@cantinasecurity/apex-cli 0.1.12 → 0.1.14

package/.claude/skills/apex-cli/SKILL.md

@@ -13,6 +13,8 @@ This skill is bundled with Apex CLI and can be installed into the current reposi
 
 Use Apex through the MCP server when the `apex-*` tools are available.
 
+For on-prem or other non-default Apex hosts, make sure the CLI or MCP server runs with `APEX_BASE_URL` set to the external HTTPS Bedrock origin before auth or provider connection flows.
+
 Recommended workflow:
 
 1. Start with `apex-auth-status`.
@@ -23,7 +25,7 @@ Recommended workflow:
 6. Use `apex-scan`, `apex-status`, `apex-scans`, `apex-findings`, and `apex-export-findings` for the scan lifecycle.
 7. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
 8. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
-9. When an agent creates a fix PR externally, call `apex-finding-feedback` with `status: "valid"`, `labels: ["fixed"]`, and `fixPrUrls`, then call `apex-finding-fix-review` to start the fix review scan.
+9. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
 
 If the Apex MCP server is not configured, fall back to the local CLI:
 
@@ -43,7 +45,8 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 - Finding comments, feedback, and fix review scan starts use the same Apex device-login credentials as read tools. If a write tool reports missing auth, re-run `apex-auth-status` and complete `apex-auth-start` / `apex-auth-wait` instead of asking for browser cookies or auth tokens.
 - Anonymous telemetry records only sanitized command/tool metadata such as command names, enum modes, counts, durations, success/failure categories, CLI version, and client integration. It must not include raw repository paths, scan IDs, finding IDs, comments, file paths, PR URLs, or tokens.
 - Invalid finding feedback requires `dismissalReason`; valid feedback can include `suggestedSeverity`, including `extreme`.
-- Fix PR callback feedback requires valid feedback with `labels: ["fixed"]` and `fixPrUrls`; start the fix review scan with `apex-finding-fix-review` after saving that feedback.
+- PR-based fix reviews can pass `fixPrUrls` directly to `apex-finding-fix-review`; agents that also need to record fixed feedback can first call `apex-finding-feedback` with `status: "valid"`, `labels: ["fixed"]`, and `fixPrUrls`.
+- Current-repository fix reviews omit `fixPrUrls` and require Bedrock original scan repository context for the finding.
 - Finding identifiers such as `KERN2-25` resolve against the selected or latest scan for the current workspace binding. Pass an explicit `scanId` when needed, or use the finding UUID directly.
 
 ## Examples
@@ -53,4 +56,4 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 - Check an active scan: call `apex-status`, passing `scanId` when the scan is not the latest binding, then `apex-findings` when the scan completes.
 - Export findings for review: call `apex-export-findings` with `format` set to `markdown`, `json`, or `gitlab-sast`.
 - Leave review feedback: call `apex-finding-comment` to add a note, or `apex-finding-feedback` with `status` set to `valid` or `invalid`.
-- Add a Fix PR and run fix review: call `apex-finding-feedback` with `status: "valid"`, `labels: ["fixed"]`, and `fixPrUrls`, then call `apex-finding-fix-review`.
+- Run a Fix PR review: call `apex-finding-fix-review` with `fixPrUrls`, optionally after recording fixed feedback with `apex-finding-feedback`.

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Cantina agent plugins for security review workflows.",
-    "version": "0.1.12"
+    "version": "0.1.14"
   },
   "plugins": [
     {
@@ -14,10 +14,10 @@
       "source": {
         "source": "npm",
         "package": "@cantinasecurity/apex-cli",
-        "version": "0.1.12"
+        "version": "0.1.14"
       },
       "description": "Run Apex security scans and review findings from Claude Code.",
-      "version": "0.1.12",
+      "version": "0.1.14",
       "author": {
         "name": "Cantina",
         "email": "support@cantina.xyz"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Run Apex security scans and review findings from Claude Code.",
   "author": {
     "name": "Cantina",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Run Apex security scans and review findings from Codex.",
   "author": {
     "name": "Cantina",

package/.mcp.claude.json

@@ -5,7 +5,7 @@
       "args": [
         "-y",
         "-p",
-        "@cantinasecurity/apex-cli@0.1.12",
+        "@cantinasecurity/apex-cli@0.1.14",
         "apex-mcp"
       ],
       "env": {

