From cf56e9b6801c05dbf5677604d9d8fdb8cd04f919 Mon Sep 17 00:00:00 2001
From: Sylvester Kaczmarek
 <16242628+sylvesterkaczmarek@users.noreply.github.com>
Date: Wed, 30 Sep 2026 23:12:52 +0100
Subject: [PATCH] fix(plugin): avoid stale source excerpts for working-tree
 diffs

Refresh onto current main.
---
 .../scripts/workbench_source_excerpt.py       |  2 +
 .../tests-ts/workbench-source-excerpt.test.ts | 54 +++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100644 sdk/typescript/tests-ts/workbench-source-excerpt.test.ts

diff --git a/plugins/codex-security/scripts/workbench_source_excerpt.py b/plugins/codex-security/scripts/workbench_source_excerpt.py
index 06c4075c73..aca9e212a0 100644
--- a/plugins/codex-security/scripts/workbench_source_excerpt.py
+++ b/plugins/codex-security/scripts/workbench_source_excerpt.py
@@ -65,6 +65,8 @@ def finding_source_excerpt(
 def scanned_source_text(scan: sqlite3.Row, target: Path, path: str) -> str | None:
     if safe_source_path(target, path) is None:
         return None
+    if scan["mode"] == "diff" and scan["diff_target_kind"] not in {"commit", "range"}:
+        return None
     revision = scan["target_revision"]
     if revision == "unversioned":
         return None
diff --git a/sdk/typescript/tests-ts/workbench-source-excerpt.test.ts b/sdk/typescript/tests-ts/workbench-source-excerpt.test.ts
new file mode 100644
index 0000000000..bf1c24f560
--- /dev/null
+++ b/sdk/typescript/tests-ts/workbench-source-excerpt.test.ts
@@ -0,0 +1,54 @@
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+import { PLUGIN_ROOT } from "./plugin-root.js";
+
+describe("workbench source excerpts", () => {
+  test("does not read HEAD for mutable or unknown diff targets", () => {
+    const python =
+      Bun.which("python3") ?? Bun.which("python") ?? Bun.which("py");
+    expect(python).not.toBeNull();
+
+    const program = [
+      "import json, sys",
+      "from pathlib import Path",
+      "sys.path.insert(0, sys.argv[1])",
+      "import workbench_source_excerpt as source_excerpt",
+      "calls = []",
+      "source_excerpt.safe_source_path = lambda target, path: target / path",
+      "def fake_git_bytes(target, *args):",
+      "    calls.append(list(args))",
+      "    return b'committed source\\n'",
+      "source_excerpt.git_bytes = fake_git_bytes",
+      "def read(kind):",
+      "    scan = {'mode': 'diff', 'diff_target_kind': kind, 'target_revision': 'abc123', 'target_snapshot_digest': None}",
+      "    return source_excerpt.scanned_source_text(scan, Path('/repo'), 'src/app.py')",
+      "results = {kind or 'unknown': read(kind) for kind in ('working_tree', None, 'commit', 'range')}",
+      "print(json.dumps({'results': results, 'calls': calls}))",
+    ].join("\n");
+    const result = Bun.spawnSync(
+      [
+        python!,
+        "-I",
+        "-B",
+        "-c",
+        program,
+        join(PLUGIN_ROOT, "scripts"),
+      ],
+      { stdout: "pipe", stderr: "pipe" },
+    );
+
+    expect(result.exitCode, new TextDecoder().decode(result.stderr)).toBe(0);
+    expect(JSON.parse(new TextDecoder().decode(result.stdout))).toEqual({
+      results: {
+        working_tree: null,
+        unknown: null,
+        commit: "committed source\n",
+        range: "committed source\n",
+      },
+      calls: [
+        ["cat-file", "blob", "abc123:src/app.py"],
+        ["cat-file", "blob", "abc123:src/app.py"],
+      ],
+    });
+  });
+});