources: result.resolve.plannedSources,
+        scan: {
+            ...scan,
+            apexScanId: scan.apexScanId ?? scan.bedrockScanId ?? null,
+        },
+        binding,
+    };
+    if (isJsonMode(flags)) {
+        printJson(payload);
+        return payload;
+    }
+    logLine(`Authenticated as ${me.user.username ?? me.user.id}`, flags);
+    logLine(`Company: ${result.company.handle ?? result.company.id}`, flags);
+    logLine(`Workspace: ${result.workspaceName}`, flags);
+    logLine(`Sources selected: ${result.sources.length}`, flags);
+    logLine(`Plan: ${result.resolve.plannedSources.length - localSnapshotCount} remote, ${localSnapshotCount} local snapshot`, flags);
+    logLine(`Scan: ${scan.status}${getTrackedScanId(scan) ? ` (${getTrackedScanId(scan)})` : ""}`, flags);
+    if (scan.scanUrl) {
+        logLine(`View: ${scan.scanUrl}`, flags);
+    }
+    logLine("Next: run `apex status` to watch progress, then `apex findings` when the scan finishes.", flags);
+    return payload;
+}
+export async function commandWorkspaces(client, cwd, flags) {
+    const me = await ensureAuthenticated(client, flags);
+    const binding = await loadWorkspaceBinding(cwd);
+    const company = await chooseCompany(me, flags, binding);
+    const response = await withLoadingIndicator("Loading workspaces...", flags, () => fetchCompanyWorkspaces(client, company.id));
+    const payload = {
+        ...response,
+        currentWorkspaceId: binding?.workspaceId ?? null,
+    };
+    if (isJsonMode(flags)) {
+        printJson(payload);
+        return payload;
+    }
+    logLine(`Company: ${response.company.handle ?? response.company.id}`, flags);
+    logLine("Bind this directory with `apex workspace use <workspace-name|workspace-prefix|workspace-id>`.", flags);
+    if (response.workspaces.length === 0) {
+        logLine("Workspaces: none", flags);
+        return payload;
+    }
+    for (const [index, workspace] of response.workspaces.entries()) {
+        const currentMarker = binding?.workspaceId === workspace.workspaceId ? " [current]" : "";
+        logLine(`Workspace: ${workspace.name}${currentMarker}`, flags);
+        if (workspace.prefix) {
+            logLine(`Prefix: ${workspace.prefix}`, flags);
+        }
+        logLine(`ID: ${workspace.workspaceId}`, flags);
+        logLine(`Use here: ${formatWorkspaceUseCommand(workspace)}`, flags);
+        logLine(`Stats: ${workspace.scanCount} scans, ${workspace.findingsCount} findings`, flags);
+        if (workspace.latestScan) {
+            logLine(`Latest: ${workspace.latestScan.displayName} (${workspace.latestScan.status}, ${workspace.latestScan.createdAt})`, flags);
+        }
+        if (index < response.workspaces.length - 1) {
+            logLine("", flags);
+        }
+    }
+    return payload;
+}
+export async function commandWorkspace(cwd, flags) {
+    const binding = await loadWorkspaceBinding(cwd);
+    const payload = { binding };
+    if (isJsonMode(flags)) {
+        printJson(payload);
+        return payload;
+    }
+    if (!binding) {
+        logLine("This directory is not bound to an Apex workspace yet.", flags);
+        logLine(WORKSPACE_BINDING_GUIDANCE, flags);
+        return payload;
+    }
+    logLine(`This directory is bound to workspace: ${binding.workspaceName}`, flags);
+    logLine(`Workspace ID: ${binding.workspaceId}`, flags);
+    logLine(`Company ID: ${binding.companyId}`, flags);
+    if (binding.lastScanId) {
+        logLine(`Last scan: ${binding.lastScanId}`, flags);
+    }
+    return payload;
+}
+export async function commandWorkspaceUse(client, cwd, flags, workspaceRef) {
+    const trimmedRef = workspaceRef.trim();
+    if (!trimmedRef) {
+        throw new Error(`Usage: apex workspace use ${WORKSPACE_USE_PATTERN}`);
