@cantinasecurity/apex-cli 0.1.38 → 0.1.39

package/.claude/skills/apex-cli/SKILL.md

@@ -76,7 +76,7 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 - `apex scan` scans the current working directory by default; pass `--repo` only when the user asks to scan explicit alternate roots.
 - `apex-doctor` is read-only for guest sessions and reports the local snapshot plan without reserving a workspace. For account sessions it reports whether Apex will use remote materialization or a local snapshot upload for each selected source.
 - Plain local directories and dirty git worktrees can scan through local snapshot uploads without provider access.
-- Audit scans use `--mode audit` in user-facing CLI calls and request payloads. The legacy `ultra` mode remains accepted as an alias, but audit scans still require provider-backed GitHub or GitLab sources.
+- Audit scans use `--mode audit` in user-facing CLI calls and request payloads. The legacy `ultra` mode remains accepted as an alias, but audit scans still require provider-backed GitHub, GitLab or company-enabled Forgejo sources.
 - Lite scans use `--mode lite` in CLI calls or `mode: "lite"` in MCP, require Lite Scan beta access, and require provider-backed GitHub or GitLab sources without local snapshot fallback.
 - PR scans use `--mode pr --pr <number>` in CLI calls, or `mode: "pr"` with `pullRequests` in MCP. They require one provider-backed GitHub repository.
 - Starting a PR scan may run alongside active workspace scans and does not require `--force` or `force: true`. Starting any non-PR scan still treats every active scan, including a PR scan, as a blocker; use force only when the user explicitly wants that overlap.
@@ -155,7 +155,7 @@ values. If Audit Setup or another workspace update is active, wait for it to
 finish before saving again.
 
 Scan target and recovery rules:
-- CLI `apex scan [target...]` and repeatable `--repo` accept exact files, directories, or HTTPS GitHub/GitLab repository URLs; local MCP uses `repoPaths` for the same selections. No target means `cwd`.
+- CLI `apex scan [target...]` and repeatable `--repo` accept exact files, directories, or HTTPS GitHub/GitLab or company-enabled Forgejo repository URLs; local MCP uses `repoPaths` for the same selections. No target means `cwd`.
 - A file selection scans only that file, respecting ignore rules. Local snapshots exclude `.apex/` state. Remote URLs use the default branch and cannot fall back to uploading `cwd`; clone locally to choose a branch or commit.
 - Use Standard for local changes, files, plain directories, and public repositories without provider access. Lite and Audit still require connected provider sources; do not silently substitute another mode.
 - Unauthenticated headless CLI commands fail with explicit login guidance; they never start device login. Use the MCP auth tools for explicit MCP login. Retry transient refresh failures without clearing credentials.
@@ -169,3 +169,9 @@ Finding lifecycle:
 - Read `remediationStatus` in workspace finding lists for the current lifecycle; `status` remains the scanner verdict. `open` and `acknowledged` stay distinct even though both use the `accepted` review state.
 - Use the finding updatedAt as expectedUpdatedAt when working from a prior snapshot. On FINDING_STATUS_CONFLICT, reload and review before retrying.
 - Linear sync is Linear-to-Apex: started becomes acknowledged, completed becomes fixed. Do not promise Apex-to-Linear status updates or automatic Linear reopening.
+
+## Forgejo
+
+Forgejo connections, remote repository scans, PR scans and Fix Review require the Forgejo company feature enabled by an administrator in Bedrock Settings. Run `apex connect forgejo` (or `apex-connect-provider` with `provider: "forgejo"`) to obtain the browser connection URL. A dedicated bot, HTTPS instance URL and repository-scoped read token are required; PR statuses, comments and webhook installation also require a write token.
+
+After connecting, run `apex doctor --repo . --source-mode remote`, then `apex scan --mode standard --repo . --source-mode remote` or `apex scan --mode pr --pr 42 --repo .`. Same-repository Forgejo PR URLs use `/owner/repository/pulls/42`. Pass a Forgejo Fix PR URL through finding feedback and start Fix Review using the existing finding commands or MCP tools. Disabling the company flag stops native Forgejo access. Existing local Standard snapshots remain provider-independent.

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Cantina agent plugins for security review workflows.",
-    "version": "0.1.38"
+    "version": "0.1.39"
   },
   "plugins": [
     {
@@ -14,10 +14,10 @@
       "source": {
         "source": "npm",
         "package": "@cantinasecurity/apex-cli",
-        "version": "0.1.38"
+        "version": "0.1.39"
       },
       "description": "Run Apex security scans and review findings from Claude Code.",
-      "version": "0.1.38",
+      "version": "0.1.39",
       "author": {
         "name": "Cantina",
         "email": "support@cantina.xyz"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "description": "Run Apex security scans and review findings from Claude Code.",
   "author": {
     "name": "Cantina",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "description": "Run Apex security scans and review findings from Codex.",
   "author": {
     "name": "Cantina",

package/.mcp.claude.json

@@ -5,7 +5,7 @@
       "args": [
         "-y",
         "-p",
-        "@cantinasecurity/apex-cli@0.1.38",
+        "@cantinasecurity/apex-cli@0.1.39",
         "apex-mcp"
       ],
       "env": {

package/.mcp.codex.json

@@ -4,7 +4,7 @@
     "args": [
       "-y",
       "-p",
-      "@cantinasecurity/apex-cli@0.1.38",
+      "@cantinasecurity/apex-cli@0.1.39",
       "apex-mcp"
     ],
     "env": {

package/MARKETPLACE.md

@@ -13,7 +13,7 @@ This package is prepared as both a Claude Code plugin and a Codex plugin. The pu
 The plugin MCP configs launch the pinned npm CLI package with:
 
 ```bash
-npx -y -p @cantinasecurity/apex-cli@0.1.38 apex-mcp
+npx -y -p @cantinasecurity/apex-cli@0.1.39 apex-mcp
 ```
 
