@cantinasecurity/apex-cli 0.1.16 → 0.1.17

package/.claude/skills/apex-cli/SKILL.md

@@ -25,9 +25,10 @@ Recommended workflow:
 4. Call `apex-doctor` before starting a scan if workspace binding or source planning might be unclear.
 5. If the directory is not bound to the right workspace, call `apex-workspaces` and `apex-workspace-use`.
 6. Use `apex-scan`, `apex-status`, `apex-scans`, `apex-findings`, and `apex-export-findings` for the scan lifecycle.
-7. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
-8. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
-9. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
+7. For Lite scans, call `apex-scan` with `mode: "lite"` only when the company has Lite Scan beta access and the sources are provider-backed.
+8. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
+9. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
+10. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
 
 If the Apex MCP server is not configured, fall back to the local CLI:
 
@@ -39,12 +40,13 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 - Hosted scan triggers require `Idempotency-Key`. Reuse one stable key only for an identical transport/timeout/5xx retry. After correcting a definitive 4xx response, or for any new intended scan, use a new key.
 - Use `--non-interactive` and `--no-open` for automation-friendly CLI calls.
 - Use `--json` whenever structured output is helpful.
-- `apex credits` reports standard credits plus audit and fix review scan entitlements when Bedrock returns those balances.
+- `apex credits` reports standard credits plus audit, fix review, and Lite scan entitlements when Bedrock returns those balances.
 - Work from the target repository directory so Apex can resolve `.apex/workspace.json`.
 - `apex scan` scans the current working directory by default; pass `--repo` only when the user asks to scan explicit alternate roots.
 - `apex-doctor` reports whether Apex will use remote materialization or a local snapshot upload for each selected source.
 - Plain local directories and dirty git worktrees can scan through local snapshot uploads without provider access.
 - Audit scans use `--mode audit` in user-facing CLI calls and request payloads. The legacy `ultra` mode remains accepted as an alias, but audit scans still require provider-backed GitHub or GitLab sources.
+- Lite scans use `--mode lite` in CLI calls or `mode: "lite"` in MCP, require Lite Scan beta access, and require provider-backed GitHub or GitLab sources without local snapshot fallback.
 - PR scans use `--mode pr --pr <number>` in CLI calls, or `mode: "pr"` with `pullRequests` in MCP. They require one provider-backed GitHub repository.
 - `apex-workspace-use` accepts a workspace name, prefix, or ID.
 - Use `sourceMode: "remote"` only when the user explicitly wants to forbid local snapshot fallbacks.
@@ -59,6 +61,7 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 ## Examples
 
 - Start a scan for the current repository or directory: run `apex-doctor`, bind a workspace if needed, then call `apex-scan`.
+- Start a Lite scan: call `apex-scan` with `mode: "lite"` after confirming beta access and provider-backed sources.
 - Start a PR scan: call `apex-scan` with `mode: "pr"` and `pullRequests`.
 - Check an active scan: call `apex-status`, passing `scanId` when the scan is not the latest binding, then `apex-findings` when the scan completes.
 - Export findings for review: call `apex-export-findings` with `format` set to `markdown`, `json`, or `gitlab-sast`.

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Cantina agent plugins for security review workflows.",
-    "version": "0.1.16"
+    "version": "0.1.17"
   },
   "plugins": [
     {
@@ -14,10 +14,10 @@
       "source": {
         "source": "npm",
         "package": "@cantinasecurity/apex-cli",
-        "version": "0.1.16"
+        "version": "0.1.17"
       },
       "description": "Run Apex security scans and review findings from Claude Code.",
-      "version": "0.1.16",
+      "version": "0.1.17",
       "author": {
         "name": "Cantina",
         "email": "support@cantina.xyz"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Run Apex security scans and review findings from Claude Code.",
   "author": {
     "name": "Cantina",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Run Apex security scans and review findings from Codex.",
   "author": {
     "name": "Cantina",

