From e92970b9e5273423d6b1688fbef76600b5e0a8a6 Mon Sep 17 00:00:00 2001
From: WenJing95 <126436871+WenJing95@users.noreply.github.com>
Date: Sun, 18 Oct 2026 19:59:26 +0900
Subject: [PATCH] fix(plugin): use the SHA-256 empty tree for root commit diffs

---
 .../codex-security/scripts/workbench_constants.py  |  4 ++++
 plugins/codex-security/scripts/workbench_db.py     |  3 ++-
 .../tests/test_git_inventory_regressions.py        | 14 ++++++++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/plugins/codex-security/scripts/workbench_constants.py b/plugins/codex-security/scripts/workbench_constants.py
index 9eefb96d83..83d1d86316 100644
--- a/plugins/codex-security/scripts/workbench_constants.py
+++ b/plugins/codex-security/scripts/workbench_constants.py
@@ -57,6 +57,10 @@
     "GIT_WORK_TREE",
 )
 EMPTY_GIT_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904"
+EMPTY_GIT_TREES = {
+    "sha1": EMPTY_GIT_TREE,
+    "sha256": "6ef19b41225c5369f1c104d45d8d85efa9b057b53b14b4b9b939dd74decc5321",
+}
 
 
 def positive_int(value: str) -> int:
diff --git a/plugins/codex-security/scripts/workbench_db.py b/plugins/codex-security/scripts/workbench_db.py
index 52b9bdfc38..2548ed7b4a 100644
--- a/plugins/codex-security/scripts/workbench_db.py
+++ b/plugins/codex-security/scripts/workbench_db.py
@@ -64,6 +64,7 @@
     DELIVERED_ACTION_LEASE_SECONDS,
     DIFF_TARGET_KINDS,
     EMPTY_GIT_TREE,
+    EMPTY_GIT_TREES,
     FINDING_ABSOLUTE_PATH_BYTES,
     FINDING_LEVEL_BYTES,
     FINDING_LOCATION_PATH_BYTES,
@@ -337,7 +338,7 @@ def require_diff_target(
             None,
         )
         if parent_line is None:
-            parent = EMPTY_GIT_TREE
+            parent = EMPTY_GIT_TREES[git_output(target, "rev-parse", "--show-object-format")]
         else:
             parent = resolve_git_commit(
                 target,
diff --git a/plugins/codex-security/tests/test_git_inventory_regressions.py b/plugins/codex-security/tests/test_git_inventory_regressions.py
index 79ea8914d8..70557a3652 100644
--- a/plugins/codex-security/tests/test_git_inventory_regressions.py
+++ b/plugins/codex-security/tests/test_git_inventory_regressions.py
@@ -29,6 +29,20 @@ def test_root_commit_message_does_not_supply_diff_parent(tmp_path: Path, workben
     assert diff["baseRevision"] == workbench_api["EMPTY_GIT_TREE"]
 
 
+def test_sha256_root_commit_uses_the_sha256_empty_tree(tmp_path: Path, workbench_api) -> None:
+    target = tmp_path / "target"
+    target.mkdir()
+    git(target, "init", "-q", "--object-format=sha256")
+    git(target, "config", "user.email", "fixture@example.com")
+    git(target, "config", "user.name", "Fixture")
+    (target / "README.md").write_text("fixture\n")
+    git(target, "add", "README.md")
+    git(target, "commit", "-qm", "Initial commit")
+    diff = workbench_api["require_diff_target"](target, "commit", None, "HEAD", None)
+    revisions = (diff["baseRevision"], diff["headRevision"])
+    assert git(target, "diff", "--name-only", *revisions) == b"README.md"
+
+
 def test_blob_batch_preserves_following_blobs_after_tree_and_commit(tmp_path: Path) -> None:
     target = tmp_path / "target"
     initialize_git_repository(target)