logwork-cli 1.1.0 → 1.1.1

package/README.md

@@ -30,16 +30,26 @@ logwork setup
 
 ## Upgrading from logwork-helper
 
-The package was renamed from `logwork-helper` to `logwork-cli`, and the `logwork-helper` command no longer exists. To upgrade:
+The package was renamed from `logwork-helper` to `logwork-cli`, and the `logwork-helper` command no longer exists. Both packages install a `logwork` command, so remove the old one first (otherwise npm stops with `EEXIST`):
 
 ```bash
+npm uninstall -g logwork-helper
 npm install -g logwork-cli
 logwork setup
 ```
 
 Most of the move is automatic:
 
-- **Old global package:** `logwork setup` removes the global `logwork-helper` package, so its `logwork` command does not conflict with the new one.
+- **Old global package:** if it is still installed, `logwork setup` removes the global `logwork-helper` package before linking. You can also run `npx logwork-cli@latest setup` without uninstalling first.
+- **`EEXIST ... bin/logwork` even after uninstalling:** the old package was linked from `~/.logwork-helper`. If that folder was deleted first, `npm uninstall` cannot remove its links. Remove the broken links, then install again:
+
+  ```bash
+  P="$(npm prefix -g)"
+  rm -f "$P/bin/logwork" "$P"/bin/logwork-helper* "$P/lib/node_modules/logwork-helper"
+  npm install -g logwork-cli && logwork setup
+  ```
+
+  `npx logwork-cli@latest setup` also removes those broken links (macOS).
 - **Local state:** on the first run, settings, project mappings, drafts, apply history and the reminder config are copied from `~/.logwork-helper` to `~/.logwork-cli`. The old directory is left in place.
 - **Login sessions:** your RO and Jira sessions are copied from the old Keychain / Credential Manager entry (`logwork-helper`) to the new one (`logwork-cli`), so you do not need to log in again.
 - **Repo mappings:** a repo that has `.logwork-helper.json` keeps using it until a `.logwork.json` exists.

package/commands/setup.mjs

@@ -4,6 +4,7 @@ import { delimiter, dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { redactText } from '../lib/auth-redaction.mjs';
 import { credentialStoreLabel } from '../lib/credential-store.mjs';
+import { npmInvocation } from '../lib/npm-command.mjs';
 import { helperHome } from '../lib/paths.mjs';
 import {
   MCP_SERVER_NAME,
@@ -59,7 +60,7 @@ export async function installUserRuntime({
   sourceDir,
   targetDir,
   mkdirFn = fs.mkdir,
-  copyFn = copyDirectory,
+  copyFn = copyRuntimeFiles,
   cleanupFn = sanitizeRuntimeMetadata,
   installFn = installDependencies,
   linkFn = linkGlobalBinaries,
@@ -103,6 +104,40 @@ async function refreshReminderSchedule(targetDir) {
   }
 }
 
+// Copies only what the npm package ships (package.json "files", plus the
+// manifest and lockfile). The target is also the state directory, so a git
+// checkout's .env files, tests, archives or a repo-scope .logwork.json must
+// never land there.
+export async function copyRuntimeFiles(sourceDir, targetDir) {
+  const manifest = JSON.parse(await fs.readFile(join(sourceDir, 'package.json'), 'utf8'));
+  const listed = Array.isArray(manifest.files) ? manifest.files : [];
+  const names = ['package.json', 'package-lock.json', 'npm-shrinkwrap.json', ...listed.map((item) => String(item).replace(/[\\/]+$/, ''))];
+  for (const name of [...new Set(names)]) {
+    const sourcePath = join(sourceDir, name);
+    let stat;
+    try {
+      stat = await fs.stat(sourcePath);
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        // A lockfile from an earlier install that no longer matches this
+        // package.json would make `npm ci` fail; let npm install write a new one.
+        if (name === 'package-lock.json') {
+          await fs.rm(join(targetDir, name), { force: true });
+        }
+        continue;
+      }
+      throw error;
+    }
+    if (stat.isDirectory()) {
+      await fs.mkdir(join(targetDir, name), { recursive: true });
+      await copyDirectory(sourcePath, targetDir, sourceDir);
+    } else {
+      await fs.mkdir(dirname(join(targetDir, name)), { recursive: true });
+      await fs.copyFile(sourcePath, join(targetDir, name));
+    }
+  }
+}
+
 async function copyDirectory(sourceDir, targetDir, rootDir) {
   const entries = await fs.readdir(sourceDir, { withFileTypes: true });
 
@@ -139,7 +174,8 @@ function installDependencies(targetDir) {
 
 function runCommand(command, args, options = {}) {
   return new Promise((resolveValue, reject) => {
-    const child = spawn(command, args, options);
+    const invocation = command === 'npm' ? npmInvocation(args) : { command, args, shell: false };
+    const child = spawn(invocation.command, invocation.args, { ...options, shell: invocation.shell });
 
     child.on('error', reject);
     child.on('close', (code) => {
@@ -243,9 +279,73 @@ function isStaleSelfDependency(value) {
   return typeof value === 'string' && /^file:.*logwork-(helper|cli).*\.tgz$/i.test(value);
 }
 
