logwork-cli 1.1.0 → 1.2.0

package/lib/ro-edit-workflow.mjs

@@ -100,7 +100,7 @@ export async function applyRoLogworkEdit({
   const reader = fetchLogwork || createF03LogworkReader();
   const creator = submitCreate || createEntryWriter();
   const deleter = submitDelete || createDeleteWriter();
-  const dayReader = fetchDayEntries || createDayEntriesReader();
+  const dayReader = fetchDayEntries || (injected ? null : createDayEntriesReader());
   const ledgerWriter = recordLedger === undefined
     ? (injected ? null : recordApplyResult)
     : recordLedger;
@@ -121,15 +121,27 @@ export async function applyRoLogworkEdit({
     needsProjectId: preview.updated.needsProjectId
   };
 
+  // Entry ids already on the target day, so a replacement found later by its
+  // values is never confused with an older identical entry.
+  const existingIds = await readDayEntryIds(dayReader, preview.updated.date);
+
   let createResult;
   try {
     createResult = await creator(createRequest);
   } catch (error) {
-    error.message = `Could not create the replacement RO entry; the original entry ${preview.logworkId} is unchanged. ${error.message}`;
-    error.applyLedger = await recordEditLedger({
-      writer: ledgerWriter, preview, status: 'failed', entryStatus: 'failed', error: error.message, cwd
-    });
-    throw error;
+    // Writes are not retried, so a timeout is ambiguous: RO may have saved the
+    // entry. Look for it before reporting that nothing changed.
+    const savedId = await findCreatedEntryId({ dayReader, preview, existingIds });
+    if (savedId === null) {
+      error.message = existingIds
+        ? `Could not create the replacement RO entry; the original entry ${preview.logworkId} is unchanged. ${error.message}`
+        : `Could not create the replacement RO entry (${error.message}). The original entry ${preview.logworkId} is unchanged, but check ${preview.updated.date} (get_logwork or \`logwork query\`) in case RO saved a copy.`;
+      error.applyLedger = await recordEditLedger({
+        writer: ledgerWriter, preview, status: 'failed', entryStatus: 'failed', error: error.message, cwd
+      });
+      throw error;
+    }
+    createResult = { entry: { id: savedId } };
   }
 
   if (createResult?.dryRun) {
@@ -156,7 +168,7 @@ export async function applyRoLogworkEdit({
 
   let newLogworkId = createResult?.entry?.id ?? null;
   if (newLogworkId === null || newLogworkId === undefined) {
-    newLogworkId = await findCreatedEntryId({ dayReader, preview });
+    newLogworkId = await findCreatedEntryId({ dayReader, preview, existingIds });
   }
   if (newLogworkId === null || newLogworkId === undefined) {
     const error = new Error(
@@ -172,6 +184,25 @@ export async function applyRoLogworkEdit({
   try {
     await deleter(preview.logworkId);
   } catch (error) {
+    // A failed DELETE may still have deleted the original (timeout). Roll the
+    // replacement back only when the original is confirmed to still exist;
+    // otherwise rolling back could leave neither entry.
+    const originalState = await originalEntryState({ dayReader, preview });
+    if (originalState === 'gone') {
+      return finishReplace({ reader, preview, newLogworkId, ledgerWriter, cwd });
+    }
+    if (originalState === 'unknown') {
+      const message = `Deleting the original RO entry ${preview.logworkId} failed (${error.message}) and its state could not be read. ` +
+        `The replacement entry ${newLogworkId} was kept. Check ${preview.original?.date || preview.updated.date} (get_logwork or \`logwork query\`); if both entries exist, delete ${preview.logworkId}.`;
+      const wrapped = new Error(message);
+      wrapped.cause = error;
+      wrapped.newLogworkId = newLogworkId;
+      wrapped.rolledBack = false;
+      wrapped.applyLedger = await recordEditLedger({
+        writer: ledgerWriter, preview, status: 'partial', entryStatus: 'failed', error: message, newLogworkId, cwd
+      });
+      throw wrapped;
+    }
     const rollback = await rollbackCreatedEntry({ deleter, newLogworkId });
     const message = rollback.ok
       ? `Could not delete the original RO entry ${preview.logworkId} (${error.message}). The replacement entry ${newLogworkId} was rolled back; nothing changed.`
@@ -193,6 +224,10 @@ export async function applyRoLogworkEdit({
     throw wrapped;
   }
 