 That keeps marketplace installs independent of a user's global `apex` install.

package/README.md

@@ -158,30 +158,30 @@ unclaimed local trial proof so `apex claim` can still use it.
 Agent-safe copy/paste prompt (substitute the issued code):
 
 ```text
-Install and run Cantina Apex CLI 0.1.38 to start one free standard security scan of this repository immediately.
+Install and run Cantina Apex CLI 0.1.39 to start one free standard security scan of this repository immediately.
 
 Use this trial code only where <TRIAL_CODE> appears below: SPBT-DEVREL-XXXXXXXX
 
 Run the commands yourself from the repository root; do not stop after setup or only explain the steps. Use terminal CLI commands only. Do not use an Apex MCP tool or run `apex setup`, `apex mcp`, `apex login`, `apex-auth-start`, or `apex-auth-wait`. Never use `--replace` or `--force`.
 
 Use this exact command prefix for every Apex command:
-  npx -y -p @cantinasecurity/apex-cli@0.1.38 apex
+  npx -y -p @cantinasecurity/apex-cli@0.1.39 apex
 
 1. Before redeeming, confirm every command will use the same persistent, user-accessible machine or container, HOME, filesystem, and repository root. Confirm Node.js 20+ and npx are available. If `APEX_BASE_URL` is set, continue only when its origin is `https://ai.cantina.xyz`. Run the exact prefix with `--help` and continue only if help lists both `redeem` and `claim`. If any check fails, STOP before sending the code; do not install system packages.
 2. Redeem, with at most one response-loss recovery retry:
-     npx -y -p @cantinasecurity/apex-cli@0.1.38 apex redeem <TRIAL_CODE> --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex redeem <TRIAL_CODE> --json
    This terminal command is the only allowed tool call containing the code. Never echo or restate the code, store it in a file or environment variable, put it in a URL or MCP call, or include it in your response. Parse the JSON from stdout only; do not merge stderr into stdout, because npm may write warnings to stderr. Continue when the command exits 0 and stdout is JSON with `redeemed: true` and `outcome` equal to `redeemed` or `idempotent`. `idempotent` means the existing guest session resumed and it may already own a workspace. If and only if the first attempt ends with an ambiguous transport/connection failure or an interrupted/missing response and no typed server error code, retry this exact same command once on the same machine, HOME, and repository root. Never retry a typed server rejection and never make more than one recovery retry. If the allowed retry does not return a successful JSON outcome, STOP.
 3. Immediately start exactly one scan; do not wait for another instruction:
-     npx -y -p @cantinasecurity/apex-cli@0.1.38 apex scan --mode standard --non-interactive --no-open --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex scan --mode standard --non-interactive --no-open --json
    The CLI validates the complete guest local archive before it reserves a workspace. An unbound renamed checkout may recover only the sole empty guest workspace when no explicit workspace name was supplied. On any error or nonzero exit, STOP. After a successful scan JSON response, inspect `localPersistence.workspaceBindingSaved`. If it is `false`, the server scan already started: capture and report `binding.lastScanId`, then STOP; do not run status or findings until local repository permissions are repaired. Otherwise capture `binding.lastScanId` from the JSON as <SCAN_ID>; if it is absent, STOP.
 4. About every 60 seconds, poll that exact scan:
-     npx -y -p @cantinasecurity/apex-cli@0.1.38 apex status --scan <SCAN_ID> --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex status --scan <SCAN_ID> --json
    Read `progress.progress.status`. Wait while it is `created`, `pending`, `queued`, `starting`, `running`, `in_progress`, or `processing`. Continue on `completed`. STOP on `failed`, `cancelled`, a missing or unknown status, or a command failure.
 5. Fetch that exact scan's findings:
-     npx -y -p @cantinasecurity/apex-cli@0.1.38 apex findings --scan <SCAN_ID> --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex findings --scan <SCAN_ID> --json
    On success, summarize findings by severity, most severe first, including identifier, title, status, and confidence. This command does not return file locations, so do not invent them. On failure, STOP.
 6. Do not claim automatically. Tell me the claim deadline from step 2 and remind me to run this exact command myself from the same repository root, machine, and HOME:
-     npx -y -p @cantinasecurity/apex-cli@0.1.38 apex claim
+     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex claim
    It may open a browser so I can create or sign in to a Cantina account and keep the results. Claim moves the trial into the currently selected Cantina workspace when I can run scans there, or into my existing personal workspace. If the selected workspace cannot run scans, tell me to switch to one that can and retry before the claim deadline.
 
 Never paste raw command transcripts. For any failure, report only the step, exit code, and sanitized error. Redact the trial code and every `apex_at_`, `apex_rt_`, or `apex_ct_` value from all reports.
@@ -262,8 +262,8 @@ Supported shell commands:
 - `apex findings link-ticket <finding-ref> <linear|jira> <issue-key|url> [--scan <scan-id>] [--json]`
 - `apex findings comment <finding-id|finding-identifier> --content <markdown> [--parent-comment <comment-id>] [--scan <scan-id>]`
 - `apex findings status <finding-ref> <open|fixed|acknowledged|in_review|pending_merge|false_positive|wont_fix|skipped> [--note <rationale>] [--expected-updated-at <timestamp>] [--scan <scan-id>]`
-- `apex findings feedback <finding-id|finding-identifier> <valid|invalid> [comment] [--comment <markdown>] [--scan <scan-id>] [--suggested-severity extreme|critical|high|medium|low|informational] [--dismissal-reason false-positive|by-design|not-relevant] [--label acknowledged|fixed] [--fix-pr-url <github-pr-url>]`
-- `apex findings fix-review <finding-id|finding-identifier> [--scan <scan-id>] [--review-target pull-request|repository-current] [--fix-pr-url <github-pr-url>]`
+- `apex findings feedback <finding-id|finding-identifier> <valid|invalid> [comment] [--comment <markdown>] [--scan <scan-id>] [--suggested-severity extreme|critical|high|medium|low|informational] [--dismissal-reason false-positive|by-design|not-relevant] [--label acknowledged|fixed] [--fix-pr-url <fix-pr-url>]`
+- `apex findings fix-review <finding-id|finding-identifier> [--scan <scan-id>] [--review-target pull-request|repository-current] [--fix-pr-url <fix-pr-url>]`
 - `apex export findings [--scan <scan-id>] [--format markdown|json|gitlab-sast] [--output <path>]`
 - `apex workspaces`
 - `apex workspace`
@@ -468,7 +468,7 @@ Local MCP exposes `apex-finding-link-ticket` with `findingRef`, `provider`, `iss
 
 ## Local Source Scans
 
-`apex scan [target...]` accepts files, directories, and HTTPS GitHub/GitLab repository URLs. With no targets, it scans the current working directory:
+`apex scan [target...]` accepts files, directories, and HTTPS GitHub/GitLab or company-enabled Forgejo repository URLs. With no targets, it scans the current working directory:
 
