@cantinasecurity/apex-cli 0.1.39 → 0.1.41

package/.claude/skills/apex-cli/SKILL.md

@@ -156,7 +156,7 @@ finish before saving again.
 
 Scan target and recovery rules:
 - CLI `apex scan [target...]` and repeatable `--repo` accept exact files, directories, or HTTPS GitHub/GitLab or company-enabled Forgejo repository URLs; local MCP uses `repoPaths` for the same selections. No target means `cwd`.
-- A file selection scans only that file, respecting ignore rules. Local snapshots exclude `.apex/` state. Remote URLs use the default branch and cannot fall back to uploading `cwd`; clone locally to choose a branch or commit.
+- A file selection scans only that file, respecting ignore rules. Local snapshots exclude `.apex/` state. Hard-linked files are uploaded independently, while safe relative symbolic links and long filenames are preserved. Remote URLs use the default branch and cannot fall back to uploading `cwd`; clone locally to choose a branch or commit.
 - Use Standard for local changes, files, plain directories, and public repositories without provider access. Lite and Audit still require connected provider sources; do not silently substitute another mode.
 - Unauthenticated headless CLI commands fail with explicit login guidance; they never start device login. Use the MCP auth tools for explicit MCP login. Retry transient refresh failures without clearing credentials.
 - Audit Setup is an explicit Standard/Audit beta flow using saved workspace repositories and context. It does not preserve local targets. Never automatically substitute setup after `AUDIT_SETUP_REQUIRED`; use the error's selected-workspace command only when that saved scope is intended. Draft operations require the ID returned by preparation; eligible accounts receive setup commands in CLI help. Lite and PR do not use `--setup`.
@@ -175,3 +175,5 @@ Finding lifecycle:
 Forgejo connections, remote repository scans, PR scans and Fix Review require the Forgejo company feature enabled by an administrator in Bedrock Settings. Run `apex connect forgejo` (or `apex-connect-provider` with `provider: "forgejo"`) to obtain the browser connection URL. A dedicated bot, HTTPS instance URL and repository-scoped read token are required; PR statuses, comments and webhook installation also require a write token.
 
 After connecting, run `apex doctor --repo . --source-mode remote`, then `apex scan --mode standard --repo . --source-mode remote` or `apex scan --mode pr --pr 42 --repo .`. Same-repository Forgejo PR URLs use `/owner/repository/pulls/42`. Pass a Forgejo Fix PR URL through finding feedback and start Fix Review using the existing finding commands or MCP tools. Disabling the company flag stops native Forgejo access. Existing local Standard snapshots remain provider-independent.
+
+Internal employee beta capabilities are advertised only after live role and workspace eligibility checks. SSH credential delivery is intentionally scripted CLI only; it is not exposed through MCP tools or public help. Server authorization remains mandatory for every action.

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Cantina agent plugins for security review workflows.",
-    "version": "0.1.39"
+    "version": "0.1.41"
   },
   "plugins": [
     {
@@ -14,10 +14,10 @@
       "source": {
         "source": "npm",
         "package": "@cantinasecurity/apex-cli",
-        "version": "0.1.39"
+        "version": "0.1.41"
       },
       "description": "Run Apex security scans and review findings from Claude Code.",
-      "version": "0.1.39",
+      "version": "0.1.41",
       "author": {
         "name": "Cantina",
         "email": "support@cantina.xyz"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "Run Apex security scans and review findings from Claude Code.",
   "author": {
     "name": "Cantina",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "Run Apex security scans and review findings from Codex.",
   "author": {
     "name": "Cantina",

package/.mcp.claude.json

@@ -5,7 +5,7 @@
       "args": [
         "-y",
         "-p",
-        "@cantinasecurity/apex-cli@0.1.39",
+        "@cantinasecurity/apex-cli@0.1.41",
         "apex-mcp"
       ],
       "env": {

package/.mcp.codex.json

@@ -4,7 +4,7 @@
     "args": [
       "-y",
       "-p",
-      "@cantinasecurity/apex-cli@0.1.39",
+      "@cantinasecurity/apex-cli@0.1.41",
       "apex-mcp"
     ],
     "env": {

package/MARKETPLACE.md

@@ -13,7 +13,7 @@ This package is prepared as both a Claude Code plugin and a Codex plugin. The pu
 The plugin MCP configs launch the pinned npm CLI package with:
 
 ```bash
-npx -y -p @cantinasecurity/apex-cli@0.1.39 apex-mcp
+npx -y -p @cantinasecurity/apex-cli@0.1.41 apex-mcp
 ```
 
 That keeps marketplace installs independent of a user's global `apex` install.

