@wrongstack/plugins 0.309.1 → 0.310.1

package/dist/cost-tracker/index.d.ts

@@ -45,6 +45,8 @@ export interface ModelPricing {
     input: number;
     /** Cost per 1M output (completion) tokens in USD. */
     output: number;
+    /** Cost per 1M prompt-cache read tokens; input rate is the safe fallback. */
+    cacheRead?: number | undefined;
 }
 declare const plugin: Plugin;
 export default plugin;

package/dist/cost-tracker.js

@@ -12,13 +12,15 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 
+// src/cost-tracker/index.ts
+import { expectDefined } from "@wrongstack/core/utils";
+
 // src/runtime/index.ts
 var runtime_exports = {};
 __reExport(runtime_exports, runtime_star);
 import * as runtime_star from "@wrongstack/plugin-sdk/runtime";
 
 // src/cost-tracker/index.ts
-import { expectDefined } from "@wrongstack/core/utils";
 var API_VERSION = "^0.1.10";
 var PRICING = {
   "gpt-4o": { input: 5, output: 15 },
@@ -48,14 +50,14 @@ function readCostTrackerConfig(raw) {
   };
 }
 var modelKeyCache = new runtime_exports.BoundedMap({ max: 256 });
-function estimateCost(model, promptTokens, completionTokens) {
+function estimateCost(model, freshTokens, completionTokens, cachedTokens = 0) {
   let key = modelKeyCache.get(model);
   if (!key) {
     key = model.toLowerCase();
     modelKeyCache.set(model, key);
   }
   const pricing = pricingOverrides[key] ?? bundledFromRegistry[key] ?? PRICING[key] ?? DEFAULT_PRICING;
-  const inputCost = promptTokens / 1e6 * pricing.input;
+  const inputCost = freshTokens / 1e6 * pricing.input + cachedTokens / 1e6 * (pricing.cacheRead ?? pricing.input);
   const outputCost = completionTokens / 1e6 * pricing.output;
   return inputCost + outputCost;
 }
@@ -89,12 +91,17 @@ var plugin = {
       },
       pricingOverrides: {
         type: "object",
-        description: "Per-model pricing overrides in USD per 1M tokens. Keys are lowercased model names; values are { input, output }. Takes precedence over the bundled PRICING table.",
+        description: "Per-model pricing overrides in USD per 1M tokens. Values are { input, output, cacheRead? }.",
         additionalProperties: {
           type: "object",
           properties: {
             input: { type: "number", minimum: 0, description: "Cost per 1M input tokens in USD" },
-            output: { type: "number", minimum: 0, description: "Cost per 1M output tokens in USD" }
+            output: { type: "number", minimum: 0, description: "Cost per 1M output tokens in USD" },
+            cacheRead: {
+              type: "number",
+              minimum: 0,
+              description: "Cost per 1M prompt-cache read tokens in USD"
+            }
           },
           required: ["input", "output"],
           additionalProperties: false
@@ -127,7 +134,12 @@ var plugin = {
         const input = v["input"];
         const output = v["output"];
         if (typeof input !== "number" || typeof output !== "number") continue;
-        pricingOverrides[model.toLowerCase()] = { input, output };
+        const cacheRead = v["cacheRead"];
+        pricingOverrides[model.toLowerCase()] = {
+          input,
+          output,
+          ...typeof cacheRead === "number" ? { cacheRead } : {}
+        };
       }
     }
     if (api.modelsRegistry) {
@@ -142,7 +154,8 @@ var plugin = {
             if (cost && typeof cost.input === "number" && typeof cost.output === "number") {
               bundledFromRegistry[modelId.toLowerCase()] = {
                 input: cost.input,
-                output: cost.output
+                output: cost.output,
+                ...typeof cost.cache_read === "number" ? { cacheRead: cost.cache_read } : {}
               };
               hydrated += 1;
             }
@@ -169,10 +182,12 @@ var plugin = {
     api.onEvent("provider.response", async (payload) => {
       const usage = payload.usage;
       const model = payload.ctx?.model ?? "unknown";
-      const promptTokens = usage.input ?? 0;
+      const cachedTokens = usage.cacheRead ?? 0;
+      const freshTokens = (usage.input ?? 0) + (usage.cacheWrite ?? 0);
+      const promptTokens = freshTokens + cachedTokens;
       const completionTokens = usage.output ?? 0;
       const totalTokens = promptTokens + completionTokens;
-      const costUsd = estimateCost(model, promptTokens, completionTokens);
+      const costUsd = estimateCost(model, freshTokens, completionTokens, cachedTokens);
       const record = {
         promptTokens,
         completionTokens,