+const LEGACY_GLOBAL_LINKS = [
+  'bin/logwork',
+  'bin/logwork-helper',
+  'bin/logwork-helper-install',
+  'bin/logwork-helper-manual',
+  'bin/logwork-helper-mcp',
+  'bin/logwork-helper-setup-user',
+  'lib/node_modules/logwork-helper'
+];
+
+// The old package was installed with `npm link` from ~/.logwork-helper. When
+// that folder is deleted first, its global links dangle: `npm rm -g` cannot
+// read the package any more and leaves bin/logwork behind, which then blocks
+// `npm install -g logwork-cli` and `npm link` with EEXIST. Remove only links
+// that point into a logwork-helper path that no longer exists.
+export async function removeDanglingLegacyLinks(globalPrefix, {
+  platform = process.platform,
+  lstatFn = fs.lstat,
+  statFn = fs.stat,
+  readlinkFn = fs.readlink,
+  unlinkFn = fs.unlink
+} = {}) {
+  const removed = [];
+  if (!globalPrefix || platform === 'win32') {
+    return removed;
+  }
+  for (const relativePath of LEGACY_GLOBAL_LINKS) {
+    const path = join(globalPrefix, relativePath);
+    try {
+      if (!(await lstatFn(path)).isSymbolicLink()) {
+        continue;
+      }
+      if (!/logwork-helper/.test(await readlinkFn(path))) {
+        continue;
+      }
+      try {
+        await statFn(path);
+        continue;
+      } catch {
+        // Dangling: the target is gone.
+      }
+      await unlinkFn(path);
+      removed.push(path);
+    } catch {
+      // Missing or unreadable: nothing to clean.
+    }
+  }
+  return removed;
+}
+
+function readNpmGlobalPrefix(cwd) {
+  return new Promise((resolveValue) => {
+    const invocation = npmInvocation(['prefix', '-g']);
+    const child = spawn(invocation.command, invocation.args, { cwd, shell: invocation.shell, stdio: ['ignore', 'pipe', 'ignore'] });
+    let stdout = '';
+    child.stdout.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => { stdout += chunk; });
+    child.on('error', () => resolveValue(''));
+    child.on('close', (code) => resolveValue(code === 0 ? stdout.trim() : ''));
+  });
+}
+
 export async function linkGlobalBinaries(targetDir, {
   runner = runCommand,
-  commandFinder = findCommandOnPath
+  commandFinder = findCommandOnPath,
+  prefixReader = readNpmGlobalPrefix,
+  legacyLinkCleaner = removeDanglingLegacyLinks
 } = {}) {
   // Best effort: drop the pre-rename global package so its `logwork` bin does
   // not block linking this one. A no-op when it is not installed.
@@ -253,6 +353,10 @@ export async function linkGlobalBinaries(targetDir, {
     cwd: targetDir,
     stdio: 'ignore'
   }).catch(() => {});
+  await Promise.resolve()
+    .then(() => prefixReader(targetDir))
+    .then((prefix) => legacyLinkCleaner(prefix))
+    .catch(() => []);
 
   try {
     await runner('npm', ['link'], {

package/docs/mcp-setup.md

@@ -107,7 +107,7 @@ Previews expire after 1 hour. They are also lost when the server restarts.
 
 ### Tool Name Changes From logwork-helper
 
-| logwork-helper (before 0.3.0) | logwork-cli |
+| logwork-helper (0.2.x and earlier) | logwork-cli |
 |---|---|
 | `preview_logwork_batch`, `apply_logwork_batch` | `log_work` |
 | `query_logwork` | `get_logwork` |

package/docs/operations-guide.md

@@ -19,6 +19,8 @@ npm install -g logwork-cli
 logwork setup
 ```
 
+Upgrading from `logwork-helper`: run `npm uninstall -g logwork-helper` first. Both packages provide a `logwork` command, and npm refuses to overwrite it (`EEXIST`). If `~/.logwork-helper` was already deleted, the uninstall leaves broken links behind; remove them with `P="$(npm prefix -g)"; rm -f "$P/bin/logwork" "$P"/bin/logwork-helper* "$P/lib/node_modules/logwork-helper"`, or run `npx logwork-cli@latest setup`, which removes them.
+
 Authenticate each target from Terminal:
 
 ```bash

package/lib/batch-parser.mjs

@@ -1,6 +1,8 @@
 const DAY_HEADING_RE = /^(Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday),\s+(\d{2})\s+([A-Za-z]{3})\s+(\d{4})$/;
 const ENTRY_RE = /^\+(\d+(?:\.\d+)?)\s+(.+)$/;
 const TICKET_RE = /\b[A-Z][A-Z0-9]+-\d+\b/g;
+const MAX_DAY_HOURS = 24;
+const WEEKDAYS = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
 
 const MONTHS = new Map([
   ['jan', 1],
@@ -67,6 +69,18 @@ export function parseWeeklyLogText(text) {
       });
       continue;
     }
+    // RO rejects more than 24h; catching it here keeps a batch from failing
+    // halfway after earlier entries were written.
+    const dayTotal = entries.filter((item) => item.date === currentDate).reduce((sum, item) => sum + item.hours, 0) + hours;
+    if (hours > MAX_DAY_HOURS || dayTotal > MAX_DAY_HOURS) {
+      errors.push({
+        line: lineNumber,
+        message: hours > MAX_DAY_HOURS
+          ? `Hours ${entry[1]} exceed ${MAX_DAY_HOURS}h for one entry.`
+          : `Entries for ${currentDate} add up to ${dayTotal}h, more than ${MAX_DAY_HOURS}h in one day.`
+      });
+      continue;
+    }
 
     const text = entry[2].trim();
     const { taskName, description, taskExplicit } = splitTaskAndDescription(text);
@@ -137,6 +151,15 @@ function parseHeadingDate(match, lineNumber, errors) {
     return null;
   }
 
+  const weekday = WEEKDAYS[date.getUTCDay()];
+  if (weekday !== match[1]) {
+    errors.push({
+      line: lineNumber,
+      message: `Date heading says ${match[1]} but ${match[2]} ${match[3]} ${match[4]} is a ${weekday}: ${match[0]}`
+    });
+    return null;
+  }
+
   return [
     String(year).padStart(4, '0'),
     String(month).padStart(2, '0'),

package/lib/batch-workflow.mjs

@@ -70,7 +70,11 @@ export async function previewLogworkBatch({
       defaultWorklogTask: normalizedDefaultTask
     }
     : enriched;
-  return typeOfWork ? { ...output, typeOfWork } : output;
+  // typeOfWork also changes what gets written, so it is folded into the
+  // batchId the same way.
+  return typeOfWork
+    ? { ...output, typeOfWork, batchId: `${output.batchId}_${hash(`typeOfWork:${typeOfWork}`)}`, summary: `${output.summary}\n\nType of work for every entry: ${typeOfWork}` }
+    : output;
 }
 
