fix(git): handle empty repositories without raw HEAD errors

[kunaldhongade]

Closes #617

Problem

Fresh git init repositories have an unborn HEAD. The default changed-files path ran git diff ... HEAD, so CodeDecay leaked raw multi-line git stderr with ambiguous argument 'HEAD'.

Fix

• Detect no-commit repositories before default HEAD diffing.
• Return root-relative added-file changes from staged/untracked files in no-commit repos.
• Update snapshot CLI behavior to emit a valid snapshot for no-commit repos instead of relying on the old error path.

Red to green evidence

Before the fix, the new git test failed with:

Git command failed: git -C <repo> diff --find-renames --name-status HEAD
fatal: ambiguous argument 'HEAD': unknown revision or path not in the working tree.

After the fix, built CLI smoke against a fresh repo reports:

analyze_code=0
snapshot_code=0
analyze_stderr=
snapshot_stderr=
analyze_changed=1
analyze_paths=src/app.ts
snapshot_changed=1

Validation

• pnpm run lint
• pnpm typecheck
• pnpm vitest run packages/git/test/git.test.ts --testNamePattern "no commits"
• pnpm vitest run packages/git/test/git.test.ts packages/cli/test/snapshot.test.ts
• pnpm test
• pnpm build
• pnpm --filter @submuxhq/codedecay pack --dry-run
• built CLI empty-repo smoke test for analyze and snapshot

[github-actions]

CodeDecay PR Check

Lead catch: Path traversal candidate — packages/git/src/changed-files.ts:122

File-system access appears to use request-controlled path input. Evidence: File access is built from request-controlled input.

Risk: High · Merge 100/100 · Decay 0/100 · Security 30/100

Full CodeDecay report

CodeDecay Report

Overall risk: High

Score	Value
Merge risk	100/100
Decay risk	0/100
Security risk	30/100

Findings	Count
High	4
Medium	3
Low	4

Changed Files

• packages/cli/test/snapshot.test.ts modified (+8/-4)
• packages/git/src/changed-files.ts modified (+60/-0)
• packages/git/test/git.test.ts modified (+26/-0)

Likely Impacted Areas

• Low Source code (source): packages/git/src/changed-files.ts
• Low Tests (test): packages/cli/test/snapshot.test.ts, packages/git/test/git.test.ts

Language And Parser Coverage

• Source files classified: 3
• Fully supported parser files: 3
• Limited files: 0
• Unsupported files: 0

Merge Risk Breakdown

• Score: 100/100
• Raw score before dampeners: 100/100
• Adjusted score before severity cap: 100/100
• Highest contributing severity: High

Top contributors:

• +30 Path traversal candidate (direct): File-system access appears to use request-controlled path input. Evidence: File access is built from request-controlled input.
• +30 Project invariant may be impacted (direct): Memory invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
• +30 Project invariant may be impacted (direct): Memory invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
• +30 Project invariant may be impacted (direct): Memory invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
• +16 Project invariant may be impacted (direct): Memory invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.

Notes:

• Blast-radius multipliers were suppressed because the current finding set is narrow or low-signal.

Decay Risk Breakdown

• Score: 0/100
• Raw score before dampeners: 0/100
• Adjusted score before severity cap: 0/100

Security Risk Breakdown

• Score: 30/100
• Raw score before dampeners: 30/100
• Adjusted score before severity cap: 30/100
• Highest contributing severity: High

Top contributors:

• +30 Path traversal candidate (direct): File-system access appears to use request-controlled path input. Evidence: File access is built from request-controlled input.

Notes:

• Blast-radius multipliers were suppressed because the current finding set is narrow or low-signal.

Security Matcher Coverage

• Changed source files scanned: 1
• Security candidates found: 1
• Skipped files: 0

Security Candidates

• High Path traversal candidate CWE-22 (direct) at packages/git/src/changed-files.ts:122: File access is built from request-controlled input.

Test Evidence

• Mode: heuristic-only
• Sources: none
• Changed source coverage:
• packages/git/src/changed-files.ts: not measured (no measurable changed lines)
• Notes:
• No runtime coverage artifact was found. Test audit remains heuristic-only.

High Risk Findings

• Project invariant may be impacted (packages/git/src/changed-files.ts:1): Memory invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
• Project invariant may be impacted (packages/git/src/changed-files.ts:1): Memory invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
• Project invariant may be impacted (packages/git/src/changed-files.ts:1): Memory invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
• Path traversal candidate (packages/git/src/changed-files.ts:122): File-system access appears to use request-controlled path input. Evidence: File access is built from request-controlled input.

Medium Risk Findings

• Project invariant may be impacted (packages/cli/test/snapshot.test.ts:80): Memory invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.
• Changed test does not reference changed source (packages/cli/test/snapshot.test.ts:80): packages/cli/test/snapshot.test.ts changed, but it does not appear to exercise any changed source file.
• Changed test does not reference changed source (packages/git/test/git.test.ts:124): packages/git/test/git.test.ts changed, but it does not appear to exercise any changed source file.

Low Risk Findings

• Architecture note applies (packages/cli/test/snapshot.test.ts:80): CLI is the published surface: The public npm package is @submuxhq/codedecay and the binary is codedecay. Internal workspace packages are implementation details.
• Source area changed (packages/git/src/changed-files.ts:1): packages/git/src/changed-files.ts touches a source area and should be reviewed for regression impact.
• Test area changed (packages/cli/test/snapshot.test.ts:80): packages/cli/test/snapshot.test.ts touches a test area and should be reviewed for regression impact.
• Test area changed (packages/git/test/git.test.ts:124): packages/git/test/git.test.ts touches a test area and should be reviewed for regression impact.

Recommended Checks

• Add or run tests covering packages/git/src/changed-files.ts
• Add or update tests that exercise packages/git/src/changed-files.ts
• Flow check (CLI release smoke): Run built CLI smoke tests
• Flow check (CLI release smoke): Run package dry-run
• Flow check (CLI release smoke): Run published-package or tarball demo before release
• Flow check (Pull request redteam review): Check weak or missing test proof
• Flow check (Pull request redteam review): Keep deterministic evidence separate from AI suggestions
• Flow check (Pull request redteam review): Review edge cases and agent fix tasks
• Flow check (Pull request redteam review): Run codedecay redteam against the PR diff
• Run project command: Full validation (pnpm install && pnpm run lint && pnpm typecheck && pnpm test && pnpm build)
• Run project command: Package dry-run (pnpm --filter @submuxhq/codedecay pack --dry-run)
• Verify flow: CLI release smoke

Notes

CodeDecay is deterministic and local-first. This report was generated without telemetry, API keys, LLMs, or model calls.

---

Found by CodeDecay - deterministic, local-first, no telemetry.