+  return finishReplace({ reader, preview, newLogworkId, ledgerWriter, cwd });
+}
+
+async function finishReplace({ reader, preview, newLogworkId, ledgerWriter, cwd }) {
   let verified;
   try {
     verified = sanitizeLogwork(await reader(newLogworkId));
@@ -483,11 +518,34 @@ function changeFingerprint(change) {
   };
 }
 
-async function findCreatedEntryId({ dayReader, preview }) {
+async function readDayEntryIds(dayReader, date) {
+  if (!dayReader) {
+    return null;
+  }
+  try {
+    return new Set((await dayReader(date) || []).map((entry) => String(entry.id)));
+  } catch {
+    return null;
+  }
+}
+
+async function originalEntryState({ dayReader, preview }) {
+  const ids = await readDayEntryIds(dayReader, preview.original?.date || preview.updated.date);
+  if (!ids) {
+    return 'unknown';
+  }
+  return ids.has(String(preview.logworkId)) ? 'present' : 'gone';
+}
+
+async function findCreatedEntryId({ dayReader, preview, existingIds = null }) {
+  if (!dayReader) {
+    return null;
+  }
   try {
     const entries = await dayReader(preview.updated.date);
     const candidates = (entries || []).filter((entry) => (
       String(entry.id) !== String(preview.logworkId) &&
+      (!existingIds || !existingIds.has(String(entry.id))) &&
       String(entry.worklogTaskId) === String(preview.updated.worklogTaskId) &&
       Number(entry.hours) === Number(preview.updated.hours) &&
       (entry.description || '') === (preview.updated.description || '') &&

package/lib/ro-entry-reader.mjs

@@ -1,24 +1,34 @@
 import { ApiError, getLogtimeById, getLogworkDay, getProjects } from './api.mjs';
 import { createResourceOptimiserSession } from './query-workflow.mjs';
 
+const DEFAULT_READS = { getLogtimeById, getLogworkDay, getProjects };
+
 // Reads one existing RO entry with the fields edit, resubmit and delete need. The legacy
 // GET /member-logtime/:id gives the date, owner and Jira link; /logwork/day
 // gives the F03 fields (status, worklog task, type of work, description); the
-// project-member list maps project_member_id to project_id.
-export function createF03LogworkReader() {
-  const session = createResourceOptimiserSession();
+// project-member list maps project_member_id to project_id. Tests inject the
+// session and the RO reads; callers use the defaults.
+export function createF03LogworkReader({
+  session = createResourceOptimiserSession(),
+  reads = DEFAULT_READS
+} = {}) {
   let projectsPromise = null;
   return async (logworkId) => withRoSessionRetry(session, async ({ token, userId }) => {
-    const legacy = await getLogtimeById(token, logworkId);
+    const legacy = await reads.getLogtimeById(token, logworkId);
     if (!legacy.date) {
       throw new Error(`Resource Optimiser did not return a date for logwork ${logworkId}.`);
     }
-    const day = await getLogworkDay(token, { date: legacy.date });
+    const day = await reads.getLogworkDay(token, { date: legacy.date });
     const f03 = (day.entries || []).find((entry) => String(entry.id) === String(legacy.id));
     if (!f03) {
       throw new Error(`RO logwork ${logworkId} was not found on ${legacy.date}; it may have been deleted.`);
     }
-    projectsPromise ||= getProjects(token, userId);
+    // Cache only a successful load: a cached rejection (say a 401) would make
+    // the retry after a forced login fail the same way.
+    projectsPromise ||= reads.getProjects(token, userId).catch((error) => {
+      projectsPromise = null;
+      throw error;
+    });
     const projects = await projectsPromise;
     const projectMemberId = f03.projectMemberId ?? legacy.projectMemberId;
     const project = projects.find((item) => String(item.projectMemberId) === String(projectMemberId));
@@ -54,3 +64,36 @@ function withoutEmpty(record = {}) {
     value !== undefined && value !== null && value !== ''
   )));
 }
+
+// Guards shared by delete and resubmit (edit has its own, stricter set): the
+// entry must be the user's own, not synced from Jira, and on an unlocked day.
+export function assertOwnUnlockedRoEntry(logwork, action) {
+  if (
+    logwork?.currentUserId !== undefined &&
+    logwork?.createdBy !== undefined &&
+    String(logwork.currentUserId) !== String(logwork.createdBy)
+  ) {
+    throw new Error(`Cannot ${action} another user's RO logwork.`);
+  }
+  const jiraId = logwork?.jiraLogworkId;
+  if ((jiraId !== null && jiraId !== undefined && String(jiraId).trim() !== '') || String(logwork?.source || '').toLowerCase() === 'jira') {
+    throw new Error(`This RO logwork was created by Jira; ${action} it in Jira so both systems stay in step.`);
+  }
+  if (logwork?.dayLocked) {
+    throw new Error(`Logwork for ${logwork.date || 'this day'} is locked on Resource Optimiser; cannot ${action} it.`);
+  }
+}
+
+// What a preview was approved against; apply refuses if any of it changed.
+export function createRoEntryRevisionFingerprint(logwork) {
+  return JSON.stringify({
+    id: logwork.id,
+    date: logwork.date ?? null,
+    hours: logwork.hours,
+    status: logwork.status,
+    taskName: logwork.taskName,
+    worklogTaskId: logwork.worklogTaskId ?? null,
+    typeOfWork: logwork.typeOfWork ?? null,
+    description: logwork.description ?? null
+  });
+}

