fix(workbench): keep finding source excerpts within requested paths

[mldangelo-oai]

Summary

Keep optional finding source excerpts inside the paths selected when the scan started.

Changes

• Save the authorized Git tree and blob IDs for each scan entrypoint in a nullable source-scope column.
• Validate finding paths before invoking Git, then read immutable objects offline using the same indexed locations returned to the caller.
• Index normalized Git names once per tree and keep filesystem aliases bound to their original objects.
• Authenticate requested paths before granting canonical aliases, including selected directory links.
• Preserve exact, unambiguous historical scopes and already-saved objects. Omit new excerpt authority when replacement refs are present, without running a working-tree diff.
• Preserve finding details and public launch recipes, and include the shared helper in the package contract.

Testing

• bun test tests-ts/finding-preview.test.ts — 18 passed, 0 failed.
• Focused preview, report-limit, publication-store, and scan-history tests — 35 passed, 0 failed.
• Fixture connection-lifecycle probe — no SQLite handles left open.
• bun test --timeout 90000 --randomize --seed 12345 — 1,320 passed, 11 skipped, 0 failed.
• Generated-model check, TypeScript check, Prettier check, and Python unused-name checks — passed.
• Package inspection and installed Python/Node entrypoint smoke tests — passed.
• git diff --check — passed.

Risk and rollout

Migration 34 adds a nullable column; existing scan records remain readable. Exact historical scopes remain usable. New scans with replacement refs omit optional source excerpts; later replacement-ref changes do not alter already-saved objects. Finding data, displayed-location limits, and launch recipes do not change. The paired bundled-plugin version is 0.1.25; migration and release ordering must be checked again at integration.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: e2e177ba65

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: e2e177ba65

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

Please review commit 90df0d476b7705a699256ef42078d5ec52073464.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 90df0d476b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 90df0d476b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

Please review commit ed885606373b565c88a1b87b2649aa140ba1e758.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: ed88560637

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: ed88560637

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.