CLI: platform and QAST commands

One binary, two kinds of command. The local half — scan, scan deps, scan tls, baseline, doctor, version, self-update — needs no network and no account, and runs entirely on your machine.

This page covers the other half — the commands that call your tenant API and, unless noted, require an authenticated session. There is no offline fallback for them, with one deliberate exception described under the release gate.

Credentials resolve in a fixed order: RELIXQ_API_TOKEN (then the legacy RELIXQ_TOKEN) from the environment, then the OS keychain — Windows Credential Manager, macOS Keychain, or Linux Secret Service — populated by relixq login. If neither yields a token, platform commands fail with not logged in.

version: 1
project: payments-api        # active project for platform commands
default_branch: main

remote:
  api_url: https://api.relixq.io

gate:
  fail_on_score_drop: 5      # see relixq pentest gate

relixq login / logout / whoami

login runs the device-code flow: it prints a verification URL and a short code, you approve in a browser, and the resulting access and refresh tokens are stored in your OS keychain — never on disk in plain text. logout removes them. whoami currently confirms that a stored credential exists; it does not yet call a profile endpoint.

relixq org list / org use <slug>

org list prints the organizations you belong to with slug, name, role, and join date. org use switches your active organization: the platform re-mints your access token scoped to the target org, so every subsequent command operates in that context. Exits 1 if the slug is not among your memberships.

relixq use <project-slug>

Sets the active project by writing the project field into relixq.yaml in the current directory, creating the file if absent and preserving other settings. Purely local — no API call.

relixq remote-scan [--wait]

Triggers a scan on the platform for the active project. Without --wait it prints the scan run id and returns. With --wait it polls every 3 seconds until the run reaches a terminal state, then prints the findings in your configured output format. Exits 1 if the scan ends failed or cancelled.

relixq submit [findings.jsonl]

Uploads local scan results so they appear in your workspace alongside server-side scans. Reads JSONL from the file argument or from stdin, so it pipes directly from a local scan.

relixq report --scan-id <id>

Downloads the report for a completed platform scan. --format accepts markdown, sarif, json, or html; -o writes to a file.

relixq rules list / install / update / show

Manages rule packs through the platform rule registry. These are not a local pack manager and require login. For local scans, point --rules at a rule directory instead.

# Scan locally, then publish the findings to your tenant
relixq scan --format jsonl | relixq submit

# Or have the platform do the scanning
relixq remote-scan --wait

Reads a SARIF file produced by relixq scan --format sarif, then posts or updates an idempotent summary comment on the pull request and creates a GitHub check run with inline annotations, capped at 50. The comment leads with the RelixQ Score; pass --base-sarif with a scan of the base branch to show a before-and-after delta.

The QAST honesty stance applies verbatim to every subcommand: adversary modeling, reachability, and a consent-gated PQC-readiness probe. No decryption is performed.

$ relixq pentest run --project payments-api
QAST run started: 7d31c0aa-....
  mode:   passive
  status: queued
  QAST - adversary-modeling + reachability + consent-gated PQC-readiness probe;
  no decryption is performed.

With --quiet, only the run id is printed, which is script-friendly. Exit codes: 1 on the RoE refusal, when no project is set, or on any API error; 0 when the run is accepted.

Exit codes: 1 when the verdict is fail — which only block mode produces — or when the command itself errors; 0 otherwise. The exit code, the JSON verdict, the check-run conclusion, and the PR comment always agree.