+    }
+    const me = await ensureAuthenticated(client, flags);
+    const currentBinding = await loadWorkspaceBinding(cwd);
+    const company = await chooseCompany(me, flags, currentBinding);
+    const response = await withLoadingIndicator("Loading workspaces...", flags, () => fetchCompanyWorkspaces(client, company.id));
+    const workspace = findWorkspaceByRef(response.workspaces, trimmedRef);
+    if (!workspace) {
+        throw new Error(`Could not find a workspace matching "${trimmedRef}". ${WORKSPACE_SELECTION_GUIDANCE}`);
+    }
+    const binding = createWorkspaceBindingFromSummary({
+        companyId: company.id,
+        workspace,
+        currentBinding,
+    });
+    await saveWorkspaceBinding(cwd, binding);
+    await saveCompanyDefault(company.id);
+    const payload = {
+        company,
+        workspace,
+        binding,
+    };
+    if (isJsonMode(flags)) {
+        printJson(payload);
+        return payload;
+    }
+    logLine(`Company: ${company.handle ?? company.id}`, flags);
+    logLine(`Bound this directory to workspace: ${workspace.name}`, flags);
+    if (workspace.prefix) {
+        logLine(`Workspace prefix: ${workspace.prefix}`, flags);
+    }
+    logLine(`Workspace ID: ${workspace.workspaceId}`, flags);
+    logLine("Next: run `apex scan` to start a scan in this workspace.", flags);
+    return payload;
+}
+export async function commandScans(client, cwd, flags) {
+    await ensureAuthenticated(client, flags);
+    const binding = await requireWorkspaceBinding(cwd);
+    const scans = await withLoadingIndicator("Loading scans...", flags, async () => {
+        try {
+            return await fetchWorkspaceScans(client, binding.workspaceId);
+        }
+        catch (error) {
+            if (error instanceof ApiError &&
+                [404, 405].includes(error.status) &&
+                binding.lastScanId) {
+                const fallback = await findFallbackActiveScan(client, binding);
+                return fallback ? [fallback] : [];
+            }
+            throw error;
+        }
+    });
+    const payload = {
+        binding,
+        scans,
+    };
+    if (isJsonMode(flags)) {
+        printJson(payload);
+        return payload;
+    }
+    logLine(`Workspace: ${binding.workspaceName}`, flags);
+    if (scans.length === 0) {
+        logLine("Scans: none yet. Run `apex scan` to start one.", flags);
+        return payload;
+    }
+    for (const scan of scans) {
+        const timestamp = scan.startedAt ?? scan.createdAt ?? scan.finishedAt ?? null;
+        const modeSuffix = scan.mode ? `, ${scan.mode}` : "";
+        const timeSuffix = timestamp ? `, ${timestamp}` : "";
+        logLine(`Scan: ${getScanDisplayLabel(scan)} (${scan.status}${modeSuffix}${timeSuffix})`, flags);
+        if (scan.scanUrl) {
+            logLine(`View: ${scan.scanUrl}`, flags);
+        }
+    }
+    return payload;
+}
+export async function commandCancelScan(client, cwd, flags, requestedScanId) {
+    await ensureAuthenticated(client, flags);
+    const binding = await requireWorkspaceBinding(cwd);
+    let scanId = requestedScanId?.trim() || null;
+    if (!scanId) {
+        const scans = await withLoadingIndicator("Finding a scan to cancel...", flags, async () => {
+            try {
+                return await fetchWorkspaceScans(client, binding.workspaceId);
+            }
+            catch (error) {
+                if (error instanceof ApiError &&
+                    [404, 405].includes(error.status) &&
+                    binding.lastScanId) {
+                    scanId = binding.lastScanId;
+                    return [];
+                }
+                throw error;
+            }
+        });