 export const LOGWORK_LINE_FORMAT = '+<hours> <worklog task> | <description>';
@@ -394,6 +398,16 @@ export async function applyLogworkBatch({
         ok: false,
         error: error.message
       });
+      // Earlier entries are already in RO. Say so plainly: re-applying the same
+      // text would log them twice.
+      const written = results.filter((result) => result.ok);
+      const notTried = preview.entries.slice(results.length).map((item) => item.id);
+      error.message = `Entry ${entry.id} (+${entry.hours}h ${entry.taskName}) failed: ${error.message}` +
+        (written.length
+          ? ` Already written to RO: ${written.map((result) => `${result.entryId} (+${result.hours}h ${result.taskName})`).join(', ')}. Do not apply this batch again; preview only the entries that were not written.`
+          : ' Nothing was written.') +
+        (notTried.length ? ` Not attempted: ${notTried.join(', ')}.` : '');
+      error.partialResults = results;
       error.applyLedger = await recordRoApplyLedger({
         writer: ledgerWriter,
         preview,

package/lib/commit-workflow.mjs

@@ -1,5 +1,7 @@
 import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
 import { resolve } from 'node:path';
+import { isAuthRequiredError } from './auth-errors.mjs';
 import { CONFIG } from './config.mjs';
 import { normalizeQueryRange, queryLogwork } from './query-workflow.mjs';
 import { addLocalDays, todayLocalDateISO } from './util.mjs';
@@ -15,6 +17,10 @@ import { addLocalDays, todayLocalDateISO } from './util.mjs';
 // approves it, then log_work previews and applies it as usual.
 
 const TICKET_RE = /\b[A-Z][A-Z0-9]+-\d+\b/g;
+// Prefixes that look like ticket keys but are standards or versions
+// ("UTF-8", "ISO-8601", "SHA-256", "CVE-2024-1234").
+const NOT_TICKET_PREFIXES = new Set(['UTF', 'ISO', 'SHA', 'RFC', 'HTTP', 'HTTPS', 'ES', 'ECMA', 'TLS', 'SSL', 'MD', 'AES', 'RSA', 'UTC', 'GMT', 'CVE', 'CWE', 'IPV', 'WCAG', 'PEP', 'JSR', 'ISBN', 'COVID', 'MP', 'H', 'X', 'IE', 'WIN', 'NODE', 'PHP', 'IOS']);
+const MAX_TICKETS_IN_DESCRIPTION = 4;
 const CONVENTIONAL_RE = /^(\w+)(?:\([^)]*\))?!?:\s*/;
 const FIELD = '\x1f';
 const RECORD = '\x1e';
@@ -111,36 +117,77 @@ export function parseGitLog(output = '') {
 
 export async function readRepoCommits({ repo, from, to, author, runGit = runGitCommand }) {
   const root = (await runGit(repo, ['rev-parse', '--show-toplevel'])).trim();
-  const authorFilter = author || (await runGit(root, ['config', 'user.email']).catch(() => '')).trim();
+  const authorFilter = (author || (await runGit(root, ['config', 'user.email']).catch(() => ''))).trim();
   if (!authorFilter) {
     throw new Error(`No git author for ${root}. Set git config user.email or pass author.`);
   }
-  const output = await runGit(root, [
+  // The period is matched on the author date in JS below. Git's --since and
+  // --until use the committer date (so rebased or amended commits would fall
+  // out of their real day) and --since stops the walk at the first older
+  // commit (clock skew). --since-as-filter (git 2.37+) only filters, and a day
+  // of slack covers time zones; older git falls back to a 31-day window.
+  const sinceDate = addLocalDays(from, -1);
+  const baseArgs = [
     'log',
-    // Every local and remote branch (work often sits on feature branches), but
-    // not refs/stash, whose "WIP on"/"index on" commits are not work items.
+    // Every local and remote branch (work often sits on feature branches) and
+    // HEAD (a detached HEAD mid-rebase), but not refs/stash, whose "WIP on" /
+    // "index on" commits are not work items.
     '--branches',
     '--remotes',
+    'HEAD',
     '--no-merges',
-    `--since=${from}T00:00:00`,
-    `--until=${to}T00:00:00`,
+    // Narrow by author in git (fixed string, so "." or "+" in an email is not
+    // a regex); the exact match happens in JS.
     `--author=${authorFilter}`,
+    '--fixed-strings',
     '--regexp-ignore-case',
     `--format=${RECORD}%H${FIELD}%at${FIELD}%an${FIELD}%ae${FIELD}%s${FIELD}%b${FIELD}`,
     '--numstat'
-  ]);
+  ];
+  let output;
+  try {
+    output = await runGit(root, [...baseArgs, `--since-as-filter=${sinceDate}T00:00:00`]);
+  } catch (error) {
+    if (!/since-as-filter|unrecognized argument|unknown option/i.test(error.message)) {
+      throw error;
+    }
+    output = await runGit(root, [...baseArgs, `--since=${addLocalDays(from, -31)}T00:00:00`]);
+  }
   const seen = new Set();
   const commits = parseGitLog(output)
+    .filter((commit) => matchesAuthor(commit, authorFilter))
     .filter((commit) => !seen.has(commit.hash) && seen.add(commit.hash))
     .map((commit) => ({ ...commit, repo: root, date: todayLocalDateISO(new Date(commit.timestamp * 1000)) }))
     .filter((commit) => commit.date >= from && commit.date < to);
   return { root, author: authorFilter, commits };
 }
 
+// Exact author match: an email filter must equal the author email, a name
+// filter must equal the author name (both case-insensitive). git --author is
+// a substring match, so "me@x.com" alone would also match "jime@x.com".
+export function matchesAuthor(commit, authorFilter) {
+  const filter = String(authorFilter || '').trim().toLowerCase();
+  if (!filter) {
+    return true;
+  }
+  const email = String(commit.authorEmail || '').toLowerCase();
+  const name = String(commit.authorName || '').toLowerCase();
+  const bracketed = filter.match(/<([^>]+)>/);
+  if (bracketed) {
+    return email === bracketed[1].trim();
+  }
+  return filter.includes('@') ? email === filter : name === filter;
+}
+
+export function extractTickets(text = '') {
+  return [...new Set((String(text).match(TICKET_RE) || [])
+    .filter((key) => !NOT_TICKET_PREFIXES.has(key.slice(0, key.lastIndexOf('-')))))];
+}
+
 export function groupCommits(commits = []) {
   const groups = new Map();
   for (const commit of [...commits].sort((a, b) => a.timestamp - b.timestamp)) {
-    const tickets = [...new Set(`${commit.subject}\n${commit.body}`.match(TICKET_RE) || [])];
+    const tickets = extractTickets(`${commit.subject}\n${commit.body}`);
     const kind = classifyCommit(commit.subject, commit.body);
     const key = [commit.repo, tickets[0] || '', kind].join('|');
     const group = groups.get(key) || {
@@ -172,9 +219,14 @@ export function groupCommits(commits = []) {
 }
 
