@przeprogramowani/10x-cli 1.20.0 → 1.21.0

package/dist/index.mjs

@@ -3183,7 +3183,7 @@ var cac = (name = "") => new CAC(name);
 // package.json
 var package_default = {
   name: "@przeprogramowani/10x-cli",
-  version: "1.20.0",
+  version: "1.21.0",
   description: "Open-source CLI for 10xDevs course content",
   repository: {
     type: "git",
@@ -3350,6 +3350,9 @@ function updateToolConfig(patch) {
   saveToolConfig(merged);
 }
 
+// src/lib/auth-flow.ts
+import { hostname as osHostname, release as osRelease } from "node:os";
+
 // src/lib/api-client.ts
 var DEFAULT_API_BASE = "https://10x-toolkit-api.przeprogramowani.workers.dev";
 var PROD_HOSTNAME = "10x-toolkit-api.przeprogramowani.workers.dev";
@@ -3382,6 +3385,10 @@ var DEFAULT_TIMEOUT_MS = 30000;
 var UNKNOWN_API_ERROR_MESSAGE = "An unknown error occurred. Please contact 10xDevs mentors and share the command that caused this. Sorry for the issue!";
 var ERROR_CODE_MESSAGES = {
   course_not_found: "Course not found.",
+  course_unavailable: "This course has no available published content yet.",
+  course_access_denied: "Your account does not have access to this course.",
+  invalid_release: "The selected content release is invalid.",
+  release_mismatch: "Content does not match the selected release. Run the command again.",
   lesson_not_found: "Lesson not found.",
   module_not_found: "Module not found.",
   artifact_not_found: "Artifact not found.",
@@ -3395,6 +3402,12 @@ var ERROR_CODE_MESSAGES = {
   membership_revoked: "Your course membership has been revoked.",
   rate_limited: "Too many requests. Please slow down and try again shortly.",
   email_send_failed: "Could not send the login email. Try again in a moment.",
+  circle_login_disabled: "Circle login is currently unavailable. Run `10x auth --method email` instead.",
+  dm_rejected: "Circle refused to deliver the login message. Check your Circle direct-message settings or run `10x auth --method email`.",
+  access_denied: "This account is not allowed to sign in. Check your course access.",
+  expired_or_used: "This Circle login link has expired or was already used. Run `10x auth --method circle` again.",
+  slow_down: "Polling too fast. The CLI will wait longer between checks.",
+  auth_cancelled: "Authentication was cancelled before it completed.",
   admin_access_required: "This action requires admin access.",
   circle_api_error: "The membership service is temporarily unavailable.",
   internal_error: "The server hit an unexpected error."
@@ -3467,7 +3480,7 @@ async function request(method, path, body, options = {}) {
     return {
       ok: false,
       status: response.status,
-      code: typeof payload?.code === "string" ? payload.code : `http_${response.status}`,
+      code: typeof payload?.code === "string" ? payload.code : typeof payload?.error === "string" ? payload.error : `http_${response.status}`,
       error: errorMessage,
       payload
     };
@@ -3541,6 +3554,97 @@ async function pollVerifySession(sessionId, options = {}) {
     await sleep(intervalMs);
   }
 }
+var CLIENT_HOSTNAME_MAX = 128;
+var CLIENT_OS_MAX = 64;
+function describeCircleClient() {
+  const client = {};
+  try {
+    const host = osHostname();
+    if (host.length > 0)
+      client.hostname = host.slice(0, CLIENT_HOSTNAME_MAX);
+  } catch {}
+  try {
+    client.os = `${process.platform} ${osRelease()}`.slice(0, CLIENT_OS_MAX);
+  } catch {}
+  return client;
+}
+function circleStartRequest(email, client = {}, options = {}) {
+  return apiPost("/auth/circle/start", { email, client }, { signal: options.signal });
+}
+async function checkCircleLogin(deviceCode, options = {}) {
+  const result = await apiPost("/auth/circle/poll", { device_code: deviceCode }, { signal: options.signal });
+  if (result.ok) {
+    if (result.status === 200 && result.data && "token" in result.data) {
+      return { kind: "verified", tokens: result.data };
+    }
+    return { kind: "pending" };
+  }
+  if (result.status === 0)
+    return { kind: "pending" };
+  if (result.status === 400 && result.code === "slow_down")
+    return { kind: "slow_down" };
+  if (result.status >= 500 || result.status === 429)
+    return { kind: "pending" };
+  const message = result.payload?.message ?? result.error;
+  if (result.status === 410)
+    return { kind: "expired", message };
+  if (result.status === 403)
+    return { kind: "denied", message };
+  return {
+    kind: "error",
+    code: result.code,
+    message: result.error,
+    status: result.status
+  };
+}
+var SLOW_DOWN_INCREMENT_MS = 5000;
+function abortableSleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve();
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    function onAbort() {
+      clearTimeout(timer);
+      resolve();
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function pollCircleLogin(deviceCode, options = {}) {
+  let intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const now = options.now ?? Date.now;
+  const sleep = options.sleep ?? ((ms) => abortableSleep(ms, options.signal));
+  const startedAt = now();
+  const deadline = startedAt + timeoutMs;
+  while (true) {
+    if (options.signal?.aborted)
+      return { kind: "aborted" };
+    const remaining = deadline - now();
+    options.onTick?.(Math.max(0, remaining));
+    const outcome = await checkCircleLogin(deviceCode, { signal: options.signal });
+    if (options.signal?.aborted)
+      return { kind: "aborted" };
+    if (outcome.kind === "verified")
+      return outcome;
+    if (outcome.kind === "expired")
+      return outcome;
+    if (outcome.kind === "denied")
+      return outcome;
+    if (outcome.kind === "error")
+      return outcome;
+    if (outcome.kind === "slow_down")
+      intervalMs += SLOW_DOWN_INCREMENT_MS;
+    if (now() + intervalMs >= deadline)
+      return { kind: "timeout" };
+    await sleep(intervalMs);
+  }
+}
 
 // src/lib/auth-guard.ts
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
@@ -3645,7 +3749,8 @@ async function requireAuth(ctx, options = {}) {
     outputError(ctx, "auth_required", "Not authenticated.", ExitCodes.AUTH_REQUIRED, "Run '10x auth' to log in.");
   }
   const initialNow = now();
-  if (!isExpired(auth, initialNow) && !isNearExpiry(auth, windowMs, initialNow)) {
+  const forced = options.forceRefreshForToken !== undefined;
+  if (!forced && !isExpired(auth, initialNow) && !isNearExpiry(auth, windowMs, initialNow)) {
     return auth;
   }
   const release = await acquireRefreshLock(ctx, lockTarget);
@@ -3656,7 +3761,7 @@ async function requireAuth(ctx, options = {}) {
     }
     const freshNow = now();
     const freshExpired = isExpired(fresh, freshNow);
-    if (!freshExpired && !isNearExpiry(fresh, windowMs, freshNow)) {
+    if (!freshExpired && !isNearExpiry(fresh, windowMs, freshNow) && (!forced || fresh.access_token !== options.forceRefreshForToken)) {
       verbose(ctx, "another process already refreshed — using rotated token");
       return fresh;
     }
@@ -3669,11 +3774,15 @@ async function requireAuth(ctx, options = {}) {
         access_token: refreshed.data.token,
         refresh_token: refreshed.data.refresh_token,
         expires_at: refreshed.data.expires_at,
-        created_at: fresh.created_at
+        created_at: fresh.created_at,
+        ...fresh.method !== undefined ? { method: fresh.method } : {}
       };
       persist(next);
       return next;
     }
+    if (forced) {
+      outputError(ctx, refreshed.code, refreshed.error, refreshed.status === 403 ? ExitCodes.FORBIDDEN : refreshed.status === 401 ? ExitCodes.AUTH_REQUIRED : ExitCodes.ERROR);
+    }
     if (!freshExpired) {
       verbose(ctx, `refresh failed (${refreshed.code}) — using existing token`);
       return fresh;
@@ -3690,169 +3799,597 @@ async function requireAuth(ctx, options = {}) {
   throw new Error("requireAuth: unreachable");
 }
 
