@basou/cli 0.67.0 → 0.68.0

package/dist/index.js

@@ -830,33 +830,190 @@ function printNoApprovals(options) {
 }
 
 // src/commands/board.ts
-import { lstat, readFile as readFile2, realpath as realpath2 } from "fs/promises";
-import { basename as basename3, dirname as dirname3, join as join3, relative, resolve as resolve3, sep } from "path";
+import { lstat, readdir as readdir2, readFile as readFile2, realpath as realpath3 } from "fs/promises";
+import { basename as basename4, dirname as dirname5, join as join4, relative, resolve as resolve3, sep as sep2 } from "path";
 import {
   assertBasouRootSafe as assertBasouRootSafe3,
+  BOARD_INIT_SAVE,
   basouPaths as basouPaths4,
+  boardGuide,
+  boardInitText,
   buildRecord,
   byCodePoint,
   diffCells,
   diffObserved,
   displayPath as displayPath3,
+  effortStartOf,
   findErrorCode as findErrorCode3,
+  isBoardTimeZone,
   measureBoard,
   measureBoardLive,
   NO_PREVIOUS_RECORDS,
   parseBoardDeclaration,
   parseRecordInput,
-  readManifest as readManifest3,
+  readManifest as readManifest4,
   readPreviousRecords,
+  recordIds,
+  resolveViewLanguage,
+  shellWord,
   writeRecord
 } from "@basou/core";
 
+// src/lib/foreign-workspace-warn.ts
+import { realpath as realpath2 } from "fs/promises";
+import { dirname } from "path";
+import {
+  isPositionBoardLine,
+  loadPortfolioConfig as loadPortfolioConfig2,
+  PortfolioConfigMissingError,
+  readMarkdownFile
+} from "@basou/core";
+
+// src/lib/foreign-workspace-scan.ts
+import { homedir as osHomedir } from "os";
+import { basename as basename2, normalize, sep } from "path";
+var MIN_TOKEN_LENGTH = 4;
+function stripTrailingSep(p) {
+  return p.length > 1 && p.endsWith(sep) ? p.slice(0, -sep.length) : p;
+}
+function toTildePath(absPath, home) {
+  if (absPath === home) return "~";
+  if (absPath.startsWith(home + sep)) return `~${absPath.slice(home.length)}`;
+  return null;
+}
+function encodedSpelling(name) {
+  return name.replace(/[^a-zA-Z0-9]/g, "-");
+}
+function directoryNameSpellings(dir) {
+  const paired = /^(.+)-(planning|workspace)$/.exec(dir);
+  const plain = paired !== null ? [`${paired[1]}-planning`, `${paired[1]}-workspace`] : [dir, `${dir}-workspace`];
+  return [...plain, ...plain.map(encodedSpelling)];
+}
+function nameTokensFor(workspacePath, home) {
+  const abs = stripTrailingSep(normalize(workspacePath));
+  const tokens = /* @__PURE__ */ new Set([abs]);
+  const tilde = toTildePath(abs, home);
+  if (tilde !== null) tokens.add(tilde);
+  for (const name of directoryNameSpellings(basename2(abs))) tokens.add(name);
+  return [...tokens].filter((t) => t.length >= MIN_TOKEN_LENGTH);
+}
+function isSpellingOfSelf(workspacePath, selfPath) {
+  const own = new Set(directoryNameSpellings(basename2(stripTrailingSep(normalize(selfPath)))));
+  return directoryNameSpellings(basename2(stripTrailingSep(normalize(workspacePath)))).some(
+    (s) => own.has(s)
+  );
+}
+function scanForeignWorkspaceNames(input) {
+  if (input.text.length === 0 || input.workspacePaths.length === 0) return [];
+  const home = input.homedir ?? osHomedir();
+  const own = input.selfPath === void 0 ? [] : nameTokensFor(input.selfPath, home);
+  const lines = input.text.split("\n");
+  const hits = [];
+  for (const workspacePath of input.workspacePaths) {
+    if (input.selfPath !== void 0 && isSpellingOfSelf(workspacePath, input.selfPath)) continue;
+    const tokens = nameTokensFor(workspacePath, home).filter(
+      (token) => !own.some((ownToken) => ownToken.includes(token))
+    );
+    if (tokens.length === 0) continue;
+    const matched = /* @__PURE__ */ new Set();
+    const matchedLines = [];
+    for (const [index, line] of lines.entries()) {
+      let lineMatched = false;
+      for (const token of tokens) {
+        if (line.includes(token)) {
+          matched.add(token);
+          lineMatched = true;
+        }
+      }
+      if (lineMatched) matchedLines.push(index + 1);
+    }
+    if (matchedLines.length === 0) continue;
+    hits.push({
+      workspacePath,
+      tokens: [...matched].sort((a, b) => b.length - a.length || a.localeCompare(b)),
+      lines: matchedLines
+    });
+  }
+  return hits;
+}
+
+// src/lib/foreign-workspace-warn.ts
+var MAX_LISTED_LINES = 5;
+async function canonicalize(path) {
+  try {
+    return await realpath2(path);
+  } catch {
+    return path;
+  }
+}
+async function findForeignWorkspaceNames(args) {
+  let workspacePaths;
+  let selfPath;
+  try {
+    const workspaces = await loadPortfolioConfig2(args.configPath);
+    workspacePaths = await Promise.all(workspaces.map((w) => canonicalize(w.path)));
+    selfPath = args.selfPath === void 0 ? void 0 : await canonicalize(args.selfPath);
+  } catch {
+    return null;
+  }
+  const text = args.text.split("\n").map((line) => isPositionBoardLine(line) ? "" : line).join("\n");
+  const hits = scanForeignWorkspaceNames({ text, workspacePaths, selfPath });
+  if (hits.length === 0) return null;
+  const lines = [...new Set(hits.flatMap((h) => h.lines))].sort((a, b) => a - b);
+  return { workspaceCount: hits.length, lines };
+}
+async function findForeignWorkspaceFields(args) {
+  let workspacePaths;
+  let selfPath;
+  try {
+    const workspaces = await loadPortfolioConfig2(args.configPath);
+    workspacePaths = await Promise.all(workspaces.map((w) => canonicalize(w.path)));
+    selfPath = await canonicalize(args.selfPath);
+  } catch (error) {
+    return error instanceof PortfolioConfigMissingError ? { status: "no_registry" } : { status: "unreadable" };
+  }
+  const at = args.fields.filter(
+    (field) => scanForeignWorkspaceNames({ text: field.text, workspacePaths, selfPath }).length > 0
+  ).map((field) => field.at);
+  return { status: "checked", at };
+}
+function describeForeignWorkspaceLines(lines) {
+  const listed = lines.slice(0, MAX_LISTED_LINES).join(", ");
+  const rest = lines.length - MAX_LISTED_LINES;
+  const numbers = rest > 0 ? `${listed} and ${rest} more` : listed;
+  return `${lines.length === 1 ? "line" : "lines"} ${numbers}`;
+}
+function positionForeignWorkspaceWarning(report, where) {
+  const subject = report.workspaceCount === 1 ? "names another registered workspace" : `names ${report.workspaceCount} other registered workspaces`;
+  return `basou: this workspace's position ${subject} (${where}, ${describeForeignWorkspaceLines(report.lines)}). The position is handed to the agent session running in this workspace, so those names travel with it. Advisory only: nothing was withheld.`;
+}
+function protocolForeignWorkspaceWarning(report) {
+  const subject = report.workspaceCount === 1 ? "names a registered workspace" : `names ${report.workspaceCount} registered workspaces`;
+  return `basou: the protocol block ${subject} (block ${describeForeignWorkspaceLines(report.lines)}, counted from the block's first line, not the file's). Standing protocols are written to the user-global CLAUDE.md, which every project on this machine loads, so a workspace-specific name there reaches every workspace's sessions. Only the basou-managed block is checked; the rest of that file is not basou's to inspect. Advisory only: nothing was withheld.`;
+}
+async function warnIfPositionNamesOtherWorkspaces(args) {
+  try {
+    const body = await readMarkdownFile(args.paths.files.orientation);
+    if (body === null) return;
+    const report = await findForeignWorkspaceNames({
+      text: body,
+      selfPath: dirname(args.paths.root),
+      configPath: args.configPath
+    });
+    if (report !== null) {
+      console.error(positionForeignWorkspaceWarning(report, args.paths.files.orientation));
+    }
+  } catch {
+  }
+}
+
 // src/lib/provenance-actions.ts
+import { dirname as dirname4 } from "path";
 import {
   assertApprovalStoreSafe,
   assertLockStoreSafe as assertLockStoreSafe3,
   assertTaskStoreSafe,
-  readMarkdownFile,
+  readMarkdownFile as readMarkdownFile2,
   renderDecisions,
   renderHandoff,
   renderOrientation,
@@ -868,7 +1025,7 @@ import {
 import { createReadStream } from "fs";
 import { readdir, readFile, rm, stat as stat2 } from "fs/promises";
 import { homedir } from "os";
-import { basename as basename2, dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { basename as basename3, dirname as dirname3, join as join2, resolve as resolve2 } from "path";
 import { createInterface } from "readline";
 import {
   AGENT_INFRA_DIRS,
@@ -895,7 +1052,7 @@ import {
 } from "@basou/core";
 
 // src/lib/observation-warn.ts
-import { dirname } from "path";
+import { dirname as dirname2 } from "path";
 import { assertObservationsDirSafe, displayPath } from "@basou/core";
 async function warnIfObservationsRefused(paths) {
   try {
@@ -903,7 +1060,7 @@ async function warnIfObservationsRefused(paths) {
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     console.error(
-      `basou: ${reason} (in ${displayPath(dirname(paths.root))}). The files a session changes through the shell are not observed there, so a session imported now records only the files its transcript names.`
+      `basou: ${reason} (in ${displayPath(dirname2(paths.root))}). The files a session changes through the shell are not observed there, so a session imported now records only the files its transcript names.`
     );
   }
 }
@@ -980,7 +1137,7 @@ async function doRunImportClaudeCode(options, ctx) {
   const files = await selectTranscriptFiles(projectsRoot, projectPaths, options);
   const projectSet = new Set(projectPaths);
   const candidates = files.map((file) => {
-    const externalId = basename2(file, ".jsonl");
+    const externalId = basename3(file, ".jsonl");
     return {
       externalId,
       sourcePath: file,
@@ -1079,7 +1236,7 @@ async function importDerivedSessions(paths, manifest, options, sourceKind, candi
         files: payload.session.related_files ?? [],
         workingDirectory: payload.session.working_directory,
         sourceRoots: projectPaths,
-        masterRoot: dirname2(paths.root),
+        masterRoot: dirname3(paths.root),
         extraInRoot: AGENT_INFRA_DIRS
       });
       if (scope.outOfRoot.length > 0) crossProject.push({ externalId, outOfRoot: scope.outOfRoot });
@@ -1517,6 +1674,19 @@ async function assertWorkspaceInitialized2(basouRoot) {
   }
 }
 