package/.mcp.codex.json

@@ -4,7 +4,7 @@
     "args": [
       "-y",
       "-p",
-      "@cantinasecurity/apex-cli@0.1.12",
+      "@cantinasecurity/apex-cli@0.1.14",
       "apex-mcp"
     ],
     "env": {

package/MARKETPLACE.md

@@ -13,7 +13,7 @@ This package is prepared as both a Claude Code plugin and a Codex plugin. The pu
 The plugin MCP configs launch the pinned npm CLI package with:
 
 ```bash
-npx -y -p @cantinasecurity/apex-cli@0.1.12 apex-mcp
+npx -y -p @cantinasecurity/apex-cli@0.1.14 apex-mcp
 ```
 
 That keeps marketplace installs independent of a user's global `apex` install.

package/README.md

@@ -74,10 +74,13 @@ pnpm apex
 
 By default, the CLI targets `https://ai.cantina.xyz/`.
 
-Use `APEX_BASE_URL` only when testing against a non-production Apex host:
+Use `APEX_BASE_URL` only when targeting a non-default Apex host. For on-prem deployments,
+set it to the same external HTTPS Bedrock origin configured as `ONPREM_PUBLIC_BASE_URL`;
+browser handoffs such as `apex connect github` and `apex-connect-provider` need that
+public origin for GitHub callback and success redirects.
 
 ```bash
-APEX_BASE_URL=https://preview.cantina.xyz pnpm apex
+APEX_BASE_URL=https://bedrock.customer.example pnpm apex
 ```
 
 ## Interactive Shell
@@ -138,7 +141,7 @@ Supported shell commands:
 - `apex findings [--scan <scan-id>]`
 - `apex findings comment <finding-id|finding-identifier> --content <markdown> [--parent-comment <comment-id>] [--scan <scan-id>]`
 - `apex findings feedback <finding-id|finding-identifier> <valid|invalid> [comment] [--comment <markdown>] [--scan <scan-id>] [--suggested-severity extreme|critical|high|medium|low|informational] [--dismissal-reason false-positive|by-design|not-relevant] [--label acknowledged|fixed] [--fix-pr-url <github-pr-url>]`
-- `apex findings fix-review <finding-id|finding-identifier> [--scan <scan-id>]`
+- `apex findings fix-review <finding-id|finding-identifier> [--scan <scan-id>] [--review-target pull-request|repository-current] [--fix-pr-url <github-pr-url>]`
 - `apex export findings [--scan <scan-id>] [--format markdown|json|gitlab-sast] [--output <path>]`
 - `apex workspaces`
 - `apex workspace`
@@ -181,12 +184,12 @@ Finding comments, valid/invalid feedback, and fix review scan starts use the sam
 
 Invalid feedback requires a dismissal reason. Valid feedback can include `--suggested-severity extreme|critical|high|medium|low|informational`.
 
-Fix review scans use a two-step callback flow for agents that create a PR outside Apex:
+Fix review scans can review either a Fix PR or the current repository state:
 
-1. Save fixed feedback on the finding with `--label fixed` and one or more `--fix-pr-url` values.
-2. Start the scan with `apex findings fix-review <finding-id|finding-identifier>`.
+1. For PR-based reviews, either save fixed feedback on the finding with `--label fixed` and one or more `--fix-pr-url` values, or pass `--fix-pr-url` directly to `apex findings fix-review`.
+2. For current-repository reviews, run `apex findings fix-review <finding-id|finding-identifier>` without Fix PR URLs. Bedrock must have original scan repository context for the finding.
 
-The matching MCP flow is `apex-finding-feedback` with `status: "valid"`, `labels: ["fixed"]`, and `fixPrUrls`, followed by `apex-finding-fix-review`.
+The matching MCP flow is `apex-finding-fix-review` with optional `fixPrUrls`. Agents that need to record fixed feedback first can still call `apex-finding-feedback` with `status: "valid"`, `labels: ["fixed"]`, and `fixPrUrls`, then call `apex-finding-fix-review`.
 
 The matching CLI and MCP flows intentionally use the same device-login session so agents should not ask users to paste browser cookies or auth tokens.
 