package/.mcp.claude.json

@@ -5,7 +5,7 @@
       "args": [
         "-y",
         "-p",
-        "@cantinasecurity/apex-cli@0.1.16",
+        "@cantinasecurity/apex-cli@0.1.17",
         "apex-mcp"
       ],
       "env": {

package/.mcp.codex.json

@@ -4,7 +4,7 @@
     "args": [
       "-y",
       "-p",
-      "@cantinasecurity/apex-cli@0.1.16",
+      "@cantinasecurity/apex-cli@0.1.17",
       "apex-mcp"
     ],
     "env": {

package/MARKETPLACE.md

@@ -13,7 +13,7 @@ This package is prepared as both a Claude Code plugin and a Codex plugin. The pu
 The plugin MCP configs launch the pinned npm CLI package with:
 
 ```bash
-npx -y -p @cantinasecurity/apex-cli@0.1.16 apex-mcp
+npx -y -p @cantinasecurity/apex-cli@0.1.17 apex-mcp
 ```
 
 That keeps marketplace installs independent of a user's global `apex` install.

package/README.md

@@ -103,7 +103,7 @@ If Apex asks for a workspace name, that is the Apex workspace name for the curre
 Supported shell commands:
 
 - `/credits`
-- `/scan [standard|audit]`
+- `/scan [standard|audit|lite]`
 - `/scan pr <pr-number>`
 - `/scans`
 - `/findings [scan-id]`
@@ -136,6 +136,7 @@ Supported shell commands:
 
 - `apex credits`
 - `apex scan`
+- `apex scan --mode lite`
 - `apex scan --mode pr --pr <number> [--pr <number>] [--pr-path <path>]`
 - `apex scans`
 - `apex findings [--scan <scan-id>]`
@@ -165,7 +166,7 @@ Helpful workspace flags:
 - `--company <id-or-handle>` to choose the Apex company when more than one is available
 - `--workspace-name <name>` to set the Apex workspace name for this directory
 
-`apex credits` shows standard scan credits plus audit and fix review scan entitlements when the server returns them.
+`apex credits` shows standard, audit, fix review, and Lite scan entitlements when the server returns them.
 
 ## Service Keys And The Hosted API
 
@@ -278,7 +279,7 @@ Useful flags:
 
 - `--repo <path>` to scan one or more explicit local roots instead of the current directory
 - `--source-mode auto|remote|local` to control remote-first fallback behavior
-- `--mode standard|audit|pr` to choose the scan mode
+- `--mode standard|audit|lite|pr` to choose the scan mode
 - `--pr <number>` to select one or more GitHub pull requests for `--mode pr`
 - `--pr <number:path,path>` or `--pr-path <path>` to limit a PR scan to changed paths
 
@@ -286,6 +287,8 @@ Useful flags:
 
 Audit scans use `audit` as the scan mode and still require provider-backed GitHub or GitLab repositories that Apex can materialize remotely without a local snapshot fallback. `ultra` remains accepted as a backwards-compatible alias.
 
+Lite scans use `lite` as the scan mode and require the Lite Scan beta feature plus provider-backed GitHub or GitLab repositories that Apex can materialize remotely. Local snapshot uploads are not supported for Lite scans.
+
 PR scans require exactly one provider-backed GitHub repository. If the current directory resolves to multiple sources, pass `--repo <path>` to select the one that contains the pull request.
 
 ## LLM / MCP Usage
@@ -382,6 +385,7 @@ The MCP server exposes Apex-specific tools for:
 - doctor, credits, and provider connection URLs
 - workspace inspection and workspace binding
 - scan start, status, cancellation, findings, and findings export
+- Lite scan start by calling `apex-scan` with `mode: "lite"`
 - PR scan start by calling `apex-scan` with `mode: "pr"` and `pullRequests`
 - finding comments and valid/invalid feedback with `apex-finding-comment` and `apex-finding-feedback`
 - Fix PR and current-repository fix review scans with `apex-finding-fix-review`, optionally after `apex-finding-feedback`
@@ -425,7 +429,7 @@ Telemetry event posts do not include bearer tokens. The telemetry endpoint is `P
     {
       "schemaVersion": 1,
       "event": "apex.invocation.completed",
-      "cliVersion": "0.1.16",
+      "cliVersion": "0.1.17",
       "invocation": {
         "surface": "mcp",
         "command": "apex-scan",
@@ -456,7 +460,7 @@ The npm package also includes marketplace-ready plugin artifacts:
 - `.claude-plugin/plugin.json` and `.mcp.claude.json` for Claude Code plugin installs
 - `.claude-plugin/marketplace.json` for a Claude marketplace entry backed by the public npm package
 
