logwork-cli 1.1.0 → 1.2.0

package/lib/manual-repl.mjs

@@ -1,4 +1,5 @@
 import { stdin as defaultInput, stdout as defaultOutput } from 'node:process';
+import { resolve as resolvePath } from 'node:path';
 import { confirm, isCancel } from '@clack/prompts';
 import { getStoredAuthStatus, loginResourceOptimiser } from './auth.mjs';
 import { queryApplyLedger } from './apply-ledger.mjs';
@@ -30,8 +31,10 @@ import {
 import { findManualCommand, formatManualHelp } from './manual-commands.mjs';
 import {
   buildManualApplyConfirmation,
+  buildManualDuplicateConfirmation,
   buildManualUnbookedConfirmation,
   getManualApplyBlocker,
+  manualDuplicateEntryCount,
   manualUnbookedEntryCount
 } from './manual-apply-state.mjs';
 import { runManualInkApp } from './manual-ink-app.mjs';
@@ -363,7 +366,11 @@ export async function executeManualCommand(command, session, context) {
   }
 
   if (command.type === 'map') {
-    const ok = await prompts.confirm(`Map ${command.tickets.join(', ')} to projectMemberId ${command.projectMemberId}?`);
+    const subject = [
+      ...command.tickets,
+      ...(command.repos || []).map((repo) => `repo ${resolvePath(cwd, repo)}`)
+    ].join(', ');
+    const ok = await prompts.confirm(`Map ${subject} to projectMemberId ${command.projectMemberId}?`);
     if (!ok) {
       print('Mapping cancelled.');
       return { exit: false };
@@ -373,6 +380,7 @@ export async function executeManualCommand(command, session, context) {
       projectMemberId: command.projectMemberId,
       tickets: command.tickets,
       keywords: [],
+      ...(command.repos?.length ? { repos: command.repos } : {}),
       scope: 'user',
       confirm: true,
       cwd
@@ -666,10 +674,20 @@ async function applyManualRoPreview({
     }
   }
 
+  let allowDuplicates = false;
+  if (manualDuplicateEntryCount(preview)) {
+    allowDuplicates = await prompts.confirm(buildManualDuplicateConfirmation(preview), false);
+    if (!allowDuplicates) {
+      print('Resource Optimiser apply cancelled because possible duplicates were not approved. Nothing was written.');
+      return false;
+    }
+  }
+
   const result = await runWithInlineAuth(() => workflows.applyLogworkBatch({
     batch: preview,
     confirm: true,
     allowUnbooked,
+    allowDuplicates,
     cwd,
     ledgerContext: { flowTarget }
   }), { workflows, print });
@@ -871,9 +889,27 @@ function parseTargetCommand(type, parts, {
   };
 }
 
+const MAP_USAGE = 'Usage: /map <TICKET_PREFIX[,PREFIX...]> <projectMemberId> | /map --repo [path] <projectMemberId>';
+
 function parseMapCommand(parts) {
+  if (parts[0] === '--repo') {
+    // The repo path defaults to the current folder; a path with spaces may be
+    // quoted.
+    const projectMemberId = parts.length > 1 ? parts[parts.length - 1] : '';
+    const repo = parts.slice(1, -1).join(' ').replace(/^(["'])(.*)\1$/, '$2').trim() || '.';
+    if (!projectMemberId || projectMemberId.startsWith('-')) {
+      throw new Error(MAP_USAGE);
+    }
+    return {
+      type: 'map',
+      tickets: [],
+      repos: [repo],
+      projectMemberId
+    };
+  }
+
   if (parts.length < 2) {
-    throw new Error('Usage: /map <TICKET_PREFIX[,PREFIX...]> <projectMemberId>');
+    throw new Error(MAP_USAGE);
   }
 
   const tickets = parts[0]
@@ -883,7 +919,7 @@ function parseMapCommand(parts) {
   const projectMemberId = parts[1];
 
   if (!tickets.length || !projectMemberId) {
-    throw new Error('Usage: /map <TICKET_PREFIX[,PREFIX...]> <projectMemberId>');
+    throw new Error(MAP_USAGE);
   }
 
   return {

package/lib/mcp-server.mjs

@@ -1,12 +1,13 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
-import { ApiError } from './api.mjs';
+import { ApiError } from './ro-api-http.mjs';
 import { queryApplyLedger } from './apply-ledger.mjs';
 import { readLogworkSkill } from './agent-skill.mjs';
 import { draftLogworkFromCommits } from './commit-workflow.mjs';
 import {
   applyLogworkBatch,
+  formatDuplicateBlock,
   formatToolResponse,
   listWorklogTasks,
   previewLogworkBatch
@@ -64,6 +65,7 @@ export const SERVER_INSTRUCTIONS = `logwork logs work hours to Resource Optimise
 
