From e20c20bd34a078ac5a0d66a103419f4f2e5267b5 Mon Sep 17 00:00:00 2001
From: WenJing95 <126436871+WenJing95@users.noreply.github.com>
Date: Sat, 17 Oct 2026 15:18:43 +0900
Subject: [PATCH] fix(plugin): separate diff revisions from paths in scan
 inputs

---
 .../scripts/generate_rank_input.py               |  1 +
 .../tests/test_generate_rank_input.py            | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/plugins/codex-security/scripts/generate_rank_input.py b/plugins/codex-security/scripts/generate_rank_input.py
index 754abc9d11..8d834cebf0 100644
--- a/plugins/codex-security/scripts/generate_rank_input.py
+++ b/plugins/codex-security/scripts/generate_rank_input.py
@@ -227,6 +227,7 @@ def run_git_changed_paths(repo: Path, diff_args: list[str]) -> list[tuple[Path,
         "-z",
         "--diff-filter=ACMRDT",
         *diff_args,
+        "--",
         text=False,
     )
     result.check_returncode()
diff --git a/plugins/codex-security/tests/test_generate_rank_input.py b/plugins/codex-security/tests/test_generate_rank_input.py
index b0b741c06e..54dd4e9000 100644
--- a/plugins/codex-security/tests/test_generate_rank_input.py
+++ b/plugins/codex-security/tests/test_generate_rank_input.py
@@ -697,6 +697,22 @@ def test_make_diff_rank_input_combines_staged_and_unstaged_patch(tmp_path: Path)
     ]
 
 
+def test_make_diff_rank_input_accepts_base_that_matches_a_path(tmp_path: Path) -> None:
+    repo = tmp_path / "repo"
+    (repo / "release").mkdir(parents=True)
+    initialize_repo(repo)
+    (repo / "release" / "build.py").write_text("build = 1", encoding="utf-8")
+    git(repo, "add", ".")
+    git(repo, "commit", "-qm", "base")
+    git(repo, "branch", "release")
+    (repo / "release" / "build.py").write_text("build = 2", encoding="utf-8")
+    output = tmp_path / "patch.jsonl"
+
+    run_repo_cli("make-diff-rank-input", repo, output, "--base", "release", "--mode", "local-patch")
+
+    assert [row["path"] for row in read_jsonl(output)] == ["release/build.py"]
+
+
 @pytest.mark.parametrize("mode", ["revisions", "local-patch"])
 def test_make_rank_input_decodes_bom_marked_utf16_source(tmp_path: Path, mode: str) -> None:
     repo = tmp_path / "repo"