+        if (!scanId && scans.length === 0) {
+            throw new Error("No scans are available to cancel for this workspace.");
+        }
+        if (!scanId) {
+            const selected = selectDefaultScanToCancel(scans, binding.lastScanId ?? null);
+            if (!selected) {
+                throw new Error("Multiple active scans are running. Run `apex scans` to list scan IDs, then re-run `apex cancel-scan <scan-id>`.");
+            }
+            scanId = getScanDisplayId(selected);
+        }
+    }
+    if (!scanId) {
+        throw new Error("No scans are available to cancel for this workspace.");
+    }
+    const targetScanId = scanId;
+    const scan = await withLoadingIndicator("Cancelling scan...", flags, () => cancelScan(client, targetScanId));
+    const nextBinding = binding.lastScanId && matchesScanId(scan, binding.lastScanId)
+        ? {
+            ...binding,
+            lastScanUrl: scan.scanUrl ?? binding.lastScanUrl ?? null,
+        }
+        : binding;
+    await saveWorkspaceBinding(cwd, nextBinding);
+    const payload = {
+        binding: nextBinding,
+        scan,
+    };
+    if (isJsonMode(flags)) {
+        printJson(payload);
+        return payload;
+    }
+    logLine(`Workspace: ${nextBinding.workspaceName}`, flags);
+    logLine(`Scan: ${getScanDisplayId(scan)}`, flags);
+    logLine(`Status: ${scan.status}`, flags);
+    if (scan.scanUrl) {
+        logLine(`View: ${scan.scanUrl}`, flags);
+    }
+    return payload;
+}
+export async function commandFindings(client, cwd, flags) {
+    await ensureAuthenticated(client, flags);
+    const binding = await requireWorkspaceBinding(cwd);
+    const { scan, response } = await withLoadingIndicator("Loading findings...", flags, async () => {
+        const scan = await resolveScanSelection({
+            client,
+            binding,
+            requestedScanId: getFlagString(flags, "scan"),
+        });
+        const response = await fetchScanFindings(client, scan.scanId, getFlagString(flags, "limit"));
+        return { scan, response };
+    });
+    const nextBinding = {
+        ...binding,
+        lastScanId: getScanDisplayId(scan),
+        lastScanUrl: response.scan.scanUrl ?? binding.lastScanUrl ?? null,
+    };
+    await saveWorkspaceBinding(cwd, nextBinding);
+    const payload = {
+        ...response,
+        binding: nextBinding,
+    };
+    if (isJsonMode(flags)) {
+        printJson(payload);
+        return payload;
+    }
+    logLine(`Workspace: ${response.workspace.name}`, flags);
+    logLine(`Scan: ${response.scan.displayName} (${response.scan.status})`, flags);
+    if (response.findings.length === 0) {
+        logLine("Findings: none for this scan.", flags);
+        return payload;
+    }
+    for (const finding of response.findings) {
+        const identifier = finding.findingIdentifier ?? finding.id;
+        logLine(`${finding.severity.toUpperCase()} ${identifier} ${finding.title} (${finding.status}, ${finding.confidence})`, flags);
+        if (finding.findingUrl) {
+            logLine(`View: ${finding.findingUrl}`, flags);
+        }
+    }
+    return payload;
+}
+export async function commandExportFindings(client, cwd, flags) {
+    await ensureAuthenticated(client, flags);
+    const binding = await requireWorkspaceBinding(cwd);
+    const format = getFlagString(flags, "format") ?? "markdown";
+    const { scan, response, outputPath } = await withLoadingIndicator("Exporting findings...", flags, async () => {
+        const scan = await resolveScanSelection({
+            client,
+            binding,
+            requestedScanId: getFlagString(flags, "scan"),
+        });
+        const response = await fetchScanExport(client, scan.scanId, format);
