@cantinasecurity/apex-cli 0.1.17 → 0.1.18

package/.claude/skills/apex-cli/SKILL.md

@@ -17,22 +17,40 @@ For serverless, cron, or other HTTP-only integrations, use the hosted Apex REST
 
 For on-prem or other non-default Apex hosts, make sure the CLI or MCP server runs with `APEX_BASE_URL` set to the external HTTPS Bedrock origin before auth or provider connection flows.
 
+When the user provides a Cantina trial code, redemption is the one deliberate
+terminal exception to the MCP-first workflow. From the repository root, run
+`apex redeem <code> --json`; do not start device login. The code is secret:
+send it only to `apex redeem`; never echo or restate it, save it, or place it in an MCP
+tool call or result. Trial redemption, claim, and revocation are hosted-only;
+stop before passing the code when `APEX_BASE_URL` has any origin other than
+`https://ai.cantina.xyz`. Only when the first attempt has an ambiguous
+transport/connection failure or interrupted/missing response with no typed
+server error may you retry that exact same command once on the same machine,
+HOME, and repository root. Never retry a typed server rejection or make more
+than one recovery retry. Continue only for `redeemed` or `idempotent` outcomes.
+
 Recommended workflow:
 
 1. Start with `apex-auth-status`.
-2. If Apex is unauthenticated, call `apex-auth-start`, ask the user to approve the device-login URL, then call `apex-auth-wait` with the returned `deviceCode`.
-3. For repository-scoped work, pass `cwd` explicitly.
-4. Call `apex-doctor` before starting a scan if workspace binding or source planning might be unclear.
-5. If the directory is not bound to the right workspace, call `apex-workspaces` and `apex-workspace-use`.
-6. Use `apex-scan`, `apex-status`, `apex-scans`, `apex-findings`, and `apex-export-findings` for the scan lifecycle.
-7. For Lite scans, call `apex-scan` with `mode: "lite"` only when the company has Lite Scan beta access and the sources are provider-backed.
-8. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
-9. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
-10. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
+2. Always call `apex-trial-status` next, even when account authentication succeeded. When `claimAvailable` is true, do not call `apex-auth-start`; tell the user to run `apex claim` in a terminal first so the trial workspace, scans, and findings are kept. When the claim deadline has passed and `claimAvailable` is false, continue normal account authentication instead of steering the user to an expired claim.
+3. Only when Apex is unauthenticated, no unexpired claim proof is available, and no trial code was supplied, call `apex-auth-start`, ask the user to approve the device-login URL, then call `apex-auth-wait` with both the returned `deviceCode` and opaque `credentialGeneration`. If the wait is superseded, keep the current credential state and re-check `apex-auth-status` before starting another login.
+4. For repository-scoped work, pass `cwd` explicitly.
+5. Call `apex-doctor` before starting a scan if workspace binding or source planning might be unclear.
+6. If the directory is not bound to the right workspace, call `apex-workspaces` and `apex-workspace-use`.
+7. Use `apex-scan`, `apex-status`, `apex-scans`, `apex-findings`, and `apex-export-findings` for the scan lifecycle.
+8. For Lite scans, call `apex-scan` with `mode: "lite"` only when the company has Lite Scan beta access and the sources are provider-backed.
+9. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
+10. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
+11. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
 
 If the Apex MCP server is not configured, fall back to the local CLI:
 
