@cantinasecurity/apex-cli 0.1.35 → 0.1.36

package/.claude/skills/apex-cli/SKILL.md

@@ -120,3 +120,36 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 - Use `apex-finding-tickets` to read existing links. CLI fallback: `apex findings link-ticket <finding-ref> <linear|jira> <issue-key|url> --json`, then `apex findings tickets <finding-ref> --json`.
 - Hosted MCP uses `findingId` (UUID) instead of `findingRef`, with no `cwd` or `scanId`. Linking requires explicit `findings:write`; listing requires `findings:read`. Default service-key scopes remain scans:create, scans:read, findings:read. Do not infer write permission from read access.
 - Apex verifies the ticket through the connected integration and records the frontend link; it does not create or modify a provider ticket. Repeating the same association is safe. A different existing link or in-progress export is a conflict: do not replace it or create another ticket as a fallback. For ambiguous Jira sites, use the full issue URL.
+
+### Workspace CVSS configuration
+
+Use `apex workspace use <workspace>` to bind the intended existing workspace, then
+`apex cvss get` to read its configuration and CVSS 3.1 policy template. To update it,
+write a JSON file containing exactly `enabled` (boolean) and `policy` (the edited
+template), then run `apex cvss set --file <configuration.json>`. Both commands emit
+JSON and require an existing device-login account; they never initiate login,
+create a workspace, or start a scan. Guest sessions are denied. `enabled: false`
+disables CVSS scoring while preserving the supplied policy. This configures future
+synthesis; it does not rescore historical findings.
+
+CVSS administration is intentionally scripted CLI only for this release. No shell,
+local MCP, hosted MCP, or organization service-key tool is added. Agents can invoke
+these explicit terminal commands. Server deployment requires Bedrock CVSS API support for CLI bearer authentication.
+
+Example (jq is used only to prepare the JSON file):
+
+```sh
+apex login
+apex workspace use "<workspace name or prefix>"
+apex cvss get > cvss-current.json
+jq '.configuration // {enabled: true, policy: .template}' cvss-current.json > cvss.json
+# Edit cvss.json, then save and verify:
+apex cvss set --file cvss.json
+apex cvss get
+```
+
+Keep `policy.version` at `3.1`. Supply a name, instructions, and all eight metrics
+(AV, AC, PR, UI, S, C, I, A). Each metric has an `options` map with at least one
+allowed value and nonempty guidance for each allowed value. Omit disallowed
+values. If Audit Setup or another workspace update is active, wait for it to
+finish before saving again.

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Cantina agent plugins for security review workflows.",
-    "version": "0.1.35"
+    "version": "0.1.36"
   },
   "plugins": [
     {
@@ -14,10 +14,10 @@
       "source": {
         "source": "npm",
         "package": "@cantinasecurity/apex-cli",
-        "version": "0.1.35"
+        "version": "0.1.36"
       },
       "description": "Run Apex security scans and review findings from Claude Code.",
-      "version": "0.1.35",
+      "version": "0.1.36",
       "author": {
         "name": "Cantina",
         "email": "support@cantina.xyz"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "Run Apex security scans and review findings from Claude Code.",
   "author": {
     "name": "Cantina",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "Run Apex security scans and review findings from Codex.",
   "author": {
     "name": "Cantina",

package/.mcp.claude.json

@@ -5,7 +5,7 @@
       "args": [
         "-y",
         "-p",
-        "@cantinasecurity/apex-cli@0.1.35",
+        "@cantinasecurity/apex-cli@0.1.36",
         "apex-mcp"
       ],
       "env": {

package/.mcp.codex.json

@@ -4,7 +4,7 @@
     "args": [
       "-y",
       "-p",
-      "@cantinasecurity/apex-cli@0.1.35",
+      "@cantinasecurity/apex-cli@0.1.36",
       "apex-mcp"
     ],
     "env": {

package/MARKETPLACE.md

@@ -13,7 +13,7 @@ This package is prepared as both a Claude Code plugin and a Codex plugin. The pu
 The plugin MCP configs launch the pinned npm CLI package with:
 
 ```bash
-npx -y -p @cantinasecurity/apex-cli@0.1.35 apex-mcp
+npx -y -p @cantinasecurity/apex-cli@0.1.36 apex-mcp
 ```
 
 That keeps marketplace installs independent of a user's global `apex` install.

