[FEATURE] Improve error message when origin/HEAD is not set for /security-review command

[nahyeongjin1]

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

When running /security-review in a repository where origin/HEAD is not set, the command fails immediately with a cryptic Git error:

Error: Bash command failed for pattern "!`git diff --merge-base origin/HEAD`": [stderr] fatal: ambiguous argument 'origin/HEAD': unknown revision or path not in the working tree. Use '--' to separate paths from revisions, like this: 'git <command> [<revision>...] -- [<file>...]'

This error doesn't indicate what the actual problem is or how to fix it. Users unfamiliar with Git internals may not understand that they simply need to set origin/HEAD.

Proposed Solution

1. Detect missing origin/HEAD before running the diff command
2. Provide a helpful error message that explains the issue and suggests the fix:

Error: origin/HEAD is not set. This is required for /security-review to compare changes.

To fix this, run:
     git remote set-head origin -a

   Then try /security-review again.

3. Optionally: Automatically fall back to origin/main or origin/master if origin/HEAD is not set

Alternative Solutions

Current workaround is to manually run:

git remote set-head origin -a

This works, but requires users to search for the solution externally.

Priority

Low - Nice to have

Feature Category

CLI commands and flags

Use Case Example

1. User clones a repository or sets up a new project with git init + git remote add origin
2. User runs /security-review to check for vulnerabilities
3. Command fails with unclear error about origin/HEAD
4. User spends time searching online for the solution
5. Expected: Clear error message with one-liner fix command

Additional Context

• This is a common Git configuration issue, especially for newly cloned repos or repos set up manually
• The fix is trivial (git remote set-head origin -a), but the current error message provides no guidance
• Similar issue reported in a Japanese blog post encountering the same error: https://note.com/munakata_souri/n/n346c43c49b9a