fix(fix): commit every file a fix changes in PR mode

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes REA-848, the socket-cli side of REA-840.

Files coana doesn't report were dropped from fix PRs. PR mode only committed files listed in coana's modifiedFiles, so changes coana wrote without reporting (e.g. package.json override bumps) were left out. Now:

• every tracked file the fix changes is committed;
• new untracked files are committed only if coana reports them or they have a manifest name, so build output in repos without a .gitignore stays out;
• files already dirty before the fix are left out unless coana reports them (keeps generated facts files and local edits out).

This holds with a coana that under-reports, so it doesn't depend on coana-package-manager#2512.

Below the repo root, fixes were skipped as "no changes". git diff --name-only printed repo-root-relative paths while git ls-files, git add and coana use cwd-relative ones. git diff now uses --relative, and both lists use -z.

Tests: PR-mode selection (npm/pnpm transitive override, missing modifiedFiles, pre-dirty files, untracked filtering) and real-git coverage for listing and committing from a subdirectory.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes which files land in automated fix PRs and git path handling when cwd is below the repo root; wrong selection could omit fixes or commit unrelated dirty files, though pre-dirty filtering and manifest checks mitigate the latter.

Overview
socket fix PR mode no longer trusts Coana’s modifiedFiles alone. Before each GHSA fix it snapshots the working tree, then selectFixedFiles commits every tracked path that changed unless it was already dirty (local edits and generated facts stay out unless Coana explicitly lists them). That closes gaps such as package.json override bumps Coana applies but omits from modifiedFiles. New untracked files are included only when Coana reports them or the basename matches a scan manifest, so build artifacts in poorly ignored repos are not swept into PRs.

Running fix from a repo subdirectory was broken: unstaged paths from git diff were repo-root-relative while git add and Coana use cwd-relative paths, so fixes looked like “no changes.” gitUnstagedModifiedFiles now uses git diff --relative and both diff and untracked listing parse -z output.

Coverage adds PR-mode commit selection tests and real-git tests for listing and committing from a subdirectory; the changelog records the unreleased fix.

^{Reviewed by Cursor Bugbot for commit 637869f. Configure here.}