 ```bash
 apex scan . --mode standard
@@ -481,7 +481,7 @@ A file target uploads only that file, never its siblings. Local snapshots includ
 
 Source planning:
 
-- clean GitHub or GitLab checkouts can stay on the remote-materialization path
+- clean GitHub, GitLab or company-enabled Forgejo checkouts can stay on the remote-materialization path
 - dirty git worktrees fall back to a local snapshot upload by default
 - plain directories that are not git repositories are scanned through a local snapshot upload
 
@@ -490,20 +490,20 @@ Useful flags:
 - `--repo <path-or-url>` as a repeatable alternative to positional targets
 - `--source-mode auto|remote|local` to control remote-first fallback behavior
 - `--mode standard|audit|lite|pr` to choose the scan mode
-- `--pr <number>` to select one or more GitHub pull requests for `--mode pr`
+- `--pr <number>` to select one or more GitHub or enabled Forgejo pull requests for `--mode pr`
 - `--pr <number:path,path>` or `--pr-path <path>` to limit a PR scan to changed paths
 
 Unauthenticated `--json`, `--non-interactive`, and non-TTY commands fail immediately with `apex login` guidance. Run login explicitly before automation. Temporary refresh/network failures preserve credentials; retry after the service recovers. Provider connection commands return URLs without opening browsers in automation.
 
 `auto` is the default. `remote` requires Apex to materialize from a remote repository. `local` forces a local snapshot upload even when a clean remote path is available.
 
-Audit scans use `audit` as the scan mode and still require provider-backed GitHub or GitLab repositories that Apex can materialize remotely without a local snapshot fallback. `ultra` remains accepted as a backwards-compatible alias.
+Audit scans use `audit` as the scan mode and still require provider-backed GitHub, GitLab or company-enabled Forgejo repositories that Apex can materialize remotely without a local snapshot fallback. `ultra` remains accepted as a backwards-compatible alias.
 
 Lite scans use `lite` as the scan mode and require the Lite Scan beta feature plus provider-backed GitHub or GitLab repositories that Apex can materialize remotely. Local snapshot uploads are not supported for Lite scans.
 
 If a backend returns `AUDIT_SETUP_REQUIRED`, the error includes a setup command for the selected workspace. This explicit beta workflow uses the workspace's saved repositories and context; it does not preserve positional file or directory selections. Do not automatically substitute it for a local target scan. An explicit Standard source scan requires current CLI and backend versions. Eligible accounts receive setup commands in CLI help; draft operations use the ID returned by preparation. Lite and PR scans do not use `--setup`.
 
-PR scans require exactly one provider-backed GitHub repository. If the current directory resolves to multiple sources, pass `--repo <path>` to select the one that contains the pull request.
+PR scans require exactly one provider-backed GitHub or company-enabled, connected Forgejo repository. If the current directory resolves to multiple sources, pass `--repo <path>` to select the one that contains the pull request.
 