package/README.md

@@ -158,30 +158,30 @@ unclaimed local trial proof so `apex claim` can still use it.
 Agent-safe copy/paste prompt (substitute the issued code):
 
 ```text
-Install and run Cantina Apex CLI 0.1.35 to start one free standard security scan of this repository immediately.
+Install and run Cantina Apex CLI 0.1.36 to start one free standard security scan of this repository immediately.
 
 Use this trial code only where <TRIAL_CODE> appears below: SPBT-DEVREL-XXXXXXXX
 
 Run the commands yourself from the repository root; do not stop after setup or only explain the steps. Use terminal CLI commands only. Do not use an Apex MCP tool or run `apex setup`, `apex mcp`, `apex login`, `apex-auth-start`, or `apex-auth-wait`. Never use `--replace` or `--force`.
 
 Use this exact command prefix for every Apex command:
-  npx -y -p @cantinasecurity/apex-cli@0.1.35 apex
+  npx -y -p @cantinasecurity/apex-cli@0.1.36 apex
 
 1. Before redeeming, confirm every command will use the same persistent, user-accessible machine or container, HOME, filesystem, and repository root. Confirm Node.js 20+ and npx are available. If `APEX_BASE_URL` is set, continue only when its origin is `https://ai.cantina.xyz`. Run the exact prefix with `--help` and continue only if help lists both `redeem` and `claim`. If any check fails, STOP before sending the code; do not install system packages.
 2. Redeem, with at most one response-loss recovery retry:
-     npx -y -p @cantinasecurity/apex-cli@0.1.35 apex redeem <TRIAL_CODE> --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.36 apex redeem <TRIAL_CODE> --json
    This terminal command is the only allowed tool call containing the code. Never echo or restate the code, store it in a file or environment variable, put it in a URL or MCP call, or include it in your response. Parse the JSON from stdout only; do not merge stderr into stdout, because npm may write warnings to stderr. Continue when the command exits 0 and stdout is JSON with `redeemed: true` and `outcome` equal to `redeemed` or `idempotent`. `idempotent` means the existing guest session resumed and it may already own a workspace. If and only if the first attempt ends with an ambiguous transport/connection failure or an interrupted/missing response and no typed server error code, retry this exact same command once on the same machine, HOME, and repository root. Never retry a typed server rejection and never make more than one recovery retry. If the allowed retry does not return a successful JSON outcome, STOP.
 3. Immediately start exactly one scan; do not wait for another instruction:
-     npx -y -p @cantinasecurity/apex-cli@0.1.35 apex scan --mode standard --non-interactive --no-open --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.36 apex scan --mode standard --non-interactive --no-open --json
    The CLI validates the complete guest local archive before it reserves a workspace. An unbound renamed checkout may recover only the sole empty guest workspace when no explicit workspace name was supplied. On any error or nonzero exit, STOP. After a successful scan JSON response, inspect `localPersistence.workspaceBindingSaved`. If it is `false`, the server scan already started: capture and report `binding.lastScanId`, then STOP; do not run status or findings until local repository permissions are repaired. Otherwise capture `binding.lastScanId` from the JSON as <SCAN_ID>; if it is absent, STOP.
 4. About every 60 seconds, poll that exact scan:
-     npx -y -p @cantinasecurity/apex-cli@0.1.35 apex status --scan <SCAN_ID> --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.36 apex status --scan <SCAN_ID> --json
    Read `progress.progress.status`. Wait while it is `created`, `pending`, `queued`, `starting`, `running`, `in_progress`, or `processing`. Continue on `completed`. STOP on `failed`, `cancelled`, a missing or unknown status, or a command failure.
 5. Fetch that exact scan's findings:
-     npx -y -p @cantinasecurity/apex-cli@0.1.35 apex findings --scan <SCAN_ID> --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.36 apex findings --scan <SCAN_ID> --json
    On success, summarize findings by severity, most severe first, including identifier, title, status, and confidence. This command does not return file locations, so do not invent them. On failure, STOP.
 6. Do not claim automatically. Tell me the claim deadline from step 2 and remind me to run this exact command myself from the same repository root, machine, and HOME:
-     npx -y -p @cantinasecurity/apex-cli@0.1.35 apex claim
+     npx -y -p @cantinasecurity/apex-cli@0.1.36 apex claim
    It may open a browser so I can create or sign in to a Cantina account and keep the results. Claim moves the trial into the currently selected Cantina workspace when I can run scans there, or into my existing personal workspace. If the selected workspace cannot run scans, tell me to switch to one that can and retry before the claim deadline.
 
