moodle-cli 0.8.0 → 0.9.1

package/dist/moodle.js

@@ -20,6 +20,8 @@ var counts = z.object(Object.fromEntries(["notification_count", "unread_notifica
 var postSchema = z.object({ id, parent_id: n, name: s, author: z.object({ id, name: s }), time_created: id, created: s, message_text: s, links: z.array(z.object({ text: s, url: s })).optional() });
 var gradeSchema = z.object({ unit_id: id, code: s, graded: id, total: id, total_grade: s, total_range: s, total_percentage: s, items: z.array(z.object({ name: s, type: s, grade: s, range: s, percentage: s, weight: s, contribution: s, feedback: s, status: s, due: s, due_at: n })).optional() });
 var searchSchema = z.object({ unit_id: id, forum_id: id, discussion_id: id, name: s, post_id: id, snippet: s, time_created: n, created: s, url: s });
+var submissionFile = z.object({ name: z.string(), bytes: n, url: s });
+var receiptSchema = z.object({ id, name: s, unit_id: n, url: s, action: z.enum(["planned", "saved", "submitted"]), submission_status: s, grading_status: s, due: s, time_remaining: s, last_modified: s, statement: s, statement_accepted: z.boolean().optional(), files: z.array(submissionFile).optional(), uploads: z.array(z.object({ name: z.string(), bytes: id, path: s })).optional(), removed: z.array(z.string()).optional(), limits: z.object({ max_bytes: n, max_files: n, area_max_bytes: n, accepted_types: z.array(z.string()).optional() }).optional(), checked_at: z.string() });
 var input = (shape) => z.object(shape).strict();
 var list = (key, value) => z.object({ [key]: z.array(value).optional(), total: id });
 var intentContracts = {
@@ -33,6 +35,7 @@ var intentContracts = {
   news: { when: "announcements", command: "moodle news [UNIT]", what: "Latest announcement threads with first-post text.", instead: "search_forums for other discussions", refs: "optional unit code, name, id or URL", then: "thread with discussion id", cost: "up to 5 announcements by default", input: input({ unit: ref.optional(), limit: limit.default(5) }), output: list("news", z.object({ id, name: s, unit_id: id, unit_code: s, forum_id: id, post: postSchema.optional() })) },
   thread: { when: "discussion posts", command: "moodle threads show ID", what: "A discussion and a page of compact posts, with attachment links.", instead: "news for announcements", refs: "discussion_id; offset and limit", then: "increase offset while posts_total exceeds returned", cost: "up to 20 posts by default", input: input({ discussion_id: z.number().int().positive(), limit, offset: z.number().int().nonnegative().default(0) }), output: z.object({ thread: z.object({ id, name: s, unit_id: id, forum_id: id, url: s, posts: z.array(postSchema).optional(), posts_total: id, offset: id }) }) },
   search_forums: { when: "forum post text", command: 'moodle forums search "QUERY" --unit UNIT', what: "Matching posts with unit and forum name maps.", instead: "find for activity names", refs: "query, optional unit or courseId and forumId", then: "thread with discussion_id", cost: "bounded forum scan; total covers scanned scope", input: input({ query: z.string().trim().min(1), unit: ref.optional(), courseId: z.number().int().positive().optional(), forumId: z.number().int().positive().optional(), limit, includePostText: z.boolean().default(true), titlesOnly: z.boolean().default(false), unreadOnly: z.boolean().default(false), sortBy: z.enum(["relevance", "recent"]).default("relevance"), maxForums: limit.default(20), maxDiscussionsPerForum: limit.default(50) }), output: z.object({ results: z.array(searchSchema).optional(), total: id, forums: z.record(z.string(), z.string()).optional(), units: z.record(z.string(), z.string()).optional(), scope: z.object({ max_forums: id, max_discussions_per_forum: id }) }) },
+  submit: { when: "upload assignment files", command: 'moodle submit "UNIT TASK" FILE... [--final]', what: "Upload local files into an assignment; returns the receipt Moodle shows afterwards.", instead: "item for status only", refs: "assignment id, same-site URL or UNIT TASK phrase; local file paths", then: "dry_run (default) only plans; show the plan to the person, then rerun with dry_run false; final submits for grading and cannot be undone", cost: "writes to Moodle", input: input({ ref, files: z.array(z.string().trim().min(1)).max(20).default([]), final: z.boolean().default(false), replace: z.boolean().default(false), accept_statement: z.boolean().default(false), dry_run: z.boolean().default(true) }), output: z.object({ submission: receiptSchema }) },
   file: { when: "download a file", command: 'moodle get "UNIT TASK" --to DIR', what: "One authenticated file as embedded content, at most 16 MiB.", instead: "item for file choices", refs: "resource id, same-site URL, or UNIT TASK phrase", then: "read the returned resource", cost: "binary content up to 16 MiB", input: input({ ref }), output: z.object({ file: z.object({ name: z.string(), mime_type: z.string(), bytes: id, uri: z.string() }) }) }
 };
 function humanDescription(name) {
@@ -95,10 +98,10 @@ function postRow(p, subject, tz = "UTC") {
 }
 
 // src/doctor.ts
-import { access, readdir as readdir2, readFile as readFile4 } from "fs/promises";
-import { constants as constants2 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
+import { access as access3, readdir as readdir3, readFile as readFile4 } from "fs/promises";
+import { constants as constants3 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join9 } from "path";
 
 // src/session-fetch.ts
 var MAX_REDIRECTS = 5;
@@ -124,7 +127,12 @@ async function fetchWithSession(input2, init, moodleOrigin, cookie, fetchImpl =
       headers.delete("authorization");
       headers.delete("proxy-authorization");
     }
-    const response = await fetchImpl(url.toString(), { ...init, method, body, headers: Object.fromEntries(headers), signal, redirect: "manual" });
+    let response;
+    try {
+      response = await fetchImpl(url.toString(), { ...init, method, body, headers: Object.fromEntries(headers), signal, redirect: "manual" });
+    } catch (error) {
+      throw requestFailure(error, url, deadline);
+    }
     if (!REDIRECT_STATUSES.has(response.status)) return response;
     const location = response.headers.get("location");
     if (!location) return response;
@@ -145,13 +153,31 @@ async function fetchWithSession(input2, init, moodleOrigin, cookie, fetchImpl =
     url = next;
   }
 }
+var RequestFailed = class extends Error {
+  host;
+  timedOut;
+  constructor(host, timedOut, cause) {
+    super(timedOut ? `${host} did not respond within ${REQUEST_TIMEOUT_MS / 1e3}s.` : `Could not reach ${host}: ${cause}`);
+    this.name = "RequestFailed";
+    this.host = host;
+    this.timedOut = timedOut;
+  }
+};
+function requestFailure(error, url, deadline) {
+  if (deadline.aborted) {
+    return new RequestFailed(url.host, true);
+  }
+  if (!(error instanceof Error)) {
+    return error;
+  }
+  return new RequestFailed(url.host, false, error.cause instanceof Error ? error.cause.message : error.message);
+}
 
 // src/auth.ts
 import { ALL_PROFILES, getCookies } from "@steipete/sweet-cookie";
-import { execFile as execFileCallback } from "child_process";
-import { readdir } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { readdir as readdir2 } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 
 // src/constants.ts
 var PACKAGE_NAME = "moodle-cli";
@@ -171,6 +197,15 @@ var GRADE_REPORT_INDEX_PATH = "/grade/report/index.php";
 var GRADE_REPORT_OVERVIEW_PATH = "/grade/report/overview/index.php";
 var GRADE_REPORT_PATH = "/grade/report/user/index.php";
 var LOGIN_PATH = "/login/index.php";
+var MOBILE_LAUNCH_PATH = "/admin/tool/mobile/launch.php";
+var MOBILE_AUTOLOGIN_PATH = "/admin/tool/mobile/autologin.php";
+var WEBSERVICE_REST_PATH = "/webservice/rest/server.php";
+var SERVICE_NOLOGIN_PATH = "/lib/ajax/service-nologin.php";
+var MOBILE_SERVICE_SHORTNAME = "moodle_mobile_app";
+var MOBILE_URL_SCHEME = "moodlecli";
+var MOBILE_USER_AGENT = "MoodleMobile 4.5.0 (moodle-cli)";
+var FUNC_MOBILE_PUBLIC_CONFIG = "tool_mobile_get_public_config";
+var FUNC_MOBILE_AUTOLOGIN_KEY = "tool_mobile_get_autologin_key";
 var FUNC_GET_SITE_INFO = "core_webservice_get_site_info";
 var FUNC_GET_COURSES = "core_enrol_get_users_courses";
 var FUNC_GET_COURSES_BY_TIMELINE = "core_course_get_enrolled_courses_by_timeline_classification";
@@ -189,6 +224,7 @@ var CONFIG_FILENAME = "config.yaml";
 var CONFIG_DIR_NAME = ".config/moodle-cli";
 var CACHE_DIR_NAME = ".cache/moodle-cli";
 var SESSION_CACHE_FILENAME = "session.json";
+var CDP_PROFILE_DIR_NAME = ".cache/moodle-cli/browser-profile";
 var DEFAULT_SESSION_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var KEEPALIVE_LAUNCH_AGENT_LABEL = "com.moodle-cli.keepalive";
 var KEEPALIVE_DEFAULT_INTERVAL_MINUTES = 30;
@@ -201,6 +237,466 @@ var ENV_MOODLE_TOKEN = "MOODLE_TOKEN";
 var MOODLE_SESSION_COOKIE_PREFIX = "MoodleSession";
 var WRANGLER_VERSION = "4.131.0";
 