 - Prefer scripted commands over the interactive shell.
+- A trial redeem with an ambiguous transport or response-loss failure may be retried exactly once with the same code, machine, HOME, and repository root. Never retry a typed server rejection or use `--replace` for response-loss recovery.
+- After a successful scan JSON response, inspect `localPersistence.workspaceBindingSaved`. If it is `false`, the server scan already started: capture and report `binding.lastScanId`, then STOP; do not run status or findings until local repository permissions are repaired.
+- `apex-trial-status` is MCP-only; do not invoke it as a CLI command. In a CLI-only flow, use the `claimDeadline` returned by `apex redeem <code> --json` without repeating or persisting the secret code.
+- After a guest scan, tell the user to run `apex claim` on the same machine before that returned claim deadline. If the deadline is unavailable or uncertain, do not guess or start a replacement login; run `apex claim` and let the server validate the proof.
+- Claim currently requires a Cantina account that does not already own a personal Apex tenant. If the user already completed Cantina Apex onboarding, explain that CLI linking is not available yet and tell them to contact Cantina support before the claim deadline.
 - Service-key management has no MCP tools. Never ask a user to paste a service key into a prompt, and never place one in an MCP call, tool result, source file, or log.
 - If a user explicitly needs a new service key, tell them to run `apex login` if needed, then run `apex service-key create --name <name> --scope <scope[,scope]>` directly in their own terminal. Use only the required scopes: `scans:create` to trigger, `scans:read` to poll status, and `findings:read` to retrieve findings. A P1-only adapter can use `--scope scans:read,findings:read`; omitting `--scope` grants all three. The CLI automatically selects the company when only one is available and prompts when there are several; use `--company <id-or-handle>` to skip that prompt or resolve a non-interactive command. Service-key commands never initiate login, and the secret is shown once.
 - For a headless HTTP adapter, read the service key from a secret-backed environment variable, send it as a bearer token to `/api/apex/v1`, and redact it from errors and logs. Do not shell out to `apex` or launch MCP from the adapter.
@@ -51,8 +69,8 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 - `apex-workspace-use` accepts a workspace name, prefix, or ID.
 - Use `sourceMode: "remote"` only when the user explicitly wants to forbid local snapshot fallbacks.
 - When checking a scan that is not the workspace binding's latest scan, pass `scanId` to `apex-status`; use `apex scans` or `apex-scans` first if you need to discover scan IDs.
-- Finding comments, feedback, and fix review scan starts use the same Apex device-login credentials as read tools. If a write tool reports missing auth, re-run `apex-auth-status` and complete `apex-auth-start` / `apex-auth-wait` instead of asking for browser cookies or auth tokens.
-- Anonymous telemetry records only sanitized command/tool metadata such as command names, enum modes, counts, durations, success/failure categories, CLI version, and client integration. It must not include raw repository paths, scan IDs, finding IDs, comments, file paths, PR URLs, or tokens.
+- Finding comments, feedback, and fix review scan starts use the same Apex device-login credentials as read tools. If a write tool reports missing auth, re-run `apex-auth-status`, check `apex-trial-status`, and complete `apex-auth-start` / `apex-auth-wait` only when no unexpired local claim proof is available, instead of asking for browser cookies or auth tokens.
+- Anonymous telemetry records only sanitized command/tool metadata such as command names, enum modes, counts, durations, success/failure categories, CLI version, and client integration. It must not include raw repository paths, scan IDs, finding IDs, comments, file paths, PR URLs, trial codes, claim tokens, onboarding fingerprints, or bearer tokens.
 - Invalid finding feedback requires `dismissalReason`; valid feedback can include `suggestedSeverity`, including `extreme`.
 - PR-based fix reviews can pass `fixPrUrls` directly to `apex-finding-fix-review`; agents that also need to record fixed feedback can first call `apex-finding-feedback` with `status: "valid"`, `labels: ["fixed"]`, and `fixPrUrls`.
 - Current-repository fix reviews omit `fixPrUrls` and require Bedrock original scan repository context for the finding.
@@ -60,6 +78,7 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 
 ## Examples
 
+- Redeem a supplied trial code: run `apex redeem <code> --json` in a terminal, continue with MCP only after a `redeemed` or `idempotent` outcome, then check `apex-trial-status` and remind the user about `apex claim` after findings only while `claimAvailable` remains true.
 - Start a scan for the current repository or directory: run `apex-doctor`, bind a workspace if needed, then call `apex-scan`.
 - Start a Lite scan: call `apex-scan` with `mode: "lite"` after confirming beta access and provider-backed sources.
 - Start a PR scan: call `apex-scan` with `mode: "pr"` and `pullRequests`.