 Never paste raw command transcripts. For any failure, report only the step, exit code, and sanitized error. Redact the trial code and every `apex_at_`, `apex_rt_`, or `apex_ct_` value from all reports.
@@ -266,6 +266,8 @@ Supported shell commands:
 - `apex workspaces`
 - `apex workspace`
 - `apex workspace use <workspace-name|workspace-prefix|workspace-id>`
+- `apex cvss get`
+- `apex cvss set --file <configuration.json>`
 - `apex cancel-scan [scan-id]`
 - `apex status [--scan <scan-id>]`
 - `apex doctor`
@@ -667,7 +669,7 @@ Telemetry event posts do not include bearer tokens. The telemetry endpoint is `P
     {
       "schemaVersion": 1,
       "event": "apex.invocation.completed",
-      "cliVersion": "0.1.35",
+      "cliVersion": "0.1.36",
       "invocation": {
         "surface": "mcp",
         "command": "apex-scan",
@@ -698,7 +700,7 @@ The npm package also includes marketplace-ready plugin artifacts:
 - `.claude-plugin/plugin.json` and `.mcp.claude.json` for Claude Code plugin installs
 - `.claude-plugin/marketplace.json` for a Claude marketplace entry backed by the public npm package
 
-These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.35 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
+These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.36 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
 
 The repository also includes `.agents/plugins/marketplace.json` for local Codex marketplace testing from a checkout.
 
@@ -735,3 +737,36 @@ To move between existing Apex workspaces from the CLI:
 3. If the workspace name contains spaces, quote it, for example `apex workspace use "Core Platform"`.
 4. Use `apex scans`, `apex status --scan <scan-id>`, `apex findings`, and `apex export findings` against that binding.
 5. Use `apex findings --workspace --company <handle> --workspace-ref <ref> --finding-state open` for the workspace browser's cross-scan findings that still need review, without changing the local binding.
+
+### Workspace CVSS configuration
+
+Use `apex workspace use <workspace>` to bind the intended existing workspace, then
+`apex cvss get` to read its configuration and CVSS 3.1 policy template. To update it,
+write a JSON file containing exactly `enabled` (boolean) and `policy` (the edited
+template), then run `apex cvss set --file <configuration.json>`. Both commands emit
+JSON and require an existing device-login account; they never initiate login,
+create a workspace, or start a scan. Guest sessions are denied. `enabled: false`
+disables CVSS scoring while preserving the supplied policy. This configures future
+synthesis; it does not rescore historical findings.
+
+CVSS administration is intentionally scripted CLI only for this release. No shell,
+local MCP, hosted MCP, or organization service-key tool is added. Agents can invoke
+these explicit terminal commands. Server deployment requires Bedrock CVSS API support for CLI bearer authentication.
+
+Example (jq is used only to prepare the JSON file):
+
+```sh
+apex login
+apex workspace use "<workspace name or prefix>"
+apex cvss get > cvss-current.json
+jq '.configuration // {enabled: true, policy: .template}' cvss-current.json > cvss.json
+# Edit cvss.json, then save and verify:
+apex cvss set --file cvss.json
+apex cvss get
+```
+
+Keep `policy.version` at `3.1`. Supply a name, instructions, and all eight metrics
+(AV, AC, PR, UI, S, C, I, A). Each metric has an `options` map with at least one
+allowed value and nonempty guidance for each allowed value. Omit disallowed
+values. If Audit Setup or another workspace update is active, wait for it to
+finish before saving again.

package/dist/apex.js

@@ -1,3 +1,4 @@
+import { commandCvss } from "./cvss.js";
 import { commandStartThreatModel, commandThreatModel, hasAuditSetupBeta, threatModelExitCode, terminalText } from "./threat-model.js";
 import { getMe } from "./auth.js";
 import { ApexApiClient, formatApiError } from "./api-client.js";
@@ -94,6 +95,11 @@ async function dispatch(parsed) {
         case "workspaces":
             await commandWorkspaces(client, cwd, parsed.flags);
             return;
+        case "cvss":
+            if (parsed.args.length)
+                throw new Error("Unexpected CVSS arguments");
+            await commandCvss(client, cwd, parsed.flags, parsed.subcommand);
+            return;
         case "workspace":
             if (parsed.subcommand === "use") {
                 const workspaceRef = parsed.args.join(" ");

package/dist/cvss.js

@@ -0,0 +1,49 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { getMe } from "./auth.js";
+import { getFlagString } from "./args.js";
+import { printJson } from "./output.js";
+import { loadWorkspaceBinding } from "./workspace-binding.js";
+const inputSchema = z
+    .object({
+    enabled: z.boolean(),
+    policy: z.record(z.string(), z.unknown()),
+})
+    .strict();
+export async function commandCvss(client, cwd, flags, action) {
+    const file = getFlagString(flags, "file");
+    if (!["get", "set"].includes(action ?? "") ||
+        (action === "set" ? !file : file))
+        throw new Error("Usage: apex cvss get | apex cvss set --file <configuration.json>");