+// src/cookie-stores.ts
+import { constants } from "fs";
+import { access, readdir } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+var CHROMIUM_ROOTS = [
+  ["Chrome", "Google/Chrome"],
+  ["Edge", "Microsoft Edge"],
+  ["Brave", "BraveSoftware/Brave-Browser"]
+];
+var CHROMIUM_FILES = ["Cookies", "Network/Cookies"];
+var SAFARI_FILES = [
+  "Library/Cookies/Cookies.binarycookies",
+  "Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies"
+];
+function probe(path5, mode) {
+  return access(path5, mode).then(() => true, () => false);
+}
+async function chromiumProfiles(root) {
+  const entries = await readdir(root).catch(() => []);
+  const profiles = entries.filter((entry) => entry === "Default" || entry.startsWith("Profile "));
+  return profiles.length ? profiles : ["Default"];
+}
+async function browserCookieStores(options = {}) {
+  if ((options.platform ?? process.platform) !== "darwin") {
+    return [];
+  }
+  const home = options.homeDir ?? homedir();
+  const stores = [];
+  const add = async (browser, path5) => {
+    if (await probe(path5, constants.F_OK)) {
+      stores.push({ browser, path: path5, readable: await probe(path5, constants.R_OK) });
+    }
+  };
+  for (const [browser, directory] of CHROMIUM_ROOTS) {
+    const root = join(home, "Library/Application Support", directory);
+    for (const profile of await chromiumProfiles(root)) {
+      for (const file2 of CHROMIUM_FILES) {
+        await add(browser, join(root, profile, file2));
+      }
+    }
+  }
+  const firefoxRoot = join(home, "Library/Application Support/Firefox/Profiles");
+  for (const profile of await readdir(firefoxRoot).catch(() => [])) {
+    await add("Firefox", join(firefoxRoot, profile, "cookies.sqlite"));
+  }
+  for (const file2 of SAFARI_FILES) {
+    await add("Safari", join(home, file2));
+  }
+  return stores;
+}
+function unreadableCookieStores(stores) {
+  return stores.filter((store) => !store.readable);
+}
+function cookieStoresBlocked(stores) {
+  return stores.length > 0 && stores.every((store) => !store.readable);
+}
+
+// src/cdp-login.ts
+import { spawn } from "child_process";
+import { access as access2, mkdir } from "fs/promises";
+import { accessSync, constants as fsConstants } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var CdpError = class extends Error {
+  constructor(message, hint) {
+    super(message);
+    this.hint = hint;
+    this.name = "CdpError";
+  }
+  hint;
+};
+var NO_CHROMIUM_HINT = "Install Google Chrome, Microsoft Edge, Brave, or Chromium, or run `moodle auth login --paste` to hand over the cookie yourself.";
+var DEFAULT_INTERACTIVE_TIMEOUT_MS = 3e5;
+var DEFAULT_HEADLESS_TIMEOUT_MS = 45e3;
+var HANDSHAKE_TIMEOUT_MS = 15e3;
+var RPC_TIMEOUT_MS = 1e4;
+var CLOSE_TIMEOUT_MS = 2e3;
+var KILL_GRACE_MS = 1e3;
+function withTimeout(promise, ms, onTimeout) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => resolve(onTimeout()), ms);
+    timer.unref?.();
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    );
+  });
+}
+function cdpProfileDir(homeDir = homedir2()) {
+  return join2(homeDir, CDP_PROFILE_DIR_NAME);
+}
+function launchFlags(profileDir, url, headless) {
+  return [
+    `--user-data-dir=${profileDir}`,
+    "--remote-debugging-pipe",
+    "--no-first-run",
+    "--no-default-browser-check",
+    "--no-service-autorun",
+    "--disable-sync",
+    "--disable-background-networking",
+    "--disable-features=Translate,MediaRouter,OptimizationHints",
+    // macOS: use an in-memory key so decrypting cookies never prompts Keychain.
+    "--use-mock-keychain",
+    // Linux: avoid a gnome-keyring/kwallet unlock prompt for the same reason.
+    "--password-store=basic",
+    ...headless ? ["--headless=new"] : [],
+    url
+  ];
+}
+var MAC_BROWSERS = [
+  { name: "Google Chrome", path: "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" },
+  { name: "Microsoft Edge", path: "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge" },
+  { name: "Brave", path: "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser" },
+  { name: "Chromium", path: "/Applications/Chromium.app/Contents/MacOS/Chromium" }
+];
+var LINUX_BROWSERS = [
+  { name: "Google Chrome", path: "google-chrome" },
+  { name: "Google Chrome", path: "google-chrome-stable" },
+  { name: "Chromium", path: "chromium" },
+  { name: "Chromium", path: "chromium-browser" },
+  { name: "Microsoft Edge", path: "microsoft-edge" },
+  { name: "Brave", path: "brave-browser" }
+];
+function windowsBrowsers(env) {
+  const roots = [env.PROGRAMFILES, env["PROGRAMFILES(X86)"], env.LOCALAPPDATA].filter(Boolean);
+  const relative = [
+    ["Google Chrome", "Google/Chrome/Application/chrome.exe"],
+    ["Microsoft Edge", "Microsoft/Edge/Application/msedge.exe"],
+    ["Brave", "BraveSoftware/Brave-Browser/Application/brave.exe"],
+    ["Chromium", "Chromium/Application/chrome.exe"]
+  ];
+  return roots.flatMap((root) => relative.map(([name, tail]) => ({ name, path: join2(root, tail) })));
+}
+async function findChromiumBrowser(options = {}) {
+  if (options.browserPath) {
+    return { name: "Chromium", path: options.browserPath };
+  }
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  if (platform === "linux") {
+    for (const candidate of LINUX_BROWSERS) {
+      const resolved = resolveFromPath(candidate.path, env, platform);
+      if (resolved) return { name: candidate.name, path: resolved };
+    }
+    return null;
+  }
+  const candidates = platform === "win32" ? windowsBrowsers(env) : MAC_BROWSERS;
+  for (const candidate of candidates) {
+    if (await isExecutable(candidate.path)) return candidate;
+  }
+  return null;
+}
+async function loginWithCdp(options) {
+  const browser = await findChromiumBrowser(options);
+  if (!browser) {
+    throw new CdpError("No Chromium-family browser is installed.", NO_CHROMIUM_HINT);
+  }
+  const profileDir = options.profileDir ?? cdpProfileDir(options.homeDir);
+  await mkdir(profileDir, { recursive: true, mode: 448 });
+  const headless = options.headless ?? false;
+  const spawnImpl = options.spawn ?? spawn;
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = options.now ?? Date.now;
+  const timeoutMs = options.timeoutMs ?? (headless ? DEFAULT_HEADLESS_TIMEOUT_MS : DEFAULT_INTERACTIVE_TIMEOUT_MS);
+  const pollIntervalMs = options.pollIntervalMs ?? 500;
+  const child = spawnImpl(browser.path, launchFlags(profileDir, options.url, headless), {
+    stdio: ["ignore", "ignore", "pipe", "pipe", "pipe"]
+  });
+  const connection = new CdpConnection(child, { rpc: options.rpcTimeoutMs, close: options.closeTimeoutMs });
+  try {
+    await connection.handshake(options.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS);
+    options.onOpened?.();
+    const deadline = now() + timeoutMs;
+    while (now() < deadline) {
+      if (connection.closed) {
+        throw new CdpError(
+          "The browser closed before sign-in completed.",
+          "Another moodle login or renewal may be using the same browser profile. Wait for it to finish, then retry."
+        );
+      }
+      const cookies = await connection.getCookies();
+      if (await options.isDone(cookies)) {
+        return { cookies, browserName: browser.name };
+      }
+      await sleep(pollIntervalMs);
+    }
+    throw new CdpError(
+      headless ? "Timed out renewing the session in the background browser." : "Timed out waiting for sign-in.",
+      headless ? "Run `moodle auth login` to sign in again." : "Complete the sign-in in the browser window, then retry."
+    );
+  } finally {
+    await connection.close();
+  }
+}
+var CdpConnection = class {
+  constructor(child, timeouts = {}) {
+    this.child = child;
+    this.timeouts = timeouts;
+    child.on("exit", () => {
+      this.exited = true;
+      clearTimeout(this.hardKill);
+      this.markClosed();
+    });
+    child.on("error", () => this.markClosed());
+    const toBrowser = child.stdio[3];
+    toBrowser?.on("error", () => this.markClosed());
+    const fromBrowser = child.stdio[4];
+    fromBrowser?.on("error", () => this.markClosed());
+    fromBrowser?.on("data", (chunk) => this.consume(chunk));
+  }
+  child;
+  timeouts;
+  nextId = 1;
+  buffer = "";
+  pending = /* @__PURE__ */ new Map();
+  closed = false;
+  exited = false;
+  hardKill;
+  markClosed() {
+    if (this.closed) return;
+    this.closed = true;
+    for (const resolve of this.pending.values()) resolve({ error: { message: "browser closed" } });
+    this.pending.clear();
+  }
+  consume(chunk) {
+    this.buffer += chunk.toString("utf8");
+    let index;
+    while ((index = this.buffer.indexOf("\0")) !== -1) {
+      const raw = this.buffer.slice(0, index);
+      this.buffer = this.buffer.slice(index + 1);
+      let message;
+      try {
+        message = JSON.parse(raw);
+      } catch {
+        continue;
+      }
+      if (typeof message.id === "number") {
+        this.pending.get(message.id)?.(message);
+        this.pending.delete(message.id);
+      }
+    }
+  }
+  call(method, params = {}, timeoutMs = this.timeouts.rpc ?? RPC_TIMEOUT_MS) {
+    if (this.closed) return Promise.resolve({ error: { message: "browser closed" } });
+    const id2 = this.nextId++;
+    const toBrowser = this.child.stdio[3];
+    const request = new Promise((resolve) => {
+      this.pending.set(id2, resolve);
+      try {
+        toBrowser?.write(`${JSON.stringify({ id: id2, method, params })}\0`);
+      } catch {
+        this.pending.delete(id2);
+        resolve({ error: { message: "pipe write failed" } });
+      }
+    });
+    return withTimeout(request, timeoutMs, () => {
+      this.pending.delete(id2);
+      return { error: { message: "timeout" } };
+    });
+  }
+  async handshake(timeoutMs) {
+    const version = await this.call("Browser.getVersion", {}, timeoutMs);
+    if (version.error || this.closed) {
+      throw new CdpError(
+        "Could not talk to the browser over remote debugging.",
+        "Update the browser, or run `moodle auth login --paste` instead."
+      );
+    }
+  }
+  async getCookies() {
+    const response = await this.call("Storage.getCookies");
+    const cookies = response.result?.cookies ?? [];
+    return cookies.map((cookie) => ({
+      name: String(cookie.name ?? ""),
+      value: String(cookie.value ?? ""),
+      domain: String(cookie.domain ?? ""),
+      path: typeof cookie.path === "string" ? cookie.path : void 0,
+      secure: Boolean(cookie.secure),
+      httpOnly: Boolean(cookie.httpOnly)
+    }));
+  }
+  async close() {
+    if (!this.closed) {
+      await this.call("Browser.close", {}, this.timeouts.close ?? CLOSE_TIMEOUT_MS);
+    }
+    if (this.exited) return;
+    if (!this.child.killed) this.child.kill();
+    if (!this.exited) {
+      this.hardKill = setTimeout(() => {
+        if (!this.exited) this.child.kill("SIGKILL");
+      }, KILL_GRACE_MS);
+      this.hardKill.unref?.();
+    }
+  }
+};
+async function isExecutable(path5) {
+  try {
+    await access2(path5, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveFromPath(name, env, platform) {
+  if (name.includes("/")) return null;
+  const separator = platform === "win32" ? ";" : ":";
+  for (const dir of (env.PATH ?? "").split(separator).filter(Boolean)) {
+    const candidate = join2(dir, name);
+    try {
+      accessSync(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+// src/mobile-login-core.ts
+function parseLaunchToken(location) {
+  const match = /token=([^&#]+)/.exec(location);
+  if (!match) return null;
+  let decoded;
+  try {
+    decoded = Buffer.from(decodeURIComponent(match[1]), "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+  const parts = decoded.split(":::");
+  if (parts.length < 2 || !parts[1]) return null;
+  return { wstoken: parts[1], privatetoken: parts[2] || void 0 };
+}
+async function readMobilePublicConfig(baseUrl, fetchImpl = fetch) {
+  const url = new URL(SERVICE_NOLOGIN_PATH, ensureTrailingSlash(baseUrl));
+  url.searchParams.set("info", FUNC_MOBILE_PUBLIC_CONFIG);
+  const body = JSON.stringify([{ index: 0, methodname: FUNC_MOBILE_PUBLIC_CONFIG, args: {} }]);
+  let response;
+  try {
+    response = await fetchImpl(url.toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok) return null;
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    return null;
+  }
+  const data = Array.isArray(payload) ? payload[0] : void 0;
+  if (!data || data.error) return null;
+  const config = data.data;
+  if (!config) return null;
+  return {
+    webserviceEnabled: config.enablewebservices === 1 || config.enablewebservices === true,
+    mobileServiceEnabled: config.enablemobilewebservice === 1 || config.enablemobilewebservice === true
+  };
+}
+async function fetchMobileToken(baseUrl, cookie, fetchImpl = fetch) {
+  const url = new URL(MOBILE_LAUNCH_PATH, ensureTrailingSlash(baseUrl));
+  url.searchParams.set("service", MOBILE_SERVICE_SHORTNAME);
+  url.searchParams.set("passport", randomPassport());
+  url.searchParams.set("urlscheme", MOBILE_URL_SCHEME);
+  let response;
+  try {
+    response = await fetchImpl(url.toString(), {
+      method: "GET",
+      headers: { "user-agent": MOBILE_USER_AGENT, cookie: `${cookie.name}=${cookie.value}` },
+      redirect: "manual"
+    });
+  } catch {
+    return null;
+  }
+  const location = response.headers.get("location");
+  if (location) {
+    await response.body?.cancel();
+    return parseLaunchToken(location);
+  }
+  const html = await response.text().catch(() => "");
+  const inline = new RegExp(`${MOBILE_URL_SCHEME}://[^"'\\s]*token=[^"'\\s]+`).exec(html);
+  return inline ? parseLaunchToken(inline[0]) : null;
+}
+async function mintSessionFromMobileToken(baseUrl, userid, token, fetchImpl = fetch) {
+  if (!token.privatetoken) return null;
+  const key = await requestAutologinKey(baseUrl, token, fetchImpl);
+  if (!key) return null;
+  return exchangeAutologinKey(baseUrl, userid, key, fetchImpl);
+}
+async function requestAutologinKey(baseUrl, token, fetchImpl) {
+  const url = new URL(WEBSERVICE_REST_PATH, ensureTrailingSlash(baseUrl));
+  url.searchParams.set("moodlewsrestformat", "json");
+  url.searchParams.set("wsfunction", FUNC_MOBILE_AUTOLOGIN_KEY);
+  url.searchParams.set("wstoken", token.wstoken);
+  const form = new URLSearchParams({ privatetoken: token.privatetoken ?? "" });
+  let response;
+  try {
+    response = await fetchImpl(url.toString(), {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", "user-agent": MOBILE_USER_AGENT },
+      body: form.toString()
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok) return null;
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload !== "object" || "exception" in payload) return null;
+  const key = payload.key;
+  return typeof key === "string" && key ? key : null;
+}
+async function exchangeAutologinKey(baseUrl, userid, key, fetchImpl) {
+  const url = new URL(MOBILE_AUTOLOGIN_PATH, ensureTrailingSlash(baseUrl));
+  url.searchParams.set("userid", String(userid));
+  url.searchParams.set("key", key);
+  let response;
+  try {
+    response = await fetchImpl(url.toString(), {
+      method: "GET",
+      headers: { "user-agent": MOBILE_USER_AGENT },
+      redirect: "manual"
+    });
+  } catch {
+    return null;
+  }
+  const value = extractSessionCookie(response);
+  return value ? { cookie: { name: value.name, value: value.value, source: "mobile-token" } } : null;
+}
+function extractSessionCookie(response) {
+  const headers = typeof response.headers.getSetCookie === "function" ? response.headers.getSetCookie() : [response.headers.get("set-cookie") ?? ""].filter(Boolean);
+  for (const header of headers) {
+    const match = new RegExp(`(${MOODLE_SESSION_COOKIE_PREFIX}\\w*)=([^;\\s]+)`).exec(header);
+    if (match && match[2] && match[2] !== "deleted") {
+      return { name: match[1], value: match[2] };
+    }
+  }
+  return null;
+}
+function ensureTrailingSlash(baseUrl) {
+  return `${baseUrl.replace(/\/+$/, "")}/`;
+}
+function randomPassport() {
+  return (Math.random() * 1e3).toFixed(10);
+}
+
 // src/errors.ts
 import { CliError } from "@bunizao/cli-kit";
 import { CliError as CliError2 } from "@bunizao/cli-kit";
@@ -239,15 +735,18 @@ function isLoginRequiredError(error) {
 function isLoginErrorCode(code) {
   return ["servicerequireslogin", "sitepolicynotagreed"].includes(code ?? "");
 }
+function asNetworkError(error) {
+  return error instanceof RequestFailed ? new CliError("network", error.message, "Check the connection or VPN, then retry.") : null;
+}
 