package/README.md

@@ -158,30 +158,30 @@ unclaimed local trial proof so `apex claim` can still use it.
 Agent-safe copy/paste prompt (substitute the issued code):
 
 ```text
-Install and run Cantina Apex CLI 0.1.39 to start one free standard security scan of this repository immediately.
+Install and run Cantina Apex CLI 0.1.41 to start one free standard security scan of this repository immediately.
 
 Use this trial code only where <TRIAL_CODE> appears below: SPBT-DEVREL-XXXXXXXX
 
 Run the commands yourself from the repository root; do not stop after setup or only explain the steps. Use terminal CLI commands only. Do not use an Apex MCP tool or run `apex setup`, `apex mcp`, `apex login`, `apex-auth-start`, or `apex-auth-wait`. Never use `--replace` or `--force`.
 
 Use this exact command prefix for every Apex command:
-  npx -y -p @cantinasecurity/apex-cli@0.1.39 apex
+  npx -y -p @cantinasecurity/apex-cli@0.1.41 apex
 
 1. Before redeeming, confirm every command will use the same persistent, user-accessible machine or container, HOME, filesystem, and repository root. Confirm Node.js 20+ and npx are available. If `APEX_BASE_URL` is set, continue only when its origin is `https://ai.cantina.xyz`. Run the exact prefix with `--help` and continue only if help lists both `redeem` and `claim`. If any check fails, STOP before sending the code; do not install system packages.
 2. Redeem, with at most one response-loss recovery retry:
-     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex redeem <TRIAL_CODE> --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.41 apex redeem <TRIAL_CODE> --json
    This terminal command is the only allowed tool call containing the code. Never echo or restate the code, store it in a file or environment variable, put it in a URL or MCP call, or include it in your response. Parse the JSON from stdout only; do not merge stderr into stdout, because npm may write warnings to stderr. Continue when the command exits 0 and stdout is JSON with `redeemed: true` and `outcome` equal to `redeemed` or `idempotent`. `idempotent` means the existing guest session resumed and it may already own a workspace. If and only if the first attempt ends with an ambiguous transport/connection failure or an interrupted/missing response and no typed server error code, retry this exact same command once on the same machine, HOME, and repository root. Never retry a typed server rejection and never make more than one recovery retry. If the allowed retry does not return a successful JSON outcome, STOP.
 3. Immediately start exactly one scan; do not wait for another instruction:
-     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex scan --mode standard --non-interactive --no-open --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.41 apex scan --mode standard --non-interactive --no-open --json
    The CLI validates the complete guest local archive before it reserves a workspace. An unbound renamed checkout may recover only the sole empty guest workspace when no explicit workspace name was supplied. On any error or nonzero exit, STOP. After a successful scan JSON response, inspect `localPersistence.workspaceBindingSaved`. If it is `false`, the server scan already started: capture and report `binding.lastScanId`, then STOP; do not run status or findings until local repository permissions are repaired. Otherwise capture `binding.lastScanId` from the JSON as <SCAN_ID>; if it is absent, STOP.
 4. About every 60 seconds, poll that exact scan:
-     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex status --scan <SCAN_ID> --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.41 apex status --scan <SCAN_ID> --json
    Read `progress.progress.status`. Wait while it is `created`, `pending`, `queued`, `starting`, `running`, `in_progress`, or `processing`. Continue on `completed`. STOP on `failed`, `cancelled`, a missing or unknown status, or a command failure.
 5. Fetch that exact scan's findings:
-     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex findings --scan <SCAN_ID> --json
+     npx -y -p @cantinasecurity/apex-cli@0.1.41 apex findings --scan <SCAN_ID> --json
    On success, summarize findings by severity, most severe first, including identifier, title, status, and confidence. This command does not return file locations, so do not invent them. On failure, STOP.
 6. Do not claim automatically. Tell me the claim deadline from step 2 and remind me to run this exact command myself from the same repository root, machine, and HOME:
-     npx -y -p @cantinasecurity/apex-cli@0.1.39 apex claim
+     npx -y -p @cantinasecurity/apex-cli@0.1.41 apex claim
    It may open a browser so I can create or sign in to a Cantina account and keep the results. Claim moves the trial into the currently selected Cantina workspace when I can run scans there, or into my existing personal workspace. If the selected workspace cannot run scans, tell me to switch to one that can and retry before the claim deadline.
 
 Never paste raw command transcripts. For any failure, report only the step, exit code, and sanitized error. Redact the trial code and every `apex_at_`, `apex_rt_`, or `apex_ct_` value from all reports.
@@ -477,7 +477,7 @@ apex scan ./contracts/UniswapV2ERC20.sol --mode standard
 apex scan https://github.com/Uniswap/v2-core --mode standard
 ```
 
-A file target uploads only that file, never its siblings. Local snapshots include current local changes and honor Git ignore rules and `.apexignore`; Apex state under `.apex/` is excluded. Explicit remote URLs use the default branch and never fall back to uploading the current checkout. Use a local clone to scan a particular remote branch or commit.
+A file target uploads only that file, never its siblings. Local snapshots include current local changes and honor Git ignore rules and `.apexignore`; Apex state under `.apex/` is excluded. Hard-linked paths are uploaded as independent file contents; safe relative symbolic links and long filenames are preserved. Explicit remote URLs use the default branch and never fall back to uploading the current checkout. Use a local clone to scan a particular remote branch or commit.
 
