@cantinasecurity/apex-cli 0.1.15 → 0.1.16

package/.claude/skills/apex-cli/SKILL.md

@@ -33,7 +33,7 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 
 - Prefer scripted commands over the interactive shell.
 - Service-key management has no MCP tools. Never ask a user to paste a service key into a prompt, and never place one in an MCP call, tool result, source file, or log.
-- If a user explicitly needs a new service key, tell them to run `apex login` if needed, then run `apex service-key create --company <company> --name <name> --scope <scope[,scope]>` directly in their own terminal. Use only the required scopes: `scans:create` to trigger, `scans:read` to poll status, and `findings:read` to retrieve findings. A P1-only adapter can use `--scope scans:read,findings:read`; omitting `--scope` grants all three. Service-key commands never initiate login; the secret is shown once. `list` and `revoke` also require an explicit `--company`.
+- If a user explicitly needs a new service key, tell them to run `apex login` if needed, then run `apex service-key create --name <name> --scope <scope[,scope]>` directly in their own terminal. Use only the required scopes: `scans:create` to trigger, `scans:read` to poll status, and `findings:read` to retrieve findings. A P1-only adapter can use `--scope scans:read,findings:read`; omitting `--scope` grants all three. The CLI automatically selects the company when only one is available and prompts when there are several; use `--company <id-or-handle>` to skip that prompt or resolve a non-interactive command. Service-key commands never initiate login, and the secret is shown once.
 - For a headless HTTP adapter, read the service key from a secret-backed environment variable, send it as a bearer token to `/api/apex/v1`, and redact it from errors and logs. Do not shell out to `apex` or launch MCP from the adapter.
 - Hosted API v1 requires the GitHub repository to be linked to an active Apex workspace. It never creates or mutates workspaces; use optional `workspaceId` to disambiguate matches and treat zero or ambiguous matches as HTTP `409` setup errors.
 - Hosted scan triggers require `Idempotency-Key`. Reuse one stable key only for an identical transport/timeout/5xx retry. After correcting a definitive 4xx response, or for any new intended scan, use a new key.

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Cantina agent plugins for security review workflows.",
-    "version": "0.1.15"
+    "version": "0.1.16"
   },
   "plugins": [
     {
@@ -14,10 +14,10 @@
       "source": {
         "source": "npm",
         "package": "@cantinasecurity/apex-cli",
-        "version": "0.1.15"
+        "version": "0.1.16"
       },
       "description": "Run Apex security scans and review findings from Claude Code.",
-      "version": "0.1.15",
+      "version": "0.1.16",
       "author": {
         "name": "Cantina",
         "email": "support@cantina.xyz"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Run Apex security scans and review findings from Claude Code.",
   "author": {
     "name": "Cantina",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Run Apex security scans and review findings from Codex.",
   "author": {
     "name": "Cantina",

package/.mcp.claude.json

@@ -5,7 +5,7 @@
       "args": [
         "-y",
         "-p",
-        "@cantinasecurity/apex-cli@0.1.15",
+        "@cantinasecurity/apex-cli@0.1.16",
         "apex-mcp"
       ],
       "env": {

package/.mcp.codex.json

@@ -4,7 +4,7 @@
     "args": [
       "-y",
       "-p",
-      "@cantinasecurity/apex-cli@0.1.15",
+      "@cantinasecurity/apex-cli@0.1.16",
       "apex-mcp"
     ],
     "env": {

package/MARKETPLACE.md

@@ -13,7 +13,7 @@ This package is prepared as both a Claude Code plugin and a Codex plugin. The pu
 The plugin MCP configs launch the pinned npm CLI package with:
 
 ```bash
-npx -y -p @cantinasecurity/apex-cli@0.1.15 apex-mcp
+npx -y -p @cantinasecurity/apex-cli@0.1.16 apex-mcp
 ```
 
 That keeps marketplace installs independent of a user's global `apex` install.

package/README.md

@@ -151,9 +151,9 @@ Supported shell commands:
 - `apex doctor`
 - `apex login`
 - `apex logout`
-- `apex service-key create --company <id-or-handle> --name <name> [--scope <scope[,scope]>] [--expires-at <ISO-8601>] [--json]`
-- `apex service-key list --company <id-or-handle> [--json]`
-- `apex service-key revoke <key-id> --company <id-or-handle> [--json]`
+- `apex service-key create --name <name> [--company <id-or-handle>] [--scope <scope[,scope]>] [--expires-at <ISO-8601>] [--json]`
+- `apex service-key list [--company <id-or-handle>] [--json]`
+- `apex service-key revoke <key-id> [--company <id-or-handle>] [--json]`
 - `apex setup [all|codex|claude|copilot]`
 - `apex telemetry [status|enable|disable]`
 - `apex update`
@@ -175,12 +175,13 @@ An organization manager can create a service key with an existing Apex device-lo
 
 ```bash
 apex service-key create \
-  --company acme \
   --name internal-audit-hub \
   --scope scans:create,scans:read,findings:read \
   --expires-at 2027-01-01T00:00:00Z
 ```
 