 // src/session-cache.ts
 import { createHash, randomBytes } from "crypto";
 
 // src/mcp/credentials/node-store.ts
-import { spawn } from "child_process";
-import { chmod, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join, win32 as windowsPath } from "path";
+import { spawn as spawn2 } from "child_process";
+import { chmod, mkdir as mkdir2, readFile, rename, rm, writeFile } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname, join as join3, win32 as windowsPath } from "path";
 
 // src/mcp/credentials/store.ts
 var TOKEN_OVERLAP_MS = 10 * 60 * 1e3;
@@ -472,7 +971,7 @@ if ([IO.File]::Exists($payload.path)) { Remove-Item -LiteralPath $payload.path -
 var NodeCredentialCommandRunner = class {
   async run(command, args, input2) {
     return new Promise((resolve, reject) => {
-      const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+      const child = spawn2(command, args, { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
       let stdout = "";
       let stderr = "";
       child.stdout.setEncoding("utf8").on("data", (chunk) => {
@@ -717,15 +1216,15 @@ var UnavailableCredentialBackend = class {
   }
 };
 var PrivateFileCredentialBackend = class {
-  constructor(baseDirectory = join(homedir(), ".config", "moodle-cli", "mcp", "credentials")) {
+  constructor(baseDirectory = join3(homedir3(), ".config", "moodle-cli", "mcp", "credentials")) {
     this.baseDirectory = baseDirectory;
   }
   baseDirectory;
   name = "private credential file";
   async read(profile) {
-    const path4 = this.path(profile);
+    const path5 = this.path(profile);
     try {
-      return parseCredentials(await readFile(path4, "utf8"));
+      return parseCredentials(await readFile(path5, "utf8"));
     } catch (error) {
       if (isMissing(error)) {
         return null;
@@ -734,30 +1233,30 @@ var PrivateFileCredentialBackend = class {
     }
   }
   async write(profile, credentials) {
-    const path4 = this.path(profile);
-    const temporary = `${path4}.${process.pid}.tmp`;
-    await mkdir(dirname(path4), { recursive: true, mode: 448 });
-    await chmod(dirname(path4), 448);
+    const path5 = this.path(profile);
+    const temporary = `${path5}.${process.pid}.tmp`;
+    await mkdir2(dirname(path5), { recursive: true, mode: 448 });
+    await chmod(dirname(path5), 448);
     await writeFile(temporary, `${JSON.stringify(credentials)}
 `, { encoding: "utf8", mode: 384 });
     await chmod(temporary, 384);
-    await rename(temporary, path4);
-    await chmod(path4, 384);
+    await rename(temporary, path5);
+    await chmod(path5, 384);
   }
   async delete(profile) {
     await rm(this.path(profile), { force: true });
   }
   path(profile) {
     validateProfile(profile);
-    return join(this.baseDirectory, `${profile}.json`);
+    return join3(this.baseDirectory, `${profile}.json`);
   }
 };
 function createDefaultCredentialStore(options = {}) {
   const platform = options.platform ?? process.platform;
   const runner = options.runner ?? new NodeCredentialCommandRunner();
   const preferred = platform === "darwin" ? new MacOSKeychainCredentialBackend(runner) : platform === "linux" ? new LinuxSecretServiceCredentialBackend(runner) : platform === "win32" ? new WindowsCredentialManagerBackend(runner) : new UnavailableCredentialBackend(`${platform} credential store`);
-  const home = options.homeDirectory ?? homedir();
-  const fallbackDirectory = platform === "win32" ? windowsPath.join(home, "AppData", "Local", "moodle-cli", "credentials") : join(home, ".config", "moodle-cli", "mcp", "credentials");
+  const home = options.homeDirectory ?? homedir3();
+  const fallbackDirectory = platform === "win32" ? windowsPath.join(home, "AppData", "Local", "moodle-cli", "credentials") : join3(home, ".config", "moodle-cli", "mcp", "credentials");
   const fallback = platform === "win32" ? new WindowsDpapiFileCredentialBackend(fallbackDirectory, runner) : new PrivateFileCredentialBackend(fallbackDirectory);
   return new SafeCredentialStore(preferred, fallback, platform !== "win32");
 }
@@ -798,9 +1297,9 @@ function windowsCredentialInput(profile, credentials) {
     ...credentials ? { credentials: JSON.stringify(credentials) } : {}
   });
 }
-function windowsDpapiInput(path4, credentials) {
+function windowsDpapiInput(path5, credentials) {
   return JSON.stringify({
-    path: path4,
+    path: path5,
     ...credentials ? { credentials: JSON.stringify(credentials) } : {}
   });
 }
@@ -894,26 +1393,26 @@ function isRecord(value) {
 }
 
 // src/session-cache.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
-var nodeFs = { readFile: readFile2, writeFile: writeFile2, mkdir: mkdir2, rm: rm2, chmod: chmod2 };
-function sessionCachePath(homeDir = homedir2()) {
-  return join2(homeDir, CACHE_DIR_NAME, SESSION_CACHE_FILENAME);
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, join as join4 } from "path";
+var nodeFs = { readFile: readFile2, writeFile: writeFile2, mkdir: mkdir3, rm: rm2, chmod: chmod2 };
+function sessionCachePath(homeDir = homedir4()) {
+  return join4(homeDir, CACHE_DIR_NAME, SESSION_CACHE_FILENAME);
 }
 function isCachedSessionFresh(session, ttlMs = DEFAULT_SESSION_CACHE_TTL_MS, now = Date.now) {
   const age = now() - session.savedAt;
-  return age >= 0 && age <= ttlMs;
+  return !session.cookieInvalidated && age >= 0 && age <= ttlMs;
 }
 async function readCachedSession(baseUrl, options = {}) {
   if (options.noCache) {
     return null;
   }
   const fs = options.fs ?? nodeFs;
-  const path4 = sessionCachePath(options.homeDir);
+  const path5 = sessionCachePath(options.homeDir);
   let raw;
   try {
-    raw = await fs.readFile(path4, "utf8");
+    raw = await fs.readFile(path5, "utf8");
   } catch (error) {
     if (isMissingFileError(error)) {
       return null;
@@ -931,28 +1430,28 @@ async function readCachedSession(baseUrl, options = {}) {
       if (session) await writeCachedSession(session, { ...options, noCache: false });
     }
   } catch {
-    if (parseCachedSession(raw)) await fs.rm(path4, { force: true });
+    if (parseCachedSession(raw)) await fs.rm(path5, { force: true });
     return null;
   }
   if (!session || !sameBaseUrl(session.baseUrl, baseUrl)) {
     return null;
   }
   const ttlMs = options.ttlMs ?? DEFAULT_SESSION_CACHE_TTL_MS;
-  return isCachedSessionFresh(session, ttlMs, options.now ?? Date.now) ? session : null;
+  return options.allowExpired || isCachedSessionFresh(session, ttlMs, options.now ?? Date.now) ? session : null;
 }
 async function writeCachedSession(session, options = {}) {
   if (options.noCache) return;
   const fs = options.fs ?? nodeFs;
-  const path4 = sessionCachePath(options.homeDir);
+  const path5 = sessionCachePath(options.homeDir);
   const keyring = await createEncryptionKeyring(await cacheEncryptionKey(options));
   const encrypted = { version: 2, encrypted_session: await encryptValue(JSON.stringify(session), keyring) };
-  await fs.mkdir(dirname2(path4), { recursive: true, mode: 448 });
-  await fs.writeFile(path4, `${JSON.stringify(encrypted)}
+  await fs.mkdir(dirname2(path5), { recursive: true, mode: 448 });
+  await fs.writeFile(path5, `${JSON.stringify(encrypted)}
 `, { encoding: "utf8", mode: 384 });
-  await fs.chmod(path4, 384);
+  await fs.chmod(path5, 384);
 }
 async function deleteCachedSession(baseUrl, options = {}) {
-  const current2 = await readCachedSession(baseUrl, { ...options, noCache: false, ttlMs: Number.MAX_SAFE_INTEGER });
+  const current2 = await readCachedSession(baseUrl, { ...options, noCache: false, allowExpired: true });
   if (!current2) {
     return;
   }
@@ -986,9 +1485,12 @@ function parseCachedSession(raw) {
     sesskey: session.sesskey,
     userid: session.userid,
     savedAt: session.savedAt,
+    ...session.cookieInvalidated === true ? { cookieInvalidated: true } : {},
     ...typeof session.cookieSource === "string" ? { cookieSource: session.cookieSource } : {},
     ...Array.isArray(session.unavailable) && session.unavailable.every((name) => typeof name === "string") ? { unavailable: session.unavailable } : {},
-    ...isRecord2(session.user) && typeof session.user.fullname === "string" && typeof session.user.userid === "number" ? { user: session.user } : {}
+    ...isRecord2(session.user) && typeof session.user.fullname === "string" && typeof session.user.userid === "number" ? { user: session.user } : {},
+    ...isRecord2(session.mobileToken) && typeof session.mobileToken.wstoken === "string" ? { mobileToken: { wstoken: session.mobileToken.wstoken, ...typeof session.mobileToken.privatetoken === "string" ? { privatetoken: session.mobileToken.privatetoken } : {} } } : {},
+    ...typeof session.mobileServiceEnabled === "boolean" ? { mobileServiceEnabled: session.mobileServiceEnabled } : {}
   };
 }
 function sameBaseUrl(left, right) {
@@ -1007,7 +1509,7 @@ function isMissingFileError(error) {
 var pendingCacheKeys = /* @__PURE__ */ new Map();
 async function cacheEncryptionKey(options) {
   if (options.encryptionKey) return options.encryptionKey();
-  const homeDirectory = options.homeDir ?? homedir2();
+  const homeDirectory = options.homeDir ?? homedir4();
   let pending = pendingCacheKeys.get(homeDirectory);
   if (!pending) {
     pending = (async () => {
@@ -1026,6 +1528,23 @@ async function cacheEncryptionKey(options) {
 }
 
