Passing a base that does not exist in the repository does not fail the run. The companion proceeds, silently falls back to a much wider diff than the caller asked for, and exits 0 — so a CI step or a wrapper script reads it as a clean, scoped review.
Why it is expensive rather than merely wrong: the failure mode is a review that looks successful. In our use the base is a wave-start SHA passed by a script; a typo produced a run that swept months of history, returned findings about code nobody had touched in the change under review, and reported success. Nothing in the output said the base had not resolved.
Expected: exit non-zero with "base not found in this repository", before any model call.
Workaround we adopted: validate before every launch — git cat-file -e "<sha>^{commit}" || exit 1.
Environment: codex-plugin-cc companion via the app server; observed 2026-08-09.
Related but distinct: #611 §1 covers a run exiting 0 with no verdict on a valid base.
Passing a base that does not exist in the repository does not fail the run. The companion proceeds, silently falls back to a much wider diff than the caller asked for, and exits 0 — so a CI step or a wrapper script reads it as a clean, scoped review.
Why it is expensive rather than merely wrong: the failure mode is a review that looks successful. In our use the base is a wave-start SHA passed by a script; a typo produced a run that swept months of history, returned findings about code nobody had touched in the change under review, and reported success. Nothing in the output said the base had not resolved.
Expected: exit non-zero with "base not found in this repository", before any model call.
Workaround we adopted: validate before every launch —
git cat-file -e "<sha>^{commit}" || exit 1.Environment: codex-plugin-cc companion via the app server; observed 2026-08-09.
Related but distinct: #611 §1 covers a run exiting 0 with no verdict on a valid base.