+    if (flags.company || flags["workspace-name"] || flags["workspace-ref"])
+        throw new Error("CVSS uses the bound workspace. Run `apex workspace use <workspace>` first.");
+    const binding = await loadWorkspaceBinding(cwd);
+    if (!binding)
+        throw new Error("Run `apex workspace use <workspace>` before configuring CVSS.");
+    let input;
+    if (action === "set") {
+        const raw = await readFile(path.resolve(cwd, file), "utf8");
+        if (Buffer.byteLength(raw) > 128 * 1024)
+            throw new Error("CVSS configuration is too large.");
+        input = inputSchema.parse(JSON.parse(raw));
+    }
+    const me = await getMe(client);
+    if (!me)
+        throw new Error("Run `apex login` before configuring CVSS.");
+    if ((await client.getCredentials())?.guest ||
+        me.user.role?.trim().toLowerCase() === "guest")
+        throw new Error("CVSS configuration requires a signed-in account.");
+    const response = await client.request(`/api/workspaces/${encodeURIComponent(binding.workspaceId)}/cvss`, action === "set" ? { method: "PUT", json: input } : {});
+    const payload = {
+        configuration: response.configuration
+            ? {
+                enabled: response.configuration.enabled,
+                policy: response.configuration.policy,
+            }
+            : null,
+        template: response.template,
+    };
+    printJson(payload);
+    return payload;
+}

package/dist/help.js

@@ -18,6 +18,8 @@ export const CLI_HELP_TEXT = `Usage:
                                     Start a fix review scan for a Fix PR or current repository
   apex export findings              Export findings for the latest or selected scan
   apex workspaces                   List accessible workspaces for the active company
+  apex cvss get                     Read workspace CVSS configuration and template (JSON)
+  apex cvss set --file <json>        Update the bound workspace CVSS 3.1 rubric
   apex workspace                    Show the workspace currently bound to this directory
   apex workspace use <workspace-name|workspace-prefix|workspace-id>
                                     Bind this directory to an existing Apex workspace

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cantinasecurity/apex-cli",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "Standalone CLI and MCP server for Apex.",
   "private": false,
   "type": "module",

package/skills/apex-cli/SKILL.md

@@ -120,3 +120,36 @@ verify `apex-credits` without printing the credential.
 - Use `apex-finding-tickets` to read existing links. CLI fallback: `apex findings link-ticket <finding-ref> <linear|jira> <issue-key|url> --json`, then `apex findings tickets <finding-ref> --json`.
 - Hosted MCP uses `findingId` (UUID) instead of `findingRef`, with no `cwd` or `scanId`. Linking requires explicit `findings:write`; listing requires `findings:read`. Default service-key scopes remain scans:create, scans:read, findings:read. Do not infer write permission from read access.
 - Apex verifies the ticket through the connected integration and records the frontend link; it does not create or modify a provider ticket. Repeating the same association is safe. A different existing link or in-progress export is a conflict: do not replace it or create another ticket as a fallback. For ambiguous Jira sites, use the full issue URL.
+
+### Workspace CVSS configuration
+
+Use `apex workspace use <workspace>` to bind the intended existing workspace, then
+`apex cvss get` to read its configuration and CVSS 3.1 policy template. To update it,
+write a JSON file containing exactly `enabled` (boolean) and `policy` (the edited
+template), then run `apex cvss set --file <configuration.json>`. Both commands emit
+JSON and require an existing device-login account; they never initiate login,
+create a workspace, or start a scan. Guest sessions are denied. `enabled: false`
+disables CVSS scoring while preserving the supplied policy. This configures future
+synthesis; it does not rescore historical findings.
+
+CVSS administration is intentionally scripted CLI only for this release. No shell,
+local MCP, hosted MCP, or organization service-key tool is added. Agents can invoke
+these explicit terminal commands. Server deployment requires Bedrock CVSS API support for CLI bearer authentication.
+
+Example (jq is used only to prepare the JSON file):
+
+```sh
+apex login
+apex workspace use "<workspace name or prefix>"
+apex cvss get > cvss-current.json
+jq '.configuration // {enabled: true, policy: .template}' cvss-current.json > cvss.json
+# Edit cvss.json, then save and verify:
+apex cvss set --file cvss.json
+apex cvss get
+```
+
+Keep `policy.version` at `3.1`. Supply a name, instructions, and all eight metrics
+(AV, AC, PR, UI, S, C, I, A). Each metric has an `options` map with at least one
+allowed value and nonempty guidance for each allowed value. Omit disallowed
+values. If Audit Setup or another workspace update is active, wait for it to
+finish before saving again.