@basou/cli 0.11.0 → 0.12.0

package/dist/index.js

@@ -1512,7 +1512,8 @@ async function importDerivedSessions(paths, manifest, options, sourceKind, candi
     reimported: 0,
     skippedLegacy: 0,
     skippedDecreased: 0,
-    skippedDuplicate: 0
+    skippedDuplicate: 0,
+    skippedUnverifiable: 0
   };
   let sanitizedPaths = 0;
   const validate = (payload) => {
@@ -1554,7 +1555,7 @@ async function importDerivedSessions(paths, manifest, options, sourceKind, candi
       if (outcome.status === "skipped") {
         const detail = outcome.reason === "prior_events_unreadable" ? "prior events.jsonl has unreadable lines" : outcome.reason === "prior_chain_broken" ? "prior events.jsonl failed hash-chain verification (run 'basou verify')" : "source changed in a non-append way (derived events would be dropped)";
         console.error(`Import: ${externalId} ${detail}; re-import skipped`);
-        counts.skippedNoAction++;
+        counts.skippedUnverifiable++;
         continue;
       }
       counts.reimported++;
@@ -1825,7 +1826,8 @@ function printImportResult(options, results, counts) {
     reimported,
     skippedLegacy,
     skippedDecreased,
-    skippedDuplicate
+    skippedDuplicate,
+    skippedUnverifiable
   } = counts;
   if (options.json === true) {
     console.log(
@@ -1844,6 +1846,7 @@ function printImportResult(options, results, counts) {
         skipped_legacy_untracked: skippedLegacy,
         skipped_decreased: skippedDecreased,
         skipped_duplicate: skippedDuplicate,
+        skipped_unverifiable: skippedUnverifiable,
         event_total: eventTotal,
         dry_run: isDry
       })
@@ -1856,6 +1859,8 @@ function printImportResult(options, results, counts) {
   if (skippedLegacy > 0) skipParts.push(`${skippedLegacy} legacy (untracked size)`);
   if (skippedDecreased > 0) skipParts.push(`${skippedDecreased} shrank`);
   if (skippedDuplicate > 0) skipParts.push(`${skippedDuplicate} duplicated`);
+  if (skippedUnverifiable > 0)
+    skipParts.push(`${skippedUnverifiable} unverifiable (run 'basou verify')`);
   const skipSuffix = skipParts.length > 0 ? `; skipped ${skipParts.join(", ")}` : "";
   const eventsPart = replaced > 0 ? `${eventTotal} events, ${replaced} replaced` : `${eventTotal} events`;
   if (isDry) {
@@ -1935,6 +1940,9 @@ function registerInitCommand(program2) {
     "Extra import source root, relative to the repo root (repeatable; aggregates sibling repos into this workspace)",
     collectValue,
     []
+  ).option(
+    "--local-only",
+    "Write a .basou/ full-exclude .gitignore block (keep the trail out of version control) instead of the default ignore+commit block"
   ).option("-f, --force", "Overwrite an existing manifest").option("-v, --verbose", "Show error causes").action(async (options) => {
     await runInit(options);
   });
@@ -1971,7 +1979,7 @@ async function doRunInit(options, ctx) {
   });
   await writeManifest(paths, manifest, { force: options.force === true });
   try {
-    await appendBasouGitignore(repositoryRoot);
+    await appendBasouGitignore(repositoryRoot, { localOnly: options.localOnly === true });
   } catch (error) {
     renderGitignoreWarning(error, isVerbose(options));
   }
@@ -2000,15 +2008,21 @@ async function resolveRepositoryRootForInit(cwd) {
   }
 }
 
-// src/commands/refresh.ts
-import { assertBasouRootSafe as assertBasouRootSafe7, basouPaths as basouPaths7, findErrorCode as findErrorCode7, resolveRepositoryRoot as resolveRepositoryRoot8 } from "@basou/core";
-import { InvalidArgumentError as InvalidArgumentError2 } from "commander";
+// src/commands/orient.ts
+import {
+  assertBasouRootSafe as assertBasouRootSafe7,
+  basouPaths as basouPaths7,
+  findErrorCode as findErrorCode6,
+  renderOrientation as renderOrientation2,
+  writeMarkdownFile as writeMarkdownFile4
+} from "@basou/core";
 
 // src/lib/provenance-actions.ts
 import {
   readMarkdownFile as readMarkdownFile3,
   renderDecisions as renderDecisions2,
   renderHandoff as renderHandoff2,
+  renderOrientation,
   renderWithMarkers as renderWithMarkers3,
   writeMarkdownFile as writeMarkdownFile3
 } from "@basou/core";
@@ -2059,6 +2073,7 @@ async function runImport(adapter, fn) {
       skippedNoAction: readCount(json.skipped_no_action),
       skippedAlreadyImported: readCount(json.skipped_already_imported),
       skippedLegacyUntracked: readCount(json.skipped_legacy_untracked),
+      skippedUnverifiable: readCount(json.skipped_unverifiable),
       eventTotal: readCount(json.event_total),
       dryRun: json.dry_run === true
     };
@@ -2107,6 +2122,17 @@ async function regenerateDecisions(paths, nowIso, callbacks) {
   );
   return { decisionCount: result.decisionCount };
 }
+async function regenerateOrientation(paths, nowIso, callbacks) {
+  const result = await renderOrientation({ paths, nowIso, ...callbacks });
+  await writeMarkdownFile3(paths.files.orientation, `${result.body}
+`);
+  return {
+    sessionCount: result.sessionCount,
+    inFlightTaskCount: result.inFlightTaskCount,
+    pendingApprovalsCount: result.pendingApprovalsCount,
+    suspectCount: result.suspectCount
+  };
+}
 async function refreshAll(args) {
   const { options, ctx, paths, nowIso } = args;
   const dryRun = options.dryRun === true;
@@ -2114,31 +2140,210 @@ async function refreshAll(args) {
   const codex = await importCodex(options, ctx);
   if (dryRun) {
     const skipped = { status: "skipped", reason: "dry-run" };
-    return { claudeCode, codex, handoff: skipped, decisions: skipped, dryRun };
+    return {
+      claudeCode,
+      codex,
+      handoff: skipped,
+      decisions: skipped,
+      orientation: skipped,
+      dryRun
+    };
   }
   const handoffCounts = await regenerateHandoff(paths, nowIso);
   const decisionCounts = await regenerateDecisions(paths, nowIso);
+  const scoped = options.project !== void 0 && options.project.length > 0;
+  const orientationCounts = await regenerateOrientation(
+    paths,
+    nowIso,
+    scoped ? {} : {
+      staleness: {
+        newSessions: 0,
+        updatedSessions: 0,
+        unverifiableSessions: wouldBlock(claudeCode) + wouldBlock(codex)
+      }
+    }
+  );
   return {
     claudeCode,
     codex,
     handoff: { status: "generated", ...handoffCounts },
     decisions: { status: "generated", ...decisionCounts },
+    orientation: { status: "generated", ...orientationCounts },
     dryRun
   };
 }
+function wouldImport(outcome) {
+  return outcome.status === "ran" ? outcome.importedCount : 0;
+}
+function wouldUpdate(outcome) {
+  return outcome.status === "ran" ? outcome.reimportedCount + outcome.replacedCount : 0;
+}
+function wouldBlock(outcome) {
+  return outcome.status === "ran" ? outcome.skippedUnverifiable : 0;
+}
+async function probeStaleness(args) {
+  try {
+    const dry = await refreshAll({
+      options: { dryRun: true },
+      ctx: args.ctx,
+      paths: args.paths,
+      nowIso: args.nowIso
+    });
+    return {
+      newSessions: wouldImport(dry.claudeCode) + wouldImport(dry.codex),
+      updatedSessions: wouldUpdate(dry.claudeCode) + wouldUpdate(dry.codex),
+      unverifiableSessions: wouldBlock(dry.claudeCode) + wouldBlock(dry.codex)
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/lib/repo-root.ts
+import { resolveBasouRepositoryRoot } from "@basou/core";
+async function resolveBasouRootForCommand(cwd, commandName) {
+  try {
+    return await resolveBasouRepositoryRoot(cwd, {
+      onRedirect: ({ via, root }) => console.error(`Resolved workspace view to ${root} (via ${via}).`)
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message === "Not a git repository") {
+      throw new Error(
+        `Not a git repository. Run 'git init' first, then re-run 'basou ${commandName}'.`,
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+}
+
+// src/commands/orient.ts
+function registerOrientCommand(program2) {
+  program2.command("orient").description("Show the workspace's current position (also writes .basou/orientation.md)").option("-q, --quiet", "Write the file without printing the body").option("-v, --verbose", "Show error causes").action(async (opts) => {
+    await runOrient(opts);
+  });
+}
+async function runOrient(options, ctx = {}) {
+  try {
+    await doRunOrient(options, ctx);
+  } catch (error) {
+    renderCliError(error, { verbose: isVerbose(options) });
+    process.exitCode = 1;
+  }
+}
+async function doRunOrient(options, ctx) {
+  const cwd = ctx.cwd ?? process.cwd();
+  const repositoryRoot = await resolveBasouRootForCommand(cwd, "orient");
+  const paths = basouPaths7(repositoryRoot);
+  await assertWorkspaceInitialized6(paths.root);
+  const nowIso = (ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()).toISOString();
+  const probeCtx = { cwd: repositoryRoot };
+  if (ctx.claudeProjectsDir !== void 0) probeCtx.claudeProjectsDir = ctx.claudeProjectsDir;
+  if (ctx.codexSessionsDir !== void 0) probeCtx.codexSessionsDir = ctx.codexSessionsDir;
+  const staleness = await probeStaleness({ ctx: probeCtx, paths, nowIso });
+  const result = await renderOrientation2({
+    paths,
+    nowIso,
+    staleness,
+    verbose: options.verbose === true,
+    onWarning: (w, sid) => printReplayWarning(w, sid),
+    onSessionSkip: (sid, reason) => printSessionSkip(sid, reason),
+    onTaskSkip: (taskId, reason) => printTaskSkip(taskId, reason)
+  });
+  await writeMarkdownFile4(paths.files.orientation, `${result.body}
+`);
+  if (options.quiet === true) {
+    console.log(
+      `Generated .basou/orientation.md (sessions: ${result.sessionCount}, in-flight tasks: ${result.inFlightTaskCount}, pending approvals: ${result.pendingApprovalsCount}, suspect: ${result.suspectCount})`
+    );
+  } else {
+    console.log(result.body);
+  }
+}
+async function assertWorkspaceInitialized6(basouRoot) {
+  try {
+    await assertBasouRootSafe7(basouRoot);
+  } catch (error) {
+    if (findErrorCode6(error, "ENOENT")) {
+      throw new Error("Workspace not initialized. Run 'basou init' first.");
+    }
+    throw error;
+  }
+}
+
+// src/commands/refresh.ts
+import { assertBasouRootSafe as assertBasouRootSafe8, basouPaths as basouPaths8, findErrorCode as findErrorCode8 } from "@basou/core";
+import { InvalidArgumentError as InvalidArgumentError2 } from "commander";
+
+// src/lib/portfolio-config.ts
+import { homedir as homedir3 } from "os";
+import { isAbsolute, join as join4, resolve as resolve3 } from "path";
+import { readYamlFile as readYamlFile3 } from "@basou/core";
+var DEFAULT_PORTFOLIO_CONFIG_PATH = join4(homedir3(), ".basou", "portfolio.yaml");
+function expandTilde(p) {
+  if (p === "~") return homedir3();
+  if (p.startsWith("~/")) return join4(homedir3(), p.slice(2));
+  return p;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function loadPortfolioConfig(configPath = DEFAULT_PORTFOLIO_CONFIG_PATH) {
+  let raw;
+  try {
+    raw = await readYamlFile3(configPath);
+  } catch (error) {
+    if (error instanceof Error && error.message === "YAML file not found") {
+      throw new Error(
+        "No portfolio config at ~/.basou/portfolio.yaml. Create one (a 'workspaces:' list of repo paths) or pass --workspace <path>."
+      );
+    }
+    if (error instanceof Error && error.message === "Failed to parse YAML content") {
+      throw new Error("~/.basou/portfolio.yaml is not valid YAML.");
+    }
+    throw error;
+  }
+  if (!isRecord(raw) || !Array.isArray(raw.workspaces)) {
+    throw new Error("~/.basou/portfolio.yaml must contain a 'workspaces:' list.");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const entry of raw.workspaces) {
+    if (!isRecord(entry) || typeof entry.path !== "string" || entry.path.trim().length === 0) {
+      throw new Error("Each portfolio workspace needs a non-empty string 'path'.");
+    }
+    if (entry.label !== void 0 && typeof entry.label !== "string") {
+      throw new Error("A portfolio workspace 'label' must be a string when present.");
+    }
+    const expanded = expandTilde(entry.path.trim());
+    if (!isAbsolute(expanded)) {
+      throw new Error(
+        "Portfolio workspace paths must be absolute (or start with '~'); use --workspace for relative ad-hoc paths."
+      );
+    }
+    const abs = resolve3(expanded);
+    if (seen.has(abs)) continue;
+    seen.add(abs);
+    result.push(entry.label !== void 0 ? { path: abs, label: entry.label } : { path: abs });
+  }
+  if (result.length === 0) {
+    throw new Error("~/.basou/portfolio.yaml has no workspaces.");
+  }
+  return result;
+}
 
