@nerviq/cli 1.11.0 → 1.13.0

package/src/copilot/freshness.js

@@ -27,18 +27,39 @@ const P0_SOURCES = [
     stalenessThresholdDays: 30,
     verifiedAt: '2026-04-07',
   },
-  {
-    key: 'copilot-cloud-agent-docs',
-    label: 'Copilot Coding Agent',
-    url: 'https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-coding-agent',
-    stalenessThresholdDays: 14,
-    verifiedAt: '2026-04-07',
-  },
-  {
-    key: 'copilot-prompt-files-docs',
-    label: 'Copilot Prompt Files Documentation',
-    url: 'https://docs.github.com/en/copilot/customizing-copilot/adding-custom-instructions-for-github-copilot#creating-prompt-files',
-    stalenessThresholdDays: 30,
+  {
+    key: 'copilot-cloud-agent-docs',
+    label: 'Copilot Coding Agent',
+    url: 'https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-coding-agent',
+    stalenessThresholdDays: 14,
+    verifiedAt: '2026-04-07',
+  },
+  {
+    key: 'copilot-cli-docs',
+    label: 'Copilot CLI Documentation',
+    url: 'https://docs.github.com/en/copilot/concepts/agents/about-copilot-cli',
+    stalenessThresholdDays: 14,
+    verifiedAt: '2026-04-10',
+  },
+  {
+    key: 'copilot-model-lts-docs',
+    label: 'Copilot Base & LTS Models',
+    url: 'https://docs.github.com/en/copilot/concepts/fallback-and-lts-models',
+    stalenessThresholdDays: 14,
+    verifiedAt: '2026-04-10',
+  },
+  {
+    key: 'copilot-cli-custom-agents-docs',
+    label: 'Copilot CLI Custom Agents',
+    url: 'https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/create-custom-agents-for-cli',
+    stalenessThresholdDays: 30,
+    verifiedAt: '2026-04-10',
+  },
+  {
+    key: 'copilot-prompt-files-docs',
+    label: 'Copilot Prompt Files Documentation',
+    url: 'https://docs.github.com/en/copilot/customizing-copilot/adding-custom-instructions-for-github-copilot#creating-prompt-files',
+    stalenessThresholdDays: 30,
     verifiedAt: '2026-04-07',
   },
   {
@@ -123,14 +144,30 @@ const PROPAGATION_CHECKLIST = [
       'src/copilot/setup.js — update content exclusions guide',
     ],
   },
-  {
-    trigger: 'Organization policy change or new policy type',
-    targets: [
-      'src/copilot/techniques.js — update organization checks (CP-F01..CP-F05)',
-      'src/copilot/governance.js — update enterprise-managed profile',
-    ],
-  },
-];
+  {
+    trigger: 'Organization policy change or new policy type',
+    targets: [
+      'src/copilot/techniques.js — update organization checks (CP-F01..CP-F05)',
+      'src/copilot/governance.js — update enterprise-managed profile',
+    ],
+  },
+  {
+    trigger: 'Copilot CLI behavior change (CLI custom agents, hooks, memory, prompt layering)',
+    targets: [
+      'src/copilot/techniques.js — update CLI-agent and instruction-surface checks',
+      'src/copilot/setup.js — update starter guidance when CLI agent or hook behavior changes',
+      'src/source-urls.js — refresh Copilot source mappings for CLI-specific surfaces',
+    ],
+  },
+  {
+    trigger: 'Copilot model / fallback / LTS policy change',
+    targets: [
+      'src/copilot/governance.js — update model-selection and enterprise policy caveats',
+      'src/copilot/techniques.js — update trust/availability assumptions tied to model fallback behavior',
+      'src/source-urls.js — refresh Copilot model and maturity source mappings',
+    ],
+  },
+];
 
 /**
  * Release gate: check if all P0 sources are within staleness threshold.

