fix(cli): scope review to staged hunks

[andrei-hasna]

Summary

• scan staged index blobs instead of the working tree
• report only findings that intersect added staged hunk lines
• include explicitly staged test and spec files even when broad repository scans ignore them
• fail closed when staged-content scanning cannot complete

Regression coverage

• unchanged vulnerable lines are excluded while the same newly added line is reported
• the same synthetic known-positive is reported in both .test.ts and .ts
• unstaged edits made after git add cannot affect the staged review result

Verification

• bun test src/cli/commands/review.test.ts src/scanners/code.test.ts src/scanners/secrets.test.ts --parallel=1: 97 pass, 0 fail
• bun test --parallel=1 --timeout 30000: 436 pass, 0 fail
• bun run test: 435 pass, 1 unchanged five-second timeout under station load above 50
• bun run typecheck: pass
• bun run check:secrets: 0 violations
• git diff --check origin/main...HEAD: pass
• pre-push hook: scanned 1 outgoing commit

Todos: SHI-00001 (d0bb42cb-27a2-42f0-96e4-afcc59f3147e)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #8 @ 6e47c04 — lens: correctness+security+gates, reviewer Aruns (1 of 1)

Reviewed the exact candidate against freshly fetched base origin/main at ddc74bb7430955a8bfe20c092fe4720855a68b6d.

What I read:

• git log --oneline origin/main..HEAD (exit 0): 6e47c04 fix(cli): scope review to staged hunks
• git diff origin/main...HEAD --stat (exit 0): 2 files changed, 231 insertions, 26 deletions
• Full diff and complete surrounding source for src/cli/commands/review.ts and src/cli/commands/review.test.ts
• Relevant scanner registry, secrets/code scanner traversal and finding paths, FindingInput, terminal reporting, CLI registration, README command contract, and package.json scripts

Commands and exact results:

• bun install — exit 0 (setup only, not a gate); actual output: 211 packages installed [220.00ms]
• bun run typecheck — exit 0; actual invoked script: $ tsc --noEmit; no diagnostics were emitted (the gate does not emit pass/fail counts)
• bun run test — exit 0; actual output: 436 pass, 0 fail, 7025 expect() calls, Ran 436 tests across 46 files. [13.26s]

Blocking P0/P1 findings: none. The reviewed path reads NUL-delimited staged names, snapshots index blobs rather than unstaged working-tree content, invokes Git without a shell, rejects absolute/parent-escaping snapshot paths, filters findings to added hunk lines, and fails closed when Git or scanning fails. The regression tests exercise added-vs-unchanged vulnerable lines, equal coverage for staged test/source files, and staged-index content after later unstaged edits.

Non-blocking follow-ups: none.