-// src/commands/auth.ts
-function registerAuthCommand(cli) {
-  cli.command("auth", "Authenticate with 10xDevs via magic link").option("--email <email>", "Email address (skips interactive prompt)").option("--status", "Show current authentication state").option("--logout", "Delete locally stored credentials").action(async (options) => {
-    const ctx = resolveContext(options);
-    if (options.status) {
-      runStatus(ctx);
-      return;
-    }
-    if (options.logout) {
-      runLogout(ctx);
-      return;
-    }
-    await runLogin(ctx, options);
-  });
+// src/lib/signing.ts
+import { createHash, createPublicKey, verify } from "node:crypto";
+
+class SignatureError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SignatureError";
+  }
 }
-function runStatus(ctx) {
-  const auth = readAuth();
-  if (!auth) {
-    outputError(ctx, "auth_required", "You're not signed in.", ExitCodes.AUTH_REQUIRED, "Run '10x auth' to log in.");
+var KEYSET = [
+  {
+    keyId: 1,
+    publicKey: "MCowBQYDK2VwAyEANXEwq1y+9CYAJS6ze9m/c212fL4r1BauXwKdT6Zo5Ko="
   }
-  const expired = isExpired(auth);
-  const expiresAt = new Date(auth.expires_at);
-  if (expired) {
-    outputError(ctx, "auth_expired", `Your session for ${auth.email} has expired.`, ExitCodes.AUTH_REQUIRED, "Run '10x auth' to log in again.");
+];
+var REQUIRE_SIGNATURES = true;
+function loadEffectiveKeyset() {
+  const override = process.env["BUNDLE_PUBLIC_KEYSET"];
+  if (!override)
+    return KEYSET;
+  const apiBase = process.env["API_BASE_URL"];
+  if (!apiBase)
+    return KEYSET;
+  let hostname;
+  try {
+    hostname = new URL(apiBase).hostname;
+  } catch {
+    return KEYSET;
   }
-  output(ctx, `Signed in as ${auth.email} — session expires ${formatExpiry(expiresAt)}.`, {
-    email: auth.email,
-    expires_at: auth.expires_at,
-    is_valid: true
-  });
-}
-function formatExpiry(expiresAt) {
-  if (!Number.isFinite(expiresAt.getTime()))
-    return "at an unknown time";
-  const diffMs = expiresAt.getTime() - Date.now();
-  if (diffMs <= 0)
-    return "now";
-  const days = Math.floor(diffMs / (24 * 60 * 60 * 1000));
-  if (days >= 1)
-    return `in ${days} day${days === 1 ? "" : "s"}`;
-  const hours = Math.floor(diffMs / (60 * 60 * 1000));
-  if (hours >= 1)
-    return `in ${hours} hour${hours === 1 ? "" : "s"}`;
-  const mins = Math.max(1, Math.floor(diffMs / (60 * 1000)));
-  return `in ${mins} minute${mins === 1 ? "" : "s"}`;
-}
-function runLogout(ctx) {
-  const had = readAuth() !== null;
-  deleteAuth();
-  output(ctx, had ? "Logged out successfully." : "Already logged out.", {
-    logged_out: true,
-    had_credentials: had
-  });
-}
-async function runLogin(ctx, options) {
-  const email = await collectEmail(ctx, options);
-  if (!ctx.json)
-    we("10x auth");
-  const sp = ctx.json ? null : L2();
-  sp?.start("Requesting magic link…");
-  const login = await loginRequest(email);
-  if (!login.ok) {
-    sp?.stop("Magic link request failed.", 1);
-    handleLoginError(ctx, login.status, login.code, login.error);
+  if (hostname !== "localhost" && hostname !== "127.0.0.1") {
+    return KEYSET;
   }
-  const { session_id } = login.data;
-  sp?.stop(`Magic link sent to ${email}. Check your inbox.`);
-  const pollSpinner = ctx.json ? null : L2();
-  pollSpinner?.start("Waiting for magic link…");
-  const result = await pollVerifySession(session_id, {
-    onTick: (remainingMs) => {
-      if (pollSpinner) {
-        pollSpinner.message(`Waiting for magic link (${formatRemaining(remainingMs)} remaining)`);
+  try {
+    const parsed = JSON.parse(override);
+    if (!Array.isArray(parsed) || parsed.length === 0)
+      return KEYSET;
+    for (const k3 of parsed) {
+      if (typeof k3.keyId !== "number" || typeof k3.publicKey !== "string") {
+        return KEYSET;
       }
     }
-  });
-  if (result.kind === "verified") {
-    pollSpinner?.stop("Authenticated.");
-    const auth = {
-      version: AUTH_FILE_VERSION,
-      email,
-      access_token: result.tokens.token,
-      refresh_token: result.tokens.refresh_token,
-      expires_at: result.tokens.expires_at,
-      created_at: new Date().toISOString()
-    };
-    saveAuth(auth);
-    if (!ctx.json)
-      fe(`Signed in as ${email}.`);
-    output(ctx, "", {
-      authenticated: true,
-      email,
-      expires_at: auth.expires_at
-    });
-    return;
-  }
-  if (result.kind === "expired") {
-    pollSpinner?.stop("Session expired.", 1);
-    outputError(ctx, "session_expired", result.message || "Magic-link session expired before it was clicked.", ExitCodes.AUTH_REQUIRED, "Run '10x auth' again to request a fresh link.");
-  }
-  if (result.kind === "timeout") {
-    pollSpinner?.stop("Timed out waiting for magic link.", 1);
-    outputError(ctx, "auth_timeout", "Timed out waiting for the magic link to be clicked.", ExitCodes.ERROR, "Run '10x auth' to request a new link.");
-  }
-  if (result.kind === "aborted") {
-    pollSpinner?.stop("Cancelled.", 1);
-    outputError(ctx, "auth_cancelled", "Authentication cancelled.", ExitCodes.ERROR);
+    return parsed;
+  } catch {
+    return KEYSET;
   }
-  pollSpinner?.stop("Authentication failed.", 1);
-  outputError(ctx, result.code || "auth_error", result.message || "Authentication failed.", ExitCodes.ERROR);
 }
-async function collectEmail(ctx, options) {
-  if (options.email) {
-    const trimmed = options.email.trim();
-    if (!isLikelyEmail(trimmed)) {
-      outputError(ctx, "invalid_email", `'${options.email}' does not look like an email address.`, ExitCodes.USAGE, "Pass your 10xDevs email, for example '10x auth --email you@example.com'.");
-    }
-    return trimmed;
-  }
-  if (ctx.json) {
-    outputError(ctx, "missing_email", "Email is required in non-interactive mode.", ExitCodes.USAGE, "Pass --email, for example '10x auth --email you@example.com'.");
-  }
-  const answer = await ue({
-    message: "Enter your 10xDevs email",
-    placeholder: "you@example.com",
-    validate: (value) => {
-      if (!value || value.trim().length === 0)
-        return "Email is required.";
-      if (!isLikelyEmail(value.trim()))
-        return "That does not look like an email address.";
-      return;
-    }
-  });
-  if (BD(answer)) {
-    ve("Authentication cancelled.");
-    outputError(ctx, "auth_cancelled", "Authentication cancelled.", ExitCodes.ERROR);
-  }
-  return answer.trim();
+function sha256Hex(body) {
+  return createHash("sha256").update(body).digest("hex");
 }
-function isLikelyEmail(value) {
-  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+function canonicalSigningString(keyId, hashHex) {
+  return `v1:${keyId}:${hashHex}`;
 }
-function formatRemaining(ms) {
-  const totalSeconds = Math.max(0, Math.ceil(ms / 1000));
-  const minutes = Math.floor(totalSeconds / 60);
-  const seconds = totalSeconds % 60;
-  return `${minutes}:${seconds.toString().padStart(2, "0")}`;
+function verifyBundleSignature(rawBody, signature, keyId, headerHash) {
+  verifyBundleSignatureWithKeyset(rawBody, signature, keyId, headerHash, loadEffectiveKeyset());
 }
-function handleLoginError(ctx, status, code, error) {
-  verbose(ctx, `login failed: status=${status} code=${code}`);
-  if (status === 403) {
-    outputError(ctx, "no_access", "This email has no active 10xDevs course membership.", ExitCodes.FORBIDDEN, "Enroll at https://10xdevs.pl, then run '10x auth' again.");
+function verifyBundleSignatureWithKeyset(rawBody, signature, keyId, headerHash, keyset) {
+  const key = keyset.find((k3) => k3.keyId === keyId);
+  if (!key) {
+    throw new SignatureError(`Unknown signing key (key_id=${keyId}). Update your CLI: npm update -g @przeprogramowani/10x-cli`);
   }
-  if (status === 429) {
-    outputError(ctx, "rate_limited", "Too many magic-link requests for this email.", ExitCodes.ERROR, "Wait a few minutes, then run '10x auth' again.");
+  const computedHash = sha256Hex(rawBody);
+  if (computedHash !== headerHash) {
+    throw new SignatureError(`Bundle content hash mismatch (header=${headerHash.slice(0, 12)}…, computed=${computedHash.slice(0, 12)}…). ` + "The bundle may have been tampered with in transit. Do NOT use the content.");
   }
-  if (status === 502) {
-    outputError(ctx, "email_delivery_failed", "Could not send the magic-link email.", ExitCodes.ERROR, "Try '10x auth' again in a few minutes. If it keeps failing, contact support.");
+  let pubKey;
+  try {
+    pubKey = createPublicKey({
+      key: Buffer.from(key.publicKey, "base64"),
+      format: "der",
+      type: "spki"
+    });
+  } catch {
+    throw new SignatureError("Failed to load the signing public key. Your CLI binary may be corrupted — reinstall it.");
   }
-  if (status === 0) {
-    outputError(ctx, "network_error", "Could not reach the 10x-toolkit API.", ExitCodes.ERROR, "Check your internet connection and run '10x auth' again.");
+  const canonical = canonicalSigningString(keyId, computedHash);
+  const sig = Buffer.from(signature, "base64");
+  const valid = verify(null, Buffer.from(canonical), pubKey, sig);
+  if (!valid) {
+    throw new SignatureError("Bundle signature verification failed — the bundle may have been tampered with. " + "Do NOT use the content. Report this to the course team.");
   }
-  outputError(ctx, code || "auth_error", "Authentication failed.", ExitCodes.ERROR, error ? `Server said: ${error}` : undefined);
+}
+
+// src/lib/api-content.ts
+function validateCourseDiscovery(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const data = value;
+  if (!Array.isArray(data.courses) || data.defaultCourse !== null && typeof data.defaultCourse !== "string")
+    return false;
+  const identifiers = new Set;
+  for (const course of data.courses) {
+    if (!course || typeof course.id !== "string" || !course.id || typeof course.slug !== "string" || !course.slug || typeof course.title !== "string" || !Number.isInteger(course.edition) || course.edition < 1 || typeof course.available !== "boolean")
+      return false;
+    for (const identifier of new Set([course.id, course.slug])) {
+      if (identifiers.has(identifier))
+        return false;
+      identifiers.add(identifier);
+    }
+  }
+  const available = data.courses.filter((course) => course.available);
+  if (data.defaultCourse === null)
+    return available.length === 0;
+  const selected = available.find((course) => course.id === data.defaultCourse || course.slug === data.defaultCourse);
+  return !!selected && available.every((course) => course.edition <= selected.edition);
+}
+async function fetchCourses(token) {
+  const result = await apiGet("/api/me/courses", { token });
+  if (!result.ok) {
+    if (result.status === 404)
+      return { ...result, code: "discovery_unsupported", error: "The backend does not support course discovery. Update the backend before using this CLI." };
+    return result;
+  }
+  if (!validateCourseDiscovery(result.data))
+    return { ok: false, status: 0, code: "discovery_invalid", error: "Invalid course discovery response; no course was selected." };
+  return result;
+}
+function catalogRelease(catalog) {
+  if (catalog.course !== "10xdevs4")
+    return;
+  if (!/^r-[a-f0-9]{64}$/.test(catalog.releaseId ?? "") || !/^[a-f0-9]{64}$/.test(catalog.releaseManifestHash ?? ""))
+    throw new Error("Invalid or missing v4 catalog release identity");
+  return { course: catalog.course, releaseId: catalog.releaseId, releaseManifestHash: catalog.releaseManifestHash };
+}
+function releaseMismatch(course, data, selected) {
+  if (course !== "10xdevs4" && course !== "10xdevs-4")
+    return null;
+  if (!selected || selected.course !== "10xdevs4" || !data || typeof data !== "object")
+    return "V4 content requires the operation's selected catalog release.";
+  const value = data;
+  return value["course"] === selected.course && value["releaseId"] === selected.releaseId && value["releaseManifestHash"] === selected.releaseManifestHash ? null : "Signed content differs from the selected course/release/manifest.";
+}
+async function fetchCatalog(course, token, options = {}) {
+  const result = await apiGet(`/api/catalog/${encodeURIComponent(course)}${options.release ? `?release=${encodeURIComponent(options.release.releaseId)}` : ""}`, { token, signal: options.signal });
+  if (result.ok && (course === "10xdevs4" || course === "10xdevs-4")) {
+    try {
+      if (result.data.course !== "10xdevs4")
+        throw new Error("Catalog course mismatch");
+      catalogRelease(result.data);
+      if (options.release) {
+        const mismatch = releaseMismatch(course, result.data, options.release);
+        if (mismatch)
+          throw new Error(mismatch);
+      }
+    } catch (error) {
+      return { ok: false, status: 0, code: "release_mismatch", error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+  return result;
+}
+async function fetchModuleDetail(course, module, token, options = {}) {
+  const result = await apiGet(`/api/modules/${encodeURIComponent(course)}/${module}${options.release ? `?release=${encodeURIComponent(options.release.releaseId)}` : ""}`, { token, signal: options.signal });
+  if (result.ok) {
+    const mismatch = releaseMismatch(course, result.data, options.release);
+    if (mismatch)
+      return { ok: false, status: 0, code: "release_mismatch", error: mismatch };
+  }
+  return result;
+}
+async function fetchLesson(course, lessonId, token, options = {}) {
+  const params = new URLSearchParams;
+  if (options.lang)
+    params.set("lang", options.lang);
+  if (options.release)
+    params.set("release", options.release.releaseId);
+  if (options.tool)
+    params.set("tool", options.tool);
+  const qs = params.toString();
+  const path = `/api/lessons/${encodeURIComponent(course)}/${encodeURIComponent(lessonId)}${qs ? `?${qs}` : ""}`;
+  const result = await apiGet(path, { token, signal: options.signal });
+  if (!result.ok)
+    return result;
+  const mismatch = releaseMismatch(course, result.data, options.release);
+  if (mismatch)
+    return { ok: false, status: 0, code: "release_mismatch", error: mismatch };
+  const signature = result.responseHeaders.get("X-Bundle-Signature");
+  const keyIdRaw = result.responseHeaders.get("X-Bundle-Key-Id");
+  const headerHash = result.responseHeaders.get("X-Bundle-Content-Hash");
+  if (signature && keyIdRaw && headerHash) {
+    const keyId = Number(keyIdRaw);
+    try {
+      verifyBundleSignature(result.rawBody, signature, keyId, headerHash);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return {
+        ok: false,
+        status: 0,
+        code: err instanceof SignatureError ? "signature_error" : "signature_internal_error",
+        error: message
+      };
+    }
+  } else if (signature || keyIdRaw || headerHash) {
+    return {
+      ok: false,
+      status: 0,
+      code: "signature_error",
+      error: "Bundle signing headers are incomplete (expected X-Bundle-Signature, X-Bundle-Key-Id, and X-Bundle-Content-Hash together). " + "The API may be misconfigured. Do NOT use the content. Report this to the course team."
+    };
+  } else if (REQUIRE_SIGNATURES) {
+    return {
+      ok: false,
+      status: 0,
+      code: "signature_missing",
+      error: "Bundle is missing a signature. The API may be misconfigured or compromised. " + "Do NOT use the content. Report this to the course team."
+    };
+  } else {
+    process.stderr.write(`Warning: bundle is not signed. Signature verification skipped.
+`);
+  }
+  return result;
+}
+async function fetchArtifact(course, lessonId, type, name, tool, token, options = {}) {
+  const params = new URLSearchParams({ tool });
+  if (options.lang)
+    params.set("lang", options.lang);
+  if (options.release)
+    params.set("release", options.release.releaseId);
+  const path = `/api/artifacts/${encodeURIComponent(course)}/${encodeURIComponent(lessonId)}/${encodeURIComponent(type)}/${encodeURIComponent(name)}?${params}`;
+  const result = await apiGet(path, { token, signal: options.signal });
+  if (!result.ok)
+    return result;
+  const mismatch = releaseMismatch(course, result.data, options.release);
+  if (mismatch)
+    return { ok: false, status: 0, code: "release_mismatch", error: mismatch };
+  const signature = result.responseHeaders.get("X-Bundle-Signature");
+  const keyIdRaw = result.responseHeaders.get("X-Bundle-Key-Id");
+  const headerHash = result.responseHeaders.get("X-Bundle-Content-Hash");
+  if (signature && keyIdRaw && headerHash) {
+    const keyId = Number(keyIdRaw);
+    try {
+      verifyBundleSignature(result.rawBody, signature, keyId, headerHash);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return {
+        ok: false,
+        status: 0,
+        code: err instanceof SignatureError ? "signature_error" : "signature_internal_error",
+        error: message
+      };
+    }
+  } else if (signature || keyIdRaw || headerHash) {
+    return {
+      ok: false,
+      status: 0,
+      code: "signature_error",
+      error: "Artifact signing headers are incomplete (expected X-Bundle-Signature, X-Bundle-Key-Id, and X-Bundle-Content-Hash together). " + "The API may be misconfigured. Do NOT use the content. Report this to the course team."
+    };
+  } else if (REQUIRE_SIGNATURES) {
+    return {
+      ok: false,
+      status: 0,
+      code: "signature_missing",
+      error: "Artifact is missing a signature. The API may be misconfigured or compromised. " + "Do NOT use the content. Report this to the course team."
+    };
+  } else {
+    process.stderr.write(`Warning: artifact is not signed. Signature verification skipped.
+`);
+  }
+  return result;
+}
+async function fetchHealth(options = {}) {
+  const timeoutMs = options.timeoutMs ?? 5000;
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const started = Date.now();
+  try {
+    const result = await apiGet("/health", { signal: controller.signal });
+    const latencyMs = Date.now() - started;
+    return { ...result, latencyMs };
+  } catch (err) {
+    const latencyMs = Date.now() - started;
+    const aborted = controller.signal.aborted;
+    return {
+      ok: false,
+      status: 0,
+      code: aborted ? "timeout" : "network_error",
+      error: err instanceof Error ? err.message : String(err),
+      latencyMs
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function apiBaseUrl() {
+  return resolveApiBase();
+}
+
+// src/commands/auth.ts
+var AUTH_METHODS = ["email", "circle"];
+function isAuthMethod(value) {
+  return AUTH_METHODS.includes(value);
+}
+function registerAuthCommand(cli) {
+  cli.command("auth", "Authenticate with 10xDevs via magic link or Circle message").option("--email <email>", "Email address (skips interactive prompt)").option("--method <method>", "Login method: 'email' (magic link, default) or 'circle' (approval link sent as a Circle message)").option("--status", "Show current authentication state").option("--logout", "Delete locally stored credentials").action(async (options) => {
+    const ctx = resolveContext(options);
+    if (options.status) {
+      await runStatus(ctx);
+      return;
+    }
+    if (options.logout) {
+      runLogout(ctx);
+      return;
+    }
+    await runLogin(ctx, options);
+  });
+}
+async function runStatus(ctx) {
+  const auth = readAuth();
+  if (!auth) {
+    outputError(ctx, "auth_required", "You're not signed in.", ExitCodes.AUTH_REQUIRED, "Run '10x auth' to log in.");
+  }
+  const expired = isExpired(auth);
+  const expiresAt = new Date(auth.expires_at);
+  if (expired) {
+    outputError(ctx, "auth_expired", `Your session for ${auth.email} has expired.`, ExitCodes.AUTH_REQUIRED, "Run '10x auth' to log in again.");
+  }
+  const access = await fetchCourses(auth.access_token);
+  const accessMessage = access.ok ? `Available courses: ${access.data.courses.filter((course) => course.available).map((course) => course.slug).join(", ") || "none"}.` : `Course access could not be checked (${access.code}).`;
+  const methodMessage = auth.method ? ` Signed in via ${describeMethod(auth.method)}.` : "";
+  output(ctx, `Signed in as ${auth.email} — session expires ${formatExpiry(expiresAt)}. ${accessMessage}${methodMessage}`, {
+    email: auth.email,
+    expires_at: auth.expires_at,
+    is_valid: true,
+    ...auth.method ? { method: auth.method } : {},
+    access_checked: access.ok,
+    ...access.ok ? { courses: access.data.courses, defaultCourse: access.data.defaultCourse } : { access_error: { code: access.code, message: access.error } }
+  });
+}
+function describeMethod(method) {
+  return method === "circle" ? "Circle message" : "email magic link";
+}
+function formatExpiry(expiresAt) {
+  if (!Number.isFinite(expiresAt.getTime()))
+    return "at an unknown time";
+  const diffMs = expiresAt.getTime() - Date.now();
+  if (diffMs <= 0)
+    return "now";
+  const days = Math.floor(diffMs / (24 * 60 * 60 * 1000));
+  if (days >= 1)
+    return `in ${days} day${days === 1 ? "" : "s"}`;
+  const hours = Math.floor(diffMs / (60 * 60 * 1000));
+  if (hours >= 1)
+    return `in ${hours} hour${hours === 1 ? "" : "s"}`;
+  const mins = Math.max(1, Math.floor(diffMs / (60 * 1000)));
+  return `in ${mins} minute${mins === 1 ? "" : "s"}`;
+}
+function runLogout(ctx) {
+  const had = readAuth() !== null;
+  deleteAuth();
+  output(ctx, had ? "Logged out successfully." : "Already logged out.", {
+    logged_out: true,
+    had_credentials: had
+  });
+}
+async function runLogin(ctx, options) {
+  const method = await collectMethod(ctx, options);
+  const email = await collectEmail(ctx, options);
+  if (method === "circle") {
+    await runCircleLogin(ctx, email);
+    return;
+  }
+  if (!ctx.json)
+    we("10x auth");
+  const sp = ctx.json ? null : L2();
+  sp?.start("Requesting magic link…");
+  const login = await loginRequest(email);
+  if (!login.ok) {
+    sp?.stop("Magic link request failed.", 1);
+    handleLoginError(ctx, login.status, login.code, login.error);
+  }
+  const { session_id } = login.data;
+  sp?.stop(`Magic link sent to ${email}. Check your inbox.`);
+  const pollSpinner = ctx.json ? null : L2();
+  pollSpinner?.start("Waiting for magic link…");
+  const result = await pollVerifySession(session_id, {
+    onTick: (remainingMs) => {
+      if (pollSpinner) {
+        pollSpinner.message(`Waiting for magic link (${formatRemaining(remainingMs)} remaining)`);
+      }
+    }
+  });
+  if (result.kind === "verified") {
+    pollSpinner?.stop("Authenticated.");
+    const auth = {
+      version: AUTH_FILE_VERSION,
+      email,
+      access_token: result.tokens.token,
+      refresh_token: result.tokens.refresh_token,
+      expires_at: result.tokens.expires_at,
+      created_at: new Date().toISOString(),
+      method: "email"
+    };
+    saveAuth(auth);
+    if (!ctx.json)
+      fe(`Signed in as ${email}.`);
+    output(ctx, "", {
+      authenticated: true,
+      email,
+      expires_at: auth.expires_at,
+      method: "email"
+    });
+    return;
+  }
+  if (result.kind === "expired") {
+    pollSpinner?.stop("Session expired.", 1);
+    outputError(ctx, "session_expired", result.message || "Magic-link session expired before it was clicked.", ExitCodes.AUTH_REQUIRED, "Run '10x auth' again to request a fresh link.");
+  }
+  if (result.kind === "timeout") {
+    pollSpinner?.stop("Timed out waiting for magic link.", 1);
+    outputError(ctx, "auth_timeout", "Timed out waiting for the magic link to be clicked.", ExitCodes.ERROR, "Run '10x auth' to request a new link.");
+  }
+  if (result.kind === "aborted") {
+    pollSpinner?.stop("Cancelled.", 1);
+    outputError(ctx, "auth_cancelled", "Authentication cancelled.", ExitCodes.ERROR);
+  }
+  pollSpinner?.stop("Authentication failed.", 1);
+  outputError(ctx, result.code || "auth_error", result.message || "Authentication failed.", ExitCodes.ERROR);
+}
+var CIRCLE_SENT_MESSAGE = "A Circle message with an approval link is on its way; open it in Circle on any device.";
+var CIRCLE_UNKNOWN_MESSAGE = "Circle did not confirm delivery; the message may still arrive. Waiting for approval.";
+var CIRCLE_EXPIRY_HINT = "Run '10x auth --method email' to sign in with a magic link, or run '10x auth --method circle' to request a fresh Circle message.";
+async function runCircleLogin(ctx, email) {
+  if (!ctx.json)
+    we("10x auth");
+  const sp = ctx.json ? null : L2();
+  sp?.start("Requesting a Circle message…");
+  const start = await circleStartRequest(email, describeCircleClient());
+  if (!start.ok) {
+    sp?.stop("Circle message request failed.", 1);
+    handleCircleStartError(ctx, start.status, start.code, start.error, start.payload);
+  }
+  const { device_code, expires_in, interval, delivery } = start.data;
+  sp?.stop(delivery === "unknown" ? CIRCLE_UNKNOWN_MESSAGE : CIRCLE_SENT_MESSAGE);
+  verbose(ctx, `circle login started: delivery=${delivery} interval=${interval}s expires_in=${expires_in}s`);
+  const pollSpinner = ctx.json ? null : L2();
+  pollSpinner?.start("Waiting for approval in Circle…");
+  const controller = new AbortController;
+  const onSigint = () => controller.abort();
+  process.on("SIGINT", onSigint);
+  let result;
+  try {
+    result = await pollCircleLogin(device_code, {
+      intervalMs: interval * 1000,
+      timeoutMs: expires_in * 1000,
+      signal: controller.signal,
+      onTick: (remainingMs) => {
+        if (pollSpinner) {
+          pollSpinner.message(`Waiting for approval in Circle (${formatRemaining(remainingMs)} remaining)`);
+        }
+      }
+    });
+  } finally {
+    process.removeListener("SIGINT", onSigint);
+  }
+  if (result.kind === "verified") {
+    pollSpinner?.stop("Authenticated.");
+    const auth = {
+      version: AUTH_FILE_VERSION,
+      email,
+      access_token: result.tokens.token,
+      refresh_token: result.tokens.refresh_token,
+      expires_at: result.tokens.expires_at,
+      created_at: new Date().toISOString(),
+      method: "circle"
+    };
+    saveAuth(auth);
+    if (!ctx.json)
+      fe(`Signed in as ${email}.`);
+    output(ctx, "", {
+      authenticated: true,
+      email,
+      expires_at: auth.expires_at,
+      method: "circle"
+    });
+    return;
+  }
+  if (result.kind === "expired") {
+    pollSpinner?.stop("Circle login expired.", 1);
+    outputError(ctx, "circle_login_expired", "The Circle login expired before the approval link was opened.", ExitCodes.ERROR, CIRCLE_EXPIRY_HINT);
+  }
+  if (result.kind === "denied") {
+    pollSpinner?.stop("Access denied.", 1);
+    outputError(ctx, "access_denied", "This email has no active 10xDevs course membership, so the login was denied.", ExitCodes.FORBIDDEN, "Enroll at https://10xdevs.pl, then run '10x auth --method circle' again.");
+  }
+  if (result.kind === "timeout") {
+    pollSpinner?.stop("Timed out waiting for approval.", 1);
+    outputError(ctx, "auth_timeout", "Timed out waiting for the Circle approval link to be opened.", ExitCodes.ERROR, CIRCLE_EXPIRY_HINT);
+  }
+  if (result.kind === "aborted") {
+    pollSpinner?.stop("Cancelled.", 1);
+    outputError(ctx, "auth_cancelled", "Authentication cancelled.", ExitCodes.ERROR);
+  }
+  pollSpinner?.stop("Authentication failed.", 1);
+  outputError(ctx, result.code || "auth_error", result.message || "Authentication failed.", ExitCodes.ERROR);
+}
+function handleCircleStartError(ctx, status, code, error, payload) {
+  verbose(ctx, `circle start failed: status=${status} code=${code}`);
+  if (status === 403) {
+    outputError(ctx, "no_access", "This email has no active 10xDevs course membership.", ExitCodes.FORBIDDEN, "Enroll at https://10xdevs.pl, then run '10x auth --method circle' again.");
+  }
+  if (status === 429) {
+    const retryAfter = payload?.retry_after_s;
+    const wait = typeof retryAfter === "number" && Number.isFinite(retryAfter) && retryAfter > 0 ? `Wait about ${Math.ceil(retryAfter)} seconds` : "Wait a few minutes";
+    outputError(ctx, "rate_limited", "Too many Circle login requests right now.", ExitCodes.ERROR, `${wait}, then run '10x auth --method circle' again.`);
+  }
+  if (status === 502) {
+    outputError(ctx, "dm_rejected", "Circle refused to deliver the login message.", ExitCodes.ERROR, "Check that direct messages are enabled in your Circle settings, or run '10x auth --method email'.");
+  }
+  if (status === 503) {
+    outputError(ctx, "circle_login_disabled", "Circle login is currently unavailable.", ExitCodes.ERROR, "Run '10x auth --method email' to sign in with a magic link.");
+  }
+  if (status === 0) {
+    outputError(ctx, "network_error", "Could not reach the 10x-toolkit API.", ExitCodes.ERROR, "Check your internet connection and run '10x auth --method circle' again.");
+  }
+  outputError(ctx, code || "auth_error", "Authentication failed.", ExitCodes.ERROR, error ? `Server said: ${error}` : undefined);
+}
+async function collectMethod(ctx, options) {
+  if (options.method !== undefined) {
+    const value = String(options.method).trim().toLowerCase();
+    if (!isAuthMethod(value)) {
+      outputError(ctx, "invalid_method", `'${options.method}' is not a login method.`, ExitCodes.USAGE, "Pass '--method email' for a magic link or '--method circle' for a Circle message.");
+    }
+    return value;
+  }
+  if (ctx.json)
+    return "email";
+  const answer = await de({
+    message: "How do you want to sign in?",
+    options: [
+      { value: "email", label: "Email magic link", hint: "a link sent to your inbox" },
+      { value: "circle", label: "Circle message", hint: "an approval link sent to you in Circle" }
+    ],
+    initialValue: "email"
+  });
+  if (BD(answer)) {
+    ve("Authentication cancelled.");
+    outputError(ctx, "auth_cancelled", "Authentication cancelled.", ExitCodes.ERROR);
+  }
+  return answer;
+}
+async function collectEmail(ctx, options) {
+  if (options.email) {
+    const trimmed = options.email.trim();
+    if (!isLikelyEmail(trimmed)) {
+      outputError(ctx, "invalid_email", `'${options.email}' does not look like an email address.`, ExitCodes.USAGE, "Pass your 10xDevs email, for example '10x auth --email you@example.com'.");
+    }
+    return trimmed;
+  }
+  if (ctx.json) {
+    outputError(ctx, "missing_email", "Email is required in non-interactive mode.", ExitCodes.USAGE, "Pass --email, for example '10x auth --email you@example.com'.");
+  }
+  const answer = await ue({
+    message: "Enter your 10xDevs email",
+    placeholder: "you@example.com",
+    validate: (value) => {
+      if (!value || value.trim().length === 0)
+        return "Email is required.";
+      if (!isLikelyEmail(value.trim()))
+        return "That does not look like an email address.";
+      return;
+    }
+  });
+  if (BD(answer)) {
+    ve("Authentication cancelled.");
+    outputError(ctx, "auth_cancelled", "Authentication cancelled.", ExitCodes.ERROR);
+  }
+  return answer.trim();
+}
+function isLikelyEmail(value) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+}
+function formatRemaining(ms) {
+  const totalSeconds = Math.max(0, Math.ceil(ms / 1000));
+  const minutes = Math.floor(totalSeconds / 60);
+  const seconds = totalSeconds % 60;
+  return `${minutes}:${seconds.toString().padStart(2, "0")}`;
+}
+function handleLoginError(ctx, status, code, error) {
+  verbose(ctx, `login failed: status=${status} code=${code}`);
+  if (status === 403) {
+    outputError(ctx, "no_access", "This email has no active 10xDevs course membership.", ExitCodes.FORBIDDEN, "Enroll at https://10xdevs.pl, then run '10x auth' again.");
+  }
+  if (status === 429) {
+    outputError(ctx, "rate_limited", "Too many magic-link requests for this email.", ExitCodes.ERROR, "Wait a few minutes, then run '10x auth' again.");
+  }
+  if (status === 502) {
+    outputError(ctx, "email_delivery_failed", "Could not send the magic-link email.", ExitCodes.ERROR, "Try '10x auth' again in a few minutes. If it keeps failing, contact support.");
+  }
+  if (status === 0) {
+    outputError(ctx, "network_error", "Could not reach the 10x-toolkit API.", ExitCodes.ERROR, "Check your internet connection and run '10x auth' again.");
+  }
+  outputError(ctx, code || "auth_error", "Authentication failed.", ExitCodes.ERROR, error ? `Server said: ${error}` : undefined);
 }
 
 // src/lib/bench-client.ts
@@ -4043,207 +4580,80 @@ function renderLeaderboard(ctx, data, limit) {
       totalAttempts: data.totalAttempts,
       totalModels: data.totalModels,
       models: ranked.map((e2, i) => ({
-        rank: i + 1,
-        model: e2.modelName,
-        modelBaseId: e2.modelBaseId,
-        score: e2.averageScore,
-        maxScore: e2.averageMaxScore,
-        percentage: e2.averagePercentage,
-        attempts: e2.attemptCount,
-        environment: e2.agentEnvironment,
-        averageCost: e2.averageCost
-      }))
-    });
-    return;
-  }
-  if (ranked.length === 0) {
-    output(ctx, "The leaderboard has no results yet.", undefined);
-    return;
-  }
-  const names = ranked.map((e2) => sanitize(e2.modelName));
-  const details = ranked.map((e2) => formatDetail(e2));
-  const nameWidth = Math.max(...names.map((n) => n.length));
-  const detailWidth = Math.max(...details.map((d2) => d2.length));
-  const rankWidth = String(ranked.length).length;
-  const lines = [];
-  lines.push(paint(STYLE.bold, `10xBench — Top ${ranked.length} of ${data.totalModels} models`) + paint(STYLE.dim, `  (${data.totalAttempts} attempts scored)`));
-  lines.push("");
-  for (let i = 0;i < ranked.length; i++) {
-    lines.push(formatRow(ranked[i], i + 1, names[i], details[i], rankWidth, nameWidth, detailWidth));
-  }
-  lines.push("");
-  lines.push(paint(STYLE.dim, `Data as of ${formatReleaseAt(data.generatedAt)} — ${resolveBenchBase()}`));
-  output(ctx, lines.join(`
-`), undefined);
-}
-function formatDetail(entry) {
-  const score = `${entry.averageScore.toFixed(1)}/${entry.averageMaxScore.toFixed(0)}`;
-  const runs = `${entry.attemptCount} run${entry.attemptCount === 1 ? "" : "s"}`;
-  const cost = entry.averageCost === null || entry.averageCost === undefined ? "" : `, ~$${entry.averageCost.toFixed(2)}/run`;
-  return `(${score}, ${runs}${cost})`;
-}
-function formatRow(entry, rank, name, detail, rankWidth, nameWidth, detailWidth) {
-  const style = scoreStyle(entry.averagePercentage);
-  const rankCell = String(rank).padStart(rankWidth);
-  const nameCell = name.padEnd(nameWidth);
-  const pctCell = `${entry.averagePercentage.toFixed(1)}%`.padStart(6);
-  return [
-    `  ${paint(rank <= 3 ? STYLE.bold : STYLE.dim, rankCell)}`,
-    rank <= 3 ? paint(STYLE.bold, nameCell) : nameCell,
-    paint(style, scoreBar(entry.averagePercentage)),
-    paint(style, pctCell),
-    detail.padEnd(detailWidth),
-    paint(STYLE.dim, sanitize(entry.agentEnvironment))
-  ].join("  ");
-}
-
-// src/commands/bench-kit.ts
-import { spawn } from "node:child_process";
-import { existsSync as existsSync4, mkdtempSync, readFileSync as readFileSync3, rmSync as rmSync3 } from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, join as join4, resolve } from "node:path";
-
-// src/lib/tool-detect.ts
-import { existsSync as existsSync3 } from "node:fs";
-import { join as join3 } from "node:path";
-
-// src/lib/manifest.ts
-import { createHash } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join2 } from "node:path";
-var MANIFEST_FILENAME = ".10x-cli-manifest.json";
-var CLI_PACKAGE_NAME = "@przeprogramowani/10x-cli";
-var MANIFEST_VERSION = 3;
-function contentHash(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
-}
-function readManifest(dir) {
-  const manifestPath = join2(dir, MANIFEST_FILENAME);
-  if (!existsSync2(manifestPath))
-    return null;
-  let raw;
-  try {
-    raw = readFileSync2(manifestPath, "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (!isManifest(parsed))
-    return null;
-  return parsed;
-}
-function writeManifest(dir, manifest) {
-  if (!existsSync2(dir)) {
-    mkdirSync3(dir, { recursive: true });
-  }
-  const manifestPath = join2(dir, MANIFEST_FILENAME);
-  mkdirSync3(dirname2(manifestPath), { recursive: true });
-  const tmp = `${manifestPath}.tmp`;
-  rmSync2(tmp, { force: true });
-  writeFileSync2(tmp, `${JSON.stringify(manifest, null, 2)}
-`);
-  renameSync2(tmp, manifestPath);
-}
-function isManifest(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  const v3 = value;
-  if (v3["package"] !== CLI_PACKAGE_NAME)
-    return false;
-  if (typeof v3["version"] !== "string")
-    return false;
-  const mv = v3["manifestVersion"];
-  if (mv !== 2 && mv !== 3)
-    return false;
-  if (typeof v3["lastApplied"] !== "string")
-    return false;
-  if (typeof v3["lessonId"] !== "string")
-    return false;
-  if (typeof v3["course"] !== "string")
-    return false;
-  const files = v3["files"];
-  if (typeof files !== "object" || files === null)
-    return false;
-  const f2 = files;
-  if (!(isSkillsRecord(f2["skills"]) && isStringArray(f2["prompts"]) && isStringArray(f2["configs"])))
-    return false;
-  const lessons = v3["lessons"];
-  if (lessons !== undefined && !isLessonsRecord(lessons))
-    return false;
-  return true;
-}
-function isSkillsRecord(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value))
-    return false;
-  for (const entry of Object.values(value)) {
-    if (typeof entry !== "object" || entry === null)
-      return false;
-    const e2 = entry;
-    if (!isStringArray(e2["files"]))
-      return false;
+        rank: i + 1,
+        model: e2.modelName,
+        modelBaseId: e2.modelBaseId,
+        score: e2.averageScore,
+        maxScore: e2.averageMaxScore,
+        percentage: e2.averagePercentage,
+        attempts: e2.attemptCount,
+        environment: e2.agentEnvironment,
+        averageCost: e2.averageCost
+      }))
+    });
+    return;
   }
-  return true;
-}
-function isStringArray(value) {
-  return Array.isArray(value) && value.every((item) => typeof item === "string");
-}
-function isLessonFilesEntry(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  const e2 = value;
-  if (typeof e2["appliedAt"] !== "string")
-    return false;
-  if (typeof e2["skills"] !== "object" || e2["skills"] === null || Array.isArray(e2["skills"]))
-    return false;
-  for (const skill of Object.values(e2["skills"])) {
-    if (typeof skill !== "object" || skill === null)
-      return false;
-    if (!isStringArray(skill["files"]))
-      return false;
+  if (ranked.length === 0) {
+    output(ctx, "The leaderboard has no results yet.", undefined);
+    return;
   }
-  if (e2["catalogContentHash"] !== undefined && typeof e2["catalogContentHash"] !== "string") {
-    return false;
+  const names = ranked.map((e2) => sanitize(e2.modelName));
+  const details = ranked.map((e2) => formatDetail(e2));
+  const nameWidth = Math.max(...names.map((n) => n.length));
+  const detailWidth = Math.max(...details.map((d2) => d2.length));
+  const rankWidth = String(ranked.length).length;
+  const lines = [];
+  lines.push(paint(STYLE.bold, `10xBench — Top ${ranked.length} of ${data.totalModels} models`) + paint(STYLE.dim, `  (${data.totalAttempts} attempts scored)`));
+  lines.push("");
+  for (let i = 0;i < ranked.length; i++) {
+    lines.push(formatRow(ranked[i], i + 1, names[i], details[i], rankWidth, nameWidth, detailWidth));
   }
-  return isStringArray(e2["prompts"]) && isStringArray(e2["configs"]);
+  lines.push("");
+  lines.push(paint(STYLE.dim, `Data as of ${formatReleaseAt(data.generatedAt)} — ${resolveBenchBase()}`));
+  output(ctx, lines.join(`
+`), undefined);
 }
-function isLessonsRecord(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value))
-    return false;
-  for (const entry of Object.values(value)) {
-    if (!isLessonFilesEntry(entry))
-      return false;
-  }
-  return true;
+function formatDetail(entry) {
+  const score = `${entry.averageScore.toFixed(1)}/${entry.averageMaxScore.toFixed(0)}`;
+  const runs = `${entry.attemptCount} run${entry.attemptCount === 1 ? "" : "s"}`;
+  const cost = entry.averageCost === null || entry.averageCost === undefined ? "" : `, ~$${entry.averageCost.toFixed(2)}/run`;
+  return `(${score}, ${runs}${cost})`;
 }
-function buildUnionFiles(lessons) {
-  const skills = {};
-  const prompts = new Set;
-  const configs = new Set;
-  for (const entry of Object.values(lessons)) {
-    for (const [name, skill] of Object.entries(entry.skills)) {
-      if (!skills[name]) {
-        skills[name] = { files: [...skill.files] };
-      } else {
-        for (const f2 of skill.files) {
-          if (!skills[name].files.includes(f2)) {
-            skills[name].files.push(f2);
-          }
-        }
-      }
-    }
-    for (const p2 of entry.prompts)
-      prompts.add(p2);
-    for (const c2 of entry.configs)
-      configs.add(c2);
-  }
-  return { skills, prompts: [...prompts], configs: [...configs] };
+function formatRow(entry, rank, name, detail, rankWidth, nameWidth, detailWidth) {
+  const style = scoreStyle(entry.averagePercentage);
+  const rankCell = String(rank).padStart(rankWidth);
+  const nameCell = name.padEnd(nameWidth);
+  const pctCell = `${entry.averagePercentage.toFixed(1)}%`.padStart(6);
+  return [
+    `  ${paint(rank <= 3 ? STYLE.bold : STYLE.dim, rankCell)}`,
+    rank <= 3 ? paint(STYLE.bold, nameCell) : nameCell,
+    paint(style, scoreBar(entry.averagePercentage)),
+    paint(style, pctCell),
+    detail.padEnd(detailWidth),
+    paint(STYLE.dim, sanitize(entry.agentEnvironment))
+  ].join("  ");
 }
 