 // src/commands/refresh-watch.ts
 import { readdir as readdir2, stat as stat2 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
-import { findErrorCode as findErrorCode6 } from "@basou/core";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
+import { findErrorCode as findErrorCode7 } from "@basou/core";
 var DEFAULT_WATCH_INTERVAL_SEC = 30;
 var MIN_WATCH_INTERVAL_SEC = 5;
 var MAX_WATCH_INTERVAL_SEC = 86400;
 function watchedRoots(ctx) {
   return [
-    ctx.codexSessionsDir ?? join4(homedir3(), ".codex", "sessions"),
-    ctx.claudeProjectsDir ?? join4(homedir3(), ".claude", "projects")
+    ctx.codexSessionsDir ?? join5(homedir4(), ".codex", "sessions"),
+    ctx.claudeProjectsDir ?? join5(homedir4(), ".claude", "projects")
   ];
 }
 async function scanSourceLogs(roots) {
@@ -2148,11 +2353,11 @@ async function scanSourceLogs(roots) {
     try {
       entries = await readdir2(dir, { withFileTypes: true });
     } catch (error) {
-      if (findErrorCode6(error, "ENOENT") || findErrorCode6(error, "ENOTDIR")) return;
+      if (findErrorCode7(error, "ENOENT") || findErrorCode7(error, "ENOTDIR")) return;
       throw new Error("Failed to read a source log directory", { cause: error });
     }
     for (const entry of entries) {
-      const full = join4(dir, entry.name);
+      const full = join5(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
@@ -2160,7 +2365,7 @@ async function scanSourceLogs(roots) {
           const info = await stat2(full);
           out.set(full, { mtimeMs: info.mtimeMs, size: info.size });
         } catch (error) {
-          if (findErrorCode6(error, "ENOENT")) continue;
+          if (findErrorCode7(error, "ENOENT")) continue;
           throw new Error("Failed to stat a source log file", { cause: error });
         }
       }
@@ -2259,19 +2464,19 @@ function parseInterval(value) {
   return seconds;
 }
 function abortableSleep(ms, signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve7) => {
     if (signal.aborted) {
-      resolve4();
+      resolve7();
       return;
     }
     let timer;
     const onAbort = () => {
       clearTimeout(timer);
-      resolve4();
+      resolve7();
     };
     timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve4();
+      resolve7();
     }, ms);
     signal.addEventListener("abort", onAbort, { once: true });
   });
@@ -2285,6 +2490,9 @@ function registerRefreshCommand(program2) {
     collectPath2,
     []
   ).option("--force", "Re-import sessions already imported instead of skipping").option("--dry-run", "Preview imports and skip writing handoff / decisions").option("--json", "Output the result as JSON").option(
+    "--portfolio",
+    "Refresh every workspace listed in ~/.basou/portfolio.yaml (each with its own source roots)"
+  ).option(
     "--watch",
     "Keep running: re-import + regenerate when the native logs change (Ctrl-C to stop)"
   ).option(
@@ -2297,7 +2505,9 @@ function registerRefreshCommand(program2) {
 }
 async function runRefresh(options, ctx = {}) {
   try {
-    if (options.watch === true) {
+    if (options.portfolio === true) {
+      await doRunRefreshPortfolio(options, ctx);
+    } else if (options.watch === true) {
       await doRunRefreshWatch(options, ctx);
     } else {
       await doRunRefresh(options, ctx);
@@ -2307,14 +2517,58 @@ async function runRefresh(options, ctx = {}) {
     process.exitCode = 1;
   }
 }
+async function doRunRefreshPortfolio(options, ctx) {
+  if (options.watch === true) throw new Error("--portfolio cannot be combined with --watch.");
+  if (options.project !== void 0 && options.project.length > 0) {
+    throw new Error(
+      "--portfolio refreshes each workspace with its own source roots; remove --project."
+    );
+  }
+  const workspaces = await loadPortfolioConfig(ctx.portfolioConfigPath);
+  const rollup = [];
+  for (const ws of workspaces) {
+    const label = ws.label ?? ws.path;
+    try {
+      const result = await computeRefresh(
+        { ...options, portfolio: false },
+        { ...ctx, cwd: ws.path }
+      );
+      rollup.push({ label, path: ws.path, status: "ok", result });
+      if (options.json !== true) {
+        console.log(`
+## ${label} (${ws.path})`);
+        printRefreshSummary(result);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      rollup.push({ label, path: ws.path, status: "failed", error: message });
+      if (options.json !== true) {
+        console.log(`
+## ${label} (${ws.path})`);
+        console.log(`  failed: ${message}`);
+      }
+    }
+  }
+  if (options.json === true) {
+    console.log(JSON.stringify({ portfolio: true, workspaces: rollup }));
+  } else {
+    const failed = rollup.filter((r) => r.status === "failed").length;
+    const ok = rollup.length - failed;
+    console.log(
+      `
+portfolio: ${ok}/${rollup.length} refreshed${failed > 0 ? `, ${failed} failed` : ""}.`
+    );
+  }
+  if (rollup.some((r) => r.status === "failed")) process.exitCode = 1;
+}
 async function doRunRefreshWatch(options, ctx) {
   if (options.dryRun === true) throw new Error("--watch cannot be combined with --dry-run.");
   if (options.json === true) throw new Error("--watch cannot be combined with --json.");
   if (options.force === true) throw new Error("--watch cannot be combined with --force.");
   const cwd = ctx.cwd ?? process.cwd();
-  const repositoryRoot = await resolveRepositoryRootForRefresh(cwd);
-  const paths = basouPaths7(repositoryRoot);
-  await assertWorkspaceInitialized6(paths.root);
+  const repositoryRoot = await resolveBasouRootForCommand(cwd, "refresh");
+  const paths = basouPaths8(repositoryRoot);
+  await assertWorkspaceInitialized7(paths.root);
   const intervalMs = (options.interval ?? DEFAULT_WATCH_INTERVAL_SEC) * 1e3;
   const controller = new AbortController();
   const onSignal = () => controller.abort();
@@ -2322,7 +2576,9 @@ async function doRunRefreshWatch(options, ctx) {
   process.on("SIGTERM", onSignal);
   try {
     await runRefreshWatch({
-      ctx,
+      // Watch from a workspace view: import from the resolved planning repo, not
+      // the raw (non-git) view cwd — mirrors the redirect in computeRefresh.
+      ctx: { ...ctx, cwd: repositoryRoot },
       paths,
       intervalMs,
       importOptions: options.project !== void 0 && options.project.length > 0 ? { project: options.project } : {},
@@ -2336,22 +2592,27 @@ async function doRunRefreshWatch(options, ctx) {
     process.off("SIGTERM", onSignal);
   }
 }
-async function doRunRefresh(options, ctx) {
+async function computeRefresh(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
-  const repositoryRoot = await resolveRepositoryRootForRefresh(cwd);
-  const paths = basouPaths7(repositoryRoot);
-  await assertWorkspaceInitialized6(paths.root);
+  const repositoryRoot = await resolveBasouRootForCommand(cwd, "refresh");
+  const paths = basouPaths8(repositoryRoot);
+  await assertWorkspaceInitialized7(paths.root);
   const nowIso = (ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()).toISOString();
-  const result = await refreshAll({
+  return refreshAll({
     options: {
       ...options.project !== void 0 && options.project.length > 0 ? { project: options.project } : {},
       ...options.force === true ? { force: true } : {},
       ...options.dryRun === true ? { dryRun: true } : {}
     },
-    ctx,
+    // Import from the resolved repo root, not the raw cwd: a workspace-view cwd
+    // redirects to its planning repo, and the import must run there too.
+    ctx: { ...ctx, cwd: repositoryRoot },
     paths,
     nowIso
   });
+}
+async function doRunRefresh(options, ctx) {
+  const result = await computeRefresh(options, ctx);
   if (options.json === true) {
     console.log(JSON.stringify(result));
   } else {
@@ -2387,24 +2648,19 @@ function printRefreshSummary(result) {
   } else {
     console.log(`decisions: skipped (${result.decisions.reason})`);
   }
-}
-async function resolveRepositoryRootForRefresh(cwd) {
-  try {
-    return await resolveRepositoryRoot8(cwd);
-  } catch (error) {
-    if (error instanceof Error && error.message === "Not a git repository") {
-      throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou refresh'.", {
-        cause: error
-      });
-    }
-    throw error;
+  if (result.orientation.status === "generated") {
+    console.log(
+      `orientation: regenerated (in-flight: ${result.orientation.inFlightTaskCount}, pending approvals: ${result.orientation.pendingApprovalsCount}, suspect: ${result.orientation.suspectCount})`
+    );
+  } else {
+    console.log(`orientation: skipped (${result.orientation.reason})`);
   }
 }
-async function assertWorkspaceInitialized6(basouRoot) {
+async function assertWorkspaceInitialized7(basouRoot) {
   try {
-    await assertBasouRootSafe7(basouRoot);
+    await assertBasouRootSafe8(basouRoot);
   } catch (error) {
-    if (findErrorCode7(error, "ENOENT")) {
+    if (findErrorCode8(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -2412,14 +2668,14 @@ async function assertWorkspaceInitialized6(basouRoot) {
 }
 