@@ -308,7 +311,7 @@ The MCP server exposes Apex-specific tools for:
 - scan start, status, cancellation, findings, and findings export
 - PR scan start by calling `apex-scan` with `mode: "pr"` and `pullRequests`
 - finding comments and valid/invalid feedback with `apex-finding-comment` and `apex-finding-feedback`
-- Fix PR callback and fix review scans with `apex-finding-feedback` plus `apex-finding-fix-review`
+- Fix PR and current-repository fix review scans with `apex-finding-fix-review`, optionally after `apex-finding-feedback`
 
 For repository-scoped operations, pass `cwd` explicitly so the server can resolve the right `.apex/workspace.json` binding and repository roots.
 
@@ -347,7 +350,7 @@ Telemetry event posts do not include bearer tokens. The telemetry endpoint is `P
     {
       "schemaVersion": 1,
       "event": "apex.invocation.completed",
-      "cliVersion": "0.1.12",
+      "cliVersion": "0.1.14",
       "invocation": {
         "surface": "mcp",
         "command": "apex-scan",
@@ -378,7 +381,7 @@ The npm package also includes marketplace-ready plugin artifacts:
 - `.claude-plugin/plugin.json` and `.mcp.claude.json` for Claude Code plugin installs
 - `.claude-plugin/marketplace.json` for a Claude marketplace entry backed by the public npm package
 
-These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.12 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
+These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.14 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
 
 The repository also includes `.agents/plugins/marketplace.json` for local Codex marketplace testing from a checkout.
 

package/dist/commands.js

@@ -36,6 +36,10 @@ const FINDING_FEEDBACK_LABELS = [
     "acknowledged",
     "fixed",
 ];
+const FIX_REVIEW_TARGETS = [
+    "pull_request",
+    "repository_current",
+];
 async function saveCompanyDefault(companyId) {
     const config = await loadConfig();
     if (config.defaultCompanyId !== companyId) {
@@ -336,6 +340,19 @@ function normalizeDismissalReason(value) {
     }
     throw new Error(`Dismissal reason must be one of: ${FINDING_DISMISSAL_REASONS.join(", ")}.`);
 }
+function normalizeFixReviewTarget(value) {
+    const normalized = value?.trim().replace(/-/g, "_") ?? "";
+    if (!normalized) {
+        return null;
+    }
+    if (FIX_REVIEW_TARGETS.includes(normalized)) {
+        return normalized;
+    }
+    throw new Error("Fix review target must be one of: pull-request, repository-current.");
+}
+function formatFixReviewTarget(value) {
+    return value === "repository_current" ? "current repository" : "pull request";
+}
 async function requireWorkspaceBinding(cwd) {
     const binding = await loadWorkspaceBinding(cwd);
     if (binding) {
@@ -1130,6 +1147,13 @@ export async function commandFindingFeedback(client, cwd, flags, params) {
 }
 export async function commandFindingFixReview(client, cwd, flags, requestedFindingRef) {
     const findingRef = normalizeFindingRefInput(requestedFindingRef);
+    const reviewTarget = normalizeFixReviewTarget(getFlagString(flags, "review-target"));
+    const fixPrUrls = getFlagList(flags, "fix-pr-url")
+        .map((url) => url.trim())
+        .filter((url) => url.length > 0);
+    if (reviewTarget === "repository_current" && fixPrUrls.length > 0) {
+        throw new Error("Fix PR URLs require the pull-request fix review target.");
+    }
     const currentBinding = await loadWorkspaceBinding(cwd);
     const needsWorkspaceResolution = !isFindingUuid(findingRef);
     const binding = needsWorkspaceResolution
@@ -1144,7 +1168,10 @@ export async function commandFindingFixReview(client, cwd, flags, requestedFindi
         requestedFindingRef: findingRef,
         requestedScanId: getFlagString(flags, "scan"),
     }));
-    const response = await withLoadingIndicator("Starting fix review scan...", flags, () => startFindingFixReviewScan(client, selection.findingId));
+    const response = await withLoadingIndicator("Starting fix review scan...", flags, () => startFindingFixReviewScan(client, selection.findingId, {
+        reviewTarget,
+        fixPrUrls,
+    }));
     const nextBinding = binding && selection.scan
         ? {
             ...binding,
@@ -1174,12 +1201,18 @@ export async function commandFindingFixReview(client, cwd, flags, requestedFindi
     if (response.fixReview.kernelScanId) {
         logLine(`Kernel scan: ${response.fixReview.kernelScanId}`, flags);
     }
+    if (response.fixReview.reviewTarget) {
+        logLine(`Review target: ${formatFixReviewTarget(response.fixReview.reviewTarget)}`, flags);
+    }
     if (response.fixReview.fixPrUrls?.length) {
         logLine(`Fix PRs: ${response.fixReview.fixPrUrls.join(", ")}`, flags);
     }
-    else {
+    else if (response.fixReview.fixPrUrl) {
         logLine(`Fix PR: ${response.fixReview.fixPrUrl}`, flags);
     }
+    if (response.fixReview.repoName) {
+        logLine(`Repository: ${response.fixReview.repoName}`, flags);
+    }
     if (response.reused) {
         logLine("Reused existing active fix review scan.", flags);
     }

