From a73b022f269d78132ef8149f1acec77fb29a8b10 Mon Sep 17 00:00:00 2001
From: Alex Schapiro <bearsyankees@gmail.com>
Date: Tue, 28 Jul 2026 04:48:44 +0000
Subject: [PATCH] docs(skills): make diff-base resolution robust

- Drop @{u} fallback that could resolve the current feature branch as its
  own diff base (empty diff -> falsely clean verification)
- Prefer origin/HEAD, then a common default branch that exists, else HEAD~1
- CI: resolve base branch without pipe-masking (parameter expansion + ref
  verification) so a failed lookup can't silently produce origin/
---
 skills/strix-ci-setup/SKILL.md     | 13 ++++++++++---
 skills/strix-fix-findings/SKILL.md | 10 +++++++++-
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/skills/strix-ci-setup/SKILL.md b/skills/strix-ci-setup/SKILL.md
index 3efa2f843..416c1c665 100644
--- a/skills/strix-ci-setup/SKILL.md
+++ b/skills/strix-ci-setup/SKILL.md
@@ -76,9 +76,16 @@ Any pipeline works the same way — install, set the two env vars, run headless:
 
 ```bash
 curl -sSL https://strix.ai/install | bash
-# Resolve the PR's base branch (fall back to the remote default, then main).
-DIFF_BASE="${CI_MERGE_REQUEST_TARGET_BRANCH_NAME:-}"
-DIFF_BASE="origin/${DIFF_BASE:-$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##' || echo main)}"
+# Resolve the PR's base branch robustly (use your CI's base-branch variable if it
+# has one, e.g. GitHub Actions: origin/${{ github.base_ref }}). Avoid piping the
+# git lookup into another command — a failed lookup would otherwise be masked.
+BASE_BRANCH="${CI_MERGE_REQUEST_TARGET_BRANCH_NAME:-}"   # GitLab MR target
+if [ -z "$BASE_BRANCH" ]; then
+  BASE_BRANCH=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null)
+  BASE_BRANCH="${BASE_BRANCH#origin/}"
+fi
+DIFF_BASE="origin/${BASE_BRANCH:-main}"
+git rev-parse --verify --quiet "$DIFF_BASE" >/dev/null || DIFF_BASE="HEAD~1"
 strix -n -t ./ --scan-mode quick --scope-mode diff --diff-base "$DIFF_BASE" --max-budget 10
 ```
 
diff --git a/skills/strix-fix-findings/SKILL.md b/skills/strix-fix-findings/SKILL.md
index a08749224..fd00fad32 100644
--- a/skills/strix-fix-findings/SKILL.md
+++ b/skills/strix-fix-findings/SKILL.md
@@ -41,7 +41,15 @@ After fixing, re-scan scoped to the fixed area and confirm the finding is gone.
 ```bash
 # Re-test just the changed files (fast). Resolve the repo's real default
 # branch instead of assuming origin/main (many repos use master/develop).
-DIFF_BASE=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null || echo HEAD~1)
+# Avoid the current branch's own upstream as the base — its merge base with
+# HEAD would be HEAD, giving an empty diff and a falsely clean result.
+DIFF_BASE=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null)
+if [ -z "$DIFF_BASE" ]; then
+  for b in origin/main origin/master origin/develop; do
+    git rev-parse --verify --quiet "$b" >/dev/null && DIFF_BASE="$b" && break
+  done
+fi
+DIFF_BASE="${DIFF_BASE:-HEAD~1}"
 strix -n -t ./ --scan-mode quick --scope-mode diff --diff-base "$DIFF_BASE" --max-budget 5
 
 # Or re-test with the original finding as focus (no diff base needed)