package/dist/git-autocommit/index.d.ts

@@ -3,10 +3,25 @@
  *
  * Tools registered:
  * - git_autocommit: Stage files and create a commit with AI-written conventional commit messages.
- *   Supports `files` for specific staging and `dry_run` for preview.
+ *   Supports `files` for specific staging, `paths` for scoped pathspec staging,
+ *   and `dry_run` for preview.
+ *
+ * Scope guard (2026-08): this tool previously committed the ENTIRE git index,
+ * and auto-staged every changed file in the tree when the index was empty —
+ * while its own `autoStage: false` default was never consulted. On a shared
+ * working tree that let one agent's commit absorb files another process had
+ * staged concurrently (observed: a release commit absorbed a concurrently
+ * staged workstream it never asked for). The guard:
+ *   - `files` callers commit via `git commit --only -- <files>` — exactly
+ *     those paths; anything else staged stays in the index for its owner.
+ *   - `paths` callers stage ONLY changed files matching the pathspecs (git
+ *     resolves the globs) and commit those, fenced the same way.
+ *   - With no files/paths and an empty index, the tool now honors `autoStage`
+ *     (default false) and returns an instructive error instead of silently
+ *     staging the whole tree. Set `autoStage: true` for the legacy behavior.
  *
  * Note: The former `git_autocommit` and `git_autocommit` tools have been removed.
- * - For staging: use `git_autocommit` with `files` (it stages automatically), or `bash` with `git add`.
+ * - For staging: use `git_autocommit` with `files` or `paths` (it stages automatically), or `bash` with `git add`.
  * - For status: use the built-in `git` tool with `command: "status"` or `command: "diff"`.
  */
 import type { Plugin } from '@wrongstack/core/types';

