wr-risk-scorer: restage-commit helper sweeps the whole index/working tree instead of the supplied paths

[tompahoward]

Description

The wr-risk-scorer-restage-commit helper re-adds the supplied paths but commits the ENTIRE index — paths staged earlier in the session, and even unstaged working-tree modifications, are silently swept into the commit. Observed: a planned two-commit sequence collapsed into one because unrelated files were pre-staged; and separately, two modified-but-unstaged files were folded into an unrelated capture commit. This indicates the helper runs a working-tree-wide git add rather than a pathspec-scoped commit.

Symptoms

• Two-commit plan collapsed to one commit.
• Second restage-commit call errors with an empty-index-diff after the first consumed its paths.
• Unstaged working-tree files swept into an unrelated capture commit.

Affected plugin / component

@windyroad/risk-scorer — restage-commit helper.

Fix direction

Helper should commit only the supplied paths (git commit -- <paths> pathspec form), or warn/abort when the index contains paths outside the supplied list.

Cross-reference

Reported from a downstream adopter; tracked locally as P115.

Versions

• Local plugin: @windyroad/* (cache: itil 0.57.1)
• Claude Code CLI: 2.1.201 (Claude Code)
• Node: v22.17.1
• OS: Darwin 25.3.0 x86_64