 CLI and MCP scan results use the public Bedrock `scanId`. Kernel execution IDs are internal implementation details and are neither returned nor accepted as scan aliases.
 
@@ -687,7 +687,7 @@ Telemetry event posts do not include bearer tokens. The telemetry endpoint is `P
     {
       "schemaVersion": 1,
       "event": "apex.invocation.completed",
-      "cliVersion": "0.1.38",
+      "cliVersion": "0.1.39",
       "invocation": {
         "surface": "mcp",
         "command": "apex-scan",
@@ -718,7 +718,7 @@ The npm package also includes marketplace-ready plugin artifacts:
 - `.claude-plugin/plugin.json` and `.mcp.claude.json` for Claude Code plugin installs
 - `.claude-plugin/marketplace.json` for a Claude marketplace entry backed by the public npm package
 
-These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.38 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
+These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.39 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
 
 The repository also includes `.agents/plugins/marketplace.json` for local Codex marketplace testing from a checkout.
 
@@ -820,3 +820,9 @@ Reload and review the latest state before retrying a conflict.
 Linear sync currently runs from Linear to Apex: started tickets become acknowledged
 and completed tickets become fixed. Apex status changes do not update linked Linear
 or Jira tickets. Use the direct status operation to manage issues from MCP or REST.
+
+## Forgejo
+
+Forgejo connections, remote repository scans, PR scans and Fix Review require the Forgejo company feature enabled by an administrator in Bedrock Settings. Run `apex connect forgejo` (or `apex-connect-provider` with `provider: "forgejo"`) to obtain the browser connection URL. A dedicated bot, HTTPS instance URL and repository-scoped read token are required; PR statuses, comments and webhook installation also require a write token.
+
+After connecting, run `apex doctor --repo . --source-mode remote`, then `apex scan --mode standard --repo . --source-mode remote` or `apex scan --mode pr --pr 42 --repo .`. Same-repository Forgejo PR URLs use `/owner/repository/pulls/42`. Pass a Forgejo Fix PR URL through finding feedback and start Fix Review using the existing finding commands or MCP tools. Disabling the company flag stops native Forgejo access. Existing local Standard snapshots remain provider-independent.

package/dist/apex.js

@@ -182,8 +182,8 @@ async function dispatch(parsed) {
             await commandStatus(client, cwd, parsed.flags);
             return;
         case "connect":
-            if (parsed.subcommand !== "github" && parsed.subcommand !== "gitlab") {
-                throw new Error("Usage: apex connect <github|gitlab>");
+            if (parsed.subcommand !== "github" && parsed.subcommand !== "gitlab" && parsed.subcommand !== "forgejo") {
+                throw new Error("Usage: apex connect <github|gitlab|forgejo>");
             }
             await commandConnect(client, cwd, parsed.flags, parsed.subcommand);
             return;

package/dist/commands.js

@@ -1,3 +1,4 @@
+import { parseForgejoPullRequestUrl } from "./forgejo-url.js";
 import { canPromptInteractively, getFlagList, getFlagString, isJsonMode, } from "./args.js";
 import { getMe, login, logout } from "./auth.js";
 import { ApiError, formatApiError, getApiErrorCode, } from "./api-client.js";
@@ -371,6 +372,10 @@ function normalizeRepositoryUrl(value) {
     return value.replace(/\.git$/i, "").replace(/\/+$/, "").toLowerCase();
 }
 function parseGithubPullRequestUrl(value) {
+    const forgejoWithPaths = value.match(/^(https?:\/\/[^\s]+\/pulls\/\d+):(.+)$/);
+    const forgejo = parseForgejoPullRequestUrl(forgejoWithPaths?.[1] ?? value);
+    if (forgejo)
+        return { number: forgejo.prNumber, repoUrl: forgejo.baseUrl + "/" + forgejo.repoName + ".git", pathFilterValue: forgejoWithPaths?.[2] ?? null };
     const withPathFilter = value.match(/^(https?:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/\d+):(.+)$/i);
     const urlValue = withPathFilter?.[1] ?? value;
     const match = urlValue.match(/^https?:\/\/github\.com\/([^/\s]+)\/([^/\s]+)\/pull\/(\d+)(?:[/?#].*)?$/i);
@@ -457,10 +462,12 @@ function resolvePrScanSource(repositories) {
         throw new Error("PR scans require exactly one GitHub repository. Re-run with --repo to select a single source root.");
     }
     const source = repositories[0];
-    if (source.provider !== "github") {
-        throw new Error("PR scans require a provider-backed GitHub repository.");
+    if (source.provider !== "github" && source.provider !== "forgejo") {
+        throw new Error("PR scans require a provider-backed GitHub repository or an enabled Forgejo repository.");
     }
-    if (typeof source.installationId !== "number") {
+    if (source.provider === "forgejo" && (!source.connectionId || !source.projectId || !source.baseUrl))
+        throw new Error("PR scans require a connected Forgejo repository.");
+    if (source.provider === "github" && typeof source.installationId !== "number") {
         throw new Error("PR scans require GitHub App installation access for the selected repository.");
     }
     return source;
@@ -481,9 +488,10 @@ function formatMissingProviderConnections(missing) {
 function buildPrScanRepositoriesPayload(params) {
     return [
         {
-            provider: "github",
+            provider: params.source.provider,
             repoUrl: params.source.repoUrl,
             installationId: params.source.installationId,
+            ...(params.source.provider === "forgejo" ? { connectionId: params.source.connectionId, projectId: params.source.projectId, baseUrl: params.source.baseUrl } : {}),
             sourceType: "pr",
             pullRequests: params.pullRequests.map((pullRequest) => ({
                 number: pullRequest.number,
@@ -508,7 +516,7 @@ function buildPrScanPlannedSource(source) {
         displayName: getPrScanSourceDisplayName(source),
         relativePath: source.path || ".",
         sourceKind: "remote_repo",
-        provider: "github",
+        provider: source.provider,
         repoUrl: source.repoUrl,
         ref: {
             type: "default",
@@ -518,7 +526,7 @@ function buildPrScanPlannedSource(source) {
         connectionId: source.connectionId ?? null,
         projectId: source.projectId ?? null,
         baseUrl: source.baseUrl ?? null,
-        materializationAuth: "installation",
+        materializationAuth: source.provider === "forgejo" ? "connection" : "installation",
     };
 }
 function getPrScanSelectedSources(sources, source) {
@@ -1070,9 +1078,7 @@ export async function commandConnect(client, cwd, flags, provider) {
     const me = await ensureAuthenticated(client, flags);
     const binding = await loadWorkspaceBinding(cwd);
     const company = await chooseCompany(me, flags, binding);
-    const route = provider === "github"
-        ? `/api/cli/v1/providers/github/connect?companyId=${encodeURIComponent(company.id)}`
-        : `/api/cli/v1/providers/gitlab/connect?companyId=${encodeURIComponent(company.id)}`;
+    const route = `/api/cli/v1/providers/${provider}/connect?companyId=${encodeURIComponent(company.id)}`;
     const response = await withLoadingIndicator(`Preparing ${provider} connection link...`, flags, () => client.request(route));
     if (!isJsonMode(flags)) {
         logLine(`Connection URL for ${provider}: ${response.url}`, flags);