+// src/lib/board-glance.ts
+import { join as join3 } from "path";
+import { glanceBoard, readManifest as readManifest3 } from "@basou/core";
+async function glanceDefaultBoard(root, paths) {
+  try {
+    const own = (await readManifest3(paths)).repos?.find((repo) => repo.path === ".");
+    if (own?.visibility !== "private") return null;
+  } catch {
+    return null;
+  }
+  return glanceBoard(join3(root, DEFAULT_BOARD_PATH));
+}
+
 // src/lib/provenance-actions.ts
 var capturing = Promise.resolve();
 function captureImportJson(fn) {
@@ -1601,7 +1771,7 @@ function importCodex(options, ctx) {
 }
 async function regenerateHandoff(paths, nowIso, callbacks) {
   const result = await renderHandoff({ paths, nowIso, ...callbacks });
-  const existing = await readMarkdownFile(paths.files.handoff);
+  const existing = await readMarkdownFile2(paths.files.handoff);
   await writeMarkdownFile(
     paths.files.handoff,
     renderWithMarkers(existing, result.body, "handoff.md")
@@ -1615,7 +1785,7 @@ async function regenerateHandoff(paths, nowIso, callbacks) {
 }
 async function regenerateDecisions(paths, nowIso, callbacks) {
   const result = await renderDecisions({ paths, nowIso, ...callbacks });
-  const existing = await readMarkdownFile(paths.files.decisions);
+  const existing = await readMarkdownFile2(paths.files.decisions);
   await writeMarkdownFile(
     paths.files.decisions,
     renderWithMarkers(existing, result.body, "decisions.md")
@@ -1623,7 +1793,12 @@ async function regenerateDecisions(paths, nowIso, callbacks) {
   return { decisionCount: result.decisionCount };
 }
 async function regenerateOrientation(paths, nowIso, callbacks) {
-  const result = await renderOrientation({ paths, nowIso, ...callbacks });
+  const result = await renderOrientation({
+    paths,
+    nowIso,
+    board: await glanceDefaultBoard(dirname4(paths.root), paths),
+    ...callbacks
+  });
   await writeMarkdownFile(paths.files.orientation, `${result.body}
 `);
   return {
@@ -1741,8 +1916,9 @@ read (nothing is printed on stdout).`
     "after",
     `
 The input is a JSON object: measure_digest (the digest of the measurement the
-judgement saw), observed, cells (every lane at every stage), prose, judged_by
-and axis_review. The board is measured again, and nothing is written when the
+judgement saw), observed (exactly the observations the board declares, when it
+declares any), cells (every lane at every stage), prose, judged_by and
+axis_review. The board is measured again, and nothing is written when the
 digest differs. Records are never written under a .basou/ directory. Exit
 codes: 0 when the record was written, or with --dry-run when everything
 checked out (nothing is written then); 1 when it was refused (nothing is
@@ -1750,6 +1926,191 @@ written; the reasons are on stderr).`
   ).action(async (options) => {
     await runBoardRecord(options);
   });
+  board.command("guide").description(
+    "Print the steps an agent follows to judge the board and record it (writes nothing, sends nothing)"
+  ).option("-v, --verbose", "Show error causes").addHelpText(
+    "after",
+    `
+The steps are filled in with this workspace's board (${DEFAULT_BOARD_PATH},
+read only when the manifest declares the workspace's own repo private): where
+it is and its last record, the commands that measure, observe, record and show
+it, what each stage is judged by, and the record's input to fill in, with the
+previous record's state of each cell beside it. With no board declared yet, it
+says how to declare one. The text is for an agent to read; its shape may change
+at any release. Exit codes: 0 when the steps were printed; 1 when the workspace,
+its manifest or its board.yaml cannot be read, or its own repo is not declared
+private (the reason is on stderr).`
+  ).action(async (options) => {
+    await runBoardGuide(options);
+  });
+  board.command("init").description("Print a board.yaml to start a board from (writes nothing)").option("-v, --verbose", "Show error causes").addHelpText(
+    "after",
+    `
+It prints a declaration of the newest board_version, in the language the
+manifest declares for the workspace's own repo: a title from the workspace's
+name, the six stages with a meaning each, one lane to cut again, nothing to
+observe, no component registered, an axis of version 1, and the effort from
+the day of the first session, in this host's time zone. It writes nothing:
+save it, from the workspace's own repo, only where no board is, through a file
+of its own:
+
+  ${INIT_SAVE}
+
+Never print it straight into ${DEFAULT_BOARD_PATH}: the shell empties that file
+before init runs, so a board already there would be lost.
+
+Exit codes: 0 when it was printed; 1 when the manifest does not declare the
+workspace's own repo private (a board's records hold what the trail holds),
+when ${DEFAULT_BOARD_PATH} is already there, or when the workspace cannot be
+read (the reason is on stderr, and nothing is printed on stdout).`
+  ).action(async (options) => {
+    await runBoardInit(options);
+  });
+}
+var INIT_SAVE = BOARD_INIT_SAVE;
+async function runBoardInit(options, ctx = {}) {
+  try {
+    await doRunBoardInit(options, ctx);
+  } catch (error) {
+    renderCliError(error, { verbose: isVerbose(options) });
+    process.exitCode = 1;
+  }
+}
+async function doRunBoardInit(_options, ctx) {
+  const { root, paths, manifest } = await privateWorkspace(ctx, "board init");
+  const cwd = ctx.cwd ?? process.cwd();
+  if (await realpath3(cwd).catch(() => cwd) !== await realpath3(root).catch(() => root)) {
+    throw new Error(
+      `Run basou board init from the top of the workspace's own repo, where its .basou/ is: the way to save what it prints writes ${DEFAULT_BOARD_PATH} in the current directory.`
+    );
+  }
+  const board = join4(root, DEFAULT_BOARD_PATH);
+  try {
+    await lstat(board);
+    throw new Error(
+      `${DEFAULT_BOARD_PATH} is already there, so there is no board to start: change that one (through an axis review when it changes the lanes or the stages).`
+    );
+  } catch (error) {
+    if (!findErrorCode3(error, "ENOENT")) throw error;
+  }
+  const { start, timeZone, sessionsRead } = await effortStartOf(
+    paths,
+    ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()
+  );
+  if (timeZone === void 0) {
+    console.error(
+      "basou: this host's time zone has no name, so effort.start is today in UTC and effort.time_zone is left out; write both."
+    );
+  } else if (!sessionsRead) {
+    console.error(
+      "basou: the sessions could not be read, so effort.start is today; set it to the day the work began."
+    );
+  } else if (!isBoardTimeZone(timeZone)) {
+    console.error(
+      "basou: this host's time zone has no name a board can declare, so effort.time_zone is left out; write one."
+    );
+  }
+  const text = boardInitText({
+    name: manifest.workspace.name,
+    language: resolveViewLanguage(manifest),
+    start,
+    startIsFirstSession: timeZone !== void 0,
+    // An offset such as +00:00, which some hosts name their zone, is not
+    // one a board can declare.
+    timeZone: timeZone !== void 0 && isBoardTimeZone(timeZone) ? timeZone : void 0
+  });
+  process.stdout.write(text);
+  return text;
+}
+async function privateWorkspace(ctx, command) {
+  const cwd = ctx.cwd ?? process.cwd();
+  const root = await resolveBasouRootForCommand(
+    cwd,
+    command,
+    ctx.portfolioConfigPath === void 0 ? {} : { portfolioConfigPath: ctx.portfolioConfigPath }
+  );
+  const paths = basouPaths4(root);
+  await assertWorkspaceInitialized3(paths.root);
+  const manifest = await readManifest4(paths);
+  const own = (manifest.repos ?? []).find((repo) => repo.path === ".");
+  if (own?.visibility !== "private") {
+    throw new Error(
+      `The board is kept at ${DEFAULT_BOARD_PATH} only in a workspace whose manifest declares its own repo (path: .) private, since a record holds what the trail holds (open tracks, time worked, model names). This one does not, so it has no judged board; basou view's /board page shows what is measured without one.`
+    );
+  }
+  return { root, paths, manifest };
+}
+async function runBoardGuide(options, ctx = {}) {
+  try {
+    await doRunBoardGuide(options, ctx);
+  } catch (error) {
+    renderCliError(error, { verbose: isVerbose(options) });
+    process.exitCode = 1;
+  }
+}
+async function doRunBoardGuide(_options, ctx) {
+  const { root, manifest } = await privateWorkspace(ctx, "board guide");
+  const board = {
+    path: join4(root, DEFAULT_BOARD_PATH),
+    shown: DEFAULT_BOARD_PATH,
+    given: false
+  };
+  let text;
+  try {
+    text = await readDeclaration(board);
+  } catch (error) {
+    if (!findErrorCode3(error, "ENOENT")) throw error;
+    if (await lstat(board.path).then(
+      () => true,
+      () => false
+    )) {
+      throw new Error(
+        `${DEFAULT_BOARD_PATH} is there but cannot be read (a link to nothing?). Fix it before the board is updated.`
+      );
+    }
+    text = null;
+  }
+  const otherRepos = (manifest.repos ?? []).map((repo) => repo.path).filter((p) => p !== ".");
+  if ([root, ...otherRepos].some((path) => displayPath3(path) !== path)) {
+    throw new Error(
+      "The workspace's path, or a repo path the manifest declares, holds a control character, which the guide's commands cannot carry safely. Rename it, or follow the steps by hand."
+    );
+  }
+  const common = {
+    // As basou resolves it, the root measure resolves the repos' paths against.
+    anchor: root,
+    otherRepos,
+    language: resolveViewLanguage(manifest),
+    basouCommand: ctx.basouCommand ?? [process.execPath, process.argv[1] ?? ""].filter((part) => part !== "").map(shellWord).join(" "),
+    basouVersion: BASOU_CLI_VERSION,
+    now: ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()
+  };
+  let guide;
+  if (text === null) {
+    guide = boardGuide({ ...common, board: { status: "undeclared" } });
+  } else {
+    const parsed = parseBoardDeclaration(text, {
+      manifestRepoPaths: (manifest.repos ?? []).map((repo) => repo.path)
+    });
+    if (!parsed.ok) {
+      throw new Error(
+        `${DEFAULT_BOARD_PATH} is not a valid board declaration, so there are no steps to print until it reads (fix it through an axis review when it changes the lanes or the stages):
+${parsed.errors.map((e) => `  - ${displayPath3(e)}`).join("\n")}`
+      );
+    }
+    const recordsDir = join4(dirname5(board.path), "records");
+    guide = boardGuide({
+      ...common,
+      board: {
+        status: "declared",
+        declaration: parsed.declaration,
+        recordCount: recordIds(await readdir2(recordsDir).catch(() => [])).length,
+        previous: await readPreviousRecords(recordsDir)
+      }
+    });
+  }
+  console.log(guide.trimEnd());
+  return guide;
 }
 async function runBoardMeasure(options, ctx = {}) {
   try {
@@ -1796,8 +2157,8 @@ Nothing was written.`, { cause: error.cause });
 async function checkAndRecord(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const loaded = await loadBoard(options, ctx, "board record");
-  const beside = (...parts) => loaded.board.given ? join3(dirname3(loaded.board.shown), ...parts) : relative(cwd, join3(dirname3(loaded.board.path), ...parts));
-  const recordsDir = join3(dirname3(loaded.board.path), "records");
+  const beside = (...parts) => loaded.board.given ? join4(dirname5(loaded.board.shown), ...parts) : relative(cwd, join4(dirname5(loaded.board.path), ...parts));
+  const recordsDir = join4(dirname5(loaded.board.path), "records");
   await checkRecordsPlace(loaded, recordsDir, beside("records"), options.notPrivate === true);
   const text = await readRecordInput(options, ctx);
   let value;
@@ -1808,6 +2169,7 @@ async function checkAndRecord(options, ctx) {
       cause: error
     });
   }
+  await refuseOtherWorkspaces(value, loaded.root, ctx);
   const parsed = parseRecordInput(value, loaded.declaration);
   if (!parsed.ok) {
     throw new RecordRefusal(
@@ -1864,11 +2226,90 @@ ${parsed.errors.map((e) => `  - ${displayPath3(e)}`).join("\n")}`
     diff
   };
 }
+var INPUT_KEYS = /* @__PURE__ */ new Set([
+  "measure_digest",
+  "observed",
+  "cells",
+  "prose",
+  "judged_by",
+  "axis_review",
+  "value",
+  "observed_at",
+  "source",
+  "error",
+  "lane",
+  "stage",
+  "state",
+  "reason",
+  "summary",
+  "lanes",
+  "operator_turns",
+  "footnotes",
+  "text",
+  "model",
+  "self_reported",
+  "triggers"
+]);
+var SHAPED_PLACES = [
+  /^measure_digest$/,
+  /^observed \(a named entry\)\.observed_at$/,
+  /^cells\[\d+\]\.state$/,
+  /^axis_review\.triggers$/
+];
+var NAMED_MAPS = /* @__PURE__ */ new Set(["observed", "prose.lanes"]);
+function inputTexts(value) {
+  const out = [];
+  const stack = [{ value, at: "" }];
+  for (let next = stack.pop(); next !== void 0; next = stack.pop()) {
+    const { value: v, at } = next;
+    if (SHAPED_PLACES.some((place) => place.test(at))) continue;
+    if (typeof v === "string" || typeof v === "number") {
+      out.push({ at: at === "" ? "(top level)" : at, text: String(v) });
+    } else if (Array.isArray(v)) {
+      for (let i = v.length - 1; i >= 0; i--) stack.push({ value: v[i], at: `${at}[${i}]` });
+    } else if (typeof v === "object" && v !== null) {
+      const named = NAMED_MAPS.has(at);
+      const where = at === "" ? "(top level)" : at;
+      const children = [];
+      for (const [k, child] of Object.entries(v)) {
+        if (!named && INPUT_KEYS.has(k)) {
+          children.push({ value: child, at: at === "" ? k : `${at}.${k}` });
+        } else {
+          out.push({ at: `${where}: a name`, text: k });
+          children.push({ value: child, at: `${where} (a named entry)` });
+        }
+      }
+      stack.push(...children.reverse());
+    }
+  }
+  return out;
+}
+async function refuseOtherWorkspaces(input, root, ctx) {
+  const found = await findForeignWorkspaceFields({
+    fields: inputTexts(input),
+    selfPath: root,
+    configPath: ctx.portfolioConfigPath
+  });
+  if (found.status === "unreadable") {
+    console.error(
+      "basou: ~/.basou/portfolio.yaml could not be read, or does not list workspaces as basou reads them, so the record's input was not checked for the names of other registered workspaces."
+    );
+    return;
+  }
+  if (found.status === "checked" && found.at.length > 0) {
+    throw new RecordRefusal(
+      `The record's input names another workspace the portfolio registers, and a board holds this workspace's own work only; nothing was written:
+${[
+        ...new Set(found.at)
+      ].map((where) => `  - ${displayPath3(where)}`).join("\n")}`
+    );
+  }
+}
 function hasRecords(loaded) {
-  return basename3(loaded.board.path) === "board.yaml";
+  return basename4(loaded.board.path) === "board.yaml";
 }
 async function previousOf(loaded) {
-  return hasRecords(loaded) ? readPreviousRecords(join3(dirname3(loaded.board.path), "records")) : NO_PREVIOUS_RECORDS;
+  return hasRecords(loaded) ? readPreviousRecords(join4(dirname5(loaded.board.path), "records")) : NO_PREVIOUS_RECORDS;
 }
 function errorCode(error) {
   const code = error?.code;
@@ -1876,21 +2317,21 @@ function errorCode(error) {
 }
 async function checkRecordsPlace(loaded, recordsDir, shown, notPrivate) {
   const { board } = loaded;
-  if (basename3(board.path) !== "board.yaml") {
+  if (basename4(board.path) !== "board.yaml") {
     throw new RecordRefusal(
       `${displayPath3(board.shown)} is not named board.yaml: basou board record reads only a file of that name, so that the records/ beside it holds one board's records; nothing was written.`
     );
   }
   let dir;
   try {
-    dir = await realpath2(dirname3(board.path));
+    dir = await realpath3(dirname5(board.path));
   } catch (error) {
     throw new RecordRefusal(
       `The directory of ${displayPath3(board.shown)} could not be resolved; nothing was written.`,
       { cause: error }
     );
   }
-  if (dir.split(sep).includes(".basou")) {
+  if (dir.split(sep2).includes(".basou")) {
     throw new RecordRefusal(
       `${displayPath3(shown)} would be under a .basou/ directory, where basou board record writes nothing; nothing was written.`
     );
@@ -1898,8 +2339,8 @@ async function checkRecordsPlace(loaded, recordsDir, shown, notPrivate) {
   if (!notPrivate) {
     let holder;
     for (const repo of loaded.manifest.repos ?? []) {
-      const real = await realpath2(resolve3(loaded.root, repo.path)).catch(() => void 0);
-      if (real === void 0 || dir !== real && !dir.startsWith(`${real}${sep}`)) continue;
+      const real = await realpath3(resolve3(loaded.root, repo.path)).catch(() => void 0);
+      if (real === void 0 || dir !== real && !dir.startsWith(`${real}${sep2}`)) continue;
       if (holder === void 0 || real.length > holder.real.length) {
         holder = { real, private: repo.visibility === "private" };
       }
@@ -1999,7 +2440,7 @@ async function loadBoard(options, ctx, command) {
   );
   const paths = basouPaths4(root);
   await assertWorkspaceInitialized3(paths.root);
-  const manifest = await readManifest3(paths);
+  const manifest = await readManifest4(paths);
   const board = boardPath(options, cwd, root, manifest);
   const text = await readDeclaration(board);
   const repoPaths = (manifest.repos ?? []).map((repo) => repo.path);
@@ -2038,7 +2479,7 @@ async function measureLiveBoard(root, ctx) {
   let repos = ["."];
   let manifestUnread = false;
   try {
-    const declared = ((await readManifest3(paths)).repos ?? []).map((repo) => repo.path);
+    const declared = ((await readManifest4(paths)).repos ?? []).map((repo) => repo.path);
     if (declared.length > 0) repos = declared;
   } catch {
     manifestUnread = true;
@@ -2077,7 +2518,7 @@ function boardPath(options, cwd, root, manifest) {
       `No --board given, and the default ${DEFAULT_BOARD_PATH} is used only when the manifest declares this workspace's own repo (path: .) private. Pass --board <path to board.yaml>.`
     );
   }
-  return { path: join3(root, DEFAULT_BOARD_PATH), shown: DEFAULT_BOARD_PATH, given: false };
+  return { path: join4(root, DEFAULT_BOARD_PATH), shown: DEFAULT_BOARD_PATH, given: false };
 }
 async function readDeclaration(board) {
   try {
@@ -2309,19 +2750,19 @@ function printMeasurementText(m, hasRecords2) {
 