+// src/commands/bench-kit.ts
+import { spawn } from "node:child_process";
+import { existsSync as existsSync4, mkdtempSync, readFileSync as readFileSync4, rmSync as rmSync4 } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join as join5, resolve as resolve2 } from "node:path";
+
+// src/lib/tool-detect.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { join as join4 } from "node:path";
+
+// src/lib/manifest.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
+
+// src/lib/project-course.ts
+import { randomUUID } from "node:crypto";
+import { linkSync, lstatSync, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { isAbsolute, join as join2, relative, resolve, sep } from "node:path";
+
 // src/lib/tool-profile.ts
 var SENTINEL_BEGIN = "<!-- BEGIN @przeprogramowani/10x-cli -->";
 var SENTINEL_END = "<!-- END @przeprogramowani/10x-cli -->";
@@ -4350,21 +4760,329 @@ var LEGACY_PROFILES = {
     sentinelBegin: SENTINEL_BEGIN,
     sentinelEnd: SENTINEL_END
   }
-};
-function canonicalToolId(toolId) {
-  return TOOL_ALIASES[toolId] ?? toolId;
+};
+function canonicalToolId(toolId) {
+  return TOOL_ALIASES[toolId] ?? toolId;
+}
+function getToolProfile(toolId) {
+  return PROFILES[canonicalToolId(toolId)];
+}
+function contentToolId(profile) {
+  return profile.contentToolId ?? profile.toolId;
+}
+var DEFAULT_TOOL = "claude-code";
+
+// src/lib/project-course.ts
+var PROJECT_COURSE_FILENAME = ".10x-cli.json";
+
+class CourseBindingError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+function normalizeProjectCourse(value) {
+  if (value === "10xdevs3" || value === "10xdevs-3")
+    return "10xdevs3";
+  if (value === "10xdevs4" || value === "10xdevs-4")
+    return "10xdevs4";
+  return null;
+}
+function assertProjectPath(projectRoot, target) {
+  const root = resolve(projectRoot);
+  const rel = relative(root, resolve(target));
+  if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`))
+    throw new CourseBindingError("course_binding_invalid", `Path escapes project: ${target}`);
+  let current = root;
+  const parts = rel ? rel.split(sep) : [];
+  for (let i = 0;i <= parts.length; i++) {
+    if (i > 0)
+      current = join2(current, parts[i - 1]);
+    let stat;
+    try {
+      stat = lstatSync(current);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return;
+      throw error;
+    }
+    if (stat.isSymbolicLink() || i < parts.length && !stat.isDirectory() || i === parts.length && !stat.isFile() && !stat.isDirectory()) {
+      throw new CourseBindingError("course_binding_invalid", `Unsafe project path: ${current}`);
+    }
+  }
+}
+function assertProjectFilePath(projectRoot, target) {
+  assertProjectPath(projectRoot, target);
+  try {
+    if (!lstatSync(target).isFile())
+      throw new CourseBindingError("course_binding_invalid", `Expected a regular file at ${target}.`);
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+  }
+}
+function readJsonIfPresent(projectRoot, target) {
+  assertProjectPath(projectRoot, target);
+  try {
+    if (!lstatSync(target).isFile())
+      throw new Error("Expected a regular file");
+    return JSON.parse(readFileSync2(target, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw new CourseBindingError("course_binding_invalid", `Cannot read project state ${target}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function inspectProjectCourse(projectRoot) {
+  const binding = readJsonIfPresent(projectRoot, join2(projectRoot, PROJECT_COURSE_FILENAME));
+  let bound = null;
+  if (binding !== undefined) {
+    if (!binding || typeof binding !== "object" || Array.isArray(binding))
+      throw new CourseBindingError("course_binding_invalid", "Invalid .10x-cli.json.");
+    const value = binding;
+    bound = normalizeProjectCourse(value.course);
+    if (value.version !== 1 || !bound || value.course !== bound || Object.keys(value).some((key) => key !== "version" && key !== "course"))
+      throw new CourseBindingError("course_binding_invalid", "Unsupported or corrupt .10x-cli.json; preserve it and repair the project state before writing.");
+  }
+  const courses = new Set;
+  if (bound)
+    courses.add(bound);
+  for (const profile of [...Object.values(PROFILES), ...Object.values(LEGACY_PROFILES)]) {
+    const path = join2(projectRoot, profile.manifestDir, MANIFEST_FILENAME);
+    const value = readJsonIfPresent(projectRoot, path);
+    if (value === undefined)
+      continue;
+    if (!isManifest(value))
+      throw new CourseBindingError("course_binding_invalid", `Unsupported or corrupt manifest: ${path}. Preserve it; this CLI supports manifest versions 2 and 3.`);
+    const course = normalizeProjectCourse(value.course);
+    if (!course)
+      throw new CourseBindingError("course_binding_invalid", `Unsupported course in ${path}.`);
+    courses.add(course);
+  }
+  if (courses.size > 1)
+    throw new CourseBindingError("course_binding_conflict", "Project binding and tool manifests disagree on the course. Resolve the conflict before writing.");
+  return { course: courses.values().next().value ?? null, source: bound ? "binding" : courses.size ? "legacy" : "none" };
+}
+function assertProjectCourse(projectRoot, course) {
+  const normalized = normalizeProjectCourse(course);
+  if (!normalized || normalized !== course)
+    throw new CourseBindingError("course_binding_invalid", `Unsupported normalized course: ${course}`);
+  const state = inspectProjectCourse(projectRoot);
+  if (state.course && state.course !== course)
+    throw new CourseBindingError("course_mismatch", `This project uses ${state.course}. Start ${course} in a separate directory; get/sync cannot switch its edition.`);
+  return state;
+}
+function establishProjectCourse(projectRoot, course) {
+  const state = assertProjectCourse(projectRoot, course);
+  if (state.source === "binding")
+    return;
+  const destination = join2(projectRoot, PROJECT_COURSE_FILENAME);
+  const temporary = `${destination}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync2(temporary, `${JSON.stringify({ version: 1, course }, null, 2)}
+`, { flag: "wx" });
+    try {
+      linkSync(temporary, destination);
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      assertProjectCourse(projectRoot, course);
+    }
+  } finally {
+    rmSync2(temporary, { force: true });
+  }
+}
+
+// src/lib/manifest.ts
+var MANIFEST_FILENAME = ".10x-cli-manifest.json";
+var CLI_PACKAGE_NAME = "@przeprogramowani/10x-cli";
+var MANIFEST_VERSION = 3;
+function contentHash(content) {
+  return createHash2("sha256").update(content).digest("hex");
+}
+function readManifest(dir) {
+  const manifestPath = join3(dir, MANIFEST_FILENAME);
+  assertProjectFilePath(dirname2(dir), manifestPath);
+  if (!existsSync2(manifestPath))
+    return null;
+  let raw;
+  try {
+    raw = readFileSync3(manifestPath, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!isManifest(parsed))
+    return null;
+  return parsed;
+}
+function writeManifest(dir, manifest) {
+  assertProjectFilePath(dirname2(dir), join3(dir, MANIFEST_FILENAME));
+  assertProjectFilePath(dirname2(dir), join3(dir, `${MANIFEST_FILENAME}.tmp`));
+  if (!existsSync2(dir)) {
+    mkdirSync3(dir, { recursive: true });
+  }
+  const manifestPath = join3(dir, MANIFEST_FILENAME);
+  mkdirSync3(dirname2(manifestPath), { recursive: true });
+  const tmp = `${manifestPath}.${randomUUID2()}.tmp`;
+  assertProjectFilePath(dirname2(dir), tmp);
+  try {
+    writeFileSync3(tmp, `${JSON.stringify(manifest, null, 2)}
+`, { flag: "wx" });
+    renameSync2(tmp, manifestPath);
+  } finally {
+    rmSync3(tmp, { force: true });
+  }
+}
+function isManifest(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v3 = value;
+  if (v3["package"] !== CLI_PACKAGE_NAME || "directSkills" in v3)
+    return false;
+  if (typeof v3["version"] !== "string")
+    return false;
+  const mv = v3["manifestVersion"];
+  if (mv !== 2 && mv !== 3)
+    return false;
+  if (typeof v3["lastApplied"] !== "string")
+    return false;
+  if (typeof v3["lessonId"] !== "string")
+    return false;
+  if (typeof v3["course"] !== "string")
+    return false;
+  const files = v3["files"];
+  if (typeof files !== "object" || files === null)
+    return false;
+  const f2 = files;
+  if ("directSkills" in f2 || f2["promptHashes"] !== undefined && !isStringRecord(f2["promptHashes"]))
+    return false;
+  if (!(isSkillsRecord(f2["skills"]) && isStringArray(f2["prompts"]) && isStringArray(f2["configs"])))
+    return false;
+  if (f2["configHashes"] !== undefined && !isStringRecord(f2["configHashes"]))
+    return false;
+  const rules = v3["managedRules"];
+  if (rules !== undefined) {
+    if (!rules || typeof rules !== "object" || Array.isArray(rules))
+      return false;
+    const r2 = rules;
+    if (!["path", "begin", "end"].every((k3) => typeof r2[k3] === "string") || r2.upstreamHash !== undefined && typeof r2.upstreamHash !== "string")
+      return false;
+  }
+  const lessons = v3["lessons"];
+  if (lessons !== undefined && !isLessonsRecord(lessons))
+    return false;
+  return true;
+}
+function isSkillsRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  for (const entry of Object.values(value)) {
+    if (typeof entry !== "object" || entry === null)
+      return false;
+    const e2 = entry;
+    if (!isStringArray(e2["files"]) || e2["contentHashes"] !== undefined && !isStringRecord(e2["contentHashes"]))
+      return false;
+  }
+  return true;
+}
+function isStringRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function isLessonFilesEntry(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const e2 = value;
+  if (typeof e2["appliedAt"] !== "string")
+    return false;
+  if (typeof e2["skills"] !== "object" || e2["skills"] === null || Array.isArray(e2["skills"]))
+    return false;
+  for (const skill of Object.values(e2["skills"])) {
+    if (typeof skill !== "object" || skill === null)
+      return false;
+    if (!isStringArray(skill["files"]))
+      return false;
+  }
+  if (e2["catalogContentHash"] !== undefined && typeof e2["catalogContentHash"] !== "string") {
+    return false;
+  }
+  for (const k3 of ["installedReleaseId", "installedManifestHash"])
+    if (e2[k3] !== undefined && typeof e2[k3] !== "string")
+      return false;
+  if (e2.representation !== undefined) {
+    const r2 = e2.representation;
+    if (!r2 || typeof r2 !== "object" || typeof r2.lang !== "string" || typeof r2.tool !== "string" || typeof r2.courseRules !== "boolean" || r2.rules !== undefined && typeof r2.rules !== "boolean")
+      return false;
+  }
+  return isStringArray(e2["prompts"]) && isStringArray(e2["configs"]);
+}
+function isLessonsRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  for (const entry of Object.values(value)) {
+    if (!isLessonFilesEntry(entry))
+      return false;
+  }
+  return true;
 }
-function getToolProfile(toolId) {
-  return PROFILES[canonicalToolId(toolId)];
+function buildUnionFiles(lessons) {
+  const skills = {};
+  const prompts = new Set;
+  const configs = new Set;
+  for (const entry of Object.values(lessons)) {
+    for (const [name, skill] of Object.entries(entry.skills)) {
+      if (!skills[name]) {
+        skills[name] = { files: [...skill.files] };
+      } else {
+        for (const f2 of skill.files) {
+          if (!skills[name].files.includes(f2)) {
+            skills[name].files.push(f2);
+          }
+        }
+      }
+    }
+    for (const p2 of entry.prompts)
+      prompts.add(p2);
+    for (const c2 of entry.configs)
+      configs.add(c2);
+  }
+  return { skills, prompts: [...prompts], configs: [...configs] };
 }
-function contentToolId(profile) {
-  return profile.contentToolId ?? profile.toolId;
+function seedLessons(manifest) {
+  return structuredClone(manifest.lessons ?? { [manifest.lessonId]: {
+    appliedAt: manifest.lastApplied,
+    skills: Object.fromEntries(Object.entries(manifest.files.skills).map(([name, entry]) => [name, { files: [...entry.files] }])),
+    prompts: [...manifest.files.prompts],
+    configs: [...manifest.files.configs]
+  } });
+}
+function rebuildManifestFiles(manifest) {
+  const union = buildUnionFiles(manifest.lessons ?? {});
+  const previous = manifest.files;
+  manifest.files = {
+    skills: Object.fromEntries(Object.entries(union.skills).map(([name, entry]) => [name, {
+      files: entry.files,
+      contentHashes: Object.fromEntries(entry.files.flatMap((file) => previous.skills[name]?.contentHashes?.[file] ? [[file, previous.skills[name].contentHashes[file]]] : []))
+    }])),
+    prompts: union.prompts,
+    configs: union.configs,
+    promptHashes: Object.fromEntries(union.prompts.flatMap((name) => previous.promptHashes?.[name] ? [[name, previous.promptHashes[name]]] : [])),
+    configHashes: Object.fromEntries(union.configs.flatMap((name) => previous.configHashes?.[name] ? [[name, previous.configHashes[name]]] : []))
+  };
 }
-var DEFAULT_TOOL = "claude-code";
 
 // src/lib/tool-detect.ts
 function detectTools(projectRoot) {
-  const hit = (rel) => existsSync3(join3(projectRoot, rel));
+  const hit = (rel) => existsSync3(join4(projectRoot, rel));
   const signals = [];
   if (hit(".claude/" + MANIFEST_FILENAME)) {
     signals.push({
@@ -4498,7 +5216,7 @@ function topDetectedProfile(signals) {
 
 // src/commands/bench-kit.ts
 var TEMPLATE_REPO_URL = "https://github.com/przeprogramowani/10x-bench-kit";
-var BOOTSTRAP_ENTRY = join4(".bench-kit", "bootstrap", "index.mjs");
+var BOOTSTRAP_ENTRY = join5(".bench-kit", "bootstrap", "index.mjs");
 var CONTRACT_VERSION = 1;
 function registerBenchKitCommand(cli) {
   cli.command("bench-kit <action> [dir]", "Manage a benchmark instance (actions: init, update)").option("--template-version <tag>", "Template tag to install (default: latest)").option("--tool <id>", `Agent tool for skill placement (${Object.keys(PROFILES).join(", ")})`).option("--yes", "Run non-interactively, accepting defaults").example("10x bench-kit init my-benchmark").example("10x bench-kit init my-benchmark --template-version v0.1.0").example("10x bench-kit update").action(async (action, dir, options) => {
@@ -4515,7 +5233,7 @@ function registerBenchKitCommand(cli) {
   });
 }
 async function runBenchKitInit(ctx, dirArg, options, deps = defaultDeps) {
-  const targetDir = resolve(dirArg ?? ".");
+  const targetDir = resolve2(dirArg ?? ".");
   const requestedRef = normalizeRef(ctx, options.templateVersion);
   await preflight(ctx, deps);
   const existingVersion = readInstanceVersion(targetDir);
@@ -4523,7 +5241,7 @@ async function runBenchKitInit(ctx, dirArg, options, deps = defaultDeps) {
     outputError(ctx, "version_conflict", `This directory already holds a benchmark instance on template version ${existingVersion}.`, ExitCodes.USAGE, "Run '10x bench-kit update' to change the template version of an existing instance.");
   }
   const toolChoice = await resolveInstanceTool(ctx, options, deps, existingVersion !== null);
-  const scratch = mkdtempSync(join4(tmpdir(), "bench-kit-"));
+  const scratch = mkdtempSync(join5(tmpdir(), "bench-kit-"));
   try {
     await cloneTemplateOrDie(ctx, deps, requestedRef, scratch, "init");
     const entry = requireBootstrap(ctx, scratch);
@@ -4560,14 +5278,14 @@ async function runBenchKitInit(ctx, dirArg, options, deps = defaultDeps) {
     }
     let baseRepoClone = "skipped";
     if (res.baseRepoClone != null) {
-      const cloneDest = join4(targetDir, res.baseRepoClone.dest);
+      const cloneDest = join5(targetDir, res.baseRepoClone.dest);
       verbose(ctx, `cloning base repo into ${res.baseRepoClone.dest}`);
       const cloned = await deps.cloneBaseRepo(res.baseRepoClone, cloneDest);
       if (cloned.ok) {
         baseRepoClone = "cloned";
       } else {
         baseRepoClone = "failed";
-        rmSync3(cloneDest, { recursive: true, force: true });
+        rmSync4(cloneDest, { recursive: true, force: true });
         verbose(ctx, `base repo clone failed (${cloned.error.trim().split(`
 `).pop() ?? ""})`);
       }
@@ -4614,11 +5332,11 @@ async function runBenchKitInit(ctx, dirArg, options, deps = defaultDeps) {
       warnings: res.warnings ?? []
     });
   } finally {
-    rmSync3(scratch, { recursive: true, force: true });
+    rmSync4(scratch, { recursive: true, force: true });
   }
 }
 async function runBenchKitUpdate(ctx, dirArg, options, deps = defaultDeps) {
-  const targetDir = resolve(dirArg ?? ".");
+  const targetDir = resolve2(dirArg ?? ".");
   const requestedRef = normalizeRef(ctx, options.templateVersion);
   await preflight(ctx, deps);
   const currentVersion = readInstanceVersion(targetDir);
@@ -4633,7 +5351,7 @@ async function runBenchKitUpdate(ctx, dirArg, options, deps = defaultDeps) {
   if (!status.ok) {
     verbose(ctx, "not a git repository — proceeding, but review the changes without git diff");
   }
-  const scratch = mkdtempSync(join4(tmpdir(), "bench-kit-"));
+  const scratch = mkdtempSync(join5(tmpdir(), "bench-kit-"));
   try {
     await cloneTemplateOrDie(ctx, deps, requestedRef, scratch, "update");
     const entry = requireBootstrap(ctx, scratch);
@@ -4691,7 +5409,7 @@ async function runBenchKitUpdate(ctx, dirArg, options, deps = defaultDeps) {
       warnings: res.warnings ?? []
     });
   } finally {
-    rmSync3(scratch, { recursive: true, force: true });
+    rmSync4(scratch, { recursive: true, force: true });
   }
 }
 function describeSync(counts) {
@@ -4754,17 +5472,17 @@ async function cloneTemplateOrDie(ctx, deps, ref, scratch, action) {
   }
 }
 function requireBootstrap(ctx, scratch) {
-  const entry = join4(scratch, BOOTSTRAP_ENTRY);
+  const entry = join5(scratch, BOOTSTRAP_ENTRY);
   if (!existsSync4(entry)) {
     outputError(ctx, "template_incomplete", `The downloaded template has no ${BOOTSTRAP_ENTRY} — it predates the bootstrap contract.`, ExitCodes.ERROR, "This CLI needs template v0.10.0 or newer; drop --template-version or pass a newer tag.");
   }
   return entry;
 }
 function readInstanceVersion(dir) {
-  const versionFile = join4(dir, ".bench-kit", "VERSION");
+  const versionFile = join5(dir, ".bench-kit", "VERSION");
   if (!existsSync4(versionFile))
     return null;
-  return readFileSync3(versionFile, "utf8").trim();
+  return readFileSync4(versionFile, "utf8").trim();
 }
 function toHttpsUrl(url) {
   const scp = url.match(/^git@([^:/]+):(.+)$/);
@@ -4890,214 +5608,76 @@ var defaultDeps = {
 