+The CLI automatically uses your company when only one is available. If you belong to multiple companies, it prompts you to choose one. Pass `--company <id-or-handle>` to skip that prompt, or when a non-interactive or `--json` command cannot prompt.
+
 The secret is returned only by `create` and cannot be retrieved later. Store it directly in a secret manager and do not put it in source control, prompts, chat messages, or logs. `--json` also includes the shown-once secret so it can be captured programmatically; handle that output as a credential.
 
 Service keys are organization-level credentials. Grant only the scopes the integration needs: `scans:create` triggers scans, `scans:read` polls status, and `findings:read` retrieves findings. Omit `--scope` to grant all three scopes. For a P1-only adapter that reads manually started scans, create a read-only key with `--scope scans:read,findings:read`.
@@ -190,8 +191,8 @@ A key with `findings:read` can retrieve unpublished draft findings for scans in
 List metadata or revoke a key without exposing its secret:
 
 ```bash
-apex service-key list --company acme
-apex service-key revoke <key-id> --company acme
+apex service-key list
+apex service-key revoke <key-id>
 ```
 
 Service-key management is intentionally available only through the scripted CLI. It is not exposed as an MCP tool or interactive-shell command, which keeps raw secrets out of model tool results and transcripts. The CLI requires an existing device-login bearer session, never initiates login from these commands, and never stores a created service key locally.
@@ -424,7 +425,7 @@ Telemetry event posts do not include bearer tokens. The telemetry endpoint is `P
     {
       "schemaVersion": 1,
       "event": "apex.invocation.completed",
-      "cliVersion": "0.1.15",
+      "cliVersion": "0.1.16",
       "invocation": {
         "surface": "mcp",
         "command": "apex-scan",
@@ -455,7 +456,7 @@ The npm package also includes marketplace-ready plugin artifacts:
 - `.claude-plugin/plugin.json` and `.mcp.claude.json` for Claude Code plugin installs
 - `.claude-plugin/marketplace.json` for a Claude marketplace entry backed by the public npm package
 
-These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.15 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
+These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.16 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
 
 The repository also includes `.agents/plugins/marketplace.json` for local Codex marketplace testing from a checkout.
 

package/dist/apex.js

@@ -52,7 +52,7 @@ async function dispatch(parsed) {
                 await commandServiceKeyRevoke(client, parsed.flags, parsed.args[0] ?? "");
                 return;
             }
-            throw new Error("Usage: apex service-key <create|list|revoke> [key-id] --company <id-or-handle>");
+            throw new Error("Usage: apex service-key <create|list|revoke> [key-id] [--company <id-or-handle>]");
         case "update":
             await commandUpdate(parsed.flags);
             return;