package/lib/ro-resubmit-workflow.mjs

@@ -1,6 +1,7 @@
-import { ApiError, resubmitLogworkEntry } from './api.mjs';
+import { ApiError } from './ro-api-http.mjs';
+import { resubmitLogworkEntry } from './ro-api-entries.mjs';
 import { createResourceOptimiserSession } from './query-workflow.mjs';
-import { createF03LogworkReader } from './ro-entry-reader.mjs';
+import { assertOwnUnlockedRoEntry, createF03LogworkReader, createRoEntryRevisionFingerprint } from './ro-entry-reader.mjs';
 
 export async function previewRoLogworkResubmit({
   logworkId,
@@ -15,31 +16,40 @@ export async function previewRoLogworkResubmit({
   if (String(current.status || '').toLowerCase() !== 'rejected') {
     throw new Error('Only rejected RO logwork entries can be resubmitted through this flow.');
   }
+  assertOwnUnlockedRoEntry(current, 'resubmit');
 
   const effortHours = hours === undefined ? current.hours : Number(hours);
-  if (!Number.isFinite(effortHours) || effortHours <= 0) {
-    throw new Error('hours must be a positive number.');
+  if (!Number.isFinite(effortHours) || effortHours <= 0 || effortHours > 24) {
+    throw new Error('hours must be a positive number up to 24.');
   }
 