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Cantina agent plugins for security review workflows.",
-    "version": "0.1.17"
+    "version": "0.1.18"
   },
   "plugins": [
     {
@@ -14,10 +14,10 @@
       "source": {
         "source": "npm",
         "package": "@cantinasecurity/apex-cli",
-        "version": "0.1.17"
+        "version": "0.1.18"
       },
       "description": "Run Apex security scans and review findings from Claude Code.",
-      "version": "0.1.17",
+      "version": "0.1.18",
       "author": {
         "name": "Cantina",
         "email": "support@cantina.xyz"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Run Apex security scans and review findings from Claude Code.",
   "author": {
     "name": "Cantina",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Run Apex security scans and review findings from Codex.",
   "author": {
     "name": "Cantina",

package/.mcp.claude.json

@@ -5,7 +5,7 @@
       "args": [
         "-y",
         "-p",
-        "@cantinasecurity/apex-cli@0.1.17",
+        "@cantinasecurity/apex-cli@0.1.18",
         "apex-mcp"
       ],
       "env": {

package/.mcp.codex.json

@@ -4,7 +4,7 @@
     "args": [
       "-y",
       "-p",
-      "@cantinasecurity/apex-cli@0.1.17",
+      "@cantinasecurity/apex-cli@0.1.18",
       "apex-mcp"
     ],
     "env": {

package/MARKETPLACE.md

@@ -13,7 +13,7 @@ This package is prepared as both a Claude Code plugin and a Codex plugin. The pu
 The plugin MCP configs launch the pinned npm CLI package with:
 
 ```bash
-npx -y -p @cantinasecurity/apex-cli@0.1.17 apex-mcp
+npx -y -p @cantinasecurity/apex-cli@0.1.18 apex-mcp
 ```
 
 That keeps marketplace installs independent of a user's global `apex` install.

package/README.md

@@ -56,6 +56,10 @@ pnpm install
 
 MCP registrations keep working across package updates because they point at the stable `apex-mcp` shim. Re-run `apex setup` after upgrading if you want to refresh copied skill files, and run `apex setup claude` in each repository where you want the Claude project skill.
 
+Restart any already-running MCP client after an Apex CLI upgrade before using
+trial redemption or claim. A process that loaded an older credential writer
+cannot adopt the new merge and generation-safety rules until it restarts.
+
 When `apex` is run in an interactive terminal, it checks for updates periodically and offers to install them.
 