 Safety rules:
 - Writes are two calls to the same tool. Call it without confirm to get a preview (batchId or previewId plus a summary), show the summary to the user, wait for explicit approval, then call the same tool again with only that id and confirm: true. Never set confirm: true without approval.
+- log_work previews flag possibleDuplicate entries (same date, worklog task, hours and description as an existing RO entry, or a repeated line). Show the warning; apply refuses them unless the user confirms it is new work and you call again with the same batchId and allowDuplicates: true. Never pass allowDuplicates or allowUnbooked without asking.
 - Never ask for or pass passwords, OTP codes, or tokens. If a tool returns authRequired, call login (target "ro" or "jira") and ask the user to finish login in their terminal.
 
 Logwork text format (log_work and log_jira_work):
@@ -75,7 +77,7 @@ Logwork text format (log_work and log_jira_work):
 - Lines without "|" are accepted only when the text is itself a catalog task name (no description is written), or when defaultWorklogTask is passed (the text then becomes the description).
 - Jira needs exactly one issue key such as SCB-213 in the line.
 
-Recommended RO flow: get_logwork (what is booked/logged) -> draft_from_commits (the user's git commits as draft lines) -> list_tasks(projectId) -> log_work(text) -> user approval -> log_work(batchId, confirm: true).
+Recommended RO flow: get_logwork (what is booked/logged) -> draft_from_commits (the user's git commits as draft lines plus projectOverrides) -> list_tasks(projectId) -> log_work(text, projectOverrides) -> user approval -> log_work(batchId, confirm: true).
 Base every line on the user's commits or on what the user tells you; never invent work. The log_from_commits prompt has the full procedure.
 Fixing existing RO entries (logworkId from get_logwork): submitted/approved entries -> edit_entry (hours, worklog task, type of work, description; apply replaces the entry with a new id, approved immediately); rejected entries -> resubmit_entry; removing an entry -> delete_entry.
 If a preview entry is unresolved: worklog_task_required / task_not_found means fix the worklog task (see availableTaskNames); project reasons mean ask the user to pick a project (projectOverrides) or save a mapping with map_project.`;
@@ -133,7 +135,7 @@ server.registerTool('list_tasks', {
 
 server.registerTool('draft_from_commits', {
   title: 'Draft logwork from git commits',
-  description: 'Read-only: read the user\'s own git commits (all branches, git user.email) in one or more repos for a period, group them per day by repo + ticket + kind of work, suggest an RO worklog task per group (feat -> Feature Development, fix -> Bug Fix, refactor/review -> Code Review & Refactoring, test -> Testing Activities, ci/build/release -> Deployment & Release, docs -> Requirements & Design), and split each day\'s remaining RO hours (booked - logged) across the groups. Returns draftText in the log_work line format. Review it with the user, check task names with list_tasks, then pass it to log_work.',
+  description: 'Read-only: read the user\'s own git commits (all branches, git user.email) in one or more repos for a period, group them per day by repo + ticket + kind of work, suggest an RO worklog task per group (feat -> Feature Development, fix -> Bug Fix, refactor/review -> Code Review & Refactoring, test -> Testing Activities, ci/build/release -> Deployment & Release, docs -> Requirements & Design), and resolve each group\'s RO project (a map_project mapping whose repos holds the repo, else ticket/keyword mappings and that day\'s bookings), and split each project\'s remaining RO hours (booked - logged) across its groups; groups without a project share the room of booked projects no group claimed. Returns draftText in the log_work line format plus projectOverrides (preview entry id -> projectMemberId) for every line with a project. Review it with the user, check task names with list_tasks, then pass draftText and projectOverrides unchanged to log_work. unmappedRepos lists repos whose lines got no project: offer map_project with repos.',
   annotations: READ_ONLY,
   inputSchema: {
     period: z.enum(PERIOD_VALUES).optional().describe('Preset period. Defaults to today.'),
@@ -147,23 +149,29 @@ server.registerTool('draft_from_commits', {
 