-These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.16 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
+These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.17 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
 
 The repository also includes `.agents/plugins/marketplace.json` for local Codex marketplace testing from a checkout.
 

package/dist/commands.js

@@ -184,6 +184,28 @@ function formatFixReviewScanBalance(scanBalance) {
     }
     return `Fix review scans: ${detailParts.join(", ")}`;
 }
+function formatLiteScanBalance(scanBalance) {
+    const purchased = getOptionalCount(scanBalance.litePurchased);
+    const used = getOptionalCount(scanBalance.liteUsed);
+    const remaining = getOptionalCount(scanBalance.liteRemaining);
+    const available = remaining ??
+        (purchased !== null && used !== null ? Math.max(0, purchased - used) : null);
+    if (purchased === null && used === null && available === null) {
+        return null;
+    }
+    const detailParts = [];
+    if (purchased !== null) {
+        detailParts.push(`${purchased} purchased`);
+    }
+    if (used !== null) {
+        detailParts.push(`${used} used`);
+    }
+    if (available !== null) {
+        const detailSuffix = detailParts.length ? ` (${detailParts.join(", ")})` : "";
+        return `Lite scan credits: ${available} available${detailSuffix}`;
+    }
+    return `Lite scan credits: ${detailParts.join(", ")}`;
+}
 function normalizeRequestedScanMode(value) {
     if (value === "ultra" || value === "audit") {
         return "audit";
@@ -191,6 +213,9 @@ function normalizeRequestedScanMode(value) {
     if (value === "pr") {
         return "pr";
     }
+    if (value === "lite") {
+        return "lite";
+    }
     return "standard";
 }
 function getFlagValues(flags, key) {
@@ -574,6 +599,10 @@ export async function commandCredits(client, cwd, flags) {
     if (redeemableFixReviewScans && redeemableFixReviewScans > 0) {
         logLine(`Redeemable fix review scans from standard credits: ${redeemableFixReviewScans}`, flags);
     }
+    const liteBalance = formatLiteScanBalance(payload.scanBalance);
+    if (liteBalance) {
+        logLine(liteBalance, flags);
+    }
     logLine(`Scans enabled: ${payload.scansEnabled ? "yes" : "no"}`, flags);
     return payload;
 }
@@ -855,16 +884,17 @@ export async function commandScan(client, cwd, flags) {
             },
         }));
     }
-    else if (requestedMode === "audit") {
+    else if (requestedMode === "audit" || requestedMode === "lite") {
+        const modeLabel = requestedMode === "audit" ? "Audit" : "Lite";
         if (!supportsLegacyRemoteFlow(result.resolve.plannedSources)) {
-            throw new Error("Audit scans currently require provider-backed GitHub or GitLab repositories without local snapshot fallbacks.");
+            throw new Error(`${modeLabel} scans currently require provider-backed GitHub or GitLab repositories without local snapshot fallbacks.`);
         }
-        const legacyResolve = await withLoadingIndicator("Preparing audit scan...", flags, () => resolveWorkspaceSelectionLegacy(client, selection, resolvedWorkspaceId));
+        const legacyResolve = await withLoadingIndicator(`Preparing ${modeLabel.toLowerCase()} scan...`, flags, () => resolveWorkspaceSelectionLegacy(client, selection, resolvedWorkspaceId));
         if (!legacyResolve.workspaceId) {
             throw new Error("Workspace resolution did not return a workspaceId.");
         }
         workspaceId = legacyResolve.workspaceId;
-        scan = await withLoadingIndicator("Starting audit scan...", flags, () => client.request(`/api/cli/v1/local-workspaces/${encodeURIComponent(workspaceId)}/scan`, {
+        scan = await withLoadingIndicator(`Starting ${modeLabel.toLowerCase()} scan...`, flags, () => client.request(`/api/cli/v1/local-workspaces/${encodeURIComponent(workspaceId)}/scan`, {
             method: "POST",
             json: {
                 mode: requestedMode,