package/dist/forgejo-url.js

@@ -0,0 +1,53 @@
+export function normalizeForgejoBaseUrl(value) {
+    try {
+        const url = new URL(value.trim());
+        if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash)
+            return null;
+        if (!url.hostname || /^(localhost|127\.|0\.|\[::1\])/i.test(url.hostname))
+            return null;
+        return url.origin + url.pathname.replace(/\/+$/, "");
+    }
+    catch {
+        return null;
+    }
+}
+export function parseForgejoRepository(value, baseUrl) {
+    const base = normalizeForgejoBaseUrl(baseUrl);
+    if (!base)
+        return null;
+    try {
+        const url = new URL(value.includes("://") ? value : base + "/" + value.replace(/^\/+/, ""));
+        if (url.username || url.password || url.search || url.hash || !url.href.startsWith(base + "/"))
+            return null;
+        const segments = url.pathname.slice(new URL(base).pathname.replace(/\/+$/, "").length).replace(/^\/+/, "").replace(/\.git$/, "").split("/");
+        if (segments.length !== 2 || segments.some(part => !/^[a-z0-9_.-]+$/i.test(part) || part === "." || part === ".."))
+            return null;
+        const [owner, repo] = segments;
+        return { provider: "forgejo", baseUrl: base, owner, repo, repoName: owner + "/" + repo, normalizedUrl: base + "/" + owner + "/" + repo };
+    }
+    catch {
+        return null;
+    }
+}
+export function parseForgejoPullRequestUrl(value) {
+    try {
+        const url = new URL(value.trim());
+        const match = url.pathname.match(/^(.*)\/([^/]+)\/([^/]+)\/pulls\/(\d+)(?:\/.*)?$/);
+        if (!match || url.username || url.password)
+            return null;
+        const identity = parseForgejoRepository(match[2] + "/" + match[3], url.origin + match[1]);
+        const prNumber = Number(match[4]);
+        if (!identity || !Number.isSafeInteger(prNumber) || prNumber <= 0)
+            return null;
+        return { ...identity, prNumber, normalizedUrl: identity.normalizedUrl + "/pulls/" + prNumber };
+    }
+    catch {
+        return null;
+    }
+}
+export function forgejoRepositoryPath(repoName) {
+    const parts = repoName.split("/");
+    if (parts.length !== 2 || parts.some(part => !/^[a-z0-9_.-]+$/i.test(part) || part === "." || part === ".."))
+        throw new Error("Invalid Forgejo repository path");
+    return "/repos/" + parts.map(encodeURIComponent).join("/");
+}

package/dist/help.js

@@ -43,6 +43,7 @@ export const CLI_HELP_TEXT = `Usage:
   apex update                       Update the local Apex CLI install
   apex connect github               Open the GitHub connection flow
   apex connect gitlab               Open the GitLab connection flow
+  apex connect forgejo              Connect company-enabled Forgejo access
 