package/dist/git-autocommit.js

@@ -74,9 +74,15 @@ function unquotePorcelainPath(raw) {
   return Buffer.from(bytes).toString("utf8");
 }
 function parsePorcelainLine(line) {
-  const body = line.slice(3);
+  const twoColumn = /^[MADRCUTX?! ]{2} /.test(line);
+  const oneColumnTrimmed = !twoColumn && /^[MADRCUTX?!] /.test(line);
+  if (!twoColumn && !oneColumnTrimmed) {
+    const bodyAny = line.slice(3);
+    return bodyAny ? unquotePorcelainPath(bodyAny.trim()) : null;
+  }
+  const body = oneColumnTrimmed ? line.slice(2) : line.slice(3);
   if (!body) return null;
-  const status = line.slice(0, 2);
+  const status = oneColumnTrimmed ? ` ${line.slice(0, 1)}` : line.slice(0, 2);
   if (status.includes("R") || status.includes("C")) {
     const arrow = body.lastIndexOf(" -> ");
     if (arrow !== -1) return unquotePorcelainPath(body.slice(arrow + 4).trim());
@@ -92,20 +98,38 @@ async function getStagedFiles(cwd) {
   const output = await runGit(["diff", "--cached", "--name-only"], cwd);
   return output ? output.split("\n").filter(Boolean) : [];
 }
+async function getScopedStagedFiles(paths, cwd) {
+  const output = await runGit(["diff", "--cached", "--name-only", "--", ...paths], cwd);
+  return output ? output.split("\n").filter(Boolean) : [];
+}
 async function stageFiles(files, cwd) {
-  if (!files || !Array.isArray(files)) return;
-  const existing = files.filter((f) => {
-    try {
-      return existsSync(f);
-    } catch {
-      return false;
-    }
-  });
-  if (existing.length === 0) throw new Error("No files exist to stage");
-  await runGit(["add", "--", ...existing], cwd);
+  if (!files || !Array.isArray(files) || files.length === 0) return;
+  const hasPattern = files.some((f) => /[*?[\]]/.test(f));
+  if (!hasPattern) {
+    const existing = files.filter((f) => {
+      try {
+        return existsSync(f);
+      } catch {
+        return false;
+      }
+    });
+    if (existing.length === 0) throw new Error("No files exist to stage");
+    await runGit(["add", "--", ...existing], cwd);
+    return;
+  }
+  await runGit(["add", "--", ...files], cwd);
+}
+async function commitWithMessage(message, cwd, paths) {
+  const scoped = paths && paths.length > 0 ? ["--only", "--", ...paths] : [];
+  return await runGit(["commit", "-m", message, ...scoped], cwd, GIT_COMMIT_TIMEOUT_MS);
 }
-async function commitWithMessage(message, cwd) {
-  return await runGit(["commit", "-m", message], cwd, GIT_COMMIT_TIMEOUT_MS);
+async function scopedPathsDrifted(paths, cwd) {
+  try {
+    const out = await runGit(["diff", "--name-only", "--", ...paths], cwd);
+    return out ? out.split("\n").filter(Boolean) : [];
+  } catch {
+    return [];
+  }
 }
 async function getWorktrees(cwd) {
   try {
@@ -148,6 +172,17 @@ async function getStagedDiff(cwd) {
     return { stat: "(unavailable)", diff: "(unavailable)" };
   }
 }
+async function getScopedStagedDiff(paths, cwd) {
+  try {
+    const stat = await runGit(["diff", "--cached", "--stat", "--", ...paths], cwd);
+    const diff = await runGit(["diff", "--cached", "--", ...paths], cwd);
+    const MAX_DIFF = 2e4;
+    const truncated = diff.length > MAX_DIFF ? diff.slice(0, MAX_DIFF) + "\n\n... (diff truncated)" : diff;
+    return { stat: stat || "(no stat)", diff: truncated || "(clean)" };
+  } catch {
+    return { stat: "(unavailable)", diff: "(unavailable)" };
+  }
+}
 async function externalChangesSinceStage(cwd) {
   try {
     const out = await runGit(["status", "--porcelain"], cwd);
@@ -219,7 +254,7 @@ function extractJsonObject(text) {
 }
 var plugin = {
   name: "git-autocommit",
-  version: "0.2.0",
+  version: "0.3.0",
   description: "AI-powered git staging and conventional commit message generation",
   apiVersion: API_VERSION,
   capabilities: { tools: true, llm: true },
@@ -233,7 +268,11 @@ var plugin = {
     type: "object",
     properties: {
       conventionalCommits: { type: "boolean", default: true },
-      autoStage: { type: "boolean", default: false },
+      autoStage: {
+        type: "boolean",
+        default: false,
+        description: "When the index is empty and no files/paths were given, stage every changed file before committing (legacy whole-tree behavior). Default false: the tool returns an instructive error instead, so a commit never absorbs unrelated concurrently staged work."
+      },
       defaultType: { type: "string", default: "feat" },
       useLlm: {
         type: "boolean",
@@ -263,14 +302,19 @@ var plugin = {
     };
     api.tools.register({
       name: "git_autocommit",
-      description: "Stage files and create a git commit with an AI-generated conventional commit message. Pass files to stage specific ones, or leave empty to auto-detect all changed files.",
+      description: 'Stage files and create a git commit with an AI-generated conventional commit message. Pass files for exact paths, or paths (git pathspec globs like "**/package.json", "website/**") to stage only matching changed files. Commits are fenced to the staged scope \u2014 unrelated concurrently staged files are left in the index, not absorbed.',
       inputSchema: {
         type: "object",
         properties: {
           files: {
             type: "array",
             items: { type: "string" },
-            description: "Specific files to stage. If empty, auto-detects all changed files."
+            description: "Specific files to stage and commit. The commit is fenced to exactly these paths."
+          },
+          paths: {
+            type: "array",
+            items: { type: "string" },
+            description: 'Git pathspec globs limiting what this commit may include (e.g. ["**/package.json", "CHANGELOG.md", "website/**"] for a release). Only changed files matching these patterns are staged and committed.'
           },
           type: {
             type: "string",
@@ -324,7 +368,52 @@ var plugin = {
             }
             files = rawFiles;
           }
-          if (files && files.length > 0) {
+          let pathspecs;
+          const rawPaths = input["paths"];
+          if (rawPaths !== void 0) {
+            if (!Array.isArray(rawPaths)) {
+              return { ok: false, error: "paths must be an array of pathspec patterns" };
+            }
+            pathspecs = rawPaths.filter((p) => typeof p === "string" && p.length > 0);
+            if (pathspecs.length === 0) {
+              return { ok: false, error: "paths must contain at least one non-empty pattern" };
+            }
+            if (files && files.length > 0) {
+              return {
+                ok: false,
+                error: "Pass either files (exact paths) or paths (pathspec globs), not both \u2014 the other would be silently ignored."
+              };
+            }
+          }
+          let commitScope;
+          let staged = [];
+          if (pathspecs) {
+            try {
