[sylvesterkaczmarek]

Summary

Fixes #514. A saved diff scan can have a head revision without recording what kind of diff was scanned. In that case, reports could show a line from the commit even when the finding came from different text in the working tree.

Changes

Only use Git objects for a saved diff excerpt when the target kind is commit or range. The check happens before either stored source scopes or the fallback for older scans is used. The regression test exercises both paths and checks that standard scans still show their source.

Testing

• Reproduced the wrong line on main using a sealed scan in a temporary Git repository. Both get-scan and list-findings returned it for a null target kind and for a simulated unrecognized kind. Both omit it with the fix. Commit and range excerpts still match the committed file; working-tree diffs still omit the excerpt.
• The regression test failed in the four affected cases on main. All 12 cases passed with the fix, as did all 40 related workbench tests and three SDK fixture scenarios.
• All five portable plugin checks passed: Ruff lint and format, the SDK CI build, plugin source compatibility, and all nine tests for the compatibility checker.

Risk and rollout

Only the optional source excerpt changes. Findings, locations, and sealed artifacts are untouched. Existing saved scans pick up the fix when read; no migration is needed.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[sylvesterkaczmarek]

I resolved this PR against current main while preserving the intended fix and newer upstream behavior. The branch is now mergeable and no longer has a base conflict. Could a maintainer please re-review it when convenient?

@codex review

[sylvesterkaczmarek]

The current node-ci run is green. Could a maintainer review the remaining unknown-target excerpt guard?

[mldangelo-oai]

Thanks for sticking with this one. I checked the same saved scan before and after the fix: both get-scan and list-findings now leave out the misleading excerpt, and commit and range scans still show the right line. Looks good to me.

[sylvesterkaczmarek]

Thanks for taking another look and checking the saved scan before and after. Glad this one is in.