package/dist/help.js

@@ -1,6 +1,6 @@
 export const CLI_HELP_TEXT = `Usage:
   apex                              Open the interactive Apex shell
-  apex credits                      Show scan credits plus audit and fix review scan entitlements for the active company
+  apex credits                      Show standard, audit, fix review, and Lite scan entitlements for the active company
   apex scan                         Create or resolve a workspace for this directory and start a scan
   apex scans                        List scans for the current workspace binding
   apex findings                     List findings for the latest or selected scan
@@ -55,7 +55,7 @@ Flags:
                                     Choose the export format for findings
   --output <path>                   Write exported findings to this file path
   --limit <count>                   Limit the number of findings returned
-  --mode standard|audit|pr          Choose the scan mode
+  --mode standard|audit|lite|pr     Choose the scan mode
   --pr <number[:path,path]>         Select a GitHub pull request for --mode pr
   --pr-path <path>                  Limit a single-PR scan to a changed file path
   --source-mode auto|remote|local   Control remote-vs-local source materialization
@@ -71,6 +71,7 @@ Tips:
   apex scan uses the current directory as the default source root unless you pass --repo.
   PR scans require --mode pr and at least one --pr selection for a GitHub repository.
   audit is the current scan mode for audit scans; ultra remains accepted as a legacy alias.
+  Lite scans use --mode lite and require beta access plus provider-backed GitHub or GitLab sources.
   apex workspace use accepts a workspace name, prefix, or ID.
   Finding comments, feedback, and fix review scans use the same Apex login credentials as other CLI commands.
   Service-key commands require an existing login; run apex login first when needed.
@@ -87,8 +88,9 @@ Tips:
 export const SHELL_HELP_TEXT = `Press Tab to autocomplete commands and common arguments.
 
 Commands:
-  /credits                Show scan credits plus audit and fix review scan entitlements for the active company
-  /scan [standard|audit]  Start a new Apex scan for this workspace
+  /credits                Show standard, audit, fix review, and Lite scan entitlements for the active company
+  /scan [standard|audit|lite]
+                           Start a new Apex scan for this workspace
   /scan pr <pr-number>    Start a PR scan for this workspace
   /scans                  List scans for this workspace
   /findings [scan-id]     List findings for the latest or selected scan
@@ -132,6 +134,7 @@ Scripted-only commands (run outside the interactive shell):
 Tips:
   PR scans require a GitHub PR number and provider-backed repository access.
   audit is the current scan mode for audit scans; ultra remains accepted as a legacy alias.
+  Lite scans require beta access plus provider-backed GitHub or GitLab sources.
   /workspace use accepts a workspace name, prefix, or ID.
   /findings comment, /findings feedback, and /findings fix-review use the current Apex login.
   Service-key commands automatically use your company when only one is available. With multiple companies, choose one interactively or pass --company.