package/src/cost-tracking.js

@@ -0,0 +1,61 @@
+const BUDGET_PATTERNS = [
+  /\bcost.{0,15}budget\b/i,
+  /\bmonthly.{0,15}budget\b/i,
+  /\bspending.{0,15}limit\b/i,
+  /\busage.{0,15}limit\b/i,
+  /\bbudget guardrails?\b/i,
+  /\bspend cap\b/i,
+  /\bquota\b/i,
+];
+
+const USAGE_TRACKING_PATTERNS = [
+  /\b(per[- ]run|per agent run|per session|per request)\b.{0,40}\b(cost|usage|token|spend|billing)\b/i,
+  /\b(cost|usage|token|spend|billing)\b.{0,40}\b(per[- ]run|per agent run|per session|per request)\b/i,
+  /\b(track|tracking|monitor|monitoring|log|logging|meter|metering|report|reporting)\b.{0,40}\b(cost|usage|token|spend|billing)\b/i,
+  /\b(cost|usage|token|spend|billing)\b.{0,40}\b(track|tracking|monitor|monitoring|log|logging|meter|metering|report|reporting)\b/i,
+  /\btoken metrics?\b/i,
+  /\busage dashboard\b/i,
+  /\bcost dashboard\b/i,
+  /\b(prompt|completion|input|output)\s+tokens?\b.{0,20}\b(log|track|monitor|report)\b/i,
+  /\b(langfuse|langsmith|helicone|openlit|lunary|braintrust|phoenix)\b/i,
+];
+
+const USAGE_TRACKING_FILE_PATTERNS = [
+  /\blangfuse\b/i,
+  /\blangsmith\b/i,
+  /\bhelicone\b/i,
+  /\bopenlit\b/i,
+  /\blunary\b/i,
+  /\bbraintrust\b/i,
+  /\bphoenix\b/i,
+];
+
+function matchesAny(text, patterns) {
+  const normalized = String(text || '');
+  return patterns.some((pattern) => {
+    pattern.lastIndex = 0;
+    return pattern.test(normalized);
+  });
+}
+
+function hasUsageTrackingDependency(ctx) {
+  if (!ctx || typeof ctx.projectDependencies !== 'function') return false;
+  const deps = Object.keys(ctx.projectDependencies() || {});
+  return deps.some((name) => USAGE_TRACKING_FILE_PATTERNS.some((pattern) => pattern.test(name)));
+}
+
+function hasUsageTrackingArtifacts(ctx) {
+  if (!ctx || !Array.isArray(ctx.files)) return false;
+  return ctx.files.some((filePath) => USAGE_TRACKING_FILE_PATTERNS.some((pattern) => pattern.test(String(filePath || ''))));
+}
+
+function hasCostBudgetOrUsageTracking(text, ctx = null) {
+  return matchesAny(text, BUDGET_PATTERNS) ||
+    matchesAny(text, USAGE_TRACKING_PATTERNS) ||
+    hasUsageTrackingDependency(ctx) ||
+    hasUsageTrackingArtifacts(ctx);
+}
+
+module.exports = {
+  hasCostBudgetOrUsageTracking,
+};