 // src/commands/doctor.ts
 import { existsSync as existsSync5, accessSync, constants } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 
-// src/lib/signing.ts
-import { createHash as createHash2, createPublicKey, verify } from "node:crypto";
-
-class SignatureError extends Error {
-  constructor(message) {
+// src/lib/course-selection.ts
+class CourseSelectionError extends Error {
+  code;
+  constructor(code, message) {
     super(message);
-    this.name = "SignatureError";
-  }
-}
-var KEYSET = [
-  {
-    keyId: 1,
-    publicKey: "MCowBQYDK2VwAyEANXEwq1y+9CYAJS6ze9m/c212fL4r1BauXwKdT6Zo5Ko="
-  }
-];
-var REQUIRE_SIGNATURES = true;
-function loadEffectiveKeyset() {
-  const override = process.env["BUNDLE_PUBLIC_KEYSET"];
-  if (!override)
-    return KEYSET;
-  const apiBase = process.env["API_BASE_URL"];
-  if (!apiBase)
-    return KEYSET;
-  let hostname;
-  try {
-    hostname = new URL(apiBase).hostname;
-  } catch {
-    return KEYSET;
-  }
-  if (hostname !== "localhost" && hostname !== "127.0.0.1") {
-    return KEYSET;
-  }
-  try {
-    const parsed = JSON.parse(override);
-    if (!Array.isArray(parsed) || parsed.length === 0)
-      return KEYSET;
-    for (const k3 of parsed) {
-      if (typeof k3.keyId !== "number" || typeof k3.publicKey !== "string") {
-        return KEYSET;
-      }
-    }
-    return parsed;
-  } catch {
-    return KEYSET;
-  }
-}
-function sha256Hex(body) {
-  return createHash2("sha256").update(body).digest("hex");
-}
-function canonicalSigningString(keyId, hashHex) {
-  return `v1:${keyId}:${hashHex}`;
-}
-function verifyBundleSignature(rawBody, signature, keyId, headerHash) {
-  verifyBundleSignatureWithKeyset(rawBody, signature, keyId, headerHash, loadEffectiveKeyset());
-}
-function verifyBundleSignatureWithKeyset(rawBody, signature, keyId, headerHash, keyset) {
-  const key = keyset.find((k3) => k3.keyId === keyId);
-  if (!key) {
-    throw new SignatureError(`Unknown signing key (key_id=${keyId}). Update your CLI: npm update -g @przeprogramowani/10x-cli`);
-  }
-  const computedHash = sha256Hex(rawBody);
-  if (computedHash !== headerHash) {
-    throw new SignatureError(`Bundle content hash mismatch (header=${headerHash.slice(0, 12)}…, computed=${computedHash.slice(0, 12)}…). ` + "The bundle may have been tampered with in transit. Do NOT use the content.");
-  }
-  let pubKey;
+    this.code = code;
+  }
+}
+function selectCourse(discovery, state, explicit, writing = false) {
+  if (!validateCourseDiscovery(discovery))
+    throw new CourseSelectionError("discovery_invalid", "Invalid course discovery response.");
+  const requested = explicit ?? state.course ?? discovery.defaultCourse;
+  if (!requested)
+    throw new CourseSelectionError(discovery.courses.length ? "course_unavailable" : "course_access_denied", discovery.courses.length ? "Your courses have no available published content yet." : "Your account has no active course access.");
+  const selected = discovery.courses.find((course) => course.id === requested || course.slug === requested);
+  const normalized = selected?.slug ?? normalizeProjectCourse(requested);
+  if (writing && state.course && normalized && state.course !== normalized)
+    throw new CourseBindingError("course_mismatch", `This project uses ${state.course}. Start ${normalized} in a separate directory; get/sync cannot switch its edition.`);
+  if (!selected)
+    throw new CourseSelectionError("course_access_denied", `Your account does not have access to ${requested}.`);
+  if (!selected.available)
+    throw new CourseSelectionError("course_unavailable", `${selected.slug} has no available published content yet.`);
+  if (normalizeProjectCourse(selected.slug) !== selected.slug)
+    throw new CourseSelectionError("course_unsupported", `This CLI does not support ${selected.slug}. Update the CLI before writing its content.`);
+  return { course: selected.slug, courseId: selected.id, reason: explicit !== undefined ? "explicit" : state.source === "binding" ? "project_binding" : state.source === "legacy" ? "legacy_manifest" : "backend_recommendation" };
+}
+function tokenLacksCourse(token, selection) {
   try {
-    pubKey = createPublicKey({
-      key: Buffer.from(key.publicKey, "base64"),
-      format: "der",
-      type: "spki"
-    });
+    const segment = token.split(".")[1];
+    if (!segment)
+      return false;
+    const payload = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    return Array.isArray(payload.courses) && !payload.courses.includes(selection.courseId) && !payload.courses.includes(selection.course);
   } catch {
-    throw new SignatureError("Failed to load the signing public key. Your CLI binary may be corrupted — reinstall it.");
-  }
-  const canonical = canonicalSigningString(keyId, computedHash);
-  const sig = Buffer.from(signature, "base64");
-  const valid = verify(null, Buffer.from(canonical), pubKey, sig);
-  if (!valid) {
-    throw new SignatureError("Bundle signature verification failed — the bundle may have been tampered with. " + "Do NOT use the content. Report this to the course team.");
-  }
-}
-
-// src/lib/api-content.ts
-function fetchCatalog(course, token, options = {}) {
-  return apiGet(`/api/catalog/${encodeURIComponent(course)}`, { token, signal: options.signal });
-}
-function fetchModuleDetail(course, module, token, options = {}) {
-  return apiGet(`/api/modules/${encodeURIComponent(course)}/${module}`, { token, signal: options.signal });
-}
-async function fetchLesson(course, lessonId, token, options = {}) {
-  const params = new URLSearchParams;
-  if (options.lang)
-    params.set("lang", options.lang);
-  if (options.tool)
-    params.set("tool", options.tool);
-  const qs = params.toString();
-  const path = `/api/lessons/${encodeURIComponent(course)}/${encodeURIComponent(lessonId)}${qs ? `?${qs}` : ""}`;
-  const result = await apiGet(path, { token, signal: options.signal });
-  if (!result.ok)
-    return result;
-  const signature = result.responseHeaders.get("X-Bundle-Signature");
-  const keyIdRaw = result.responseHeaders.get("X-Bundle-Key-Id");
-  const headerHash = result.responseHeaders.get("X-Bundle-Content-Hash");
-  if (signature && keyIdRaw && headerHash) {
-    const keyId = Number(keyIdRaw);
-    try {
-      verifyBundleSignature(result.rawBody, signature, keyId, headerHash);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return {
-        ok: false,
-        status: 0,
-        code: err instanceof SignatureError ? "signature_error" : "signature_internal_error",
-        error: message
-      };
-    }
-  } else if (signature || keyIdRaw || headerHash) {
-    return {
-      ok: false,
-      status: 0,
-      code: "signature_error",
-      error: "Bundle signing headers are incomplete (expected X-Bundle-Signature, X-Bundle-Key-Id, and X-Bundle-Content-Hash together). " + "The API may be misconfigured. Do NOT use the content. Report this to the course team."
-    };
-  } else if (REQUIRE_SIGNATURES) {
-    return {
-      ok: false,
-      status: 0,
-      code: "signature_missing",
-      error: "Bundle is missing a signature. The API may be misconfigured or compromised. " + "Do NOT use the content. Report this to the course team."
-    };
-  } else {
-    process.stderr.write(`Warning: bundle is not signed. Signature verification skipped.
-`);
+    return false;
   }
-  return result;
 }
-async function fetchArtifact(course, lessonId, type, name, tool, token, options = {}) {
-  const params = new URLSearchParams({ tool });
-  if (options.lang)
-    params.set("lang", options.lang);
-  const path = `/api/artifacts/${encodeURIComponent(course)}/${encodeURIComponent(lessonId)}/${encodeURIComponent(type)}/${encodeURIComponent(name)}?${params}`;
-  const result = await apiGet(path, { token, signal: options.signal });
-  if (!result.ok)
-    return result;
-  const signature = result.responseHeaders.get("X-Bundle-Signature");
-  const keyIdRaw = result.responseHeaders.get("X-Bundle-Key-Id");
-  const headerHash = result.responseHeaders.get("X-Bundle-Content-Hash");
-  if (signature && keyIdRaw && headerHash) {
-    const keyId = Number(keyIdRaw);
-    try {
-      verifyBundleSignature(result.rawBody, signature, keyId, headerHash);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return {
-        ok: false,
-        status: 0,
-        code: err instanceof SignatureError ? "signature_error" : "signature_internal_error",
-        error: message
-      };
-    }
-  } else if (signature || keyIdRaw || headerHash) {
-    return {
-      ok: false,
-      status: 0,
-      code: "signature_error",
-      error: "Artifact signing headers are incomplete (expected X-Bundle-Signature, X-Bundle-Key-Id, and X-Bundle-Content-Hash together). " + "The API may be misconfigured. Do NOT use the content. Report this to the course team."
-    };
-  } else if (REQUIRE_SIGNATURES) {
-    return {
-      ok: false,
-      status: 0,
-      code: "signature_missing",
-      error: "Artifact is missing a signature. The API may be misconfigured or compromised. " + "Do NOT use the content. Report this to the course team."
-    };
-  } else {
-    process.stderr.write(`Warning: artifact is not signed. Signature verification skipped.
-`);
+function reportCourseError(ctx, error) {
+  if (error instanceof CourseBindingError || error instanceof CourseSelectionError) {
+    outputError(ctx, error.code, error.message, error.code === "course_access_denied" ? ExitCodes.FORBIDDEN : error.code === "course_mismatch" ? ExitCodes.USAGE : ExitCodes.ERROR);
   }
-  return result;
+  throw error;
 }
-async function fetchHealth(options = {}) {
-  const timeoutMs = options.timeoutMs ?? 5000;
-  const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const started = Date.now();
+async function resolveCourseSelection(ctx, options, dependencies = {}) {
+  const authenticate = dependencies.authenticate ?? requireAuth;
+  const discover = dependencies.discover ?? fetchCourses;
+  const root = options.projectRoot ?? process.cwd();
   try {
-    const result = await apiGet("/health", { signal: controller.signal });
-    const latencyMs = Date.now() - started;
-    return { ...result, latencyMs };
-  } catch (err) {
-    const latencyMs = Date.now() - started;
-    const aborted = controller.signal.aborted;
-    return {
-      ok: false,
-      status: 0,
-      code: aborted ? "timeout" : "network_error",
-      error: err instanceof Error ? err.message : String(err),
-      latencyMs
-    };
-  } finally {
-    clearTimeout(timer);
+    const state = inspectProjectCourse(root);
+    let auth = await authenticate(ctx);
+    let discovery = await discover(auth.access_token);
+    if (!discovery.ok)
+      outputError(ctx, discovery.code, discovery.error, discovery.status === 401 ? ExitCodes.AUTH_REQUIRED : discovery.status === 403 ? ExitCodes.FORBIDDEN : ExitCodes.ERROR);
+    const selected = selectCourse(discovery.data, state, options.explicit, options.writing);
+    if (tokenLacksCourse(auth.access_token, selected)) {
+      auth = await authenticate(ctx, { forceRefreshForToken: auth.access_token });
+      discovery = await discover(auth.access_token);
+      if (!discovery.ok)
+        outputError(ctx, discovery.code, discovery.error, discovery.status === 401 ? ExitCodes.AUTH_REQUIRED : discovery.status === 403 ? ExitCodes.FORBIDDEN : ExitCodes.ERROR);
+      selectCourse(discovery.data, state, selected.course, options.writing);
+      if (tokenLacksCourse(auth.access_token, selected))
+        throw new CourseSelectionError("course_access_denied", "The refreshed session still does not grant the selected course. Sign in again.");
+    }
+    return { ...selected, auth };
+  } catch (error) {
+    return reportCourseError(ctx, error);
   }
 }
-function apiBaseUrl() {
-  return resolveApiBase();
-}
 
 // src/lib/update-check.ts
 var NPM_REGISTRY_URL = "https://registry.npmjs.org/@przeprogramowani/10x-cli/latest";
@@ -5172,7 +5752,7 @@ function registerDoctorCommand(cli) {
 async function runDoctor(ctx) {
   verbose(ctx, "running doctor checks");
   const checks = [];
-  checks.push(checkAuth());
+  checks.push(await checkAuth());
   checks.push(await checkApiConnectivity());
   checks.push(checkConfigDirectory());
   checks.push(await checkCliVersion());
@@ -5221,7 +5801,7 @@ async function runDoctor(ctx) {
     process.exit(EX_CONFIG);
   }
 }
-function checkAuth() {
+async function checkAuth() {
   const auth = readAuth();
   if (!auth) {
     return {
@@ -5242,6 +5822,16 @@ function checkAuth() {
       details: { email: auth.email, expires_at: auth.expires_at }
     };
   }
+  const access = await fetchCourses(auth.access_token);
+  if (!access.ok)
+    return { name: "auth", label: "Auth", status: "fail", message: `Session exists, but course access could not be verified: ${access.error}`, details: { email: auth.email, expires_at: auth.expires_at, code: access.code, access_checked: false } };
+  let selected;
+  try {
+    selected = selectCourse(access.data, inspectProjectCourse(process.cwd()));
+  } catch (error) {
+    return { name: "auth", label: "Auth", status: "fail", message: error instanceof Error ? error.message : String(error), details: { access_checked: true, courses: access.data.courses, code: error && typeof error === "object" && "code" in error ? error.code : "course_error" } };
+  }
+  const accessDetails = { access_checked: true, courses: access.data.courses, course: selected.course, selectionReason: selected.reason };
   const nearExpiry = isNearExpiry(auth);
   const prettyDate = formatReleaseAt(auth.expires_at);
   if (nearExpiry) {
@@ -5251,15 +5841,15 @@ function checkAuth() {
       status: "warn",
       message: `Signed in as ${auth.email}, but the session expires ${prettyDate.toLowerCase()}.`,
       hint: "The next command will transparently refresh the token.",
-      details: { email: auth.email, expires_at: auth.expires_at }
+      details: { email: auth.email, expires_at: auth.expires_at, ...accessDetails }
     };
   }
   return {
     name: "auth",
     label: "Auth",
     status: "pass",
-    message: `Signed in as ${auth.email} — session expires ${prettyDate.toLowerCase()}.`,
-    details: { email: auth.email, expires_at: auth.expires_at }
+    message: `Signed in as ${auth.email} — ${selected.course} (${selected.reason}); session expires ${prettyDate.toLowerCase()}.`,
+    details: { email: auth.email, expires_at: auth.expires_at, ...accessDetails }
   };
 }
 async function checkApiConnectivity() {
@@ -5360,7 +5950,7 @@ function checkToolDirectory() {
   const toolId = readToolConfig()?.tool ?? DEFAULT_TOOL;
   const profile = getToolProfile(toolId) ?? PROFILES[DEFAULT_TOOL];
   const dirName = profile.manifestDir;
-  const toolDir = join5(cwd, dirName);
+  const toolDir = join6(cwd, dirName);
   if (!existsSync5(toolDir)) {
     return {
       name: "tool-dir",
@@ -5393,7 +5983,7 @@ function checkToolDirectory() {
 }
 
 // src/commands/get.ts
-import { join as join8 } from "node:path";
+import { join as join10 } from "node:path";
 
 // src/lib/conflict-prompt.ts
 init_dist2();
@@ -5481,108 +6071,163 @@ function parseModuleRef(raw) {
 init_dist2();
 
 // src/lib/tool-switch.ts
-import {
-  existsSync as existsSync7,
-  lstatSync,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync6,
-  renameSync as renameSync3,
-  rmdirSync as rmdirSync2,
-  rmSync as rmSync5,
-  statSync,
-  writeFileSync as writeFileSync4
-} from "node:fs";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync5, statSync, chmodSync as chmodSync3, openSync, closeSync } from "node:fs";
+import { dirname as dirname5, join as join9 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
 
-// src/lib/fs-utils.ts
-import { readFileSync as readFileSync4 } from "node:fs";
-function readFileOrNull(path) {
-  try {
-    return readFileSync4(path, "utf8");
-  } catch {
-    return null;
+// src/lib/managed-removal.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5, rmSync as rmSync5, rmdirSync } from "node:fs";
+import { dirname as dirname3, relative as relative2, sep as sep2 } from "node:path";
+function planManagedRemoval(root, input) {
+  assertProjectFilePath(root, input.path);
+  const base = { name: input.name, path: input.path, storedHash: input.storedHash, pruneRoot: input.pruneRoot };
+  if (!existsSync6(input.path))
+    return { ...base, action: "unchanged", reason: "already_missing" };
+  if (input.protected)
+    return { ...base, action: "preserved_local", reason: "still_owned" };
+  if (input.config)
+    return { ...base, action: "preserved_local", reason: "config_template" };
+  if (!input.storedHash)
+    return { ...base, action: "preserved_local", reason: "missing_baseline" };
+  if (contentHash(readFileSync5(input.path)) !== input.storedHash)
+    return { ...base, action: "preserved_local", reason: "locally_modified" };
+  return { ...base, action: "removed" };
+}
+function executeManagedRemoval(root, plan) {
+  assertProjectFilePath(root, plan.path);
+  if (plan.action !== "removed")
+    return plan;
+  if (!existsSync6(plan.path))
+    return { ...plan, action: "unchanged", reason: "already_missing" };
+  if (!plan.storedHash || contentHash(readFileSync5(plan.path)) !== plan.storedHash)
+    return { ...plan, action: "preserved_local", reason: "locally_modified" };
+  rmSync5(plan.path);
+  if (plan.pruneRoot)
+    pruneEmptyParents(root, plan.path, plan.pruneRoot);
+  return plan;
+}
+function pruneEmptyParents(root, file, boundary) {
+  let dir = dirname3(file);
+  while (dir === boundary || relative2(boundary, dir) !== ".." && !relative2(boundary, dir).startsWith(`..${sep2}`)) {
+    assertProjectPath(root, dir);
+    try {
+      rmdirSync(dir);
+    } catch (error) {
+      if (["ENOENT", "ENOTEMPTY", "EEXIST", "EACCES", "EPERM"].includes(error.code ?? ""))
+        return;
+      throw error;
+    }
+    if (dir === boundary)
+      return;
+    dir = dirname3(dir);
   }
 }
 
+// src/lib/managed-rules.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
+import { join as join7 } from "node:path";
+
 // src/lib/sentinel-migration.ts
 var OLD_BEGIN = "<!-- BEGIN @przeprogramowani/10x-toolkit -->";
 var OLD_END = "<!-- END @przeprogramowani/10x-toolkit -->";
+function inspectRulesBlock(content, begin, end) {
+  const starts = content.split(begin).length - 1;
+  const ends = content.split(end).length - 1;
+  if (!starts && !ends)
+    return null;
+  const start = content.indexOf(begin);
+  const stop = content.indexOf(end);
+  if (starts !== 1 || ends !== 1 || stop < start) {
+    throw new Error("Rules markers need repair: orphan, duplicate, or out-of-order sentinel. Preserve the file and resolve its markers before continuing.");
+  }
+  const finish = stop + end.length;
+  return { start, finish, text: content.slice(start, finish), body: content.slice(start + begin.length, stop).trim() };
+}
 function removeRulesBlockWithMarkers(existing, begin, end) {
-  const beginIdx = existing.indexOf(begin);
-  const endIdx = existing.indexOf(end);
-  if (beginIdx === -1 || endIdx === -1 || endIdx < beginIdx) {
+  const block = inspectRulesBlock(existing, begin, end);
+  if (!block)
     return { content: existing, removed: false };
-  }
-  const beforeRaw = existing.slice(0, beginIdx);
-  const afterRaw = existing.slice(endIdx + end.length);
-  const before = beforeRaw.replace(/[\r\n]*$/, "");
-  const after = afterRaw.replace(/^[\r\n]*/, "");
-  const joiner = before.length > 0 && after.length > 0 ? `
-
-` : "";
-  const combined = before + joiner + after;
-  const content = combined.length === 0 ? "" : combined.replace(/[\r\n]*$/, `
-`);
-  return { content, removed: true };
+  return { content: existing.slice(0, block.start) + existing.slice(block.finish), removed: true };
 }
-function applyRulesBlockWithMarkers(existingContent, rulesBody, beginMarker, endMarker) {
-  for (const marker of [OLD_BEGIN, OLD_END, beginMarker, endMarker]) {
-    if (rulesBody.includes(marker)) {
-      throw new Error(`rules body contains a sentinel marker (${JSON.stringify(marker)}) — refusing to write to prevent rules file corruption`);
-    }
+function applyRulesBlockWithMarkers(existing, body, begin, end) {
+  for (const marker of [OLD_BEGIN, OLD_END, begin, end]) {
+    if (body.includes(marker))
+      throw new Error(`rules body contains a sentinel marker (${JSON.stringify(marker)})`);
   }
-  const warnings = [];
-  let content = existingContent;
-  content = stripBlock(content, OLD_BEGIN, OLD_END, "@przeprogramowani/10x-toolkit", warnings);
-  content = stripBlock(content, beginMarker, endMarker, "@przeprogramowani/10x-cli", warnings);
-  content = content.replace(/\n{3,}/g, `
-
-`).trim();
-  const block = `${beginMarker}
+  const current = inspectRulesBlock(existing, begin, end);
+  const legacy = begin === OLD_BEGIN ? null : inspectRulesBlock(existing, OLD_BEGIN, OLD_END);
+  const fresh = `${begin}
 
-${rulesBody.trim()}
-
-${endMarker}`;
-  const result = content.length > 0 ? `${content}
-
-${block}
-` : `${block}
-`;
-  return { content: result, warnings };
-}
-function stripBlock(content, begin, end, label, warnings) {
-  const beginIdx = content.indexOf(begin);
-  const endIdx = content.indexOf(end);
-  if (beginIdx !== -1 && endIdx !== -1 && endIdx > beginIdx) {
-    return content.slice(0, beginIdx) + content.slice(endIdx + end.length);
-  }
-  if (beginIdx !== -1 && endIdx === -1) {
-    warnings.push(`CLAUDE.md has an orphan ${label} BEGIN marker; truncating from the marker onward.`);
-    return content.slice(0, beginIdx);
-  }
-  if (beginIdx === -1 && endIdx !== -1) {
-    warnings.push(`CLAUDE.md has an orphan ${label} END marker; truncating content before the marker.`);
-    return content.slice(0, endIdx);
-  }
-  if (beginIdx !== -1 && endIdx !== -1 && endIdx < beginIdx) {
-    warnings.push(`CLAUDE.md has out-of-order ${label} markers; repairing by truncating to the first marker.`);
-    return content.slice(0, Math.min(beginIdx, endIdx));
-  }
-  return content;
+${body.trim()}
+
+${end}`;
+  const blocks = [current, legacy].filter((entry) => entry !== null).sort((a2, b2) => a2.start - b2.start);
+  if (blocks.length > 1 && blocks[0].finish > blocks[1].start)
+    throw new Error("Rules markers need repair: nested sentinel blocks.");
+  if (!blocks.length)
+    return { content: `${existing}${existing && !existing.endsWith(`
+`) ? `
+` : ""}${fresh}
+`, warnings: [] };
+  let content = existing;
+  for (let i = blocks.length - 1;i >= 0; i--) {
+    const block = blocks[i];
+    content = content.slice(0, block.start) + (i === 0 ? fresh : "") + content.slice(block.finish);
+  }
+  return { content, warnings: [] };
+}
+
+// src/lib/managed-rules.ts
+function otherRulesOwners(root, profile) {
+  const owners = [];
+  for (const candidate of [...Object.values(PROFILES), ...Object.values(LEGACY_PROFILES)]) {
+    if (candidate.manifestDir === profile.manifestDir || candidate.rulesFile !== profile.rulesFile)
+      continue;
+    const manifest = readManifest(join7(root, candidate.manifestDir));
+    if (!manifest)
+      continue;
+    if (manifest.managedRules || !manifest.lessons || Object.values(manifest.lessons).some((lesson) => lesson.representation?.courseRules !== false))
+      owners.push({ profile: candidate, rules: manifest.managedRules });
+  }
+  return owners;
+}
+function planManagedRules(root, profile, body, enabled, baseline) {
+  const path = join7(root, profile.rulesFile);
+  assertProjectFilePath(root, path);
+  const existing = existsSync7(path) ? readFileSync6(path, "utf8") : "";
+  const block = inspectRulesBlock(existing, profile.sentinelBegin, profile.sentinelEnd);
+  const legacy = inspectRulesBlock(existing, OLD_BEGIN, OLD_END);
+  if (block && legacy && Math.max(block.start, legacy.start) < Math.min(block.finish, legacy.finish))
+    throw new Error("Rules markers need repair: nested sentinel blocks.");
+  if (body === undefined && enabled)
+    return { action: "unchanged", content: existing, isConflict: false, next: baseline };
+  const validBaseline = baseline?.path === profile.rulesFile && baseline.begin === profile.sentinelBegin && baseline.end === profile.sentinelEnd ? baseline : undefined;
+  const owners = otherRulesOwners(root, profile);
+  const desired = enabled ? applyRulesBlockWithMarkers(existing, body ?? "", profile.sentinelBegin, profile.sentinelEnd).content : removeRulesBlockWithMarkers(removeRulesBlockWithMarkers(existing, profile.sentinelBegin, profile.sentinelEnd).content, OLD_BEGIN, OLD_END).content;
+  const desiredBlock = enabled ? inspectRulesBlock(desired, profile.sentinelBegin, profile.sentinelEnd) : null;
+  const next = desiredBlock ? { path: profile.rulesFile, begin: profile.sentinelBegin, end: profile.sentinelEnd, upstreamHash: contentHash(desiredBlock.text) } : undefined;
+  if (!enabled && owners.length)
+    return { action: "unchanged", content: existing, isConflict: false, reason: "still_owned" };
+  if (enabled && owners.some((owner) => !owner.rules?.upstreamHash || owner.rules.path !== profile.rulesFile || owner.rules.begin !== profile.sentinelBegin || owner.rules.end !== profile.sentinelEnd || owner.rules.upstreamHash !== next?.upstreamHash)) {
+    return { action: "conflict_skipped", content: existing, isConflict: true, blocked: true, reason: "incompatible_shared_owner", next: baseline };
+  }
+  const unknownOrEdited = !!legacy || !!block && (!validBaseline?.upstreamHash || contentHash(block.text) !== validBaseline.upstreamHash);
+  if (unknownOrEdited)
+    return { action: "conflict_skipped", content: desired, isConflict: true, reason: validBaseline?.upstreamHash ? "locally_modified" : "missing_baseline", next };
+  if (desired === existing)
+    return { action: "unchanged", content: existing, isConflict: false, next: enabled ? next ?? baseline : undefined };
+  return { action: !enabled ? "removed" : existing ? "updated" : "created", content: desired, isConflict: false, next };
 }
 