package/dist/mcp.js

@@ -26,7 +26,7 @@ Notes:
 - Finding write tools use the same Apex device-login credentials as read tools.
 - Organization service-key creation, listing, and revocation are intentionally scripted-CLI-only and are not exposed as MCP tools. Never ask a user to paste a service key into an MCP prompt or tool call.
 - HTTP-only serverless and cron integrations should use the hosted API documented at https://ai.cantina.xyz/docs/apex-api instead of launching this stdio server.
-- Use mode "audit" for audit scans; "ultra" remains accepted as a legacy alias. Use mode "pr" for GitHub pull request scans.
+- Use mode "audit" for audit scans; "ultra" remains accepted as a legacy alias. Use mode "lite" only for beta-enabled provider-backed Lite scans, and mode "pr" for GitHub pull request scans.
 - Doctor reports whether Apex will use remote materialization or a local snapshot upload for each source.`;
 const WORKSPACE_BINDING_ERROR = "This directory is not bound to an Apex workspace yet. Run `apex workspaces` to list workspace names, prefixes, and IDs, then bind one with `apex workspace use \"<workspace name>\"`, or run `apex scan` to create or resolve one automatically.";
 const MISSING_PROVIDER_CONNECTIONS_ERROR = "Missing provider connections. Re-run interactively or pre-connect providers.";
@@ -292,7 +292,7 @@ function registerTools(server) {
     }));
     server.registerTool("apex-credits", {
         title: "Get Apex Credits",
-        description: "Show scan credits plus audit and fix review scan entitlements for the active or selected company.",
+        description: "Show scan credits plus audit, fix review, and Lite scan entitlements for the active or selected company.",
         inputSchema: {
             cwd: z.string().optional(),
             company: z.string().optional(),
@@ -376,13 +376,13 @@ function registerTools(server) {
     }));
     server.registerTool("apex-scan", {
         title: "Start Apex Scan",
-        description: "Start a new Apex scan for the provided cwd by default. Pass repoPaths only to scan explicit alternate local roots. Use mode audit for audit scans and mode pr for GitHub pull request scans.",
+        description: "Start a new Apex scan for the provided cwd by default. Pass repoPaths only to scan explicit alternate local roots. Use mode audit for audit scans, mode lite for beta-gated provider-backed Lite scans, and mode pr for GitHub pull request scans.",
         inputSchema: {
             cwd: z.string().optional(),
             company: z.string().optional(),
             workspaceName: z.string().optional(),
             repoPaths: z.array(z.string()).optional(),
-            mode: z.enum(["standard", "audit", "ultra", "pr"]).optional(),
+            mode: z.enum(["standard", "audit", "ultra", "lite", "pr"]).optional(),
             pullRequests: z
                 .array(z.object({
                 number: z.number().int().positive(),

package/dist/shell.js

@@ -7,7 +7,7 @@ import { formatApiError } from "./api-client.js";
 import { createShellTelemetryInvocation, emitInvocationCompleted, emitInvocationStarted, withTelemetryContext, } from "./telemetry.js";
 const SHELL_COMPLETIONS = [
     { command: "credits" },
-    { command: "scan", args: ["standard", "audit", "ultra", "pr"] },
+    { command: "scan", args: ["standard", "audit", "ultra", "lite", "pr"] },
     { command: "scans" },
     { command: "findings", args: ["comment", "feedback", "fix-review"] },
     { command: "export" },
@@ -195,8 +195,8 @@ async function runShellCommand(client, cwd, parsed, shellFlags, session) {
             return {};
         case "scan": {
             const mode = parsed.args[0];
-            if (mode && !["standard", "audit", "ultra", "pr"].includes(mode)) {
-                process.stderr.write("Usage: /scan [standard|audit|ultra|pr] [pr-number]\n");
+            if (mode && !["standard", "audit", "ultra", "lite", "pr"].includes(mode)) {
+                process.stderr.write("Usage: /scan [standard|audit|ultra|lite|pr] [pr-number]\n");
                 return {};
             }
             const prNumber = mode === "pr" ? parsed.args[1] : null;