 // src/auth.ts
+var COOKIE_STORE_TIMEOUT_MS = 8e3;
+function withTimeoutValue(promise, ms, onTimeout) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => resolve(onTimeout()), ms);
+    timer.unref?.();
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    );
+  });
+}
 async function getAuthenticatedSession(baseUrl, options = {}) {
   const envSession = loadSessionFromEnv(options.env);
   const validate = options.validateSession ?? validateSessionWithFetch(options);
@@ -1044,6 +1563,10 @@ async function getAuthenticatedSession(baseUrl, options = {}) {
   if (cached) {
     return cached;
   }
+  const minted = await mintFromStoredToken(baseUrl, options, validate);
+  if (minted) {
+    return minted;
+  }
   const cookieWarnings = [];
   const providerOptions = {
     ...options,
@@ -1059,17 +1582,25 @@ async function getAuthenticatedSession(baseUrl, options = {}) {
     await refreshSessionCache(baseUrl, browserSession.cookie, browserSession.context, options);
     return { baseUrl, cookie: browserSession.cookie, ...browserSession.context, fromCache: false };
   }
+  const stores = await browserCookieStores({ homeDir: options.homeDir, platform: options.platform });
   throw new AuthError(
     `No usable MoodleSession found for ${baseUrl}.`,
-    authFailureHint(baseUrl, cookieWarnings, options.platform)
+    authFailureHint(baseUrl, cookieWarnings, options.platform, unreadableCookieStores(stores), options.env)
   );
 }
 async function getAuthenticatedSessionWithBrowserFallback(baseUrl, options = {}) {
   const cookieWarnings = [];
+  const rawProvider = options.browserCookieProvider ?? defaultBrowserCookieProvider;
+  const cookieStoreTimeoutMs = options.cookieStoreTimeoutMs ?? COOKIE_STORE_TIMEOUT_MS;
+  const boundedProvider = (url, opts) => withTimeoutValue(rawProvider(url, opts), cookieStoreTimeoutMs, () => {
+    opts.onCookieWarnings?.(["Reading the browser cookie store timed out; opening a browser to sign in."]);
+    return [];
+  });
   const authOptions = {
     ...options,
     noCache: true,
     nonInteractive: true,
+    browserCookieProvider: boundedProvider,
     onCookieWarnings: (warnings) => {
       cookieWarnings.push(...warnings);
       options.onCookieWarnings?.(warnings);
@@ -1095,34 +1626,92 @@ async function getAuthenticatedSessionWithBrowserFallback(baseUrl, options = {})
       }
     }
   }
-  if (cookieAccessBlocked(cookieWarnings)) {
-    throw new AuthError(
-      `Cannot read browser cookies for ${baseUrl}.`,
-      cookieAccessHint(cookieWarnings, options.platform)
-    );
+  const probeBrowser = options.findBrowser ?? findChromiumBrowser;
+  const hasBrowser = Boolean(await probeBrowser({ ...options }));
+  if (!hasBrowser) {
+    const stores = await browserCookieStores({ homeDir: options.homeDir, platform: options.platform });
+    if (cookieAccessBlocked(cookieWarnings) || cookieStoresBlocked(stores)) {
+      throw new AuthError(
+        `Cannot read browser cookies for ${baseUrl}.`,
+        cookieAccessHint(cookieWarnings, options.platform, unreadableCookieStores(stores), options.env)
+      );
+    }
   }
+  return loginViaCdp(baseUrl, { ...options, ...browserAuthOptions });
+}
+function toSessionCookie(cookie) {
+  return { name: cookie.name, value: cookie.value, domain: cookie.domain, path: cookie.path, source: "cdp" };
+}
+async function loginViaCdp(baseUrl, options) {
+  const validate = options.validateSession ?? validateSessionWithFetch(options);
+  const runCdp = options.cdpLogin ?? loginWithCdp;
   const url = loginUrl(baseUrl);
-  await (options.openBrowser ?? ((target) => openSystemBrowser(target, options)))(url);
-  options.onBrowserOpened?.(url);
-  const pollIntervalMs = options.browserLoginPollIntervalMs ?? 1e3;
-  const timeoutMs = options.browserLoginTimeoutMs ?? 12e4;
-  const attempts = Math.max(1, Math.ceil(timeoutMs / pollIntervalMs));
-  const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
-  const pollOptions = browserAuthOptions;
-  for (let attempt = 0; attempt < attempts; attempt += 1) {
-    await sleep(pollIntervalMs);
-    try {
-      return await getAuthenticatedSession(baseUrl, pollOptions);
-    } catch (error) {
-      if (!(error instanceof AuthError)) {
-        throw error;
+  let resolved = null;
+  let lastChecked = "";
+  try {
+    await runCdp({
+      url,
+      headless: options.headlessCdp ?? false,
+      homeDir: options.homeDir,
+      platform: options.platform,
+      env: options.env,
+      onOpened: () => options.onBrowserOpened?.(url),
+      isDone: async (cookies) => {
+        if (resolved) return true;
+        const top = matchingMoodleSessionCookies(cookies.map(toSessionCookie), baseUrl)[0];
+        if (!top || top.value === lastChecked) return false;
+        lastChecked = top.value;
+        const context = await validate(baseUrl, top);
+        if (context) {
+          resolved = { cookie: top, context };
+          return true;
+        }
+        return false;
       }
+    });
+  } catch (error) {
+    if (error instanceof CdpError) {
+      throw new AuthError(error.message, error.hint ?? authFailureHint(baseUrl, [], options.platform, [], options.env));
     }
+    throw error;
   }
-  throw new AuthError(
-    `Timed out waiting for browser login at ${baseUrl}.`,
-    `Complete the login in your browser, then rerun: moodle auth login`
-  );
+  const session = resolved;
+  if (!session) {
+    throw new AuthError(`Sign-in did not complete for ${baseUrl}.`, `Run: moodle auth login`);
+  }
+  await refreshSessionCache(baseUrl, session.cookie, session.context, { ...options, noCache: false });
+  return { baseUrl, cookie: session.cookie, ...session.context, fromCache: false };
+}
+function parsePastedSessionCookie(raw) {
+  const text2 = raw.trim();
+  if (!text2) {
+    return null;
+  }
+  const pair = /\b(MoodleSession\w*)=([^;\s'"\\]+)/.exec(text2);
+  if (pair) {
+    return { name: pair[1], value: pair[2], source: "paste" };
+  }
+  return /[\s=;]/.test(text2) ? null : { name: MOODLE_SESSION_COOKIE_PREFIX, value: text2, source: "paste" };
+}
+async function authenticateWithPastedCookie(baseUrl, raw, options = {}) {
+  const cookie = parsePastedSessionCookie(raw);
+  if (!cookie) {
+    throw new AuthError(`That is not a ${MOODLE_SESSION_COOKIE_PREFIX} cookie value.`, pastedCookieHint(baseUrl));
+  }
+  const validate = options.validateSession ?? validateSessionWithFetch(options);
+  const context = await validate(baseUrl, cookie);
+  if (!context) {
+    throw new AuthError(`The pasted cookie did not authenticate for ${baseUrl}.`, pastedCookieHint(baseUrl));
+  }
+  await refreshSessionCache(baseUrl, cookie, context, { ...options, noCache: false });
+  return { baseUrl, cookie, ...context, fromCache: false };
+}
+function pastedCookieHint(baseUrl) {
+  return [
+    `Sign in at ${loginUrl(baseUrl)}, then open the browser developer tools.`,
+    'In the Network tab, right-click any request to the site and choose "Copy as cURL", then paste the whole command.',
+    `Copying the ${MOODLE_SESSION_COOKIE_PREFIX} value from Application (or Storage) > Cookies works too.`
+  ].join("\n");
 }
 function loadSessionFromEnv(env = process.env) {
   const source = env[ENV_MOODLE_TOKEN] ? ENV_MOODLE_TOKEN : ENV_MOODLE_SESSION;
@@ -1174,17 +1763,17 @@ async function defaultBrowserCookieProvider(baseUrl, options = {}) {
   }));
 }
 async function braveProfilePaths(options = {}) {
-  const home = options.homeDir ?? homedir3();
+  const home = options.homeDir ?? homedir5();
   const platform = options.platform ?? process.platform;
   const roots = platform === "linux" ? [
-    join3(home, ".config/BraveSoftware/Brave-Browser"),
-    join3(home, ".var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser")
-  ] : platform === "win32" ? [join3(home, "AppData/Local/BraveSoftware/Brave-Browser/User Data")] : platform === "darwin" ? [join3(home, "Library/Application Support/BraveSoftware/Brave-Browser")] : [];
+    join5(home, ".config/BraveSoftware/Brave-Browser"),
+    join5(home, ".var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser")
+  ] : platform === "win32" ? [join5(home, "AppData/Local/BraveSoftware/Brave-Browser/User Data")] : platform === "darwin" ? [join5(home, "Library/Application Support/BraveSoftware/Brave-Browser")] : [];
   const profiles = [];
   for (const root of roots) {
     try {
       profiles.push(
-        ...(await readdir(root, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => name === "Default" || name === "Guest Profile" || name.startsWith("Profile ")).sort().map((name) => join3(root, name))
+        ...(await readdir2(root, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => name === "Default" || name === "Guest Profile" || name.startsWith("Profile ")).sort().map((name) => join5(root, name))
       );
     } catch {
       continue;
@@ -1192,46 +1781,70 @@ async function braveProfilePaths(options = {}) {
   }
   return profiles;
 }
+var FULL_DISK_ACCESS_PANE = "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles";
+var TERMINAL_APPLICATIONS = {
+  Apple_Terminal: "Terminal",
+  ghostty: "Ghostty",
+  Hyper: "Hyper",
+  "iTerm.app": "iTerm",
+  Tabby: "Tabby",
+  vscode: "Visual Studio Code",
+  WarpTerminal: "Warp",
+  WezTerm: "WezTerm"
+};
+function hostApplicationName(env = process.env) {
+  const program = env.TERM_PROGRAM?.trim();
+  return program ? TERMINAL_APPLICATIONS[program] ?? program : null;
+}
 var COOKIE_ACCESS_DENIED = /EPERM|EACCES|operation not permitted|permission denied/i;
 var COOKIE_SQLITE_UNAVAILABLE = /No such built-in module: node:sqlite/i;
 var MINIMUM_NODE_FOR_BROWSER_COOKIES = "22.13.0";
 function cookieAccessBlocked(warnings) {
   return warnings.some((warning) => COOKIE_ACCESS_DENIED.test(warning) || COOKIE_SQLITE_UNAVAILABLE.test(warning));
 }
-function cookieAccessHint(warnings, platform = process.platform) {
-  const grant = platform === "darwin" ? "Grant Full Disk Access to the application running this command (System Settings > Privacy & Security > Full Disk Access), then restart it." : "Run this command as the user that owns the browser profile, or grant it read access to the browser cookie store.";
-  const remedy = warnings.some((warning) => COOKIE_SQLITE_UNAVAILABLE.test(warning)) ? [
-    `This Node.js runtime has no node:sqlite, which is needed to read browser cookies. Use Node.js ${MINIMUM_NODE_FOR_BROWSER_COOKIES} or newer, or run the CLI with Bun (bunx --bun moodle-cli).`
-  ] : [
-    "If this runs inside a sandboxed app (an IDE or agent terminal), rerun it from a regular terminal first.",
-    grant
-  ];
+function cookieAccessHint(warnings, platform = process.platform, unreadable = [], env = process.env) {
+  const grant = platform === "darwin" ? [
+    `Grant Full Disk Access to ${hostApplicationName(env) ?? "the application running this command"}, then restart it:`,
+    `  open "${FULL_DISK_ACCESS_PANE}"`
+  ].join("\n") : "Run this command as the user that owns the browser profile, or grant it read access to the browser cookie store.";
+  const remedy = [];
+  if (warnings.some((warning) => COOKIE_SQLITE_UNAVAILABLE.test(warning))) {
+    remedy.push(
+      `This Node.js runtime has no node:sqlite, which is needed to read browser cookies. Use Node.js ${MINIMUM_NODE_FOR_BROWSER_COOKIES} or newer, or run the CLI with Bun (bunx --bun moodle-cli).`
+    );
+  }
+  if (unreadable.length || !remedy.length) {
+    remedy.push(
+      "If this runs inside a sandboxed app (an IDE or agent terminal), rerun it from a regular terminal first.",
+      grant
+    );
+  }
   return [
     "The browser cookie store could not be read, so the session could not be detected.",
     ...remedy,
+    "Or skip the store entirely: `moodle auth login --paste` takes the cookie by hand and caches it.",
     "Run moodle doctor for runtime and browser diagnostics.",
-    `Alternatively set ${ENV_MOODLE_SESSION} to a valid MoodleSession cookie value.`,
-    "",
-    "Cookie store diagnostics:",
-    ...warnings.map((warning) => `  - ${warning}`)
+    ...cookieDiagnostics(warnings, unreadable)
   ].join("\n");
 }
-function authFailureHint(baseUrl, cookieWarnings = [], platform = process.platform) {
-  if (cookieAccessBlocked(cookieWarnings)) {
-    return cookieAccessHint(cookieWarnings, platform);
-  }
+function cookieDiagnostics(warnings, unreadable) {
+  const probed = unreadable.map((store) => store.path);
   const lines = [
-    `Log in to ${loginUrl(baseUrl)} in your browser, then rerun the command.`,
-    "Or run `moodle auth login` to sign in through a browser window this command controls.",
-    `Or set ${ENV_MOODLE_SESSION} to a valid MoodleSession cookie value.`
+    ...unreadable.map((store) => `  - ${store.browser} cookie store exists but cannot be opened: ${store.path}`),
+    ...warnings.filter((warning) => COOKIE_ACCESS_DENIED.test(warning) || COOKIE_SQLITE_UNAVAILABLE.test(warning)).filter((warning) => !probed.some((path5) => warning.includes(path5))).map((warning) => `  - ${warning}`)
   ];
-  if (cookieWarnings.length) {
-    lines.push("", "Cookie store diagnostics:", ...cookieWarnings.map((warning) => `  - ${warning}`));
-  }
-  return lines.join("\n");
+  return lines.length ? ["", "Cookie store diagnostics:", ...lines] : [];
 }
-async function invalidateCachedSession(baseUrl, options = {}) {
-  await deleteCachedSession(baseUrl, cacheOptions(options));
+function authFailureHint(baseUrl, cookieWarnings = [], platform = process.platform, unreadable = [], env = process.env) {
+  if (cookieAccessBlocked(cookieWarnings) || unreadable.length) {
+    return cookieAccessHint(cookieWarnings, platform, unreadable, env);
+  }
+  return [
+    `Log in to ${loginUrl(baseUrl)} in your browser, then rerun the command.`,
+    "Or run `moodle auth login` to sign in through a browser window this command controls.",
+    "Or run `moodle auth login --paste` to hand over the cookie yourself.",
+    ...cookieDiagnostics(cookieWarnings, unreadable)
+  ].join("\n");
 }
 function parseSessionContext(html) {
   const sesskey = firstMatch(html, [
@@ -1259,7 +1872,11 @@ function validateSessionWithFetch(options) {
     let response;
     try {
       response = await fetchWithSession(`${baseUrl}${DASHBOARD_PATH}`, {}, baseUrl, cookie, fetcher);
-    } catch {
+    } catch (error) {
+      const network = asNetworkError(error);
+      if (network) {
+        throw network;
+      }
       return null;
     }
     if (response.status >= 400 || isLoginRedirect(response.url, baseUrl)) {
@@ -1300,16 +1917,59 @@ async function refreshSessionCache(baseUrl, cookie, context, options) {
     savedAt: (options.now ?? Date.now)()
   };
   try {
-    const previous = await readCachedSession(baseUrl, { ...cacheOptions(options), ttlMs: Number.MAX_SAFE_INTEGER });
+    const previous = await readCachedSession(baseUrl, { ...cacheOptions(options), allowExpired: true });
+    if (typeof previous?.mobileServiceEnabled === "boolean") session.mobileServiceEnabled = previous.mobileServiceEnabled;
     if (previous?.userid === context.userid) {
       if (previous.unavailable?.length) session.unavailable = previous.unavailable;
       if (previous.user) session.user = previous.user;
+      if (previous.mobileToken?.privatetoken) session.mobileToken = previous.mobileToken;
+    }
+    const newCookie = !previous || previous.cookieValue !== cookie.value;
+    if (!session.mobileToken && newCookie && options.captureMobileToken && session.mobileServiceEnabled !== false) {
+      const captured = await captureMobileToken(baseUrl, cookie, options);
+      session.mobileServiceEnabled = captured.supported;
+      if (captured.token) session.mobileToken = captured.token;
     }
     await writeCachedSession(session, cacheOptions(options));
   } catch {
     return;
   }
 }
+async function captureMobileToken(baseUrl, cookie, options) {
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  try {
+    const config = await readMobilePublicConfig(baseUrl, fetchImpl);
+    if (config && !config.mobileServiceEnabled) return { supported: false };
+    const token = await fetchMobileToken(baseUrl, cookie, fetchImpl) ?? void 0;
+    return { supported: config?.mobileServiceEnabled ?? (token ? true : void 0), token };
+  } catch {
+    return {};
+  }
+}
+async function mintValidatedSession(baseUrl, stored, options = {}) {
+  if (!stored.mobileToken?.privatetoken) return null;
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const minted = await mintSessionFromMobileToken(baseUrl, stored.userid, stored.mobileToken, fetchImpl);
+  if (!minted) return null;
+  const cookie = { name: minted.cookie.name, value: minted.cookie.value, source: minted.cookie.source };
+  const validate = options.validateSession ?? validateSessionWithFetch(options);
+  const context = await validate(baseUrl, cookie);
+  if (!context || context.userid === 0 || context.userid !== stored.userid) return null;
+  return { cookie, context };
+}
+async function mintFromStoredToken(baseUrl, options, validate) {
+  let stored;
+  try {
+    stored = await readCachedSession(baseUrl, { ...cacheOptions(options), allowExpired: true });
+  } catch {
+    return null;
+  }
+  if (!stored?.mobileToken?.privatetoken) return null;
+  const result = await mintValidatedSession(baseUrl, stored, { ...options, validateSession: validate });
+  if (!result) return null;
+  await refreshSessionCache(baseUrl, result.cookie, result.context, options);
+  return { baseUrl, cookie: result.cookie, ...result.context, fromCache: false };
+}
 function cachedSessionToAuth(baseUrl, cached) {
   return {
     baseUrl,
@@ -1347,8 +2007,8 @@ function isLoginRedirect(responseUrl, baseUrl) {
   if (!responseUrl) {
     return false;
   }
-  const path4 = new URL(responseUrl, baseUrl).pathname;
-  return path4 === LOGIN_PATH || path4.startsWith("/login/");
+  const path5 = new URL(responseUrl, baseUrl).pathname;
+  return path5 === LOGIN_PATH || path5.startsWith("/login/");
 }
 function looksLikeLoginPage(html) {
   return /name=["']username["']/i.test(html) && /name=["']password["']/i.test(html);
@@ -1365,40 +2025,36 @@ function firstMatch(value, patterns) {
 function decodeHtml(value) {
   return value.replace(/&amp;/g, "&").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
 }
-async function openSystemBrowser(url, options) {
-  const platform = options.platform ?? process.platform;
-  const command = platform === "darwin" ? { file: "open", args: [url] } : platform === "win32" ? { file: "cmd", args: ["/c", "start", "", url] } : { file: "xdg-open", args: [url] };
-  const result = await (options.execFile ?? defaultExecFile)(command.file, command.args);
-  if (result.exitCode !== 0) {
-    throw new AuthError(
-      `Could not open the browser for Moodle login.`,
-      `Open ${url} manually, then rerun: moodle auth login`
-    );
-  }
-}
-var defaultExecFile = (file2, args) => new Promise((resolve) => {
-  execFileCallback(file2, args, { encoding: "utf8" }, (error, stdout, stderr) => {
-    const errorWithCode = error;
-    resolve({
-      stdout: String(stdout ?? ""),
-      stderr: String(stderr ?? ""),
-      exitCode: errorWithCode ? Number(errorWithCode.code) || 1 : 0
-    });
-  });
-});
 