 // src/commands/report.ts
-import { isAbsolute, resolve as resolve3 } from "path";
+import { isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
 import {
-  assertBasouRootSafe as assertBasouRootSafe8,
-  basouPaths as basouPaths8,
-  findErrorCode as findErrorCode8,
+  assertBasouRootSafe as assertBasouRootSafe9,
+  basouPaths as basouPaths9,
+  findErrorCode as findErrorCode9,
   renderReport,
-  resolveRepositoryRoot as resolveRepositoryRoot9,
-  writeMarkdownFile as writeMarkdownFile4
+  resolveRepositoryRoot as resolveRepositoryRoot8,
+  writeMarkdownFile as writeMarkdownFile5
 } from "@basou/core";
 function registerReportCommand(program2) {
   const report = program2.command("report").description(
@@ -2440,8 +2696,8 @@ async function runReportGenerate(options, ctx = {}) {
 async function doRunReportGenerate(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForReport(cwd);
-  const paths = basouPaths8(repositoryRoot);
-  await assertWorkspaceInitialized7(paths.root);
+  const paths = basouPaths9(repositoryRoot);
+  await assertWorkspaceInitialized8(paths.root);
   const nowIso = (ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const result = await renderReport({
     paths,
@@ -2452,8 +2708,8 @@ async function doRunReportGenerate(options, ctx) {
     onTaskSkip: (taskId, reason) => printTaskSkip(taskId, reason)
   });
   if (options.out !== void 0) {
-    const outPath = isAbsolute(options.out) ? options.out : resolve3(cwd, options.out);
-    await writeMarkdownFile4(outPath, result.body);
+    const outPath = isAbsolute2(options.out) ? options.out : resolve4(cwd, options.out);
+    await writeMarkdownFile5(outPath, result.body);
     const { sessions, decisions, tasks } = result.data;
     console.error(
       `Wrote report to ${options.out} (sessions: ${sessions.total}, decisions: ${decisions.count}, tasks: ${tasks.total})`
@@ -2467,7 +2723,7 @@ async function doRunReportGenerate(options, ctx) {
 }
 async function resolveRepositoryRootForReport(cwd) {
   try {
-    return await resolveRepositoryRoot9(cwd);
+    return await resolveRepositoryRoot8(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error(
@@ -2478,11 +2734,11 @@ async function resolveRepositoryRootForReport(cwd) {
     throw error;
   }
 }
-async function assertWorkspaceInitialized7(basouRoot) {
+async function assertWorkspaceInitialized8(basouRoot) {
   try {
-    await assertBasouRootSafe8(basouRoot);
+    await assertBasouRootSafe9(basouRoot);
   } catch (error) {
-    if (findErrorCode8(error, "ENOENT")) {
+    if (findErrorCode9(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -2491,12 +2747,12 @@ async function assertWorkspaceInitialized7(basouRoot) {
 
 // src/commands/run.ts
 import { mkdir as mkdir2 } from "fs/promises";
-import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
 import {
   acquireLock as acquireLock4,
-  assertBasouRootSafe as assertBasouRootSafe9,
-  basouPaths as basouPaths9,
+  assertBasouRootSafe as assertBasouRootSafe10,
+  basouPaths as basouPaths10,
   ChildProcessRunner as ChildProcessRunner2,
   claudeCodeAdapterMetadata,
   appendChainedEvent as coreAppendChainedEvent2,
@@ -2506,9 +2762,9 @@ import {
   overwriteYamlFile as overwriteYamlFile2,
   prefixedUlid as prefixedUlid4,
   readManifest as readManifest4,
-  readYamlFile as readYamlFile3,
+  readYamlFile as readYamlFile4,
   resolveClaudeCodeCommand,
-  resolveRepositoryRoot as resolveRepositoryRoot10,
+  resolveRepositoryRoot as resolveRepositoryRoot9,
   SessionSchema as SessionSchema2,
   sanitizeRelatedFiles,
   sanitizeWorkingDirectory as sanitizeWorkingDirectory2,
@@ -2541,17 +2797,17 @@ async function runClaudeCode(args, options, ctx = {}) {
   const { command } = await resolveCommand();
   const cwd = options.cwd ?? process.cwd();
   const repoRoot = await resolveRepositoryRootForRun(cwd);
-  const paths = basouPaths9(repoRoot);
-  await assertBasouRootSafe9(paths.root);
+  const paths = basouPaths10(repoRoot);
+  await assertBasouRootSafe10(paths.root);
   const manifest = await readManifest4(paths);
   const sessionId = prefixedUlid4("ses");
-  const sessionDir = join5(paths.sessions, sessionId);
+  const sessionDir = join6(paths.sessions, sessionId);
   await mkdir2(sessionDir, { recursive: true });
   const appendEvent = ctx.appendEvent ?? (async (_sessionDir, event) => {
     await coreAppendChainedEvent2(paths, sessionId, event);
   });
   const startedAt = now().toISOString();
-  const sessionYamlPath = join5(sessionDir, "session.yaml");
+  const sessionYamlPath = join6(sessionDir, "session.yaml");
   const session = buildInitialSession2({
     id: sessionId,
     command,
@@ -2677,7 +2933,7 @@ async function runClaudeCode(args, options, ctx = {}) {
   const rawRelated = computeRelatedFiles(preSnapshot, postSnapshot, diff);
   const relatedFiles = sanitizeRelatedFiles(rawRelated, {
     workingDirectory: repoRoot,
-    homedir: homedir4()
+    homedir: homedir5()
   }).sanitized;
   const finalStatus = decideFinalStatus2(result, signalReceived);
   await appendEvent(sessionDir, {
@@ -2821,7 +3077,7 @@ function buildInitialSession2(input) {
       source: { ...claudeCodeAdapterMetadata },
       started_at: input.startedAt,
       status: "initialized",
-      working_directory: sanitizeWorkingDirectory2(input.cwd, { homedir: homedir4() }),
+      working_directory: sanitizeWorkingDirectory2(input.cwd, { homedir: homedir5() }),
       invocation: {
         command: input.command,
         args: [...input.args],
@@ -2833,7 +3089,7 @@ function buildInitialSession2(input) {
   };
 }
 async function mutateSessionYaml2(filePath, mutator) {
-  const raw = await readYamlFile3(filePath);
+  const raw = await readYamlFile4(filePath);
   const parsed = SessionSchema2.parse(raw);
   mutator(parsed);
   const validated = SessionSchema2.parse(parsed);
@@ -2881,7 +3137,7 @@ async function finalizeSessionAsFailed2(paths, sessionDir, sessionId, appendEven
 }
 async function resolveRepositoryRootForRun(cwd) {
   try {
-    return await resolveRepositoryRoot10(cwd);
+    return await resolveRepositoryRoot9(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou run'.", {
@@ -2894,21 +3150,21 @@ async function resolveRepositoryRootForRun(cwd) {
 
 // src/commands/session.ts
 import { readFile as readFile2 } from "fs/promises";
-import { basename as basename3, isAbsolute as isAbsolute2, join as join6, relative as relative2 } from "path";
+import { basename as basename3, isAbsolute as isAbsolute3, join as join7, relative as relative2 } from "path";
 import {
   acquireLock as acquireLock5,
   appendEventToExistingSession as appendEventToExistingSession2,
-  assertBasouRootSafe as assertBasouRootSafe10,
-  basouPaths as basouPaths10,
+  assertBasouRootSafe as assertBasouRootSafe11,
+  basouPaths as basouPaths11,
   enumerateSessionDirs as enumerateSessionDirs2,
-  findErrorCode as findErrorCode9,
+  findErrorCode as findErrorCode10,
   importSessionFromJson as importSessionFromJson2,
   loadSessionEntries,
   readAllEvents,
   readManifest as readManifest5,
-  readYamlFile as readYamlFile4,
+  readYamlFile as readYamlFile5,
   rechainSessionInPlace,
-  resolveRepositoryRoot as resolveRepositoryRoot11,
+  resolveRepositoryRoot as resolveRepositoryRoot10,
   resolveSessionId as resolveSessionId2,
   resolveTaskId,
   SessionImportPayloadSchema as SessionImportPayloadSchema2,
@@ -2965,8 +3221,8 @@ async function runSessionList(options, ctx = {}) {
 async function doRunSessionList(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "list");
-  const paths = basouPaths10(repositoryRoot);
-  await assertWorkspaceInitialized8(paths.root);
+  const paths = basouPaths11(repositoryRoot);
+  await assertWorkspaceInitialized9(paths.root);
   const now = /* @__PURE__ */ new Date();
   const records = (await loadSessionEntries(paths, {
     now,
@@ -3017,17 +3273,17 @@ async function runSessionShow(idInput, options, ctx = {}) {
 async function doRunSessionShow(idInput, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "show");
-  const paths = basouPaths10(repositoryRoot);
-  await assertWorkspaceInitialized8(paths.root);
+  const paths = basouPaths11(repositoryRoot);
+  await assertWorkspaceInitialized9(paths.root);
   const sessionId = await resolveSessionId2(paths, idInput);
-  const sessionDir = join6(paths.sessions, sessionId);
-  const sessionYamlPath = join6(sessionDir, "session.yaml");
+  const sessionDir = join7(paths.sessions, sessionId);
+  const sessionYamlPath = join7(sessionDir, "session.yaml");
   let session;
   try {
-    const raw = await readYamlFile4(sessionYamlPath);
+    const raw = await readYamlFile5(sessionYamlPath);
     session = SessionSchema3.parse(raw);
   } catch (error) {
-    if (findErrorCode9(error, "ENOENT")) {
+    if (findErrorCode10(error, "ENOENT")) {
       throw new Error(`Session not found: ${idInput}`);
     }
     throw new Error("Failed to read session", { cause: error });
@@ -3142,7 +3398,7 @@ function formatSessionWork(session, events, now) {
 }
 function formatWorkingDir(workingDir, repositoryRoot, options) {
   if (options.fullPath === true) return workingDir;
-  if (!isAbsolute2(workingDir)) {
+  if (!isAbsolute3(workingDir)) {
     if (workingDir === ".") return "<repository_root>";
     return workingDir;
   }
@@ -3262,7 +3518,7 @@ function maxLen2(values, floor) {
 }
 async function resolveRepositoryRootForSession(cwd, subcmd) {
   try {
-    return await resolveRepositoryRoot11(cwd);
+    return await resolveRepositoryRoot10(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error(
@@ -3273,11 +3529,11 @@ async function resolveRepositoryRootForSession(cwd, subcmd) {
     throw error;
   }
 }
-async function assertWorkspaceInitialized8(basouRoot) {
+async function assertWorkspaceInitialized9(basouRoot) {
   try {
-    await assertBasouRootSafe10(basouRoot);
+    await assertBasouRootSafe11(basouRoot);
   } catch (error) {
-    if (findErrorCode9(error, "ENOENT")) {
+    if (findErrorCode10(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -3315,8 +3571,8 @@ async function runSessionImport(options, ctx = {}) {
 async function doRunSessionImport(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "import");
-  const paths = basouPaths10(repositoryRoot);
-  await assertWorkspaceInitialized8(paths.root);
+  const paths = basouPaths11(repositoryRoot);
+  await assertWorkspaceInitialized9(paths.root);
   const manifest = await readManifest5(paths);
   const rawBody = await readInputFile(options.from);
   const json = parseJsonStrict(rawBody);
@@ -3346,10 +3602,10 @@ async function readInputFile(path) {
   try {
     return await readFile2(path, "utf8");
   } catch (error) {
-    if (findErrorCode9(error, "ENOENT")) {
+    if (findErrorCode10(error, "ENOENT")) {
       throw new Error("Import source not found", { cause: error });
     }
-    if (findErrorCode9(error, "EISDIR")) {
+    if (findErrorCode10(error, "EISDIR")) {
       throw new Error("Import source is not a file", { cause: error });
     }
     throw new Error("Failed to read import source", { cause: error });
@@ -3429,8 +3685,8 @@ async function doRunSessionNote(sessionIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "note");
-  const paths = basouPaths10(repositoryRoot);
-  await assertWorkspaceInitialized8(paths.root);
+  const paths = basouPaths11(repositoryRoot);
+  await assertWorkspaceInitialized9(paths.root);
   const sessionId = await resolveSessionId2(paths, sessionIdInput);
   const body = hasBody ? options.body : await readNoteFile(options.fromFile);
   if (body.length === 0) {
@@ -3463,10 +3719,10 @@ async function readNoteFile(path) {
   try {
     return await readFile2(path, "utf8");
   } catch (error) {
-    if (findErrorCode9(error, "ENOENT")) {
+    if (findErrorCode10(error, "ENOENT")) {
       throw new Error("Note source not found", { cause: error });
     }
-    if (findErrorCode9(error, "EISDIR")) {
+    if (findErrorCode10(error, "EISDIR")) {
       throw new Error("Note source is not a file", { cause: error });
     }
     throw new Error("Failed to read note source", { cause: error });
@@ -3511,8 +3767,8 @@ async function doRunSessionRechain(options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "rechain");
-  const paths = basouPaths10(repositoryRoot);
-  await assertWorkspaceInitialized8(paths.root);
+  const paths = basouPaths11(repositoryRoot);
+  await assertWorkspaceInitialized9(paths.root);
   const sessionIds = options.session !== void 0 ? [await resolveSessionId2(paths, options.session)] : await enumerateSessionDirs2(paths);
   const dryRun = options.dryRun === true;
   const rows = [];
@@ -3565,11 +3821,11 @@ function renderRechainRow(row, dryRun) {
 