+        const outputPath = path.resolve(cwd, getFlagString(flags, "output") ?? response.fileName);
+        await mkdir(path.dirname(outputPath), { recursive: true });
+        const fileContents = typeof response.content === "string"
+            ? response.content.endsWith("\n")
+                ? response.content
+                : `${response.content}\n`
+            : `${JSON.stringify(response.content, null, 2)}\n`;
+        await writeFile(outputPath, fileContents, "utf8");
+        return { scan, response, outputPath };
+    });
+    const nextBinding = {
+        ...binding,
+        lastScanId: getScanDisplayId(scan),
+        lastScanUrl: response.scan.scanUrl ?? binding.lastScanUrl ?? null,
+    };
+    await saveWorkspaceBinding(cwd, nextBinding);
+    const payload = {
+        ...response,
+        binding: nextBinding,
+        outputPath,
+    };
+    if (isJsonMode(flags)) {
+        printJson({
+            format: payload.format,
+            fileName: payload.fileName,
+            contentType: payload.contentType,
+            findingCount: payload.findingCount,
+            workspace: payload.workspace,
+            scan: payload.scan,
+            outputPath: payload.outputPath,
+        });
+        return payload;
+    }
+    logLine(`Workspace: ${response.workspace.name}`, flags);
+    logLine(`Scan: ${response.scan.displayName}`, flags);
+    logLine(`Export: ${response.format} (${response.findingCount} findings)`, flags);
+    logLine(`Saved: ${outputPath}`, flags);
+    return payload;
+}
+export async function openCurrentApexView(client, cwd, flags) {
+    const binding = await loadWorkspaceBinding(cwd);
+    const url = binding?.lastScanUrl ?? (await client.getBaseUrl());
+    if (!isJsonMode(flags)) {
+        logLine(`Open: ${url}`, flags);
+    }
+    if (flags["no-open"] !== true) {
+        await openInBrowser(url);
+    }
+    if (isJsonMode(flags)) {
+        printJson({
+            url,
+            source: binding?.lastScanUrl ? "last_scan" : "home",
+        });
+    }
+    return url;
+}

package/dist/config.js

@@ -0,0 +1,54 @@
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+const CONFIG_DIR = path.join(os.homedir(), ".config", "apex");
+const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
+const CREDENTIALS_PATH = path.join(CONFIG_DIR, "credentials.json");
+const DEFAULT_BASE_URL = process.env.APEX_BASE_URL ?? "https://ai.cantina.xyz/";
+async function ensureConfigDir() {
+    await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+}
+async function readJsonFile(filePath) {
+    try {
+        const contents = await readFile(filePath, "utf8");
+        return JSON.parse(contents);
+    }
+    catch {
+        return null;
+    }
+}
+async function writeJsonFile(filePath, value, mode) {
+    await ensureConfigDir();
+    await writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`, {
+        encoding: "utf8",
+        mode,
+    });
+    await chmod(filePath, mode);
+}
+export async function loadConfig() {
+    const config = await readJsonFile(CONFIG_PATH);
+    if (!config?.baseUrl) {
+        return {
+            version: 1,
+            baseUrl: DEFAULT_BASE_URL,
+            defaultCompanyId: null,
+        };
+    }
+    return {
+        version: 1,
+        baseUrl: config.baseUrl,
+        defaultCompanyId: config.defaultCompanyId ?? null,
+    };
+}
+export async function saveConfig(config) {
+    await writeJsonFile(CONFIG_PATH, config, 0o600);
+}
+export async function loadCredentials() {
+    return readJsonFile(CREDENTIALS_PATH);
+}
+export async function saveCredentials(credentials) {
+    await writeJsonFile(CREDENTIALS_PATH, credentials, 0o600);
+}
+export async function clearCredentials() {
+    await rm(CREDENTIALS_PATH, { force: true });
+}