 export function buildDescription(group) {
-  const ticketSuffix = group.tickets.length ? ` (${group.tickets.join(', ')})` : '';
-  const room = MAX_DESCRIPTION_LENGTH - ticketSuffix.length;
-  const subjects = group.subjects.map((subject) => subject.replace(TICKET_RE, '').replace(/\s*[[(]\s*[)\]]\s*/g, ' ').replace(/\s+/g, ' ').trim()).filter(Boolean);
+  const shown = group.tickets.slice(0, MAX_TICKETS_IN_DESCRIPTION);
+  const more = group.tickets.length - shown.length;
+  const ticketSuffix = shown.length ? ` (${shown.join(', ')}${more > 0 ? ` +${more} more` : ''})` : '';
+  const room = Math.max(40, MAX_DESCRIPTION_LENGTH - ticketSuffix.length);
+  const ticketSet = new Set(group.tickets);
+  const subjects = group.subjects
+    .map((subject) => subject.replace(TICKET_RE, (key) => (ticketSet.has(key) ? '' : key)).replace(/\s*[[(]\s*[)\]]\s*/g, ' ').replace(/\s+/g, ' ').trim())
+    .filter(Boolean);
   let text = '';
   for (const subject of subjects) {
     const next = text ? `${text}; ${subject}` : subject;
@@ -244,7 +296,15 @@ export function remainingHoursByDay(roResult) {
     byDay.set(day.date, {
       bookedHours: Number(day.bookedHours || 0),
       loggedHours: Number(day.loggedHours || 0),
-      remainingHours: Number(remaining.toFixed(2))
+      remainingHours: Number(remaining.toFixed(2)),
+      // The draft does not know which project a commit belongs to; this lets
+      // the agent move lines to the projects that still have room.
+      remainingByProject: projects
+        .map((project) => ({
+          projectName: project.projectName,
+          remainingHours: Number(Math.max(0, Number(project.bookedHours || 0) - Number(project.loggedHours || 0)).toFixed(2))
+        }))
+        .filter((project) => project.remainingHours > 0)
     });
   }
   return byDay;
@@ -262,15 +322,24 @@ export async function draftLogworkFromCommits({
   queryRo = queryLogwork
 } = {}) {
   const range = from || to ? normalizeQueryRange({ from, to }) : normalizeQueryRange({ period });
-  const repoPaths = [...new Set((repos?.length ? repos : [cwd]).map((repo) => resolve(cwd, String(repo))))];
+  const repoPaths = [...new Set((repos?.length ? repos : [cwd]).map((repo) => resolve(cwd, expandHome(String(repo)))))];
 
   const repoResults = [];
   const commits = [];
+  const seenRoots = new Set();
+  // A commit counts once even when two paths reach it (a subfolder of the same
+  // repo, or a git worktree of it).
+  const seenHashes = new Set();
   for (const repo of repoPaths) {
     try {
       const result = await readRepoCommits({ repo, from: range.from, to: range.to, author, runGit });
-      repoResults.push({ path: result.root, author: result.author, commitCount: result.commits.length });
-      commits.push(...result.commits);
+      if (seenRoots.has(result.root)) {
+        continue;
+      }
+      seenRoots.add(result.root);
+      const fresh = result.commits.filter((commit) => !seenHashes.has(commit.hash) && seenHashes.add(commit.hash));
+      repoResults.push({ path: result.root, author: result.author, commitCount: fresh.length });
+      commits.push(...fresh);
     } catch (error) {
       repoResults.push({ path: repo, error: error.message, commitCount: 0 });
     }
@@ -282,6 +351,11 @@ export async function draftLogworkFromCommits({
     try {
       bookings = remainingHoursByDay(await queryRo({ from: range.from, to: range.to, includeEntries: false, cwd }));
     } catch (error) {
+      // A missing or expired RO login must reach the agent as authRequired;
+      // falling back to an 8h day would hide hours that are already logged.
+      if (isAuthRequiredError(error)) {
+        throw error;
+      }
       bookingsError = error.message;
     }
   }
@@ -312,7 +386,7 @@ export async function draftLogworkFromCommits({
       date,
       targetHours,
       hoursSource,
-      ...(booking ? { bookedHours: booking.bookedHours, loggedHours: booking.loggedHours } : {}),
+      ...(booking ? { bookedHours: booking.bookedHours, loggedHours: booking.loggedHours, remainingByProject: booking.remainingByProject } : {}),
       groups: groups.map((group, index) => ({
         hours: hours[index],
         task: group.task,
@@ -337,7 +411,7 @@ export async function draftLogworkFromCommits({
     .join('\n\n');
 
   const result = {
-    status: commits.length ? 'draft' : 'no_commits',
+    status: !commits.length ? 'no_commits' : (draftText ? 'draft' : 'no_hours'),
     range,
     repos: repoResults,
     bookings: useBookings ? (bookings ? 'ro' : 'unavailable') : 'skipped',
@@ -371,6 +445,9 @@ export function formatCommitDraftSummary(result) {
       standard_day: `standard day ${day.targetHours}h`
     }[day.hoursSource];
     lines.push('', `${formatDayHeading(day.date)} - ${source}`);
+    if (day.remainingByProject?.length) {
+      lines.push(`  Room by project: ${day.remainingByProject.map((project) => `${project.projectName} ${project.remainingHours}h`).join(', ')}`);
+    }
     for (const group of day.groups) {
       lines.push(`  +${group.hours} ${group.task} | ${group.description}  [${group.repo}, ${group.commitCount} commit(s)]`);
     }
@@ -381,6 +458,10 @@ export function formatCommitDraftSummary(result) {
   return lines.join('\n');
 }
 