 // src/config.ts
-import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname3, join as join4 } from "path";
-import { createInterface } from "readline/promises";
+import { mkdir as mkdir4, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname3, join as join6 } from "path";
+import { createUi, isAgentEnvironment } from "@bunizao/cli-kit";
+
+// src/wordmark.ts
+var MOODLE_TAGLINE = "Read Moodle and submit work from the command line.";
+var MOODLE_WORDMARK = [
+  "                     _ _",
+  "  _ __  ___  ___  __| | |___",
+  " | '  \\/ _ \\/ _ \\/ _` | / -_)",
+  " |_|_|_\\___/\\___/\\__,_|_\\___|"
+].join("\n");
+var shown = false;
+function showWordmark(ui) {
+  if (shown) return;
+  shown = true;
+  ui.banner(MOODLE_WORDMARK, MOODLE_TAGLINE);
+}
+
+// src/config.ts
 import YAML from "yaml";
-var nodeFs2 = { readFile: readFile3, writeFile: writeFile3, mkdir: mkdir3 };
+var nodeFs2 = { readFile: readFile3, writeFile: writeFile3, mkdir: mkdir4 };
 function cwdConfigPath(cwd = process.cwd()) {
-  return join4(cwd, CONFIG_FILENAME);
+  return join6(cwd, CONFIG_FILENAME);
 }
-function userConfigPath(homeDir = homedir4()) {
-  return join4(homeDir, CONFIG_DIR_NAME, CONFIG_FILENAME);
+function userConfigPath(homeDir = homedir6()) {
+  return join6(homeDir, CONFIG_DIR_NAME, CONFIG_FILENAME);
 }
 function normalizeBaseUrl(value) {
   const raw = value.trim();
@@ -1453,29 +2109,32 @@ async function loadConfig(options = {}) {
   return toMoodleConfig(loaded.config, baseUrl);
 }
 async function promptForBaseUrl(options = {}) {
-  const prompt = options.prompt ?? defaultPrompt(options);
-  const output = options.stderr ?? process.stderr;
-  output.write("Configuration required\n");
-  output.write("Moodle base URL is not configured yet.\n");
-  output.write(`Runtime: ${process.versions.bun ? `bun ${process.versions.bun}` : `node ${process.versions.node}`}. Browser SQLite needs Bun or Node 22.13+. Run moodle doctor for diagnostics.
-`);
-  output.write("Required format: https://school.example.edu\n");
-  output.write("Use the site root only. Do not include paths like /login/index.php or /my/.\n");
+  const ui = createUi({ input: process.stdin, output: options.stderr ?? process.stderr, ...options.prompt ? { interactive: false } : {} });
+  const prompt = options.prompt ?? defaultPrompt(ui);
+  showWordmark(ui);
+  ui.intro("Moodle setup");
+  ui.note([
+    "Moodle base URL is not configured yet.",
+    `Runtime: ${process.versions.bun ? `bun ${process.versions.bun}` : `node ${process.versions.node}`}. Browser SQLite needs Bun or Node 22.13+. Run moodle doctor for diagnostics.`,
+    "Use the site root only, for example https://school.example.edu.",
+    "Do not include paths like /login/index.php or /my/."
+  ].join("\n"), "Configuration required");
   while (true) {
     let baseUrl;
     try {
       baseUrl = normalizeBaseUrl(await prompt("Moodle base URL"));
     } catch (error) {
-      output.write(`Invalid URL: ${error instanceof Error ? error.message : String(error)}
-`);
+      ui.warn(`Invalid URL: ${error instanceof Error ? error.message : String(error)}`);
       continue;
     }
-    const probe = await probeBaseUrl(baseUrl, options);
-    if (probe.ok) {
+    const spin = ui.spinner();
+    spin.start(`Checking ${baseUrl}`);
+    const probe2 = await probeBaseUrl(baseUrl, options);
+    if (probe2.ok) {
+      spin.stop(`${baseUrl} looks like Moodle`);
       return baseUrl;
     }
-    output.write(`Validation failed: ${probe.message ?? "site did not look like Moodle"}
-`);
+    spin.error(`Validation failed: ${probe2.message ?? "site did not look like Moodle"}`);
   }
 }
 async function probeBaseUrl(baseUrl, options = {}) {
@@ -1523,19 +2182,19 @@ async function loadExistingConfig(options) {
   const paths = [explicitPath, cwdConfigPath(options.cwd), userConfigPath(options.homeDir)].filter(
     (value) => Boolean(value)
   );
-  for (const path4 of paths) {
-    const config = await readConfigFile(path4, options);
+  for (const path5 of paths) {
+    const config = await readConfigFile(path5, options);
     if (config) {
-      return { config, path: path4 };
+      return { config, path: path5 };
     }
   }
   return { config: {}, path: explicitPath ?? null };
 }
-async function readConfigFile(path4, options) {
+async function readConfigFile(path5, options) {
   const fs = options.fs ?? nodeFs2;
   let raw;
   try {
-    raw = await fs.readFile(path4, "utf8");
+    raw = await fs.readFile(path5, "utf8");
   } catch (error) {
     if (isMissingFileError2(error)) {
       return null;
@@ -1544,34 +2203,24 @@ async function readConfigFile(path4, options) {
   }
   const parsed = YAML.parse(raw) ?? {};
   if (!isRecord3(parsed)) {
-    throw new ConfigError(`${path4} must contain a YAML object.`);
+    throw new ConfigError(`${path5} must contain a YAML object.`);
   }
   return parsed;
 }
-async function saveConfigFile(path4, config, options) {
+async function saveConfigFile(path5, config, options) {
   const fs = options.fs ?? nodeFs2;
-  await fs.mkdir(dirname3(path4), { recursive: true });
-  await fs.writeFile(path4, YAML.stringify(config, { sortMapEntries: true }), "utf8");
+  await fs.mkdir(dirname3(path5), { recursive: true });
+  await fs.writeFile(path5, YAML.stringify(config, { sortMapEntries: true }), "utf8");
 }
 function toMoodleConfig(config, baseUrl) {
   const { base_url: _baseUrl, ...rest } = config;
   return { ...rest, baseUrl };
 }
-function defaultPrompt(options) {
-  return async (label) => {
-    const rl = createInterface({
-      input: process.stdin,
-      output: options.stdout ?? process.stdout
-    });
-    try {
-      return await rl.question(`${label} > `);
-    } finally {
-      rl.close();
-    }
-  };
+function defaultPrompt(ui) {
+  return (label) => ui.text(label, { placeholder: "https://school.example.edu" });
 }
 function isInteractive(options) {
-  return Boolean((options.stdin ?? process.stdin).isTTY);
+  return Boolean((options.stdin ?? process.stdin).isTTY) && !isAgentEnvironment(options.env ?? process.env);
 }
 function isRecord3(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
@@ -1581,15 +2230,15 @@ function isMissingFileError2(error) {
 }
 