 Source planning:
 
@@ -687,7 +687,7 @@ Telemetry event posts do not include bearer tokens. The telemetry endpoint is `P
     {
       "schemaVersion": 1,
       "event": "apex.invocation.completed",
-      "cliVersion": "0.1.39",
+      "cliVersion": "0.1.41",
       "invocation": {
         "surface": "mcp",
         "command": "apex-scan",
@@ -718,7 +718,7 @@ The npm package also includes marketplace-ready plugin artifacts:
 - `.claude-plugin/plugin.json` and `.mcp.claude.json` for Claude Code plugin installs
 - `.claude-plugin/marketplace.json` for a Claude marketplace entry backed by the public npm package
 
-These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.39 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
+These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.41 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
 
 The repository also includes `.agents/plugins/marketplace.json` for local Codex marketplace testing from a checkout.
 
@@ -826,3 +826,5 @@ or Jira tickets. Use the direct status operation to manage issues from MCP or RE
 Forgejo connections, remote repository scans, PR scans and Fix Review require the Forgejo company feature enabled by an administrator in Bedrock Settings. Run `apex connect forgejo` (or `apex-connect-provider` with `provider: "forgejo"`) to obtain the browser connection URL. A dedicated bot, HTTPS instance URL and repository-scoped read token are required; PR statuses, comments and webhook installation also require a write token.
 
 After connecting, run `apex doctor --repo . --source-mode remote`, then `apex scan --mode standard --repo . --source-mode remote` or `apex scan --mode pr --pr 42 --repo .`. Same-repository Forgejo PR URLs use `/owner/repository/pulls/42`. Pass a Forgejo Fix PR URL through finding feedback and start Fix Review using the existing finding commands or MCP tools. Disabling the company flag stops native Forgejo access. Existing local Standard snapshots remain provider-independent.
+
+Internal employee beta capabilities are advertised only after live role and workspace eligibility checks. SSH credential delivery is intentionally scripted CLI only; it is not exposed through MCP tools or public help. Server authorization remains mandatory for every action.

package/dist/apex.js

@@ -1,3 +1,4 @@
+import { commandCodeAccess, commandInternalTriage, hasCodeAccess, CODE_ACCESS_HELP } from "./code-access.js";
 import { commandCvss } from "./cvss.js";
 import { commandStartThreatModel, commandThreatModel, hasAuditSetupBeta, threatModelExitCode, terminalText } from "./threat-model.js";
 import { getMe } from "./auth.js";
@@ -13,13 +14,21 @@ async function dispatch(parsed) {
     const client = new ApexApiClient();
     if (parsed.flags.help === true || parsed.command === "help") {
         const me = await getMe(client, { signal: AbortSignal.timeout(1_500) }).catch(() => null);
-        process.stdout.write(cliHelpText(hasAuditSetupBeta(me)));
+        process.stdout.write(cliHelpText(hasAuditSetupBeta(me)) + (hasCodeAccess(me) ? CODE_ACCESS_HELP : ""));
         return;
     }
     if (parsed.command === "mcp") {
         await runMcpServer();
         return;
     }
+    if (parsed.command === "code-access") {
+        await commandCodeAccess(client, parsed.flags, parsed.subcommand ?? "list", parsed.args[0]);
+        return;
+    }
+    if (parsed.command === "triage") {
+        await commandInternalTriage(client, parsed.flags, parsed.subcommand ?? "findings", parsed.args[0]);
+        return;
+    }
     const cwd = process.cwd();
     if (await maybePromptForUpdate(parsed.flags, parsed.command)) {
         return;