 server.registerTool('log_work', {
   title: 'Log work to Resource Optimiser',
-  description: `Resource Optimiser only: create new RO entries (worklog task + hours + date + type of work + description) from a weekly logwork block. ${TWO_STEP} The preview resolves the project (bookings, mappings, ticket prefixes) and worklog task per line; unresolved lines block apply. Use log_jira_work for Jira.`,
+  description: `Resource Optimiser only: create new RO entries (worklog task + hours + date + type of work + description) from a weekly logwork block. ${TWO_STEP} The preview resolves the project (bookings, mappings, ticket prefixes) and worklog task per line; unresolved lines block apply. It also reads each date's RO entries and flags possibleDuplicate lines (same date, worklog task, hours and description, or a repeated line); apply refuses them unless allowDuplicates: true. Use log_jira_work for Jira.`,
   annotations: WRITE,
   inputSchema: {
     text: z.string().min(1).optional().describe(ENTRY_TEXT_DESCRIPTION),
-    projectOverrides: z.record(z.string(), z.union([z.string(), z.number()])).optional().describe('Preview call only. Map preview entry id (e.g. "2026-06-01-01") to the projectMemberId the user chose for an unresolved entry.'),
+    projectOverrides: z.record(z.string(), z.union([z.string(), z.number()])).optional().describe('Preview call only. Map preview entry id (e.g. "2026-06-01-01") to the projectMemberId the user chose for an unresolved entry, or pass the projectOverrides returned by draft_from_commits with its draftText unchanged.'),
     defaultWorklogTask: z.string().min(1).optional().describe('Preview call only. Worklog task name (or "#<id>") for lines without "|" whose text is not a catalog task; that text becomes the description. Example: "Feature Development".'),
     typeOfWork: TYPE_OF_WORK_SCHEMA.optional().describe('Preview call only. Override type_of_work for every entry. When omitted, each entry takes its worklog task type, else "other".'),
     batchId: BATCH_ID_SCHEMA,
     allowUnbooked: z.boolean().optional().describe('Apply call only. Allow entries resolved to a project membership without a booking on that date.'),
+    allowDuplicates: z.boolean().optional().describe('Apply call only. Allow entries the preview flagged as possibleDuplicate (same date, worklog task, hours and description as an existing RO entry or an earlier line). Pass true only after the user confirmed they are new work.'),
     confirm: CONFIRM_SCHEMA
   }
-}, withAuthRequiredHandling(async ({ text, projectOverrides, defaultWorklogTask, typeOfWork, batchId, allowUnbooked = false, confirm }) => {
+}, withAuthRequiredHandling(async ({ text, projectOverrides, defaultWorklogTask, typeOfWork, batchId, allowUnbooked = false, allowDuplicates = false, confirm }) => {
   prunePreviewCache(previews);
   if (confirm === true) {
     assertApplyOnly('log_work', { text, projectOverrides, defaultWorklogTask, typeOfWork });
+    // Check allowUnbooked and allowDuplicates before the preview is consumed,
+    // so the agent can retry the same batchId with the flag set.
+    const pending = resolveApprovedBatch({ cache: previews, batchId });
+    assertUnbookedAllowed(pending, allowUnbooked);
+    assertDuplicatesAllowed(pending, allowDuplicates);
     const approvedBatch = consumeApprovedBatch({ cache: previews, batchId });
-    return formatToolResponse(await applyLogworkBatch({ batch: approvedBatch, confirm, allowUnbooked }));
+    return formatToolResponse(await applyLogworkBatch({ batch: approvedBatch, confirm, allowUnbooked, allowDuplicates }));
   }
   requirePreviewInput('log_work', { text });
   const preview = await previewLogworkBatch({ text, projectOverrides: projectOverrides || {}, typeOfWork, defaultWorklogTask });
@@ -203,7 +211,7 @@ server.registerTool('resubmit_entry', {
   annotations: WRITE,
   inputSchema: {
     logworkId: LOGWORK_ID_SCHEMA,
-    hours: z.number().positive().optional().describe('Preview call only. New hours; defaults to the rejected entry hours.'),
+    hours: z.number().positive().max(24).optional().describe('Preview call only. New hours; defaults to the rejected entry hours.'),
     typeOfWork: TYPE_OF_WORK_SCHEMA.optional().describe('Preview call only. New type of work; defaults to the rejected entry value.'),
     noteToPm: z.string().max(500).optional().describe('Preview call only. Note to the project manager explaining the fix.'),
     description: z.string().max(1_000).optional().describe('Preview call only. New description; defaults to the rejected entry description.'),
@@ -257,8 +265,7 @@ server.registerTool('log_jira_work', {
   prunePreviewCache(jiraPreviews);
   if (confirm === true) {
     assertApplyOnly('log_jira_work', { text });
-    const approvedBatch = consumeApprovedJiraBatch({ cache: jiraPreviews, batchId });
-    return formatToolResponse(await applyJiraWorklogBatch({ batch: approvedBatch, confirm }));
+    return applyCachedJiraWork({ cache: jiraPreviews, batchId, confirm });
   }
   requirePreviewInput('log_jira_work', { text });
   const preview = await previewJiraWorklogBatch({ text });
@@ -304,18 +311,19 @@ server.registerTool('get_history', {
 