+function expandHome(path) {
+  return path === '~' || /^~[\\/]/.test(path) ? `${homedir()}${path.slice(1)}` : path;
+}
+
 function runGitCommand(cwd, args) {
   return new Promise((resolveValue, reject) => {
     const child = spawn('git', ['-C', cwd, ...args], { stdio: ['ignore', 'pipe', 'pipe'] });

package/lib/keychain.mjs

@@ -41,16 +41,9 @@ export function createKeychainValueStorage({
     },
 
     async set(token) {
-      await run([
-        'add-generic-password',
-        '-U',
-        '-s',
-        service,
-        '-a',
-        account,
-        '-w',
-        token
-      ]);
+      // The value goes in on stdin (security's interactive mode, as hex), never
+      // in argv where `ps` could show it.
+      await run(['-i'], { input: formatAddPasswordCommand({ service, account, value: token }) });
     },
 
     async delete() {
@@ -67,11 +60,25 @@ export function createKeychainValueStorage({
   };
 }
 
-function runSecurity(args) {
+export function formatAddPasswordCommand({ service, account, value }) {
+  for (const [label, text] of [['service', service], ['account', account]]) {
+    if (!/^[A-Za-z0-9._@+-]+$/.test(String(text))) {
+      throw new Error(`Unsupported Keychain ${label} name: ${text}`);
+    }
+  }
+  const hex = Buffer.from(String(value), 'utf8').toString('hex');
+  return `add-generic-password -U -s "${service}" -a "${account}" -X ${hex}\n`;
+}
+
+function runSecurity(args, { input } = {}) {
   return new Promise((resolve, reject) => {
     const child = spawn('/usr/bin/security', args, {
-      stdio: ['ignore', 'pipe', 'pipe']
+      stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe']
     });
+    if (input !== undefined) {
+      child.stdin.on('error', () => {});
+      child.stdin.end(input);
+    }
 
     let stdout = '';
     let stderr = '';

package/lib/mcp-server.mjs

@@ -162,6 +162,10 @@ server.registerTool('log_work', {
   prunePreviewCache(previews);
   if (confirm === true) {
     assertApplyOnly('log_work', { text, projectOverrides, defaultWorklogTask, typeOfWork });
+    // Check allowUnbooked before the preview is consumed, so the agent can
+    // retry the same batchId with allowUnbooked: true.
+    const pending = resolveApprovedBatch({ cache: previews, batchId });
+    assertUnbookedAllowed(pending, allowUnbooked);
     const approvedBatch = consumeApprovedBatch({ cache: previews, batchId });
     return formatToolResponse(await applyLogworkBatch({ batch: approvedBatch, confirm, allowUnbooked }));
   }
@@ -203,7 +207,7 @@ server.registerTool('resubmit_entry', {
   annotations: WRITE,
   inputSchema: {
     logworkId: LOGWORK_ID_SCHEMA,
-    hours: z.number().positive().optional().describe('Preview call only. New hours; defaults to the rejected entry hours.'),
+    hours: z.number().positive().max(24).optional().describe('Preview call only. New hours; defaults to the rejected entry hours.'),
     typeOfWork: TYPE_OF_WORK_SCHEMA.optional().describe('Preview call only. New type of work; defaults to the rejected entry value.'),
     noteToPm: z.string().max(500).optional().describe('Preview call only. Note to the project manager explaining the fix.'),
     description: z.string().max(1_000).optional().describe('Preview call only. New description; defaults to the rejected entry description.'),
@@ -536,7 +540,7 @@ export function resolveApprovedBatch({
 
   const cached = getCachedPreviewRecord(cache, batchId, now);
   if (!cached) {
-    throw new Error('No cached log_work preview for this batchId (expired after 1 hour, already applied, or the server restarted). Preview again and apply using the returned batchId.');
+    throw new Error('No cached log_work preview for this batchId (expired after 1 hour, already used by an earlier confirm call, or the server restarted; an earlier confirm may have failed without writing, so check get_logwork before assuming it was applied). Preview again and apply using the returned batchId.');
   }
 
   if (batch && createPreviewFingerprint(batch) !== cached.fingerprint) {
@@ -546,6 +550,13 @@ export function resolveApprovedBatch({
   return clonePreview(cached.preview);
 }
 
+function assertUnbookedAllowed(batch, allowUnbooked) {
+  const unbooked = (batch?.entries || []).filter((entry) => entry.requiresAllowUnbooked);
+  if (unbooked.length && allowUnbooked !== true) {
+    throw new Error(`Nothing was written. ${unbooked.length} entr${unbooked.length === 1 ? 'y has' : 'ies have'} no booking on that date (${unbooked.map((entry) => entry.id).join(', ')}). Ask the user, then call log_work again with the same batchId, confirm: true and allowUnbooked: true.`);
+  }
+}
+
 export function consumeApprovedBatch({
   cache,
   batchId,
@@ -578,7 +589,7 @@ export function resolveApprovedJiraBatch({
 
   const cached = getCachedPreviewRecord(cache, batchId, now);
   if (!cached) {
-    throw new Error('No cached log_jira_work preview for this batchId (expired after 1 hour, already applied, or the server restarted). Preview again and apply using the returned batchId.');
+    throw new Error('No cached log_jira_work preview for this batchId (expired after 1 hour, already used by an earlier confirm call, or the server restarted; an earlier confirm may have failed without writing, so check get_logwork before assuming it was applied). Preview again and apply using the returned batchId.');
   }
 
   if (batch && createJiraPreviewFingerprint(batch) !== cached.fingerprint) {
@@ -620,7 +631,7 @@ export function resolveApprovedRoEditPreview({
 
   const cached = getCachedPreviewRecord(cache, previewId, now);
   if (!cached) {
-    throw new Error(`No cached ${toolName} preview for this previewId (expired after 1 hour, already applied, or the server restarted). Preview again before applying.`);
+    throw new Error(`No cached ${toolName} preview for this previewId (expired after 1 hour, already used by an earlier confirm call, or the server restarted; an earlier confirm may have failed without writing, so check get_logwork before assuming it was applied). Preview again before applying.`);
   }
   if (preview && createRoEditPreviewFingerprint(preview) !== cached.fingerprint) {
     throw new Error(`Approved ${toolName} preview changed after preview. Preview again before applying.`);