 // src/mcp/self-command.ts
-import { accessSync, constants, realpathSync } from "fs";
-import { delimiter, join as join5 } from "path";
+import { accessSync as accessSync2, constants as constants2, realpathSync } from "fs";
+import { delimiter, join as join7 } from "path";
 import { spawnSync } from "child_process";
 function findExecutable(name, env = process.env) {
   for (const dir of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     for (const suffix of process.platform === "win32" ? [".exe", ".cmd", ""] : [""]) {
-      const file2 = join5(dir, name + suffix);
+      const file2 = join7(dir, name + suffix);
       try {
-        accessSync(file2, constants.X_OK);
+        accessSync2(file2, constants2.X_OK);
         return realpathSync(file2);
       } catch {
       }
@@ -1619,9 +2268,9 @@ function runtimeCommand(command, args) {
 // src/keepalive.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { realpathSync as realpathSync2 } from "fs";
-import { mkdir as mkdir4, rm as rm3, stat, writeFile as writeFile4 } from "fs/promises";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname4, join as join6 } from "path";
+import { mkdir as mkdir5, rm as rm3, stat, writeFile as writeFile4 } from "fs/promises";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname4, join as join8 } from "path";
 async function touchMoodleSession(baseUrl, cookie, sesskey, fetchImpl = fetch, extend = true) {
   const methods = extend ? [FUNC_SESSION_TOUCH, FUNC_SESSION_TIME_REMAINING] : [FUNC_SESSION_TIME_REMAINING];
   const url = `${baseUrl.replace(/\/$/, "")}${AJAX_SERVICE_PATH}?sesskey=${encodeURIComponent(sesskey)}&info=${methods.join(",")}`;
@@ -1667,13 +2316,13 @@ async function touchMoodleSession(baseUrl, cookie, sesskey, fetchImpl = fetch, e
 async function keepAliveOnce(baseUrl, options = {}) {
   const session = await readCachedSession(baseUrl, {
     homeDir: options.homeDir,
-    ttlMs: Number.MAX_SAFE_INTEGER,
+    allowExpired: true,
     now: options.now
   });
   if (!session) {
     return { status: "no_session", time_remaining_seconds: null };
   }
-  const touch = await touchMoodleSession(
+  const touch = session.cookieInvalidated ? { alive: false, timeRemainingSeconds: null } : await touchMoodleSession(
     baseUrl,
     { name: session.cookieName, value: session.cookieValue },
     session.sesskey,
@@ -1689,6 +2338,10 @@ async function keepAliveOnce(baseUrl, options = {}) {
   if (options.renewOnExpiry === false) {
     return { status: "expired", time_remaining_seconds: null };
   }
+  if (session.mobileToken) {
+    const renewed = await renewViaMobileToken(baseUrl, session, options);
+    if (renewed) return renewed;
+  }
   const authenticate = options.authenticate ?? ((url) => getAuthenticatedSession(url, {
     homeDir: options.homeDir,
     fetch: options.fetchImpl,
@@ -1704,12 +2357,29 @@ async function keepAliveOnce(baseUrl, options = {}) {
     return { status: "expired", time_remaining_seconds: null };
   }
 }
+async function renewViaMobileToken(baseUrl, session, options) {
+  const result = await mintValidatedSession(baseUrl, session, { fetch: options.fetchImpl }).catch(() => null);
+  if (!result) return null;
+  await writeCachedSession(
+    {
+      ...session,
+      cookieInvalidated: false,
+      cookieName: result.cookie.name,
+      cookieValue: result.cookie.value,
+      cookieSource: result.cookie.source,
+      sesskey: result.context.sesskey,
+      savedAt: (options.now ?? Date.now)()
+    },
+    { homeDir: options.homeDir }
+  );
+  return { status: "reauthenticated", time_remaining_seconds: null };
+}
 async function getAuthStatus(baseUrl, options = {}) {
   const now = options.now ?? Date.now;
   const keepalive = await keepaliveStatus(options.homeDir);
   const session = await readCachedSession(baseUrl, {
     homeDir: options.homeDir,
-    ttlMs: Number.MAX_SAFE_INTEGER,
+    allowExpired: true,
     now: options.now
   });
   if (!session) {
@@ -1723,7 +2393,7 @@ async function getAuthStatus(baseUrl, options = {}) {
       keepalive_plist_path: keepalive.plist_path
     };
   }
-  const touch = await touchMoodleSession(
+  const touch = session.cookieInvalidated ? { alive: false, timeRemainingSeconds: null } : await touchMoodleSession(
     baseUrl,
     { name: session.cookieName, value: session.cookieValue },
     session.sesskey,
@@ -1741,11 +2411,11 @@ async function getAuthStatus(baseUrl, options = {}) {
     keepalive_plist_path: keepalive.plist_path
   };
 }
-function keepalivePlistPath(homeDir = homedir5()) {
-  return join6(homeDir, "Library/LaunchAgents", `${KEEPALIVE_LAUNCH_AGENT_LABEL}.plist`);
+function keepalivePlistPath(homeDir = homedir7()) {
+  return join8(homeDir, "Library/LaunchAgents", `${KEEPALIVE_LAUNCH_AGENT_LABEL}.plist`);
 }
-function keepaliveLogPath(homeDir = homedir5()) {
-  return join6(homeDir, CACHE_DIR_NAME, KEEPALIVE_LOG_FILENAME);
+function keepaliveLogPath(homeDir = homedir7()) {
+  return join8(homeDir, CACHE_DIR_NAME, KEEPALIVE_LOG_FILENAME);
 }
 function buildKeepalivePlist(programArguments2, intervalMinutes, logPath) {
   const args = programArguments2.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n");
@@ -1787,13 +2457,13 @@ async function installKeepalive(options = {}) {
       `This runtime (${process.version}) cannot read browser cookies, and the launch agent would be pinned to it. Reinstall with Node.js ${MINIMUM_NODE_FOR_BROWSER_COOKIES} or newer, or with Bun.`
     );
   }
-  const homeDir = options.homeDir ?? homedir5();
+  const homeDir = options.homeDir ?? homedir7();
   const intervalMinutes = options.intervalMinutes ?? KEEPALIVE_DEFAULT_INTERVAL_MINUTES;
   const plistPath = keepalivePlistPath(homeDir);
   const logPath = keepaliveLogPath(homeDir);
   const command = [selectedRuntime.command, ...selectedRuntime.args, "auth", "keepalive", "--json"];
-  await mkdir4(dirname4(plistPath), { recursive: true });
-  await mkdir4(dirname4(logPath), { recursive: true, mode: 448 });
+  await mkdir5(dirname4(plistPath), { recursive: true });
+  await mkdir5(dirname4(logPath), { recursive: true, mode: 448 });
   await writeFile4(plistPath, buildKeepalivePlist(command, intervalMinutes, logPath), "utf8");
   const runCommand = options.runCommand ?? spawnSync2;
   const uid = options.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
@@ -1808,7 +2478,7 @@ async function installKeepalive(options = {}) {
   return { plist_path: plistPath, interval_minutes: intervalMinutes, log_path: logPath, command };
 }
 async function uninstallKeepalive(options = {}) {
-  const homeDir = options.homeDir ?? homedir5();
+  const homeDir = options.homeDir ?? homedir7();
   const plistPath = keepalivePlistPath(homeDir);
   const runCommand = options.runCommand ?? spawnSync2;
   const uid = options.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
@@ -1816,7 +2486,7 @@ async function uninstallKeepalive(options = {}) {
   await rm3(plistPath, { force: true });
   return { installed: false, plist_path: plistPath };
 }
-async function keepaliveStatus(homeDir = homedir5()) {
+async function keepaliveStatus(homeDir = homedir7()) {
   const plistPath = keepalivePlistPath(homeDir);
   try {
     return { installed: (await stat(plistPath)).isFile(), plist_path: plistPath };
@@ -1829,20 +2499,21 @@ function escapeXml(value) {
 }
 