 // src/commands/stats.ts
 import {
-  assertBasouRootSafe as assertBasouRootSafe11,
-  basouPaths as basouPaths11,
+  assertBasouRootSafe as assertBasouRootSafe12,
+  basouPaths as basouPaths12,
   computeWorkStats,
-  findErrorCode as findErrorCode10,
-  resolveRepositoryRoot as resolveRepositoryRoot12
+  findErrorCode as findErrorCode11,
+  resolveRepositoryRoot as resolveRepositoryRoot11
 } from "@basou/core";
 function registerStatsCommand(program2) {
   program2.command("stats").description("Report how much the AI worked (output volume + time proxies) across sessions").option("--by-source", "Break the totals down by session source kind").option("--by-day", "Break billable time and volume down by calendar day").option("--json", "Output the full stats as JSON").option("-v, --verbose", "Show error causes").action(async (options) => {
@@ -3587,8 +3843,8 @@ async function runStats(options, ctx = {}) {
 async function doRunStats(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForStats(cwd);
-  const paths = basouPaths11(repositoryRoot);
-  await assertWorkspaceInitialized9(paths.root);
+  const paths = basouPaths12(repositoryRoot);
+  await assertWorkspaceInitialized10(paths.root);
   const now = ctx.nowProvider?.() ?? /* @__PURE__ */ new Date();
   const result = await computeWorkStats({
     paths,
@@ -3672,7 +3928,7 @@ function formatInt(n) {
 }
 async function resolveRepositoryRootForStats(cwd) {
   try {
-    return await resolveRepositoryRoot12(cwd);
+    return await resolveRepositoryRoot11(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou stats'.", {
@@ -3682,11 +3938,11 @@ async function resolveRepositoryRootForStats(cwd) {
     throw error;
   }
 }
-async function assertWorkspaceInitialized9(basouRoot) {
+async function assertWorkspaceInitialized10(basouRoot) {
   try {
-    await assertBasouRootSafe11(basouRoot);
+    await assertBasouRootSafe12(basouRoot);
   } catch (error) {
-    if (findErrorCode10(error, "ENOENT")) {
+    if (findErrorCode11(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -3695,12 +3951,12 @@ async function assertWorkspaceInitialized9(basouRoot) {
 
 // src/commands/status.ts
 import {
-  assertBasouRootSafe as assertBasouRootSafe12,
-  basouPaths as basouPaths12,
+  assertBasouRootSafe as assertBasouRootSafe13,
+  basouPaths as basouPaths13,
   buildStatusSnapshot,
-  findErrorCode as findErrorCode11,
+  findErrorCode as findErrorCode12,
   readManifest as readManifest6,
-  resolveRepositoryRoot as resolveRepositoryRoot13,
+  resolveRepositoryRoot as resolveRepositoryRoot12,
   writeStatus
 } from "@basou/core";
 function registerStatusCommand(program2) {
@@ -3719,11 +3975,11 @@ async function runStatus(options, ctx = {}) {
 async function doRunStatus(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForStatus(cwd);
-  const paths = basouPaths12(repositoryRoot);
+  const paths = basouPaths13(repositoryRoot);
   try {
-    await assertBasouRootSafe12(paths.root);
+    await assertBasouRootSafe13(paths.root);
   } catch (error) {
-    if (findErrorCode11(error, "ENOENT")) {
+    if (findErrorCode12(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -3732,7 +3988,7 @@ async function doRunStatus(options, ctx) {
   try {
     manifest = await readManifest6(paths);
   } catch (error) {
-    if (findErrorCode11(error, "ENOENT")) {
+    if (findErrorCode12(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw new Error("Failed to read workspace manifest", { cause: error });
@@ -3756,7 +4012,7 @@ function renderTextStatus(s) {
 }
 async function resolveRepositoryRootForStatus(cwd) {
   try {
-    return await resolveRepositoryRoot13(cwd);
+    return await resolveRepositoryRoot12(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou status'.", {
@@ -3769,16 +4025,16 @@ async function resolveRepositoryRootForStatus(cwd) {
 
 // src/commands/task.ts
 import { readFile as readFile3 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import {
   archiveTask,
-  assertBasouRootSafe as assertBasouRootSafe13,
-  basouPaths as basouPaths13,
+  assertBasouRootSafe as assertBasouRootSafe14,
+  basouPaths as basouPaths14,
   createTaskWithEvent,
   deleteTask,
   editTask,
   enumerateArchivedTaskIds,
-  findErrorCode as findErrorCode12,
+  findErrorCode as findErrorCode13,
   loadSessionEntries as loadSessionEntries2,
   loadTaskEntries,
   prefixedUlid as prefixedUlid5,
@@ -3789,7 +4045,7 @@ import {
   reconcileTask,
   refreshTaskLinkedSessions,
   replayEvents as replayEvents2,
-  resolveRepositoryRoot as resolveRepositoryRoot14,
+  resolveRepositoryRoot as resolveRepositoryRoot13,
   resolveSessionId as resolveSessionId3,
   resolveTaskId as resolveTaskId2,
   TaskStatusSchema,
@@ -3875,8 +4131,8 @@ async function doRunTaskNew(options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "new");
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const description = options.description !== void 0 ? options.description : options.fromFile !== void 0 ? await readDescriptionFile(options.fromFile) : "";
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
   const occurredAt = now.toISOString();
@@ -3984,8 +4240,8 @@ async function runTaskList(options, ctx = {}) {
 async function doRunTaskList(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "list");
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const entries = await loadTaskEntries(paths, {
     onSkip: (id, reason) => printTaskSkip(id, reason)
   });
@@ -4088,15 +4344,15 @@ async function runTaskShow(idInput, options, ctx = {}) {
 async function doRunTaskShow(idInput, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "show");
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const taskId = await resolveTaskId2(paths, idInput, { includeArchived: true });
   const { doc, archived } = await readTaskFileWithArchiveFallback(paths, taskId);
   const sessions = await loadSessionEntries2(paths, { now: /* @__PURE__ */ new Date() });
   const events = [];
   const linkedSessionIds = new Set(doc.task.task.linked_sessions);
   for (const s of sessions) {
-    const sessionDir = join7(paths.sessions, s.sessionId);
+    const sessionDir = join8(paths.sessions, s.sessionId);
     try {
       for await (const ev of replayEvents2(sessionDir, {
         onWarning: (w) => printReplayWarning(w, s.sessionId)
@@ -4232,8 +4488,8 @@ async function doRunTaskStatus(taskIdInput, newStatusInput, options, ctx) {
   const newStatus = parseTaskStatusPositional(newStatusInput);
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "status");
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
   const occurredAt = now.toISOString();
@@ -4309,8 +4565,8 @@ async function runTaskReconcile(options, ctx = {}) {
 async function doRunTaskReconcile(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "reconcile");
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const manifest = await readManifest7(paths);
   const nowProvider = ctx.nowProvider ?? (() => /* @__PURE__ */ new Date());
   const write = options.write === true;
@@ -4489,8 +4745,8 @@ async function doRunTaskRefreshLinkage(taskIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "refresh-linkage");
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const manifest = await readManifest7(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   const nowProvider = ctx.nowProvider ?? (() => /* @__PURE__ */ new Date());
@@ -4569,8 +4825,8 @@ async function doRunTaskEdit(taskIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "edit");
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const manifest = await readManifest7(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
@@ -4625,8 +4881,8 @@ async function doRunTaskDelete(taskIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "delete");
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const manifest = await readManifest7(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   if (options.yes !== true) {
@@ -4670,8 +4926,8 @@ async function doRunTaskArchive(taskIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "archive");
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const manifest = await readManifest7(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   if (options.yes !== true) {
@@ -4786,10 +5042,10 @@ async function readDescriptionFile(path) {
   try {
     return await readFile3(path, "utf8");
   } catch (error) {
-    if (findErrorCode12(error, "ENOENT")) {
+    if (findErrorCode13(error, "ENOENT")) {
       throw new Error("Description source not found", { cause: error });
     }
-    if (findErrorCode12(error, "EISDIR")) {
+    if (findErrorCode13(error, "EISDIR")) {
       throw new Error("Description source is not a file", { cause: error });
     }
     throw new Error("Failed to read description source", { cause: error });
@@ -4797,7 +5053,7 @@ async function readDescriptionFile(path) {
 }
 async function resolveRepositoryRootForTask(cwd, subcmd) {
   try {
-    return await resolveRepositoryRoot14(cwd);
+    return await resolveRepositoryRoot13(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error(
@@ -4808,11 +5064,11 @@ async function resolveRepositoryRootForTask(cwd, subcmd) {
     throw error;
   }
 }
-async function assertWorkspaceInitialized10(basouRoot) {
+async function assertWorkspaceInitialized11(basouRoot) {
   try {
-    await assertBasouRootSafe13(basouRoot);
+    await assertBasouRootSafe14(basouRoot);
   } catch (error) {
-    if (findErrorCode12(error, "ENOENT")) {
+    if (findErrorCode13(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -4900,11 +5156,11 @@ function maxLen3(values, floor) {
 
 // src/commands/verify.ts
 import {
-  assertBasouRootSafe as assertBasouRootSafe14,
-  basouPaths as basouPaths14,
+  assertBasouRootSafe as assertBasouRootSafe15,
+  basouPaths as basouPaths15,
   enumerateSessionDirs as enumerateSessionDirs3,
-  findErrorCode as findErrorCode13,
-  resolveRepositoryRoot as resolveRepositoryRoot15,
+  findErrorCode as findErrorCode14,
+  resolveRepositoryRoot as resolveRepositoryRoot14,
   resolveSessionId as resolveSessionId4,
   verifyEventsChain
 } from "@basou/core";
@@ -4927,8 +5183,8 @@ async function doRunVerify(options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForVerify(cwd);
-  const paths = basouPaths14(repositoryRoot);
-  await assertWorkspaceInitialized11(paths.root);
+  const paths = basouPaths15(repositoryRoot);
+  await assertWorkspaceInitialized12(paths.root);
   const sessionIds = options.session !== void 0 ? [await resolveSessionId4(paths, options.session)] : await enumerateSessionDirs3(paths);
   const rows = [];
   for (const sessionId of sessionIds) {
@@ -4975,7 +5231,7 @@ function renderVerdict(row) {
 }
 async function resolveRepositoryRootForVerify(cwd) {
   try {
-    return await resolveRepositoryRoot15(cwd);
+    return await resolveRepositoryRoot14(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou verify'.", {
@@ -4985,11 +5241,11 @@ async function resolveRepositoryRootForVerify(cwd) {
     throw error;
   }
 }
-async function assertWorkspaceInitialized11(basouRoot) {
+async function assertWorkspaceInitialized12(basouRoot) {
   try {
-    await assertBasouRootSafe14(basouRoot);
+    await assertBasouRootSafe15(basouRoot);
   } catch (error) {
-    if (findErrorCode13(error, "ENOENT")) {
+    if (findErrorCode14(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -4998,27 +5254,162 @@ async function assertWorkspaceInitialized11(basouRoot) {
 
 // src/commands/view.ts
 import { spawn } from "child_process";
-import { assertBasouRootSafe as assertBasouRootSafe15, basouPaths as basouPaths15, findErrorCode as findErrorCode15, resolveRepositoryRoot as resolveRepositoryRoot16 } from "@basou/core";
+import { createHash } from "crypto";
+import { basename as basename4, resolve as resolve6 } from "path";
+import {
+  assertBasouRootSafe as assertBasouRootSafe16,
+  basouPaths as basouPaths16,
+  findErrorCode as findErrorCode16,
+  readManifest as readManifest10,
+  resolveRepositoryRoot as resolveRepositoryRoot15
+} from "@basou/core";
 import { InvalidArgumentError as InvalidArgumentError5 } from "commander";
 