 ## Local Development
@@ -83,6 +87,95 @@ public origin for GitHub callback and success redirects.
 APEX_BASE_URL=https://bedrock.customer.example pnpm apex
 ```
 
+## Try Apex With A Trial Code
+
+A Cantina-issued trial code can start a temporary guest scan without a Cantina
+account, browser, or device login. Redeem it from the repository root, run the
+normal scan lifecycle, and create a Cantina account only after reviewing the
+findings:
+
+```bash
+apex redeem SPBT-DEVREL-XXXXXXXX --json
+apex scan --non-interactive --json
+apex status --json
+apex findings --json
+apex claim
+```
+
+`apex redeem` never opens a browser. It saves a machine-local onboarding
+fingerprint before the first request, exchanges the code for a seven-day guest
+session, and stores the single-use claim proof only in the mode-0600 Apex
+credentials file. A one-way code hash distinguishes safe same-code retries
+without retaining the trial code. `apex claim` is the one onboarding command
+that may open a browser; it creates or signs into a Cantina account, then
+attaches the existing workspace, scans, and findings to that account. Run it on
+the same machine within 30 days. Unclaimed guest data is retained only for the
+limited period disclosed during redemption and is then queued for deletion.
+Currently, the account used for claim must not already own a personal Apex
+tenant. If you already completed Cantina Apex onboarding, the CLI cannot link
+the guest tenant to that account yet; contact Cantina support before the claim
+deadline.
+Trial redemption, claim, and revocation are hosted-only and fail before sending
+any onboarding secret when `APEX_BASE_URL` is not `https://ai.cantina.xyz`.
+
+If the local claim proof is lost while the seven-day guest session is still
+active, run `apex redeem <the-same-code>` again on the same machine to rotate
+the guest credentials and re-mint the claim proof over the authenticated guest
+channel. After the guest session expires, Apex cannot safely recover a lost
+claim proof from the public trial code and machine fingerprint alone.
+
+If the current credentials already belong to a real account, `apex redeem`
+exits with code 2 and `outcome: "already_authenticated"`; it never silently
+spends that account's credits. Re-redeeming the same code on the same machine
+is idempotent while the guest session remains active. A different active trial
+requires the explicit `--replace` flag, which revokes the outgoing guest
+session before redeeming the new code.
+
+Logging out of an active guest trial, or discarding a proof-only trial stub,
+requires explicit confirmation (`apex logout --force` in non-interactive
+flows). Apex first attempts a proof-bound server revoke; an explicitly
+confirmed logout may discard a stale local proof when the server can no longer
+verify it. Logging out of a separately authenticated account preserves any
+unclaimed local trial proof so `apex claim` can still use it.
+
+Agent-safe copy/paste prompt (substitute the issued code):
+
+```text
+Install and run Cantina Apex CLI 0.1.18 to start one free standard security scan of this repository immediately.
+
+Use this trial code only where <TRIAL_CODE> appears below: SPBT-DEVREL-XXXXXXXX
+
+Run the commands yourself from the repository root; do not stop after setup or only explain the steps. Use terminal CLI commands only. Do not use an Apex MCP tool or run `apex setup`, `apex mcp`, `apex login`, `apex-auth-start`, or `apex-auth-wait`. Never use `--replace` or `--force`.
+
+Use this exact command prefix for every Apex command:
+  npx -y -p @cantinasecurity/apex-cli@0.1.18 apex
+
+1. Before redeeming, confirm every command will use the same persistent, user-accessible machine or container, HOME, filesystem, and repository root. Confirm Node.js 20+ and npx are available. If `APEX_BASE_URL` is set, continue only when its origin is `https://ai.cantina.xyz`. Run the exact prefix with `--help` and continue only if help lists both `redeem` and `claim`. If any check fails, STOP before sending the code; do not install system packages.
+2. Redeem, with at most one response-loss recovery retry:
+     npx -y -p @cantinasecurity/apex-cli@0.1.18 apex redeem <TRIAL_CODE> --json
+   This terminal command is the only allowed tool call containing the code. Never echo or restate the code, store it in a file or environment variable, put it in a URL or MCP call, or include it in your response. Continue when the command exits 0 and stdout is JSON with `redeemed: true` and `outcome` equal to `redeemed` or `idempotent`. If and only if the first attempt ends with an ambiguous transport/connection failure or an interrupted/missing response and no typed server error code, retry this exact same command once on the same machine, HOME, and repository root. Never retry a typed server rejection and never make more than one recovery retry. If the allowed retry does not return a successful JSON outcome, STOP.