package/dist/args.js

@@ -1,4 +1,8 @@
 export const KNOWN_CLI_FLAG_NAMES = [
+    "instance-type",
+    "disk",
+    "minutes",
+    "key-file",
     "setup",
     "draft",
     "file",
@@ -40,6 +44,8 @@ export const KNOWN_CLI_FLAG_NAMES = [
     "scope",
     "source-mode",
     "status",
+    "validity",
+    "severity",
     "suggested-severity",
     "workspace-name",
     "workspace-ref",
@@ -47,7 +53,9 @@ export const KNOWN_CLI_FLAG_NAMES = [
 ];
 const KNOWN_CLI_FLAGS = new Set(KNOWN_CLI_FLAG_NAMES);
 const BOOLEAN_FLAGS = new Set([
-    "wait", "start-scan", "no-feedback-context",
+    "wait",
+    "start-scan",
+    "no-feedback-context",
     "force",
     "non-interactive",
     "json",
@@ -102,7 +110,10 @@ export function parseArgs(argv) {
         if (flags.setup !== undefined) {
             throw new Error("Audit Setup does not accept scan targets. Use --workspace-ref <workspace>.");
         }
-        flags.repo = [...(flags.repo ?? []), ...positional.slice(1)];
+        flags.repo = [
+            ...(flags.repo ?? []),
+            ...positional.slice(1),
+        ];
         positional.splice(1);
     }
     return {
@@ -113,9 +124,15 @@ export function parseArgs(argv) {
     };
 }
 export function validateCommandFlags(parsed) {
-    if (parsed.flags["source-mode"] !== undefined && !["auto", "remote", "local"].includes(String(parsed.flags["source-mode"]))) {
+    if (parsed.flags["source-mode"] !== undefined &&
+        !["auto", "remote", "local"].includes(String(parsed.flags["source-mode"]))) {
         throw new Error("--source-mode must be auto, remote, or local.");
     }
+    if ((parsed.flags.validity !== undefined ||
+        parsed.flags.severity !== undefined) &&
+        parsed.command !== "triage") {
+        throw new Error("--validity and --severity are only supported with triage.");
+    }
     if (parsed.flags["workspace-ref"] === undefined) {
         return;
     }
@@ -123,7 +140,9 @@ export function validateCommandFlags(parsed) {
         parsed.subcommand === null &&
         parsed.flags.workspace === true;
     const isSetupScan = parsed.command === "scan" && parsed.flags.setup !== undefined;
-    if (!isWorkspaceFindings && !isSetupScan) {
+    if (!isWorkspaceFindings &&
+        !isSetupScan &&
+        !["code-access", "triage"].includes(parsed.command ?? "")) {
         throw new Error("--workspace-ref is only supported with `apex findings --workspace`. To change the local workspace used by scans or exports, run `apex workspace use <workspace-ref>` first.");
     }
 }
@@ -144,7 +163,9 @@ export function canPromptInteractively(flags) {
 }
 export function getFlagString(flags, key) {
     const value = flags[key];
-    return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+    return typeof value === "string" && value.trim().length > 0
+        ? value.trim()
+        : null;
 }
 export function getFlagList(flags, key) {
     const value = flags[key];