+// src/lib/portfolio-safety.ts
+import { execFile } from "child_process";
+import { lstat, realpath } from "fs/promises";
+import { isAbsolute as isAbsolute4, join as join9, relative as relative3, resolve as resolve5 } from "path";
+import { promisify } from "util";
+import { readManifest as readManifest8 } from "@basou/core";
+var execFileAsync = promisify(execFile);
+function errorCode(error) {
+  return error instanceof Error ? error.code : void 0;
+}
+async function canonical(p) {
+  try {
+    return await realpath(p);
+  } catch {
+    return resolve5(p);
+  }
+}
+function isInside(child, parent) {
+  const rel = relative3(parent, child);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
+}
+function isBasouPath(p) {
+  return p === ".basou" || p.startsWith(".basou/") || p.includes("/.basou/") || p.endsWith("/.basou");
+}
+async function inspectRepo(repoPath) {
+  let hasEntry = false;
+  try {
+    await lstat(join9(repoPath, ".basou"));
+    hasEntry = true;
+  } catch (error) {
+    if (errorCode(error) !== "ENOENT") {
+      return {
+        kind: "unverifiable",
+        detail: `could not check for a .basou here (${errorCode(error) ?? "unknown error"}) \u2014 treat as unsafe`
+      };
+    }
+  }
+  try {
+    const { stdout } = await execFileAsync("git", ["-C", repoPath, "ls-files", "-z"]);
+    const tracked = stdout.split("\0").some((f) => f.length > 0 && isBasouPath(f));
+    if (tracked) {
+      return {
+        kind: "footprint",
+        detail: "a .basou/ entry is tracked by git here and would be pushed"
+      };
+    }
+  } catch {
+  }
+  if (hasEntry) return { kind: "footprint", detail: "a .basou/ entry exists here" };
+  return null;
+}
+async function checkPortfolioSafety(workspaces) {
+  const findings = [];
+  let monitoredReposChecked = 0;
+  for (const ws of workspaces) {
+    const wsReal = await canonical(ws.repoRoot);
+    let sourceRoots = [];
+    try {
+      const manifest = await readManifest8(ws.paths);
+      sourceRoots = manifest.import?.source_roots ?? [];
+    } catch (error) {
+      if (error instanceof Error && error.message === "YAML file not found") {
+        sourceRoots = [];
+      } else {
+        findings.push({
+          workspaceLabel: ws.label,
+          workspaceRoot: ws.repoRoot,
+          monitoredRepo: ws.repoRoot,
+          kind: "unverifiable",
+          detail: "the workspace manifest is present but unreadable \u2014 cannot determine which repos it monitors; treat as unsafe"
+        });
+        continue;
+      }
+    }
+    const monitored = /* @__PURE__ */ new Map();
+    for (const root of sourceRoots) {
+      const display = resolve5(ws.repoRoot, root);
+      const real = await canonical(display);
+      if (real !== wsReal) monitored.set(real, display);
+    }
+    for (const [real, display] of monitored) {
+      monitoredReposChecked++;
+      if (isInside(wsReal, real)) {
+        findings.push({
+          workspaceLabel: ws.label,
+          workspaceRoot: ws.repoRoot,
+          monitoredRepo: display,
+          kind: "overlap",
+          detail: "the workspace (where .basou/ is written) is inside this monitored repo"
+        });
+      }
+      const inspection = await inspectRepo(real);
+      if (inspection !== null) {
+        findings.push({
+          workspaceLabel: ws.label,
+          workspaceRoot: ws.repoRoot,
+          monitoredRepo: display,
+          kind: inspection.kind,
+          detail: inspection.detail
+        });
+      }
+    }
+  }
+  return { findings, workspacesChecked: workspaces.length, monitoredReposChecked };
+}
+function formatSafetyReport(result) {
+  if (result.findings.length === 0) {
+    if (result.monitoredReposChecked === 0) {
+      return [
+        `Portfolio safety: OK. ${result.workspacesChecked} workspace(s) checked \u2014 no monitored repos configured (portfolio safety applies when a workspace imports from sibling repos via source_roots).`
+      ];
+    }
+    return [
+      `Portfolio safety: OK. ${result.workspacesChecked} workspace(s), ${result.monitoredReposChecked} monitored repo(s) checked \u2014 no .basou footprint, no overlap.`
+    ];
+  }
+  const lines = [`Portfolio safety: DANGER \u2014 ${result.findings.length} finding(s):`];
+  for (const f of result.findings) {
+    lines.push(`  [${f.kind}] ${f.monitoredRepo} (workspace "${f.workspaceLabel}"): ${f.detail}`);
+  }
+  lines.push(
+    "A monitored repo must have no basou footprint. Use a separate workspace repo whose source_roots point at the monitored repo as a sibling; never 'basou init' / 'run' / 'exec' inside a monitored repo."
+  );
+  return lines;
+}
+
 // src/lib/view-server.ts
 import { createServer } from "http";
-import { join as join8 } from "path";
+import { join as join10 } from "path";
 import {
   computeWorkStats as computeWorkStats2,
   enumerateApprovals as enumerateApprovals2,
-  findErrorCode as findErrorCode14,
+  findErrorCode as findErrorCode15,
   isLazyExpired as isLazyExpired2,
   loadApproval as loadApproval2,
   loadSessionEntries as loadSessionEntries3,
   loadTaskEntries as loadTaskEntries2,
   readAllEvents as readAllEvents2,
-  readManifest as readManifest8,
+  readManifest as readManifest9,
   readMarkdownFile as readMarkdownFile4,
   readSessionYaml as readSessionYaml3,
   readTaskFile as readTaskFile2,
   renderDecisions as renderDecisions3,
-  renderHandoff as renderHandoff3
+  renderHandoff as renderHandoff3,
+  summarizeOrientation
 } from "@basou/core";
 
 // src/lib/view-ui.ts
@@ -5040,8 +5431,13 @@ var VIEW_HTML = `<!doctype html>
   button.primary { background: #2563eb; color: #fff; border-color: #2563eb; }
   button:disabled { opacity: .5; cursor: default; }
   label.chk { font-size: 13px; opacity: .85; }
+  /* On the portfolio landing there is no selected workspace, so the per-workspace action bar is hidden. */
+  body.landing #project, body.landing label.chk,
+  body.landing #btn-refresh, body.landing #btn-import-claude, body.landing #btn-import-codex,
+  body.landing #btn-gen-handoff, body.landing #btn-gen-decisions { display: none; }
   #status { padding: 6px 16px; font-size: 13px; min-height: 20px; border-bottom: 1px solid #8884; white-space: pre-wrap; }
   #status.err { color: #dc2626; }
+  .err { color: #dc2626; }
   nav { display: flex; gap: 2px; padding: 6px 12px; border-bottom: 1px solid #8884; flex-wrap: wrap; }
   nav button { border: none; border-radius: 6px; background: transparent; }
   nav button.active { background: #2563eb22; font-weight: 600; }
@@ -5055,6 +5451,8 @@ var VIEW_HTML = `<!doctype html>
   #detail { padding: 12px 16px; overflow: auto; max-height: 80vh; }
   .badge { display: inline-block; padding: 0 6px; border-radius: 6px; background: #8882; font-size: 12px; }
   .badge.warn { background: #f59e0b33; }
+  .badge.danger { background: #ef444433; }
+  .badge.ok { background: #22c55e33; }
   pre { background: #8881; padding: 12px; border-radius: 8px; overflow: auto; white-space: pre-wrap; word-break: break-word; }
   table.kv { border-collapse: collapse; }
   table.kv td { padding: 2px 10px 2px 0; vertical-align: top; }
@@ -5063,6 +5461,11 @@ var VIEW_HTML = `<!doctype html>
   .card { border: 1px solid #8884; border-radius: 8px; padding: 10px 14px; min-width: 120px; }
   .card .n { font-size: 22px; font-weight: 700; }
   .card .l { font-size: 12px; opacity: .7; }
+  .pcard { min-width: 240px; max-width: 340px; }
+  .pcard.open { cursor: pointer; }
+  .pcard.open:hover { background: #8881; }
+  .pcard .l { font-size: 14px; font-weight: 700; opacity: 1; margin-bottom: 4px; }
+  .pcard .f { font-size: 13px; }
   .tl { border-left: 2px solid #8885; margin-left: 6px; padding-left: 12px; }
   .tl .ev { margin-bottom: 8px; }
   .tl .ev .t { font-size: 12px; opacity: .65; }
@@ -5072,6 +5475,7 @@ var VIEW_HTML = `<!doctype html>
 <body>
 <header>
   <h1>basou view</h1>
+  <button id="btn-back" style="display:none">&larr; portfolio</button>
   <input type="text" id="project" placeholder="source root (optional override)" />
   <button class="primary" id="btn-refresh">Refresh all</button>
   <button id="btn-import-claude">Import claude-code</button>
@@ -5091,7 +5495,12 @@ var VIEW_HTML = `<!doctype html>
 <script>
 (function () {
   var TABS = ['overview', 'stats', 'sessions', 'tasks', 'decisions', 'approvals', 'handoff'];
-  var state = { tab: 'overview', repoRoot: '' };
+  // base is the API prefix for the active workspace: '/api' in single mode,
+  // '/api/ws/<key>' once a portfolio card is opened.
+  // canAct gates the mutating action bar: true only when a concrete workspace
+  // is active (single mode, or a portfolio card opened). It is the real safety
+  // guard \u2014 body.landing also hides the buttons, but that is cosmetic.
+  var state = { tab: 'overview', repoRoot: '', base: '/api', mode: 'single', wsKey: null, canAct: false };
 
   function $(id) { return document.getElementById(id); }
   function clear(node) { while (node.firstChild) node.removeChild(node.firstChild); }
@@ -5155,7 +5564,15 @@ var VIEW_HTML = `<!doctype html>
     for (var i = 0; i < ids.length; i++) $(ids[i]).disabled = busy;
   }
 
+  // Enable the action bar only when a workspace is active; disabled buttons
+  // cannot post to a stale/wrong workspace even if a CSS regression un-hides them.
+  function updateActionBar() {
+    var ids = ['btn-refresh', 'btn-import-claude', 'btn-import-codex', 'btn-gen-handoff', 'btn-gen-decisions'];
+    for (var i = 0; i < ids.length; i++) $(ids[i]).disabled = !state.canAct;
+  }
+
   function post(path, label) {
+    if (!state.canAct) { setStatus('Open a workspace first.', true); return; }
     setBusy(true);
     setStatus(label + '...', false);
     fetchJson(path, {
@@ -5188,6 +5605,155 @@ var VIEW_HTML = `<!doctype html>
     return (o.dryRun ? 'would import ' : 'imported ') + o.importedCount + ' (' + o.eventTotal + ' events)';
   }
 