 server.registerTool('map_project', {
   title: 'Save a project mapping',
-  description: 'Save a local ticket-prefix/keyword -> RO project mapping so future log_work previews resolve the project automatically. Writes .logwork.json; requires confirm: true after the user approved the mapping.',
+  description: 'Save a local ticket-prefix/keyword/git repo -> RO project mapping so future log_work previews resolve the project automatically and draft_from_commits allocates a repo\'s commits to its project. Pass tickets, repos, or both. Writes .logwork.json; requires confirm: true after the user approved the mapping.',
   annotations: { ...LOCAL_WRITE, idempotentHint: true },
   inputSchema: {
     projectMemberId: z.union([z.string(), z.number()]).optional().describe('RO projectMemberId from list_projects or preview setupSuggestions.'),
     projectName: z.string().optional().describe('Project name to match against the user\'s memberships when projectMemberId is not given.'),
-    tickets: z.array(z.string()).min(1).describe('Ticket prefixes to map, for example ["SCB"].'),
+    tickets: z.array(z.string()).optional().describe('Ticket prefixes to map, for example ["SCB"]. At least one ticket prefix or repo is required.'),
     keywords: z.array(z.string()).optional().describe('Optional task keywords to map to the project.'),
+    repos: z.array(z.string().min(1)).max(20).optional().describe('Absolute paths of git repos whose commits belong to this project (a subfolder is stored as its repo root). draft_from_commits uses them to pick the project per commit.'),
     scope: z.enum(['user', 'project']).optional().describe('user (default): ~/.logwork-cli/.logwork.json for this machine. project: .logwork.json in the current repo.'),
     confirm: z.boolean().describe('Must be true, and only after explicit user approval.')
   }
-}, withAuthRequiredHandling(async ({ projectMemberId, projectName, tickets, keywords = [], scope = 'user', confirm }) => {
-  const result = await upsertProjectMapping({ projectMemberId, projectName, tickets, keywords, scope, confirm });
+}, withAuthRequiredHandling(async ({ projectMemberId, projectName, tickets = [], keywords = [], repos = [], scope = 'user', confirm }) => {
+  const result = await upsertProjectMapping({ projectMemberId, projectName, tickets, keywords, repos, scope, confirm });
   return formatToolResponse(result);
 }));
 
@@ -340,15 +348,19 @@ server.registerTool('login', {
 
 server.registerTool('reminder', {
   title: 'Logwork reminder',
-  description: 'The native macOS/Windows weekday logwork reminder. action "status" is read-only. "enable", "disable" and "test" (shows a sample notification) change the OS scheduler or display a notification and require confirm: true after explicit user approval. No credentials are stored in the schedule.',
+  description: 'The native macOS/Windows weekday logwork reminder. action "status" is read-only. "enable", "disable" and "test" (shows a sample notification) change the OS scheduler or display a notification and require confirm: true after explicit user approval. When RO hours are missing, the notification also counts today\'s commits in the configured repos. status warns when the Node path in the schedule no longer exists. No credentials are stored in the schedule.',
   annotations: LOCAL_WRITE,
   inputSchema: {
     action: z.enum(['status', 'enable', 'disable', 'test']).describe('status: show config and scheduler state. enable/disable: install or remove the schedule. test: send a sample notification.'),
     time: z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/).optional().describe('enable only. Local time in 24-hour HH:mm. Defaults to 17:00.'),
     target: z.enum(['ro', 'jira', 'both']).optional().describe('enable/test only. What to check. Defaults to both (enable) or the configured target (test).'),
+    repos: z.array(z.string().min(1)).max(20).optional().describe('enable only. Absolute paths of git repos whose commits today the reminder counts when RO hours are missing. Replaces the saved list; [] clears it; omit to keep it.'),
     confirm: z.boolean().optional().describe('Required (true) for enable, disable and test, after explicit user approval.')
   }
-}, async ({ action, time, target, confirm }) => {
+}, async ({ action, time, target, repos, confirm }) => {
+  if (action !== 'enable' && repos !== undefined) {
+    throw new Error('repos is only valid when enabling the reminder.');
+  }
   if (action === 'status') {
     return formatToolResponse(await getLogworkReminderStatus());
   }
@@ -362,7 +374,7 @@ server.registerTool('reminder', {
     throw new Error('target is not valid when disabling the reminder.');
   }
   if (action === 'enable') {
-    return formatToolResponse(await enableLogworkReminder({ time, target, confirm }));
+    return formatToolResponse(await enableLogworkReminder({ time, target, repos, confirm }));
   }
   if (action === 'disable') {
     return formatToolResponse(await disableLogworkReminder({ confirm }));
@@ -536,7 +548,7 @@ export function resolveApprovedBatch({
 