 // src/lib/context-channel.ts
 import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import {
   ORIENTATION_END,
   ORIENTATION_START,
   parseMarkers,
-  readMarkdownFile as readMarkdownFile2,
+  readMarkdownFile as readMarkdownFile3,
   removeMarkerSection
 } from "@basou/core";
 
 // src/lib/durable-write.ts
 import { randomUUID } from "crypto";
 import { lstat as lstat2, open, rename, stat as stat3, unlink as unlink2 } from "fs/promises";
-import { basename as basename4, dirname as dirname4, join as join4 } from "path";
+import { basename as basename5, dirname as dirname6, join as join5 } from "path";
 async function assertNotSymlink(targetPath) {
   try {
     const st = await lstat2(targetPath);
@@ -2336,8 +2777,8 @@ async function assertNotSymlink(targetPath) {
   }
 }
 async function writeFileDurable(targetPath, content) {
-  const dir = dirname4(targetPath);
-  const tmpPath = join4(dir, `.${basename4(targetPath)}.tmp.${randomUUID()}`);
+  const dir = dirname6(targetPath);
+  const tmpPath = join5(dir, `.${basename5(targetPath)}.tmp.${randomUUID()}`);
   let mode = 420;
   try {
     mode = (await stat3(targetPath)).mode & 511;
@@ -2372,7 +2813,7 @@ async function writeFileDurable(targetPath, content) {
 }
 
 // src/lib/context-channel.ts
-var CODEX_TARGET_PATH = join5(homedir2(), ".codex", "AGENTS.md");
+var CODEX_TARGET_PATH = join6(homedir2(), ".codex", "AGENTS.md");
 var ORIENTATION_MARKERS = { start: ORIENTATION_START, end: ORIENTATION_END };
 function buildTargetBody(existing, block, markers) {
   const wrapped = `${markers.start}
@@ -2396,20 +2837,20 @@ ${block}${markers.end}${section.after}`;
 }
 async function backupOnce(target, existing) {
   const bak = `${target}.basou-bak`;
-  const already = await readMarkdownFile2(bak);
+  const already = await readMarkdownFile3(bak);
   if (already !== null) return;
   await writeFileDurable(bak, existing ?? "");
 }
 async function syncMarkerBlock(opts) {
   const { target, markers, block } = opts;
   await assertNotSymlink(target);
-  const existing = await readMarkdownFile2(target);
+  const existing = await readMarkdownFile3(target);
   const newBody = buildTargetBody(existing, block, markers);
   if (newBody === existing) return { action: "unchanged" };
   const hadBlock = existing !== null && parseMarkers(existing, markers).kind === "ok";
   const action = hadBlock ? "updated" : "installed";
   if (opts.dryRun === true) return { action };
-  const recheck = await readMarkdownFile2(target);
+  const recheck = await readMarkdownFile3(target);
   if (recheck !== existing) {
     throw new Error(
       "The target changed during sync; aborting so a concurrent edit is not overwritten. Re-run the command."
@@ -2431,12 +2872,12 @@ function assertNoMarkerLine(body, markers) {
 async function removeMarkerBlock(opts) {
   const { target, markers, fileLabel } = opts;
   await assertNotSymlink(target);
-  const existing = await readMarkdownFile2(target);
+  const existing = await readMarkdownFile3(target);
   if (existing === null) return { removed: false };
   const newBody = removeMarkerSection(existing, fileLabel, markers);
   if (newBody === existing) return { removed: false };
   if (opts.dryRun === true) return { removed: true };
-  const recheck = await readMarkdownFile2(target);
+  const recheck = await readMarkdownFile3(target);
   if (recheck !== existing) {
     throw new Error(
       "The target changed during unsync; aborting so a concurrent edit is not overwritten. Re-run the command."
@@ -2517,7 +2958,7 @@ async function doRunChannelClear(face, options) {
 // src/commands/decision.ts
 import { readFile as readFile3 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join6, resolve as resolve4 } from "path";
+import { join as join7, resolve as resolve4 } from "path";
 import {
   AGENT_INFRA_DIRS as AGENT_INFRA_DIRS2,
   acquireLock as acquireLock2,
@@ -2533,7 +2974,7 @@ import {
   LOCAL_CLI_EVENT_SOURCE as LOCAL_CLI_EVENT_SOURCE2,
   loadSessionEntries,
   prefixedUlid as prefixedUlid2,
-  readManifest as readManifest4,
+  readManifest as readManifest5,
   replayEvents as replayEvents2,
   resolveSessionId,
   sanitizePath
@@ -2796,7 +3237,7 @@ async function runDecisionRecord(options, ctx = {}) {
 async function warnLinkedFilesOutsideRoots(input) {
   if (input.linkedFiles.length === 0) return;
   try {
-    const manifest = await readManifest4(input.paths);
+    const manifest = await readManifest5(input.paths);
     if ((manifest.import?.source_roots?.length ?? 0) === 0) return;
     const scope = await classifyFilesBySourceRoot2({
       files: input.linkedFiles,
@@ -2862,7 +3303,7 @@ async function doRunDecisionRecord(options, ctx) {
     });
     return;
   }
-  const manifest = await readManifest4(paths);
+  const manifest = await readManifest5(paths);
   const adHoc = await createAdHocSessionWithEvent({
     paths,
     manifest,
@@ -2926,7 +3367,7 @@ async function doRunDecisionCapture(options, ctx) {
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
   const occurredAt = now.toISOString();
   const decisionIds = decisions.map(() => prefixedUlid2("decision"));
-  const manifest = await readManifest4(paths);
+  const manifest = await readManifest5(paths);
   const invocationArgs = options.file !== void 0 ? [
     "--file",
     sanitizePath(resolve4(cwd, options.file), {
@@ -3032,7 +3473,7 @@ async function doRunDecisionVoid(decisionId, options, ctx) {
     });
     return;
   }
-  const manifest = await readManifest4(paths);
+  const manifest = await readManifest5(paths);
   const adHoc = await createAdHocSessionWithEvent({
     paths,
     manifest,
@@ -3068,7 +3509,7 @@ function isDecisionId(value) {
 async function decisionExists(paths, decisionId) {
   const entries = await loadSessionEntries(paths, { now: /* @__PURE__ */ new Date() });
   for (const entry of entries) {
-    const sessionDir = join6(paths.sessions, entry.sessionId);
+    const sessionDir = join7(paths.sessions, entry.sessionId);
     try {
       for await (const ev of replayEvents2(sessionDir, {})) {
         if (ev.type === "decision_recorded" && ev.decision_id === decisionId) return true;
@@ -3480,7 +3921,7 @@ import {
   assertBasouRootSafe as assertBasouRootSafe5,
   basouPaths as basouPaths7,
   findErrorCode as findErrorCode5,
-  readMarkdownFile as readMarkdownFile3,
+  readMarkdownFile as readMarkdownFile4,
   renderDecisions as renderDecisions2,
   renderWithMarkers as renderWithMarkers2,
   writeMarkdownFile as writeMarkdownFile2
@@ -3512,7 +3953,7 @@ async function doRunDecisionsGenerate(options, ctx) {
     onWarning: (w, sid) => printReplayWarning(w, sid),
     onSessionSkip: (sid, reason) => printSessionSkip(sid, reason)
   });
-  const existing = await readMarkdownFile3(paths.files.decisions);
+  const existing = await readMarkdownFile4(paths.files.decisions);
   const finalBody = renderWithMarkers2(existing, result.body, "decisions.md");
   await writeMarkdownFile2(paths.files.decisions, finalBody);
   console.log(`Generated .basou/decisions.md (decisions: ${result.decisionCount})`);
@@ -3531,7 +3972,7 @@ async function assertWorkspaceInitialized5(basouRoot) {
 // src/commands/exec.ts
 import { mkdir as mkdir2, rm as rm2 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import {
   acquireLock as acquireLock3,
   assertBasouRootSafe as assertBasouRootSafe6,
@@ -3545,7 +3986,7 @@ import {
   overwriteYamlFile,
   parseDuration,
   prefixedUlid as prefixedUlid3,
-  readManifest as readManifest5,
+  readManifest as readManifest6,
   readYamlFile as readYamlFile2,
   SESSION_SCHEMA_VERSION,
   SessionSchema,
@@ -3572,15 +4013,15 @@ async function runExec(command, args, options, ctx = {}) {
   const repoRoot = await resolveRepositoryRootInPlace(cwd, "exec");
   const paths = basouPaths8(repoRoot);
   await assertBasouRootSafe6(paths.root);
-  const manifest = await readManifest5(paths);
+  const manifest = await readManifest6(paths);
   await assertSessionStoreSafe2(paths);
   const sessionId = prefixedUlid3("ses");
-  const sessionDir = join7(paths.sessions, sessionId);
+  const sessionDir = join8(paths.sessions, sessionId);
   const appendEvent = ctx.appendEvent ?? (async (_sessionDir, event) => {
     await coreAppendChainedEvent(paths, sessionId, event);
   });
   const startedAt = now().toISOString();
-  const sessionYamlPath = join7(sessionDir, "session.yaml");
+  const sessionYamlPath = join8(sessionDir, "session.yaml");
   const session = buildInitialSession({
     id: sessionId,
     command,
@@ -3873,7 +4314,7 @@ import {
   assertBasouRootSafe as assertBasouRootSafe7,
   basouPaths as basouPaths9,
   findErrorCode as findErrorCode6,
-  readMarkdownFile as readMarkdownFile4,
+  readMarkdownFile as readMarkdownFile5,
   renderHandoff as renderHandoff2,
   renderWithMarkers as renderWithMarkers3,
   writeMarkdownFile as writeMarkdownFile3
@@ -3906,7 +4347,7 @@ async function doRunHandoffGenerate(options, ctx) {
     onSessionSkip: (sid, reason) => printSessionSkip(sid, reason),
     onTaskSkip: (taskId, reason) => printTaskSkip(taskId, reason)
   });
-  const existing = await readMarkdownFile4(paths.files.handoff);
+  const existing = await readMarkdownFile5(paths.files.handoff);
   const finalBody = renderWithMarkers3(existing, result.body, "handoff.md");
   await writeMarkdownFile3(paths.files.handoff, finalBody);
   console.log(
@@ -3941,7 +4382,7 @@ async function assertWorkspaceInitialized6(basouRoot) {
 import { execFile } from "child_process";
 import { open as open2, readFile as readFile4, realpath as realpath4, stat as stat4 } from "fs/promises";
 import { homedir as homedir7 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
 import {
@@ -3968,7 +4409,7 @@ import {
   parseProtocolStamp,
   protocolSectionsFrom,
   protocolUpdateToken,
-  readManifest as readManifest6,
+  readManifest as readManifest7,
   readMarkdownFile as readMarkdownFile6,
   recordSessionBaseline,
   removeClaudeSessionStartHook,
@@ -3995,12 +4436,12 @@ function commandHandlerFields(handler) {
     out.additionalContextLimit = handler.additionalContextLimit;
   return out;
 }
-function canonicalize(value) {
-  if (Array.isArray(value)) return value.map(canonicalize);
+function canonicalize2(value) {
+  if (Array.isArray(value)) return value.map(canonicalize2);
   if (typeof value === "object" && value !== null) {
     const src = value;
     const out = {};
-    for (const key of Object.keys(src).sort()) out[key] = canonicalize(src[key]);
+    for (const key of Object.keys(src).sort()) out[key] = canonicalize2(src[key]);
     return out;
   }
   return value;
@@ -4019,7 +4460,7 @@ function computeCodexHookIdentityHash(input) {
   }
   const identity = { event_name: input.eventKey, hooks: [normalized] };
   if (input.matcher !== void 0) identity.matcher = input.matcher;
-  const blob = JSON.stringify(canonicalize(identity));
+  const blob = JSON.stringify(canonicalize2(identity));
   return `sha256:${createHash("sha256").update(blob, "utf8").digest("hex")}`;
 }
 function codexHookStateKey(hooksPath, eventKey, groupIndex, handlerIndex) {
@@ -4100,148 +4541,17 @@ function describeCodexHookTrust(trust) {
   }
 }
 