package/src/cursor/freshness.js

@@ -41,18 +41,39 @@ const P0_SOURCES = [
     stalenessThresholdDays: 14,
     verifiedAt: '2026-04-07',
   },
-  {
-    key: 'cursor-automations',
-    label: 'Automations Documentation',
-    url: 'https://cursor.com/docs/cloud-agent/automations',
-    stalenessThresholdDays: 14,
-    verifiedAt: '2026-04-07',
-  },
-  {
-    key: 'cursor-bugbot',
-    label: 'BugBot Documentation',
-    url: 'https://cursor.com/docs/bugbot',
-    stalenessThresholdDays: 30,
+  {
+    key: 'cursor-automations',
+    label: 'Automations Documentation',
+    url: 'https://cursor.com/docs/cloud-agent/automations',
+    stalenessThresholdDays: 14,
+    verifiedAt: '2026-04-07',
+  },
+  {
+    key: 'cursor-agent-modes',
+    label: 'Cursor Agent Modes',
+    url: 'https://docs.cursor.com/en/chat/agent',
+    stalenessThresholdDays: 14,
+    verifiedAt: '2026-04-10',
+  },
+  {
+    key: 'cursor-models-docs',
+    label: 'Cursor Models & Auto Selection',
+    url: 'https://docs.cursor.com/models',
+    stalenessThresholdDays: 14,
+    verifiedAt: '2026-04-10',
+  },
+  {
+    key: 'cursor-cli-docs',
+    label: 'Cursor CLI Usage',
+    url: 'https://docs.cursor.com/en/cli/using',
+    stalenessThresholdDays: 30,
+    verifiedAt: '2026-04-10',
+  },
+  {
+    key: 'cursor-bugbot',
+    label: 'BugBot Documentation',
+    url: 'https://cursor.com/docs/bugbot',
+    stalenessThresholdDays: 30,
     verifiedAt: '2026-04-07',
   },
   {
@@ -140,14 +161,38 @@ const PROPAGATION_CHECKLIST = [
       'src/cursor/deep-review.js — update trust class detection',
     ],
   },
-  {
-    trigger: 'Design Mode feature update',
-    targets: [
-      'src/cursor/setup.js — update Design Mode guide template',
-      'src/cursor/techniques.js — update CU-L01 modern features check',
-    ],
-  },
-];
+  {
+    trigger: 'Design Mode feature update',
+    targets: [
+      'src/cursor/setup.js — update Design Mode guide template',
+      'src/cursor/techniques.js — update CU-L01 modern features check',
+    ],
+  },
+  {
+    trigger: 'Cursor mode behavior change (Agent/Ask/Custom, auto-run, auto-fix, tool scopes)',
+    targets: [
+      'src/cursor/techniques.js — update agent-mode and autonomy checks',
+      'src/cursor/governance.js — update mode-related permission caveats',
+      'src/source-urls.js — refresh Cursor mode source mappings',
+    ],
+  },
+  {
+    trigger: 'Cursor model catalog or auto-selection change',
+    targets: [
+      'src/cursor/techniques.js — update model-awareness and cost/trust assumptions',
+      'src/cursor/governance.js — update privacy and model-selection caveats',
+      'src/source-urls.js — refresh Cursor model source mappings',
+    ],
+  },
+  {
+    trigger: 'Cursor CLI behavior change',
+    targets: [
+      'src/cursor/setup.js — update CLI-oriented starter guidance',
+      'src/cursor/techniques.js — update CLI/rules expectations where relevant',
+      'src/source-urls.js — refresh Cursor CLI source mappings',
+    ],
+  },
+];
 
 /**
  * Release gate: check if all P0 sources are within staleness threshold.

package/src/cursor/techniques.js

@@ -14,11 +14,12 @@
 const os = require('os');
 const path = require('path');
 const { CursorProjectContext } = require('./context');
-const { EMBEDDED_SECRET_PATTERNS, containsEmbeddedSecret } = require('../secret-patterns');
-const { attachSourceUrls } = require('../source-urls');
-const { buildStackChecks } = require('../stack-checks');
-const { isApiProject, isDatabaseProject, isAuthProject, isMonitoringRelevant } = require('../supplemental-checks');
-const { validateMdcFrontmatter, validateMcpEnvVars } = require('./config-parser');
+const { EMBEDDED_SECRET_PATTERNS, containsEmbeddedSecret } = require('../secret-patterns');
+const { attachSourceUrls } = require('../source-urls');
+const { buildStackChecks } = require('../stack-checks');
+const { isApiProject, isDatabaseProject, isAuthProject, isMonitoringRelevant } = require('../supplemental-checks');
+const { hasCostBudgetOrUsageTracking } = require('../cost-tracking');
+const { validateMdcFrontmatter, validateMcpEnvVars } = require('./config-parser');
 