+              await stageFiles(pathspecs);
+            } catch (err) {
+              return {
+                ok: false,
+                error: `Failed to stage files matching paths: ${err instanceof Error ? err.message : String(err)}`
+              };
+            }
+            try {
+              staged = await getScopedStagedFiles(pathspecs);
+            } catch {
+              staged = [];
+            }
+            if (staged.length === 0) {
+              return {
+                ok: false,
+                error: "No changed files match the given paths \u2014 refusing to commit anything else."
+              };
+            }
+            commitScope = staged;
+            try {
+              staged = await getStagedFiles();
+            } catch {
+              staged = commitScope;
+            }
+          } else if (files && files.length > 0) {
             try {
               await stageFiles(files);
             } catch (err) {
@@ -333,31 +422,37 @@ var plugin = {
                 error: `Failed to stage files: ${err instanceof Error ? err.message : String(err)}`
               };
             }
-          }
-          let staged = [];
-          try {
-            staged = await getStagedFiles();
-          } catch {
-            staged = [];
-          }
-          if (staged.length === 0) {
+            commitScope = files;
             try {
-              const changed = await getChangedFiles();
-              if (changed.length > 0) {
-                try {
-                  await stageFiles(changed);
-                } catch {
-                }
-                try {
-                  staged = await getStagedFiles();
-                } catch {
-                  staged = [];
+              staged = await getStagedFiles();
+            } catch {
+              staged = [];
+            }
+          } else {
+            try {
+              staged = await getStagedFiles();
+            } catch {
+              staged = [];
+            }
+            if (staged.length === 0 && opts.autoStage) {
+              try {
+                const changed = await getChangedFiles();
+                if (changed.length > 0) {
+                  try {
+                    await stageFiles(changed);
+                  } catch {
+                  }
+                  try {
+                    staged = await getStagedFiles();
+                  } catch {
+                    staged = [];
+                  }
                 }
+              } catch {
               }
-            } catch {
             }
           }
-          const { stat, diff: stagedDiff } = await getStagedDiff();
+          const { stat, diff: stagedDiff } = commitScope ? await getScopedStagedDiff(commitScope) : await getStagedDiff();
           let generatedByLlm = false;
           if (wantGenerate && staged.length > 0) {
             const g = await generateCommitFromDiff(api, stat, stagedDiff);
@@ -400,9 +495,19 @@ var plugin = {
           if (staged.length === 0) {
             return {
               ok: false,
-              error: "Nothing staged. Add files with git add or provide files input."
+              error: 'Nothing staged. Pass files (exact paths) or paths (pathspec globs) to scope this commit, stage with git add beforehand, or set extensions["git-autocommit"].autoStage=true to allow staging every changed file (legacy whole-tree behavior).'
             };
           }
+          let scopeWarning = null;
+          if (commitScope) {
+            const scopedSet = new Set(commitScope);
+            const foreign = staged.filter((f) => !scopedSet.has(f));
+            if (foreign.length > 0) {
+              const preview = foreign.slice(0, 10).join(", ");
+              const suffix = foreign.length > 10 ? ` and ${foreign.length - 10} more` : "";
+              scopeWarning = `\u26A0 Scope guard: ${foreign.length} staged file(s) outside the requested scope (${preview}${suffix}) were left uncommitted and remain staged for their owner.`;
+            }
+          }
           const worktreeWarn = await simultaneousEditWarning();
           const externalChanges = await externalChangesSinceStage();
           let externalWarning = null;
@@ -411,7 +516,7 @@ var plugin = {
             const suffix = externalChanges.length > 10 ? ` and ${externalChanges.length - 10} more` : "";
             externalWarning = `\u26A0 External changes detected since staging: ${preview}${suffix}. Another agent may be modifying files concurrently. These unstaged changes will NOT be included in this commit, but they indicate simultaneous edits. Review carefully.`;
           }
-          const warning = [worktreeWarn, externalWarning].filter(Boolean).join("\n") || void 0;
+          const warning = [worktreeWarn, scopeWarning, externalWarning].filter(Boolean).join("\n") || void 0;
           if (dryRun) {
             return {
               ok: true,
@@ -428,16 +533,20 @@ ${stagedDiff}
 \`\`\``
             };
           }
-          let preCommitDiff = stagedDiff;
-          let preCommitStat = stat;
-          if (staged.length === 0) {
-            const fresh = await getStagedDiff();
-            preCommitDiff = fresh.diff;
-            preCommitStat = fresh.stat;
+          if (commitScope && !dryRun) {
+            const drifted = await scopedPathsDrifted(commitScope);
+            if (drifted.length > 0) {
+              const preview = drifted.slice(0, 10).join(", ");
+              const suffix = drifted.length > 10 ? ` and ${drifted.length - 10} more` : "";
+              return {
+                ok: false,
+                error: `Working tree changed after staging for: ${preview}${suffix}. A scoped commit takes working-tree content, so committing now could include changes that were never staged or previewed. Re-run the tool to re-stage the current content.`
+              };
+            }
           }
           let hash = "";
           try {
-            hash = await commitWithMessage(msg);
+            hash = await commitWithMessage(msg, void 0, commitScope);
           } catch (err) {
             return {
               ok: false,
@@ -457,7 +566,7 @@ ${stagedDiff}
               commitType: type,
               scope: String(scope ?? ""),
               /* v8 ignore next -- staged is always an array here; the : [] fallback is defensive. */
-              files: Array.isArray(staged) ? staged : [],
+              files: Array.isArray(staged) ? commitScope ?? staged : [],
               warning: warning ?? null
             });
           } catch (_err) {
@@ -466,7 +575,7 @@ ${stagedDiff}
             ok: true,
             hash,
             message: msg,
-            stagedFiles: staged,
+            stagedFiles: commitScope ?? staged,
             type,
             scope: scope ?? null,
             generatedByLlm,
@@ -474,10 +583,10 @@ ${stagedDiff}
             diff: `
 ## Staged diff
 