 // src/lib/writer.ts
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync6,
+  existsSync as existsSync8,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync5,
-  readdirSync,
-  rmdirSync,
-  rmSync as rmSync4,
-  writeFileSync as writeFileSync3
+  readFileSync as readFileSync7,
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname4, join as join8 } from "node:path";
 var CLI_VERSION = package_default.version;
 var DEFAULT_COURSE = "10xdevs3";
 async function applyBundle(bundle, projectRoot, options = {}) {
@@ -5590,221 +6235,208 @@ async function applyBundle(bundle, projectRoot, options = {}) {
   const partial = options.partial === true;
   const course = options.course ?? DEFAULT_COURSE;
   const profile = options.profile ?? PROFILES[DEFAULT_TOOL];
-  const onConflict = options.onConflict;
   const applyCourseRules = options.applyCourseRules !== false;
-  const manifestDir = join6(projectRoot, profile.manifestDir);
-  const prevManifest = readManifest(manifestDir);
-  const plan = planBundle(bundle, projectRoot, { profile, applyCourseRules });
-  const nextSkillHashes = {};
-  const nextPromptHashes = {};
-  const skills = [];
+  const plan = planBundle(bundle, projectRoot, { course, profile, applyCourseRules });
+  const manifestDir = join8(projectRoot, profile.manifestDir);
+  const previous = readManifest(manifestDir);
+  const ledger = previous ? structuredClone(previous) : {
+    package: CLI_PACKAGE_NAME,
+    version: CLI_VERSION,
+    manifestVersion: MANIFEST_VERSION,
+    lastApplied: new Date().toISOString(),
+    lessonId: bundle.lessonId,
+    course,
+    tool: profile.toolId,
+    files: { skills: {}, prompts: [], configs: [] },
+    lessons: {}
+  };
+  ledger.lessons = previous ? seedLessons(previous) : {};
+  ledger.manifestVersion = MANIFEST_VERSION;
+  ledger.course = course;
+  ledger.tool = profile.toolId;
+  const lesson = ledger.lessons[bundle.lessonId] ?? { appliedAt: new Date().toISOString(), skills: {}, prompts: [], configs: [] };
+  ledger.lessons[bundle.lessonId] = lesson;
+  const oldRepresentation = lesson.representation;
+  const oldDigest = oldRepresentation?.lang === (options.lang ?? "en") && oldRepresentation.tool === profile.toolId ? lesson.catalogContentHash : undefined;
+  delete lesson.representation;
+  delete lesson.catalogContentHash;
+  delete lesson.installedReleaseId;
+  delete lesson.installedManifestHash;
+  const invalidateOtherOwners = (kind, name, file) => {
+    for (const [id, owner] of Object.entries(ledger.lessons)) {
+      if (id === bundle.lessonId)
+        continue;
+      if (kind === "rules" || (kind === "skills" ? owner.skills[name]?.files.includes(file) : owner.prompts.includes(name))) {
+        const representation = owner.representation;
+        if (!partial && isEarlierLesson(id, bundle.lessonId) && representation?.lang === (options.lang ?? "en") && representation.tool === profile.toolId && representation.courseRules === applyCourseRules)
+          continue;
+        delete owner.representation;
+        delete owner.catalogContentHash;
+      }
+    }
+  };
+  const persist = () => {
+    if (!dryRun) {
+      rebuildManifestFiles(ledger);
+      writeManifest(manifestDir, ledger);
+    }
+  };
+  if (!dryRun) {
+    assertProjectCourse(projectRoot, course);
+    establishProjectCourse(projectRoot, course);
+  }
+  const result = { skills: [], prompts: [], configs: [], rules: { action: "unchanged" }, removals: { skills: [], prompts: [], configs: [] } };
+  const deliver = async (file, content, info) => {
+    let action = file.action;
+    let userBackupPath;
+    if (file.isConflict) {
+      const resolution = dryRun ? "skip" : await options.onConflict?.(info) ?? "skip";
+      if (resolution === "skip")
+        return { action: "conflict_skipped", delivered: false };
+      action = resolution === "save_user" ? "conflict_saved_user" : "conflict_overwritten";
+      if (resolution === "save_user") {
+        userBackupPath = buildUserBackupPath(file.path);
+        assertProjectFilePath(projectRoot, userBackupPath);
+        assertProjectFilePath(projectRoot, file.path);
+        copyFileSync(file.path, userBackupPath);
+      }
+    }
+    if (!dryRun && action !== "unchanged") {
+      assertProjectFilePath(projectRoot, file.path);
+      writeFileAt(file.path, content);
+    }
+    return { action, userBackupPath, delivered: true };
+  };
   for (let si = 0;si < bundle.skills.length; si++) {
     const skill = bundle.skills[si];
-    const planSkill = plan.skills[si];
-    const prevEntry = prevManifest?.files.skills[skill.name];
-    const fileWrites = [];
-    const skillHashes = {};
+    const writes = [];
+    result.skills.push({ name: skill.name, files: writes });
     for (let fi = 0;fi < skill.files.length; fi++) {
       const file = skill.files[fi];
-      const planFile = planSkill.files[fi];
-      const target = planFile.path;
-      const storedHash = prevEntry?.contentHashes?.[file.path];
-      const { action, isConflict } = planFile;
-      let finalAction = action;
-      let userBackupPath;
-      if (isConflict) {
-        const resolution = onConflict ? await onConflict({
-          artifactType: "skill",
-          artifactName: `${skill.name}/${file.path}`,
-          filePath: target,
-          relativePath: file.path
-        }) : "skip";
-        if (resolution === "overwrite") {
-          finalAction = "conflict_overwritten";
-          if (!dryRun)
-            writeFileAt(target, file.content);
-          skillHashes[file.path] = contentHash(file.content);
-        } else if (resolution === "save_user") {
-          finalAction = "conflict_saved_user";
-          if (!dryRun) {
-            userBackupPath = buildUserBackupPath(target);
-            copyFileSync(target, userBackupPath);
-            writeFileAt(target, file.content);
-          }
-          skillHashes[file.path] = contentHash(file.content);
-        } else {
-          finalAction = "conflict_skipped";
-          if (storedHash)
-            skillHashes[file.path] = storedHash;
-        }
-      } else {
-        if (!dryRun && action !== "unchanged") {
-          writeFileAt(target, file.content);
+      const planned = plan.skills[si].files[fi];
+      const outcome = await deliver(planned, file.content, { artifactType: "skill", artifactName: `${skill.name}/${file.path}`, filePath: planned.path, relativePath: file.path });
+      writes.push({ path: file.path, absolutePath: planned.path, action: outcome.action, userBackupPath: outcome.userBackupPath });
+      if (outcome.delivered) {
+        if (!dryRun && file.executable && outcome.action !== "unchanged") {
+          assertProjectFilePath(projectRoot, planned.path);
+          chmodSync2(planned.path, 493);
         }
-        if (!dryRun && file.executable === true && action !== "unchanged") {
-          chmodSync2(target, 493);
-        }
-        skillHashes[file.path] = contentHash(file.content);
+        const entry = lesson.skills[skill.name] ??= { files: [] };
+        if (!entry.files.includes(file.path))
+          entry.files.push(file.path);
+        const global2 = ledger.files.skills[skill.name] ??= { files: [] };
+        if (global2.contentHashes?.[file.path] !== contentHash(file.content))
+          invalidateOtherOwners("skills", skill.name, file.path);
+        (global2.contentHashes ??= {})[file.path] = contentHash(file.content);
+        persist();
       }
-      fileWrites.push({ path: file.path, absolutePath: target, action: finalAction, userBackupPath });
     }
-    nextSkillHashes[skill.name] = skillHashes;
-    skills.push({ name: skill.name, files: fileWrites });
   }
-  const prompts = [];
   for (let pi = 0;pi < bundle.prompts.length; pi++) {
     const prompt = bundle.prompts[pi];
-    const planPrompt = plan.prompts[pi];
-    const target = planPrompt.path;
-    const promptFilename = `${prompt.name}.md`;
-    const storedHash = prevManifest?.files.promptHashes?.[promptFilename];
-    const { action, isConflict } = planPrompt;
-    let finalAction = action;
-    let userBackupPath;
-    if (isConflict) {
-      const resolution = onConflict ? await onConflict({
-        artifactType: "prompt",
-        artifactName: prompt.name,
-        filePath: target,
-        relativePath: promptFilename
-      }) : "skip";
-      if (resolution === "overwrite") {
-        finalAction = "conflict_overwritten";
-        if (!dryRun)
-          writeFileAt(target, prompt.content);
-        nextPromptHashes[promptFilename] = contentHash(prompt.content);
-      } else if (resolution === "save_user") {
-        finalAction = "conflict_saved_user";
-        if (!dryRun) {
-          userBackupPath = buildUserBackupPath(target);
-          copyFileSync(target, userBackupPath);
-          writeFileAt(target, prompt.content);
-        }
-        nextPromptHashes[promptFilename] = contentHash(prompt.content);
-      } else {
-        finalAction = "conflict_skipped";
-        if (storedHash)
-          nextPromptHashes[promptFilename] = storedHash;
-      }
-    } else {
-      if (!dryRun && action !== "unchanged") {
-        writeFileAt(target, prompt.content);
+    const file = plan.prompts[pi];
+    const name = `${prompt.name}.md`;
+    const outcome = await deliver(file, prompt.content, { artifactType: "prompt", artifactName: prompt.name, filePath: file.path, relativePath: name });
+    result.prompts.push({ name: prompt.name, path: file.path, action: outcome.action, userBackupPath: outcome.userBackupPath });
+    if (outcome.delivered) {
+      if (!lesson.prompts.includes(name))
+        lesson.prompts.push(name);
+      if (ledger.files.promptHashes?.[name] !== contentHash(prompt.content))
+        invalidateOtherOwners("prompts", name);
+      (ledger.files.promptHashes ??= {})[name] = contentHash(prompt.content);
+      persist();
+    }
+  }
+  const rules = planManagedRules(projectRoot, profile, bundle.rules.length ? bundle.rules.map((r2) => r2.content.trim()).join(`
+
+`) : undefined, applyCourseRules, previous?.managedRules);
+  let rulesAction = rules.action;
+  let rulesDelivered = !rules.isConflict;
+  let rulesBackup;
+  if (rules.isConflict && !rules.blocked && !dryRun) {
+    const resolution = await options.onConflict?.({ artifactType: "rules", artifactName: "course-rules", filePath: join8(projectRoot, profile.rulesFile), relativePath: profile.rulesFile }) ?? "skip";
+    if (resolution !== "skip") {
+      rulesDelivered = true;
+      rulesAction = resolution === "save_user" ? "conflict_saved_user" : "conflict_overwritten";
+      if (resolution === "save_user") {
+        rulesBackup = buildUserBackupPath(join8(projectRoot, profile.rulesFile));
+        assertProjectFilePath(projectRoot, rulesBackup);
+        assertProjectFilePath(projectRoot, join8(projectRoot, profile.rulesFile));
+        copyFileSync(join8(projectRoot, profile.rulesFile), rulesBackup);
       }
-      nextPromptHashes[promptFilename] = contentHash(prompt.content);
     }
-    prompts.push({ name: prompt.name, path: target, action: finalAction, userBackupPath });
-  }
-  const rulesFilePath = join6(projectRoot, profile.rulesFile);
-  const existingRules = readFileOrEmpty(rulesFilePath);
-  const { action: rulesAction, content: newRulesContent } = planRules(existingRules, bundle, profile, applyCourseRules);
-  if (!dryRun && rulesAction !== "unchanged") {
-    writeFileAt(rulesFilePath, newRulesContent);
   }
-  const configs = bundle.configs.map((config, ci) => {
-    const planConfig = plan.configs[ci];
-    if (!dryRun && planConfig.action === "created") {
-      writeFileAt(planConfig.path, config.content);
-    }
-    return { name: config.name, path: planConfig.path, action: planConfig.action };
-  });
-  const removed = computeRemovals(prevManifest, bundle, profile, projectRoot);
-  const removalResult = {
-    skills: [],
-    prompts: [],
-    configs: []
-  };
-  for (const entry of removed.skillDirs) {
-    removalResult.skills.push({ name: entry.name, path: entry.path, action: "removed" });
-    if (!dryRun && !partial)
-      rmSync4(entry.path, { recursive: true, force: true });
-  }
-  for (const entry of removed.skillFiles) {
-    removalResult.skills.push({ name: entry.name, path: entry.path, action: "removed" });
-    if (!dryRun && !partial) {
-      rmSync4(entry.path, { force: true });
-      removeEmptyParentDirs(entry.path, entry.skillDirAbs);
-    }
-  }
-  for (const entry of removed.prompts) {
-    removalResult.prompts.push({ name: entry.name, path: entry.path, action: "removed" });
-    if (!dryRun && !partial)
-      rmSync4(entry.path, { force: true });
-  }
-  for (const entry of removed.configs) {
-    removalResult.configs.push({ name: entry.name, path: entry.path, action: "removed" });
-    if (!dryRun && !partial)
-      rmSync4(entry.path, { force: true });
-  }
-  if (!dryRun && !partial) {
-    const catalogContentHash = options.catalogContentHash ?? prevManifest?.lessons?.[bundle.lessonId]?.catalogContentHash;
-    const newLessonEntry = {
-      appliedAt: new Date().toISOString(),
-      skills: Object.fromEntries(bundle.skills.map((s) => [s.name, { files: s.files.map((f2) => f2.path) }])),
-      prompts: bundle.prompts.map((p2) => `${p2.name}.md`),
-      configs: bundle.configs.map((c2) => c2.name),
-      ...catalogContentHash !== undefined ? { catalogContentHash } : {}
-    };
-    let baseLessons = {};
-    if (prevManifest && !prevManifest.lessons) {
-      baseLessons[prevManifest.lessonId] = {
-        appliedAt: prevManifest.lastApplied,
-        skills: Object.fromEntries(Object.entries(prevManifest.files.skills).map(([name, entry]) => [
-          name,
-          { files: [...entry.files] }
-        ])),
-        prompts: [...prevManifest.files.prompts],
-        configs: [...prevManifest.files.configs]
-      };
-    } else if (prevManifest?.lessons) {
-      baseLessons = { ...prevManifest.lessons };
-    }
-    const lessons = {
-      ...baseLessons,
-      [bundle.lessonId]: newLessonEntry
-    };
-    const union = buildUnionFiles(lessons);
-    const unionSkills = {};
-    for (const [name, skill] of Object.entries(union.skills)) {
-      const prevHash = prevManifest?.files.skills[name]?.contentHashes;
-      const currentHash = nextSkillHashes[name];
-      unionSkills[name] = {
-        files: skill.files,
-        contentHashes: { ...prevHash, ...currentHash }
-      };
+  if (rulesDelivered) {
+    if (!dryRun && rulesAction !== "unchanged") {
+      assertProjectFilePath(projectRoot, join8(projectRoot, profile.rulesFile));
+      const path = join8(projectRoot, profile.rulesFile);
+      if (!existsSync8(path) || readFileSync7(path, "utf8") !== rules.content)
+        writeFileAt(path, rules.content);
+    }
+    if (ledger.managedRules?.upstreamHash !== rules.next?.upstreamHash)
+      invalidateOtherOwners("rules");
+    ledger.managedRules = rules.next;
+    persist();
+  }
+  result.rules = { action: rulesAction, reason: rules.reason, userBackupPath: rulesBackup };
+  for (let ci = 0;ci < bundle.configs.length; ci++) {
+    const config = bundle.configs[ci];
+    const planned = plan.configs[ci];
+    if (planned.action === "created") {
+      if (!dryRun) {
+        assertProjectFilePath(projectRoot, planned.path);
+        writeFileAt(planned.path, config.content);
+      }
+      if (!lesson.configs.includes(config.name))
+        lesson.configs.push(config.name);
+      (ledger.files.configHashes ??= {})[config.name] = contentHash(config.content);
+      persist();
+    }
+    if (planned.action === "skipped" && previous?.files.configs.includes(config.name) && !lesson.configs.includes(config.name)) {
+      lesson.configs.push(config.name);
+      persist();
+    }
+    result.configs.push({ name: config.name, path: planned.path, action: planned.action });
+  }
+  if (!partial) {
+    for (const kind of ["skills", "prompts", "configs"]) {
+      for (const candidate of plan.removals[kind]) {
+        const removed = dryRun ? candidate : executeManagedRemoval(projectRoot, candidate);
+        result.removals[kind].push({ name: removed.name, path: removed.path, action: removed.action, reason: removed.reason });
+        if (kind === "skills") {
+          const slash = candidate.name.indexOf("/");
+          const name = candidate.name.slice(0, slash);
+          const file = candidate.name.slice(slash + 1);
+          const entry = lesson.skills[name];
+          if (entry) {
+            entry.files = entry.files.filter((value) => value !== file);
+            if (!entry.files.length)
+              delete lesson.skills[name];
+          }
+        } else
+          lesson[kind] = lesson[kind].filter((value) => value !== candidate.name);
+        persist();
+      }
     }
-    const unionPromptHashes = {
-      ...prevManifest?.files.promptHashes,
-      ...nextPromptHashes
-    };
-    const nextManifest = {
-      package: CLI_PACKAGE_NAME,
-      version: CLI_VERSION,
-      manifestVersion: MANIFEST_VERSION,
-      lastApplied: new Date().toISOString(),
-      lessonId: bundle.lessonId,
-      course,
-      tool: profile.toolId,
-      files: {
-        skills: unionSkills,
-        prompts: union.prompts,
-        configs: union.configs,
-        promptHashes: unionPromptHashes
-      },
-      lessons
-    };
-    writeManifest(manifestDir, nextManifest);
   }
-  return {
-    skills,
-    prompts,
-    rules: { action: rulesAction },
-    configs,
-    removals: removalResult
-  };
+  ledger.lessonId = bundle.lessonId;
+  ledger.lastApplied = lesson.appliedAt = new Date().toISOString();
+  const conflicts = result.skills.some((s) => s.files.some((f2) => f2.action === "conflict_skipped")) || result.prompts.some((p2) => p2.action === "conflict_skipped") || rulesAction === "conflict_skipped";
+  if (!partial && !conflicts) {
+    lesson.catalogContentHash = options.catalogContentHash ?? oldDigest;
+    lesson.representation = { lang: options.lang ?? "en", tool: profile.toolId, courseRules: applyCourseRules, rules: applyCourseRules && bundle.rules.length > 0 };
+    lesson.installedReleaseId = bundle.releaseId;
+    lesson.installedManifestHash = bundle.releaseManifestHash;
+  }
+  persist();
+  return result;
 }
 function planBundle(bundle, projectRoot, options = {}) {
   const profile = options.profile ?? PROFILES[DEFAULT_TOOL];
   const applyCourseRules = options.applyCourseRules !== false;
+  validateBundlePayload(bundle);
+  if (options.course && bundle.course !== undefined && bundle.course !== options.course)
+    throw new Error("Bundle course differs from selected project course");
   for (const skill of bundle.skills) {
     assertSafeName(skill.name, "skill");
     for (const file of skill.files)
@@ -5814,13 +6446,15 @@ function planBundle(bundle, projectRoot, options = {}) {
     assertSafeName(prompt.name, "prompt");
   for (const config of bundle.configs)
     assertSafeName(config.name, "config");
-  const manifestDir = join6(projectRoot, profile.manifestDir);
+  const manifestDir = join8(projectRoot, profile.manifestDir);
+  assertProjectFilePath(projectRoot, join8(manifestDir, MANIFEST_FILENAME));
   const prevManifest = readManifest(manifestDir);
   const skills = bundle.skills.map((skill) => {
-    const skillDir = join6(projectRoot, profile.skillDir(skill.name));
+    const skillDir = join8(projectRoot, profile.skillDir(skill.name));
     const prevEntry = prevManifest?.files.skills[skill.name];
     const files = skill.files.map((file) => {
-      const target = join6(skillDir, file.path);
+      const target = join8(skillDir, file.path);
+      assertProjectFilePath(projectRoot, target);
       const storedHash = prevEntry?.contentHashes?.[file.path];
       const { action, isConflict } = computeFileAction(target, file.content, storedHash);
       return {
@@ -5834,7 +6468,8 @@ function planBundle(bundle, projectRoot, options = {}) {
     return { name: skill.name, files };
   });
   const prompts = bundle.prompts.map((prompt) => {
-    const target = join6(projectRoot, profile.promptPath(prompt.name));
+    const target = join8(projectRoot, profile.promptPath(prompt.name));
+    assertProjectFilePath(projectRoot, target);
     const storedHash = prevManifest?.files.promptHashes?.[`${prompt.name}.md`];
     const { action, isConflict } = computeFileAction(target, prompt.content, storedHash);
     return {
@@ -5845,12 +6480,14 @@ function planBundle(bundle, projectRoot, options = {}) {
       upstreamChanged: computeUpstreamChanged(prompt.content, storedHash, action)
     };
   });
-  const rulesFilePath = join6(projectRoot, profile.rulesFile);
-  const existingRules = readFileOrEmpty(rulesFilePath);
-  const { action: rulesAction } = planRules(existingRules, bundle, profile, applyCourseRules);
+  const rulesFilePath = join8(projectRoot, profile.rulesFile);
+  const rulesPlan = planManagedRules(projectRoot, profile, bundle.rules.length ? bundle.rules.map((r2) => r2.content.trim()).join(`
+
+`) : undefined, applyCourseRules, prevManifest?.managedRules);
   const configs = bundle.configs.map((config) => {
-    const target = join6(projectRoot, profile.configPath(config.name));
-    const action = existsSync6(target) ? "skipped" : "created";
+    const target = join8(projectRoot, profile.configPath(config.name));
+    assertProjectFilePath(projectRoot, target);
+    const action = existsSync8(target) ? "skipped" : "created";
     return {
       name: config.name,
       path: target,
@@ -5860,58 +6497,56 @@ function planBundle(bundle, projectRoot, options = {}) {
     };
   });
   const removed = computeRemovals(prevManifest, bundle, profile, projectRoot);
-  const removals = {
-    skills: [
-      ...removed.skillDirs.map((e2) => ({ name: e2.name, path: e2.path })),
-      ...removed.skillFiles.map((e2) => ({ name: e2.name, path: e2.path }))
-    ],
-    prompts: removed.prompts.map((e2) => ({ name: e2.name, path: e2.path })),
-    configs: removed.configs.map((e2) => ({ name: e2.name, path: e2.path }))
-  };
+  const targets = [
+    join8(manifestDir, MANIFEST_FILENAME),
+    join8(manifestDir, `${MANIFEST_FILENAME}.tmp`),
+    rulesFilePath,
+    buildUserBackupPath(rulesFilePath),
+    ...skills.flatMap((skill) => skill.files.flatMap((file) => [file.path, buildUserBackupPath(file.path)])),
+    ...prompts.flatMap((prompt) => [prompt.path, buildUserBackupPath(prompt.path)]),
+    ...configs.map((config) => config.path)
+  ];
+  for (const target of targets)
+    assertProjectFilePath(projectRoot, target);
+  const removals = removed;
   return {
     skills,
     prompts,
-    rules: { action: rulesAction, upstreamChanged: rulesAction !== "unchanged" },
+    rules: { action: rulesPlan.action, isConflict: rulesPlan.isConflict, reason: rulesPlan.reason, upstreamChanged: rulesPlan.action !== "unchanged" },
     configs,
     removals
   };
 }
+function isEarlierLesson(left, right) {
+  const a2 = /^m(\d+)l(\d+)$/.exec(left);
+  const b2 = /^m(\d+)l(\d+)$/.exec(right);
+  if (!a2 || !b2)
+    return false;
+  return Number(a2[1]) < Number(b2[1]) || Number(a2[1]) === Number(b2[1]) && Number(a2[2]) < Number(b2[2]);
+}
+function validateBundlePayload(bundle) {
+  if (!bundle || typeof bundle.lessonId !== "string" || !Array.isArray(bundle.skills) || !Array.isArray(bundle.prompts) || !Array.isArray(bundle.rules) || !Array.isArray(bundle.configs))
+    throw new Error("Invalid lesson bundle payload");
+  for (const skill of bundle.skills) {
+    if (!skill || typeof skill.name !== "string" || !Array.isArray(skill.files))
+      throw new Error("Invalid skill payload");
+    for (const file of skill.files)
+      if (!file || typeof file.path !== "string" || typeof file.content !== "string" || file.executable !== undefined && typeof file.executable !== "boolean")
+        throw new Error("Invalid skill file payload");
+  }
+  for (const artifact of [...bundle.prompts, ...bundle.rules, ...bundle.configs])
+    if (!artifact || typeof artifact.name !== "string" || typeof artifact.content !== "string")
+      throw new Error("Invalid artifact payload");
+}
 function computeUpstreamChanged(newContent, storedHash, action) {
   if (storedHash === undefined)
     return action !== "unchanged";
   return contentHash(newContent) !== storedHash;
 }
-function planRules(existingRules, bundle, profile, applyCourseRules) {
-  if (!applyCourseRules) {
-    const { content: stripped, removed } = removeRulesBlockWithMarkers(existingRules, profile.sentinelBegin, profile.sentinelEnd);
-    if (removed && stripped !== existingRules)
-      return { action: "removed", content: stripped };
-    return { action: "unchanged", content: existingRules };
-  }
-  if (bundle.rules.length === 0)
-    return { action: "unchanged", content: existingRules };
-  const rulesBody = bundle.rules.map((r2) => r2.content.trim()).join(`
-
-`);
-  const { content: newRules } = applyRulesBlockWithMarkers(existingRules, rulesBody, profile.sentinelBegin, profile.sentinelEnd);
-  let action;
-  if (newRules === existingRules)
-    action = "unchanged";
-  else if (existingRules.length === 0)
-    action = "created";
-  else
-    action = "updated";
-  return { action, content: newRules };
-}
 function computeFileAction(filePath, newContent, storedHash) {
-  if (!existsSync6(filePath))
+  if (!existsSync8(filePath))
     return { action: "created", isConflict: false };
-  let current;
-  try {
-    current = readFileSync5(filePath, "utf8");
-  } catch {
-    return { action: "updated", isConflict: false };
-  }
+  const current = readFileSync7(filePath, "utf8");
   if (current === newContent)
     return { action: "unchanged", isConflict: false };
   if (storedHash !== undefined) {
@@ -5924,152 +6559,62 @@ function computeFileAction(filePath, newContent, storedHash) {
 }
 function buildUserBackupPath(filePath) {
   const lastDot = filePath.lastIndexOf(".");
-  if (lastDot === -1)
-    return `${filePath}.user`;
-  return `${filePath.slice(0, lastDot)}.user${filePath.slice(lastDot)}`;
+  const stem = lastDot === -1 ? filePath : filePath.slice(0, lastDot);
+  const extension = lastDot === -1 ? "" : filePath.slice(lastDot);
+  let candidate = `${stem}.user${extension}`;
+  let suffix = 1;
+  while (existsSync8(candidate))
+    candidate = `${stem}.user.${suffix++}${extension}`;
+  return candidate;
 }
 function copyFileSync(src, dest) {
-  mkdirSync4(dirname3(dest), { recursive: true });
-  writeFileSync3(dest, readFileSync5(src));
-}
-function readFileOrEmpty(filePath) {
-  if (!existsSync6(filePath))
-    return "";
-  try {
-    return readFileSync5(filePath, "utf8");
-  } catch {
-    return "";
-  }
+  mkdirSync4(dirname4(dest), { recursive: true });
+  writeFileSync4(dest, readFileSync7(src));
 }
 function writeFileAt(filePath, content) {
-  mkdirSync4(dirname3(filePath), { recursive: true });
-  writeFileSync3(filePath, content);
-}
-function computeRemovals(prevManifest, bundle, profile, projectRoot) {
-  const empty = {
-    skillDirs: [],
-    skillFiles: [],
-    prompts: [],
-    configs: []
-  };
-  if (!prevManifest?.lessons)
-    return empty;
-  const prevLessonEntry = prevManifest.lessons[bundle.lessonId];
-  if (!prevLessonEntry)
-    return empty;
-  const protectedSkills = new Map;
-  const protectedPrompts = new Set;
-  const protectedConfigs = new Set;
-  for (const [lessonId, entry] of Object.entries(prevManifest.lessons)) {
-    if (lessonId === bundle.lessonId)
-      continue;
-    for (const [name, skill] of Object.entries(entry.skills)) {
-      if (!protectedSkills.has(name))
-        protectedSkills.set(name, new Set);
-      for (const f2 of skill.files)
-        protectedSkills.get(name).add(f2);
-    }
-    for (const p2 of entry.prompts)
-      protectedPrompts.add(p2);
-    for (const c2 of entry.configs)
-      protectedConfigs.add(c2);
-  }
-  const currentSkills = new Map(bundle.skills.map((s) => [s.name, new Set(s.files.map((f2) => f2.path))]));
-  const currentPrompts = new Set(bundle.prompts.map((p2) => `${p2.name}.md`));
-  const currentConfigs = new Set(bundle.configs.map((c2) => c2.name));
-  const removed = {
-    skillDirs: [],
-    skillFiles: [],
-    prompts: [],
-    configs: []
-  };
-  for (const [skillName, skill] of Object.entries(prevLessonEntry.skills)) {
-    if (!isSafeName(skillName))
-      continue;
-    const skillDirAbs = join6(projectRoot, profile.skillDir(skillName));
-    if (!currentSkills.has(skillName)) {
-      if (protectedSkills.has(skillName)) {
-        const prot = protectedSkills.get(skillName);
-        for (const relPath of skill.files) {
-          if (prot.has(relPath))
-            continue;
-          if (!isSafeSkillFilePath(relPath))
-            continue;
-          removed.skillFiles.push({
-            name: `${skillName}/${relPath}`,
-            path: join6(skillDirAbs, relPath),
-            skillDirAbs
-          });
-        }
-      } else {
-        removed.skillDirs.push({ name: skillName, path: skillDirAbs });
-      }
-      continue;
-    }
-    const currentFiles = currentSkills.get(skillName);
-    for (const relPath of skill.files) {
-      if (currentFiles.has(relPath))
-        continue;
-      if (protectedSkills.get(skillName)?.has(relPath))
-        continue;
-      if (!isSafeSkillFilePath(relPath))
+  mkdirSync4(dirname4(filePath), { recursive: true });
+  writeFileSync4(filePath, content);
+}
+function computeRemovals(previous, bundle, profile, root) {
+  const out = { skills: [], prompts: [], configs: [] };
+  if (!previous)
+    return out;
+  const lessons = seedLessons(previous);
+  const before = lessons[bundle.lessonId];
+  if (!before)
+    return out;
+  const others = Object.entries(lessons).filter(([id]) => id !== bundle.lessonId).map(([, entry]) => entry);
+  for (const [name, skill] of Object.entries(before.skills)) {
+    if (!isSafeName(name))
+      throw new Error("Unsafe skill name in manifest");
+    for (const file of skill.files) {
+      if (!isSafeSkillFilePath(file))
+        throw new Error("Unsafe skill path in manifest");
+      if (bundle.skills.some((entry) => entry.name === name && entry.files.some((entry2) => entry2.path === file)))
         continue;
-      removed.skillFiles.push({
-        name: `${skillName}/${relPath}`,
-        path: join6(skillDirAbs, relPath),
-        skillDirAbs
-      });
+      out.skills.push(planManagedRemoval(root, { name: `${name}/${file}`, path: join8(root, profile.skillDir(name), file), storedHash: previous.files.skills[name]?.contentHashes?.[file], protected: others.some((entry) => entry.skills[name]?.files.includes(file)), pruneRoot: join8(root, profile.skillDir(name)) }));
     }
   }
-  for (const promptFile of prevLessonEntry.prompts) {
-    if (currentPrompts.has(promptFile))
-      continue;
-    if (protectedPrompts.has(promptFile))
-      continue;
-    if (!isSafeName(promptFile))
-      continue;
-    const promptName = promptFile.replace(/\.md$/, "");
-    removed.prompts.push({
-      name: promptFile,
-      path: join6(projectRoot, profile.promptPath(promptName))
-    });
-  }
-  for (const configFile of prevLessonEntry.configs) {
-    if (currentConfigs.has(configFile))
-      continue;
-    if (protectedConfigs.has(configFile))
-      continue;
-    if (!isSafeName(configFile))
-      continue;
-    removed.configs.push({
-      name: configFile,
-      path: join6(projectRoot, profile.configPath(configFile))
-    });
-  }
-  return removed;
-}
-function removeEmptyParentDirs(filePath, skillDirAbs) {
-  let dir = dirname3(filePath);
-  while (dir.startsWith(skillDirAbs) && dir !== skillDirAbs) {
-    try {
-      if (readdirSync(dir).length > 0)
-        return;
-      rmdirSync(dir);
-    } catch {
-      return;
+  for (const kind of ["prompts", "configs"])
+    for (const name of before[kind]) {
+      if (!isSafeName(name))
+        throw new Error("Unsafe file name in manifest");
+      if ((kind === "prompts" ? bundle.prompts.map((p2) => `${p2.name}.md`) : bundle.configs.map((c2) => c2.name)).includes(name))
+        continue;
+      const path = join8(root, kind === "prompts" ? profile.promptPath(name.replace(/\.md$/, "")) : profile.configPath(name));
+      out[kind].push(planManagedRemoval(root, { name, path, storedHash: kind === "prompts" ? previous.files.promptHashes?.[name] : previous.files.configHashes?.[name], protected: others.some((entry) => entry[kind].includes(name)), config: kind === "configs" }));
     }
-    dir = dirname3(dir);
-  }
+  return out;
 }
 function findOrphanedManifests(projectRoot, currentProfile) {
   const out = [];
   for (const profile of [...Object.values(PROFILES), ...Object.values(LEGACY_PROFILES)]) {
     if (profile.toolId === currentProfile.toolId)
       continue;
-    const manifestPath = join6(projectRoot, profile.manifestDir, MANIFEST_FILENAME);
-    if (!existsSync6(manifestPath))
+    const manifestPath = join8(projectRoot, profile.manifestDir, MANIFEST_FILENAME);
+    if (!existsSync8(manifestPath))
       continue;
-    const manifest = readManifest(join6(projectRoot, profile.manifestDir));
+    const manifest = readManifest(join8(projectRoot, profile.manifestDir));
     if (!manifest)
       continue;
     out.push({ profile, manifestPath, manifest });
@@ -6134,231 +6679,315 @@ function isSafeName(name) {
 }
 