 // ─── Shared helpers ─────────────────────────────────────────────────────────
 
@@ -2211,13 +2212,17 @@ const CURSOR_TECHNIQUES = {
     fix: 'Enable prompt caching in MCP configuration or document caching strategy for repeated prompts.',
     template: null, file: () => '.cursor/mcp.json', line: () => null,
   },
-  cursorCostBudgetDefined: {
-    id: 'CU-T48', name: 'AI cost budget or usage limits documented',
-    check: (ctx) => { const docs = allRulesContent(ctx) + (ctx.fileContent('CLAUDE.md') || '') + (ctx.fileContent('README.md') || ''); if (!docs.trim()) return null; return /cost.{0,15}budget|spending.{0,15}limit|usage.{0,15}limit|monthly.{0,15}budget/i.test(docs); },
-    impact: 'low', rating: 2, category: 'cost-optimization',
-    fix: 'Document AI cost budget in README.md or Cursor rules to maintain spend awareness.',
-    template: null, file: () => 'README.md', line: () => null,
-  },
+  cursorCostBudgetDefined: {
+    id: 'CU-T48', name: 'AI cost budget or per-run usage tracking documented',
+    check: (ctx) => {
+      const docs = docsBundle(ctx) + (ctx.fileContent('CLAUDE.md') || '');
+      if (!docs.trim() && !hasCostBudgetOrUsageTracking('', ctx)) return null;
+      return hasCostBudgetOrUsageTracking(docs, ctx);
+    },
+    impact: 'low', rating: 2, category: 'cost-optimization',
+    fix: 'Document AI cost guardrails or per-run usage tracking in README.md or Cursor rules so spend is observable, not guessed.',
+    template: null, file: () => 'README.md', line: () => null,
+  },
 
   // ============================================================
   // === PYTHON STACK CHECKS (category: 'python') ===============

package/src/deep-review.js

@@ -11,6 +11,15 @@ const { execFileSync, execSync } = require('child_process');
 const { ProjectContext } = require('./context');
 const { STACKS } = require('./techniques');
 const { redactEmbeddedSecrets } = require('./secret-patterns');
+const {
+  analyzeBehavioralDrift,
+  compareBehavioralLatest,
+  formatBehavioralCompare,
+  formatBehavioralHistory,
+  formatBehavioralReport,
+  getBehavioralHistory,
+  writeBehavioralSnapshot,
+} = require('./behavioral-drift');
 
 const COLORS = {
   reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
@@ -236,7 +245,81 @@ async function callClaudeCode(prompt) {
   });
 }
 
+function renderBehavioralJson(options) {
+  if (options.compareView) {
+    const comparison = compareBehavioralLatest(options.dir);
+    console.log(JSON.stringify(comparison || {
+      mode: 'behavioral-drift',
+      message: 'Behavioral compare needs two behavioral snapshots.',
+      historyCount: getBehavioralHistory(options.dir, 20).length,
+    }, null, 2));
+    return;
+  }
+
+  if (options.historyView) {
+    console.log(JSON.stringify({
+      mode: 'behavioral-drift',
+      history: getBehavioralHistory(options.dir, 20),
+      comparison: compareBehavioralLatest(options.dir),
+    }, null, 2));
+    return;
+  }
+
+  const report = analyzeBehavioralDrift(options.dir);
+  let snapshotArtifact = null;
+  if (options.snapshot) {
+    snapshotArtifact = writeBehavioralSnapshot(options.dir, report, {
+      tags: options.snapshotTags,
+      milestone: options.snapshotMilestone,
+      sourceCommand: 'deep-review --behavioral',
+    });
+  }
+
+  console.log(JSON.stringify({
+    ...report,
+    snapshotArtifact,
+  }, null, 2));
+}
+
+function runBehavioralReview(options) {
+  if (options.json) {
+    renderBehavioralJson(options);
+    return;
+  }
+
+  if (options.compareView) {
+    console.log('');
+    console.log(formatBehavioralCompare(options.dir));
+    console.log('');
+    return;
+  }
+
+  if (options.historyView) {
+    console.log('');
+    console.log(formatBehavioralHistory(options.dir));
+    console.log('');
+    return;
+  }
+
+  const report = analyzeBehavioralDrift(options.dir);
+  let snapshotArtifact = null;
+  if (options.snapshot) {
+    snapshotArtifact = writeBehavioralSnapshot(options.dir, report, {
+      tags: options.snapshotTags,
+      milestone: options.snapshotMilestone,
+      sourceCommand: 'deep-review --behavioral',
+    });
+  }
+
+  process.stdout.write(formatBehavioralReport(report, { snapshotArtifact }));
+}
+
 async function deepReview(options) {
+  if (options.behavioral) {
+    runBehavioralReview(options);
+    return;
+  }
+
   const apiKey = process.env.ANTHROPIC_API_KEY;
   const hasClaude = hasClaudeCode();
 