package/dist/code-access.js

@@ -0,0 +1,446 @@
+import { createPrivateKey, randomUUID } from "node:crypto";
+import { createRequire } from "node:module";
+import { spawn } from "node:child_process";
+import { accessSync, chmodSync, constants, existsSync, mkdtempSync, mkdirSync, writeFileSync, rmSync, readFileSync, } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { Transform } from "node:stream";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { getMe } from "./auth.js";
+import { canPromptInteractively, getFlagString, } from "./args.js";
+import { withLoadingIndicator } from "./output.js";
+import { chooseOne } from "./prompt.js";
+export const CODE_ACCESS_HELP = `
+Internal employee beta:
+  apex code-access create --workspace-ref <id> [--instance-type m7i.xlarge] [--disk 100]
+  apex code-access list --workspace-ref <id>
+  apex code-access ssh|get|connect|extend|resume|revoke-ssh|stop|kill <id> --workspace-ref <id>
+  ssh opens the sandbox immediately with a temporary key that is deleted on exit. create prompts for compute and disk, then prints the one-line ssh command. connect is an advanced flow and requires --key-file <new-path>. kill permanently removes sandbox resources while retaining execution history.
+  apex triage findings --workspace-ref <id>
+  apex triage review <finding-id> --workspace-ref <id> --expected-updated-at <timestamp from findings> --validity valid|partially_valid|invalid [--severity high] [--note <rationale>] [--request-id <uuid>]
+  apex triage edit <finding-id> --workspace-ref <id> --file <edit.json> --expected-updated-at <timestamp from findings> [--request-id <uuid>]
+  Edit JSON: {"action":"comment","content":"..."}, {"action":"severity","severity":"high"},
+  {"action":"review","validity":"valid","severity":"high","note":"..."}, or {"action":"cvss","vector":"CVSS:3.1/...","note":"..."}.
+`;
+export function hasCodeAccess(me) {
+    return Boolean(me?.user.triageWorkspaces?.length);
+}
+const uuid = z.string().uuid();
+const quote = (s) => `'${s.replaceAll("'", "'\\''")}'`;
+export function createSsmPluginOutputFilter() {
+    const prefix = Buffer.from("\nStarting session with SessionId:");
+    let buffered = Buffer.alloc(0);
+    let decided = false;
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            if (decided)
+                return callback(null, chunk);
+            buffered = Buffer.concat([buffered, chunk]);
+            const comparable = Math.min(buffered.length, prefix.length);
+            if (!buffered.subarray(0, comparable).equals(prefix.subarray(0, comparable))) {
+                decided = true;
+                callback(null, buffered);
+                buffered = Buffer.alloc(0);
+                return;
+            }
+            const end = buffered.indexOf(0x0a, prefix.length);
+            if (end < 0)
+                return callback();
+            decided = true;
+            const remainder = buffered.subarray(end + 1);
+            buffered = Buffer.alloc(0);
+            callback(null, remainder);
+        },
+        flush(callback) {
+            callback(null, decided ? undefined : buffered);
+        },
+    });
+}
+const machineOptions = [
+    { value: "m7i.xlarge", label: "4 vCPU / 16 GiB RAM (default)" },
+    { value: "m7i.2xlarge", label: "8 vCPU / 32 GiB RAM" },
+    { value: "m7i.4xlarge", label: "16 vCPU / 64 GiB RAM" },
+];
+const diskOptions = [
+    { value: 100, label: "100 GiB SSD (default)" },
+    { value: 200, label: "200 GiB SSD" },
+    { value: 500, label: "500 GiB SSD" },
+];
+function prepareCredentialPath(requestedPath) {
+    let keyFile;
+    if (requestedPath) {
+        keyFile = path.resolve(requestedPath);
+        try {
+            accessSync(path.dirname(keyFile), constants.W_OK);
+        }
+        catch {
+            throw new Error("Credential directory does not exist or is not writable");
+        }
+    }
+    else {
+        const directory = path.join(os.homedir(), ".config", "apex", "ssh");
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        chmodSync(directory, 0o700);
+        keyFile = path.join(directory, `triage-${randomUUID()}.pem`);
+    }
+    const hostsFile = keyFile + ".known_hosts";
+    if (existsSync(keyFile) || existsSync(hostsFile))
+        throw new Error("Choose new credential filenames; existing files are never overwritten");
+    return keyFile;
+}
+export async function codeAccessScope(client, flags) {
+    const me = await getMe(client);
+    const scopes = me?.user.triageWorkspaces ?? [];
+    if (!scopes.length)
+        throw new Error("Unknown command");
+    const workspaceId = uuid.parse(getFlagString(flags, "workspace-ref") ??
+        (scopes.length === 1 ? scopes[0].workspaceId : undefined));
+    if (!scopes.some((s) => s.workspaceId === workspaceId))
+        throw new Error("Workspace not found");
+    return workspaceId;
+}
+function numberFlag(flags, key, fallback) {
+    const value = getFlagString(flags, key);
+    return value == null
+        ? fallback
+        : z.coerce.number().int().positive().parse(value);
+}
+async function createConfiguration(flags) {
+    const interactive = canPromptInteractively(flags);
+    const machineFlag = getFlagString(flags, "instance-type");
+    const diskFlag = getFlagString(flags, "disk");
+    const machine = machineFlag
+        ? machineOptions.find((option) => option.value === machineFlag)
+        : interactive
+            ? await chooseOne("Select sandbox compute:", [...machineOptions])
+            : machineOptions[0];
+    if (!machine)
+        throw new Error("--instance-type must be m7i.xlarge, m7i.2xlarge, or m7i.4xlarge");
+    const requestedDisk = diskFlag
+        ? z.coerce.number().int().parse(diskFlag)
+        : null;
+    const disk = requestedDisk !== null
+        ? diskOptions.find((option) => option.value === requestedDisk)
+        : interactive
+            ? await chooseOne("Select encrypted SSD size:", [...diskOptions])
+            : diskOptions[0];
+    if (!disk)
+        throw new Error("--disk must be 100, 200, or 500");
+    return { instanceType: machine.value, storageGiB: disk.value };
+}
+export async function commandCodeAccess(client, flags, action, id) {