+  // --- portfolio landing --------------------------------------------------
+
+  function boot() {
+    fetchJson('/api/portfolio').then(function (d) {
+      if (d && d.mode === 'portfolio') { state.mode = 'portfolio'; showLanding(d); }
+      else { enterSingle(); }
+    }).catch(function () {
+      // First-load bootstrap failure: the single-workspace view is the safe default.
+      enterSingle();
+    });
+  }
+
+  // Re-render the portfolio landing (the back button). Unlike boot(), a fetch
+  // failure here keeps the inert landing and shows an error rather than silently
+  // dropping into single mode pointed at the first workspace.
+  function backToPortfolio() {
+    enterLandingChrome();
+    fetchJson('/api/portfolio').then(function (d) {
+      if (d && d.workspaces) renderCards(d);
+      else portfolioError('Portfolio unavailable.');
+    }).catch(function (err) { portfolioError('Could not load portfolio: ' + err.message); });
+  }
+
+  function enterSingle() {
+    state.mode = 'single';
+    state.base = '/api';
+    state.wsKey = null;
+    state.canAct = true;
+    document.body.classList.remove('landing');
+    $('btn-back').style.display = 'none';
+    updateActionBar();
+    buildTabs();
+    loadTab('overview');
+  }
+
+  // Landing chrome: no workspace is active, so actions are disabled (and hidden
+  // by body.landing). The disable is the safety guard; the hide is cosmetic.
+  function enterLandingChrome() {
+    state.wsKey = null;
+    state.canAct = false;
+    document.body.classList.add('landing');
+    $('btn-back').style.display = 'none';
+    setStatus('', false);
+    clear($('tabs'));
+    updateActionBar();
+    single(true);
+  }
+
+  function showLanding(d) { enterLandingChrome(); renderCards(d); }
+
+  function renderCards(d) {
+    var detail = $('detail');
+    clear(detail);
+    var ws = d.workspaces || [];
+    detail.appendChild(el('p', { class: 'muted', text: 'Portfolio \u2014 ' + ws.length + ' workspace(s). Click a card to open it.' }));
+    var cards = el('div', { class: 'cards' }, []);
+    ws.forEach(function (w) { cards.appendChild(portfolioCard(w, d.generatedAt)); });
+    detail.appendChild(cards);
+  }
+
+  function portfolioError(msg) {
+    var detail = $('detail');
+    clear(detail);
+    detail.appendChild(el('p', { class: 'err', text: msg }));
+    detail.appendChild(el('button', { text: 'Retry', onclick: backToPortfolio }));
+  }
+
+  function highestRisk(approvals) {
+    var order = ['critical', 'high', 'medium', 'low'];
+    for (var i = 0; i < order.length; i++) {
+      for (var j = 0; j < approvals.length; j++) {
+        if (approvals[j].risk === order[i]) return order[i];
+      }
+    }
+    return approvals.length ? approvals[0].risk : '';
+  }
+
+  // Human-readable age of an ISO timestamp relative to the portfolio's
+  // generatedAt ("now"), so a stale capture reads as "3d ago" not a raw ISO.
+  function relAge(iso, nowIso) {
+    if (!iso) return '(none)';
+    var ms = Date.parse(nowIso) - Date.parse(iso);
+    if (!isFinite(ms)) return iso;
+    if (ms < 60000) return 'just now';
+    var m = Math.floor(ms / 60000); if (m < 60) return m + 'm ago';
+    var h = Math.floor(m / 60); if (h < 48) return h + 'h ago';
+    return Math.floor(h / 24) + 'd ago';
+  }
+
+  // A "run refresh" badge when a dry-run found uncaptured/changed native sessions,
+  // an "up to date" badge when the capture is current, and nothing loud when the
+  // staleness probe could not run (degrades to a quiet note).
+  function stalenessBadge(st) {
+    if (!st) return null;
+    if (!st.checked) return el('span', { class: 'badge', text: 'freshness unknown' });
+    if (st.unverifiableSessions > 0)
+      return el('span', { class: 'badge danger', text: '\u26A0 ' + st.unverifiableSessions + ' unverifiable \u2014 run verify' });
+    if (st.newSessions > 0)
+      return el('span', { class: 'badge danger', text: '\u26A0 ' + st.newSessions + ' uncaptured \u2014 run refresh' });
+    if (st.updatedSessions > 0)
+      return el('span', { class: 'badge warn', text: st.updatedSessions + ' updated \u2014 run refresh' });
+    return el('span', { class: 'badge ok', text: 'up to date' });
+  }
+
+  function portfolioCard(w, generatedAt) {
+    if (!w.initialized) {
+      return el('div', { class: 'card pcard muted' }, [
+        el('div', { class: 'l', text: w.label }),
+        el('div', { class: 'f', text: w.error ? ('unreadable: ' + w.error) : 'not initialized' })
+      ]);
+    }
+    if (w.error) {
+      return el('div', { class: 'card pcard' }, [
+        el('div', { class: 'l', text: w.label }),
+        el('div', { class: 'f' }, [el('span', { class: 'badge warn', text: 'unreadable: ' + w.error })])
+      ]);
+    }
+    var pend = w.pendingApprovals || [];
+    var pendText = 'pending ' + pend.length + (pend.length ? ' (' + highestRisk(pend) + ')' : '');
+    var now = w.latestSession ? ((w.latestSession.label || '(session)') + ' [' + w.latestSession.status + ']') : '(no live sessions)';
+    var dec = w.latestDecision ? w.latestDecision.title : '(no decisions yet)';
+    var newest = (w.freshness && w.freshness.newestStartedAt) ? w.freshness.newestStartedAt : null;
+    var badge = stalenessBadge(w.staleness);
+    return el('div', { class: 'card pcard open', onclick: function () { openWorkspace(w.key, w.label); } }, [
+      el('div', { class: 'l' }, [
+        el('span', { text: w.label }),
+        badge ? el('span', { text: '  ' }) : null,
+        badge
+      ]),
+      el('div', { class: 'f', text: 'now: ' + now }),
+      el('div', { class: 'f', text: 'latest: ' + dec }),
+      el('div', { class: 'f', text: 'in-flight ' + w.inFlightCount + '  |  ' + pendText + '  |  suspect ' + w.suspectCount }),
+      el('div', { class: 'f muted', text: 'sessions ' + w.sessionCount + '  |  newest ' + relAge(newest, generatedAt) })
+    ]);
+  }
+
+  function openWorkspace(key, label) {
+    state.mode = 'portfolio';
+    state.wsKey = key;
+    state.base = '/api/ws/' + encodeURIComponent(key);
+    state.canAct = true;
+    document.body.classList.remove('landing');
+    $('btn-back').style.display = '';
+    updateActionBar();
+    setStatus('workspace: ' + label, false);
+    buildTabs();
+    loadTab('overview');
+  }
+
   // --- tabs ---------------------------------------------------------------
 
   function buildTabs() {
@@ -5211,16 +5777,16 @@ var VIEW_HTML = `<!doctype html>
     if (name === 'stats') return loadStats();
     if (name === 'sessions') return loadSessions();
     if (name === 'tasks') return loadTasks();
-    if (name === 'decisions') return loadMarkdown('/api/decisions', 'decisions');
+    if (name === 'decisions') return loadMarkdown(state.base + '/decisions', 'decisions');
     if (name === 'approvals') return loadApprovals();
-    if (name === 'handoff') return loadMarkdown('/api/handoff', 'handoff');
+    if (name === 'handoff') return loadMarkdown(state.base + '/handoff', 'handoff');
   }
 
   function fail(err) { setStatus(err.message, true); }
 
   function loadOverview() {
     single(true);
-    fetchJson('/api/overview').then(function (d) {
+    fetchJson(state.base + '/overview').then(function (d) {
       var detail = $('detail');
       if (!d || d.initialized === false) {
         detail.appendChild(el('p', { class: 'muted', text: 'Workspace not initialized.' }));
@@ -5269,7 +5835,7 @@ var VIEW_HTML = `<!doctype html>
 
   function loadStats() {
     single(true);
-    fetchJson('/api/stats').then(function (d) {
+    fetchJson(state.base + '/stats').then(function (d) {
       var detail = $('detail');
       var t = d.totals;
       detail.appendChild(el('p', { text: 'Sessions: ' + t.sessionCount }));
@@ -5330,7 +5896,7 @@ var VIEW_HTML = `<!doctype html>
 
   function loadSessions() {
     single(false);
-    fetchJson('/api/sessions').then(function (d) {
+    fetchJson(state.base + '/sessions').then(function (d) {
       var list = $('list');
       var rows = (d && d.sessions) || [];
       if (rows.length === 0) { list.appendChild(el('div', { class: 'row muted', text: 'no sessions' })); return; }
@@ -5349,7 +5915,7 @@ var VIEW_HTML = `<!doctype html>
     row.classList.add('active');
     var detail = $('detail');
     clear(detail);
-    fetchJson('/api/sessions/' + encodeURIComponent(id)).then(function (d) {
+    fetchJson(state.base + '/sessions/' + encodeURIComponent(id)).then(function (d) {
       var s = d.session.session;
       detail.appendChild(el('h3', { text: s.label || id }));
       detail.appendChild(kv([
@@ -5382,7 +5948,7 @@ var VIEW_HTML = `<!doctype html>
 
   function loadTasks() {
     single(false);
-    fetchJson('/api/tasks').then(function (d) {
+    fetchJson(state.base + '/tasks').then(function (d) {
       var list = $('list');
       var rows = (d && d.tasks) || [];
       if (rows.length === 0) { list.appendChild(el('div', { class: 'row muted', text: 'no tasks' })); return; }
@@ -5401,7 +5967,7 @@ var VIEW_HTML = `<!doctype html>
     row.classList.add('active');
     var detail = $('detail');
     clear(detail);
-    fetchJson('/api/tasks/' + encodeURIComponent(id)).then(function (d) {
+    fetchJson(state.base + '/tasks/' + encodeURIComponent(id)).then(function (d) {
       detail.appendChild(el('h3', { text: (d.task && (d.task.title || d.task.label)) || id }));
       detail.appendChild(el('pre', { text: JSON.stringify(d.task, null, 2) }));
       if (d.body) detail.appendChild(el('pre', { text: d.body }));
@@ -5420,7 +5986,7 @@ var VIEW_HTML = `<!doctype html>
 
   function loadApprovals() {
     single(true);
-    fetchJson('/api/approvals').then(function (d) {
+    fetchJson(state.base + '/approvals').then(function (d) {
       var detail = $('detail');
       var groups = [['pending', d.pending || []], ['resolved', d.resolved || []]];
       groups.forEach(function (g) {
@@ -5445,14 +6011,14 @@ var VIEW_HTML = `<!doctype html>
 
   // --- wire up ------------------------------------------------------------
 
-  $('btn-refresh').addEventListener('click', function () { post('/api/refresh', 'Refresh all'); });
-  $('btn-import-claude').addEventListener('click', function () { post('/api/import/claude-code', 'Import claude-code'); });
-  $('btn-import-codex').addEventListener('click', function () { post('/api/import/codex', 'Import codex'); });
-  $('btn-gen-handoff').addEventListener('click', function () { post('/api/handoff/generate', 'Regenerate handoff'); });
-  $('btn-gen-decisions').addEventListener('click', function () { post('/api/decisions/generate', 'Regenerate decisions'); });
+  $('btn-back').addEventListener('click', function () { backToPortfolio(); });
+  $('btn-refresh').addEventListener('click', function () { post(state.base + '/refresh', 'Refresh all'); });
+  $('btn-import-claude').addEventListener('click', function () { post(state.base + '/import/claude-code', 'Import claude-code'); });
+  $('btn-import-codex').addEventListener('click', function () { post(state.base + '/import/codex', 'Import codex'); });
+  $('btn-gen-handoff').addEventListener('click', function () { post(state.base + '/handoff/generate', 'Regenerate handoff'); });
+  $('btn-gen-decisions').addEventListener('click', function () { post(state.base + '/decisions/generate', 'Regenerate decisions'); });
 