-  const previewId = `resubmit_${current.id}_${effortHours}`;
+  const updated = {
+    hours: effortHours,
+    typeOfWork: typeOfWork || current.typeOfWork || 'other',
+    noteToPm: noteToPm ?? current.noteToPm ?? '',
+    description: description ?? current.description ?? ''
+  };
+  const originalFingerprint = createLogworkRevisionFingerprint(current);
+  // Every field that will be sent is part of the id, so two different
+  // previews of the same entry never share (and overwrite) one cache slot.
+  const previewId = `resubmit_${current.id}_${hash(JSON.stringify({ updated, originalFingerprint }))}`;
   const preview = {
     previewId,
     status: 'ready',
     logworkId: current.id,
     original: current,
-    updated: {
-      hours: effortHours,
-      typeOfWork: typeOfWork || current.typeOfWork || 'other',
-      noteToPm: noteToPm ?? current.noteToPm ?? '',
-      description: description ?? current.description ?? ''
-    },
-    originalFingerprint: createLogworkRevisionFingerprint(current)
+    updated,
+    originalFingerprint
   };
+  const changeLine = (label, from, to) => (String(from ?? '') === String(to ?? '') ? `- ${label}: ${to || '(empty)'}` : `- ${label}: ${from || '(empty)'} -> ${to || '(empty)'}`);
   preview.summary = [
     'RO logwork resubmit preview:',
-    `- Entry: ${current.id}`,
-    `- Hours: ${current.hours} -> ${effortHours}`,
-    `- Status: rejected -> approved (after resubmit)`
+    `- Entry: ${current.id} (${current.date || 'unknown date'}, ${current.taskName || 'unknown task'})`,
+    changeLine('Hours', current.hours, effortHours),
+    changeLine('Type of work', current.typeOfWork, updated.typeOfWork),
+    changeLine('Description', current.description, updated.description),
+    `- Note to PM: ${updated.noteToPm || '(none)'}`,
+    '- Status: rejected -> resubmitted'
   ].join('\n');
   return preview;
 }
@@ -125,10 +135,14 @@ function assertIdentifier(value, label) {
 }
 
 function createLogworkRevisionFingerprint(logwork) {
-  return JSON.stringify({
-    id: logwork.id,
-    hours: logwork.hours,
-    status: logwork.status,
-    taskName: logwork.taskName
-  });
+  return createRoEntryRevisionFingerprint(logwork);
+}
+
+function hash(value) {
+  let hashValue = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hashValue ^= value.charCodeAt(index);
+    hashValue = Math.imul(hashValue, 16777619);
+  }
+  return (hashValue >>> 0).toString(36);
 }

package/lib/terminal-auth-prompts.mjs

@@ -1,12 +1,15 @@
-import { isCancel, password, select, text } from '@clack/prompts';
+import * as clackPrompts from '@clack/prompts';
 import { createAuthRequiredError } from './auth-errors.mjs';
 import { createCredentialEmailStorage } from './credential-store.mjs';
 
 export function createTerminalCredentialProvider({
   emailStorage = createCredentialEmailStorage(),
   stdin = process.stdin,
-  stdout = process.stdout
+  stdout = process.stdout,
+  prompts = clackPrompts
 } = {}) {
+  const { password, select, text } = prompts;
+  const handleCancel = (value) => handleCancelWith(prompts, value);
   return {
     async requestCredentials() {
       ensureInteractive(stdin, stdout);
@@ -111,8 +114,8 @@ function ensureInteractive(stdin, stdout) {
   }
 }
 
-function handleCancel(value) {
-  if (isCancel(value)) {
+function handleCancelWith(prompts, value) {
+  if (prompts.isCancel(value)) {
     throw new Error('User cancelled Resource Optimiser authentication.');
   }
 

package/lib/ui.mjs

@@ -1,8 +1,22 @@
-import { cancel, confirm, isCancel, note, outro, select, text } from '@clack/prompts';
+import * as clackPrompts from '@clack/prompts';
 import { CONFIG } from './config.mjs';
 
-export async function chooseProject(projects, daySummaries) {
-  const options = projects.map((project, index) => {
+// Every prompt function takes an optional `{ prompts }` (default: @clack/prompts)
+// so tests can answer prompts without a terminal.
+
+export async function chooseProject(projects, daySummaries, { prompts = clackPrompts } = {}) {
+  const options = projectSelectOptions(projects, daySummaries);
+
+  const projectMemberId = handleCancel(await prompts.select({
+    message: 'Chọn project cần log work:',
+    options
+  }), prompts);
+
+  return projects.find((project) => project.projectMemberId === projectMemberId);
+}
+
+export function projectSelectOptions(projects, daySummaries) {
+  return projects.map((project, index) => {
     const summary = daySummaries[index];
     const logged = summary?.ok ? `${formatHours(summary.totalHours)}h` : `${formatHours(project.loggedHours)}h`;
     const booked = `${formatHours(project.assignedHours)}h`;
@@ -12,88 +26,87 @@ export async function chooseProject(projects, daySummaries) {
       label: `${project.projectName} - ${booked}/day (${project.workloadPercent}% assigned) · ${logged} logged today`
     };
   });
-
-  const projectMemberId = handleCancel(await select({
-    message: 'Chọn project cần log work:',
-    options
-  }));
-
-  return projects.find((project) => project.projectMemberId === projectMemberId);
 }
 