 Flags:
   --company <id-or-handle>          Override the automatically selected Apex company
@@ -66,7 +67,7 @@ Flags:
   --dismissal-reason false-positive|by-design|not-relevant
                                     Explain why invalid feedback is being left
   --label acknowledged|fixed        Attach a valid-feedback label
-  --fix-pr-url <github-pr-url>      Attach one or more Fix PR URLs to feedback or fix-review start
+  --fix-pr-url <fix-pr-url>      Attach one or more Fix PR URLs to feedback or fix-review start
   --review-target pull-request|repository-current
                                     Choose the fix review target when starting a fix review
   --format markdown|json|gitlab-sast
@@ -74,7 +75,7 @@ Flags:
   --output <path>                   Write exported findings to this file path
   --limit <count>                   Limit the number of findings returned
   --mode standard|audit|lite|pr     Choose the scan mode
-  --pr <number[:path,path]>         Select a GitHub pull request for --mode pr
+  --pr <number[:path,path]>         Select a GitHub or Forgejo PR for --mode pr
   --pr-path <path>                  Limit a single-PR scan to a changed file path
   --source-mode auto|remote|local   Control remote-vs-local source materialization
   --force                           Start an overlapping non-PR scan, or confirm destructive guest logout
@@ -90,7 +91,7 @@ Tips:
   apex scan defaults to the current directory; positional targets or --repo select files, directories, or HTTPS GitHub/GitLab repositories.
   A file target scans only that file. Use --mode standard for local changes and public repositories without a provider connection.
   Headless and --json commands require an existing session; run apex login explicitly first.
-  PR scans require --mode pr and at least one --pr selection for a GitHub repository.
+  PR scans require --mode pr and at least one --pr selection for a connected GitHub or company-enabled Forgejo repository.
   audit is the current scan mode for audit scans; ultra remains accepted as a legacy alias.
   Lite scans use --mode lite and require beta access plus provider-backed GitHub or GitLab sources.
   apex workspace use accepts a workspace name, prefix, or ID.
@@ -190,6 +191,7 @@ Commands:
   /company [id|handle]    Show or switch the active company
   /connect github         Connect GitHub access in the browser
   /connect gitlab         Connect GitLab access in the browser
+  /connect forgejo        Connect company-enabled Forgejo access
   /open                   Open the latest scan or Apex home in the browser
   /clear                  Clear the terminal
   /help                   Show this help
@@ -206,7 +208,7 @@ Scripted-only commands (run outside the interactive shell):
                            Revoke a service key
 
 Tips:
-  PR scans require a GitHub PR number and provider-backed repository access.
+  PR scans require a GitHub or enabled Forgejo PR number and provider-backed access.
   audit is the current scan mode for audit scans; ultra remains accepted as a legacy alias.
   Lite scans require beta access plus provider-backed GitHub or GitLab sources.
   /workspace use accepts a workspace name, prefix, or ID.

package/dist/mcp.js

@@ -33,7 +33,7 @@ Notes:
 - Finding write tools use the same Apex device-login credentials as read tools. Never ask for browser cookies or CANTINA_AUTH_TOKEN. An error requiring CANTINA_AUTH_TOKEN proves the MCP server is outdated; update Apex CLI, re-run apex setup for this client, restart it, and retry.
 - Organization service-key creation, listing, and revocation are intentionally scripted-CLI-only and are not exposed as MCP tools. Never ask a user to paste a service key into a prompt or tool argument. A hosted MCP client supplies it only as the HTTP Authorization header.
 - Production agents that do not need local filesystem access can connect to https://ai.cantina.xyz/mcp over Streamable HTTP with Authorization: Bearer <service-key>. Serverless and cron applications can instead use the REST API documented at https://ai.cantina.xyz/docs/apex-api. This local stdio server continues to use device login.
-- Use mode "audit" for audit scans; "ultra" remains accepted as a legacy alias. Use mode "lite" only for beta-enabled provider-backed Lite scans, and mode "pr" for GitHub pull request scans.
+- Use mode "audit" for audit scans; "ultra" remains accepted as a legacy alias. Use mode "lite" only for beta-enabled provider-backed Lite scans, and mode "pr" for GitHub or company-enabled Forgejo pull request scans.
 - Use only the public Bedrock scanId returned by Apex for scan inputs. Kernel execution IDs are private and are neither returned nor accepted as aliases.
 - Starting a PR scan may run alongside active workspace scans and does not require force. Starting any non-PR scan still treats every active scan, including a PR scan, as a blocker; use force only when the user explicitly wants that overlap.
 - Doctor is read-only for guest sessions and reports the local snapshot plan without reserving a workspace.
@@ -543,7 +543,7 @@ function registerTools(server, auditSetupEnabled = false) {
         }, value => `Threat-model draft ${String(value.draftId)}: ${String(value.state)}.`, input));
     server.registerTool("apex-scan", {
         title: "Start Apex Scan",
-        description: "Start a new Apex scan for the provided cwd by default. Pass repoPaths to select exact files, directories, or HTTPS GitHub/GitLab repository URLs. Remote URLs use the default branch; files never include siblings. Use mode audit for audit scans, mode lite for beta-gated provider-backed Lite scans, and mode pr for GitHub pull request scans.",
+        description: "Start a new Apex scan for the provided cwd by default. Pass repoPaths to select exact files, directories, or HTTPS GitHub/GitLab or company-enabled Forgejo repository URLs. Remote URLs use the default branch; files never include siblings. Use mode audit for audit scans, mode lite for beta-gated provider-backed Lite scans, and mode pr for GitHub or company-enabled Forgejo pull request scans.",
         inputSchema: {
             cwd: z.string().optional(),
             company: z.string().optional(),
@@ -885,11 +885,11 @@ function registerTools(server, auditSetupEnabled = false) {
     }));
     server.registerTool("apex-connect-provider", {
         title: "Get Apex Provider Connection URL",
-        description: "Return the browser URL a user needs to connect GitHub or GitLab access for Apex. This tool never opens a browser.",
+        description: "Return the browser URL a user needs to connect GitHub, GitLab or company-enabled Forgejo access for Apex. This tool never opens a browser.",
         inputSchema: {
             cwd: z.string().optional(),
             company: z.string().optional(),
-            provider: z.enum(["github", "gitlab"]),
+            provider: z.enum(["github", "gitlab", "forgejo"]),
         },
     }, async ({ cwd, company, provider }) => runTool("apex-connect-provider", async () => {
         const client = new ApexApiClient();