 // src/lib/tool-switch.ts
-function migrateArtifacts(projectRoot, orphan, newProfile) {
-  const summary = {
-    action: "migrated",
-    oldToolId: orphan.profile.toolId,
-    movedOrRemoved: { skills: [], prompts: [], configs: [] },
-    sentinelStripped: false,
-    skipped: []
-  };
-  const oldProfile = orphan.profile;
-  for (const [skillName, entry] of Object.entries(orphan.manifest.files.skills)) {
-    if (!isSafeName(skillName)) {
-      summary.skipped.push({ path: skillName, reason: "unsafe name in manifest" });
+function entries(manifest) {
+  return [
+    ...Object.entries(manifest.files.skills).flatMap(([name, entry]) => entry.files.map((file) => ({ kind: "skills", name, file, hash: entry.contentHashes?.[file] }))),
+    ...manifest.files.prompts.map((name) => ({ kind: "prompts", name, hash: manifest.files.promptHashes?.[name] })),
+    ...manifest.files.configs.map((name) => ({ kind: "configs", name, hash: manifest.files.configHashes?.[name] }))
+  ];
+}
+function entryPath(root, profile, entry) {
+  if (!isSafeName(entry.name) || entry.file !== undefined && !isSafeSkillFilePath(entry.file))
+    throw new Error("unsafe name or path in manifest");
+  return join9(root, entry.kind === "skills" ? join9(profile.skillDir(entry.name), entry.file) : entry.kind === "prompts" ? profile.promptPath(entry.name.replace(/\.md$/, "")) : profile.configPath(entry.name));
+}
+function owns(lesson, entry) {
+  return entry.kind === "skills" ? !!lesson.skills[entry.name]?.files.includes(entry.file) : lesson[entry.kind].includes(entry.name);
+}
+function retire(manifest, entry) {
+  for (const lesson of Object.values(manifest.lessons)) {
+    if (!owns(lesson, entry))
       continue;
-    }
-    const fromSkillDir = join7(projectRoot, oldProfile.skillDir(skillName));
-    const toSkillDir = join7(projectRoot, newProfile.skillDir(skillName));
-    let anyMoved = false;
-    for (const relPath of entry.files) {
-      if (!isSafeSkillFilePath(relPath)) {
-        summary.skipped.push({
-          path: `${skillName}/${relPath}`,
-          reason: "unsafe path in manifest"
-        });
-        continue;
-      }
-      const from = join7(fromSkillDir, relPath);
-      const to = join7(toSkillDir, relPath);
-      if (moveIfSafe(from, to, summary.skipped))
-        anyMoved = true;
-    }
-    tryRemoveEmptyDir(fromSkillDir);
-    if (anyMoved)
-      summary.movedOrRemoved.skills.push(skillName);
-  }
-  for (const promptFile of orphan.manifest.files.prompts) {
-    if (!isSafeName(promptFile)) {
-      summary.skipped.push({ path: promptFile, reason: "unsafe name in manifest" });
+    if (entry.kind === "skills") {
+      const skill = lesson.skills[entry.name];
+      skill.files = skill.files.filter((file) => file !== entry.file);
+      if (!skill.files.length)
+        delete lesson.skills[entry.name];
+    } else
+      lesson[entry.kind] = lesson[entry.kind].filter((name) => name !== entry.name);
+    delete lesson.representation;
+    delete lesson.catalogContentHash;
+  }
+  rebuildManifestFiles(manifest);
+}
+function acquire(destination, source, entry) {
+  for (const [id, prior] of Object.entries(source.lessons)) {
+    if (!owns(prior, entry))
       continue;
-    }
-    const promptName = promptFile.replace(/\.md$/, "");
-    const from = join7(projectRoot, oldProfile.promptPath(promptName));
-    const to = join7(projectRoot, newProfile.promptPath(promptName));
-    if (moveIfSafe(from, to, summary.skipped)) {
-      summary.movedOrRemoved.prompts.push(promptFile);
-    }
+    const lesson = destination.lessons[id] ??= { appliedAt: prior.appliedAt, skills: {}, prompts: [], configs: [] };
+    delete lesson.representation;
+    delete lesson.catalogContentHash;
+    if (entry.kind === "skills") {
+      const skill = lesson.skills[entry.name] ??= { files: [] };
+      if (!skill.files.includes(entry.file))
+        skill.files.push(entry.file);
+    } else if (!lesson[entry.kind].includes(entry.name))
+      lesson[entry.kind].push(entry.name);
+  }
+  if (entry.kind === "skills") {
+    const skill = destination.files.skills[entry.name] ??= { files: [] };
+    if (entry.hash)
+      (skill.contentHashes ??= {})[entry.file] = entry.hash;
+  } else if (entry.hash)
+    (entry.kind === "prompts" ? destination.files.promptHashes ??= {} : destination.files.configHashes ??= {})[entry.name] = entry.hash;
+  rebuildManifestFiles(destination);
+}
+function summaryFor(orphan, action) {
+  return { action, oldToolId: orphan.profile.toolId, movedOrRemoved: { skills: [], prompts: [], configs: [] }, sentinelStripped: false, skipped: [] };
+}
+function record(summary, entry) {
+  if (!summary.movedOrRemoved[entry.kind].includes(entry.name))
+    summary.movedOrRemoved[entry.kind].push(entry.name);
+}
+function persistSource(root, profile, source) {
+  rebuildManifestFiles(source);
+  const dir = join9(root, profile.manifestDir);
+  if (entries(source).length || source.managedRules) {
+    writeManifest(dir, source);
+    return;
   }
-  for (const configFile of orphan.manifest.files.configs) {
-    if (!isSafeName(configFile)) {
-      summary.skipped.push({ path: configFile, reason: "unsafe name in manifest" });
-      continue;
-    }
-    const from = join7(projectRoot, oldProfile.configPath(configFile));
-    const to = join7(projectRoot, newProfile.configPath(configFile));
-    if (moveIfSafe(from, to, summary.skipped)) {
-      summary.movedOrRemoved.configs.push(configFile);
+  const path = join9(dir, MANIFEST_FILENAME);
+  assertProjectFilePath(root, path);
+  rmSync6(path, { force: true });
+  pruneEmptyParents(root, path, dir);
+}
+function commitSourceRules(root, profile, source, update) {
+  const rulesPath = join9(root, profile.rulesFile);
+  const manifestPath = join9(root, profile.manifestDir, MANIFEST_FILENAME);
+  assertProjectFilePath(root, rulesPath);
+  assertProjectFilePath(root, manifestPath);
+  const rulesBefore = existsSync9(rulesPath) ? readFileSync8(rulesPath) : undefined;
+  const manifestBefore = existsSync9(manifestPath) ? readFileSync8(manifestPath) : undefined;
+  const metadataBefore = source.managedRules;
+  try {
+    update();
+    persistSource(root, profile, source);
+  } catch (error) {
+    source.managedRules = metadataBefore;
+    for (const [path, bytes] of [[rulesPath, rulesBefore], [manifestPath, manifestBefore]]) {
+      if (bytes === undefined)
+        continue;
+      assertProjectFilePath(root, path);
+      if (!existsSync9(path) || !readFileSync8(path).equals(bytes)) {
+        mkdirSync5(dirname5(path), { recursive: true });
+        writeFileSync5(path, bytes);
+      }
     }
+    throw error;
   }
-  summary.sentinelStripped = stripSentinelFromRulesFile(projectRoot, oldProfile);
-  rmSync5(orphan.manifestPath, { force: true });
-  tryRemoveEmptyDir(join7(projectRoot, oldProfile.manifestDir));
-  return summary;
 }
-function deleteArtifacts(projectRoot, orphan) {
-  const summary = {
-    action: "deleted",
-    oldToolId: orphan.profile.toolId,
-    movedOrRemoved: { skills: [], prompts: [], configs: [] },
-    sentinelStripped: false,
-    skipped: []
-  };
-  const oldProfile = orphan.profile;
-  for (const [skillName, entry] of Object.entries(orphan.manifest.files.skills)) {
-    if (!isSafeName(skillName)) {
-      summary.skipped.push({ path: skillName, reason: "unsafe name in manifest" });
+function copyForTransfer(root, from, to, bytes) {
+  assertProjectFilePath(root, to);
+  mkdirSync5(dirname5(to), { recursive: true });
+  const temporary = `${to}.${randomUUID3()}.tmp`;
+  assertProjectFilePath(root, temporary);
+  let owned = false;
+  try {
+    const fd = openSync(temporary, "wx");
+    owned = true;
+    closeSync(fd);
+    writeFileSync5(temporary, bytes);
+    chmodSync3(temporary, statSync(from).mode & 511);
+    renameSync3(temporary, to);
+  } finally {
+    if (owned) {
+      assertProjectFilePath(root, temporary);
+      rmSync6(temporary, { force: true });
+    }
+  }
+}
+function preflightProfilePaths(root, orphan, destination) {
+  assertProjectFilePath(root, orphan.manifestPath);
+  for (const profile of destination ? [orphan.profile, destination] : [orphan.profile]) {
+    assertProjectPath(root, join9(root, profile.manifestDir));
+    for (const file of [MANIFEST_FILENAME, `${MANIFEST_FILENAME}.tmp`])
+      assertProjectFilePath(root, join9(root, profile.manifestDir, file));
+    assertProjectFilePath(root, join9(root, profile.rulesFile));
+    for (const entry of entries(orphan.manifest)) {
+      const path = entryPath(root, profile, entry);
+      assertProjectFilePath(root, path);
+      assertProjectFilePath(root, `${path}.tmp`);
+    }
+    const rulesPath = join9(root, profile.rulesFile);
+    if (existsSync9(rulesPath))
+      inspectRulesBlock(readFileSync8(rulesPath, "utf8"), profile.sentinelBegin, profile.sentinelEnd);
+  }
+}
+function begin(root, orphan, destination) {
+  const course = normalizeProjectCourse(orphan.manifest.course);
+  if (!course)
+    throw new Error("Unsupported course in orphan manifest");
+  assertProjectCourse(root, course);
+  preflightProfilePaths(root, orphan, destination);
+  establishProjectCourse(root, course);
+  const source = structuredClone(orphan.manifest);
+  source.course = course;
+  source.lessons = seedLessons(source);
+  const rulesPath = join9(root, orphan.profile.rulesFile);
+  if (!source.managedRules && existsSync9(rulesPath) && inspectRulesBlock(readFileSync8(rulesPath, "utf8"), orphan.profile.sentinelBegin, orphan.profile.sentinelEnd)) {
+    source.managedRules = { path: orphan.profile.rulesFile, begin: orphan.profile.sentinelBegin, end: orphan.profile.sentinelEnd };
+  }
+  return source;
+}
+function migrateArtifacts(root, orphan, profile) {
+  const summary = summaryFor(orphan, "migrated");
+  if (!existsSync9(orphan.manifestPath))
+    return summary;
+  const source = begin(root, orphan, profile);
+  const destination = readManifest(join9(root, profile.manifestDir)) ?? { ...structuredClone(source), tool: profile.toolId, files: { skills: {}, prompts: [], configs: [] }, lessons: {}, managedRules: undefined };
+  destination.lessons = seedLessons(destination);
+  destination.course = source.course;
+  destination.tool = profile.toolId;
+  for (const entry of entries(source)) {
+    const from = entryPath(root, orphan.profile, entry);
+    const to = entryPath(root, profile, entry);
+    if (!existsSync9(from)) {
+      retire(source, entry);
+      persistSource(root, orphan.profile, source);
       continue;
     }
-    const skillDir = join7(projectRoot, oldProfile.skillDir(skillName));
-    for (const relPath of entry.files) {
-      if (!isSafeSkillFilePath(relPath)) {
-        summary.skipped.push({
-          path: `${skillName}/${relPath}`,
-          reason: "unsafe path in manifest"
-        });
-        continue;
-      }
-      rmSync5(join7(skillDir, relPath), { force: true });
-    }
-    rmSync5(skillDir, { recursive: true, force: true });
-    summary.movedOrRemoved.skills.push(skillName);
-  }
-  for (const promptFile of orphan.manifest.files.prompts) {
-    if (!isSafeName(promptFile)) {
-      summary.skipped.push({ path: promptFile, reason: "unsafe name in manifest" });
+    const bytes = readFileSync8(from);
+    if (existsSync9(to) && !readFileSync8(to).equals(bytes)) {
+      summary.skipped.push({ path: to, reason: "destination already exists with different content" });
       continue;
     }
-    const promptName = promptFile.replace(/\.md$/, "");
-    rmSync5(join7(projectRoot, oldProfile.promptPath(promptName)), { force: true });
-    summary.movedOrRemoved.prompts.push(promptFile);
-  }
-  for (const configFile of orphan.manifest.files.configs) {
-    if (!isSafeName(configFile)) {
-      summary.skipped.push({ path: configFile, reason: "unsafe name in manifest" });
+    if (!existsSync9(to))
+      copyForTransfer(root, from, to, bytes);
+    acquire(destination, source, entry);
+    writeManifest(join9(root, profile.manifestDir), destination);
+    record(summary, entry);
+    try {
+      assertProjectFilePath(root, from);
+      if (!readFileSync8(from).equals(bytes))
+        throw new Error("source changed during transfer");
+      rmSync6(from);
+    } catch (error) {
+      summary.skipped.push({ path: from, reason: `copied to destination but could not remove source: ${error instanceof Error ? error.message : String(error)}` });
+      persistSource(root, orphan.profile, source);
       continue;
     }
-    rmSync5(join7(projectRoot, oldProfile.configPath(configFile)), { force: true });
-    summary.movedOrRemoved.configs.push(configFile);
+    retire(source, entry);
+    try {
+      persistSource(root, orphan.profile, source);
+    } catch (error) {
+      assertProjectFilePath(root, from);
+      if (!existsSync9(from)) {
+        mkdirSync5(dirname5(from), { recursive: true });
+        writeFileSync5(from, bytes);
+      }
+      throw error;
+    }
+    pruneEmptyParents(root, from, join9(root, orphan.profile.manifestDir));
   }
-  summary.sentinelStripped = stripSentinelFromRulesFile(projectRoot, oldProfile);
-  rmSync5(orphan.manifestPath, { force: true });
-  const manifestDirAbs = join7(projectRoot, oldProfile.manifestDir);
-  tryRemoveEmptyDir(join7(manifestDirAbs, "skills"));
-  tryRemoveEmptyDir(join7(manifestDirAbs, "prompts"));
-  tryRemoveEmptyDir(join7(manifestDirAbs, "config-templates"));
-  tryRemoveEmptyDir(manifestDirAbs);
+  commitSourceRules(root, orphan.profile, source, () => {
+    transferRules(root, orphan.profile, profile, source, destination, summary);
+  });
   return summary;
 }
-function moveIfSafe(from, to, skipped) {
-  if (!existsSync7(from)) {
-    return false;
+function transferRules(root, old, profile, source, destination, summary) {
+  const metadata = source.managedRules;
+  if (!metadata)
+    return;
+  const from = join9(root, old.rulesFile);
+  if (!existsSync9(from)) {
+    delete source.managedRules;
+    return;
   }
-  if (lstatSync(from).isSymbolicLink()) {
-    skipped.push({ path: from, reason: "source is a symlink" });
-    return false;
+  const existing = readFileSync8(from, "utf8");
+  const block = inspectRulesBlock(existing, old.sentinelBegin, old.sentinelEnd);
+  if (!block) {
+    delete source.managedRules;
+    return;
   }
-  if (existsSync7(to)) {
-    if (!filesAreIdentical(from, to)) {
-      skipped.push({
-        path: to,
-        reason: "destination already exists with different content"
-      });
-      return false;
-    }
-    rmSync5(from, { force: true });
-    return true;
+  if (metadata.path !== old.rulesFile || metadata.begin !== old.sentinelBegin || metadata.end !== old.sentinelEnd || !metadata.upstreamHash || contentHash(block.text) !== metadata.upstreamHash) {
+    summary.skipped.push({ path: from, reason: "managed rules require explicit resolution: missing baseline or local edits" });
+    return;
   }
-  mkdirSync5(dirname4(to), { recursive: true });
-  try {
-    renameSync3(from, to);
-  } catch (err) {
-    const code = err?.code;
-    if (code !== "EXDEV")
-      throw err;
-    const bytes = readFileSync6(from);
-    const tmp = `${to}.tmp`;
-    writeFileSync4(tmp, bytes);
-    renameSync3(tmp, to);
-    try {
-      rmSync5(from, { force: true });
-    } catch {
-      skipped.push({
-        path: from,
-        reason: "copied to destination but could not remove source"
-      });
-      return true;
+  if (old.rulesFile === profile.rulesFile) {
+    if (destination.managedRules && destination.managedRules.upstreamHash !== metadata.upstreamHash) {
+      summary.skipped.push({ path: from, reason: "incompatible shared rules ownership" });
+      return;
     }
+    destination.managedRules = { ...metadata };
+    writeManifest(join9(root, profile.manifestDir), destination);
+    if (!entries(source).length)
+      delete source.managedRules;
+    return;
   }
-  return true;
-}
-function stripSentinelFromRulesFile(projectRoot, oldProfile) {
-  const rulesPath = join7(projectRoot, oldProfile.rulesFile);
-  if (!existsSync7(rulesPath))
-    return false;
-  const existing = readFileOrNull(rulesPath);
-  if (existing === null)
-    return false;
-  const { content, removed } = removeRulesBlockWithMarkers(existing, oldProfile.sentinelBegin, oldProfile.sentinelEnd);
-  if (!removed)
-    return false;
-  if (content.trim().length === 0) {
-    rmSync5(rulesPath, { force: true });
-  } else {
-    writeFileSync4(rulesPath, content);
+  const plan = planManagedRules(root, profile, block.body, true, destination.managedRules);
+  if (plan.isConflict) {
+    summary.skipped.push({ path: join9(root, profile.rulesFile), reason: plan.reason ?? "rules conflict" });
+    return;
   }
-  return true;
-}
-function filesAreIdentical(a2, b2) {
-  try {
-    const aStat = statSync(a2);
-    const bStat = statSync(b2);
-    if (aStat.size !== bStat.size)
-      return false;
-    return readFileSync6(a2).equals(readFileSync6(b2));
-  } catch {
-    return false;
+  const to = join9(root, profile.rulesFile);
+  if (plan.action !== "unchanged") {
+    assertProjectFilePath(root, to);
+    mkdirSync5(dirname5(to), { recursive: true });
+    writeFileSync5(to, plan.content);
   }
-}
-function tryRemoveEmptyDir(dir) {
-  if (!existsSync7(dir))
+  destination.managedRules = plan.next;
+  writeManifest(join9(root, profile.manifestDir), destination);
+  if (entries(source).length)
     return;
-  try {
-    rmdirSync2(dir);
-  } catch {}
+  if (!otherRulesOwners(root, old).length) {
+    const stripped = removeRulesBlockWithMarkers(existing, old.sentinelBegin, old.sentinelEnd);
+    assertProjectFilePath(root, from);
+    writeFileSync5(from, stripped.content);
+    summary.sentinelStripped = stripped.removed;
+  }
+  delete source.managedRules;
+}
+function deleteArtifacts(root, orphan) {
+  const summary = summaryFor(orphan, "deleted");
+  if (!existsSync9(orphan.manifestPath))
+    return summary;
+  const source = begin(root, orphan);
+  for (const entry of entries(source)) {
+    const path = entryPath(root, orphan.profile, entry);
+    const plan = planManagedRemoval(root, { name: entry.name, path, storedHash: entry.hash, config: entry.kind === "configs", pruneRoot: join9(root, orphan.profile.manifestDir) });
+    const result = executeManagedRemoval(root, plan);
+    if (result.action === "removed")
+      record(summary, entry);
+    else if (result.action === "preserved_local")
+      summary.skipped.push({ path, reason: `preserved_local: ${result.reason}` });
+    retire(source, entry);
+    persistSource(root, orphan.profile, source);
+  }
+  commitSourceRules(root, orphan.profile, source, () => {
+    if (source.managedRules) {
+      const path = join9(root, orphan.profile.rulesFile);
+      const plan = planManagedRules(root, orphan.profile, undefined, false, source.managedRules);
+      if (plan.isConflict)
+        summary.skipped.push({ path, reason: "managed rules require explicit resolution: missing baseline or local edits" });
+      else {
+        if (plan.action === "removed") {
+          assertProjectFilePath(root, path);
+          writeFileSync5(path, plan.content);
+          summary.sentinelStripped = true;
+        }
+        delete source.managedRules;
+      }
+    }
+  });
+  return summary;
 }
 