+    const workspaceId = await codeAccessScope(client, flags);
+    const endpoint = `/api/workspaces/${workspaceId}/code-access`;
+    const request = (body) => client.request(endpoint, {
+        method: "POST",
+        json: body,
+        signal: AbortSignal.timeout(790_000),
+    });
+    const print = (body) => process.stdout.write(JSON.stringify(body, null, 2) + "\n");
+    const issueConnection = async (executionId, keyFile) => {
+        const act = (input) => request({ operation: "act", id: executionId, input });
+        const hostsFile = keyFile + ".known_hosts";
+        if (existsSync(keyFile) || existsSync(hostsFile))
+            throw new Error("Choose new credential filenames; existing files are never overwritten");
+        const issued = await act({ action: "connect" });
+        const parsed = z
+            .object({
+            connection: z.object({
+                privateKey: z.string().min(1),
+                hostPublicKey: z.string(),
+                hostAlias: z.literal(`triage-${executionId}`),
+                username: z.literal("triage"),
+                expiresAt: z.string().datetime({ offset: true }),
+            }),
+        })
+            .safeParse(issued);
+        if (!parsed.success)
+            throw new Error("Invalid SSH identity returned by Apex");
+        const { connection } = parsed.data;
+        const hostKey = connection.hostPublicKey
+            .trim()
+            .split(/\s+/)
+            .slice(0, 2)
+            .join(" ");
+        if (!/^ssh-ed25519 [A-Za-z0-9+/]+=*$/.test(hostKey) ||
+            Date.parse(connection.expiresAt) <= Date.now())
+            throw new Error("Invalid SSH identity");
+        try {
+            if (createPrivateKey(connection.privateKey).asymmetricKeyType !== "rsa")
+                throw new Error("unexpected key type");
+        }
+        catch {
+            throw new Error("Invalid SSH private key returned by Apex");
+        }
+        let wroteKey = false;
+        try {
+            writeFileSync(keyFile, connection.privateKey, {
+                flag: "wx",
+                mode: 0o600,
+            });
+            wroteKey = true;
+            writeFileSync(hostsFile, `${connection.hostAlias} ${hostKey}\n`, {
+                flag: "wx",
+                mode: 0o600,
+            });
+        }
+        catch {
+            if (wroteKey)
+                rmSync(keyFile);
+            throw new Error("Could not save credentials");
+        }
+        const source = import.meta.url.endsWith(".ts");
+        const entry = fileURLToPath(new URL(source ? "./apex.ts" : "./apex.js", import.meta.url));
+        const invocation = [
+            quote(process.execPath),
+            ...(source
+                ? ["--import", quote(createRequire(import.meta.url).resolve("tsx"))]
+                : []),
+            quote(entry),
+            "code-access",
+            "proxy",
+            executionId,
+            "--workspace-ref",
+            workspaceId,
+        ].join(" ");
+        const sshArgs = [
+            "-i",
+            keyFile.replaceAll("%", "%%"),
+            "-o",
+            "IdentitiesOnly=yes",
+            "-o",
+            "StrictHostKeyChecking=yes",
+            "-o",
+            "UpdateHostKeys=no",
+            "-o",
+            "ForwardAgent=no",
+            "-o",
+            "ClearAllForwardings=yes",
+            "-o",
+            `UserKnownHostsFile="${hostsFile.replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`,
+            "-o",
+            `HostKeyAlias=${connection.hostAlias}`,
+            "-o",
+            `ProxyCommand=${invocation.replaceAll("%", "%%")}`,
+            `triage@${connection.hostAlias}`,
+        ];
+        const sshCommand = ["ssh", ...sshArgs.map(quote)].join(" ");
+        return {
+            keyFile,
+            hostsFile,
+            expiresAt: connection.expiresAt,
+            sshCommand,
+            sshArgs,
+        };
+    };
+    if (action === "create") {
+        const config = await createConfiguration(flags);
+        const created = await withLoadingIndicator("Starting sandbox and cloning workspace repositories...", flags, () => request({
+            operation: "create",
+            input: {
+                ...config,
+                leaseMinutes: numberFlag(flags, "minutes", 1440),
+            },
+        }));
+        const execution = z
+            .object({ execution: z.object({ id: uuid }).passthrough() })
+            .passthrough()
+            .parse(created);
+        print({
+            ...execution,
+            sshCommand: `apex code-access ssh ${execution.execution.id} --workspace-ref ${workspaceId}`,
+        });
+        return;
+    }
+    if (action === "list") {
+        print(await request({ operation: "list" }));
+        return;
+    }
+    const executionId = uuid.parse(id);
+    if (action === "get") {
+        print(await request({ operation: "get", id: executionId }));
+        return;
+    }
+    const act = (input) => request({ operation: "act", id: executionId, input });
+    if (action === "proxy") {
+        const session = z
+            .object({
+            session: z.object({
+                SessionId: z.string(),
+                StreamUrl: z.string().url(),
+                TokenValue: z.string(),
+            }),
+            target: z.string().regex(/^i-[a-f0-9]+$/),
+            region: z.string().regex(/^[a-z0-9-]+$/),
+            port: z.literal(2222),
+        })
+            .parse(await act({ action: "connect-session" }));
+        const child = spawn("session-manager-plugin", [
+            JSON.stringify(session.session),
+            session.region,
+            "StartSession",
+            "",
+            JSON.stringify({
+                Target: session.target,
+                DocumentName: "AWS-StartSSHSession",
+                Parameters: { portNumber: ["2222"] },
+            }),
+            `https://ssm.${session.region}.amazonaws.com`,
+        ], {
+            stdio: ["pipe", "pipe", "inherit"],
+            env: {
+                PATH: process.env.PATH,
+                HOME: process.env.HOME,