-export async function chooseTask(tasks) {
-  const taskId = handleCancel(await select({
+export async function chooseTask(tasks, { prompts = clackPrompts } = {}) {
+  const taskId = handleCancel(await prompts.select({
     message: 'Chọn loại công việc:',
-    options: tasks.map((task) => ({
-      value: task.taskId,
-      label: `${task.name} (${task.typeOfWork})`,
-      hint: task.description
-    }))
-  }));
+    options: taskSelectOptions(tasks)
+  }), prompts);
 
   return tasks.find((task) => task.taskId === taskId);
 }
 
-export async function chooseMessageSource(defaultMessage) {
-  const source = handleCancel(await select({
+export function taskSelectOptions(tasks) {
+  return tasks.map((task) => ({
+    value: task.taskId,
+    label: `${task.name} (${task.typeOfWork})`,
+    hint: task.description
+  }));
+}
+
+export async function chooseMessageSource(defaultMessage, { prompts = clackPrompts } = {}) {
+  const source = handleCancel(await prompts.select({
     message: 'Task message:',
     options: [
       { value: 'git', label: 'Use git commit message' },
       { value: 'custom', label: 'Custom' }
     ],
     initialValue: 'git'
-  }));
+  }), prompts);
 
   const initialValue = source === 'git' ? defaultMessage : '';
-  const value = handleCancel(await text({
+  const value = handleCancel(await prompts.text({
     message: 'Nội dung công việc:',
     placeholder: 'Fix login flow',
     initialValue,
-    validate(input) {
-      if (!input || input.trim() === '') {
-        return 'Vui lòng nhập nội dung công việc.';
-      }
-      return undefined;
-    }
-  }));
+    validate: validateTaskMessage
+  }), prompts);
 
   return value.trim();
 }
 
-export async function askHours(defaultHours = CONFIG.defaultHours) {
-  const value = handleCancel(await text({
+export function validateTaskMessage(input) {
+  if (!input || input.trim() === '') {
+    return 'Vui lòng nhập nội dung công việc.';
+  }
+  return undefined;
+}
+
+export async function askHours(defaultHours = CONFIG.defaultHours, { prompts = clackPrompts } = {}) {
+  const value = handleCancel(await prompts.text({
     message: 'Số giờ log:',
     placeholder: String(defaultHours),
     initialValue: String(defaultHours),
     validate(input) {
-      const numeric = Number(input);
-
-      if (!Number.isFinite(numeric)) {
-        return 'Số giờ phải là số.';
-      }
-      if (numeric <= 0) {
-        return 'Số giờ phải lớn hơn 0.';
-      }
-      if (!Number.isInteger(numeric / CONFIG.hourStep)) {
-        return `Số giờ phải chia hết cho ${CONFIG.hourStep}.`;
-      }
-
-      return undefined;
+      return validateHours(input);
     }
-  }));
+  }), prompts);
 
   return Number(value);
 }
 
-export async function confirmSubmit(payloadPreview) {
-  const task = truncate(payloadPreview.taskName, 80);
-  const description = payloadPreview.description
-    ? ` | "${truncate(payloadPreview.description, 120)}"`
-    : '';
-  const ok = handleCancel(await confirm({
-    message: `Log ${payloadPreview.hours}h to ${payloadPreview.projectName} with task "${task}"${description}?`,
+export function validateHours(input, hourStep = CONFIG.hourStep) {
+  const numeric = Number(input);
+
+  if (!Number.isFinite(numeric)) {
+    return 'Số giờ phải là số.';
+  }
+  if (numeric <= 0) {
+    return 'Số giờ phải lớn hơn 0.';
+  }
+  if (!Number.isInteger(numeric / hourStep)) {
+    return `Số giờ phải chia hết cho ${hourStep}.`;
+  }
+
+  return undefined;
+}
+
+export async function confirmSubmit(payloadPreview, { prompts = clackPrompts } = {}) {
+  const ok = handleCancel(await prompts.confirm({
+    message: formatSubmitConfirmation(payloadPreview),
     initialValue: true
-  }));
+  }), prompts);
 
   if (!ok) {
     throw new Error('User declined final submit.');
@@ -102,16 +115,24 @@ export async function confirmSubmit(payloadPreview) {
   return true;
 }
 