+3. Immediately start exactly one scan; do not wait for another instruction:
+     npx -y -p @cantinasecurity/apex-cli@0.1.18 apex scan --mode standard --non-interactive --no-open --json
+   On any error or nonzero exit, STOP. After a successful scan JSON response, inspect `localPersistence.workspaceBindingSaved`. If it is `false`, the server scan already started: capture and report `binding.lastScanId`, then STOP; do not run status or findings until local repository permissions are repaired. Otherwise capture `binding.lastScanId` from the JSON as <SCAN_ID>; if it is absent, STOP.
+4. About every 60 seconds, poll that exact scan:
+     npx -y -p @cantinasecurity/apex-cli@0.1.18 apex status --scan <SCAN_ID> --json
+   Read `progress.progress.status`. Wait while it is `created`, `pending`, `queued`, `starting`, `running`, `in_progress`, or `processing`. Continue on `completed`. STOP on `failed`, `cancelled`, a missing or unknown status, or a command failure.
+5. Fetch that exact scan's findings:
+     npx -y -p @cantinasecurity/apex-cli@0.1.18 apex findings --scan <SCAN_ID> --json
+   On success, summarize findings by severity, most severe first, including identifier, title, status, and confidence. This command does not return file locations, so do not invent them. On failure, STOP.
+6. Do not claim automatically. Tell me the claim deadline from step 2 and remind me to run this exact command myself from the same repository root, machine, and HOME:
+     npx -y -p @cantinasecurity/apex-cli@0.1.18 apex claim
+   It may open a browser so I can create or sign in to a Cantina account and keep the results. The account must not already own a personal Apex tenant; if it does, tell me to contact Cantina support before the claim deadline because CLI linking is not available yet.
+
+Never paste raw command transcripts. For any failure, report only the step, exit code, and sanitized error. Redact the trial code and every `apex_at_`, `apex_rt_`, or `apex_ct_` value from all reports.
+```
+
+Trial codes and claim tokens must never be logged, telemetered, printed in JSON
+output, placed in URLs, or sent through MCP tool calls. The MCP server does not
+expose redemption or claim tools. After terminal redemption, its read-only
+`apex-trial-status` tool can report local guest and claim deadlines without
+returning either secret.
+
 ## Interactive Shell
 
 Bare `apex` opens the interactive shell:
@@ -117,6 +210,7 @@ Supported shell commands:
 - `/status [scan-id]`
 - `/doctor`
 - `/update`
+- `/claim`
 - `/logout`
 - `/repos`
 - `/workspace`
@@ -151,6 +245,8 @@ Supported shell commands:
 - `apex status [--scan <scan-id>]`
 - `apex doctor`
 - `apex login`
+- `apex redeem <code> [--json] [--replace]`
+- `apex claim [--json] [--no-open]`
 - `apex logout`
 - `apex service-key create --name <name> [--company <id-or-handle>] [--scope <scope[,scope]>] [--expires-at <ISO-8601>] [--json]`
 - `apex service-key list [--company <id-or-handle>] [--json]`
@@ -254,7 +350,7 @@ Finding review collaboration now has explicit write commands:
 
 Identifiers such as `KERN2-25` are resolved against the selected or latest scan for the current workspace binding. Pass `--scan <scan-id>` when you need a specific scan, or pass the finding UUID directly to skip workspace-based resolution.
 
-Finding comments, valid/invalid feedback, and fix review scan starts use the same Apex login credentials as read commands. In MCP clients, `apex-auth-start` followed by `apex-auth-wait` is enough to authenticate these write tools.
+Finding comments, valid/invalid feedback, and fix review scan starts use the same Apex login credentials as read commands. In MCP clients, call `apex-auth-start`, then pass both its returned `deviceCode` and opaque `credentialGeneration` to `apex-auth-wait` to authenticate these write tools safely.
 
 Invalid feedback requires a dismissal reason. Valid feedback can include `--suggested-severity extreme|critical|high|medium|low|informational`.
 
@@ -382,6 +478,7 @@ Do not point an MCP client at plain `pnpm mcp`. `pnpm` writes its script banner
 The MCP server exposes Apex-specific tools for:
 
 - auth status and device login
+- local guest-session deadlines through `apex-trial-status` (never the code or claim token)
 - doctor, credits, and provider connection URLs
 - workspace inspection and workspace binding
 - scan start, status, cancellation, findings, and findings export
@@ -390,7 +487,7 @@ The MCP server exposes Apex-specific tools for:
 - finding comments and valid/invalid feedback with `apex-finding-comment` and `apex-finding-feedback`
 - Fix PR and current-repository fix review scans with `apex-finding-fix-review`, optionally after `apex-finding-feedback`
 