-${preCommitStat}
+${stat}
 
 \`\`\`diff
-${preCommitDiff}
+${stagedDiff}
 \`\`\``
           };
         } catch (err) {
@@ -489,7 +598,7 @@ ${preCommitDiff}
       }
     });
     api.log.info("git-autocommit plugin loaded", {
-      version: "0.2.0",
+      version: "0.3.0",
       conventionalCommits: opts.conventionalCommits
     });
   },

package/dist/index.js

@@ -4370,14 +4370,14 @@ function readCostTrackerConfig(raw) {
   };
 }
 var modelKeyCache = new runtime_exports.BoundedMap({ max: 256 });
-function estimateCost(model, promptTokens, completionTokens) {
+function estimateCost(model, freshTokens, completionTokens, cachedTokens = 0) {
   let key = modelKeyCache.get(model);
   if (!key) {
     key = model.toLowerCase();
     modelKeyCache.set(model, key);
   }
   const pricing = pricingOverrides[key] ?? bundledFromRegistry[key] ?? PRICING[key] ?? DEFAULT_PRICING;
-  const inputCost = promptTokens / 1e6 * pricing.input;
+  const inputCost = freshTokens / 1e6 * pricing.input + cachedTokens / 1e6 * (pricing.cacheRead ?? pricing.input);
   const outputCost = completionTokens / 1e6 * pricing.output;
   return inputCost + outputCost;
 }
@@ -4411,12 +4411,17 @@ var plugin14 = {
       },
       pricingOverrides: {
         type: "object",
-        description: "Per-model pricing overrides in USD per 1M tokens. Keys are lowercased model names; values are { input, output }. Takes precedence over the bundled PRICING table.",
+        description: "Per-model pricing overrides in USD per 1M tokens. Values are { input, output, cacheRead? }.",
         additionalProperties: {
           type: "object",
           properties: {
             input: { type: "number", minimum: 0, description: "Cost per 1M input tokens in USD" },
-            output: { type: "number", minimum: 0, description: "Cost per 1M output tokens in USD" }
+            output: { type: "number", minimum: 0, description: "Cost per 1M output tokens in USD" },
+            cacheRead: {
+              type: "number",
+              minimum: 0,
+              description: "Cost per 1M prompt-cache read tokens in USD"
+            }
           },
           required: ["input", "output"],
           additionalProperties: false
@@ -4449,7 +4454,12 @@ var plugin14 = {
         const input = v["input"];
         const output = v["output"];
         if (typeof input !== "number" || typeof output !== "number") continue;
-        pricingOverrides[model.toLowerCase()] = { input, output };
+        const cacheRead = v["cacheRead"];
+        pricingOverrides[model.toLowerCase()] = {
+          input,
+          output,
+          ...typeof cacheRead === "number" ? { cacheRead } : {}
+        };
       }
     }
     if (api.modelsRegistry) {
@@ -4464,7 +4474,8 @@ var plugin14 = {
             if (cost && typeof cost.input === "number" && typeof cost.output === "number") {
               bundledFromRegistry[modelId.toLowerCase()] = {
                 input: cost.input,
-                output: cost.output
+                output: cost.output,
+                ...typeof cost.cache_read === "number" ? { cacheRead: cost.cache_read } : {}
               };
               hydrated += 1;
             }
@@ -4491,10 +4502,12 @@ var plugin14 = {
     api.onEvent("provider.response", async (payload) => {
       const usage = payload.usage;
       const model = payload.ctx?.model ?? "unknown";
-      const promptTokens = usage.input ?? 0;
+      const cachedTokens = usage.cacheRead ?? 0;
+      const freshTokens = (usage.input ?? 0) + (usage.cacheWrite ?? 0);
+      const promptTokens = freshTokens + cachedTokens;
       const completionTokens = usage.output ?? 0;
       const totalTokens = promptTokens + completionTokens;
-      const costUsd = estimateCost(model, promptTokens, completionTokens);
+      const costUsd = estimateCost(model, freshTokens, completionTokens, cachedTokens);
       const record = {
         promptTokens,
         completionTokens,
@@ -8412,9 +8425,15 @@ function unquotePorcelainPath(raw) {
   return Buffer.from(bytes).toString("utf8");
 }
 function parsePorcelainLine(line) {
-  const body = line.slice(3);
+  const twoColumn = /^[MADRCUTX?! ]{2} /.test(line);
+  const oneColumnTrimmed = !twoColumn && /^[MADRCUTX?!] /.test(line);
+  if (!twoColumn && !oneColumnTrimmed) {
+    const bodyAny = line.slice(3);
+    return bodyAny ? unquotePorcelainPath(bodyAny.trim()) : null;
+  }
+  const body = oneColumnTrimmed ? line.slice(2) : line.slice(3);
   if (!body) return null;
-  const status = line.slice(0, 2);
+  const status = oneColumnTrimmed ? ` ${line.slice(0, 1)}` : line.slice(0, 2);
   if (status.includes("R") || status.includes("C")) {
     const arrow = body.lastIndexOf(" -> ");
     if (arrow !== -1) return unquotePorcelainPath(body.slice(arrow + 4).trim());
@@ -8430,20 +8449,38 @@ async function getStagedFiles(cwd) {
   const output = await runGit3(["diff", "--cached", "--name-only"], cwd);
   return output ? output.split("\n").filter(Boolean) : [];
 }
+async function getScopedStagedFiles(paths, cwd) {
+  const output = await runGit3(["diff", "--cached", "--name-only", "--", ...paths], cwd);
+  return output ? output.split("\n").filter(Boolean) : [];
+}
 async function stageFiles(files, cwd) {
-  if (!files || !Array.isArray(files)) return;
-  const existing = files.filter((f) => {
-    try {
-      return existsSync2(f);
-    } catch {
-      return false;
-    }
-  });
-  if (existing.length === 0) throw new Error("No files exist to stage");
-  await runGit3(["add", "--", ...existing], cwd);
+  if (!files || !Array.isArray(files) || files.length === 0) return;
+  const hasPattern = files.some((f) => /[*?[\]]/.test(f));
+  if (!hasPattern) {
+    const existing = files.filter((f) => {
+      try {
+        return existsSync2(f);
+      } catch {
+        return false;
+      }
+    });
+    if (existing.length === 0) throw new Error("No files exist to stage");