package/lib/npm-command.mjs

@@ -0,0 +1,29 @@
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+// How to start npm as a child process on every platform.
+// On Windows, npm is npm.cmd: spawn('npm') fails with ENOENT, and since the
+// Node fix for CVE-2024-27980 spawn('npm.cmd') without a shell fails with
+// EINVAL. Running npm's own npm-cli.js with the current node avoids the shell;
+// when it cannot be found, fall back to npm.cmd through cmd.exe.
+export function npmInvocation(args, {
+  platform = process.platform,
+  execPath = process.execPath,
+  env = process.env,
+  exists = existsSync
+} = {}) {
+  if (platform !== 'win32') {
+    return { command: 'npm', args, shell: false };
+  }
+  const candidates = [
+    env.npm_execpath && /npm-cli\.js$/i.test(env.npm_execpath) ? env.npm_execpath : null,
+    join(dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js')
+  ].filter(Boolean);
+  const cli = candidates.find((path) => exists(path));
+  if (cli) {
+    return { command: execPath, args: [cli, ...args], shell: false };
+  }
+  // cmd.exe joins the arguments unquoted; the arguments used here have no
+  // spaces or shell metacharacters.
+  return { command: 'npm.cmd', args, shell: true };
+}

package/lib/paths.mjs

@@ -52,7 +52,10 @@ export function reminderStatePath() {
 }
 
 export function legacyUserConfigPath() {
-  return resolve(homedir(), LEGACY_CONFIG_FILE_NAME);
+  // A custom home (tests, separate profiles) keeps its state isolated from
+  // the real ~/.logwork-helper.json.
+  const custom = customHelperHome();
+  return custom ? resolve(custom, LEGACY_CONFIG_FILE_NAME) : resolve(homedir(), LEGACY_CONFIG_FILE_NAME);
 }
 
 // Project-scope mappings live in the repo the user works in. A repo that still

package/lib/release-doctor.mjs

@@ -1,6 +1,7 @@
 import { spawn } from 'node:child_process';
 import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { npmInvocation } from './npm-command.mjs';
 
 const PACKAGE_NAME = 'logwork-cli';
 const PACK_CACHE_PATH = '/private/tmp/logwork-cli-npm-cache';
@@ -113,10 +114,11 @@ export async function runCommandDefault(command, args = [], {
       ...process.env,
       ...(gitSafe ? { GIT_CONFIG_GLOBAL: '/dev/null' } : {})
     };
-    const child = spawn(command, args, {
+    const invocation = command === 'npm' ? npmInvocation(args) : { command, args, shell: false };
+    const child = spawn(invocation.command, invocation.args, {
       cwd,
       env,
-      shell: false,
+      shell: invocation.shell,
       stdio: ['ignore', 'pipe', 'pipe']
     });
     let stdout = '';

package/lib/ro-delete-workflow.mjs

@@ -1,6 +1,6 @@
 import { ApiError, deleteLogworkEntry } from './api.mjs';
 import { createResourceOptimiserSession } from './query-workflow.mjs';
-import { createF03LogworkReader } from './ro-entry-reader.mjs';
+import { assertOwnUnlockedRoEntry, createF03LogworkReader, createRoEntryRevisionFingerprint } from './ro-entry-reader.mjs';
 
 const DELETABLE_STATUSES = new Set(['submitted', 'approved']);
 
@@ -11,6 +11,7 @@ export async function previewRoLogworkDelete({
   const reader = fetchLogwork || createF03LogworkReader();
   const current = await reader(assertIdentifier(logworkId, 'logworkId'));
   assertDeletableStatus(current);
+  assertOwnUnlockedRoEntry(current, 'delete');
 
   const preview = {
     previewId: `delete_${current.id}`,
@@ -106,10 +107,5 @@ function assertIdentifier(value, label) {
 }
 
 function createLogworkRevisionFingerprint(logwork) {
-  return JSON.stringify({
-    id: logwork.id,
-    hours: logwork.hours,
-    status: logwork.status,
-    taskName: logwork.taskName
-  });
+  return createRoEntryRevisionFingerprint(logwork);
 }

package/lib/ro-edit-workflow.mjs

@@ -100,7 +100,7 @@ export async function applyRoLogworkEdit({
   const reader = fetchLogwork || createF03LogworkReader();
   const creator = submitCreate || createEntryWriter();
   const deleter = submitDelete || createDeleteWriter();
-  const dayReader = fetchDayEntries || createDayEntriesReader();
+  const dayReader = fetchDayEntries || (injected ? null : createDayEntriesReader());
   const ledgerWriter = recordLedger === undefined
     ? (injected ? null : recordApplyResult)
     : recordLedger;
@@ -121,15 +121,27 @@ export async function applyRoLogworkEdit({
     needsProjectId: preview.updated.needsProjectId
   };
 
+  // Entry ids already on the target day, so a replacement found later by its
+  // values is never confused with an older identical entry.
+  const existingIds = await readDayEntryIds(dayReader, preview.updated.date);
+
   let createResult;
   try {
     createResult = await creator(createRequest);
   } catch (error) {
-    error.message = `Could not create the replacement RO entry; the original entry ${preview.logworkId} is unchanged. ${error.message}`;
-    error.applyLedger = await recordEditLedger({
-      writer: ledgerWriter, preview, status: 'failed', entryStatus: 'failed', error: error.message, cwd
-    });
-    throw error;
+    // Writes are not retried, so a timeout is ambiguous: RO may have saved the
+    // entry. Look for it before reporting that nothing changed.
+    const savedId = await findCreatedEntryId({ dayReader, preview, existingIds });
+    if (savedId === null) {
+      error.message = existingIds
+        ? `Could not create the replacement RO entry; the original entry ${preview.logworkId} is unchanged. ${error.message}`
+        : `Could not create the replacement RO entry (${error.message}). The original entry ${preview.logworkId} is unchanged, but check ${preview.updated.date} (get_logwork or \`logwork query\`) in case RO saved a copy.`;
+      error.applyLedger = await recordEditLedger({
+        writer: ledgerWriter, preview, status: 'failed', entryStatus: 'failed', error: error.message, cwd
+      });
+      throw error;
+    }
+    createResult = { entry: { id: savedId } };
   }
 
   if (createResult?.dryRun) {
@@ -156,7 +168,7 @@ export async function applyRoLogworkEdit({
 