-// src/lib/foreign-workspace-warn.ts
-import { realpath as realpath3 } from "fs/promises";
-import { dirname as dirname5 } from "path";
-import { loadPortfolioConfig as loadPortfolioConfig2, readMarkdownFile as readMarkdownFile5 } from "@basou/core";
-
-// src/lib/foreign-workspace-scan.ts
-import { homedir as osHomedir } from "os";
-import { basename as basename5, normalize, sep as sep2 } from "path";
-var MIN_TOKEN_LENGTH = 4;
-function stripTrailingSep(p) {
-  return p.length > 1 && p.endsWith(sep2) ? p.slice(0, -sep2.length) : p;
-}
-function toTildePath(absPath, home) {
-  if (absPath === home) return "~";
-  if (absPath.startsWith(home + sep2)) return `~${absPath.slice(home.length)}`;
-  return null;
-}
-function encodedSpelling(name) {
-  return name.replace(/[^a-zA-Z0-9]/g, "-");
-}
-function directoryNameSpellings(dir) {
-  const paired = /^(.+)-(planning|workspace)$/.exec(dir);
-  const plain = paired !== null ? [`${paired[1]}-planning`, `${paired[1]}-workspace`] : [dir, `${dir}-workspace`];
-  return [...plain, ...plain.map(encodedSpelling)];
-}
-function nameTokensFor(workspacePath, home) {
-  const abs = stripTrailingSep(normalize(workspacePath));
-  const tokens = /* @__PURE__ */ new Set([abs]);
-  const tilde = toTildePath(abs, home);
-  if (tilde !== null) tokens.add(tilde);
-  for (const name of directoryNameSpellings(basename5(abs))) tokens.add(name);
-  return [...tokens].filter((t) => t.length >= MIN_TOKEN_LENGTH);
-}
-function isSpellingOfSelf(workspacePath, selfPath) {
-  const own = new Set(directoryNameSpellings(basename5(stripTrailingSep(normalize(selfPath)))));
-  return directoryNameSpellings(basename5(stripTrailingSep(normalize(workspacePath)))).some(
-    (s) => own.has(s)
-  );
-}
-function scanForeignWorkspaceNames(input) {
-  if (input.text.length === 0 || input.workspacePaths.length === 0) return [];
-  const home = input.homedir ?? osHomedir();
-  const own = input.selfPath === void 0 ? [] : nameTokensFor(input.selfPath, home);
-  const lines = input.text.split("\n");
-  const hits = [];
-  for (const workspacePath of input.workspacePaths) {
-    if (input.selfPath !== void 0 && isSpellingOfSelf(workspacePath, input.selfPath)) continue;
-    const tokens = nameTokensFor(workspacePath, home).filter(
-      (token) => !own.some((ownToken) => ownToken.includes(token))
-    );
-    if (tokens.length === 0) continue;
-    const matched = /* @__PURE__ */ new Set();
-    const matchedLines = [];
-    for (const [index, line] of lines.entries()) {
-      let lineMatched = false;
-      for (const token of tokens) {
-        if (line.includes(token)) {
-          matched.add(token);
-          lineMatched = true;
-        }
-      }
-      if (lineMatched) matchedLines.push(index + 1);
-    }
-    if (matchedLines.length === 0) continue;
-    hits.push({
-      workspacePath,
-      tokens: [...matched].sort((a, b) => b.length - a.length || a.localeCompare(b)),
-      lines: matchedLines
-    });
-  }
-  return hits;
-}
-
-// src/lib/foreign-workspace-warn.ts
-var MAX_LISTED_LINES = 5;
-async function canonicalize2(path) {
-  try {
-    return await realpath3(path);
-  } catch {
-    return path;
-  }
-}
-async function findForeignWorkspaceNames(args) {
-  let workspacePaths;
-  let selfPath;
-  try {
-    const workspaces = await loadPortfolioConfig2(args.configPath);
-    workspacePaths = await Promise.all(workspaces.map((w) => canonicalize2(w.path)));
-    selfPath = args.selfPath === void 0 ? void 0 : await canonicalize2(args.selfPath);
-  } catch {
-    return null;
-  }
-  const hits = scanForeignWorkspaceNames({
-    text: args.text,
-    workspacePaths,
-    selfPath
-  });
-  if (hits.length === 0) return null;
-  const lines = [...new Set(hits.flatMap((h) => h.lines))].sort((a, b) => a - b);
-  return { workspaceCount: hits.length, lines };
-}
-function describeForeignWorkspaceLines(lines) {
-  const listed = lines.slice(0, MAX_LISTED_LINES).join(", ");
-  const rest = lines.length - MAX_LISTED_LINES;
-  const numbers = rest > 0 ? `${listed} and ${rest} more` : listed;
-  return `${lines.length === 1 ? "line" : "lines"} ${numbers}`;
-}
-function positionForeignWorkspaceWarning(report, where) {
-  const subject = report.workspaceCount === 1 ? "names another registered workspace" : `names ${report.workspaceCount} other registered workspaces`;
-  return `basou: this workspace's position ${subject} (${where}, ${describeForeignWorkspaceLines(report.lines)}). The position is handed to the agent session running in this workspace, so those names travel with it. Advisory only: nothing was withheld.`;
-}
-function protocolForeignWorkspaceWarning(report) {
-  const subject = report.workspaceCount === 1 ? "names a registered workspace" : `names ${report.workspaceCount} registered workspaces`;
-  return `basou: the protocol block ${subject} (block ${describeForeignWorkspaceLines(report.lines)}, counted from the block's first line, not the file's). Standing protocols are written to the user-global CLAUDE.md, which every project on this machine loads, so a workspace-specific name there reaches every workspace's sessions. Only the basou-managed block is checked; the rest of that file is not basou's to inspect. Advisory only: nothing was withheld.`;
-}
-async function warnIfPositionNamesOtherWorkspaces(args) {
-  try {
-    const body = await readMarkdownFile5(args.paths.files.orientation);
-    if (body === null) return;
-    const report = await findForeignWorkspaceNames({
-      text: body,
-      selfPath: dirname5(args.paths.root),
-      configPath: args.configPath
-    });
-    if (report !== null) {
-      console.error(positionForeignWorkspaceWarning(report, args.paths.files.orientation));
-    }
-  } catch {
-  }
-}
-
 // src/lib/protocols-config.ts
 import { homedir as homedir5 } from "os";
-import { isAbsolute, join as join8, resolve as resolve5 } from "path";
+import { isAbsolute, join as join9, resolve as resolve5 } from "path";
 import { readYamlFile as readYamlFile3 } from "@basou/core";
-var DEFAULT_PROTOCOLS_CONFIG_PATH = join8(homedir5(), ".basou", "protocols.yaml");
-var DEFAULT_TARGET_PATH = join8(homedir5(), ".claude", "CLAUDE.md");
+var DEFAULT_PROTOCOLS_CONFIG_PATH = join9(homedir5(), ".basou", "protocols.yaml");
+var DEFAULT_TARGET_PATH = join9(homedir5(), ".claude", "CLAUDE.md");
 var ALLOWED_TOP_KEYS = /* @__PURE__ */ new Set(["version", "protocols"]);
 var ALLOWED_ENTRY_KEYS = /* @__PURE__ */ new Set(["source", "title"]);
 function expandTilde(p) {
   if (p === "~") return homedir5();
-  if (p.startsWith("~/")) return join8(homedir5(), p.slice(2));
+  if (p.startsWith("~/")) return join9(homedir5(), p.slice(2));
   return p;
 }
 function isRecord(value) {
@@ -4319,12 +4629,12 @@ import {
 