package/dist/telemetry.js

@@ -184,7 +184,13 @@ function sanitizeCliFlags(flags) {
         contentProvided: stringFlag(flags, "content") !== null,
         commentProvided: stringFlag(flags, "comment") !== null,
         parentCommentProvided: stringFlag(flags, "parent-comment") !== null,
-        mode: safeEnum(stringFlag(flags, "mode"), ["standard", "audit", "ultra", "pr"]),
+        mode: safeEnum(stringFlag(flags, "mode"), [
+            "standard",
+            "audit",
+            "ultra",
+            "lite",
+            "pr",
+        ]),
         sourceMode: safeEnum(stringFlag(flags, "source-mode"), ["auto", "remote", "local"]),
         format: safeEnum(stringFlag(flags, "format"), ["markdown", "json", "gitlab-sast"]),
         feedbackStatus: safeEnum(stringFlag(flags, "status"), ["valid", "invalid"]),
@@ -351,6 +357,7 @@ export function sanitizeMcpInput(input = {}) {
             "standard",
             "audit",
             "ultra",
+            "lite",
             "pr",
         ]),
         sourceMode: safeEnum(typeof input.sourceMode === "string" ? input.sourceMode : null, [
@@ -538,7 +545,13 @@ export function createCliTelemetryInvocation(parsed) {
 }
 export function createShellTelemetryInvocation(parsed, flags) {
     const shellMode = parsed.command === "scan"
-        ? safeEnum(parsed.args[0] ?? "default", ["standard", "audit", "ultra", "pr"]) ??
+        ? safeEnum(parsed.args[0] ?? "default", [
+            "standard",
+            "audit",
+            "ultra",
+            "lite",
+            "pr",
+        ]) ??
             (parsed.args[0] ? "other" : "default")
         : null;
     return createInvocation({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cantinasecurity/apex-cli",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Standalone CLI and MCP server for Apex.",
   "private": false,
   "type": "module",

package/skills/apex-cli/SKILL.md

@@ -23,9 +23,10 @@ Workflow:
 4. Call `apex-doctor` before starting a scan if workspace binding or source planning might be unclear.
 5. If the directory is not bound to the right workspace, call `apex-workspaces` and `apex-workspace-use`.
 6. Use `apex-scan`, `apex-status`, `apex-scans`, `apex-findings`, and `apex-export-findings` for the scan lifecycle.
-7. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
-8. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
-9. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
+7. For Lite scans, call `apex-scan` with `mode: "lite"` only when the company has Lite Scan beta access and the sources are provider-backed.
+8. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
+9. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
+10. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
 
 Guidelines:
 
@@ -35,11 +36,12 @@ Guidelines:
 - For a headless HTTP adapter, read the service key from a secret-backed environment variable, send it as a bearer token to `/api/apex/v1`, and redact it from errors and logs. Do not shell out to `apex` or launch MCP from the adapter.
 - Hosted API v1 requires the GitHub repository to be linked to an active Apex workspace. It never creates or mutates workspaces; use optional `workspaceId` to disambiguate matches and treat zero or ambiguous matches as HTTP `409` setup errors.
 - Hosted scan triggers require `Idempotency-Key`. Reuse one stable key only for an identical transport/timeout/5xx retry. After correcting a definitive 4xx response, or for any new intended scan, use a new key.
-- `apex-credits` reports standard credits plus audit and fix review scan entitlements when Bedrock returns those balances.
+- `apex-credits` reports standard credits plus audit, fix review, and Lite scan entitlements when Bedrock returns those balances.
 - `apex-scan` scans the provided `cwd` by default; pass `repoPaths` only when the user asks to scan explicit alternate roots.
 - `apex-doctor` reports whether Apex will use remote materialization or a local snapshot upload for each selected source.
 - Apex can scan plain local directories and dirty git worktrees without provider connections by using local snapshot uploads.
 - Audit scans use `mode: "audit"` in user-facing instructions and request payloads. The legacy `ultra` mode remains accepted as an alias, but audit scans still require provider-backed GitHub or GitLab sources.
+- Lite scans use `mode: "lite"`, require Lite Scan beta access, and require provider-backed GitHub or GitLab sources without local snapshot fallback.
 - PR scans use `mode: "pr"` and require one provider-backed GitHub repository plus one or more `pullRequests`.
 - `apex-workspace-use` accepts a workspace name, prefix, or ID.
 - Use `sourceMode: "remote"` only when the user explicitly wants to forbid local snapshot fallbacks.