+                LANG: process.env.LANG,
+            },
+        });
+        child.stdin.on("error", () => undefined);
+        process.stdin.pipe(child.stdin);
+        child.stdout.pipe(createSsmPluginOutputFilter()).pipe(process.stdout, {
+            end: false,
+        });
+        try {
+            await new Promise((resolve, reject) => {
+                child.once("error", () => reject(new Error("Install the AWS session-manager-plugin to connect")));
+                child.once("close", (code) => code === 0 ? resolve() : reject(new Error("SSH transport closed")));
+            });
+        }
+        finally {
+            process.stdin.unpipe(child.stdin);
+        }
+        return;
+    }
+    if (action === "ssh") {
+        const directory = mkdtempSync(path.join(os.tmpdir(), "apex-triage-ssh-"));
+        let child = null;
+        let interruptedBy = null;
+        const cleanup = () => rmSync(directory, { recursive: true, force: true });
+        const onSignal = (signal) => {
+            interruptedBy = signal;
+            cleanup();
+            child?.kill(signal);
+        };
+        const signals = ["SIGHUP", "SIGINT", "SIGTERM"];
+        const signalHandlers = signals.map((signal) => [signal, () => onSignal(signal)]);
+        for (const [signal, handler] of signalHandlers)
+            process.once(signal, handler);
+        try {
+            const connection = await issueConnection(executionId, path.join(directory, "identity"));
+            if (interruptedBy)
+                throw new Error(`SSH interrupted by ${interruptedBy}`);
+            const ssh = spawn("ssh", connection.sshArgs, { stdio: "inherit" });
+            child = ssh;
+            await new Promise((resolve, reject) => {
+                ssh.once("error", () => reject(new Error("Unable to start SSH")));
+                ssh.once("close", (code) => {
+                    if (interruptedBy)
+                        reject(new Error(`SSH interrupted by ${interruptedBy}`));
+                    else if (code === 255)
+                        reject(new Error("SSH connection failed"));
+                    else {
+                        if (code)
+                            process.exitCode = code;
+                        resolve();
+                    }
+                });
+            });
+        }
+        finally {
+            for (const [signal, handler] of signalHandlers)
+                process.removeListener(signal, handler);
+            cleanup();
+        }
+        return;
+    }
+    if (action === "connect") {
+        const keyPath = getFlagString(flags, "key-file");
+        if (!keyPath)
+            throw new Error("--key-file is required");
+        const { sshArgs: _sshArgs, ...connection } = await issueConnection(executionId, prepareCredentialPath(keyPath));
+        print(connection);
+        return;
+    }
+    const input = action === "extend"
+        ? { action, minutes: numberFlag(flags, "minutes", 1440) }
+        : ["resume", "revoke-ssh", "stop", "kill", "delete"].includes(action)
+            ? { action }
+            : null;
+    if (!input)
+        throw new Error("Unknown command");
+    print(await act(input));
+}
+export async function commandInternalTriage(client, flags, action, id) {
+    const workspaceId = await codeAccessScope(client, flags);
+    const endpoint = `/api/workspaces/${workspaceId}/triage`;
+    if (action === "findings") {
+        process.stdout.write(JSON.stringify(await client.request(endpoint), null, 2) + "\n");
+        return;
+    }
+    if (action === "review") {
+        const findingId = uuid.parse(id).toLowerCase();
+        const validity = z
+            .enum(["valid", "partially_valid", "invalid"])
+            .parse(getFlagString(flags, "validity"));
+        const severityValue = getFlagString(flags, "severity");
+        const severity = severityValue
+            ? z
+                .enum([
+                "extreme",
+                "critical",
+                "high",
+                "medium",
+                "low",
+                "informational",
+            ])
+                .parse(severityValue)
+            : null;
+        if (validity === "invalid" && severity)
+            throw new Error("Invalid reviews must omit --severity");
+        if (validity !== "invalid" && !severity)
+            throw new Error("Valid and partially valid reviews require --severity");
+        const expectedUpdatedAt = z
+            .string()
+            .datetime({ offset: true })
+            .parse(getFlagString(flags, "expected-updated-at"));
+        const requestedId = getFlagString(flags, "request-id");
+        const requestId = uuid.parse(requestedId ?? randomUUID()).toLowerCase();
+        if (!requestedId)
+            process.stderr.write(`Request ID: ${requestId}\n`);
+        const result = await client.request(endpoint, {
+            method: "POST",
+            json: {
+                findingId,
+                requestId,
+                expectedUpdatedAt,
+                edit: {
+                    action: "review",
+                    validity,
+                    severity,
+                    note: getFlagString(flags, "note") ?? "",
+                },
+            },
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return;
+    }
+    if (action !== "edit")
+        throw new Error("Unknown command");
+    const findingId = uuid.parse(id).toLowerCase(), file = getFlagString(flags, "file");
+    if (!file)
+        throw new Error("--file is required");
+    const edit = JSON.parse(readFileSync(file, "utf8"));
+    const expectedUpdatedAt = z
+        .string()
+        .datetime({ offset: true })
+        .parse(getFlagString(flags, "expected-updated-at"));
+    const requestedId = getFlagString(flags, "request-id");
+    const requestId = uuid.parse(requestedId ?? randomUUID()).toLowerCase();
+    if (!requestedId)
+        process.stderr.write(`Request ID: ${requestId}\n`);
+    const result = await client.request(endpoint, {
+        method: "POST",
+        json: { findingId, requestId, expectedUpdatedAt, edit },
+    });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+}

