veto diff

veto diff [policy-path] [options]
veto diff --old <path> --new <path> [options]

veto diff <policy-path>

veto diff veto/rules/financial.yaml

--old <path>
--new <path>

veto diff --old ./rules-v1 --new ./rules-v2

--log <path>

veto diff financial.yaml --log calls.jsonl

--format <text|json>

veto diff --format json

veto diff veto/rules/financial.yaml

Veto Policy Diff
================

Comparing:
  Old: HEAD:veto/rules/financial.yaml
  New: veto/rules/financial.yaml

Structural Changes:

  ADDED RULES (1):
    + block-crypto-transfers
      Severity: critical
      Tools: transfer_funds
      Description: Block cryptocurrency transfers

  MODIFIED RULES (1):
    ~ block-large-transfers
      - action: require_approval
      + action: block
      - value: 10000
      + value: 5000

  REMOVED RULES (0)

Affected Tools:
  - transfer_funds (2 rules changed)

Summary:
  Old rules: 5
  New rules: 6
  Added: 1
  Modified: 1
  Removed: 0

veto diff --old ./rules-v1 --new ./rules-v2

Veto Policy Diff
================

Comparing:
  Old: ./rules-v1
  New: ./rules-v2

Structural Changes:

  ADDED RULES (3):
    + require-mfa-admin
    + block-weekend-deploys
    + log-sensitive-queries

  MODIFIED RULES (2):
    ~ block-large-transfers
    ~ require-invoice-approval

  REMOVED RULES (1):
    - legacy-email-rule

Affected Tools:
  - transfer_funds
  - approve_invoice
  - deploy_app
  - query_database

Summary:
  Old rules: 12
  New rules: 14
  Added: 3
  Modified: 2
  Removed: 1

veto diff financial.yaml --log calls.jsonl

Veto Policy Diff
================

Comparing:
  Old: HEAD:veto/rules/financial.yaml
  New: veto/rules/financial.yaml

Structural Changes:
  ...

Impact Analysis:
================

Log file: calls.jsonl
Total lines: 1000
Valid calls: 950
Invalid lines: 50

Old Policy Decisions:
  Allow: 800 (84.2%)
  Require Approval: 100 (10.5%)
  Block: 50 (5.3%)

New Policy Decisions:
  Allow: 750 (78.9%)
  Require Approval: 120 (12.6%)
  Block: 80 (8.4%)

Transitions:
  allow → block: 40 calls
  allow → require_approval: 20 calls
  require_approval → block: 10 calls

Changed by Tool:
  transfer_funds: 50 calls affected
  approve_invoice: 20 calls affected

Sample Changed Calls:

  [Line 42] transfer_funds
    Arguments: {"amount": 6000, "recipient": "[email protected]"}
    Old: allow (no matching rule)
    New: block (rule: block-large-transfers)
    Reason: Amount 6000 exceeds new threshold of 5000

  [Line 123] transfer_funds
    Arguments: {"amount": 8000, "currency": "BTC"}
    Old: require_approval (rule: require-approval-large)
    New: block (rule: block-crypto-transfers)
    Reason: Cryptocurrency transfers now blocked

  (showing 2 of 70 changed calls)

Additional Blocked: 50 calls
Additional Requiring Approval: 20 calls

veto diff financial.yaml --format json

{
  "timestamp": "2024-03-04T12:00:00.000Z",
  "projectDir": "/path/to/project",
  "sources": {
    "mode": "implicit-git-file",
    "old": "HEAD:veto/rules/financial.yaml",
    "new": "veto/rules/financial.yaml"
  },
  "structural": {
    "addedRuleIds": ["block-crypto-transfers"],
    "removedRuleIds": [],
    "modifiedRuleIds": ["block-large-transfers"],
    "ruleChanges": [
      {
        "kind": "added",
        "ruleId": "block-crypto-transfers",
        "scopes": ["transfer_funds"],
        "summary": "Added rule for transfer_funds",
        "fieldChanges": []
      },
      {
        "kind": "modified",
        "ruleId": "block-large-transfers",
        "scopes": ["transfer_funds"],
        "summary": "Modified action, conditions",
        "fieldChanges": [
          {
            "field": "action",
            "oldValue": "require_approval",
            "newValue": "block"
          }
        ]
      }
    ],
    "changesByScope": [
      {
        "scope": "transfer_funds",
        "added": [],
        "removed": [],
        "modified": []
      }
    ],
    "unchangedTools": ["approve_invoice", "send_email"]
  },
  "impact": null,
  "summary": {
    "oldRules": 5,
    "newRules": 6,
    "added": 1,
    "modified": 1,
    "removed": 0,
    "changedScopes": 1,
    "unchangedTools": 2,
    "hasChanges": true
  }
}

{"tool": "transfer_funds", "arguments": {"amount": 100}, "timestamp": "2024-03-01T10:00:00Z"}
{"tool": "approve_invoice", "arguments": {"amount": 500}, "timestamp": "2024-03-01T10:01:00Z"}
{"tool": "transfer_funds", "arguments": {"amount": 6000}, "timestamp": "2024-03-01T10:02:00Z"}

# Before deploying to production
veto diff veto/rules/financial.yaml --log production-calls-7d.jsonl

# In CI, compare against main branch
git diff main...HEAD --name-only | grep 'veto/rules/'

veto diff veto/rules/financial.yaml

# Compare old and new rule sets
veto diff --old ./rules-2024-01 --new ./rules-2024-03 --format json > audit-report.json

# See what would change if you rolled back
veto diff --old ./rules-current --new ./rules-backup-2024-02-01

# 1. Edit rule
vim veto/rules/financial.yaml

# 2. See what changed
veto diff veto/rules/financial.yaml

# 3. Check impact
veto diff veto/rules/financial.yaml --log recent-calls.jsonl

# 4. If safe, apply
veto policy apply --file veto/rules/financial.yaml

# .github/workflows/veto-diff.yml
name: Veto Policy Diff

on:
  pull_request:
    paths:
      - 'veto/rules/**'

jobs:
  diff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - run: npm install -g veto-cli
      - run: |
          for file in $(git diff --name-only origin/main...HEAD | grep 'veto/rules/'); do
            echo "Checking $file"
            veto diff "$file" --format text
          done

#!/bin/bash

# Export tool calls from last 7 days
veto cloud logs --days 7 --format jsonl > calls-7d.jsonl

# Generate impact report
veto diff veto/rules/financial.yaml --log calls-7d.jsonl --format json > impact-report.json

# Email to team
jq '.impact' impact-report.json | mail -s "Policy Impact Analysis" [email protected]

Error: Unable to load HEAD version of veto/rules/financial.yaml

# Ensure file is committed
git add veto/rules/financial.yaml
git commit -m "Add financial rules"

# Or compare two files explicitly
veto diff --old financial-old.yaml --new financial-new.yaml

Warning: Invalid lines: 50

# Validate JSONL format
jq -c . calls.jsonl > /dev/null

# Or check line 42 (example)
sed -n '42p' calls.jsonl | jq .

No changes detected between policies.

veto diff veto/rules/financial.yaml
veto policy apply --file veto/rules/financial.yaml

# For critical policies, always check impact
veto diff production-policy.yaml --log prod-calls-30d.jsonl

# Save diff reports for audit trail
veto diff --old ./rules-v1 --new ./rules-v2 --format json > diff-v1-to-v2.json
git add diff-v1-to-v2.json

# Fail CI if diff shows high impact
veto diff veto/rules/ --log recent.jsonl --format json | \
  jq -e '.impact.additionalBlocked < 100'