   const cached = getCachedPreviewRecord(cache, batchId, now);
   if (!cached) {
-    throw new Error('No cached log_work preview for this batchId (expired after 1 hour, already applied, or the server restarted). Preview again and apply using the returned batchId.');
+    throw new Error('No cached log_work preview for this batchId (expired after 1 hour, already used by an earlier confirm call, or the server restarted; an earlier confirm may have failed without writing, so check get_logwork before assuming it was applied). Preview again and apply using the returned batchId.');
   }
 
   if (batch && createPreviewFingerprint(batch) !== cached.fingerprint) {
@@ -546,6 +558,20 @@ export function resolveApprovedBatch({
   return clonePreview(cached.preview);
 }
 
+export function assertDuplicatesAllowed(batch, allowDuplicates) {
+  const duplicates = (batch?.entries || []).filter((entry) => entry.possibleDuplicate);
+  if (duplicates.length && allowDuplicates !== true) {
+    throw new Error(`Nothing was written. ${formatDuplicateBlock(duplicates)} Ask the user whether this is new work, then call log_work again with the same batchId, confirm: true and allowDuplicates: true.`);
+  }
+}
+
+export function assertUnbookedAllowed(batch, allowUnbooked) {
+  const unbooked = (batch?.entries || []).filter((entry) => entry.requiresAllowUnbooked);
+  if (unbooked.length && allowUnbooked !== true) {
+    throw new Error(`Nothing was written. ${unbooked.length} entr${unbooked.length === 1 ? 'y has' : 'ies have'} no booking on that date (${unbooked.map((entry) => entry.id).join(', ')}). Ask the user, then call log_work again with the same batchId, confirm: true and allowUnbooked: true.`);
+  }
+}
+
 export function consumeApprovedBatch({
   cache,
   batchId,
@@ -562,6 +588,19 @@ export function consumeApprovedBatch({
   return approvedBatch;
 }
 
+// The log_jira_work apply call. With LOGWORK_DRY_RUN=1 the apply sends no
+// worklog and the response summary starts with "DRY RUN".
+export async function applyCachedJiraWork({
+  cache,
+  batchId,
+  confirm,
+  applyOptions = {},
+  now = Date.now()
+}) {
+  const approvedBatch = consumeApprovedJiraBatch({ cache, batchId, now });
+  return formatToolResponse(await applyJiraWorklogBatch({ ...applyOptions, batch: approvedBatch, confirm }));
+}
+
 export function resolveApprovedJiraBatch({
   cache,
   batchId,
@@ -578,7 +617,7 @@ export function resolveApprovedJiraBatch({
 
   const cached = getCachedPreviewRecord(cache, batchId, now);
   if (!cached) {
-    throw new Error('No cached log_jira_work preview for this batchId (expired after 1 hour, already applied, or the server restarted). Preview again and apply using the returned batchId.');
+    throw new Error('No cached log_jira_work preview for this batchId (expired after 1 hour, already used by an earlier confirm call, or the server restarted; an earlier confirm may have failed without writing, so check get_logwork before assuming it was applied). Preview again and apply using the returned batchId.');
   }
 
   if (batch && createJiraPreviewFingerprint(batch) !== cached.fingerprint) {
@@ -620,7 +659,7 @@ export function resolveApprovedRoEditPreview({
 