package/dist/repo-discovery.js

@@ -60,13 +60,13 @@ function inspectRemoteTarget(value) {
         url = new URL(target);
     }
     catch {
-        throw new Error("Remote scan targets must be HTTPS GitHub or GitLab repository URLs.");
+        throw new Error("Remote scan targets must be HTTPS GitHub, GitLab or company-enabled Forgejo repository URLs.");
     }
     const segments = url.pathname.replace(/\/+$/, "").split("/").filter(Boolean);
-    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.port ||
-        !["github.com", "gitlab.com"].includes(url.hostname) || segments.length < 2 ||
+    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash ||
+        segments.length < 2 ||
         (url.hostname === "github.com" && segments.length !== 2) || segments.includes("-")) {
-        throw new Error("Remote scan targets must be HTTPS GitHub or GitLab repository URLs without credentials, query strings, or file/tree paths.");
+        throw new Error("Remote scan targets must be HTTPS GitHub, GitLab or company-enabled Forgejo repository URLs without credentials, query strings, or file/tree paths.");
     }
     const metadata = extractCanonicalRepoMetadata(url.href);
     if (!metadata)
@@ -183,5 +183,5 @@ export async function discoverSources(cwd, selectedPaths = []) {
 export function extractLegacyRepositories(sources) {
     return sources.filter((source) => source.kind === "git_candidate" &&
         typeof source.repoUrl === "string" &&
-        (source.provider === "github" || source.provider === "gitlab"));
+        (source.provider === "github" || source.provider === "gitlab" || source.provider === "forgejo"));
 }

package/dist/repo-url.js

@@ -1,3 +1,4 @@
+import { parseForgejoRepository } from "./forgejo-url.js";
 function normalizeGitlabBaseUrl(value) {
     try {
         const url = new URL(value.trim());
@@ -99,6 +100,15 @@ export function extractGitlabProjectPathFromRepoUrl(repoUrl) {
     }
 }
 export function extractCanonicalRepoMetadata(value) {
+    try {
+        const candidate = new URL(value.replace(/^git@([^:]+):/, "https://$1/"));
+        if (candidate.hostname === "codeberg.org" || candidate.hostname === "code.forgejo.org" || candidate.hostname.split(".").includes("forgejo")) {
+            const repo = parseForgejoRepository(candidate.href, candidate.origin);
+            if (repo)
+                return { provider: "forgejo", repoUrl: repo.normalizedUrl + ".git", repoName: repo.repoName, baseUrl: repo.baseUrl };
+        }
+    }
+    catch { /* Local owner/repository shorthand is handled below. */ }
     const githubRepoUrl = normalizeGithubRepoUrl(value);
     if (githubRepoUrl?.startsWith("https://github.com/")) {
         try {

package/dist/shell.js

@@ -27,7 +27,7 @@ const SHELL_COMPLETIONS = [
     { command: "repos" },
     { command: "workspace", args: ["use", "name"] },
     { command: "company" },
-    { command: "connect", args: ["github", "gitlab"] },
+    { command: "connect", args: ["github", "gitlab", "forgejo"] },
     { command: "open" },
     { command: "clear" },
     { command: "help" },
@@ -432,8 +432,8 @@ async function runShellCommand(client, cwd, parsed, shellFlags, session) {
         }
         case "connect": {
             const provider = parsed.args[0];
-            if (provider !== "github" && provider !== "gitlab") {
-                process.stderr.write("Usage: /connect <github|gitlab>\n");
+            if (provider !== "github" && provider !== "gitlab" && provider !== "forgejo") {
+                process.stderr.write("Usage: /connect <github|gitlab|forgejo>\n");
                 return {};
             }
             await commandConnect(client, cwd, shellFlags, provider);

