scan-diff

Scan only the changed files in $ARGUMENTS — a commit hash, a bare PR/MR number (e.g. 42 or #42), or empty (defaults to HEAD) — for vulnerabilities that change itself introduced. Fast, incremental check, not the full /vantage:scan-web/scan-mobile pipeline. Same SAST-only rule applies: read the diff and resulting file content, never run the application. Bash here is scoped to read-only git/PR history commands only — never used to build, run, or test the target app.

All output for this run lives under one self-contained root, artifacts/commit-scans/<id>/ (<id> = the commit hash, or pr-<number>/mr-<number>) — never touching the main pipeline's artifacts/findings/, artifacts/poc/, or artifacts/reports/ paths. These accumulate across runs by design — this command doesn't prune old ones; delete a specific artifacts/commit-scans/<id>/ folder yourself whenever you no longer need it.

1. Resolve what to diff:
   • $ARGUMENTS empty -> use HEAD.
   • $ARGUMENTS looks like a commit hash and git rev-parse resolves it -> treat as a commit.
   • $ARGUMENTS is a bare number or #<number> -> treat as a PR/MR: try gh pr diff <number> first (GitHub); if gh isn't available or errors, try glab mr diff <number> (GitLab). If neither works, stop and tell the user to pass an explicit commit hash instead.
   • Nothing resolves -> stop, don't guess.
2. Get the changed files + diff:
   • Commit: git diff --name-only <hash>^..<hash> for the file list, git show <hash> -- <files> for the actual diff.
   • PR/MR: the gh pr diff/glab mr diff output already is the diff; derive the changed-file list from its diff --git a/... b/... headers.
   • Drop deletions and anything matching scope.json.analysis_scope.exclude_paths if scope.json exists. If zero source files remain, stop and report "nothing to scan."
3. Read platform from ./.vantage/artifacts/recon/scope.json if it exists (default web). Don't auto-generate a full scope.json for this fast path.
4. Dispatch the platform's 10 testing agents (see ${CLAUDE_PLUGIN_ROOT}/workflow/orchestration.md Platform Routing for the list) as parallel Task calls. Override their normal input for this run: instead of reading artifacts/mapping/attack-surface.json, give each agent the diff from step 2 directly in its dispatch prompt and instruct it to analyze only the changed/added lines — pre-existing unchanged code in the same file was already covered by a full scan and is out of scope here. Each agent writes its own file at artifacts/commit-scans/<id>/raw-findings.<agent-name>.json.
5. Dispatch validator-agent the same way, reading + writing inside artifacts/commit-scans/<id>/ (validated-findings.json).
6. For every validated:true Medium-Critical finding, dispatch poc-agent the same way, writing to artifacts/commit-scans/<id>/poc/<finding-id>.md — same PoC contract as the full pipeline (code evidence + manual test steps a human runs later). Do not dispatch report-agent or generate a report.md for this fast path — that's the one full-pipeline artifact this command skips.
7. Report directly in chat: what was resolved (commit hash, or PR/MR number plus its head commit — this is the <commit-scan-id> used below), which agents ran, candidate count, the validated findings (severity, file:line, one-line description), and a pointer to each one's PoC file for manual test steps.
8. To fix one of these findings, tell the user to run /vantage:fix-diff <commit-scan-id> <finding-id> — a separate command, not part of this one. Never dispatch fix-agent from inside this command.

Do not treat a clean result ("0 candidates") as proof the change is safe — this only checked the diff, not the whole attack surface (e.g. a new call site into an already-vulnerable existing function elsewhere in the repo).