   const cached = getCachedPreviewRecord(cache, previewId, now);
   if (!cached) {
-    throw new Error(`No cached ${toolName} preview for this previewId (expired after 1 hour, already applied, or the server restarted). Preview again before applying.`);
+    throw new Error(`No cached ${toolName} preview for this previewId (expired after 1 hour, already used by an earlier confirm call, or the server restarted; an earlier confirm may have failed without writing, so check get_logwork before assuming it was applied). Preview again before applying.`);
   }
   if (preview && createRoEditPreviewFingerprint(preview) !== cached.fingerprint) {
     throw new Error(`Approved ${toolName} preview changed after preview. Preview again before applying.`);
@@ -673,7 +712,10 @@ export function createPreviewFingerprint(preview = {}) {
       confidence: numberOrNull(entry?.confidence),
       matchedProject: projectFingerprint(entry?.matchedProject),
       booked: booleanOrNull(entry?.booked),
-      requiresAllowUnbooked: booleanOrNull(entry?.requiresAllowUnbooked)
+      requiresAllowUnbooked: booleanOrNull(entry?.requiresAllowUnbooked),
+      possibleDuplicate: entry?.possibleDuplicate
+        ? textOrNull(entry.possibleDuplicate.logworkId ?? entry.possibleDuplicate.entryId)
+        : null
     }))
   });
 }

package/lib/node-runtime.mjs

@@ -0,0 +1,115 @@
+import { promises as fs } from 'node:fs';
+import { atomicWriteFile } from './atomic-file.mjs';
+import { runtimeInfoPath } from './paths.mjs';
+
+// The node binary that runs the MCP server and the reminder is stored as an
+// absolute path (IDE configs, the launchd plist, the Windows task). With nvm,
+// Homebrew or a Node installer upgrade that path can disappear or stop being
+// the node the user runs. `logwork setup` records it here so `logwork doctor`
+// and `logwork reminder status` can tell when it went stale.
+
+export async function writeRuntimeInfo({
+  path = runtimeInfoPath(),
+  nodePath = process.execPath,
+  nodeVersion = process.version,
+  version = null,
+  now = () => new Date(),
+  writeFile = atomicWriteFile
+} = {}) {
+  const info = {
+    nodePath: String(nodePath || ''),
+    nodeVersion: String(nodeVersion || ''),
+    installedAt: now().toISOString(),
+    version: version ? String(version) : null
+  };
+  await writeFile(path, `${JSON.stringify(info, null, 2)}\n`);
+  return info;
+}
+
+export async function loadRuntimeInfo({
+  path = runtimeInfoPath(),
+  readFile = fs.readFile
+} = {}) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(path, 'utf8'));
+  } catch (error) {
+    if (error.code === 'ENOENT' || error instanceof SyntaxError) {
+      return null;
+    }
+    throw error;
+  }
+  if (!parsed || typeof parsed !== 'object' || typeof parsed.nodePath !== 'string' || !parsed.nodePath) {
+    return null;
+  }
+  return {
+    nodePath: parsed.nodePath,
+    nodeVersion: typeof parsed.nodeVersion === 'string' ? parsed.nodeVersion : '',
+    installedAt: typeof parsed.installedAt === 'string' ? parsed.installedAt : '',
+    version: typeof parsed.version === 'string' ? parsed.version : null
+  };
+}
+
+// ok: the recorded node is the current one (same file after symlinks).
+// missing: the recorded node no longer exists.
+// stale: it exists but differs from the current, working node.
+export async function inspectNodePath(recordedPath, {
+  currentPath = process.execPath,
+  platform = process.platform,
+  exists = pathExists,
+  realpath = fs.realpath
+} = {}) {
+  const recorded = String(recordedPath || '');
+  if (!recorded) {
+    return { status: 'unknown', recordedPath: '', currentPath };
+  }
+  if (!await exists(recorded)) {
+    return { status: 'missing', recordedPath: recorded, currentPath };
+  }
+  const [left, right] = await Promise.all([
+    realpath(recorded).catch(() => recorded),
+    realpath(currentPath).catch(() => currentPath)
+  ]);
+  const same = platform === 'win32'
+    ? String(left).toLowerCase() === String(right).toLowerCase()
+    : left === right;
+  if (same) {
+    return { status: 'ok', recordedPath: recorded, currentPath };
+  }
+  if (!await exists(currentPath)) {
+    // Not stale: there is no working node to switch to.
+    return { status: 'differs', recordedPath: recorded, currentPath };
+  }
+  return { status: 'stale', recordedPath: recorded, currentPath };
+}
+
+// source "runtime": the node recorded by `logwork setup` (used by the printed
+// MCP configs). source "reminder": the node in the installed OS schedule.
+export function formatNodePathIssue(source, inspection) {
+  const { status, recordedPath, currentPath } = inspection || {};
+  if (source === 'reminder') {
+    if (status === 'missing') {
+      return `Reminder: the OS schedule runs Node at ${recordedPath}, which no longer exists, so the reminder cannot run. Fix: run \`logwork reminder enable\` (or \`logwork setup\`) to re-register it with the current Node.`;
+    }
+    if (status === 'stale') {
+      return `Reminder: the OS schedule runs Node at ${recordedPath}, but the current Node is ${currentPath}. Fix: run \`logwork reminder enable\` to re-register it with the current Node.`;
+    }
+    return '';
+  }
+  if (status === 'missing') {
+    return `Runtime: \`logwork setup\` recorded Node at ${recordedPath}, which no longer exists, so IDE MCP configs that use it cannot start. Fix: run \`logwork setup\` and paste the new MCP config "command" into your IDE.`;
+  }
+  if (status === 'stale') {
+    return `Runtime: \`logwork setup\` recorded Node at ${recordedPath}, but the current Node is ${currentPath}. Fix: if you switched Node on purpose, run \`logwork setup\` and update the MCP config "command" in your IDE.`;
+  }
+  return '';
+}
+
+async function pathExists(path) {
+  try {
+    await fs.access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/lib/npm-command.mjs