-The MCP server does not expose service-key creation, listing, or revocation. For HTTP-only serverless and cron integrations, use the [hosted Apex API](https://ai.cantina.xyz/docs/apex-api) directly instead of launching the stdio MCP server.
+The MCP server does not expose trial redemption, trial claim, or service-key creation, listing, or revocation. When a user supplies a Cantina trial code, run `apex redeem <code>` in a terminal instead of starting device login or putting the code in an MCP call. For HTTP-only serverless and cron integrations, use the [hosted Apex API](https://ai.cantina.xyz/docs/apex-api) directly instead of launching the stdio MCP server.
 
 For repository-scoped operations, pass `cwd` explicitly so the server can resolve the right `.apex/workspace.json` binding and repository roots.
 
@@ -419,7 +516,7 @@ APEX_TELEMETRY_DISABLED=1 apex scan
 
 Telemetry records lifecycle events such as command/tool start and completion, duration, success/failure category, CLI version, Node/platform basics, anonymous install/session IDs, and sanitized command metadata. It also adds attribution headers to Apex API requests, including surface (`cli`, `interactive_shell`, or `mcp`), client integration, invocation ID, command/tool name, and CLI version.
 
-Telemetry does not send raw cwd paths, repository URLs, finding IDs, scan IDs, PR URLs, comments, file paths, tokens, or raw flag values. Sensitive inputs are reduced to booleans, counts, enum values, or length buckets.
+Telemetry does not send raw cwd paths, repository URLs, finding IDs, scan IDs, PR URLs, comments, file paths, trial codes, claim tokens, onboarding fingerprints, bearer tokens, or raw flag values. Sensitive inputs are reduced to booleans, counts, enum values, or length buckets.
 
 Telemetry event posts do not include bearer tokens. The telemetry endpoint is `POST /api/cli/v1/telemetry/events` with a batch payload:
 
@@ -429,7 +526,7 @@ Telemetry event posts do not include bearer tokens. The telemetry endpoint is `P
     {
       "schemaVersion": 1,
       "event": "apex.invocation.completed",
-      "cliVersion": "0.1.17",
+      "cliVersion": "0.1.18",
       "invocation": {
         "surface": "mcp",
         "command": "apex-scan",
@@ -460,7 +557,7 @@ The npm package also includes marketplace-ready plugin artifacts:
 - `.claude-plugin/plugin.json` and `.mcp.claude.json` for Claude Code plugin installs
 - `.claude-plugin/marketplace.json` for a Claude marketplace entry backed by the public npm package
 
-These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.17 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
+These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.18 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
 
 The repository also includes `.agents/plugins/marketplace.json` for local Codex marketplace testing from a checkout.
 

package/dist/apex.js

@@ -1,6 +1,6 @@
 import { ApexApiClient, formatApiError } from "./api-client.js";
 import { parseArgs } from "./args.js";
-import { commandCancelScan, commandConnect, commandCredits, commandDoctor, commandExportFindings, commandFindingComment, commandFindingFeedback, commandFindingFixReview, commandFindings, commandLogin, commandLogout, commandScan, commandScans, commandServiceKeyCreate, commandServiceKeyList, commandServiceKeyRevoke, commandSetup, commandStatus, commandTelemetry, commandUpdate, commandWorkspace, commandWorkspaceUse, commandWorkspaces, } from "./commands.js";
+import { commandCancelScan, commandClaim, commandConnect, commandCredits, commandDoctor, commandExportFindings, commandFindingComment, commandFindingFeedback, commandFindingFixReview, commandFindings, commandLogin, commandLogout, commandRedeem, commandScan, commandScans, commandServiceKeyCreate, commandServiceKeyList, commandServiceKeyRevoke, commandSetup, commandStatus, commandTelemetry, commandUpdate, commandWorkspace, commandWorkspaceUse, commandWorkspaces, getRedeemExitCode, } from "./commands.js";
 import { CLI_HELP_TEXT } from "./help.js";
 import { runMcpServer } from "./mcp.js";
 import { runInteractiveShell } from "./shell.js";
@@ -36,6 +36,20 @@ async function dispatch(parsed) {
         case "login":
             await commandLogin(client, parsed.flags);
             return;
+        case "redeem": {
+            if (parsed.args.length > 0) {
+                throw new Error("Usage: apex redeem [trial-code] [--replace] [--json]");
+            }
+            const result = await commandRedeem(client, parsed.flags, parsed.subcommand);
+            process.exitCode = getRedeemExitCode(result);
+            return;
+        }
+        case "claim":
+            if (parsed.subcommand || parsed.args.length > 0) {
+                throw new Error("Usage: apex claim [--json] [--no-open]");
+            }
+            await commandClaim(client, cwd, parsed.flags);
+            return;
         case "logout":
             await commandLogout(client, parsed.flags);
             return;