package/src/diff-only.js

@@ -0,0 +1,280 @@
+'use strict';
+
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const COLORS = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  dim: '\x1b[2m',
+  red: '\x1b[31m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  blue: '\x1b[36m',
+  magenta: '\x1b[35m',
+};
+
+const WEIGHTS = { critical: 15, high: 10, medium: 5, low: 2 };
+const IMPACT_ORDER = { critical: 3, high: 2, medium: 1, low: 0 };
+
+const CATEGORY_HINTS = [
+  {
+    pattern: /^(CLAUDE\.md|\.claude\/)/i,
+    categories: ['memory', 'workflow', 'security', 'automation', 'prompting', 'features', 'skills', 'agents', 'review', 'tools', 'git', 'quality'],
+  },
+  {
+    pattern: /^(AGENTS\.md|\.codex\/)/i,
+    categories: ['memory', 'workflow', 'security', 'automation', 'prompting', 'features', 'skills', 'agents', 'review', 'tools', 'git', 'local'],
+  },
+  {
+    pattern: /^(GEMINI\.md|\.gemini\/)/i,
+    categories: ['memory', 'workflow', 'security', 'automation', 'prompting', 'features', 'skills', 'agents', 'review', 'tools'],
+  },
+  {
+    pattern: /^(\.cursor\/|\.cursorrules$)/i,
+    categories: ['workflow', 'security', 'automation', 'prompting', 'features', 'tools', 'review'],
+  },
+  {
+    pattern: /^(\.windsurf\/|\.windsurfrules$|\.cascadeignore$)/i,
+    categories: ['workflow', 'security', 'automation', 'prompting', 'features', 'tools', 'review'],
+  },
+  {
+    pattern: /^(\.github\/copilot-instructions\.md|\.github\/instructions\/|\.github\/prompts\/|\.vscode\/mcp\.json$)/i,
+    categories: ['workflow', 'prompting', 'tools', 'review', 'devops'],
+  },
+  {
+    pattern: /^(opencode\.jsonc?$|\.opencode\/)/i,
+    categories: ['workflow', 'security', 'automation', 'prompting', 'features', 'skills', 'agents', 'tools', 'review'],
+  },
+  {
+    pattern: /^\.mcp\.json$/i,
+    categories: ['tools', 'security'],
+  },
+  {
+    pattern: /^(\.gitignore$|package\.json$|pyproject\.toml$|requirements.*\.txt$|\.github\/workflows\/)/i,
+    categories: ['hygiene', 'devops', 'security', 'quality', 'tools'],
+  },
+];
+
+function c(text, color) {
+  return `${COLORS[color] || ''}${text}${COLORS.reset}`;
+}
+
+function normalizeRelativePath(filePath) {
+  return String(filePath || '').replace(/\\/g, '/').replace(/^\.\//, '');
+}
+
+function runGit(dir, args) {
+  return spawnSync('git', args, {
+    cwd: dir,
+    encoding: 'utf8',
+  });
+}
+
+function collectOutputLines(result) {
+  return `${result.stdout || ''}`
+    .split(/\r?\n/)
+    .map((line) => normalizeRelativePath(line.trim()))
+    .filter(Boolean);
+}
+
+function uniquePaths(paths) {
+  return [...new Set((paths || []).map(normalizeRelativePath).filter(Boolean))].sort();
+}
+
+function getRangeOptions(options = {}) {
+  const base = options.diffBase ||
+    process.env.NERVIQ_DIFF_BASE ||
+    process.env.GITHUB_BASE_SHA ||
+    process.env.GIT_BASE_SHA ||
+    null;
+  const head = options.diffHead ||
+    process.env.NERVIQ_DIFF_HEAD ||
+    process.env.GITHUB_SHA ||
+    process.env.GIT_HEAD_SHA ||
+    'HEAD';
+  return { base, head };
+}
+
+function getChangedFiles(dir, options = {}) {
+  const repoCheck = runGit(dir, ['rev-parse', '--is-inside-work-tree']);
+  if (repoCheck.status !== 0) {
+    return {
+      mode: 'unavailable',
+      changedFiles: [],