-  buildTabs();
-  loadTab('overview');
+  boot();
 })();
 </script>
 </body>
@@ -5467,6 +6033,8 @@ var HttpError = class extends Error {
   status;
 };
 var MAX_BODY_BYTES = 64 * 1024;
+var API_PREFIX = "/api/";
+var WS_PREFIX = "/api/ws/";
 function startViewServer(opts) {
   const { port, host = "127.0.0.1", deps } = opts;
   let actionQueue = Promise.resolve();
@@ -5480,7 +6048,7 @@ function startViewServer(opts) {
   };
   let boundPort = port;
   const getPort = () => boundPort;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve7, reject) => {
     const server = createServer((req, res) => {
       handleRequest(req, res, deps, getPort, runExclusive).catch((error) => {
         sendError(res, error instanceof HttpError ? error.status : 500, pathlessMessage(error));
@@ -5491,7 +6059,7 @@ function startViewServer(opts) {
       const address = server.address();
       boundPort = isAddressInfo(address) ? address.port : port;
       server.off("error", reject);
-      resolve4({
+      resolve7({
         url: `http://${host}:${boundPort}`,
         port: boundPort,
         close: () => closeServer(server)
@@ -5503,8 +6071,8 @@ function isAddressInfo(value) {
   return value !== null && typeof value === "object";
 }
 function closeServer(server) {
-  return new Promise((resolve4) => {
-    server.close(() => resolve4());
+  return new Promise((resolve7) => {
+    server.close(() => resolve7());
     server.closeAllConnections();
   });
 }
@@ -5536,90 +6104,204 @@ async function handleGet(res, pathname, deps) {
     sendHtml(res, VIEW_HTML);
     return;
   }
-  if (pathname === "/api/overview") {
-    sendJson(res, 200, await overview(deps));
+  if (pathname === "/api/portfolio") {
+    sendJson(res, 200, await portfolio(deps));
     return;
   }
-  if (pathname === "/api/sessions") {
-    sendJson(res, 200, await sessionsList(deps));
+  const scoped = matchWsRoute(pathname);
+  if (scoped !== null) {
+    const ws = findWorkspace(deps, scoped.key);
+    if (ws === null) {
+      sendError(res, 404, "Unknown workspace");
+      return;
+    }
+    if (!await handleWorkspaceGet(res, scoped.sub, ws, deps.nowProvider)) {
+      sendError(res, 404, "Not found");
+    }
     return;
   }
-  const sessionId = matchId(pathname, "/api/sessions/");
-  if (sessionId !== null) {
-    sendJson(res, 200, await sessionDetail(deps, sessionId));
+  if (pathname.startsWith(API_PREFIX)) {
+    const sub = pathname.slice(API_PREFIX.length);
+    if (!await handleWorkspaceGet(res, sub, primaryWorkspace(deps), deps.nowProvider)) {
+      sendError(res, 404, "Not found");
+    }
     return;
   }
-  if (pathname === "/api/tasks") {
-    sendJson(res, 200, await tasksList(deps));
+  sendError(res, 404, "Not found");
+}
+async function handlePost(res, pathname, body, deps, runExclusive) {
+  const scoped = matchWsRoute(pathname);
+  if (scoped !== null) {
+    const ws = findWorkspace(deps, scoped.key);
+    if (ws === null) {
+      sendError(res, 404, "Unknown workspace");
+      return;
+    }
+    if (!await handleWorkspacePost(res, scoped.sub, ws, body, deps, runExclusive)) {
+      sendError(res, 404, "Not found");
+    }
     return;
   }
-  const taskId = matchId(pathname, "/api/tasks/");
-  if (taskId !== null) {
-    sendJson(res, 200, await taskDetail(deps, taskId));
+  if (pathname.startsWith(API_PREFIX)) {
+    const sub = pathname.slice(API_PREFIX.length);
+    if (!await handleWorkspacePost(res, sub, primaryWorkspace(deps), body, deps, runExclusive)) {
+      sendError(res, 404, "Not found");
+    }
     return;
   }
-  if (pathname === "/api/decisions") {
-    sendJson(res, 200, await decisionsView(deps));
-    return;
+  sendError(res, 404, "Not found");
+}
+async function handleWorkspaceGet(res, sub, ws, nowProvider) {
+  if (sub === "overview") {
+    sendJson(res, 200, await overview(ws, nowProvider));
+    return true;
   }
-  if (pathname === "/api/approvals") {
-    sendJson(res, 200, await approvalsView(deps));
-    return;
+  if (sub === "sessions") {
+    sendJson(res, 200, await sessionsList(ws, nowProvider));
+    return true;
   }
-  if (pathname === "/api/handoff") {
-    sendJson(res, 200, await handoffView(deps));
-    return;
+  const sessionId = matchId(sub, "sessions/");
+  if (sessionId !== null) {
+    sendJson(res, 200, await sessionDetail(ws, sessionId));
+    return true;
   }
-  if (pathname === "/api/stats") {
-    sendJson(res, 200, await computeWorkStats2({ paths: deps.paths, now: deps.nowProvider() }));
-    return;
+  if (sub === "tasks") {
+    sendJson(res, 200, await tasksList(ws));
+    return true;
   }
-  sendError(res, 404, "Not found");
+  const taskId = matchId(sub, "tasks/");
+  if (taskId !== null) {
+    sendJson(res, 200, await taskDetail(ws, taskId));
+    return true;
+  }
+  if (sub === "decisions") {
+    sendJson(res, 200, await decisionsView(ws, nowProvider));
+    return true;
+  }
+  if (sub === "approvals") {
+    sendJson(res, 200, await approvalsView(ws, nowProvider));
+    return true;
+  }
+  if (sub === "handoff") {
+    sendJson(res, 200, await handoffView(ws, nowProvider));
+    return true;
+  }
+  if (sub === "stats") {
+    sendJson(res, 200, await computeWorkStats2({ paths: ws.paths, now: nowProvider() }));
+    return true;
+  }
+  return false;
 }
-async function handlePost(res, pathname, body, deps, runExclusive) {
+async function handleWorkspacePost(res, sub, ws, body, deps, runExclusive) {
   const nowIso = deps.nowProvider().toISOString();
   const actionOptions = readActionOptions(body);
-  if (pathname === "/api/refresh") {
+  if (sub === "refresh") {
     const result = await runExclusive(
-      () => refreshAll({ options: actionOptions, ctx: deps.importCtx, paths: deps.paths, nowIso })
+      () => refreshAll({ options: actionOptions, ctx: ws.importCtx, paths: ws.paths, nowIso })
     );
     sendJson(res, 200, result);
-    return;
+    return true;
   }
-  if (pathname === "/api/import/claude-code") {
-    sendJson(res, 200, await runExclusive(() => importClaudeCode(actionOptions, deps.importCtx)));
-    return;
+  if (sub === "import/claude-code") {
+    sendJson(res, 200, await runExclusive(() => importClaudeCode(actionOptions, ws.importCtx)));
+    return true;
   }
-  if (pathname === "/api/import/codex") {
-    sendJson(res, 200, await runExclusive(() => importCodex(actionOptions, deps.importCtx)));
-    return;
+  if (sub === "import/codex") {
+    sendJson(res, 200, await runExclusive(() => importCodex(actionOptions, ws.importCtx)));
+    return true;
   }
-  if (pathname === "/api/handoff/generate") {
-    sendJson(res, 200, await runExclusive(() => regenerateHandoff(deps.paths, nowIso)));
-    return;
+  if (sub === "handoff/generate") {
+    sendJson(res, 200, await runExclusive(() => regenerateHandoff(ws.paths, nowIso)));
+    return true;
   }
-  if (pathname === "/api/decisions/generate") {
-    sendJson(res, 200, await runExclusive(() => regenerateDecisions(deps.paths, nowIso)));
-    return;
+  if (sub === "decisions/generate") {
+    sendJson(res, 200, await runExclusive(() => regenerateDecisions(ws.paths, nowIso)));
+    return true;
   }
-  sendError(res, 404, "Not found");
+  return false;
+}
+function primaryWorkspace(deps) {
+  const first = deps.workspaces[0];
+  if (first === void 0) throw new HttpError(500, "No workspace configured");
+  return first;
+}
+function findWorkspace(deps, key) {
+  return deps.workspaces.find((w) => w.key === key) ?? null;
 }
-async function overview(deps) {
+function matchWsRoute(pathname) {
+  if (!pathname.startsWith(WS_PREFIX)) return null;
+  const rest = pathname.slice(WS_PREFIX.length);
+  const slash = rest.indexOf("/");
+  if (slash <= 0) return null;
+  const sub = rest.slice(slash + 1);
+  if (sub.length === 0) return null;
+  let key;
+  try {
+    key = decodeURIComponent(rest.slice(0, slash));
+  } catch {
+    return null;
+  }
+  if (key.length === 0 || key.includes("/") || key.includes("\0")) return null;
+  return { key, sub };
+}
+async function portfolio(deps) {
+  const nowIso = deps.nowProvider().toISOString();
+  const workspaces = await Promise.all(deps.workspaces.map((ws) => portfolioCard(ws, nowIso)));
+  for (let i = 0; i < deps.workspaces.length; i++) {
+    const card = workspaces[i];
+    const ws = deps.workspaces[i];
+    if (ws !== void 0 && card !== void 0 && card.initialized === true && card.error === void 0) {
+      card.staleness = await captureStaleness(ws, nowIso);
+    }
+  }
+  return { mode: deps.mode, generatedAt: nowIso, workspaces };
+}
+async function portfolioCard(ws, nowIso) {
+  const base = { key: ws.key, label: ws.label, repoRoot: ws.repoRoot };
+  if (!ws.initialized) {
+    return ws.manifestError !== void 0 ? { ...base, initialized: false, error: ws.manifestError } : { ...base, initialized: false };
+  }
+  try {
+    const s = await summarizeOrientation({ paths: ws.paths, nowIso });
+    return {
+      ...base,
+      initialized: true,
+      sessionCount: s.sessionCount,
+      suspectCount: s.suspects.length,
+      inFlightCount: s.inFlightTasks.length,
+      pendingApprovals: s.pendingApprovals.map((a) => ({
+        risk: a.risk,
+        kind: a.kind,
+        expired: a.expired
+      })),
+      latestDecision: s.latestDecision !== null ? { title: s.latestDecision.title } : null,
+      latestSession: s.latestSession !== null ? { label: s.latestSession.label, status: s.latestSession.status } : null,
+      freshness: { newestStartedAt: s.freshness.newestStartedAt, bySource: s.freshness.bySource }
+    };
+  } catch (error) {
+    return { ...base, initialized: true, error: pathlessMessage(error) };
+  }
+}
+async function captureStaleness(ws, nowIso) {
+  const probe = await probeStaleness({ ctx: ws.importCtx, paths: ws.paths, nowIso });
+  return probe === null ? { checked: false } : { checked: true, ...probe };
+}
+async function overview(ws, nowProvider) {
   let manifest;
   try {
-    manifest = await readManifest8(deps.paths);
+    manifest = await readManifest9(ws.paths);
   } catch (error) {
-    if (findErrorCode14(error, "ENOENT")) {
-      return { initialized: false, repoRoot: deps.repoRoot };
+    if (findErrorCode15(error, "ENOENT")) {
+      return { initialized: false, repoRoot: ws.repoRoot };
     }
     throw error;
   }
-  const nowIso = deps.nowProvider().toISOString();
-  const handoff = await renderHandoff3({ paths: deps.paths, nowIso });
-  const approvals = await enumerateApprovals2(deps.paths);
+  const nowIso = nowProvider().toISOString();
+  const handoff = await renderHandoff3({ paths: ws.paths, nowIso });
+  const approvals = await enumerateApprovals2(ws.paths);
   return {
     initialized: true,
-    repoRoot: deps.repoRoot,
+    repoRoot: ws.repoRoot,
     workspace: {
       id: manifest.workspace.id,
       name: manifest.workspace.name,
@@ -5637,8 +6319,8 @@ async function overview(deps) {
     generatedAt: nowIso
   };
 }
-async function sessionsList(deps) {
-  const entries = await loadSessionEntries3(deps.paths, { now: deps.nowProvider() });
+async function sessionsList(ws, nowProvider) {
+  const entries = await loadSessionEntries3(ws.paths, { now: nowProvider() });
   const sessions = entries.map((entry) => ({
     sessionId: entry.sessionId,
     label: entry.session.session.label ?? null,
@@ -5653,10 +6335,10 @@ async function sessionsList(deps) {
   })).reverse();
   return { sessions };
 }
-async function sessionDetail(deps, sessionId) {
+async function sessionDetail(ws, sessionId) {
   let session;
   try {
-    session = await readSessionYaml3(deps.paths, sessionId);