package/dist/local-source-scan.js

@@ -285,7 +285,7 @@ async function inspectCreatedArchive(archivePath, sourceRoot, expectedFiles, dis
             if (!entryPath ||
                 !expectedEntries.has(entryPath) ||
                 observedEntries.has(entryPath) ||
-                !["File", "OldFile", "ContiguousFile", "SymbolicLink", "Link"].includes(entry.type)) {
+                !["File", "OldFile", "ContiguousFile", "SymbolicLink"].includes(entry.type)) {
                 throw new Error(`Archive for ${displayName} changed while it was being prepared.`);
             }
             if (entry.type === "SymbolicLink") {
@@ -294,12 +294,6 @@ async function inspectCreatedArchive(archivePath, sourceRoot, expectedFiles, dis
                 }
                 ensureEntryWithinRoot(sourceRoot, entryPath, entry.linkpath);
             }
-            else if (entry.type === "Link") {
-                const linkedEntry = normalizeRelativeEntry(entry.linkpath ?? "");
-                if (!linkedEntry || !expectedEntries.has(linkedEntry)) {
-                    throw new Error(`Archive for ${displayName} changed while it was being prepared.`);
-                }
-            }
             observedEntries.add(entryPath);
             entryCount += 1;
             const entrySize = Number(entry.size ?? 0);
@@ -347,6 +341,9 @@ async function createDeterministicArchive(params) {
         // that was not reviewed against the ignore rules and upload limits.
         noDirRecurse: true,
         onWriteEntry(entry) {
+            // Kernel rejects hard-link records. With jobs: 1, clearing the inode
+            // cache here makes each subsequent path carry its own file payload.
+            entry.linkCache.clear();
             entry.mtime = FIXED_MTIME;
             entry.uid = 0;
             entry.gid = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cantinasecurity/apex-cli",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "Standalone CLI and MCP server for Apex.",
   "private": false,
   "type": "module",

package/skills/apex-cli/SKILL.md

@@ -156,7 +156,7 @@ finish before saving again.
 
 Scan target and recovery rules:
 - CLI `apex scan [target...]` and repeatable `--repo` accept exact files, directories, or HTTPS GitHub/GitLab or company-enabled Forgejo repository URLs; local MCP uses `repoPaths` for the same selections. No target means `cwd`.
-- A file selection scans only that file, respecting ignore rules. Local snapshots exclude `.apex/` state. Remote URLs use the default branch and cannot fall back to uploading `cwd`; clone locally to choose a branch or commit.
+- A file selection scans only that file, respecting ignore rules. Local snapshots exclude `.apex/` state. Hard-linked files are uploaded independently, while safe relative symbolic links and long filenames are preserved. Remote URLs use the default branch and cannot fall back to uploading `cwd`; clone locally to choose a branch or commit.
 - Use Standard for local changes, files, plain directories, and public repositories without provider access. Lite and Audit still require connected provider sources; do not silently substitute another mode.
 - Unauthenticated headless CLI commands fail with explicit login guidance; they never start device login. Use the MCP auth tools for explicit MCP login. Retry transient refresh failures without clearing credentials.
 - Audit Setup is an explicit Standard/Audit beta flow using saved workspace repositories and context. It does not preserve local targets. Never automatically substitute setup after `AUDIT_SETUP_REQUIRED`; use the error's selected-workspace command only when that saved scope is intended. Draft operations require the ID returned by preparation; eligible accounts receive setup commands in CLI help. Lite and PR do not use `--setup`.
@@ -175,3 +175,5 @@ Finding lifecycle:
 Forgejo connections, remote repository scans, PR scans and Fix Review require the Forgejo company feature enabled by an administrator in Bedrock Settings. Run `apex connect forgejo` (or `apex-connect-provider` with `provider: "forgejo"`) to obtain the browser connection URL. A dedicated bot, HTTPS instance URL and repository-scoped read token are required; PR statuses, comments and webhook installation also require a write token.
 
 After connecting, run `apex doctor --repo . --source-mode remote`, then `apex scan --mode standard --repo . --source-mode remote` or `apex scan --mode pr --pr 42 --repo .`. Same-repository Forgejo PR URLs use `/owner/repository/pulls/42`. Pass a Forgejo Fix PR URL through finding feedback and start Fix Review using the existing finding commands or MCP tools. Disabling the company flag stops native Forgejo access. Existing local Standard snapshots remain provider-independent.
+
+Internal employee beta capabilities are advertised only after live role and workspace eligibility checks. SSH credential delivery is intentionally scripted CLI only; it is not exposed through MCP tools or public help. Server authorization remains mandatory for every action.