+    await runGit3(["add", "--", ...existing], cwd);
+    return;
+  }
+  await runGit3(["add", "--", ...files], cwd);
+}
+async function commitWithMessage(message, cwd, paths) {
+  const scoped = paths && paths.length > 0 ? ["--only", "--", ...paths] : [];
+  return await runGit3(["commit", "-m", message, ...scoped], cwd, GIT_COMMIT_TIMEOUT_MS);
 }
-async function commitWithMessage(message, cwd) {
-  return await runGit3(["commit", "-m", message], cwd, GIT_COMMIT_TIMEOUT_MS);
+async function scopedPathsDrifted(paths, cwd) {
+  try {
+    const out = await runGit3(["diff", "--name-only", "--", ...paths], cwd);
+    return out ? out.split("\n").filter(Boolean) : [];
+  } catch {
+    return [];
+  }
 }
 async function getWorktrees(cwd) {
   try {
@@ -8486,6 +8523,17 @@ async function getStagedDiff(cwd) {
     return { stat: "(unavailable)", diff: "(unavailable)" };
   }
 }
+async function getScopedStagedDiff(paths, cwd) {
+  try {
+    const stat8 = await runGit3(["diff", "--cached", "--stat", "--", ...paths], cwd);
+    const diff = await runGit3(["diff", "--cached", "--", ...paths], cwd);
+    const MAX_DIFF = 2e4;
+    const truncated = diff.length > MAX_DIFF ? diff.slice(0, MAX_DIFF) + "\n\n... (diff truncated)" : diff;
+    return { stat: stat8 || "(no stat)", diff: truncated || "(clean)" };
+  } catch {
+    return { stat: "(unavailable)", diff: "(unavailable)" };
+  }
+}
 async function externalChangesSinceStage(cwd) {
   try {
     const out = await runGit3(["status", "--porcelain"], cwd);
@@ -8557,7 +8605,7 @@ function extractJsonObject2(text) {
 }
 var plugin26 = {
   name: "git-autocommit",
-  version: "0.2.0",
+  version: "0.3.0",
   description: "AI-powered git staging and conventional commit message generation",
   apiVersion: API_VERSION18,
   capabilities: { tools: true, llm: true },
@@ -8571,7 +8619,11 @@ var plugin26 = {
     type: "object",
     properties: {
       conventionalCommits: { type: "boolean", default: true },
-      autoStage: { type: "boolean", default: false },
+      autoStage: {
+        type: "boolean",
+        default: false,
+        description: "When the index is empty and no files/paths were given, stage every changed file before committing (legacy whole-tree behavior). Default false: the tool returns an instructive error instead, so a commit never absorbs unrelated concurrently staged work."
+      },
       defaultType: { type: "string", default: "feat" },
       useLlm: {
         type: "boolean",
@@ -8601,14 +8653,19 @@ var plugin26 = {
     };
     api.tools.register({
       name: "git_autocommit",
-      description: "Stage files and create a git commit with an AI-generated conventional commit message. Pass files to stage specific ones, or leave empty to auto-detect all changed files.",
+      description: 'Stage files and create a git commit with an AI-generated conventional commit message. Pass files for exact paths, or paths (git pathspec globs like "**/package.json", "website/**") to stage only matching changed files. Commits are fenced to the staged scope \u2014 unrelated concurrently staged files are left in the index, not absorbed.',
       inputSchema: {
         type: "object",
         properties: {
           files: {
             type: "array",
             items: { type: "string" },
-            description: "Specific files to stage. If empty, auto-detects all changed files."
+            description: "Specific files to stage and commit. The commit is fenced to exactly these paths."
+          },
+          paths: {
+            type: "array",
+            items: { type: "string" },
+            description: 'Git pathspec globs limiting what this commit may include (e.g. ["**/package.json", "CHANGELOG.md", "website/**"] for a release). Only changed files matching these patterns are staged and committed.'
           },
           type: {
             type: "string",
@@ -8662,7 +8719,52 @@ var plugin26 = {
             }
             files = rawFiles;
           }
-          if (files && files.length > 0) {
+          let pathspecs;
+          const rawPaths = input["paths"];
+          if (rawPaths !== void 0) {
+            if (!Array.isArray(rawPaths)) {
+              return { ok: false, error: "paths must be an array of pathspec patterns" };
+            }
+            pathspecs = rawPaths.filter((p) => typeof p === "string" && p.length > 0);
+            if (pathspecs.length === 0) {
+              return { ok: false, error: "paths must contain at least one non-empty pattern" };
+            }
+            if (files && files.length > 0) {
+              return {
+                ok: false,
+                error: "Pass either files (exact paths) or paths (pathspec globs), not both \u2014 the other would be silently ignored."
+              };
+            }
+          }
+          let commitScope;
+          let staged = [];
+          if (pathspecs) {
+            try {
+              await stageFiles(pathspecs);
+            } catch (err) {
+              return {
+                ok: false,
+                error: `Failed to stage files matching paths: ${err instanceof Error ? err.message : String(err)}`
+              };
+            }
+            try {
+              staged = await getScopedStagedFiles(pathspecs);
+            } catch {
+              staged = [];
+            }
+            if (staged.length === 0) {
+              return {
+                ok: false,
+                error: "No changed files match the given paths \u2014 refusing to commit anything else."
+              };
+            }
+            commitScope = staged;
+            try {
+              staged = await getStagedFiles();
+            } catch {
+              staged = commitScope;
+            }
+          } else if (files && files.length > 0) {
             try {
               await stageFiles(files);
             } catch (err) {
@@ -8671,31 +8773,37 @@ var plugin26 = {