+      message: 'Diff-only mode requires a git repository.',
+    };
+  }
+
+  const { base, head } = getRangeOptions(options);
+  if (base) {
+    const rangeResult = runGit(dir, ['diff', '--name-only', '--diff-filter=ACMRTUXB', `${base}..${head}`]);
+    if (rangeResult.status === 0) {
+      return {
+        mode: 'range',
+        base,
+        head,
+        changedFiles: uniquePaths(collectOutputLines(rangeResult)),
+      };
+    }
+  }
+
+  const unstaged = runGit(dir, ['diff', '--name-only', '--diff-filter=ACMRTUXB', 'HEAD', '--']);
+  const staged = runGit(dir, ['diff', '--cached', '--name-only', '--diff-filter=ACMRTUXB', '--']);
+  const untracked = runGit(dir, ['ls-files', '--others', '--exclude-standard']);
+
+  return {
+    mode: 'working-tree',
+    changedFiles: uniquePaths([
+      ...collectOutputLines(unstaged),
+      ...collectOutputLines(staged),
+      ...collectOutputLines(untracked),
+    ]),
+  };
+}
+
+function matchesChangedFile(filePath, changedFiles) {
+  if (!filePath) return false;
+  const normalized = normalizeRelativePath(filePath).replace(/\/$/, '');
+
+  return changedFiles.some((changed) => {
+    const target = changed.replace(/\/$/, '');
+    return normalized === target ||
+      normalized.startsWith(`${target}/`) ||
+      target.startsWith(`${normalized}/`);
+  });
+}
+
+function inferRelevantCategories(changedFiles) {
+  const categories = new Set();
+
+  for (const filePath of changedFiles) {
+    for (const hint of CATEGORY_HINTS) {
+      if (hint.pattern.test(filePath)) {
+        hint.categories.forEach((category) => categories.add(category));
+      }
+    }
+  }
+
+  return categories;
+}
+
+function isRelevantResult(result, changedFiles, changedCategories) {
+  if (!result || result.deprecated) return false;
+  if (matchesChangedFile(result.file, changedFiles)) return true;
+  if (!result.file && result.category && changedCategories.has(result.category)) return true;
+  return false;
+}
+
+function buildFallbackActions(failed) {
+  return failed
+    .slice()
+    .sort((a, b) => (IMPACT_ORDER[b.impact] || 0) - (IMPACT_ORDER[a.impact] || 0) || a.name.localeCompare(b.name))
+    .slice(0, 5)
+    .map((item) => ({
+      key: item.key,
+      name: item.name,
+      impact: item.impact,
+      category: item.category,
+      fix: item.fix,
+      file: item.file || null,
+    }));
+}
+
+function buildDiffOnlyAuditView(auditResult, diffInfo) {
+  const changedFiles = uniquePaths(diffInfo.changedFiles || []);
+  const changedCategories = inferRelevantCategories(changedFiles);
+  const relevantResults = (auditResult.results || []).filter((item) => isRelevantResult(item, changedFiles, changedCategories));
+  const applicable = relevantResults.filter((item) => item.passed !== null && item.deprecated !== true);
+  const skipped = relevantResults.filter((item) => item.passed === null && item.deprecated !== true);
+  const passed = applicable.filter((item) => item.passed === true);
+  const failed = applicable.filter((item) => item.passed === false);
+  const maxScore = applicable.reduce((sum, item) => sum + (WEIGHTS[item.impact] || 5), 0);
+  const earnedScore = passed.reduce((sum, item) => sum + (WEIGHTS[item.impact] || 5), 0);
+  const score = applicable.length > 0 && maxScore > 0 ? Math.round((earnedScore / maxScore) * 100) : null;
