audit-diff

You are running a diff-scoped security audit using the security-auditor plugin. This is the recommended way to audit a pull request, and the recommended fallback whenever a full /audit would need to read more source than fits in context — scoping to the diff solves both problems at once.

Step 1 — Parse arguments

$ARGUMENTS may contain, in any order:

• A mode hint: dev/development or prod/production
• A git ref (branch, tag, or commit) to diff against

Any remaining token that isn't a recognized mode keyword is treated as the base ref. If no mode is given, ask the same question /audit asks:

"Is this project currently in development or production?"

Step 2 — Resolve the base ref and list changed files

If a base ref was given, use it directly. Otherwise detect the repo's default branch:

git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@'
# falls back to checking for a local `main` then `master` branch if the above is empty

Then collect the changed file set as the union of:

git diff --name-only --diff-filter=ACMR <base>...HEAD   # committed changes vs merge-base
git diff --name-only --diff-filter=ACMR HEAD             # unstaged working-tree changes
git diff --name-only --diff-filter=ACMR --staged         # staged changes

--diff-filter=ACMR keeps added/copied/modified/renamed files and drops deleted files (nothing to audit in a file that no longer exists). Deduplicate the combined list.

If this is not a git repository, has no commits, or the combined list is empty, say so plainly and stop:

"No git changes found against <base>. Run /audit for a full codebase scan instead."

Step 3 — Filter the changed set

Drop paths matching common generated/vendored directories before analysis: node_modules/, dist/, build/, vendor/, .venv/, target/, *.min.js, lockfiles that aren't being read for dependency scanning in Step 5, and any path Glob confirms doesn't exist (renamed/moved after the diff was taken).