package/dist/findings.js

@@ -232,9 +232,17 @@ export async function submitFindingFeedback(client, findingId, input) {
         },
     });
 }
-export async function startFindingFixReviewScan(client, findingId) {
+export async function startFindingFixReviewScan(client, findingId, input = {}) {
+    const fixPrUrls = input.fixPrUrls
+        ?.map((url) => url.trim())
+        .filter((url) => url.length > 0) ?? [];
     return requestFindingAppRoute(client, `/api/findings/${encodeURIComponent(findingId)}/fix-review`, {
         method: "POST",
-        json: {},
+        json: {
+            ...(input.reviewTarget ? { reviewTarget: input.reviewTarget } : {}),
+            ...(fixPrUrls.length > 0
+                ? { fixPrUrl: fixPrUrls[0], fixPrUrls }
+                : {}),
+        },
     });
 }

package/dist/help.js

@@ -9,7 +9,7 @@ export const CLI_HELP_TEXT = `Usage:
   apex findings feedback <finding-id|finding-identifier> <valid|invalid>
                                     Leave feedback; invalid requires --dismissal-reason
   apex findings fix-review <finding-id|finding-identifier>
-                                    Start a fix review scan after fixed feedback has a Fix PR URL
+                                    Start a fix review scan for a Fix PR or current repository
   apex export findings              Export findings for the latest or selected scan
   apex workspaces                   List accessible workspaces for the active company
   apex workspace                    Show the workspace currently bound to this directory
@@ -42,7 +42,9 @@ Flags:
   --dismissal-reason false-positive|by-design|not-relevant
                                     Explain why invalid feedback is being left
   --label acknowledged|fixed        Attach a valid-feedback label
-  --fix-pr-url <github-pr-url>      Attach one or more Fix PR URLs to fixed feedback
+  --fix-pr-url <github-pr-url>      Attach one or more Fix PR URLs to feedback or fix-review start
+  --review-target pull-request|repository-current
+                                    Choose the fix review target when starting a fix review
   --format markdown|json|gitlab-sast
                                     Choose the export format for findings
   --output <path>                   Write exported findings to this file path
@@ -66,7 +68,7 @@ Tips:
   apex workspace use accepts a workspace name, prefix, or ID.
   Finding comments, feedback, and fix review scans use the same Apex login credentials as other CLI commands.
   Invalid finding feedback requires --dismissal-reason.
-  Fix review scans require valid feedback with --label fixed and at least one --fix-pr-url, then apex findings fix-review.
+  Fix review scans use saved or supplied Fix PR URLs when present; otherwise they review the current repository when Bedrock has original scan repository context.
   Finding identifiers such as KERN2-25 resolve against the selected scan; pass --scan or use the finding UUID directly when needed.
   Anonymous usage telemetry helps Apex understand CLI, MCP, Codex, Claude, and Copilot usage. Disable it with apex telemetry disable or APEX_TELEMETRY_DISABLED=1.
   Quote workspace names that contain spaces:
@@ -87,7 +89,7 @@ Commands:
   /findings feedback <finding-ref> invalid <reason> [comment]
                           Leave invalid feedback; reason is false-positive, by-design, or not-relevant
   /findings fix-review <finding-ref>
-                          Start a fix review scan after fixed feedback has a Fix PR URL
+                          Start a fix review scan for a Fix PR or current repository
   /export [scan-id]       Export findings for the latest or selected scan
   /workspaces             List accessible workspaces for the active company
   /cancel-scan [scan-id]  Cancel a running or most recent scan
@@ -115,7 +117,7 @@ Tips:
   /workspace use accepts a workspace name, prefix, or ID.
   /findings comment, /findings feedback, and /findings fix-review use the current Apex login.
   Invalid finding feedback requires a dismissal reason.
-  Fix review scans require fixed valid feedback with a Fix PR URL. Use scripted CLI or MCP for attaching Fix PR URLs.
+  Fix review scans use saved Fix PR URLs when present; otherwise they review the current repository when Bedrock has original scan repository context. Use scripted CLI or MCP to supply Fix PR URLs directly.
   Use scripted CLI flags for advanced feedback options such as suggested severity or dismissal reason.
   Anonymous usage telemetry can be disabled with /telemetry disable or APEX_TELEMETRY_DISABLED=1.
   Quote workspace names that contain spaces: /workspace use "Core Platform"

