fix(workbench): share scan history across linked worktrees

[mldangelo-oai]

Summary

Keep security scans, findings, and reviewer decisions associated with their verified Git worktrees, including after a worktree is removed.

Changes

• Add an append-only repository identity migration and repair missing or dangling historical target references.
• Derive scoped repository identities from registered worktrees and immutable Git-directory creation metadata.
• Share scan history, matching, findings, reviewer feedback, and open-finding counts across verified linked worktrees.
• Preserve case-sensitive repository paths on Windows and reject unrelated clones or replaced checkouts.
• Retain scoped scan history when a repository subdirectory is recreated, without relaxing root-checkout ownership.
• Keep the existing CLI interface and remove redundant repository-wide findings queries.
• Add focused migration, worktree lifecycle, ownership, Windows-path, CLI, SDK, and triage regressions.

Testing

• pnpm run types
• pnpm run format
• pnpm run build
• Ruff checks on the modified bundled workbench scripts.
• Full SDK suite: 1,157 tests passed and 11 were skipped. One macOS nested-sandbox test cannot start sandbox-exec inside the desktop sandbox; its complete focused suite passed outside that sandbox.
• Eight focused suites with --randomize --seed 12345: 44 tests passed and two platform-specific cases were skipped.
• Packed the npm package and checked its publication contract.

Risk and rollout

• Migration 30 is additive, nullable, and indexed; existing target IDs, finding fingerprints, and sealed scan artifacts remain unchanged.
• Sharing requires verified repository identity, target scope, and checkout ownership; matching remotes alone never authorize sharing.
• Filesystems without a usable repository creation timestamp fail closed instead of associating unverified worktrees.
• Out-of-order migration coverage permits an independent lower-numbered migration to land later.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eef22c38a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 20b170e3ca

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 20b170e3ca

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 20b170e3ca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[wholley-oai]

I took a cursory glance and have Codex reviewing more thoroughly, but on first pass this looks fine so I'm ok with providing an unblocking stamp.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 4f1eb91dcb

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4f1eb91dcb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: e895dde338

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: e895dde338

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.