 // src/lib/hosts-config.ts
 import { homedir as homedir6 } from "os";
-import { isAbsolute as isAbsolute2, join as join9, resolve as resolve6 } from "path";
+import { isAbsolute as isAbsolute2, join as join10, resolve as resolve6 } from "path";
 import { readYamlFile as readYamlFile4 } from "@basou/core";
-var DEFAULT_HOSTS_CONFIG_PATH = join9(homedir6(), ".basou", "hosts.yaml");
+var DEFAULT_HOSTS_CONFIG_PATH = join10(homedir6(), ".basou", "hosts.yaml");
 function expandTilde2(p) {
   if (p === "~") return homedir6();
-  if (p.startsWith("~/")) return join9(homedir6(), p.slice(2));
+  if (p.startsWith("~/")) return join10(homedir6(), p.slice(2));
   return p;
 }
 function isRecord2(value) {
@@ -4444,6 +4754,7 @@ async function renderOrientationForRoot(repositoryRoot, options, ctx, behaviour)
     paths,
     nowIso,
     staleness,
+    board: await glanceDefaultBoard(repositoryRoot, paths),
     verbose: options.verbose === true,
     federatedRoots,
     onWarning: (w, sid) => printReplayWarning(w, sid),
@@ -4845,7 +5156,7 @@ async function observeSessionFromPayload(fields, pass, portfolioConfigPath) {
     });
     return;
   }
-  const manifest = await readManifest6(paths);
+  const manifest = await readManifest7(paths);
   await recordSessionBaseline({
     observationsDir: paths.observations,
     repoRoots: observedRepoRoots(root, manifest),
@@ -4907,7 +5218,7 @@ function parseMinEdits(raw) {
   if (raw === void 0 || !/^\d+$/.test(raw)) return void 0;
   return Number(raw);
 }
-var DEFAULT_CLAUDE_SETTINGS_PATH = join10(homedir7(), ".claude", "settings.json");
+var DEFAULT_CLAUDE_SETTINGS_PATH = join11(homedir7(), ".claude", "settings.json");
 function resolveCliEntry() {
   return fileURLToPath(import.meta.url);
 }
@@ -5264,7 +5575,7 @@ function describeHookMode(tiers) {
   const gates = tiers.review ? "capture + review" : "capture";
   return `${enforcement}, ${gates}`;
 }
-var DEFAULT_CODEX_FACE_PATH = join10(homedir7(), ".codex", "AGENTS.md");
+var DEFAULT_CODEX_FACE_PATH = join11(homedir7(), ".codex", "AGENTS.md");
 var LEFTOVER_FACE_NOTE = (label) => `${label} still carries an orientation block rendered by an earlier basou (0.39 or before); every Codex session on this machine reads it. \`basou channel clear codex\` removes it.`;
 async function faceHasLeftoverOrientationBlock(facePath) {
   try {
@@ -5276,8 +5587,8 @@ async function faceHasLeftoverOrientationBlock(facePath) {
     return false;
   }
 }
-var DEFAULT_CODEX_HOOKS_PATH = join10(homedir7(), ".codex", "hooks.json");
-var DEFAULT_CODEX_CONFIG_PATH = join10(homedir7(), ".codex", "config.toml");
+var DEFAULT_CODEX_HOOKS_PATH = join11(homedir7(), ".codex", "hooks.json");
+var DEFAULT_CODEX_CONFIG_PATH = join11(homedir7(), ".codex", "config.toml");
 async function readHooksFile(path) {
   let raw;
   try {
@@ -5535,7 +5846,7 @@ import {
   EVENT_SCHEMA_VERSION as EVENT_SCHEMA_VERSION4,
   findErrorCode as findErrorCode8,
   LOCAL_CLI_EVENT_SOURCE as LOCAL_CLI_EVENT_SOURCE3,
-  readManifest as readManifest7,
+  readManifest as readManifest8,
   resolveSessionId as resolveSessionId2,
   sanitizePath as sanitizePath2
 } from "@basou/core";
@@ -5647,7 +5958,7 @@ ${HEREDOC_EXAMPLE}`
     });
     return;
   }
-  const manifest = await readManifest7(paths);
+  const manifest = await readManifest8(paths);
   const adHoc = await createAdHocSessionWithEvent2({
     paths,
     manifest,
@@ -5895,7 +6206,7 @@ import {
   writeFileSync,
   writeSync
 } from "fs";
-import { basename as basename7, dirname as dirname6, isAbsolute as isAbsolute3, join as join11, relative as relative3, resolve as resolve9 } from "path";
+import { basename as basename7, dirname as dirname7, isAbsolute as isAbsolute3, join as join12, relative as relative3, resolve as resolve9 } from "path";
 import {
   appendBasouGitignore as appendBasouGitignore2,
   basouPaths as basouPaths13,
@@ -5913,7 +6224,7 @@ import {
   planRename,
   planRosterAdoption,
   planWorkspaceView,
-  readManifest as readManifest8,
+  readManifest as readManifest9,
   readMarkdownFile as readMarkdownFile7,
   reconcileSourceRoots,
   removeMarkerSection as removeMarkerSection2,
@@ -6061,7 +6372,7 @@ async function doRunProjectCheck(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project check");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const roster = summarizeRosterDrift({
     ...manifest.repos !== void 0 ? { repos: manifest.repos } : {},
     sourceRoots: effectiveSourceRoots(manifest)
@@ -6196,7 +6507,7 @@ async function doRunProjectSync(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project sync");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const hasRoster = manifest.repos !== void 0 && manifest.repos.length > 0;
   const reconcile = reconcileSourceRoots({
     ...manifest.repos !== void 0 ? { repos: manifest.repos } : {},
@@ -6276,13 +6587,13 @@ function classifySourceRoot(repositoryRoot, declaredPath) {
   } catch {
     return { path: declaredPath, kind: "unresolved" };
   }
-  return { path: declaredPath, kind: existsSync(join11(real, ".git")) ? "repo" : "non-repo" };
+  return { path: declaredPath, kind: existsSync(join12(real, ".git")) ? "repo" : "non-repo" };
 }
 async function doRunProjectAdopt(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project adopt");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const alreadyDeclared = manifest.repos !== void 0 && manifest.repos.length > 0;
   const candidates = effectiveSourceRoots(manifest).map(
     (r) => classifySourceRoot(repositoryRoot, r)
@@ -6380,7 +6691,7 @@ async function gatherRepoWiring(repositoryRoot, entry) {
   } catch {
     return { ...base, reachable: false, instructionFiles: [] };
   }
-  if (!existsSync(join11(real, ".git"))) {
+  if (!existsSync(join12(real, ".git"))) {
     return { ...base, reachable: false, instructionFiles: [] };
   }
   try {
@@ -6388,7 +6699,7 @@ async function gatherRepoWiring(repositoryRoot, entry) {
     for (const name of INSTRUCTION_FILES) {
       let present = true;
       try {
-        lstatSync(join11(real, name));
+        lstatSync(join12(real, name));
       } catch {
         present = false;
       }
@@ -6404,7 +6715,7 @@ async function doRunProjectWiring(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project wiring");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const roster = manifest.repos ?? [];
   const facts = [];
   for (const entry of roster) facts.push(await gatherRepoWiring(repositoryRoot, entry));
@@ -6499,10 +6810,10 @@ function gatherRepoGitignore(repositoryRoot, entry) {
   } catch {
     return { ...base, reachable: false, currentLines: [] };
   }
-  if (!existsSync(join11(real, ".git"))) {
+  if (!existsSync(join12(real, ".git"))) {
     return { ...base, reachable: false, currentLines: [] };
   }
-  return { ...base, reachable: true, currentLines: readGitignoreLines(join11(real, ".gitignore")) };
+  return { ...base, reachable: true, currentLines: readGitignoreLines(join12(real, ".gitignore")) };
 }
 function hasErrorCode(error) {
   return error instanceof Error && typeof error.code === "string";
@@ -6516,7 +6827,7 @@ function readGitignoreLines(file) {
   }
 }
 function applyGitignorePlan(repositoryRoot, plan) {
-  const file = join11(realpathSync(resolve9(repositoryRoot, plan.path)), ".gitignore");
+  const file = join12(realpathSync(resolve9(repositoryRoot, plan.path)), ".gitignore");
   let existing = "";
   try {
     existing = readFileSync(file, "utf8");
@@ -6537,7 +6848,7 @@ async function doRunProjectGitignore(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project gitignore");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const roster = manifest.repos ?? [];
   const facts = roster.map((entry) => gatherRepoGitignore(repositoryRoot, entry));
   const summary = planGitignore({ repos: facts, required: [...INSTRUCTION_FILES] });
@@ -6656,7 +6967,7 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
     return { ...base, isAnchor: false, reachable: false, canonicalPresent: false, files: [] };
   }
   if (real === anchorReal) {
-    const anchorCanonical = join11(real, CANONICAL_FILE);
+    const anchorCanonical = join12(real, CANONICAL_FILE);
     const anchorState = anchorCanonicalState(anchorCanonical);
     if (anchorState === "absent") {
       return { ...base, isAnchor: true, reachable: true, canonicalPresent: false, files: [] };
@@ -6676,7 +6987,7 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
       anchorCanonical,
       "self"
     ).map((spec) => {
-      const { state, actualTarget } = inspectSymlink(join11(real, spec.name), spec.target);
+      const { state, actualTarget } = inspectSymlink(join12(real, spec.name), spec.target);
       return {
         name: spec.name,
         expectedTarget: spec.target,
@@ -6693,16 +7004,16 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
       files: anchorFiles
     };
   }
-  if (!existsSync(join11(real, ".git"))) {
+  if (!existsSync(join12(real, ".git"))) {
     return { ...base, isAnchor: false, reachable: false, canonicalPresent: false, files: [] };
   }
-  const canonicalFile = isSelf ? join11(real, CANONICAL_FILE) : join11(anchorReal, "agents", basename7(real), CANONICAL_FILE);
+  const canonicalFile = isSelf ? join12(real, CANONICAL_FILE) : join12(anchorReal, "agents", basename7(real), CANONICAL_FILE);
   if (!existsSync(canonicalFile)) {
     return { ...base, isAnchor: false, reachable: true, canonicalPresent: false, files: [] };
   }
   const files = expectedSymlinkTargets(real, canonicalFile, mode).map(
     (spec) => {
-      const { state, actualTarget } = inspectSymlink(join11(real, spec.name), spec.target);
+      const { state, actualTarget } = inspectSymlink(join12(real, spec.name), spec.target);
       return {
         name: spec.name,
         expectedTarget: spec.target,
@@ -6731,9 +7042,9 @@ function applySymlinkPlan(repositoryRoot, plan) {
   const created = [];
   const failed = [];
   for (const { name, target } of plan.toCreate) {
-    const filePath = join11(real, name);
+    const filePath = join12(real, name);
     try {
-      mkdirSync(dirname6(filePath), { recursive: true });
+      mkdirSync(dirname7(filePath), { recursive: true });
       symlinkSync(target, filePath);
       created.push(name);
     } catch (error) {
@@ -6765,7 +7076,7 @@ function gatherViewSymlinks(repositoryRoot, anchorReal, roster, viewDir) {
   if (!existsSync(canonicalFile)) return { kind: "missing-canonical", viewName };
   const files = expectedSymlinkTargets(viewDir, canonicalFile, "hub").map(
     (spec) => {
-      const { state, actualTarget } = inspectSymlink(join11(viewDir, spec.name), spec.target);
+      const { state, actualTarget } = inspectSymlink(join12(viewDir, spec.name), spec.target);
       return {
         name: spec.name,
         expectedTarget: spec.target,
@@ -6781,9 +7092,9 @@ function applyViewSymlinks(viewDir, files) {
   const failed = [];
   for (const f of files) {
     if (f.state !== "missing") continue;
-    const filePath = join11(viewDir, f.name);
+    const filePath = join12(viewDir, f.name);
     try {
-      mkdirSync(dirname6(filePath), { recursive: true });
+      mkdirSync(dirname7(filePath), { recursive: true });
       symlinkSync(f.expectedTarget, filePath);
       created.push(f.name);
     } catch (error) {
@@ -6796,7 +7107,7 @@ async function doRunProjectSymlinks(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project symlinks");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const roster = manifest.repos ?? [];
   const anchorReal = realpathSync(repositoryRoot);
   const facts = roster.map((entry) => gatherRepoSymlinks(repositoryRoot, anchorReal, entry));
@@ -7003,7 +7314,7 @@ function resolveViewDir(repositoryRoot, viewPath) {
     return realpathSync(abs);
   } catch {
     try {
-      return join11(realpathSync(dirname6(abs)), basename7(abs));
+      return join12(realpathSync(dirname7(abs)), basename7(abs));
     } catch {
       return abs;
     }
@@ -7021,7 +7332,7 @@ function gatherViewRepo(repositoryRoot, viewDir, entry) {
     return { path: entry.path, reachable: false };
   }
   const linkName = basename7(repoReal);
-  const { state, actualTarget } = inspectSymlink(join11(viewDir, linkName), expectedTarget);
+  const { state, actualTarget } = inspectSymlink(join12(viewDir, linkName), expectedTarget);
   return {
     path: entry.path,
     reachable: true,
@@ -7035,9 +7346,9 @@ function applyViewPlan(viewDir, toCreate) {
   const created = [];
   const failed = [];
   for (const { name, target } of toCreate) {
-    const filePath = join11(viewDir, name);
+    const filePath = join12(viewDir, name);
     try {
-      mkdirSync(dirname6(filePath), { recursive: true });
+      mkdirSync(dirname7(filePath), { recursive: true });
       symlinkSync(target, filePath);
       created.push(name);
     } catch (error) {
@@ -7050,7 +7361,7 @@ var TOP_LEVEL_INSTRUCTION_FILES_LOWER = new Set(
   INSTRUCTION_FILES.filter((f) => !f.includes("/")).map((f) => f.toLowerCase())
 );
 function classifyViewLink(viewDir, name, rosterRealpaths) {
-  const filePath = join11(viewDir, name);
+  const filePath = join12(viewDir, name);
   let isLink;
   try {
     isLink = lstatSync(filePath).isSymbolicLink();
@@ -7079,7 +7390,7 @@ function classifyViewLink(viewDir, name, rosterRealpaths) {
   if (!isDir) {
     return { target, kind: existsSync(resolved) ? "non-repo" : "broken" };
   }
-  return { target, kind: existsSync(join11(resolved, ".git")) ? "repo" : "non-repo" };
+  return { target, kind: existsSync(join12(resolved, ".git")) ? "repo" : "non-repo" };
 }
 function gatherExistingViewLinks(viewDir, rosterRealpaths) {
   let names;
@@ -7104,7 +7415,7 @@ function pruneViewLinks(viewDir, toPrune, rosterRealpaths) {
   const pruned = [];
   const failed = [];
   for (const { name } of toPrune) {
-    const filePath = join11(viewDir, name);
+    const filePath = join12(viewDir, name);
     const c = classifyViewLink(viewDir, name, rosterRealpaths);
     if (c === null || c.kind !== "repo") {
       failed.push({
@@ -7126,7 +7437,7 @@ async function doRunProjectWorkspace(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project workspace");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const viewPath = manifest.workspace.view;
   const roster = manifest.repos ?? [];
   let result;
@@ -7317,10 +7628,10 @@ async function runProjectPreset(options, ctx = {}) {
   }
 }
 function canonicalFileFor(anchorReal, canonicalName) {
-  return join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+  return join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
 }
 function canonicalLabelFor(canonicalName) {
-  return join11("agents", canonicalName, CANONICAL_FILE);
+  return join12("agents", canonicalName, CANONICAL_FILE);
 }
 async function gatherRepoPreset(repositoryRoot, anchorReal, entry) {
   const declared = {
@@ -7341,7 +7652,7 @@ async function gatherRepoPreset(repositoryRoot, anchorReal, entry) {
   if (real === anchorReal) {
     return { ...declared, isAnchor: true, reachable: true, canonicalPresent: false };
   }
-  if (!existsSync(join11(real, ".git"))) {
+  if (!existsSync(join12(real, ".git"))) {
     return { ...declared, isAnchor: false, reachable: false, canonicalPresent: false };
   }
   const canonicalName = basename7(real);
@@ -7455,7 +7766,7 @@ async function applyViewPreset(anchorReal, outcome) {
     isLink = false;
   }
   if (isLink) throw new Error(`Canonical is a symlink in ${label}`);
-  if (outcome.action === "create") mkdirSync(dirname6(file), { recursive: true });
+  if (outcome.action === "create") mkdirSync(dirname7(file), { recursive: true });
   const existing = await readMarkdownFile7(file);
   await writeMarkdownFile5(file, renderWithMarkers4(existing, outcome.block, label));
 }
@@ -7469,7 +7780,7 @@ async function applyPresetPlan(anchorReal, plan) {
     isLink = false;
   }
   if (isLink) throw new Error(`Canonical is a symlink in ${label}`);
-  if (plan.action === "create") mkdirSync(dirname6(file), { recursive: true });
+  if (plan.action === "create") mkdirSync(dirname7(file), { recursive: true });
   const existing = await readMarkdownFile7(file);
   await writeMarkdownFile5(file, renderWithMarkers4(existing, plan.desiredBlock, label));
 }
@@ -7486,7 +7797,7 @@ async function doRunProjectPreset(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project preset");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const roster = manifest.repos ?? [];
   const anchorReal = realpathSync(repositoryRoot);
   const facts = [];
@@ -7723,24 +8034,24 @@ function gatherArchiveTeardown(repositoryRoot, manifest, target) {
   const instructionFiles = [];
   for (const name of INSTRUCTION_FILES) {
     try {
-      lstatSync(join11(real, name));
+      lstatSync(join12(real, name));
       instructionFiles.push(name);
     } catch {
     }
   }
   let ignored;
   try {
-    ignored = new Set(readGitignoreLines(join11(real, ".gitignore")).map((l) => l.trim()));
+    ignored = new Set(readGitignoreLines(join12(real, ".gitignore")).map((l) => l.trim()));
   } catch {
     ignored = /* @__PURE__ */ new Set();
   }
   const gitignorePatterns = INSTRUCTION_FILES.filter((p) => ignored.has(p) || ignored.has(`/${p}`));
-  const canonical2 = existsSync(join11(anchorReal, "agents", canonicalName, CANONICAL_FILE));
+  const canonical2 = existsSync(join12(anchorReal, "agents", canonicalName, CANONICAL_FILE));
   let viewLink = false;
   const viewPath = manifest.workspace.view;
   if (viewPath !== void 0) {
     try {
-      lstatSync(join11(resolveViewDir(repositoryRoot, viewPath), canonicalName));
+      lstatSync(join12(resolveViewDir(repositoryRoot, viewPath), canonicalName));
       viewLink = true;
     } catch {
     }
@@ -7754,11 +8065,11 @@ function gatherArchiveTeardown(repositoryRoot, manifest, target) {
   };
 }
 function teardownExpectedTargets(repoReal, anchorReal, canonicalName) {
-  const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+  const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
   return expectedSymlinkTargets(repoReal, canonicalFile);
 }
 function viewLinkPointsAt(viewDir, name, repoReal) {
-  const filePath = join11(viewDir, name);
+  const filePath = join12(viewDir, name);
   try {
     if (!lstatSync(filePath).isSymbolicLink()) return false;
     const target = readlinkSync(filePath);
@@ -7769,7 +8080,7 @@ function viewLinkPointsAt(viewDir, name, repoReal) {
   }
 }
 function viewLinkPointsAtPath(viewDir, name, expectedRepoPath) {
-  const filePath = join11(viewDir, name);
+  const filePath = join12(viewDir, name);
   try {
     if (!lstatSync(filePath).isSymbolicLink()) return false;
     const target = readlinkSync(filePath);
@@ -7820,7 +8131,7 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
   if (!isAnchor) {
     if (repoReal !== void 0) {
       for (const spec of teardownExpectedTargets(repoReal, anchorReal, canonicalName)) {
-        const { state, actualTarget } = inspectSymlink(join11(repoReal, spec.name), spec.target);
+        const { state, actualTarget } = inspectSymlink(join12(repoReal, spec.name), spec.target);
         if (isSelf) {
           if (state !== "missing")
             items.push({
@@ -7857,7 +8168,7 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
       }
       let ignored;
       try {
-        ignored = new Set(readGitignoreLines(join11(repoReal, ".gitignore")).map((l) => l.trim()));
+        ignored = new Set(readGitignoreLines(join12(repoReal, ".gitignore")).map((l) => l.trim()));
         for (const p of INSTRUCTION_FILES) {
           if (ignored.has(p) || ignored.has(`/${p}`)) {
             items.push({
@@ -7880,7 +8191,7 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
     const viewPath = manifest.workspace.view;
     if (viewPath !== void 0) {
       const viewDir = resolveViewDir(repositoryRoot, viewPath);
-      const linkPath = join11(viewDir, canonicalName);
+      const linkPath = join12(viewDir, canonicalName);
       let isLink = false;
       try {
         isLink = lstatSync(linkPath).isSymbolicLink();
@@ -7906,8 +8217,8 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
         else items.push({ kind: "view-symlink", label: canonicalName, state: "removable" });
       }
     }
-    const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
-    const canonicalLabel = join11("agents", canonicalName, CANONICAL_FILE);
+    const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+    const canonicalLabel = join12("agents", canonicalName, CANONICAL_FILE);
     let canonicalIsLink = false;
     try {
       canonicalIsLink = lstatSync(canonicalFile).isSymbolicLink();
@@ -8011,12 +8322,12 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
   );
   for (const item of removable.filter((i) => i.kind === "instruction-symlink")) {
     const expected = expectedByName.get(item.label);
-    if (repoReal === null || expected === void 0 || inspectSymlink(join11(repoReal, item.label), expected).state !== "correct") {
+    if (repoReal === null || expected === void 0 || inspectSymlink(join12(repoReal, item.label), expected).state !== "correct") {
       changed(item.label);
       continue;
     }
     try {
-      unlinkSync(join11(repoReal, item.label));
+      unlinkSync(join12(repoReal, item.label));
       removed.push(item.label);
     } catch (error) {
       failed.push({ label: item.label, message: failureReason(error) });
@@ -8035,7 +8346,7 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
       continue;
     }
     try {
-      unlinkSync(join11(viewDir, item.label));
+      unlinkSync(join12(viewDir, item.label));
       removed.push(`view/${item.label}`);
     } catch (error) {
       failed.push({ label: `view/${item.label}`, message: failureReason(error) });
@@ -8043,7 +8354,7 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
   }
   const NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
   for (const item of removable.filter((i) => i.kind === "canonical-block")) {
-    const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+    const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
     try {
       if (lstatSync(canonicalFile).isSymbolicLink()) {
         changed(item.label);
@@ -8145,7 +8456,7 @@ async function doRunProjectTeardown(target, options, ctx = {}) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project teardown");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const plan = gatherRepoTeardown(repositoryRoot, manifest, target);
   const willApply = options.apply === true && !plan.isAnchor && plan.removableCount > 0;
   const { removed, failed } = willApply ? applyRepoTeardown(repositoryRoot, manifest, plan) : { removed: [], failed: [] };
@@ -8187,7 +8498,7 @@ async function doRunProjectArchive(target, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project archive");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const roster = manifest.repos ?? [];
   let targetIsAnchor = false;
   try {
@@ -8317,12 +8628,12 @@ function gatherRenameWiring(repositoryRoot, manifest, oldBasename) {
   } catch {
     return { canonicalDirOld: false, viewLinkOld: false };
   }
-  const canonicalDirOld = existsSync(join11(anchorReal, "agents", oldBasename));
+  const canonicalDirOld = existsSync(join12(anchorReal, "agents", oldBasename));
   let viewLinkOld = false;
   const viewPath = manifest.workspace.view;
   if (viewPath !== void 0) {
     try {
-      lstatSync(join11(resolveViewDir(repositoryRoot, viewPath), oldBasename));
+      lstatSync(join12(resolveViewDir(repositoryRoot, viewPath), oldBasename));
       viewLinkOld = true;
     } catch {
     }
@@ -8344,7 +8655,7 @@ async function doRunProjectRename(oldPath, newPath, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project rename");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const roster = manifest.repos ?? [];
   let oldIsAnchor = false;
   try {
@@ -8618,7 +8929,7 @@ async function doRunProjectDerive(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project derive");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   if (manifest.repos === void 0 || manifest.repos.length === 0) {
     console.log(
       "# Generate project wiring in one pass (declaration \u2192 wiring)\n\n\u2139\uFE0F No repo roster declared (manifest `repos`). Declare one first with `basou project new` (new project) or `basou project adopt` (bootstrap from existing source_roots)."
@@ -8659,7 +8970,7 @@ async function doRunProjectSeedAnchor(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project derive");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const roster = manifest.repos ?? [];
   console.log("# Anchor instruction-file seed (the planning master's own AGENTS.md)");
   console.log("");
@@ -8667,7 +8978,7 @@ async function doRunProjectSeedAnchor(options, ctx) {
     console.log("\u2139\uFE0F No repo roster declared \u2014 nothing to seed.");
     return;
   }
-  const anchorDoc = join11(repositoryRoot, CANONICAL_FILE);
+  const anchorDoc = join12(repositoryRoot, CANONICAL_FILE);
   if (pathPresent(anchorDoc)) {
     console.log(
       `\u2705 The anchor's own \`${CANONICAL_FILE}\` already exists \u2014 hand-maintained, left untouched.`
@@ -8729,7 +9040,7 @@ function regularFileSpokes(repoReal) {
   const out = [];
   for (const spoke of ["CLAUDE.md", ".github/copilot-instructions.md"]) {
     try {
-      const st = lstatSync(join11(repoReal, spoke));
+      const st = lstatSync(join12(repoReal, spoke));
       if (!st.isSymbolicLink() && st.isFile()) out.push(spoke);
     } catch {
     }
@@ -8775,8 +9086,8 @@ function gatherRetrofit(repositoryRoot, anchorReal, roster, argAbs, argReal, vie
     };
   }
   const isAnchor = argReal === anchorReal;
-  const reachable = existsSync(join11(argReal, ".git"));
-  const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+  const reachable = existsSync(join12(argReal, ".git"));
+  const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
   return {
     path,
     declared,
@@ -8785,15 +9096,15 @@ function gatherRetrofit(repositoryRoot, anchorReal, roster, argAbs, argReal, vie
     reachable,
     canonicalName,
     ...viewCanonicalName !== void 0 ? { viewCanonicalName } : {},
-    agentsState: inspectAgentsState(join11(argReal, CANONICAL_FILE)),
+    agentsState: inspectAgentsState(join12(argReal, CANONICAL_FILE)),
     canonicalExists: pathPresent(canonicalFile),
     regularSpokes: regularFileSpokes(argReal)
   };
 }
 function relocateAgentsFile(repoReal, canonicalFile) {
-  const agentsFile = join11(repoReal, CANONICAL_FILE);
+  const agentsFile = join12(repoReal, CANONICAL_FILE);
   try {
-    mkdirSync(dirname6(canonicalFile), { recursive: true });
+    mkdirSync(dirname7(canonicalFile), { recursive: true });
   } catch (error) {
     return { ok: false, message: failureReason(error), partial: false };
   }
@@ -8853,7 +9164,7 @@ async function doRunProjectRetrofit(repo, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project retrofit");
   const paths = basouPaths13(repositoryRoot);
-  const manifest = await readManifest8(paths);
+  const manifest = await readManifest9(paths);
   const roster = manifest.repos ?? [];
   const anchorReal = realpathSync(repositoryRoot);
   const viewPath = manifest.workspace.view;
@@ -8907,7 +9218,7 @@ async function doRunProjectRetrofit(repo, options, ctx) {
   let failure;
   let partial = false;
   if (options.apply === true && plan.action === "relocate" && argReal !== void 0) {
-    const canonicalFile = join11(anchorReal, "agents", plan.canonicalName, CANONICAL_FILE);
+    const canonicalFile = join12(anchorReal, "agents", plan.canonicalName, CANONICAL_FILE);
     const res = relocateAgentsFile(argReal, canonicalFile);
     if (res.ok) {
       applied = true;
@@ -9292,14 +9603,14 @@ import {
   basouPaths as basouPaths14,
   findErrorCode as findErrorCode10,
   loadPortfolioConfig as loadPortfolioConfig5,
-  readManifest as readManifest9
+  readManifest as readManifest10
 } from "@basou/core";
 import { InvalidArgumentError as InvalidArgumentError4 } from "commander";
 