package/dist/mcp.js

@@ -18,7 +18,7 @@ Suggested workflow:
 5. Start and monitor scans with apex-scan, apex-status, apex-scans, apex-findings, and apex-export-findings.
 6. For PR scans, call apex-scan with mode "pr" and one or more pullRequests.
 7. Leave finding comments or valid/invalid feedback with apex-finding-comment and apex-finding-feedback when review collaboration is needed.
-8. To attach a fix PR and trigger a fix review scan, call apex-finding-feedback with status "valid", label "fixed", and fixPrUrls, then call apex-finding-fix-review.
+8. To review a fix, call apex-finding-fix-review. Pass fixPrUrls for PR-based fix reviews, or omit them to review the current repository state when Bedrock has original scan repository context.
 
 Notes:
 - Pass cwd explicitly for repository-specific operations.
@@ -67,12 +67,18 @@ function buildFlags(options) {
     if (options.sourceMode) {
         flags["source-mode"] = options.sourceMode;
     }
+    if (options.reviewTarget) {
+        flags["review-target"] = options.reviewTarget;
+    }
     if (options.force === true) {
         flags.force = true;
     }
     if (options.repoPaths && options.repoPaths.length > 0) {
         flags.repo = options.repoPaths;
     }
+    if (options.fixPrUrls && options.fixPrUrls.length > 0) {
+        flags["fix-pr-url"] = options.fixPrUrls;
+    }
     if (options.pullRequests && options.pullRequests.length > 0) {
         flags.pr = options.pullRequests.map((pullRequest) => {
             const paths = pullRequest.paths
@@ -573,17 +579,21 @@ function registerTools(server) {
     }));
     server.registerTool("apex-finding-fix-review", {
         title: "Start Apex Finding Fix Review Scan",
-        description: "Start a fix review scan for a finding after fixed feedback with one or more Fix PR URLs has been saved.",
+        description: "Start a fix review scan for a finding. Pass fixPrUrls for a PR-based review, or omit them to review the current repository state when original scan repository context is available.",
         inputSchema: {
             cwd: z.string().optional(),
             findingRef: z.string(),
             scanId: z.string().optional(),
+            reviewTarget: z.enum(["pull_request", "repository_current"]).optional(),
+            fixPrUrls: z.array(z.string().url()).max(20).optional(),
         },
-    }, async ({ cwd, findingRef, scanId }) => runTool("apex-finding-fix-review", async () => {
+    }, async ({ cwd, findingRef, scanId, reviewTarget, fixPrUrls }) => runTool("apex-finding-fix-review", async () => {
         const client = new ApexApiClient();
         const targetCwd = resolveCwd(cwd);
         const payload = await commandFindingFixReview(client, targetCwd, buildFlags({
             scanId,
+            reviewTarget,
+            fixPrUrls,
         }), findingRef);
         return {
             cwd: targetCwd,
@@ -593,6 +603,8 @@ function registerTools(server) {
         cwd,
         findingRef,
         scanId,
+        reviewTarget,
+        fixPrUrls,
     }));
     server.registerTool("apex-export-findings", {
         title: "Export Apex Findings",