+  const relevantKeys = new Set(relevantResults.map((item) => item.key));
+  const topNextActions = (auditResult.topNextActions || []).filter((item) => relevantKeys.has(item.key)).slice(0, 5);
+  const fallbackActions = buildFallbackActions(failed);
+
+  const message = changedFiles.length === 0
+    ? (diffInfo.message || 'No changed files detected for diff-only mode.')
+    : 'Diff-only mode filters to changed files plus linked governance/config surfaces. Run `nerviq audit` for complete repo posture.';
+
+  return {
+    platform: auditResult.platform,
+    platformLabel: auditResult.platformLabel,
+    diffOnly: true,
+    score,
+    scoreType: 'diff-only changed-file audit',
+    passed: passed.length,
+    failed: failed.length,
+    skipped: skipped.length,
+    checkCount: applicable.length,
+    changedFiles,
+    changedFilesCount: changedFiles.length,
+    diffMode: diffInfo.mode,
+    diffBase: diffInfo.base || null,
+    diffHead: diffInfo.head || null,
+    fullAuditScore: auditResult.score,
+    message,
+    results: relevantResults,
+    topNextActions: topNextActions.length > 0 ? topNextActions : fallbackActions,
+    suggestedNextCommand: 'nerviq audit',
+  };
+}
+
+function printDiffOnlyAudit(result) {
+  const lines = [''];
+  lines.push(c('  nerviq diff-only audit', 'bold'));
+  lines.push(c('  ═══════════════════════════════════════', 'dim'));
+  lines.push('');
+
+  if (result.diffMode === 'range' && result.diffBase) {
+    lines.push(c(`  Diff range: ${result.diffBase}..${result.diffHead}`, 'dim'));
+  } else {
+    lines.push(c('  Diff source: working tree vs HEAD', 'dim'));
+  }
+
+  if (result.changedFilesCount === 0) {
+    lines.push(c(`  ${result.message}`, 'yellow'));
+    lines.push(c('  Tip: commit or stage a change first, or provide a PR base SHA via --diff-base.', 'dim'));
+    lines.push('');
+    return lines.join('\n');
+  }
+
+  lines.push(c(`  Changed files (${result.changedFilesCount}):`, 'bold'));
+  result.changedFiles.slice(0, 8).forEach((filePath) => {
+    lines.push(`    ${c('•', 'blue')} ${filePath}`);
+  });
+  if (result.changedFilesCount > 8) {
+    lines.push(c(`    ...and ${result.changedFilesCount - 8} more`, 'dim'));
+  }
+
+  lines.push('');
+  lines.push(`  Score: ${result.score === null ? c('n/a', 'yellow') : c(`${result.score}/100`, 'bold')}`);
+  lines.push(c(`  Score type: ${result.scoreType} (not the full repo score of ${result.fullAuditScore}/100).`, 'dim'));
+  lines.push(c(`  ${result.message}`, 'dim'));
+  lines.push('');
+
+  if (result.topNextActions && result.topNextActions.length > 0) {
+    lines.push(c('  Top diff-relevant actions:', 'magenta'));
+    result.topNextActions.slice(0, 5).forEach((item, index) => {
+      lines.push(`  ${index + 1}. ${c(item.name, 'bold')} ${c(`[${item.impact}]`, 'dim')}`);
+      if (item.fix) {
+        lines.push(c(`     ${item.fix}`, 'dim'));
+      }
+    });
+    lines.push('');
+  }
+
+  lines.push(`  Relevant checks: ${result.checkCount}  |  Failed: ${result.failed}  |  Passed: ${result.passed}  |  Skipped: ${result.skipped}`);
+  lines.push(c('  Run `nerviq audit` for the complete repo posture.', 'dim'));
+  lines.push('');
+  return lines.join('\n');
+}
+
+module.exports = {
+  getChangedFiles,
+  buildDiffOnlyAuditView,
+  printDiffOnlyAudit,
+};