   let newLogworkId = createResult?.entry?.id ?? null;
   if (newLogworkId === null || newLogworkId === undefined) {
-    newLogworkId = await findCreatedEntryId({ dayReader, preview });
+    newLogworkId = await findCreatedEntryId({ dayReader, preview, existingIds });
   }
   if (newLogworkId === null || newLogworkId === undefined) {
     const error = new Error(
@@ -172,6 +184,25 @@ export async function applyRoLogworkEdit({
   try {
     await deleter(preview.logworkId);
   } catch (error) {
+    // A failed DELETE may still have deleted the original (timeout). Roll the
+    // replacement back only when the original is confirmed to still exist;
+    // otherwise rolling back could leave neither entry.
+    const originalState = await originalEntryState({ dayReader, preview });
+    if (originalState === 'gone') {
+      return finishReplace({ reader, preview, newLogworkId, ledgerWriter, cwd });
+    }
+    if (originalState === 'unknown') {
+      const message = `Deleting the original RO entry ${preview.logworkId} failed (${error.message}) and its state could not be read. ` +
+        `The replacement entry ${newLogworkId} was kept. Check ${preview.original?.date || preview.updated.date} (get_logwork or \`logwork query\`); if both entries exist, delete ${preview.logworkId}.`;
+      const wrapped = new Error(message);
+      wrapped.cause = error;
+      wrapped.newLogworkId = newLogworkId;
+      wrapped.rolledBack = false;
+      wrapped.applyLedger = await recordEditLedger({
+        writer: ledgerWriter, preview, status: 'partial', entryStatus: 'failed', error: message, newLogworkId, cwd
+      });
+      throw wrapped;
+    }
     const rollback = await rollbackCreatedEntry({ deleter, newLogworkId });
     const message = rollback.ok
       ? `Could not delete the original RO entry ${preview.logworkId} (${error.message}). The replacement entry ${newLogworkId} was rolled back; nothing changed.`
@@ -193,6 +224,10 @@ export async function applyRoLogworkEdit({
     throw wrapped;
   }
 
+  return finishReplace({ reader, preview, newLogworkId, ledgerWriter, cwd });
+}
+
+async function finishReplace({ reader, preview, newLogworkId, ledgerWriter, cwd }) {
   let verified;
   try {
     verified = sanitizeLogwork(await reader(newLogworkId));
@@ -483,11 +518,34 @@ function changeFingerprint(change) {
   };
 }
 
-async function findCreatedEntryId({ dayReader, preview }) {
+async function readDayEntryIds(dayReader, date) {
+  if (!dayReader) {
+    return null;
+  }
+  try {
+    return new Set((await dayReader(date) || []).map((entry) => String(entry.id)));
+  } catch {
+    return null;
+  }
+}
+
+async function originalEntryState({ dayReader, preview }) {
+  const ids = await readDayEntryIds(dayReader, preview.original?.date || preview.updated.date);
+  if (!ids) {
+    return 'unknown';
+  }
+  return ids.has(String(preview.logworkId)) ? 'present' : 'gone';
+}
+
+async function findCreatedEntryId({ dayReader, preview, existingIds = null }) {
+  if (!dayReader) {
+    return null;
+  }
   try {
     const entries = await dayReader(preview.updated.date);
     const candidates = (entries || []).filter((entry) => (
       String(entry.id) !== String(preview.logworkId) &&
+      (!existingIds || !existingIds.has(String(entry.id))) &&
       String(entry.worklogTaskId) === String(preview.updated.worklogTaskId) &&
       Number(entry.hours) === Number(preview.updated.hours) &&
       (entry.description || '') === (preview.updated.description || '') &&

package/lib/ro-entry-reader.mjs

@@ -18,7 +18,12 @@ export function createF03LogworkReader() {
     if (!f03) {
       throw new Error(`RO logwork ${logworkId} was not found on ${legacy.date}; it may have been deleted.`);
     }
-    projectsPromise ||= getProjects(token, userId);
+    // Cache only a successful load: a cached rejection (say a 401) would make
+    // the retry after a forced login fail the same way.
+    projectsPromise ||= getProjects(token, userId).catch((error) => {
+      projectsPromise = null;
+      throw error;
+    });
     const projects = await projectsPromise;
     const projectMemberId = f03.projectMemberId ?? legacy.projectMemberId;
     const project = projects.find((item) => String(item.projectMemberId) === String(projectMemberId));
@@ -54,3 +59,36 @@ function withoutEmpty(record = {}) {
     value !== undefined && value !== null && value !== ''
   )));
 }
+
+// Guards shared by delete and resubmit (edit has its own, stricter set): the
+// entry must be the user's own, not synced from Jira, and on an unlocked day.
+export function assertOwnUnlockedRoEntry(logwork, action) {
+  if (
+    logwork?.currentUserId !== undefined &&
+    logwork?.createdBy !== undefined &&
+    String(logwork.currentUserId) !== String(logwork.createdBy)
+  ) {
+    throw new Error(`Cannot ${action} another user's RO logwork.`);
+  }
+  const jiraId = logwork?.jiraLogworkId;
+  if ((jiraId !== null && jiraId !== undefined && String(jiraId).trim() !== '') || String(logwork?.source || '').toLowerCase() === 'jira') {
+    throw new Error(`This RO logwork was created by Jira; ${action} it in Jira so both systems stay in step.`);
+  }
+  if (logwork?.dayLocked) {
+    throw new Error(`Logwork for ${logwork.date || 'this day'} is locked on Resource Optimiser; cannot ${action} it.`);
+  }
+}
+
+// What a preview was approved against; apply refuses if any of it changed.
+export function createRoEntryRevisionFingerprint(logwork) {
+  return JSON.stringify({
+    id: logwork.id,
+    date: logwork.date ?? null,
+    hours: logwork.hours,
+    status: logwork.status,
+    taskName: logwork.taskName,
+    worklogTaskId: logwork.worklogTaskId ?? null,
+    typeOfWork: logwork.typeOfWork ?? null,
+    description: logwork.description ?? null
+  });
+}