 // src/doctor.ts
-async function ownedJobs(homeDir = homedir6()) {
-  const root = join7(homeDir, "Library", "LaunchAgents");
-  const files = await readdir2(root).catch(() => []);
+async function ownedJobs(homeDir = homedir8()) {
+  const root = join9(homeDir, "Library", "LaunchAgents");
+  const files = await readdir3(root).catch(() => []);
   const jobs = [];
   for (const name of files.filter((n2) => n2 === "com.moodle-cli.keepalive.plist" || /^com\.moodle-cli\.mcp-renewal\.[a-z0-9_-]+\.plist$/u.test(n2))) {
-    const path4 = join7(root, name);
-    const content = await readFile4(path4, "utf8");
-    jobs.push({ path: path4, profile: name.match(/mcp-renewal\.(.+)\.plist$/u)?.[1], interpreter: content.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]+)<\/string>/u)?.[1] });
+    const path5 = join9(root, name);
+    const content = await readFile4(path5, "utf8");
+    jobs.push({ path: path5, profile: name.match(/mcp-renewal\.(.+)\.plist$/u)?.[1], interpreter: content.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]+)<\/string>/u)?.[1] });
   }
   return jobs;
 }
 async function doctor(options = {}) {
-  const home = options.homeDir ?? homedir6();
+  const home = options.homeDir ?? homedir8();
   const checks = [];
+  const stores = await browserCookieStores({ homeDir: home });
   const cookies = runtimeSupportsCookies();
   checks.push({ name: "sqlite", status: cookies ? "pass" : "fail", detail: `${process.versions.bun ? "bun" : "node"} ${process.versions.bun ?? process.versions.node}`, ...cookies ? {} : { hint: "Install Bun or Node 22.13+; Safari cookie reads do not require SQLite." } });
   let baseUrl;
@@ -1862,43 +2533,19 @@ async function doctor(options = {}) {
     const warnings = [];
     try {
       const found = await defaultBrowserCookieProvider(baseUrl, { homeDir: home, onCookieWarnings: (items) => warnings.push(...items) });
-      const blocked = warnings.some((w) => /EPERM|EACCES|permission denied|operation not permitted/iu.test(w));
-      checks.push({ name: "browser", status: blocked ? "fail" : found.length ? "pass" : "warn", detail: blocked ? "Browser store access was denied." : found.length ? `Cookie sources: ${[...new Set(found.map((c) => c.source || "browser"))].join(", ")}` : "No browser session found.", ...blocked ? { hint: "System Settings > Privacy & Security > Full Disk Access: enable the app running this command, then restart it." } : !found.length ? { hint: "Sign in to Moodle in a supported browser, then run moodle auth login." } : {} });
+      const blocked = !found.length && (cookieStoresBlocked(stores) || warnings.some((w) => /EPERM|EACCES|permission denied|operation not permitted/iu.test(w)));
+      checks.push({ name: "browser", status: blocked ? "fail" : found.length ? "pass" : "warn", detail: blocked ? `Browser store access was denied (${unreadableCookieStores(stores).length} unreadable store(s)).` : found.length ? `Cookie sources: ${[...new Set(found.map((c) => c.source || "browser"))].join(", ")}` : "No browser session found.", ...blocked ? { hint: `System Settings > Privacy & Security > Full Disk Access: enable ${hostApplicationName(options.env) ?? "the app running this command"}, then restart it.` } : !found.length ? { hint: "Sign in to Moodle in a supported browser, then run moodle auth login." } : {} });
     } catch {
       checks.push({ name: "browser", status: "warn", detail: "Could not inspect browser stores.", hint: "Run moodle auth login from a regular terminal." });
     }
   }
-  const stores = [];
-  if (process.platform === "darwin") {
-    for (const [browser, directory] of [["Chrome", "Google/Chrome"], ["Edge", "Microsoft Edge"], ["Brave", "BraveSoftware/Brave-Browser"], ["Firefox", "Firefox/Profiles"]]) {
-      const root = join7(home, "Library/Application Support", directory);
-      for (const profile of await readdir2(root).catch(() => [])) {
-        if (browser !== "Firefox" && profile !== "Default" && !profile.startsWith("Profile ")) continue;
-        for (const name of browser === "Firefox" ? ["cookies.sqlite"] : ["Cookies", "Network/Cookies"]) {
-          const file2 = join7(root, profile, name);
-          try {
-            await access(file2);
-            stores.push({ browser, path: file2, readable: await access(file2, constants2.R_OK).then(() => true, () => false) });
-          } catch {
-          }
-        }
-      }
-    }
-    for (const file2 of [join7(home, "Library/Cookies/Cookies.binarycookies"), join7(home, "Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies")]) {
-      try {
-        await access(file2);
-        stores.push({ browser: "Safari", path: file2, readable: await access(file2, constants2.R_OK).then(() => true, () => false) });
-      } catch {
-      }
-    }
-  }
   const jobs = await ownedJobs(home);
   for (const job of jobs) {
-    const present = job.interpreter ? await access(job.interpreter, constants2.X_OK).then(() => true, () => false) : false;
+    const present = job.interpreter ? await access3(job.interpreter, constants3.X_OK).then(() => true, () => false) : false;
     const supported = present && (job.interpreter === process.execPath && !runtimeCommand().args.length || runtimeSupportsCookies(job.interpreter));
     checks.push({ name: "job", status: supported ? "pass" : "warn", detail: `${job.path}: ${job.interpreter ?? "missing interpreter"}`, ...!supported ? { hint: job.profile ? "Run moodle mcp deploy to repair renewal." : "Run moodle auth keepalive install." } : {} });
   }
-  const profiles = await readdir2(join7(home, ".config", "moodle-cli", "mcp", "deployments")).catch(() => []);
+  const profiles = await readdir3(join9(home, ".config", "moodle-cli", "mcp", "deployments")).catch(() => []);
   checks.push({ name: "mcp", status: profiles.length ? "pass" : "warn", detail: profiles.length ? `${profiles.length} local deployment receipts. Run moodle mcp status for remote readiness.` : "No managed MCP deployment; optional for CLI use." });
   let pin;
   try {
@@ -1909,8 +2556,8 @@ async function doctor(options = {}) {
 }
 
 // src/cli.ts
-import { rm as rm7, readdir as readdir3 } from "fs/promises";
-import { homedir as homedir12 } from "os";
+import { rm as rm7, readdir as readdir4 } from "fs/promises";
+import { homedir as homedir15 } from "os";
 
 // src/mcp/renewal/decision.ts
 function decideRenewal(snapshot) {
@@ -2047,7 +2694,7 @@ function macOSPlan(options, intervalMinutes) {
     throw new Error("macOS renewal installation requires the current user ID");
   }
   const label = `com.moodle-cli.mcp-renewal.${options.profile}`;
-  const path4 = `${trimEnd(options.homeDirectory, "/")}/Library/LaunchAgents/${label}.plist`;
+  const path5 = `${trimEnd(options.homeDirectory, "/")}/Library/LaunchAgents/${label}.plist`;
   const target = `gui/${options.uid}`;
   const logPath = `${trimEnd(options.homeDirectory, "/")}/Library/Logs/${label}.log`;
   const plist = [
@@ -2069,12 +2716,12 @@ function macOSPlan(options, intervalMinutes) {
     platform: "darwin",
     profile: options.profile,
     label,
-    files: [{ path: path4, content: plist, mode: 384 }],
+    files: [{ path: path5, content: plist, mode: 384 }],
     installCommands: [
-      { command: "launchctl", args: ["bootout", target, path4], ignoreFailure: true },
-      { command: "launchctl", args: ["bootstrap", target, path4] }
+      { command: "launchctl", args: ["bootout", target, path5], ignoreFailure: true },
+      { command: "launchctl", args: ["bootstrap", target, path5] }
     ],
-    removeCommands: [{ command: "launchctl", args: ["bootout", target, path4], ignoreFailure: true }]
+    removeCommands: [{ command: "launchctl", args: ["bootout", target, path5], ignoreFailure: true }]
   };
 }
 function linuxPlan(options, intervalMinutes) {
@@ -2125,7 +2772,7 @@ function linuxPlan(options, intervalMinutes) {
 }
 function windowsPlan(options, intervalMinutes) {
   const label = `Moodle CLI MCP Renewal (${options.profile})`;
-  const path4 = `${trimEnd(options.homeDirectory, "\\/")}\\AppData\\Local\\moodle-cli\\renewal\\${options.profile}.xml`;
+  const path5 = `${trimEnd(options.homeDirectory, "\\/")}\\AppData\\Local\\moodle-cli\\renewal\\${options.profile}.xml`;
   const argumentsText = [...options.executableArgs ?? [], ...renewalArgs(options.profile)].map(windowsArgument).join(" ");
   const task = [
     '<?xml version="1.0" encoding="UTF-8"?>',
@@ -2145,8 +2792,8 @@ function windowsPlan(options, intervalMinutes) {
     platform: "win32",
     profile: options.profile,
     label,
-    files: [{ path: path4, content: task, mode: 384 }],
-    installCommands: [{ command: "schtasks.exe", args: ["/Create", "/TN", label, "/XML", path4, "/F"] }],
+    files: [{ path: path5, content: task, mode: 384 }],
+    installCommands: [{ command: "schtasks.exe", args: ["/Create", "/TN", label, "/XML", path5, "/F"] }],
     removeCommands: [{ command: "schtasks.exe", args: ["/Delete", "/TN", label, "/F"], ignoreFailure: true }]
   };
 }
@@ -2199,24 +2846,24 @@ async function sendRenewalNotification(kind, sender) {
 }
 
 // src/mcp/renewal/node-renewal.ts
-import { execFile as execFileCallback2 } from "child_process";
-import { chmod as chmod3, mkdir as mkdir5, readFile as readFile5, rm as rm4, writeFile as writeFile5 } from "fs/promises";
-import { homedir as homedir7 } from "os";
+import { execFile as execFileCallback } from "child_process";
+import { chmod as chmod3, mkdir as mkdir6, readFile as readFile5, rm as rm4, writeFile as writeFile5 } from "fs/promises";
+import { homedir as homedir9 } from "os";
 import { dirname as dirname5 } from "path";
 import { promisify } from "util";
-var execFile = promisify(execFileCallback2);
+var execFile = promisify(execFileCallback);
 var NodeRenewalInstallerIO = class {
-  async writePrivate(path4, content, mode) {
-    await mkdir5(dirname5(path4), { recursive: true, mode: 448 });
-    await writeFile5(path4, content, { encoding: "utf8", mode });
-    await chmod3(path4, mode);
+  async writePrivate(path5, content, mode) {
+    await mkdir6(dirname5(path5), { recursive: true, mode: 448 });
+    await writeFile5(path5, content, { encoding: "utf8", mode });
+    await chmod3(path5, mode);
   }
-  async removeFile(path4) {
-    await rm4(path4, { force: true });
+  async removeFile(path5) {
+    await rm4(path5, { force: true });
   }
-  async exists(path4) {
+  async exists(path5) {
     try {
-      await readFile5(path4);
+      await readFile5(path5);
       return true;
     } catch (error) {
       if (isMissing2(error)) {
@@ -2246,7 +2893,7 @@ function createDefaultRenewalInstaller(profile, options = {}) {
     profile,
     executable: runtime.command,
     executableArgs: runtime.args,
-    homeDirectory: options.homeDirectory ?? homedir7(),
+    homeDirectory: options.homeDirectory ?? homedir9(),
     uid: options.uid ?? (typeof process.getuid === "function" ? process.getuid() : void 0),
     intervalMinutes: options.intervalMinutes
   });
@@ -2334,13 +2981,14 @@ var MoodleGatewayError = class extends Error {
     this.code = code;
   }
 };
-function createMoodleGateway(client) {
+function createMoodleGateway(client, hooks = {}) {
   return {
     getUser: () => client.getSiteInfo(),
     listThreads: (id2) => client.getForumDiscussionRefs ? client.getForumDiscussionRefs(id2) : Promise.resolve([]),
     listNewsForums: (id2) => client.getNewsForums ? client.getNewsForums(id2) : Promise.resolve([]),
     getOverview: (input2) => client.getOverview(input2.todoLimit, input2.todoDays, input2.alertsLimit),
     ...client.getTodo ? { getDue: (days, courseId) => client.getTodo(Number.MAX_SAFE_INTEGER, days, courseId) } : {},
+    ...client.submitAssignmentFiles ? { submitAssignment: (input2) => client.submitAssignmentFiles({ ...input2, ...hooks.onSubmitProgress ? { onProgress: hooks.onSubmitProgress } : {} }) } : {},
     listCourses: () => client.getCourses(),
     async getCourse({ courseId }) {
       const [courses, sections] = await Promise.all([
@@ -2658,9 +3306,9 @@ function splitUnitPhrase(phrase, courses) {
 }
 
 // src/intents.ts
-async function inParallel(items, size, run) {
+async function inParallel(items, size2, run) {
   const results = [];
-  for (let index = 0; index < items.length; index += size) results.push(...await Promise.all(items.slice(index, index + size).map(run)));
+  for (let index = 0; index < items.length; index += size2) results.push(...await Promise.all(items.slice(index, index + size2).map(run)));
   return results;
 }
 function createIntentService(gateway, now = () => Date.now()) {
@@ -2851,6 +3499,12 @@ function createIntentService(gateway, now = () => Date.now()) {
         result = { file: { name: file2.name, mime_type: file2.mimeType, bytes: file2.bytes, uri: file2.uri } };
         break;
       }
+      case "submit": {
+        if (!gateway.submitAssignment) throw new MoodleGatewayError("MOODLE_TOOL_UNAVAILABLE", "Submitting needs local files; run moodle submit or the local MCP server on the machine that holds them.");
+        const activityId = await resolveItem(input2.ref);
+        result = { submission: await gateway.submitAssignment({ activityId, files: input2.files, final: Boolean(input2.final), replace: Boolean(input2.replace), acceptStatement: Boolean(input2.accept_statement), dryRun: Boolean(input2.dry_run) }) };
+        break;
+      }
     }
     return intentContracts[name].output.parse(stripEmpty(result));
   }
@@ -2861,16 +3515,31 @@ function createIntentService(gateway, now = () => Date.now()) {
   return { run, resolveItem, fileSource, find, sections };
 }
 