+    session = await readSessionYaml3(ws.paths, sessionId);
   } catch (error) {
     if (error instanceof Error && error.message === "YAML file not found") {
       throw new HttpError(404, "Session not found");
@@ -5664,19 +6346,19 @@ async function sessionDetail(deps, sessionId) {
     throw error;
   }
   try {
-    const events = await readAllEvents2(join8(deps.paths.sessions, sessionId));
+    const events = await readAllEvents2(join10(ws.paths.sessions, sessionId));
     return { session, events };
   } catch {
     return { session, events: [], degraded: true };
   }
 }
-async function tasksList(deps) {
-  const entries = await loadTaskEntries2(deps.paths);
+async function tasksList(ws) {
+  const entries = await loadTaskEntries2(ws.paths);
   return { tasks: entries.map((entry) => entry.task).reverse() };
 }
-async function taskDetail(deps, taskId) {
+async function taskDetail(ws, taskId) {
   try {
-    const doc = await readTaskFile2(deps.paths, taskId);
+    const doc = await readTaskFile2(ws.paths, taskId);
     return { task: doc.task, body: doc.body };
   } catch (error) {
     if (error instanceof Error && error.message === "Task file not found") {
@@ -5685,22 +6367,22 @@ async function taskDetail(deps, taskId) {
     throw error;
   }
 }
-async function decisionsView(deps) {
-  const fromDisk = await readMarkdownFile4(deps.paths.files.decisions);
+async function decisionsView(ws, nowProvider) {
+  const fromDisk = await readMarkdownFile4(ws.paths.files.decisions);
   if (fromDisk !== null) {
     return { body: fromDisk, fromDisk: true };
   }
-  const nowIso = deps.nowProvider().toISOString();
-  const result = await renderDecisions3({ paths: deps.paths, nowIso });
+  const nowIso = nowProvider().toISOString();
+  const result = await renderDecisions3({ paths: ws.paths, nowIso });
   return { body: result.body, decisionCount: result.decisionCount, fromDisk: false };
 }
-async function approvalsView(deps) {
-  const now = deps.nowProvider();
-  const ids = await enumerateApprovals2(deps.paths);
+async function approvalsView(ws, nowProvider) {
+  const now = nowProvider();
+  const ids = await enumerateApprovals2(ws.paths);
   const toViews = async (list) => {
     const views = [];
     for (const id of list) {
-      const loaded = await loadApproval2(deps.paths, id);
+      const loaded = await loadApproval2(ws.paths, id);
       if (loaded === null) continue;
       views.push({ id, expired: isLazyExpired2(loaded.approval, now), approval: loaded.approval });
     }
@@ -5708,13 +6390,13 @@ async function approvalsView(deps) {
   };
   return { pending: await toViews(ids.pending), resolved: await toViews(ids.resolved) };
 }
-async function handoffView(deps) {
-  const fromDisk = await readMarkdownFile4(deps.paths.files.handoff);
+async function handoffView(ws, nowProvider) {
+  const fromDisk = await readMarkdownFile4(ws.paths.files.handoff);
   if (fromDisk !== null) {
     return { body: fromDisk, fromDisk: true };
   }
-  const nowIso = deps.nowProvider().toISOString();
-  const result = await renderHandoff3({ paths: deps.paths, nowIso });
+  const nowIso = nowProvider().toISOString();
+  const result = await renderHandoff3({ paths: ws.paths, nowIso });
   return { body: result.body, fromDisk: false };
 }
 function readActionOptions(body) {
@@ -5808,8 +6490,18 @@ function parsePort(value) {
   }
   return port;
 }
+function collectPath3(value, previous = []) {
+  return [...previous, value];
+}
 function registerViewCommand(program2) {
-  program2.command("view").description("Open a local web UI to browse provenance and run imports (localhost only)").option("--port <number>", "Port to listen on (default 4319)", parsePort).option("--no-open", "Do not open the browser automatically").option("-v, --verbose", "Show error causes").action(async (options) => {
+  program2.command("view").description("Open a local web UI to browse provenance and run imports (localhost only)").option("--port <number>", "Port to listen on (default 4319)", parsePort).option("--no-open", "Do not open the browser automatically").option(
+    "--portfolio",
+    "Serve every workspace listed in ~/.basou/portfolio.yaml (cross-repo orientation)"
+  ).option(
+    "--workspace <path>",
+    "Workspace repo path to include (repeatable; implies portfolio mode; resolved against the cwd)",
+    collectPath3
+  ).option("--check", "Run the portfolio safety preflight and exit (no server)").option("--skip-safety-check", "Skip the portfolio safety preflight on start (not recommended)").option("-v, --verbose", "Show error causes").action(async (options) => {
     await runView(options);
   });
 }
@@ -5823,23 +6515,37 @@ async function runView(options, ctx = {}) {
 }
 async function doRunView(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
-  const repositoryRoot = await resolveRepositoryRootForView(cwd);
-  const paths = basouPaths15(repositoryRoot);
-  await assertWorkspaceInitialized12(paths.root);
-  const deps = {
-    paths,
-    repoRoot: repositoryRoot,
-    importCtx: {
-      cwd: repositoryRoot,
-      ...ctx.claudeProjectsDir !== void 0 ? { claudeProjectsDir: ctx.claudeProjectsDir } : {},
-      ...ctx.codexSessionsDir !== void 0 ? { codexSessionsDir: ctx.codexSessionsDir } : {}
-    },
-    nowProvider: ctx.nowProvider ?? (() => /* @__PURE__ */ new Date())
-  };
+  const workspaceFlags = options.workspace ?? [];
+  const isPortfolio = workspaceFlags.length > 0 || options.portfolio === true;
+  const deps = isPortfolio ? await buildPortfolioDeps(workspaceFlags, ctx, cwd) : await buildSingleDeps(ctx, cwd);
+  if (options.check === true) {
+    const result = await checkPortfolioSafety(deps.workspaces);
+    for (const line of formatSafetyReport(result)) console.log(line);
+    if (result.findings.length > 0) process.exitCode = 1;
+    return;
+  }
+  if (deps.mode === "portfolio" && options.skipSafetyCheck !== true) {
+    const result = await checkPortfolioSafety(deps.workspaces);
+    const blocking = result.findings.filter((f) => f.kind === "footprint" || f.kind === "overlap");
+    if (blocking.length > 0) {
+      for (const line of formatSafetyReport(result)) console.error(line);
+      throw new Error(
+        "Portfolio safety preflight failed (see findings above). Fix the monitored repos, or re-run with --skip-safety-check to override."
+      );
+    }
+    if (result.findings.length > 0) {
+      console.error(
+        `Portfolio safety: ${result.findings.length} unverifiable item(s) \u2014 the read-only view will still open; run 'basou view --check' for detail.`
+      );
+    }
+  }
   const port = options.port ?? DEFAULT_PORT;
   const handle = await startListening(port, deps);
   try {
     console.log(`basou view running at ${handle.url}`);
+    if (deps.mode === "portfolio") {
+      console.log(`Portfolio mode: ${deps.workspaces.length} workspace(s).`);
+    }
     console.log(
       "Localhost only, no authentication. Do not expose this port beyond your machine. Press Ctrl+C to stop."
     );
@@ -5852,11 +6558,69 @@ async function doRunView(options, ctx) {
     await handle.close();
   }
 }
+async function buildSingleDeps(ctx, cwd) {
+  const repositoryRoot = await resolveRepositoryRootForView(cwd);
+  const paths = basouPaths16(repositoryRoot);
+  await assertWorkspaceInitialized13(paths.root);
+  const entry = await buildWorkspaceEntry(repositoryRoot, ctx);
+  return { workspaces: [entry], mode: "single", nowProvider: nowProviderOf(ctx) };
+}
+async function buildPortfolioDeps(workspaceFlags, ctx, cwd) {
+  const specs = workspaceFlags.length > 0 ? workspaceFlags.map((p) => ({ path: resolve6(cwd, p) })) : await loadPortfolioConfig(ctx.portfolioConfigPath);
+  const entries = [];
+  const seenPath = /* @__PURE__ */ new Set();
+  const seenKey = /* @__PURE__ */ new Set();
+  for (const spec of specs) {
+    const repoRoot = resolve6(spec.path);
+    if (seenPath.has(repoRoot)) continue;
+    seenPath.add(repoRoot);
+    const entry = await buildWorkspaceEntry(repoRoot, ctx, spec.label);
+    let key = entry.key;
+    for (let n = 1; seenKey.has(key); n++) key = `${entry.key}-${n}`;
+    seenKey.add(key);
+    entries.push({ ...entry, key });
+  }
+  if (entries.length === 0) throw new Error("No workspaces to show.");
+  return { workspaces: entries, mode: "portfolio", nowProvider: nowProviderOf(ctx) };
+}
+async function buildWorkspaceEntry(repoRoot, ctx, labelOverride) {
+  const paths = basouPaths16(repoRoot);
+  const importCtx = {
+    cwd: repoRoot,
+    ...ctx.claudeProjectsDir !== void 0 ? { claudeProjectsDir: ctx.claudeProjectsDir } : {},
+    ...ctx.codexSessionsDir !== void 0 ? { codexSessionsDir: ctx.codexSessionsDir } : {}
+  };
+  try {
+    const manifest = await readManifest10(paths);
+    return {
+      key: manifest.workspace.id,
+      label: labelOverride ?? manifest.workspace.name,
+      paths,
+      repoRoot,
+      importCtx,
+      initialized: true
+    };
+  } catch (error) {
+    const notFound = error instanceof Error && error.message === "YAML file not found";
+    return {
+      key: `ws-${createHash("sha1").update(repoRoot).digest("hex").slice(0, 12)}`,
+      label: labelOverride ?? basename4(repoRoot),
+      paths,
+      repoRoot,
+      importCtx,
+      initialized: false,
+      ...notFound ? {} : { manifestError: "manifest unreadable or invalid" }
+    };
+  }
+}
+function nowProviderOf(ctx) {
+  return ctx.nowProvider ?? (() => /* @__PURE__ */ new Date());
+}
 async function startListening(port, deps) {
   try {
     return await startViewServer({ port, deps });
   } catch (error) {
-    if (findErrorCode15(error, "EADDRINUSE")) {
+    if (findErrorCode16(error, "EADDRINUSE")) {
       throw new Error(`Port ${port} is already in use. Pass --port <n> to choose another.`, {
         cause: error
       });
@@ -5879,7 +6643,7 @@ function openInBrowser(url, override) {
   }
 }
 function waitForShutdown(signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve7) => {
     const cleanup = () => {
       process.off("SIGINT", onSignal);
       process.off("SIGTERM", onSignal);
@@ -5887,18 +6651,18 @@ function waitForShutdown(signal) {
     };
     const onSignal = () => {
       cleanup();
-      resolve4();
+      resolve7();
     };
     const onAbort = () => {
       cleanup();
-      resolve4();
+      resolve7();
     };
     process.on("SIGINT", onSignal);
     process.on("SIGTERM", onSignal);
     if (signal !== void 0) {
       if (signal.aborted) {
         cleanup();
-        resolve4();
+        resolve7();
         return;
       }
       signal.addEventListener("abort", onAbort);
@@ -5907,7 +6671,7 @@ function waitForShutdown(signal) {
 }
 async function resolveRepositoryRootForView(cwd) {
   try {
-    return await resolveRepositoryRoot16(cwd);
+    return await resolveRepositoryRoot15(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou view'.", {
@@ -5917,11 +6681,11 @@ async function resolveRepositoryRootForView(cwd) {
     throw error;
   }
 }
-async function assertWorkspaceInitialized12(basouRoot) {
+async function assertWorkspaceInitialized13(basouRoot) {
   try {
-    await assertBasouRootSafe15(basouRoot);
+    await assertBasouRootSafe16(basouRoot);
   } catch (error) {
-    if (findErrorCode15(error, "ENOENT")) {
+    if (findErrorCode16(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -5951,6 +6715,7 @@ function buildProgram() {
   registerHandoffCommand(program2);
   registerDecisionsCommand(program2);
   registerReportCommand(program2);
+  registerOrientCommand(program2);
   return program2;
 }