 // src/lib/tool-prompt.ts
 async function resolveToolProfile(flagOverride, projectRoot = process.cwd()) {
-  const profile = await resolveProfileOnly(flagOverride, projectRoot);
-  await handleToolSwitch(projectRoot, profile);
-  return profile;
+  return resolveProfileOnly(flagOverride, projectRoot);
 }
 async function resolveProfileOnly(flagOverride, projectRoot) {
   if (flagOverride) {
-    const canonicalId = canonicalToolId(flagOverride);
     const profile = getToolProfile(flagOverride);
     if (!profile) {
       throw new Error(`Unknown tool '${flagOverride}'. Supported: ${Object.keys(PROFILES).join(", ")}`);
     }
-    const existing = readToolConfig();
-    if (existing?.tool !== canonicalId) {
-      saveToolConfig({ ...existing ?? {}, tool: canonicalId });
-      if (process.stdout.isTTY) {
-        process.stderr.write(`Default tool set to ${profile.displayName}.
-`);
-      }
-    }
     return profile;
   }
   const config = readToolConfig();
   if (config?.tool) {
     const profile = getToolProfile(config.tool);
     if (profile) {
-      const canonicalId = canonicalToolId(config.tool);
-      if (canonicalId !== config.tool) {
-        saveToolConfig({ ...config, tool: canonicalId });
-      }
       return profile;
     }
   }
@@ -6383,11 +7012,25 @@ async function resolveProfileOnly(flagOverride, projectRoot) {
       ve("Using default (Claude Code).");
       return PROFILES[DEFAULT_TOOL];
     }
-    saveToolConfig({ ...config ?? {}, tool: choice });
     return PROFILES[choice];
   }
   return PROFILES[DEFAULT_TOOL];
 }
+async function prepareToolForWrite(projectRoot, profile, course, patch = {}, interactive = true) {
+  assertProjectCourse(projectRoot, course);
+  if (interactive && process.stdout.isTTY) {
+    for (const orphan of findOrphanedManifests(projectRoot, profile))
+      preflightProfilePaths(projectRoot, orphan, profile);
+  }
+  establishProjectCourse(projectRoot, course);
+  if (interactive)
+    await handleToolSwitch(projectRoot, profile);
+  const previous = readToolConfig();
+  updateToolConfig({ ...patch, tool: profile.toolId });
+  if (previous?.tool !== profile.toolId && process.stdout.isTTY)
+    process.stderr.write(`Default tool set to ${profile.displayName}.
+`);
+}
 async function handleToolSwitch(projectRoot, newProfile) {
   if (!process.stdout.isTTY)
     return;
@@ -6473,9 +7116,8 @@ function resolveCourseRulesFlag(argv) {
     return true;
   return;
 }
-var DEFAULT_COURSE2 = "10xdevs3";
 function registerGetCommand(cli) {
-  cli.command("get <ref>", "Fetch and apply a lesson pack").option("--dry-run", "Show what would be written without touching the filesystem").option("--course <course>", "Override the course slug (default: 10xdevs3)").option("--tool <tool>", "AI coding tool (claude-code, cursor, copilot, codex, devin-desktop, gemini, generic)").option("--print", "Print artifact content to stdout instead of writing to files").option("--type <type>", "Artifact type filter: skills, prompts, rules, configs").option("--name <name>", "Artifact name filter (requires --type)").option("--lang <lang>", "Content language: en (default) or pl").option("--no-course-rules", "Skip applying the course rules block to your rules file (CLAUDE.md/AGENTS.md)").action(async (ref, options) => {
+  cli.command("get <ref>", "Fetch and apply a lesson pack").option("--dry-run", "Show what would be written without touching the filesystem").option("--course <course>", "Select course ID or slug (default: project edition or API recommendation)").option("--tool <tool>", "AI coding tool (claude-code, cursor, copilot, codex, devin-desktop, gemini, generic)").option("--print", "Print artifact content to stdout instead of writing to files").option("--type <type>", "Artifact type filter: skills, prompts, rules, configs").option("--name <name>", "Artifact name filter (requires --type)").option("--lang <lang>", "Content language: en (default) or pl").option("--no-course-rules", "Skip applying the course rules block to your rules file (CLAUDE.md/AGENTS.md)").action(async (ref, options) => {
     const ctx = resolveContext(options);
     await runGet(ctx, ref, options);
   });
@@ -6495,29 +7137,28 @@ async function runGet(ctx, ref, options) {
   if (options.lang && !SUPPORTED_LANGS.includes(options.lang)) {
     outputError(ctx, "invalid_lang", `Unknown language '${options.lang}'.`, ExitCodes.USAGE, `Supported languages: ${SUPPORTED_LANGS.join(", ")}`);
   }
-  const auth = await requireAuth(ctx);
-  const course = options.course ?? DEFAULT_COURSE2;
+  const selection = await resolveCourseSelection(ctx, { explicit: options.course, writing: !options.dryRun && !options.print });
+  const { auth, course } = selection;
+  let release;
+  if (course === "10xdevs4" || course === "10xdevs-4") {
+    const catalog = await fetchCatalog(course, auth.access_token);
+    if (!catalog.ok)
+      handleLessonError(ctx, catalog.status, catalog.code, catalog.error, catalog.payload);
+    release = catalogRelease(catalog.data);
+  }
   const profile = await resolveToolProfile(options.tool, process.cwd());
   const dryRun = options.dryRun === true;
   const lang = options.lang ?? readToolConfig()?.lang ?? "en";
   const explicitCourseRules = resolveCourseRulesFlag(process.argv);
   const resolvedCourseRules = explicitCourseRules ?? readToolConfig()?.courseRules ?? true;
-  if (!dryRun && (options.lang || explicitCourseRules !== undefined)) {
-    const tool = readToolConfig()?.tool ?? profile.toolId;
-    const patch = { tool };
-    if (options.lang)
-      patch.lang = options.lang;
-    if (explicitCourseRules !== undefined)
-      patch.courseRules = explicitCourseRules;
-    updateToolConfig(patch);
-  }
   if (options.print) {
-    await runPrintMode(ctx, parsed.lessonId, course, profile, auth.access_token, lang, options);
+    await runPrintMode(ctx, parsed.lessonId, course, profile, auth.access_token, lang, options, selection.reason, release);
     return;
   }
   verbose(ctx, `fetching lesson ${course}/${parsed.lessonId}`);
   const result = await fetchLesson(course, parsed.lessonId, auth.access_token, {
     lang,
+    ...release ? { release } : {},
     tool: contentToolId(profile)
   });
   if (!result.ok) {
@@ -6536,19 +7177,34 @@ async function runGet(ctx, ref, options) {
   const isFiltered = options.type !== undefined;
   const bundle = filterBundle(ctx, result.data, options);
   const isTTY = process.stdout.isTTY === true;
-  const prevManifest = readManifest(join8(process.cwd(), profile.manifestDir));
+  const prevManifest = readManifest(join10(process.cwd(), profile.manifestDir));
   if (prevManifest && prevManifest.manifestVersion === 2) {
     showUpgradeNotice(isTTY);
   }
   const applyCourseRules = isFiltered ? true : resolvedCourseRules;
-  const writeResult = await applyBundle(bundle, process.cwd(), {
-    dryRun,
-    profile,
-    partial: isFiltered,
-    onConflict: createConflictResolver(isTTY),
-    applyCourseRules
-  });
+  let writeResult;
+  try {
+    planBundle(bundle, process.cwd(), { course, profile, applyCourseRules });
+    if (!dryRun)
+      await prepareToolForWrite(process.cwd(), profile, course, {
+        ...options.lang ? { lang: options.lang } : {},
+        ...explicitCourseRules !== undefined ? { courseRules: explicitCourseRules } : {}
+      });
+    writeResult = await applyBundle(bundle, process.cwd(), {
+      course,
+      dryRun,
+      profile,
+      partial: isFiltered,
+      lang: contentLang ?? lang,
+      onConflict: createConflictResolver(isTTY && !dryRun),
+      applyCourseRules
+    });
+  } catch (error) {
+    reportCourseError(ctx, error);
+  }
   renderGetResult(ctx, bundle, writeResult, dryRun, profile, {
+    course,
+    selectionReason: selection.reason,
     language: contentLang ?? lang,
     languageFallback: isFallback,
     applyCourseRules
@@ -6581,7 +7237,10 @@ function filterBundle(ctx, bundle, options) {
   }
   return { ...empty, [type]: bundle[type] };
 }
-async function runPrintMode(ctx, lessonId, course, profile, token, lang, options) {
+async function runPrintMode(ctx, lessonId, course, profile, token, lang, options, selectionReason, release) {
+  if (!ctx.json)
+    process.stderr.write(`Course: ${course} (${selectionReason})
+`);
   if (!options.type) {
     outputError(ctx, "missing_type", "Specify --type for --print mode.", ExitCodes.USAGE, "Usage: 10x get m1l1 --print --type skills [--name code-review]");
   }
@@ -6590,12 +7249,12 @@ async function runPrintMode(ctx, lessonId, course, profile, token, lang, options
   }
   if (options.name) {
     verbose(ctx, `fetching artifact ${course}/${lessonId}/${options.type}/${options.name}`);
-    const result = await fetchArtifact(course, lessonId, options.type, options.name, contentToolId(profile), token, { lang });
+    const result = await fetchArtifact(course, lessonId, options.type, options.name, contentToolId(profile), token, { lang, ...release ? { release } : {} });
     if (!result.ok) {
       handleLessonError(ctx, result.status, result.code, result.error, result.payload);
     }
     if (ctx.json) {
-      output(ctx, "", result.data);
+      output(ctx, "", { ...result.data, course, selectionReason });
     } else {
       const data = result.data;
       if (data.type === "skills") {
@@ -6608,7 +7267,7 @@ async function runPrintMode(ctx, lessonId, course, profile, token, lang, options
     }
   } else {
     verbose(ctx, `fetching lesson ${course}/${lessonId} (filtering by ${options.type})`);
-    const result = await fetchLesson(course, lessonId, token, { lang, tool: contentToolId(profile) });
+    const result = await fetchLesson(course, lessonId, token, { lang, tool: contentToolId(profile), ...release ? { release } : {} });
     if (!result.ok) {
       handleLessonError(ctx, result.status, result.code, result.error, result.payload);
     }
@@ -6616,7 +7275,7 @@ async function runPrintMode(ctx, lessonId, course, profile, token, lang, options
     if (type === "skills") {
       const skills = result.data.skills;
       if (ctx.json) {
-        output(ctx, "", skills);
+        output(ctx, "", { course, selectionReason, artifacts: skills });
       } else {
         const contents = skills.map((s) => s.files.find((f2) => f2.path === "SKILL.md")?.content ?? "");
         process.stdout.write(contents.join(`
@@ -6628,7 +7287,7 @@ async function runPrintMode(ctx, lessonId, course, profile, token, lang, options
     } else {
       const artifacts = result.data[type];
       if (ctx.json) {
-        output(ctx, "", artifacts);
+        output(ctx, "", { course, selectionReason, artifacts });
       } else {
         const contents = artifacts.map((a2) => a2.content);
         process.stdout.write(contents.join(`
@@ -6648,7 +7307,9 @@ function emitMultiFileSkillNotice(skillName, files) {
 }
 function handleLessonError(ctx, status, code, error, payload) {
   verbose(ctx, `lesson fetch failed: status=${status} code=${code}`);
-  if (status === 403) {
+  if (code === "course_access_denied" || code === "course_unavailable")
+    outputError(ctx, code, error, code === "course_access_denied" ? ExitCodes.FORBIDDEN : ExitCodes.ERROR);
+  if (status === 403 && code === "module_locked") {
     const moduleNum = payload?.["module"];
     const releaseAt = payload?.["releaseAt"];
     const hasModule = typeof moduleNum === "number";
@@ -6671,7 +7332,7 @@ function handleLessonError(ctx, status, code, error, payload) {
   if (status === 401) {
     outputError(ctx, "auth_required", "Your session is no longer valid.", ExitCodes.AUTH_REQUIRED, "Run '10x auth' to log in again.");
   }
-  if (code === "signature_error" || code === "signature_missing" || code === "signature_internal_error") {
+  if (code === "release_mismatch" || code === "signature_error" || code === "signature_missing" || code === "signature_internal_error") {
     outputError(ctx, code, error, ExitCodes.ERROR);
   }
   if (status === 0) {
@@ -6692,14 +7353,18 @@ function formatAction(action) {
   }
 }
 function renderGetResult(ctx, bundle, writeResult, dryRun, profile, langMeta = {
+  course: "10xdevs3",
+  selectionReason: "backend_recommendation",
   language: "en",
   languageFallback: false,
   applyCourseRules: true
 }) {
   const applyCourseRules = langMeta.applyCourseRules;
-  const totalRemovals = writeResult.removals.skills.length + writeResult.removals.prompts.length + writeResult.removals.configs.length;
+  const totalRemovals = [...writeResult.removals.skills, ...writeResult.removals.prompts, ...writeResult.removals.configs].filter((entry) => entry.action === "removed").length;
   if (ctx.json) {
     output(ctx, "", {
+      course: langMeta.course,
+      selectionReason: langMeta.selectionReason,
       lessonId: bundle.lessonId,
       title: bundle.title,
       summary: bundle.summary,
@@ -6726,6 +7391,7 @@ function renderGetResult(ctx, bundle, writeResult, dryRun, profile, langMeta = {
   }
   const targetDir = profile.manifestDir;
   const lines = [];
+  lines.push(`Course: ${langMeta.course} (${langMeta.selectionReason})`);
   lines.push(`${bundle.lessonId} — ${bundle.title}`);
   if (bundle.summary)
     lines.push(bundle.summary);
@@ -6746,7 +7412,9 @@ function renderGetResult(ctx, bundle, writeResult, dryRun, profile, langMeta = {
     lines.push(`  [${formatAction(prompt.action)}] prompt ${prompt.path}`);
   }
   if (!applyCourseRules) {
-    if (writeResult.rules.action === "removed") {
+    if (writeResult.rules.action === "conflict_skipped") {
+      lines.push(`  [conflict: skipped] rules ${profile.rulesFile} (${writeResult.rules.reason ?? "explicit resolution required"})`);
+    } else if (writeResult.rules.action === "removed") {
       lines.push(`  [removed] rules  ${profile.rulesFile}`);
     } else {
       verbose(ctx, `course rules disabled — ${profile.rulesFile} left untouched`);
@@ -6758,56 +7426,66 @@ function renderGetResult(ctx, bundle, writeResult, dryRun, profile, langMeta = {
     lines.push(`  [${config.action}] config ${config.path}`);
   }
   for (const entry of writeResult.removals.skills) {
-    lines.push(`  [removed] skill  ${entry.path}`);
+    lines.push(`  [${entry.action}] skill  ${entry.path}${entry.reason ? ` (${entry.reason})` : ""}`);
   }
   for (const entry of writeResult.removals.prompts) {
-    lines.push(`  [removed] prompt ${entry.path}`);
+    lines.push(`  [${entry.action}] prompt ${entry.path}${entry.reason ? ` (${entry.reason})` : ""}`);
   }
   for (const entry of writeResult.removals.configs) {
-    lines.push(`  [removed] config ${entry.path}`);
+    lines.push(`  [${entry.action}] config ${entry.path}${entry.reason ? ` (${entry.reason})` : ""}`);
   }
   output(ctx, lines.join(`
 `), undefined);
 }
 