                 error: `Failed to stage files: ${err instanceof Error ? err.message : String(err)}`
               };
             }
-          }
-          let staged = [];
-          try {
-            staged = await getStagedFiles();
-          } catch {
-            staged = [];
-          }
-          if (staged.length === 0) {
+            commitScope = files;
             try {
-              const changed = await getChangedFiles();
-              if (changed.length > 0) {
-                try {
-                  await stageFiles(changed);
-                } catch {
-                }
-                try {
-                  staged = await getStagedFiles();
-                } catch {
-                  staged = [];
+              staged = await getStagedFiles();
+            } catch {
+              staged = [];
+            }
+          } else {
+            try {
+              staged = await getStagedFiles();
+            } catch {
+              staged = [];
+            }
+            if (staged.length === 0 && opts.autoStage) {
+              try {
+                const changed = await getChangedFiles();
+                if (changed.length > 0) {
+                  try {
+                    await stageFiles(changed);
+                  } catch {
+                  }
+                  try {
+                    staged = await getStagedFiles();
+                  } catch {
+                    staged = [];
+                  }
                 }
+              } catch {
               }
-            } catch {
             }
           }
-          const { stat: stat8, diff: stagedDiff } = await getStagedDiff();
+          const { stat: stat8, diff: stagedDiff } = commitScope ? await getScopedStagedDiff(commitScope) : await getStagedDiff();
           let generatedByLlm = false;
           if (wantGenerate && staged.length > 0) {
             const g = await generateCommitFromDiff(api, stat8, stagedDiff);
@@ -8738,9 +8846,19 @@ var plugin26 = {
           if (staged.length === 0) {
             return {
               ok: false,
-              error: "Nothing staged. Add files with git add or provide files input."
+              error: 'Nothing staged. Pass files (exact paths) or paths (pathspec globs) to scope this commit, stage with git add beforehand, or set extensions["git-autocommit"].autoStage=true to allow staging every changed file (legacy whole-tree behavior).'
             };
           }
+          let scopeWarning = null;
+          if (commitScope) {
+            const scopedSet = new Set(commitScope);
+            const foreign = staged.filter((f) => !scopedSet.has(f));
+            if (foreign.length > 0) {
+              const preview = foreign.slice(0, 10).join(", ");
+              const suffix = foreign.length > 10 ? ` and ${foreign.length - 10} more` : "";
+              scopeWarning = `\u26A0 Scope guard: ${foreign.length} staged file(s) outside the requested scope (${preview}${suffix}) were left uncommitted and remain staged for their owner.`;
+            }
+          }
           const worktreeWarn = await simultaneousEditWarning();
           const externalChanges = await externalChangesSinceStage();
           let externalWarning = null;
@@ -8749,7 +8867,7 @@ var plugin26 = {
             const suffix = externalChanges.length > 10 ? ` and ${externalChanges.length - 10} more` : "";
             externalWarning = `\u26A0 External changes detected since staging: ${preview}${suffix}. Another agent may be modifying files concurrently. These unstaged changes will NOT be included in this commit, but they indicate simultaneous edits. Review carefully.`;
           }
-          const warning = [worktreeWarn, externalWarning].filter(Boolean).join("\n") || void 0;
+          const warning = [worktreeWarn, scopeWarning, externalWarning].filter(Boolean).join("\n") || void 0;
           if (dryRun) {
             return {
               ok: true,
@@ -8766,16 +8884,20 @@ ${stagedDiff}
 \`\`\``
             };
           }
-          let preCommitDiff = stagedDiff;
-          let preCommitStat = stat8;
-          if (staged.length === 0) {
-            const fresh = await getStagedDiff();
-            preCommitDiff = fresh.diff;
-            preCommitStat = fresh.stat;
+          if (commitScope && !dryRun) {
+            const drifted = await scopedPathsDrifted(commitScope);
+            if (drifted.length > 0) {
+              const preview = drifted.slice(0, 10).join(", ");
+              const suffix = drifted.length > 10 ? ` and ${drifted.length - 10} more` : "";
+              return {
+                ok: false,
+                error: `Working tree changed after staging for: ${preview}${suffix}. A scoped commit takes working-tree content, so committing now could include changes that were never staged or previewed. Re-run the tool to re-stage the current content.`
+              };
+            }
           }
           let hash = "";
           try {
-            hash = await commitWithMessage(msg);
+            hash = await commitWithMessage(msg, void 0, commitScope);
           } catch (err) {
             return {
               ok: false,
@@ -8795,7 +8917,7 @@ ${stagedDiff}
               commitType: type,
               scope: String(scope ?? ""),
               /* v8 ignore next -- staged is always an array here; the : [] fallback is defensive. */
-              files: Array.isArray(staged) ? staged : [],
+              files: Array.isArray(staged) ? commitScope ?? staged : [],
               warning: warning ?? null
             });
           } catch (_err) {
@@ -8804,7 +8926,7 @@ ${stagedDiff}
             ok: true,
             hash,
             message: msg,
-            stagedFiles: staged,
+            stagedFiles: commitScope ?? staged,
             type,
             scope: scope ?? null,
             generatedByLlm,
@@ -8812,10 +8934,10 @@ ${stagedDiff}
             diff: `
 ## Staged diff
 