package/dist/telemetry.js

@@ -28,6 +28,7 @@ const KNOWN_CLI_FLAG_NAMES = [
     "pr",
     "pr-path",
     "repo",
+    "review-target",
     "scan",
     "source-mode",
     "status",
@@ -104,6 +105,12 @@ function boolFlag(flags, key) {
 function safeEnum(value, allowed) {
     return allowed.includes(value) ? value : null;
 }
+function safeFixReviewTarget(value) {
+    return safeEnum(value?.replace(/-/g, "_") ?? null, [
+        "pull_request",
+        "repository_current",
+    ]);
+}
 function bucketCount(count) {
     if (count <= 0)
         return "0";
@@ -175,6 +182,7 @@ function sanitizeCliFlags(flags) {
         sourceMode: safeEnum(stringFlag(flags, "source-mode"), ["auto", "remote", "local"]),
         format: safeEnum(stringFlag(flags, "format"), ["markdown", "json", "gitlab-sast"]),
         feedbackStatus: safeEnum(stringFlag(flags, "status"), ["valid", "invalid"]),
+        fixReviewTarget: safeFixReviewTarget(stringFlag(flags, "review-target")),
         dismissalReason: safeEnum(stringFlag(flags, "dismissal-reason"), [
             "false-positive",
             "by-design",
@@ -355,6 +363,7 @@ export function sanitizeMcpInput(input = {}) {
             "valid",
             "invalid",
         ]),
+        fixReviewTarget: safeFixReviewTarget(typeof input.reviewTarget === "string" ? input.reviewTarget : null),
         dismissalReason: safeEnum(typeof input.dismissalReason === "string" ? input.dismissalReason : null, ["false-positive", "by-design", "not-relevant"]),
         suggestedSeverity: safeEnum(typeof input.suggestedSeverity === "string" ? input.suggestedSeverity : null, ["extreme", "critical", "high", "medium", "low", "informational"]),
         repoCount: arrayLength(input.repoPaths),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cantinasecurity/apex-cli",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Standalone CLI and MCP server for Apex.",
   "private": false,
   "type": "module",

package/skills/apex-cli/SKILL.md

@@ -11,6 +11,8 @@ Prefer the Apex MCP tools over running `apex` in the shell when the server is av
 
 `apex setup codex` configures the MCP server with client attribution so Apex can distinguish Codex MCP usage from direct CLI usage. Users can inspect or disable anonymous local usage telemetry with `apex telemetry status` and `apex telemetry disable`.
 
+For on-prem or other non-default Apex hosts, make sure the MCP server runs with `APEX_BASE_URL` set to the external HTTPS Bedrock origin before auth or provider connection flows.
+
 Workflow:
 
 1. Start with `apex-auth-status`.
@@ -21,7 +23,7 @@ Workflow:
 6. Use `apex-scan`, `apex-status`, `apex-scans`, `apex-findings`, and `apex-export-findings` for the scan lifecycle.
 7. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
 8. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
-9. When an agent creates a fix PR externally, call `apex-finding-feedback` with `status: "valid"`, `labels: ["fixed"]`, and `fixPrUrls`, then call `apex-finding-fix-review` to start the fix review scan.
+9. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
 
 Guidelines:
 
@@ -40,5 +42,6 @@ Guidelines:
 - Finding comments, feedback, and fix review scan starts use the same Apex device-login credentials as read tools. If a write tool reports missing auth, re-run `apex-auth-status` and complete `apex-auth-start` / `apex-auth-wait` instead of asking for browser cookies or auth tokens.
 - Anonymous telemetry records only sanitized command/tool metadata such as command names, enum modes, counts, durations, success/failure categories, CLI version, and client integration. It must not include raw repository paths, scan IDs, finding IDs, comments, file paths, PR URLs, or tokens.
 - Invalid finding feedback requires `dismissalReason`; valid feedback can include `suggestedSeverity`, including `extreme`.
-- Fix PR callback feedback requires valid feedback with `labels: ["fixed"]` and `fixPrUrls`; start the fix review scan with `apex-finding-fix-review` after saving that feedback.
+- PR-based fix reviews can pass `fixPrUrls` directly to `apex-finding-fix-review`; agents that also need to record fixed feedback can first call `apex-finding-feedback` with `status: "valid"`, `labels: ["fixed"]`, and `fixPrUrls`.
+- Current-repository fix reviews omit `fixPrUrls` and require Bedrock original scan repository context for the finding.
 - Finding identifiers such as `KERN2-25` resolve against the selected or latest scan for the current workspace binding. Pass an explicit scan when needed, or use the finding UUID directly.