package/dist/commands.js

@@ -42,9 +42,10 @@ const FIX_REVIEW_TARGETS = [
     "pull_request",
     "repository_current",
 ];
-const SERVICE_KEY_CREATE_USAGE = "Usage: apex service-key create --company <id-or-handle> --name <name> [--scope <scope[,scope]>] [--expires-at <ISO-8601>] [--json]";
-const SERVICE_KEY_LIST_USAGE = "Usage: apex service-key list --company <id-or-handle> [--json]";
-const SERVICE_KEY_REVOKE_USAGE = "Usage: apex service-key revoke <key-id> --company <id-or-handle> [--json]";
+const SERVICE_KEY_CREATE_USAGE = "Usage: apex service-key create --name <name> [--company <id-or-handle>] [--scope <scope[,scope]>] [--expires-at <ISO-8601>] [--json]";
+const SERVICE_KEY_LIST_USAGE = "Usage: apex service-key list [--company <id-or-handle>] [--json]";
+const SERVICE_KEY_REVOKE_USAGE = "Usage: apex service-key revoke <key-id> [--company <id-or-handle>] [--json]";
+const SERVICE_KEY_COMPANY_PROMPT = "Select the Apex company whose service keys you want to manage:";
 const SERVICE_KEY_EXPIRATION_SCHEMA = z.string().datetime({ offset: true });
 const SERVICE_KEY_NAME_CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
 const SERVICE_KEY_NAME_SCHEMA = z
@@ -65,11 +66,6 @@ async function saveCompanyDefault(companyId) {
 function formatCommandArgument(value) {
     return /\s/.test(value) ? `"${value}"` : value;
 }
-function requireExplicitServiceKeyCompany(flags, usage) {
-    if (!getFlagString(flags, "company")) {
-        throw new Error(`${usage}\nService-key commands require an explicit --company.`);
-    }
-}
 async function requireExistingServiceKeySession(client) {
     const me = await getMe(client);
     if (!me) {
@@ -588,12 +584,14 @@ export async function commandLogout(client, flags) {
     }
 }
 export async function commandServiceKeyCreate(client, flags) {
-    requireExplicitServiceKeyCompany(flags, SERVICE_KEY_CREATE_USAGE);
     const name = normalizeServiceKeyName(getFlagString(flags, "name"));
     const scopes = normalizeServiceKeyScopes(flags);
     const expiresAt = normalizeServiceKeyExpiration(getFlagString(flags, "expires-at"));
     const me = await requireExistingServiceKeySession(client);
-    const company = await chooseCompany(me, flags, null);
+    const company = await chooseCompany(me, flags, null, {
+        prompt: SERVICE_KEY_COMPANY_PROMPT,
+        useSavedDefault: false,
+    });
     const response = await withLoadingIndicator("Creating service key...", flags, () => createServiceApiKey(client, company.id, {
         name,
         expiresAt,
@@ -623,9 +621,11 @@ export async function commandServiceKeyCreate(client, flags) {
     return payload;
 }
 export async function commandServiceKeyList(client, flags) {
-    requireExplicitServiceKeyCompany(flags, SERVICE_KEY_LIST_USAGE);
     const me = await requireExistingServiceKeySession(client);
-    const company = await chooseCompany(me, flags, null);
+    const company = await chooseCompany(me, flags, null, {
+        prompt: SERVICE_KEY_COMPANY_PROMPT,
+        useSavedDefault: false,
+    });
     const response = await withLoadingIndicator("Loading service keys...", flags, () => listServiceApiKeys(client, company.id));
     const payload = {
         company,
@@ -653,13 +653,15 @@ export async function commandServiceKeyList(client, flags) {
     return payload;
 }
 export async function commandServiceKeyRevoke(client, flags, requestedKeyId) {
-    requireExplicitServiceKeyCompany(flags, SERVICE_KEY_REVOKE_USAGE);
     const keyId = requestedKeyId.trim();
     if (!keyId) {
         throw new Error(SERVICE_KEY_REVOKE_USAGE);
     }
     const me = await requireExistingServiceKeySession(client);
-    const company = await chooseCompany(me, flags, null);
+    const company = await chooseCompany(me, flags, null, {
+        prompt: SERVICE_KEY_COMPANY_PROMPT,
+        useSavedDefault: false,
+    });
     await withLoadingIndicator("Revoking service key...", flags, () => revokeServiceApiKey(client, company.id, keyId));
     const payload = {
         company,

package/dist/help.js

@@ -33,7 +33,7 @@ export const CLI_HELP_TEXT = `Usage:
   apex connect gitlab               Open the GitLab connection flow
 
 Flags:
-  --company <id-or-handle>          Choose the Apex company to use
+  --company <id-or-handle>          Override the automatically selected Apex company
   --name <name>                     Name a new service key
   --scope <scope[,scope]>           Limit a service key to scans:create, scans:read, and/or findings:read
   --expires-at <ISO-8601>           Set an optional service-key expiration time
@@ -73,7 +73,8 @@ Tips:
   audit is the current scan mode for audit scans; ultra remains accepted as a legacy alias.
   apex workspace use accepts a workspace name, prefix, or ID.
   Finding comments, feedback, and fix review scans use the same Apex login credentials as other CLI commands.
-  Service-key commands require an existing login and --company; run apex login first when needed.
+  Service-key commands require an existing login; run apex login first when needed.
+  Apex automatically selects your company when only one is available. With multiple companies, choose one interactively or pass --company.
   Service-key creation also requires --name and reveals the secret only once; omit --scope to grant all hosted API scopes.
   Service-key management is available only in the scripted CLI, not the interactive shell or MCP server.
   Invalid finding feedback requires --dismissal-reason.
@@ -120,11 +121,21 @@ Commands:
   /help                   Show this help
   /exit                   Exit Apex
 