-export function showSuccess(message) {
-  outro(message);
+export function formatSubmitConfirmation(payloadPreview) {
+  const task = truncate(payloadPreview.taskName, 80);
+  const description = payloadPreview.description
+    ? ` | "${truncate(payloadPreview.description, 120)}"`
+    : '';
+  return `Log ${payloadPreview.hours}h to ${payloadPreview.projectName} with task "${task}"${description}?`;
+}
+
+export function showSuccess(message, { prompts = clackPrompts } = {}) {
+  prompts.outro(message);
 }
 
-export function showError(error) {
-  cancel(error?.message || String(error));
+export function showError(error, { prompts = clackPrompts } = {}) {
+  prompts.cancel(error?.message || String(error));
 }
 
-export function handleCancel(value) {
-  if (isCancel(value)) {
+export function handleCancel(value, prompts = clackPrompts) {
+  if (prompts.isCancel(value)) {
     throw new Error('Cancelled.');
   }
 

package/lib/update-service.mjs

@@ -5,6 +5,7 @@ import { atomicWriteFile } from './atomic-file.mjs';
 import { redactText } from './auth-redaction.mjs';
 import { fetchWithPolicy, redactedExcerpt } from './http.mjs';
 import { readPackageInfo } from './package-info.mjs';
+import { npmInvocation } from './npm-command.mjs';
 import { helperHome, updateStatePath } from './paths.mjs';
 
 export const UPDATE_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
@@ -187,7 +188,7 @@ export async function installUpdate({
     };
   }
 
-  const executable = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+  const executable = 'npm';
   const args = [
     'exec',
     '--yes',
@@ -311,7 +312,9 @@ function requireSemver(value, label) {
 
 function runUpdateCommand(executable, args, { stdio = 'pipe' } = {}) {
   return new Promise((resolveValue, reject) => {
-    const child = spawn(executable, args, {
+    const invocation = executable === 'npm' ? npmInvocation(args) : { command: executable, args, shell: false };
+    const child = spawn(invocation.command, invocation.args, {
+      shell: invocation.shell,
       cwd: helperHome(),
       env: process.env,
       stdio: stdio === 'inherit' ? 'inherit' : ['ignore', 'pipe', 'pipe']

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "logwork-cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Log work to Resource Optimiser and Jira from the terminal, an MCP server for AI IDEs, and a terminal UI.",
   "license": "UNLICENSED",
   "type": "module",
@@ -58,9 +58,11 @@
     "audit:prod": "npm audit --omit=dev --audit-level=moderate",
     "pack:check": "npm pack --dry-run",
     "release:doctor": "node bin/logwork.mjs release doctor --full",
-    "release:check": "npm test && npm run audit:prod && npm run pack:check && git diff --check",
-    "test:windows-credential": "node --test --test-name-pattern=\"Windows Credential Manager stores, reads, and deletes a test credential\" test/credential-store.test.mjs",
-    "test": "node --test"
+    "lint": "eslint .",
+    "release:check": "npm run lint && npm test && npm run audit:prod && npm run pack:check && git diff --check",
+    "test:windows-credential": "node --import ./test/helpers/setup.mjs --test --test-name-pattern=\"Windows Credential Manager stores, reads, and deletes a test credential\" test/credential-store.test.mjs",
+    "test": "node --import ./test/helpers/setup.mjs --test \"test/*.test.mjs\"",
+    "test:coverage": "node --import ./test/helpers/setup.mjs --test --experimental-test-coverage --test-coverage-include=\"bin/**\" --test-coverage-include=\"commands/**\" --test-coverage-include=\"lib/**\" --test-coverage-lines=78 --test-coverage-branches=75 --test-coverage-functions=85 \"test/*.test.mjs\""
   },
   "dependencies": {
     "@clack/prompts": "^1.5.0",
@@ -71,5 +73,10 @@
     "ink-text-input": "^6.0.0",
     "react": "^19.2.7",
     "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.39.5",
+    "eslint": "^9.39.5",
+    "globals": "^17.14.0"
   }
 }

