[takashi-matsuyama]

Summary

Let one .basou/ workspace aggregate the native logs of multiple source
repositories. A single logical project often spans several checkouts (an
implementation repo, a planning repo, and a shared working directory the AI is
launched from). Each session is recorded under whichever directory the AI ran
in, but the provenance belongs to one workspace. Import discovery previously
keyed on a single exact source path, so a multi-repo project captured only the
slice whose cwd matched the workspace's own repo root and silently dropped the
rest.

Why

This is a real coverage gap for any monorepo-of-repos / workspace layout. The
fix is vendor-neutral (both the claude-code and codex importers) and matches
the project's stance that cross-tool, cross-checkout capture is the point.

What changed

Applied symmetrically to basou import claude-code, basou import codex, and
basou refresh:

• Repeatable --project <path> — each path is a source root; several paths
  union their sessions into the current workspace, de-duplicated (a root listed
  twice, or equal to the repo root, is scanned once).
• manifest.import.source_roots — an optional, ordered list of roots
  relative to the repository root (e.g. [".", "../basou-workspace"]), so
  basou refresh with no arguments aggregates every listed repo. The list is
  complete: include "." to keep the host repo. Absent means the host repo only
  (prior behaviour, unchanged). A regex validates entries (rejects absolute
  paths, ~-expansion, backslashes, drive letters) and is emitted into the JSON
  Schema pattern, so cross-language validators enforce it too.
• basou init --source-root <path> (repeatable) seeds source_roots for a
  new workspace, normalizing each value to a repo-root-relative path.

Resolution precedence: explicit --project flags, else the manifest's
source_roots, else the repository root alone.

Notes on correctness

• The path sanitizer is unchanged: each session is sanitized against its own
  working_directory, so aggregating siblings never relativizes a path across
  repositories or leaks an absolute host path beyond the existing pathless
  contract.
• basou view's project field no longer pre-fills the repo root, so a GUI
  refresh honors source_roots instead of silently overriding them.

Testing

• pnpm -r build && pnpm typecheck && pnpm test && pnpm lint all green
  (core 743, sdk 17, cli 433; lint 0 errors).
• New tests: multi-root union, manifest-vs-flag precedence, manifest roots
  resolved relative to the repo root, de-dup, partial presence (one absent
  root), --session across roots, "not found in any root" errors, schema
  rejection of absolute/~/backslash/drive-letter/empty source roots,
  init --source-root normalization, and a refresh manifest aggregation case.
• Regenerated @basou/core JSON Schema artifacts; the drift-guard test passes.

Out of scope

Capture currency / automation (a refresh --watch / cron / editor hooks),
per-source-root session tagging, and the --session + --all mutual-exclusion
guard are intentionally left as follow-ups.