package/lib/ro-resubmit-workflow.mjs

@@ -1,6 +1,6 @@
 import { ApiError, resubmitLogworkEntry } from './api.mjs';
 import { createResourceOptimiserSession } from './query-workflow.mjs';
-import { createF03LogworkReader } from './ro-entry-reader.mjs';
+import { assertOwnUnlockedRoEntry, createF03LogworkReader, createRoEntryRevisionFingerprint } from './ro-entry-reader.mjs';
 
 export async function previewRoLogworkResubmit({
   logworkId,
@@ -15,31 +15,40 @@ export async function previewRoLogworkResubmit({
   if (String(current.status || '').toLowerCase() !== 'rejected') {
     throw new Error('Only rejected RO logwork entries can be resubmitted through this flow.');
   }
+  assertOwnUnlockedRoEntry(current, 'resubmit');
 
   const effortHours = hours === undefined ? current.hours : Number(hours);
-  if (!Number.isFinite(effortHours) || effortHours <= 0) {
-    throw new Error('hours must be a positive number.');
+  if (!Number.isFinite(effortHours) || effortHours <= 0 || effortHours > 24) {
+    throw new Error('hours must be a positive number up to 24.');
   }
 
-  const previewId = `resubmit_${current.id}_${effortHours}`;
+  const updated = {
+    hours: effortHours,
+    typeOfWork: typeOfWork || current.typeOfWork || 'other',
+    noteToPm: noteToPm ?? current.noteToPm ?? '',
+    description: description ?? current.description ?? ''
+  };
+  const originalFingerprint = createLogworkRevisionFingerprint(current);
+  // Every field that will be sent is part of the id, so two different
+  // previews of the same entry never share (and overwrite) one cache slot.
+  const previewId = `resubmit_${current.id}_${hash(JSON.stringify({ updated, originalFingerprint }))}`;
   const preview = {
     previewId,
     status: 'ready',
     logworkId: current.id,
     original: current,
-    updated: {
-      hours: effortHours,
-      typeOfWork: typeOfWork || current.typeOfWork || 'other',
-      noteToPm: noteToPm ?? current.noteToPm ?? '',
-      description: description ?? current.description ?? ''
-    },
-    originalFingerprint: createLogworkRevisionFingerprint(current)
+    updated,
+    originalFingerprint
   };
+  const changeLine = (label, from, to) => (String(from ?? '') === String(to ?? '') ? `- ${label}: ${to || '(empty)'}` : `- ${label}: ${from || '(empty)'} -> ${to || '(empty)'}`);
   preview.summary = [
     'RO logwork resubmit preview:',
-    `- Entry: ${current.id}`,
-    `- Hours: ${current.hours} -> ${effortHours}`,
-    `- Status: rejected -> approved (after resubmit)`
+    `- Entry: ${current.id} (${current.date || 'unknown date'}, ${current.taskName || 'unknown task'})`,
+    changeLine('Hours', current.hours, effortHours),
+    changeLine('Type of work', current.typeOfWork, updated.typeOfWork),
+    changeLine('Description', current.description, updated.description),
+    `- Note to PM: ${updated.noteToPm || '(none)'}`,
+    '- Status: rejected -> resubmitted'
   ].join('\n');
   return preview;
 }
@@ -125,10 +134,14 @@ function assertIdentifier(value, label) {
 }
 
 function createLogworkRevisionFingerprint(logwork) {
-  return JSON.stringify({
-    id: logwork.id,
-    hours: logwork.hours,
-    status: logwork.status,
-    taskName: logwork.taskName
-  });
+  return createRoEntryRevisionFingerprint(logwork);
+}
+
+function hash(value) {
+  let hashValue = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hashValue ^= value.charCodeAt(index);
+    hashValue = Math.imul(hashValue, 16777619);
+  }
+  return (hashValue >>> 0).toString(36);
 }

package/lib/update-service.mjs

@@ -5,6 +5,7 @@ import { atomicWriteFile } from './atomic-file.mjs';
 import { redactText } from './auth-redaction.mjs';
 import { fetchWithPolicy, redactedExcerpt } from './http.mjs';
 import { readPackageInfo } from './package-info.mjs';
+import { npmInvocation } from './npm-command.mjs';
 import { helperHome, updateStatePath } from './paths.mjs';
 
 export const UPDATE_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
@@ -187,7 +188,7 @@ export async function installUpdate({
     };
   }
 
-  const executable = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+  const executable = 'npm';
   const args = [
     'exec',
     '--yes',
@@ -311,7 +312,9 @@ function requireSemver(value, label) {
 
 function runUpdateCommand(executable, args, { stdio = 'pipe' } = {}) {
   return new Promise((resolveValue, reject) => {
-    const child = spawn(executable, args, {
+    const invocation = executable === 'npm' ? npmInvocation(args) : { command: executable, args, shell: false };
+    const child = spawn(invocation.command, invocation.args, {
+      shell: invocation.shell,
       cwd: helperHome(),
       env: process.env,
       stdio: stdio === 'inherit' ? 'inherit' : ['ignore', 'pipe', 'pipe']

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "logwork-cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Log work to Resource Optimiser and Jira from the terminal, an MCP server for AI IDEs, and a terminal UI.",
   "license": "UNLICENSED",
   "type": "module",

package/skills/logwork/SKILL.md

@@ -14,7 +14,8 @@ Goal: every logged line is backed by real work (the user's commits or what the u
 3. **Check the worklog tasks.** For each project involved, call `list_tasks(projectId)`. Keep the suggested task when it exists in that catalog; otherwise pick the catalog task whose description matches the work.
 4. **Write the descriptions.** One line per piece of work: what was done and the outcome, with ticket keys, in English, under about 200 characters, no `|`. Rewrite vague commit subjects ("wip", "fix", "update"); use `get_jira_issue` to read the ticket when the subject alone is unclear.
 5. **Set the hours.**
-   - Stay within the remaining booked hours per day and project unless the user says otherwise.
+   - Stay within the remaining booked hours per day and project unless the user says otherwise. The draft splits the day's total; use each day's `remainingByProject` to move hours to the project the work belongs to.
+   - If `draft_from_commits` returns `authRequired`, call `login` first; do not guess hours without RO.
    - Use 0.5h steps.
    - Do not log weekends or days without a booking unless the user asks.
    - Work without commits (meetings, reviews, support) only comes from the user; ask, then log it as `Other Activities` or `Code Review & Refactoring`.