 // src/commands/refresh-watch.ts
-import { readdir as readdir2, stat as stat6 } from "fs/promises";
+import { readdir as readdir3, stat as stat6 } from "fs/promises";
 import { homedir as homedir9 } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import {
   assertApprovalStoreSafe as assertApprovalStoreSafe2,
   assertLockStoreSafe as assertLockStoreSafe4,
@@ -9311,8 +9622,8 @@ var MIN_WATCH_INTERVAL_SEC = 5;
 var MAX_WATCH_INTERVAL_SEC = 86400;
 function watchedRoots(ctx) {
   return [
-    ctx.codexSessionsDir ?? join12(homedir9(), ".codex", "sessions"),
-    ctx.claudeProjectsDir ?? join12(homedir9(), ".claude", "projects")
+    ctx.codexSessionsDir ?? join13(homedir9(), ".codex", "sessions"),
+    ctx.claudeProjectsDir ?? join13(homedir9(), ".claude", "projects")
   ];
 }
 async function scanSourceLogs(roots) {
@@ -9320,13 +9631,13 @@ async function scanSourceLogs(roots) {
   const walk = async (dir) => {
     let entries;
     try {
-      entries = await readdir2(dir, { withFileTypes: true });
+      entries = await readdir3(dir, { withFileTypes: true });
     } catch (error) {
       if (findErrorCode9(error, "ENOENT") || findErrorCode9(error, "ENOTDIR")) return;
       throw new Error("Failed to read a source log directory", { cause: error });
     }
     for (const entry of entries) {
-      const full = join12(dir, entry.name);
+      const full = join13(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
@@ -9609,7 +9920,7 @@ async function warnPosition(paths, result, ctx) {
 }
 async function retiredChannelNotice(paths) {
   try {
-    const manifest = await readManifest9(paths);
+    const manifest = await readManifest10(paths);
     if (manifest.channels?.codex !== true) return null;
     return "codex channel: retired \u2014 the manifest's channels.codex is ignored; a Codex session now receives this workspace's position from the SessionStart hook (see `basou hook status codex`), and nothing is written to the user-global ~/.codex/AGENTS.md";
   } catch {
@@ -9752,7 +10063,7 @@ import {
   findErrorCode as findErrorCode12,
   findUnbindableRepos,
   parseReviewRecordInput,
-  readManifest as readManifest10,
+  readManifest as readManifest11,
   resolveRepoRoot,
   sanitizePath as sanitizePath3
 } from "@basou/core";
@@ -9839,7 +10150,7 @@ async function doRunReviewRecord(options, ctx) {
   }
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
   const occurredAt = now.toISOString();
-  const manifest = await readManifest10(paths);
+  const manifest = await readManifest11(paths);
   const invocationArgs = options.file !== void 0 ? [
     "--file",
     sanitizePath3(resolve11(cwd, options.file), {
@@ -10179,7 +10490,7 @@ function unattachedLines(u) {
 // src/commands/run.ts
 import { mkdir as mkdir3, readFile as readFile8, rm as rm3 } from "fs/promises";
 import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import {
   acquireLock as acquireLock5,
   assertBasouRootSafe as assertBasouRootSafe13,
@@ -10196,7 +10507,7 @@ import {
   getSnapshot as getSnapshot2,
   overwriteYamlFile as overwriteYamlFile2,
   prefixedUlid as prefixedUlid4,
-  readManifest as readManifest11,
+  readManifest as readManifest12,
   readYamlFile as readYamlFile5,
   resolveClaudeCodeCommand,
   resolveCodexCommand,
@@ -10257,15 +10568,15 @@ async function runTrackedTool(args, options, ctx, adapter) {
   const repoRoot = await resolveRepositoryRootInPlace(cwd, "run");
   const paths = basouPaths18(repoRoot);
   await assertBasouRootSafe13(paths.root);
-  const manifest = await readManifest11(paths);
+  const manifest = await readManifest12(paths);
   await assertSessionStoreSafe3(paths);
   const sessionId = prefixedUlid4("ses");
-  const sessionDir = join13(paths.sessions, sessionId);
+  const sessionDir = join14(paths.sessions, sessionId);
   const appendEvent = ctx.appendEvent ?? (async (_sessionDir, event) => {
     await coreAppendChainedEvent2(paths, sessionId, event);
   });
   const startedAt = now().toISOString();
-  const sessionYamlPath = join13(sessionDir, "session.yaml");
+  const sessionYamlPath = join14(sessionDir, "session.yaml");
   const session = buildInitialSession2({
     id: sessionId,
     command,
@@ -10642,7 +10953,7 @@ async function noteCodexHookStatusPreSpawn(_cwd, ctx) {
 