package/skills/logwork/SKILL.md

@@ -10,18 +10,20 @@ Goal: every logged line is backed by real work (the user's commits or what the u
 ## Steps
 
 1. **Find the gaps.** Call `get_logwork` for the period. A day/project still needs time when booked > logged. Skip days that are already full.
-2. **Collect the evidence.** Call `draft_from_commits` with the same period and `repos` set to every repo the user worked in (the open workspace folders; ask the user for others). It groups the user's commits per day by repo, ticket and kind of work, suggests a worklog task per group, and splits each day's remaining RO hours across the groups. Treat its hours as a starting point, not a fact.
+2. **Collect the evidence.** Call `draft_from_commits` with the same period and `repos` set to every repo the user worked in (the open workspace folders; ask the user for others). It groups the user's commits per day by repo, ticket and kind of work, suggests a worklog task per group, picks each group's RO project (a `map_project` mapping whose `repos` holds the repo, else ticket/keyword mappings and that day's bookings), and splits each project's remaining RO hours across its groups. It returns `draftText` and `projectOverrides` (preview entry id → `projectMemberId`). Treat its hours as a starting point, not a fact.
 3. **Check the worklog tasks.** For each project involved, call `list_tasks(projectId)`. Keep the suggested task when it exists in that catalog; otherwise pick the catalog task whose description matches the work.
 4. **Write the descriptions.** One line per piece of work: what was done and the outcome, with ticket keys, in English, under about 200 characters, no `|`. Rewrite vague commit subjects ("wip", "fix", "update"); use `get_jira_issue` to read the ticket when the subject alone is unclear.
 5. **Set the hours.**
-   - Stay within the remaining booked hours per day and project unless the user says otherwise.
+   - Stay within the remaining booked hours per day and project unless the user says otherwise. The draft already gives each project at most its own remaining hours; lines without a project share the room of booked projects no other line claimed. A project with no room left gets 0h, and the summary says so.
+   - If `draft_from_commits` returns `authRequired`, call `login` first; do not guess hours without RO.
    - Use 0.5h steps.
    - Do not log weekends or days without a booking unless the user asks.
    - Work without commits (meetings, reviews, support) only comes from the user; ask, then log it as `Other Activities` or `Code Review & Refactoring`.
-6. **Resolve projects.** Ticket prefixes and mappings pick the project. If a line stays unresolved, ask the user and offer `map_project` so it is automatic next time.
+6. **Resolve projects.** The draft's `projectOverrides` already name the project of every resolved line. For `unmappedRepos` (lines with no project), ask the user which RO project the repo belongs to and offer `map_project` with `repos` (and `tickets` if useful), so later drafts resolve it; then run `draft_from_commits` again. A line `log_work` still cannot resolve: ask the user and add its id to `projectOverrides`.
 7. **Get approval, then write.**
    - Show the final block to the user.
-   - On approval, call `log_work(text)` and show its preview summary.
+   - On approval, call `log_work(text, projectOverrides)` and show its preview summary. Pass `projectOverrides` from the draft unchanged when `draftText` is unchanged. Entry ids are `<date>-<NN>` with NN counting lines through the whole text, so if you add, remove or reorder lines, renumber the overrides to match.
+   - If the preview flags `possibleDuplicate` entries, show the warnings. They match an existing RO entry (or an earlier line) on date, worklog task, hours and description. Usually drop those lines and preview again. Pass `allowDuplicates: true` on the confirm call only when the user says it is really new work.
    - Then call `log_work(batchId, confirm: true)`.
    - If the user also logs Jira, do the same with `log_jira_work`. Jira needs exactly one issue key per line.