package/dist/telemetry.js

@@ -256,7 +256,7 @@ function sanitizeShellArgs(parsed) {
             };
         case "connect":
             return {
-                provider: safeEnum(parsed.args[0] ?? null, ["github", "gitlab"]),
+                provider: safeEnum(parsed.args[0] ?? null, ["github", "gitlab", "forgejo"]),
             };
         case "findings": {
             const action = parsed.args[0] ?? null;
@@ -327,7 +327,7 @@ function safeCliSubcommand(parsed) {
         return null;
     switch (parsed.command) {
         case "connect":
-            return safeEnum(subcommand, ["github", "gitlab"]);
+            return safeEnum(subcommand, ["github", "gitlab", "forgejo"]);
         case "export":
             return safeEnum(subcommand, ["findings"]);
         case "findings":
@@ -404,6 +404,7 @@ export function sanitizeMcpInput(input = {}) {
         provider: safeEnum(typeof input.provider === "string" ? input.provider : null, [
             "github",
             "gitlab",
+            "forgejo",
         ]),
         ticketProvider: safeEnum(typeof input.provider === "string" ? input.provider : null, ["linear", "jira"]),
         feedbackStatus: safeEnum(typeof input.status === "string" ? input.status : null, [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cantinasecurity/apex-cli",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "description": "Standalone CLI and MCP server for Apex.",
   "private": false,
   "type": "module",

package/skills/apex-cli/SKILL.md

@@ -78,9 +78,9 @@ Guidelines:
 - `apex-scan` scans the provided `cwd` by default; pass `repoPaths` only when the user asks to scan explicit alternate roots.
 - `apex-doctor` is read-only for guest sessions and reports the local snapshot plan without reserving a workspace. For account sessions it reports whether Apex will use remote materialization or a local snapshot upload for each selected source.
 - Apex can scan plain local directories and dirty git worktrees without provider connections by using local snapshot uploads.
-- Audit scans use `mode: "audit"` in user-facing instructions and request payloads. The legacy `ultra` mode remains accepted as an alias, but audit scans still require provider-backed GitHub or GitLab sources.
+- Audit scans use `mode: "audit"` in user-facing instructions and request payloads. The legacy `ultra` mode remains accepted as an alias, but audit scans still require provider-backed GitHub, GitLab or company-enabled Forgejo sources.
 - Lite scans use `mode: "lite"`, require Lite Scan beta access, and require provider-backed GitHub or GitLab sources without local snapshot fallback.
-- PR scans use `mode: "pr"` and require one provider-backed GitHub repository plus one or more `pullRequests`.
+- PR scans use `mode: "pr"` and require one provider-backed GitHub or company-enabled, connected Forgejo repository plus one or more `pullRequests`.
 - Starting a PR scan may run alongside active workspace scans and does not require `force`. Starting any non-PR scan still treats every active scan, including a PR scan, as a blocker; use `force: true` only when the user explicitly wants that overlap.
 - `apex-workspace-use` accepts a workspace name, prefix, or ID.
 - Use `sourceMode: "remote"` only when the user explicitly wants to forbid local snapshot fallbacks.
@@ -155,7 +155,7 @@ values. If Audit Setup or another workspace update is active, wait for it to
 finish before saving again.
 
 Scan target and recovery rules:
-- CLI `apex scan [target...]` and repeatable `--repo` accept exact files, directories, or HTTPS GitHub/GitLab repository URLs; local MCP uses `repoPaths` for the same selections. No target means `cwd`.
+- CLI `apex scan [target...]` and repeatable `--repo` accept exact files, directories, or HTTPS GitHub/GitLab or company-enabled Forgejo repository URLs; local MCP uses `repoPaths` for the same selections. No target means `cwd`.
 - A file selection scans only that file, respecting ignore rules. Local snapshots exclude `.apex/` state. Remote URLs use the default branch and cannot fall back to uploading `cwd`; clone locally to choose a branch or commit.
 - Use Standard for local changes, files, plain directories, and public repositories without provider access. Lite and Audit still require connected provider sources; do not silently substitute another mode.
 - Unauthenticated headless CLI commands fail with explicit login guidance; they never start device login. Use the MCP auth tools for explicit MCP login. Retry transient refresh failures without clearing credentials.
@@ -169,3 +169,9 @@ Finding lifecycle:
 - Read `remediationStatus` in workspace finding lists for the current lifecycle; `status` remains the scanner verdict. `open` and `acknowledged` stay distinct even though both use the `accepted` review state.
 - Use the finding updatedAt as expectedUpdatedAt when working from a prior snapshot. On FINDING_STATUS_CONFLICT, reload and review before retrying.
 - Linear sync is Linear-to-Apex: started becomes acknowledged, completed becomes fixed. Do not promise Apex-to-Linear status updates or automatic Linear reopening.
+
+## Forgejo
+
+Forgejo connections, remote repository scans, PR scans and Fix Review require the Forgejo company feature enabled by an administrator in Bedrock Settings. Run `apex connect forgejo` (or `apex-connect-provider` with `provider: "forgejo"`) to obtain the browser connection URL. A dedicated bot, HTTPS instance URL and repository-scoped read token are required; PR statuses, comments and webhook installation also require a write token.
+
+After connecting, run `apex doctor --repo . --source-mode remote`, then `apex scan --mode standard --repo . --source-mode remote` or `apex scan --mode pr --pr 42 --repo .`. Same-repository Forgejo PR URLs use `/owner/repository/pulls/42`. Pass a Forgejo Fix PR URL through finding feedback and start Fix Review using the existing finding commands or MCP tools. Disabling the company flag stops native Forgejo access. Existing local Standard snapshots remain provider-independent.