 // src/commands/session.ts
 import { readFile as readFile9 } from "fs/promises";
-import { basename as basename8, isAbsolute as isAbsolute5, join as join14, relative as relative4, sep as sep3 } from "path";
+import { basename as basename8, isAbsolute as isAbsolute5, join as join15, relative as relative4, sep as sep3 } from "path";
 import {
   acquireLock as acquireLock6,
   appendEventToExistingSession as appendEventToExistingSession3,
@@ -10658,7 +10969,7 @@ import {
   loadSessionEntries as loadSessionEntries2,
   normalizeSessionTimestamps,
   readAllEvents,
-  readManifest as readManifest12,
+  readManifest as readManifest13,
   readObservedDuration,
   readYamlFile as readYamlFile6,
   rechainSessionInPlace,
@@ -10774,8 +11085,8 @@ async function doRunSessionShow(idInput, options, ctx) {
   const paths = basouPaths19(repositoryRoot);
   await assertWorkspaceInitialized12(paths.root);
   const sessionId = await resolveSessionId3(paths, idInput);
-  const sessionDir = join14(paths.sessions, sessionId);
-  const sessionYamlPath = join14(sessionDir, "session.yaml");
+  const sessionDir = join15(paths.sessions, sessionId);
+  const sessionYamlPath = join15(sessionDir, "session.yaml");
   let session;
   try {
     const raw = await readYamlFile6(sessionYamlPath);
@@ -11085,7 +11396,7 @@ async function doRunSessionImport(options, ctx) {
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "import");
   const paths = basouPaths19(repositoryRoot);
   await assertWorkspaceInitialized12(paths.root);
-  const manifest = await readManifest12(paths);
+  const manifest = await readManifest13(paths);
   const rawBody = await readInputFile(options.from);
   const json = parseJsonStrict(rawBody);
   const parsed = SessionImportPayloadSchema2.safeParse(json);
@@ -11471,7 +11782,7 @@ import {
   basouPaths as basouPaths21,
   buildStatusSnapshot,
   findErrorCode as findErrorCode15,
-  readManifest as readManifest13,
+  readManifest as readManifest14,
   writeStatus
 } from "@basou/core";
 function registerStatusCommand(program2) {
@@ -11501,7 +11812,7 @@ async function doRunStatus(options, ctx) {
   }
   let manifest;
   try {
-    manifest = await readManifest13(paths);
+    manifest = await readManifest14(paths);
   } catch (error) {
     if (findErrorCode15(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
@@ -11542,7 +11853,7 @@ function formatVersionGateMessage(error) {
 