 // src/commands/list.ts
-var DEFAULT_COURSE3 = "10xdevs3";
 function registerListCommand(cli) {
-  cli.command("list [module]", "Browse available modules and lessons").option("--course <course>", "Override the course slug (default: 10xdevs3)").action(async (moduleArg, options) => {
+  cli.command("list [module]", "Browse available modules and lessons").option("--course <course>", "Select course ID or slug (default: project edition or API recommendation)").action(async (moduleArg, options) => {
     const ctx = resolveContext(options);
     await runList(ctx, moduleArg, options);
   });
 }
 async function runList(ctx, moduleArg, options) {
-  const auth = await requireAuth(ctx);
-  const course = options.course ?? DEFAULT_COURSE3;
+  const selection = await resolveCourseSelection(ctx, { explicit: options.course });
+  const { auth, course } = selection;
   if (moduleArg === undefined) {
-    await listAllModules(ctx, course, auth.access_token);
+    await listAllModules(ctx, course, auth.access_token, selection.reason);
     return;
   }
   const module = parseModuleRef(moduleArg);
   if (module === null) {
     outputError(ctx, "invalid_module", `'${moduleArg}' is not a valid module reference.`, ExitCodes.USAGE, `Pass a module between ${MIN_MODULE} and ${MAX_MODULE}, for example '10x list 1' or '10x list m1'.`);
   }
-  await listModuleDetail(ctx, course, module, auth.access_token);
+  await listModuleDetail(ctx, course, module, auth.access_token, selection.reason);
 }
-async function listAllModules(ctx, course, token) {
+async function listAllModules(ctx, course, token, reason) {
   verbose(ctx, `fetching catalog for ${course}`);
   const result = await fetchCatalog(course, token);
   if (!result.ok) {
     handleListError(ctx, result.status, result.code, result.error);
   }
-  renderCatalog(ctx, result.data);
+  renderCatalog(ctx, result.data, reason);
 }
-async function listModuleDetail(ctx, course, module, token) {
+async function listModuleDetail(ctx, course, module, token, reason) {
   verbose(ctx, `fetching module detail ${course}/${module}`);
-  const result = await fetchModuleDetail(course, module, token);
+  let release;
+  if (course === "10xdevs4" || course === "10xdevs-4") {
+    const catalog = await fetchCatalog(course, token);
+    if (!catalog.ok)
+      handleListError(ctx, catalog.status, catalog.code, catalog.error);
+    release = catalogRelease(catalog.data);
+  }
+  const result = await fetchModuleDetail(course, module, token, release ? { release } : {});
   if (!result.ok) {
     handleListError(ctx, result.status, result.code, result.error);
   }
-  renderModuleDetail(ctx, result.data);
+  renderModuleDetail(ctx, result.data, course, reason);
 }
 function handleListError(ctx, status, code, error) {
+  if (["course_access_denied", "module_locked", "course_unavailable"].includes(code))
+    outputError(ctx, code, error, status === 403 ? ExitCodes.FORBIDDEN : ExitCodes.ERROR);
+  if (code === "release_mismatch")
+    outputError(ctx, code, error, ExitCodes.ERROR);
   if (status === 404) {
     outputError(ctx, "not_found", "Couldn't find that course or module.", ExitCodes.NOT_FOUND, "Run '10x list' to see available modules.");
   }
@@ -6819,7 +7497,7 @@ function handleListError(ctx, status, code, error) {
   }
   outputError(ctx, code || "list_failed", "Failed to load the catalog.", ExitCodes.ERROR, error ? `Server said: ${error}` : undefined);
 }
-function renderCatalog(ctx, catalog) {
+function renderCatalog(ctx, catalog, reason) {
   const lessonCountByModule = new Map;
   for (const lesson of catalog.lessons) {
     lessonCountByModule.set(lesson.module, (lessonCountByModule.get(lesson.module) ?? 0) + 1);
@@ -6827,6 +7505,7 @@ function renderCatalog(ctx, catalog) {
   if (ctx.json) {
     output(ctx, "", {
       course: catalog.course,
+      selectionReason: reason,
       modules: catalog.modules.map((m3) => ({
         module: m3.module,
         title: m3.title,
@@ -6843,7 +7522,7 @@ function renderCatalog(ctx, catalog) {
   }
   const exampleModule = catalog.modules.find((m3) => m3.effectiveState === "unlocked")?.module ?? catalog.modules[0]?.module ?? 0;
   const lines = [];
-  lines.push(`Course: ${catalog.course}`);
+  lines.push(`Course: ${catalog.course} (${reason})`);
   lines.push("");
   for (const m3 of catalog.modules) {
     lines.push(formatModuleRow(m3, lessonCountByModule.get(m3.module) ?? 0));
@@ -6859,10 +7538,12 @@ function formatModuleRow(m3, lessonCount) {
   const label = `Module ${m3.module}: ${m3.title}`;
   return `  ${icon} ${label} — ${lessonCount} lesson${lessonCount === 1 ? "" : "s"} [${state}]`;
 }
-function renderModuleDetail(ctx, module) {
+function renderModuleDetail(ctx, module, course, reason) {
   const isLocked = module.effectiveState === "locked";
   if (ctx.json) {
     output(ctx, "", {
+      course,
+      selectionReason: reason,
       module: module.module,
       title: module.title,
       state: module.effectiveState,
@@ -6879,6 +7560,7 @@ function renderModuleDetail(ctx, module) {
   }
   const stateLabel = isLocked ? `locked — unlocks ${formatReleaseAt(module.releaseAt)}` : "unlocked";
   const lines = [];
+  lines.push(`Course: ${course} (${reason})`);
   lines.push(`Module ${module.module}: ${module.title} [${stateLabel}]`);
   lines.push("");
   if (isLocked) {
@@ -6906,11 +7588,53 @@ function renderModuleDetail(ctx, module) {
 }
 
 // src/commands/sync.ts
-import { join as join9 } from "node:path";
-var DEFAULT_COURSE4 = "10xdevs3";
+import { join as join12 } from "node:path";
+
+// src/lib/sync-freshness.ts
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
+import { join as join11 } from "node:path";
+function isLessonFresh(root, manifest, id, profile, lang, courseRules) {
+  const lesson = manifest?.lessons?.[id];
+  const representation = lesson?.representation;
+  if (!manifest || !lesson || !representation || representation.lang !== lang || representation.tool !== profile.toolId || representation.courseRules !== courseRules || typeof representation.rules !== "boolean")
+    return false;
+  const matches = (path, hash) => {
+    assertProjectFilePath(root, path);
+    return !!hash && existsSync10(path) && contentHash(readFileSync9(path)) === hash;
+  };
+  try {
+    for (const [name, skill] of Object.entries(lesson.skills)) {
+      if (!isSafeName(name))
+        return false;
+      for (const file of skill.files)
+        if (!isSafeSkillFilePath(file) || !matches(join11(root, profile.skillDir(name), file), manifest.files.skills[name]?.contentHashes?.[file]))
+          return false;
+    }
+    for (const name of lesson.prompts)
+      if (!isSafeName(name) || !matches(join11(root, profile.promptPath(name.replace(/\.md$/, ""))), manifest.files.promptHashes?.[name]))
+        return false;
+    for (const name of lesson.configs)
+      if (!isSafeName(name) || !matches(join11(root, profile.configPath(name)), manifest.files.configHashes?.[name]))
+        return false;
+    const rulesPath = join11(root, profile.rulesFile);
+    assertProjectFilePath(root, rulesPath);
+    const existing = existsSync10(rulesPath) ? readFileSync9(rulesPath, "utf8") : "";
+    const block = inspectRulesBlock(existing, profile.sentinelBegin, profile.sentinelEnd);
+    if (representation.rules) {
+      const rules = manifest.managedRules;
+      if (!rules || rules.path !== profile.rulesFile || rules.begin !== profile.sentinelBegin || rules.end !== profile.sentinelEnd || !block || contentHash(block.text) !== rules.upstreamHash)
+        return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/sync.ts
 var SUPPORTED_LANGS = ["en", "pl"];
 function registerSyncCommand(cli) {
-  cli.command("sync", "Bulk-download and update lessons, reporting what changed upstream").option("--all", "Sync every unlocked lesson (default: only lessons you've already downloaded)").option("--dry-run", "Show what would change without writing").option("--force", "Ignore the cheap-skip digest and overwrite local edits with upstream").option("--module <module>", "Limit to one module (e.g. 'm2' or '2')").option("--course <course>", "Override the course slug (default: 10xdevs3)").option("--tool <tool>", "AI coding tool (claude-code, cursor, copilot, codex, devin-desktop, gemini, generic)").option("--lang <lang>", "Content language: en (default) or pl").option("--no-course-rules", "Skip applying the course rules block to your rules file (CLAUDE.md/AGENTS.md)").action(async (options) => {
+  cli.command("sync", "Bulk-download and update lessons, reporting what changed upstream").option("--all", "Sync every unlocked lesson (default: only lessons you've already downloaded)").option("--dry-run", "Show what would change without writing").option("--force", "Ignore the cheap-skip digest and overwrite local edits with upstream").option("--module <module>", "Limit to one module (e.g. 'm2' or '2')").option("--course <course>", "Select course ID or slug (default: project edition or API recommendation)").option("--tool <tool>", "AI coding tool (claude-code, cursor, copilot, codex, devin-desktop, gemini, generic)").option("--lang <lang>", "Content language: en (default) or pl").option("--no-course-rules", "Skip applying the course rules block to your rules file (CLAUDE.md/AGENTS.md)").action(async (options) => {
     const ctx = resolveContext(options);
     await runSync(ctx, options);
   });
@@ -6927,8 +7651,8 @@ async function runSync(ctx, options) {
     }
     moduleFilter = parsed;
   }
-  const auth = await requireAuth(ctx);
-  const course = options.course ?? DEFAULT_COURSE4;
+  const selection = await resolveCourseSelection(ctx, { explicit: options.course, writing: !options.dryRun });
+  const { auth, course } = selection;
   const profile = await resolveToolProfile(options.tool, process.cwd());
   const dryRun = options.dryRun === true;
   const force = options.force === true;
@@ -6941,6 +7665,7 @@ async function runSync(ctx, options) {
     handleCatalogError(ctx, catalogResult.status, catalogResult.code, catalogResult.error);
   }
   const catalog = catalogResult.data;
+  const release = catalogRelease(catalog);
   const moduleState = new Map;
   for (const mod of catalog.modules)
     moduleState.set(mod.module, mod.effectiveState);
@@ -6952,8 +7677,8 @@ async function runSync(ctx, options) {
     }
     return true;
   });
-  const manifest = readManifest(join9(process.cwd(), profile.manifestDir));
-  const manifestLessonIds = new Set(manifest?.lessons ? Object.keys(manifest.lessons) : []);
+  const manifest = readManifest(join12(process.cwd(), profile.manifestDir));
+  const manifestLessonIds = new Set(manifest?.lessons ? Object.keys(manifest.lessons) : manifest ? [manifest.lessonId] : []);
   let targets = unlocked;
   if (moduleFilter !== undefined)
     targets = targets.filter((l2) => l2.module === moduleFilter);
@@ -6964,12 +7689,24 @@ async function runSync(ctx, options) {
   const onSigint = () => controller.abort();
   process.once("SIGINT", onSigint);
   const outcomes = [];
+  let prepared = false;
+  const beforeWrite = async () => {
+    if (prepared)
+      return;
+    await prepareToolForWrite(process.cwd(), profile, course, {
+      ...options.lang ? { lang: options.lang } : {},
+      ...explicitCourseRules !== undefined ? { courseRules: explicitCourseRules } : {}
+    }, false);
+    prepared = true;
+  };
   try {
     for (const lesson of targets) {
       if (controller.signal.aborted)
         break;
       outcomes.push(await syncLesson(ctx, lesson, {
         course,
+        beforeWrite,
+        release,
         profile,
         lang,
         dryRun,
@@ -6985,6 +7722,7 @@ async function runSync(ctx, options) {
   }
   renderReport(ctx, profile, {
     course,
+    selectionReason: selection.reason,
     dryRun,
     force,
     mode: options.all === true ? "all" : "downloaded",
@@ -6997,8 +7735,9 @@ async function runSync(ctx, options) {
   }
 }
 async function syncLesson(ctx, lesson, opts) {
-  const stored = opts.manifest?.lessons?.[lesson.lessonId]?.catalogContentHash;
-  if (!opts.force && lesson.contentHash !== undefined && stored !== undefined && lesson.contentHash === stored) {
+  const currentManifest = readManifest(join12(process.cwd(), opts.profile.manifestDir));
+  const stored = currentManifest?.lessons?.[lesson.lessonId]?.catalogContentHash;
+  if (!opts.force && lesson.contentHash !== undefined && stored !== undefined && lesson.contentHash === stored && isLessonFresh(process.cwd(), currentManifest, lesson.lessonId, opts.profile, opts.lang, opts.applyCourseRules)) {
     verbose(ctx, `${lesson.lessonId}: upstream unchanged (digest match) — skipping fetch`);
     return {
       lessonId: lesson.lessonId,
@@ -7012,7 +7751,8 @@ async function syncLesson(ctx, lesson, opts) {
   const result = await fetchLesson(opts.course, lesson.lessonId, opts.token, {
     lang: opts.lang,
     tool: contentToolId(opts.profile),
-    signal: opts.signal
+    signal: opts.signal,
+    ...opts.release ? { release: opts.release } : {}
   });
   if (!result.ok) {
     return {
@@ -7043,14 +7783,23 @@ async function syncLesson(ctx, lesson, opts) {
       resources: resources2
     };
   }
-  const onConflict = opts.force ? async () => "overwrite" : async () => "skip";
-  const writeResult = await applyBundle(bundle, process.cwd(), {
-    course: opts.course,
-    profile: opts.profile,
-    onConflict,
-    applyCourseRules: opts.applyCourseRules,
-    catalogContentHash: lesson.contentHash
-  });
+  const onConflict = opts.force ? async (info) => info.artifactType === "rules" ? "skip" : "overwrite" : async () => "skip";
+  let writeResult;
+  try {
+    planBundle(bundle, process.cwd(), { course: opts.course, profile: opts.profile, applyCourseRules: opts.applyCourseRules });
+    await opts.beforeWrite();
+    writeResult = await applyBundle(bundle, process.cwd(), {
+      course: opts.course,
+      profile: opts.profile,
+      onConflict,
+      applyCourseRules: opts.applyCourseRules,
+      catalogContentHash: lesson.contentHash,
+      lang: result.responseHeaders.get("X-Content-Language") ?? opts.lang
+    });
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : "write_failed";
+    return { lessonId: lesson.lessonId, title: lesson.title, fetched: true, status: "errored", resources: [], error: { code, message: error instanceof Error ? error.message : String(error), retry: `10x get ${lesson.lessonId}` } };
+  }
   const resources = classifyFromWriteResult(writeResult, lesson.lessonId);
   return {
     lessonId: lesson.lessonId,
@@ -7068,6 +7817,8 @@ function actionToBucket(action) {
     case "conflict_overwritten":
     case "conflict_saved_user":
       return "upstream-updated";
+    case "preserved_local":
+      return "preserved-local";
     case "conflict_skipped":
       return "skipped-conflict";
     case "removed":
@@ -7104,18 +7855,18 @@ function classifyFromWriteResult(result, lessonId) {
       ...bucket === "skipped-conflict" ? { remediation: remediation(lessonId, "prompts", prompt.name) } : {}
     });
   }
-  out.push({ type: "rules", name: "course-rules", bucket: actionToBucket(result.rules.action) });
+  out.push({ type: "rules", name: "course-rules", bucket: actionToBucket(result.rules.action), remediation: `10x get ${lessonId} --type rules` });
   for (const config of result.configs) {
     out.push({ type: "configs", name: config.name, bucket: actionToBucket(config.action) });
   }
   for (const entry of result.removals.skills) {
-    out.push({ type: "skills", name: entry.name, bucket: "removed" });
+    out.push({ type: "skills", name: entry.name, bucket: actionToBucket(entry.action), reason: entry.reason });
   }
   for (const entry of result.removals.prompts) {
-    out.push({ type: "prompts", name: entry.name, bucket: "removed" });
+    out.push({ type: "prompts", name: entry.name, bucket: actionToBucket(entry.action), reason: entry.reason });
   }
   for (const entry of result.removals.configs) {
-    out.push({ type: "configs", name: entry.name, bucket: "removed" });
+    out.push({ type: "configs", name: entry.name, bucket: actionToBucket(entry.action), reason: entry.reason });
   }
   return out;
 }
@@ -7143,18 +7894,18 @@ function classifyFromPlan(plan, lessonId, force) {
       ...bucket === "skipped-conflict" ? { remediation: remediation(lessonId, "prompts", prompt.name) } : {}
     });
   }
-  out.push({ type: "rules", name: "course-rules", bucket: actionToBucket(plan.rules.action) });
+  out.push({ type: "rules", name: "course-rules", bucket: plan.rules.isConflict ? "skipped-conflict" : actionToBucket(plan.rules.action), remediation: `10x get ${lessonId} --type rules` });
   for (const config of plan.configs) {
     out.push({ type: "configs", name: config.name, bucket: actionToBucket(config.action) });
   }
   for (const entry of plan.removals.skills) {
-    out.push({ type: "skills", name: entry.name, bucket: "removed" });
+    out.push({ type: "skills", name: entry.name, bucket: actionToBucket(entry.action), reason: entry.reason });
   }
   for (const entry of plan.removals.prompts) {
-    out.push({ type: "prompts", name: entry.name, bucket: "removed" });
+    out.push({ type: "prompts", name: entry.name, bucket: actionToBucket(entry.action), reason: entry.reason });
   }
   for (const entry of plan.removals.configs) {
-    out.push({ type: "configs", name: entry.name, bucket: "removed" });
+    out.push({ type: "configs", name: entry.name, bucket: actionToBucket(entry.action), reason: entry.reason });
   }
   return out;
 }
@@ -7172,7 +7923,8 @@ function countBuckets(outcomes) {
     "upstream-updated": 0,
     unchanged: 0,
     "skipped-conflict": 0,
-    removed: 0
+    removed: 0,
+    "preserved-local": 0
   };
   for (const o of outcomes) {
     for (const r2 of o.resources)
@@ -7188,6 +7940,7 @@ function renderReport(ctx, profile, input) {
   if (ctx.json) {
     output(ctx, "", {
       course: input.course,
+      selectionReason: input.selectionReason,
       tool: profile.toolId,
       dryRun: input.dryRun,
       force: input.force,
@@ -7207,7 +7960,8 @@ function renderReport(ctx, profile, input) {
           upstreamUpdated: buckets["upstream-updated"],
           unchanged: buckets.unchanged,
           skippedConflict: buckets["skipped-conflict"],
-          removed: buckets.removed
+          removed: buckets.removed,
+          preservedLocal: buckets["preserved-local"]
         }
       }
     });
@@ -7217,7 +7971,7 @@ function renderReport(ctx, profile, input) {
   const verb = input.dryRun ? "Would sync" : "Synced";
   const scope = input.mode === "all" ? "all unlocked lessons" : "downloaded lessons";
   const moduleNote = input.module !== undefined ? ` in module ${input.module}` : "";
-  lines.push(`${verb} ${input.course} — ${scope}${moduleNote}:`);
+  lines.push(`${verb} ${input.course} (${input.selectionReason}) — ${scope}${moduleNote}:`);
   if (outcomes.length === 0) {
     lines.push("  (nothing to sync)");
   }
@@ -7231,6 +7985,10 @@ function renderReport(ctx, profile, input) {
     const summary = summarizeLesson(o);
     lines.push(`  ${o.lessonId} — ${o.status}${summary ? ` (${summary})` : ""}`);
     for (const r2 of o.resources) {
+      if (r2.bucket === "preserved-local") {
+        lines.push(`      preserved ${r2.type}/${r2.name} — ${r2.reason ?? "local file"}`);
+        continue;
+      }
       if (r2.bucket !== "skipped-conflict")
         continue;
       const label = r2.file ? `${r2.type}/${r2.name} (${r2.file})` : `${r2.type}/${r2.name}`;
@@ -7244,9 +8002,9 @@ function renderReport(ctx, profile, input) {
       lines.push(`  ${ex.lessonId} — ${ex.reason}`);
   }
   lines.push("");
-  lines.push(`Totals: ${buckets["upstream-updated"]} updated, ${buckets.created} new, ` + `${buckets.unchanged} unchanged, ${buckets["skipped-conflict"]} skipped (conflicts), ` + `${buckets.removed} removed.`);
+  lines.push(`Totals: ${buckets["upstream-updated"]} updated, ${buckets.created} new, ` + `${buckets.unchanged} unchanged, ${buckets["skipped-conflict"]} skipped (conflicts), ` + `${buckets.removed} removed, ${buckets["preserved-local"]} preserved locally.`);
   if (lessonsConflicts > 0 && !input.force) {
-    lines.push("To take all upstream updates over your local edits: 10x sync --force");
+    lines.push("To replace edited skills and prompts: 10x sync --force. Resolve rule conflicts with 10x get <lesson> --type rules.");
   }
   output(ctx, lines.join(`
 `), undefined);
@@ -7257,7 +8015,8 @@ function summarizeLesson(o) {
     "upstream-updated": 0,
     unchanged: 0,
     "skipped-conflict": 0,
-    removed: 0
+    removed: 0,
+    "preserved-local": 0
   };
   for (const r2 of o.resources)
     counts[r2.bucket]++;
@@ -7275,6 +8034,10 @@ function summarizeLesson(o) {
   return parts.join(", ");
 }
 function handleCatalogError(ctx, status, code, error) {
+  if (["course_access_denied", "module_locked", "course_unavailable"].includes(code))
+    outputError(ctx, code, error, status === 403 ? ExitCodes.FORBIDDEN : ExitCodes.ERROR);
+  if (code === "release_mismatch")
+    outputError(ctx, code, error, ExitCodes.ERROR);
   if (status === 401) {
     outputError(ctx, "auth_required", "Your session is no longer valid.", ExitCodes.AUTH_REQUIRED, "Run '10x auth' to log in again.");
   }
@@ -7287,7 +8050,11 @@ function handleCatalogError(ctx, status, code, error) {
   outputError(ctx, code || "catalog_fetch_failed", "Failed to fetch the course catalog.", ExitCodes.ERROR, error ? `Server said: ${error}` : undefined);
 }
 function lessonErrorMessage(status, code, error) {
-  if (status === 403)
+  if (code === "release_mismatch")
+    return error;
+  if (code === "course_access_denied" || code === "course_unavailable")
+    return error;
+  if (status === 403 && code === "module_locked")
     return "Module is locked.";
   if (status === 404)
     return "Lesson not found.";