@@ -0,0 +1,29 @@
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+// How to start npm as a child process on every platform.
+// On Windows, npm is npm.cmd: spawn('npm') fails with ENOENT, and since the
+// Node fix for CVE-2024-27980 spawn('npm.cmd') without a shell fails with
+// EINVAL. Running npm's own npm-cli.js with the current node avoids the shell;
+// when it cannot be found, fall back to npm.cmd through cmd.exe.
+export function npmInvocation(args, {
+  platform = process.platform,
+  execPath = process.execPath,
+  env = process.env,
+  exists = existsSync
+} = {}) {
+  if (platform !== 'win32') {
+    return { command: 'npm', args, shell: false };
+  }
+  const candidates = [
+    env.npm_execpath && /npm-cli\.js$/i.test(env.npm_execpath) ? env.npm_execpath : null,
+    join(dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js')
+  ].filter(Boolean);
+  const cli = candidates.find((path) => exists(path));
+  if (cli) {
+    return { command: execPath, args: [cli, ...args], shell: false };
+  }
+  // cmd.exe joins the arguments unquoted; the arguments used here have no
+  // spaces or shell metacharacters.
+  return { command: 'npm.cmd', args, shell: true };
+}

package/lib/paths.mjs

@@ -9,6 +9,7 @@ export const APPLY_LEDGER_FILE_NAME = 'apply-ledger.json';
 export const UPDATE_STATE_FILE_NAME = 'update-state.json';
 export const REMINDER_CONFIG_FILE_NAME = 'reminder.json';
 export const REMINDER_STATE_FILE_NAME = 'reminder-state.json';
+export const RUNTIME_INFO_FILE_NAME = 'runtime.json';
 
 // Names used before the package was renamed from logwork-helper to logwork-cli.
 // lib/legacy-migration.mjs copies state from these locations on first run.
@@ -51,8 +52,17 @@ export function reminderStatePath() {
   return resolve(helperHome(), REMINDER_STATE_FILE_NAME);
 }
 
+// Written by `logwork setup`: the node binary and version the installed
+// runtime, MCP configs and reminder were set up with.
+export function runtimeInfoPath() {
+  return resolve(helperHome(), RUNTIME_INFO_FILE_NAME);
+}
+
 export function legacyUserConfigPath() {
-  return resolve(homedir(), LEGACY_CONFIG_FILE_NAME);
+  // A custom home (tests, separate profiles) keeps its state isolated from
+  // the real ~/.logwork-helper.json.
+  const custom = customHelperHome();
+  return custom ? resolve(custom, LEGACY_CONFIG_FILE_NAME) : resolve(homedir(), LEGACY_CONFIG_FILE_NAME);
 }
 
