Function NewAuditDiffSubcommand

pkg/cli/audit_diff_command.go:18–110

NewAuditDiffSubcommand creates the audit diff subcommand. Deprecated: pass multiple run IDs directly to `audit` instead (e.g. `gh aw audit `). This subcommand is hidden and kept for backward compatibility only.

()

// Deprecated: pass multiple run IDs directly to `audit` instead (e.g. `gh aw audit <base> <compare...>`).
// This subcommand is hidden and kept for backward compatibility only.
func NewAuditDiffSubcommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:    "diff <base-run-id> <compare-run-id>...",
		Short:  "Compare behavior across workflow runs",
		Hidden: true,
		Long: `Deprecated: pass multiple run IDs directly to the audit command instead.

  gh aw audit <base-run-id> <compare-run-id>...

Compare workflow run behavior between a base run and one or more comparison runs
to detect policy regressions, new unauthorized domains, behavioral drift, and changes in
MCP tool usage, token usage, or run metrics.

The first argument is the base (reference) run. All subsequent arguments are compared
against that base. This enables tracking behavioral drift across multiple runs at once.

This command downloads artifacts for all runs (using cached data when available),
analyzes their data, and produces a diff showing:
- New domains that appeared in the comparison run
- Removed domains that were in the base run but not the comparison
- Status changes (domains that flipped between allowed and denied)
- Volume changes (significant request count changes, >100% threshold)
- Anomaly flags (new denied domains, previously-denied now allowed)
- MCP tool invocation changes (new/removed tools, call count and error count diffs)
- Run metrics comparison (token usage, duration, turns) when cached data is available
- Detailed token usage breakdown (input/output/cache + AI Credits) from firewall proxy`,
		Example: `  ` + string(constants.CLIExtensionPrefix) + ` audit diff 12345 12346                               # Compare two runs
  ` + string(constants.CLIExtensionPrefix) + ` audit diff 12345 12346 12347 12348                   # Compare base against 3 runs
  ` + string(constants.CLIExtensionPrefix) + ` audit diff 12345 12346 --format markdown             # Markdown output for PR comments
  ` + string(constants.CLIExtensionPrefix) + ` audit diff 12345 12346 --json                        # JSON for CI integration
  ` + string(constants.CLIExtensionPrefix) + ` audit diff 12345 12346 --repo owner/repo             # Specify repository`,
		Args: cobra.MinimumNArgs(2),
		RunE: func(cmd *cobra.Command, args []string) error {
			baseRunID, err := strconv.ParseInt(args[0], 10, 64)
			if err != nil {
				return fmt.Errorf("invalid base run ID %q: must be a numeric run ID", args[0])
			}

			compareRunIDs := make([]int64, 0, len(args)-1)
			seen := make(map[int64]bool)
			for _, arg := range args[1:] {
				id, err := strconv.ParseInt(arg, 10, 64)
				if err != nil {
					return fmt.Errorf("invalid run ID %q: must be a numeric run ID", arg)
				}
				if id == baseRunID {
					return fmt.Errorf("comparison run ID %d is the same as the base run ID: cannot diff a run against itself", id)
				}
				if seen[id] {
					return fmt.Errorf("duplicate comparison run ID %d: each run ID must appear only once", id)
				}
				seen[id] = true
				compareRunIDs = append(compareRunIDs, id)
			}

			outputDir, _ := cmd.Flags().GetString("output")
			verbose, _ := cmd.Flags().GetBool("verbose")
			jsonOutput, _ := cmd.Flags().GetBool("json")