+Scripted-only commands (run outside the interactive shell):
+  apex service-key create --name <name> [--company <id-or-handle>] [--scope <scope[,scope]>]
+                           Create an organization service key (shown once)
+  apex service-key list [--company <id-or-handle>]
+                           List service-key metadata
+  apex service-key revoke <key-id> [--company <id-or-handle>]
+                           Revoke a service key
+
 Tips:
   PR scans require a GitHub PR number and provider-backed repository access.
   audit is the current scan mode for audit scans; ultra remains accepted as a legacy alias.
   /workspace use accepts a workspace name, prefix, or ID.
   /findings comment, /findings feedback, and /findings fix-review use the current Apex login.
+  Service-key commands automatically use your company when only one is available. With multiple companies, choose one interactively or pass --company.
+  Service-key secrets are shown once. Run these commands in your terminal, not in the interactive shell or through MCP.
   Invalid finding feedback requires a dismissal reason.
   Fix review scans use saved Fix PR URLs when present; otherwise they review the current repository when Bedrock has original scan repository context. Use scripted CLI or MCP to supply Fix PR URLs directly.
   Use scripted CLI flags for advanced feedback options such as suggested severity or dismissal reason.

package/dist/session.js

@@ -23,10 +23,13 @@ export function createWorkspaceBinding(result, currentBinding) {
         lastScanUrl: preservedBinding?.lastScanUrl ?? null,
     };
 }
-export async function chooseCompany(me, flags, binding) {
+export async function chooseCompany(me, flags, binding, options = {}) {
     const requested = getFlagString(flags, "company");
     const config = await loadConfig();
-    const defaultRef = requested ?? binding?.companyId ?? config.defaultCompanyId ?? null;
+    const defaultRef = requested ??
+        (options.useSavedDefault === false
+            ? null
+            : (binding?.companyId ?? config.defaultCompanyId ?? null));
     if (defaultRef) {
         const matched = me.companies.find((company) => company.id === defaultRef ||
             (company.handle ?? "").toLowerCase() === defaultRef.toLowerCase());
@@ -46,7 +49,7 @@ export async function chooseCompany(me, flags, binding) {
     if (!canPromptInteractively(flags)) {
         throw new Error("Multiple companies available. Re-run with --company <id-or-handle>.");
     }
-    const selected = await chooseOne("Select the Apex company to use for this directory:", me.companies.map((company) => ({
+    const selected = await chooseOne(options.prompt ?? "Select the Apex company to use for this directory:", me.companies.map((company) => ({
         label: company.handle
             ? `${company.name ?? company.id} (${company.handle})`
             : (company.name ?? company.id),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cantinasecurity/apex-cli",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Standalone CLI and MCP server for Apex.",
   "private": false,
   "type": "module",

package/skills/apex-cli/SKILL.md

@@ -31,7 +31,7 @@ Guidelines:
 
 - Do not rely on interactive CLI prompts. The MCP tools are intentionally non-interactive.
 - Service-key management has no MCP tools. Never ask a user to paste a service key into a prompt, and never place one in an MCP call, tool result, source file, or log.
-- If a user explicitly needs a new service key, tell them to run `apex login` if needed, then run `apex service-key create --company <company> --name <name> --scope <scope[,scope]>` directly in their own terminal. Use only the required scopes: `scans:create` to trigger, `scans:read` to poll status, and `findings:read` to retrieve findings. A P1-only adapter can use `--scope scans:read,findings:read`; omitting `--scope` grants all three. Service-key commands never initiate login; the secret is shown once. `list` and `revoke` also require an explicit `--company`.
+- If a user explicitly needs a new service key, tell them to run `apex login` if needed, then run `apex service-key create --name <name> --scope <scope[,scope]>` directly in their own terminal. Use only the required scopes: `scans:create` to trigger, `scans:read` to poll status, and `findings:read` to retrieve findings. A P1-only adapter can use `--scope scans:read,findings:read`; omitting `--scope` grants all three. The CLI automatically selects the company when only one is available and prompts when there are several; use `--company <id-or-handle>` to skip that prompt or resolve a non-interactive command. Service-key commands never initiate login, and the secret is shown once.
 - For a headless HTTP adapter, read the service key from a secret-backed environment variable, send it as a bearer token to `/api/apex/v1`, and redact it from errors and logs. Do not shell out to `apex` or launch MCP from the adapter.
 - Hosted API v1 requires the GitHub repository to be linked to an active Apex workspace. It never creates or mutates workspaces; use optional `workspaceId` to disambiguate matches and treat zero or ambiguous matches as HTTP `409` setup errors.
 - Hosted scan triggers require `Idempotency-Key`. Reuse one stable key only for an identical transport/timeout/5xx retry. After correcting a definitive 4xx response, or for any new intended scan, use a new key.