 // Project-scope mappings live in the repo the user works in. A repo that still

package/lib/project-mapping-workflow.mjs

@@ -1,4 +1,7 @@
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
 import { ApiError, getProjects } from './api.mjs';
+import { resolveGitRepoRoot } from './commit-workflow.mjs';
 import {
   configPath,
   loadLocalConfig,
@@ -34,17 +37,35 @@ export async function upsertProjectMapping({
   projectName,
   tickets = [],
   keywords = [],
+  repos = [],
   scope = 'user',
   confirm,
   cwd = process.cwd(),
-  fetchProjects
+  fetchProjects,
+  resolveRepoRoot = resolveGitRepoRoot
 } = {}) {
   if (confirm !== true) {
     throw new Error('map_project requires confirm: true.');
   }
 
-  if (!Array.isArray(tickets) || !tickets.length) {
-    throw new Error('map_project requires at least one ticket prefix.');
+  const ticketList = Array.isArray(tickets) ? tickets : [];
+  const repoList = Array.isArray(repos) ? repos.filter((repo) => typeof repo === 'string' && repo.trim()) : [];
+  if (!ticketList.length && !repoList.length) {
+    throw new Error('map_project requires at least one ticket prefix or repo.');
+  }
+
+  // Commit drafts match a commit's git repo root, so a subfolder is stored as
+  // the root of the repo that contains it.
+  const repoRoots = [];
+  for (const repo of repoList) {
+    const trimmed = repo.trim();
+    const expanded = trimmed === '~' || /^~[\\/]/.test(trimmed) ? `${homedir()}${trimmed.slice(1)}` : trimmed;
+    const path = resolve(cwd, expanded);
+    try {
+      repoRoots.push(await resolveRepoRoot(path));
+    } catch (error) {
+      throw new Error(`${path} is not a git repository: ${error.message}`);
+    }
   }
 
   const projects = sanitizeProjects(await (fetchProjects || createMembershipProjectsFetcher())());
@@ -60,8 +81,9 @@ export async function upsertProjectMapping({
     cwd,
     scope,
     project: resolution.project,
-    tickets,
-    keywords
+    tickets: ticketList,
+    keywords,
+    repos: repoRoots
   });
 
   return {
@@ -72,8 +94,9 @@ export async function upsertProjectMapping({
     projects,
     summary: [
       `${result.created ? 'Created' : 'Updated'} project mapping for ${result.mapping.projectName}.`,
-      `Tickets: ${result.mapping.tickets.join(', ')}.`,
-      result.mapping.keywords.length ? `Keywords: ${result.mapping.keywords.join(', ')}.` : 'Keywords: none.'
+      result.mapping.tickets.length ? `Tickets: ${result.mapping.tickets.join(', ')}.` : 'Tickets: none.',
+      result.mapping.keywords.length ? `Keywords: ${result.mapping.keywords.join(', ')}.` : 'Keywords: none.',
+      result.mapping.repos?.length ? `Repos: ${result.mapping.repos.join(', ')}.` : 'Repos: none.'
     ].join('\n')
   };
 }

package/lib/query-workflow.mjs

@@ -1,4 +1,3 @@
-import { CONFIG } from './config.mjs';
 import { getFreshToken, getUserIdFromJwt } from './auth.mjs';
 import {
   ApiError,

package/lib/reconciliation-workflow.mjs

@@ -1,4 +1,4 @@
-import { ApiError } from './api.mjs';
+import { ApiError } from './ro-api-http.mjs';
 import {
   getJiraIssueWorklogs,
   searchJiraIssues

package/lib/release-doctor.mjs

@@ -1,6 +1,7 @@
 import { spawn } from 'node:child_process';
 import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { npmInvocation } from './npm-command.mjs';
 
 const PACKAGE_NAME = 'logwork-cli';
 const PACK_CACHE_PATH = '/private/tmp/logwork-cli-npm-cache';
@@ -113,10 +114,11 @@ export async function runCommandDefault(command, args = [], {
       ...process.env,
       ...(gitSafe ? { GIT_CONFIG_GLOBAL: '/dev/null' } : {})
     };
-    const child = spawn(command, args, {
+    const invocation = command === 'npm' ? npmInvocation(args) : { command, args, shell: false };
+    const child = spawn(invocation.command, invocation.args, {
       cwd,
       env,
-      shell: false,
+      shell: invocation.shell,
       stdio: ['ignore', 'pipe', 'pipe']
     });
     let stdout = '';