 // src/commands/task.ts
 import { readFile as readFile10 } from "fs/promises";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import {
   archiveTask,
   assertBasouRootSafe as assertBasouRootSafe17,
@@ -11556,7 +11867,7 @@ import {
   loadSessionEntries as loadSessionEntries3,
   loadTaskEntries,
   prefixedUlid as prefixedUlid5,
-  readManifest as readManifest14,
+  readManifest as readManifest15,
   readTaskFile,
   readTaskFileWithArchiveFallback,
   reconcileAllTasks,
@@ -11683,7 +11994,7 @@ async function doRunTaskNew(options, ctx) {
     });
     return;
   }
-  const manifest = await readManifest14(paths);
+  const manifest = await readManifest15(paths);
   const result = await createTaskWithEvent({
     mode: "ad-hoc",
     paths,
@@ -11869,7 +12180,7 @@ async function doRunTaskShow(idInput, options, ctx) {
   const events = [];
   const linkedSessionIds = new Set(doc.task.task.linked_sessions);
   for (const s of sessions) {
-    const sessionDir = join15(paths.sessions, s.sessionId);
+    const sessionDir = join16(paths.sessions, s.sessionId);
     try {
       for await (const ev of replayEvents3(sessionDir, {
         onWarning: (w) => printReplayWarning(w, s.sessionId)
@@ -12031,7 +12342,7 @@ async function doRunTaskStatus(taskIdInput, newStatusInput, options, ctx) {
     });
     return;
   }
-  const manifest = await readManifest14(paths);
+  const manifest = await readManifest15(paths);
   const result = await updateTaskStatusWithEvent({
     mode: "ad-hoc",
     paths,
@@ -12085,7 +12396,7 @@ async function doRunTaskReconcile(options, ctx) {
   const paths = basouPaths22(repositoryRoot);
   await assertWorkspaceInitialized14(paths.root);
   await assertLockStoreSafe6(paths);
-  const manifest = await readManifest14(paths);
+  const manifest = await readManifest15(paths);
   const nowProvider = ctx.nowProvider ?? (() => /* @__PURE__ */ new Date());
   const write = options.write === true;
   const verbose = isVerbose(options);
@@ -12265,7 +12576,7 @@ async function doRunTaskRefreshLinkage(taskIdInput, options, ctx) {
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "refresh-linkage");
   const paths = basouPaths22(repositoryRoot);
   await assertWorkspaceInitialized14(paths.root);
-  const manifest = await readManifest14(paths);
+  const manifest = await readManifest15(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   const nowProvider = ctx.nowProvider ?? (() => /* @__PURE__ */ new Date());
   const write = options.write === true;
@@ -12345,7 +12656,7 @@ async function doRunTaskEdit(taskIdInput, options, ctx) {
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "edit");
   const paths = basouPaths22(repositoryRoot);
   await assertWorkspaceInitialized14(paths.root);
-  const manifest = await readManifest14(paths);
+  const manifest = await readManifest15(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
   const occurredAt = now.toISOString();
@@ -12401,7 +12712,7 @@ async function doRunTaskDelete(taskIdInput, options, ctx) {
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "delete");
   const paths = basouPaths22(repositoryRoot);
   await assertWorkspaceInitialized14(paths.root);
-  const manifest = await readManifest14(paths);
+  const manifest = await readManifest15(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   if (options.yes !== true) {
     await confirmDestructiveAction("delete", taskId);
@@ -12446,7 +12757,7 @@ async function doRunTaskArchive(taskIdInput, options, ctx) {
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "archive");
   const paths = basouPaths22(repositoryRoot);
   await assertWorkspaceInitialized14(paths.root);
-  const manifest = await readManifest14(paths);
+  const manifest = await readManifest15(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   if (options.yes !== true) {
     await confirmDestructiveAction("archive", taskId);
@@ -12764,23 +13075,23 @@ async function assertWorkspaceInitialized15(basouRoot) {
 // src/commands/view.ts
 import { spawn } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { basename as basename11, dirname as dirname8, join as join19, resolve as resolve14 } from "path";
+import { basename as basename11, dirname as dirname9, join as join20, resolve as resolve14 } from "path";
 import {
   assertBasouRootSafe as assertBasouRootSafe19,
   basouPaths as basouPaths25,
   findErrorCode as findErrorCode19,
   loadPortfolioConfig as loadPortfolioConfig6,
-  readManifest as readManifest18
+  readManifest as readManifest19
 } from "@basou/core";
 import { InvalidArgumentError as InvalidArgumentError8 } from "commander";
 
 // src/lib/portfolio-coverage.ts
 import { createReadStream as createReadStream2 } from "fs";
-import { readdir as readdir3, stat as stat7 } from "fs/promises";
+import { readdir as readdir4, stat as stat7 } from "fs/promises";
 import { homedir as homedir12 } from "os";
-import { basename as basename9, dirname as dirname7, join as join16 } from "path";
+import { basename as basename9, dirname as dirname8, join as join17 } from "path";
 import { createInterface as createInterface2 } from "readline";
-import { basouPaths as basouPaths24, readManifest as readManifest15 } from "@basou/core";
+import { basouPaths as basouPaths24, readManifest as readManifest16 } from "@basou/core";
 function uncapturedTotal(result) {
   return result.groups.reduce((sum, g) => sum + g.logs, 0) + result.unplaceable;
 }
@@ -12790,8 +13101,8 @@ async function checkPortfolioCoverage(workspaces, ctx = {}) {
     ctx.portfolioConfigPath
   );
   const listedDirs = new Set([...roots].map((root) => encodeProjectDir(root)));
-  const claudeProjectsDir = ctx.claudeProjectsDir ?? join16(homedir12(), ".claude", "projects");
-  const codexSessionsDir = ctx.codexSessionsDir ?? join16(homedir12(), ".codex", "sessions");
+  const claudeProjectsDir = ctx.claudeProjectsDir ?? join17(homedir12(), ".claude", "projects");
+  const codexSessionsDir = ctx.codexSessionsDir ?? join17(homedir12(), ".codex", "sessions");
   const tally = new Tally(roots);
   const absentTrees = [];
   const claudeFiles = await listClaudeTranscripts(claudeProjectsDir);
@@ -12802,7 +13113,7 @@ async function checkPortfolioCoverage(workspaces, ctx = {}) {
         file,
         "claude-code",
         claudeTranscriptCwd,
-        listedDirs.has(basename9(dirname7(file)))
+        listedDirs.has(basename9(dirname8(file)))
       );
     }
   }
@@ -12829,7 +13140,7 @@ async function collectDeclaredRoots(workspaces, portfolioConfigPath) {
     }
     let resolved;
     try {
-      const manifest = await readManifest15(basouPaths24(importRoot));
+      const manifest = await readManifest16(basouPaths24(importRoot));
       resolved = resolveSourceRoots({
         projectFlags: [],
         manifest,
@@ -12929,7 +13240,7 @@ async function isDirEntry(parent, entry) {
   if (entry.isDirectory()) return true;
   if (!entry.isSymbolicLink()) return false;
   try {
-    return (await stat7(join16(parent, entry.name))).isDirectory();
+    return (await stat7(join17(parent, entry.name))).isDirectory();
   } catch {
     return false;
   }
@@ -12937,22 +13248,22 @@ async function isDirEntry(parent, entry) {
 async function listClaudeTranscripts(projectsRoot) {
   let entries;
   try {
-    entries = await readdir3(projectsRoot, { withFileTypes: true });
+    entries = await readdir4(projectsRoot, { withFileTypes: true });
   } catch {
     return void 0;
   }
   const files = [];
   for (const entry of entries) {
     if (!await isDirEntry(projectsRoot, entry)) continue;
-    const full = join16(projectsRoot, entry.name);
+    const full = join17(projectsRoot, entry.name);
     let names;
     try {
-      names = await readdir3(full);
+      names = await readdir4(full);
     } catch {
       continue;
     }
     for (const name of names) {
-      if (name.endsWith(".jsonl")) files.push(join16(full, name));
+      if (name.endsWith(".jsonl")) files.push(join17(full, name));
     }
   }
   return files.sort();
@@ -12962,12 +13273,12 @@ async function listCodexRollouts(sessionsRoot) {
   const walk = async (dir) => {
     let entries;
     try {
-      entries = await readdir3(dir, { withFileTypes: true });
+      entries = await readdir4(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = join16(dir, entry.name);
+      const full = join17(dir, entry.name);
       if (entry.isDirectory()) await walk(full);
       else if (entry.isFile() && entry.name.startsWith("rollout-") && entry.name.endsWith(".jsonl")) {
         found.push(full);
@@ -12975,7 +13286,7 @@ async function listCodexRollouts(sessionsRoot) {
     }
   };
   try {
-    await readdir3(sessionsRoot);
+    await readdir4(sessionsRoot);
   } catch {
     return void 0;
   }
@@ -13098,9 +13409,9 @@ function inertLines(result) {
 // src/lib/portfolio-safety.ts
 import { execFile as execFile2 } from "child_process";
 import { lstat as lstat3, realpath as realpath5 } from "fs/promises";
-import { isAbsolute as isAbsolute6, join as join17, relative as relative5, resolve as resolve12, sep as sep4 } from "path";
+import { isAbsolute as isAbsolute6, join as join18, relative as relative5, resolve as resolve12, sep as sep4 } from "path";
 import { promisify as promisify2 } from "util";
-import { readManifest as readManifest16 } from "@basou/core";
+import { readManifest as readManifest17 } from "@basou/core";
 var execFileAsync2 = promisify2(execFile2);
 function errorCode2(error) {
   return error instanceof Error ? error.code : void 0;
@@ -13122,7 +13433,7 @@ function isBasouPath(p) {
 async function inspectRepo(repoPath) {
   let hasEntry = false;
   try {
-    await lstat3(join17(repoPath, ".basou"));
+    await lstat3(join18(repoPath, ".basou"));
     hasEntry = true;
   } catch (error) {
     if (errorCode2(error) !== "ENOENT") {
@@ -13156,7 +13467,7 @@ async function checkPortfolioSafety(workspaces) {
     let viewPath;
     let isMaster = false;
     try {
-      const manifest = await readManifest16(ws.paths);
+      const manifest = await readManifest17(ws.paths);
       sourceRoots = manifest.import?.source_roots ?? [];
       viewPath = manifest.workspace.view;
       isMaster = true;
@@ -13276,7 +13587,7 @@ function formatSafetyReport(result) {
 
 // src/lib/view-server.ts
 import { createServer } from "http";
-import { basename as basename10, join as join18, resolve as resolve13 } from "path";
+import { basename as basename10, join as join19, resolve as resolve13 } from "path";
 import {
   boardLivePage,
   boardPage,
@@ -13291,7 +13602,7 @@ import {
   loadSessionEntries as loadSessionEntries4,
   loadTaskEntries as loadTaskEntries2,
   readAllEvents as readAllEvents2,
-  readManifest as readManifest17,
+  readManifest as readManifest18,
   readMarkdownFile as readMarkdownFile9,
   readSessionYaml as readSessionYaml3,
   readTaskFile as readTaskFile2,
@@ -15215,7 +15526,7 @@ async function captureStaleness(ws, nowIso) {
 async function overview(ws, nowProvider, resolveRemoteUrl) {
   let manifest;
   try {
-    manifest = await readManifest17(ws.paths);
+    manifest = await readManifest18(ws.paths);
   } catch (error) {
     if (findErrorCode18(error, "ENOENT")) {
       return { initialized: false, repoRoot: ws.repoRoot };
@@ -15300,7 +15611,7 @@ async function sessionDetail(ws, sessionId) {
     throw error;
   }
   try {
-    const events = await readAllEvents2(join18(ws.paths.sessions, sessionId));
+    const events = await readAllEvents2(join19(ws.paths.sessions, sessionId));
     return { session, events };
   } catch {
     return { session, events: [], degraded: true };
@@ -15560,12 +15871,12 @@ function sharedWhileRunning(run) {
 async function viewBoardOf(root, paths) {
   let own;
   try {
-    own = (await readManifest18(paths)).repos?.find((repo) => repo.path === ".");
+    own = (await readManifest19(paths)).repos?.find((repo) => repo.path === ".");
   } catch {
     own = void 0;
   }
   if (own?.visibility !== "private") return { why: "no_board" };
-  return { recordsDir: join19(root, dirname8(DEFAULT_BOARD_PATH), "records") };
+  return { recordsDir: join20(root, dirname9(DEFAULT_BOARD_PATH), "records") };
 }
 async function buildPortfolioDeps(workspaceFlags, ctx, cwd) {
   const specs = workspaceFlags.length > 0 ? workspaceFlags.map((p) => ({ path: resolve14(cwd, p) })) : await loadPortfolioConfig6(ctx.portfolioConfigPath);
@@ -15598,7 +15909,7 @@ async function buildWorkspaceEntry(repoRoot, ctx, labelOverride) {
     ...ctx.codexSessionsDir !== void 0 ? { codexSessionsDir: ctx.codexSessionsDir } : {}
   };
   try {
-    const manifest = await readManifest18(paths);
+    const manifest = await readManifest19(paths);
     return {
       key: manifest.workspace.id,
       label: labelOverride ?? manifest.workspace.name,
@@ -15719,7 +16030,7 @@ function installExperimentalNotice(program2, names = EXPERIMENTAL_COMMANDS, writ
 function readBuildStamp() {
   if (false) return void 0;
   try {
-    return JSON.parse('{"version":"0.67.0","commit":"c4c4ebb","committedAt":"2026-10-08T23:33:17+09:00"}');
+    return JSON.parse('{"version":"0.68.0","commit":"52aa4d4","committedAt":"2026-10-09T22:45:36+09:00"}');
   } catch {
     return void 0;
   }