-${preCommitStat}
+${stat8}
 
 \`\`\`diff
-${preCommitDiff}
+${stagedDiff}
 \`\`\``
           };
         } catch (err) {
@@ -8827,7 +8949,7 @@ ${preCommitDiff}
       }
     });
     api.log.info("git-autocommit plugin loaded", {
-      version: "0.2.0",
+      version: "0.3.0",
       conventionalCommits: opts.conventionalCommits
     });
   },
@@ -22673,9 +22795,10 @@ var plugin60 = {
 var todo_listener_default = plugin60;
 
 // src/todo-tracker/index.ts
-import * as fsp from "node:fs/promises";
 import { randomUUID } from "node:crypto";
+import * as fsp from "node:fs/promises";
 import { atomicWrite as atomicWrite3, ensureDir as ensureDir3 } from "@wrongstack/core/utils";
+import { nowIso } from "@wrongstack/primitives";
 function deriveFilePath(api) {
   const raw = api.config.extensions?.["todo-tracker"];
   const explicit = typeof raw?.["filePath"] === "string" ? raw["filePath"] : null;
@@ -22720,9 +22843,6 @@ var state56 = {
   /** Most recent mutation for /diag plugins visibility. */
   lastMutation: null
 };
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
 function ensureFile() {
   if (!state56.file) {
     state56.file = {

package/dist/todo-tracker/index.d.ts

@@ -1,3 +1,32 @@
+/**
+ * todo-tracker plugin — Persistent, project-scoped todo backlog that
+ * survives across sessions.
+ *
+ * Why a separate plugin from the built-in `todo` tool?
+ *   - The built-in `todo` tool mutates `ctx.todos`, which is
+ *     session-scoped and auto-clears when all items complete.
+ *   - todo-tracker writes to disk (`~/.wrongstack/projects/<slug>/todo-tracker.json`)
+ *     and survives across sessions. Items are explicit add/complete;
+ *     no auto-clear.
+ *
+ * Use cases:
+ *   - Backlog of work the user wants to track over days/weeks
+ *   - Items the LLM noticed but didn't finish — pull them into a fresh
+ *     session via `todo_tracker_pull` (the LLM then registers them with
+ *     the session's `ctx.todos` via the built-in `todo` tool)
+ *   - Per-project scratchpad that survives `wstack resume <id>`
+ *
+ * Tools registered:
+ *   - todo_tracker_list     : List items, filterable by status/tag/priority
+ *   - todo_tracker_add      : Append a new item
+ *   - todo_tracker_complete : Mark an item completed (idempotent)
+ *   - todo_tracker_drop     : Mark an item dropped (idempotent)
+ *   - todo_tracker_remove   : Permanently delete by id
+ *   - todo_tracker_pull     : Return pending items for LLM to promote
+ *                             into the session's ctx.todos via the
+ *                             built-in `todo` tool
+ *   - todo_tracker_status   : Counters + last update timestamp
+ */
 import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;

package/dist/todo-tracker.js

@@ -1,7 +1,8 @@
 // src/todo-tracker/index.ts
-import * as fsp from "node:fs/promises";
 import { randomUUID } from "node:crypto";
+import * as fsp from "node:fs/promises";
 import { atomicWrite, ensureDir } from "@wrongstack/core/utils";
+import { nowIso } from "@wrongstack/primitives";
 function deriveFilePath(api) {
   const raw = api.config.extensions?.["todo-tracker"];
   const explicit = typeof raw?.["filePath"] === "string" ? raw["filePath"] : null;
@@ -46,9 +47,6 @@ var state = {
   /** Most recent mutation for /diag plugins visibility. */
   lastMutation: null
 };
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
 function ensureFile() {
   if (!state.file) {
     state.file = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/plugins",
-  "version": "0.309.1",
+  "version": "0.310.1",
   "description": "Official WrongStack collection of focused plugins for code quality, security, observability, planning, and agent coordination",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
@@ -303,9 +303,10 @@
     "vitest": "^4.1.11"
   },
   "dependencies": {
-    "@wrongstack/plugin-sdk": "0.309.1",
-    "@wrongstack/core": "0.309.1",
-    "@wrongstack/tools": "0.309.1"
+    "@wrongstack/core": "0.310.1",
+    "@wrongstack/plugin-sdk": "0.310.1",
+    "@wrongstack/primitives": "0.310.1",
+    "@wrongstack/tools": "0.310.1"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",