+// src/screens.ts
+import { createTheme as createTheme2 } from "@bunizao/cli-kit";
+
 // src/terminal-table.ts
+import { createTheme } from "@bunizao/cli-kit";
 var DEFAULT_WIDTH = 120;
+var TONED_LABEL = /status|state|type|grade|due|ok|action|grading/iu;
+var colorEnabled = () => false;
+function configureTerminalTables(options) {
+  colorEnabled = options.color;
+}
 function renderTerminalTable(columns, rows, options = {}) {
+  const theme = createTheme(colorEnabled());
   const width = Math.max(20, options.width ?? process.stdout.columns ?? DEFAULT_WIDTH);
-  const clean = rows.map((row) => columns.map((_, i) => sanitizeTerminalText(row[i] ?? "").replace(/\s+/gu, " ")));
+  const cellText = (cell) => typeof cell === "string" ? cell : cell?.text ?? "";
+  const tones = rows.map((row) => columns.map((_, i) => {
+    const cell = row[i];
+    return typeof cell === "object" ? cell.tone : void 0;
+  }));
+  const clean = rows.map((row) => columns.map((_, i) => sanitizeTerminalText(cellText(row[i])).replace(/\s+/gu, " ")));
   const lengths = columns.map((c, i) => Math.max(c.label.length, ...clean.map((r) => Array.from(r[i]).length)));
   const flexible = columns.map((c, i) => c.flex || /name|title|subject|feedback|description|value|course|unit/iu.test(c.label) ? i : -1).filter((i) => i >= 0);
   const widths = columns.map((c, i) => c.width ?? (flexible.includes(i) ? Math.min(lengths[i], 36) : lengths[i]));
   const minimum = widths.reduce((n2, w, i) => n2 + (flexible.includes(i) ? 8 : w), 0) + columns.length * 3 + 1;
-  const title = options.title ? [sanitizeTerminalText(options.title)] : [];
+  const title = options.title ? [theme.subject(sanitizeTerminalText(options.title))] : [];
   if (width < 60 || minimum > width) {
     const wrap = (line2) => Array.from(line2).reduce((lines, char) => {
       if (!lines.length || Array.from(lines.at(-1)).length >= width) lines.push("");
@@ -2889,9 +3558,22 @@ function renderTerminalTable(columns, rows, options = {}) {
     const trimmed = chars.length > w ? `${chars.slice(0, w - 1).join("")}\u2026` : v;
     return trimmed + " ".repeat(Math.max(0, w - Array.from(trimmed).length));
   };
-  const border = (l, m, r) => l + widths.map((w) => "\u2500".repeat(w + 2)).join(m) + r;
-  const line = (row) => "\u2502" + widths.map((w, i) => ` ${fit(row[i] ?? "", w)} `).join("\u2502") + "\u2502";
-  return [...title, border("\u250C", "\u252C", "\u2510"), line(columns.map((c) => c.label)), border("\u251C", "\u253C", "\u2524"), ...clean.map(line), border("\u2514", "\u2534", "\u2518")].join("\n");
+  const paint = (cell, i, row, tone) => {
+    if (tone) return theme.tone(tone, cell);
+    if (options.keyValue) return i === 0 ? theme.dim(cell) : /status|grading|action/iu.test(row[0] ?? "") ? theme.status(cell) : cell;
+    return i === 0 ? theme.key(cell) : TONED_LABEL.test(columns[i]?.label ?? "") ? theme.status(cell) : cell;
+  };
+  const border = (l, m, r) => theme.dim(l + widths.map((w) => "\u2500".repeat(w + 2)).join(m) + r);
+  const bar = theme.dim("\u2502");
+  const line = (row, paintCell) => bar + widths.map((w, i) => ` ${paintCell(fit(row[i] ?? "", w), i)} `).join(bar) + bar;
+  return [
+    ...title,
+    border("\u250C", "\u252C", "\u2510"),
+    line(columns.map((c) => c.label), (cell) => theme.dim(cell)),
+    border("\u251C", "\u253C", "\u2524"),
+    ...clean.map((row, r) => line(row, (cell, i) => paint(cell, i, row, tones[r][i]))),
+    border("\u2514", "\u2534", "\u2518")
+  ].join("\n");
 }
 function renderKeyValueTable(rows, options = {}) {
   const present = rows.filter(([, value]) => value !== "");
@@ -2903,10 +3585,10 @@ No details` : "No details";
     { label: "Field" },
     { label: "Value" }
   ];
-  return renderTerminalTable(columns, present, options);
+  return renderTerminalTable(columns, present, { ...options, keyValue: true });
 }
 function sanitizeTerminalText(value) {
-  return value.replace(/\r\n?/gu, "\n").replace(/\t/gu, " ").replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/gu, "");
+  return value.replace(/\r\n?/gu, "\n").replace(/\t/gu, " ").replace(/[---Ÿ]/gu, "");
 }
 
 // src/screens.ts
@@ -2924,21 +3606,29 @@ function moment(value, now) {
   const sameYear = new Date(now).getFullYear() === Number(year);
   return `${weekday} ${Number(day)} ${MONTHS[Number(month) - 1]}${sameYear ? "" : ` ${year}`}${hour ? `, ${hour}:${minute}` : ""}`;
 }
+function tryLines(commands) {
+  return commands.map((command, index) => `${index ? "     " : "Try  "}${command}`).join("\n");
+}
 function renderScreen(data, options = {}) {
   const lines = [];
   const now = options.now ?? Date.now();
-  const dueText = (row) => {
-    if (!row.due_at) return text(row.status || row.submission_status);
+  const theme = createTheme2(Boolean(options.color));
+  const due = (row) => {
     const days = Math.ceil((Number(row.due_at) * 1e3 - now) / 864e5);
     const value = `${days < 0 ? `${-days} days overdue` : days === 0 ? "today" : days === 1 ? "tomorrow" : `in ${days} days`} \xB7 ${moment(row.due, now)}`;
-    return options.color && days <= 2 ? `\x1B[${days < 0 ? 31 : 33}m${value}\x1B[0m` : value;
+    return { text: value, tone: days < 0 ? "danger" : days <= 2 ? "warning" : "muted" };
+  };
+  const dueText = (row) => {
+    if (!row.due_at) return theme.status(text(row.status || row.submission_status));
+    const { text: value, tone } = due(row);
+    return theme.tone(tone, value);
   };
   const rows = (items, title) => {
-    lines.push(title);
-    if (!items.length) lines.push("  None");
-    for (const r of items) lines.push(`  ${text(r.unit_code || r.type)}  ${text(r.name)}${r.due_at ? `  ${dueText(r)}` : ""}${r.id ? `  #${r.id}` : ""}`);
+    lines.push(theme.subject(title));
+    if (!items.length) lines.push(theme.dim("  None"));
+    for (const r of items) lines.push(`  ${theme.key(text(r.unit_code || r.type))}  ${text(r.name)}${r.due_at ? `  ${dueText(r)}` : ""}${r.id ? `  ${theme.dim(`#${r.id}`)}` : ""}`);
   };
-  let next = "moodle due --days 30 \xB7 moodle grades";
+  let next = ["moodle due --days 30", "moodle grades"];
   if (data.home) {
     const h = record(data.home);
     lines.push(`${text(h.name)} \xB7 ${moment(h.today, now)} \xB7 ${text(h.timezone)}${h.timezone_source === "site" ? "" : ` (${text(h.timezone_source)})`}`, text(h.siteurl), "");
@@ -2969,11 +3659,12 @@ function renderScreen(data, options = {}) {
       rows(array(data.news), "Latest news");
     }
     const unit = JSON.stringify(u.code || u.name);
-    next = array(data.sections).some((s2) => s2.activities) ? `moodle ${unit} "TASK" \xB7 moodle get "UNIT TASK" --to .` : `moodle ${unit} SECTION \xB7 moodle ${unit} grades`;
+    next = array(data.sections).some((s2) => s2.activities) ? [`moodle ${unit} "TASK"`, `moodle get "UNIT TASK" --to .`] : [`moodle ${unit} SECTION`, `moodle ${unit} grades`];
   } else if (data.grades) {
     for (const g of array(data.grades)) {
       lines.push(`${text(g.code)} \xB7 ${g.graded} of ${g.total} graded`);
-      lines.push(renderTerminalTable([{ label: "Name", flex: true }, { label: "Grade" }, { label: "Range" }, { label: "Feedback", flex: true }], array(g.items).map((i) => [text(i.name), text(i.grade), text(i.range), text(i.feedback || (i.due ? dueText(i) : ""))]), { width: options.width }));
+      const feedback = (i) => i.feedback ? text(i.feedback) : i.due_at ? due(i) : "";
+      lines.push(renderTerminalTable([{ label: "Name", flex: true }, { label: "Grade" }, { label: "Range" }, { label: "Feedback", flex: true }], array(g.items).map((i) => [text(i.name), text(i.grade), text(i.range), feedback(i)]), { width: options.width }));
     }
   } else if (data.item) {
     const i = record(data.item);
@@ -2981,13 +3672,13 @@ function renderScreen(data, options = {}) {
     for (const [k, v] of Object.entries(i)) if (!["id", "name", "type", "files"].includes(k) && !k.endsWith("_at") && typeof v !== "object") lines.push(`${k.replaceAll("_", " ")}: ${moment(v, now)}`);
     for (const f of array(i.files)) lines.push(`File  ${text(f.name)}  ${text(f.url)}`);
     if (data.threads) rows(array(data.threads), "Threads");
-    next = `moodle get ${i.id} --to DIR`;
+    next = [`moodle get ${i.id} --to DIR`];
   } else if (data.thread) {
     const t = record(data.thread);
     lines.push(text(t.name));
     for (const p of array(t.posts)) lines.push("", `${text(record(p.author).name)} \xB7 ${moment(p.created, now)}`, text(p.message_text), ...array(p.links).map((l) => `${text(l.text)} ${text(l.url)}`));
     lines.push(`Posts ${Number(t.offset) + array(t.posts).length} of ${t.posts_total}`);
-    next = `moodle threads show ${t.id} --offset ${Number(t.offset) + array(t.posts).length}`;
+    next = [`moodle threads show ${t.id} --offset ${Number(t.offset) + array(t.posts).length}`];
   } else if (data.news) {
     for (const n2 of array(data.news)) {
       const p = record(n2.post);
@@ -2995,13 +3686,13 @@ function renderScreen(data, options = {}) {
     }
   } else if (data.units) {
     lines.push(renderTerminalTable([{ label: "ID" }, { label: "Code" }, { label: "Name", flex: true }], array(data.units).map((u) => [text(u.id), text(u.code), text(u.name)]), { width: options.width }));
-    next = "moodle UNIT \xB7 moodle find QUERY";
+    next = ["moodle UNIT", "moodle find QUERY"];
   } else {
     const key = ["due", "results", "activities", "forums"].find((k) => k in data);
     rows(array(key ? data[key] : []), key === "due" ? "Due" : "Matches");
     if (data.total !== void 0) lines.push(`${data.total} total`);
   }
-  lines.push("", `Try  ${next}`);
+  lines.push("", ...tryLines(next).split("\n").map((line) => theme.dim(line)));
   const width = Math.max(40, options.width || 80);
   return lines.flatMap((line) => {
     if (line.includes("\x1B[") || line.startsWith("\u2502") || /^[┌└├]/u.test(line)) return [line];
@@ -3022,12 +3713,20 @@ function renderScreen(data, options = {}) {
 }
 
 // src/cli.ts
-import { createInterface as createInterface4 } from "readline/promises";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import {
+  banner,
+  colorEnabled as colorEnabled2,
   confirm,
   createProgram,
+  createTheme as createTheme3,
+  createUi as createUi3,
+  detectAudience,
+  examples,
+  helpSection,
   insertDefaultVerb,
+  isInformationalExit,
+  parseWithPrompts,
   render,
   reportError,
   normalizeError,
@@ -3036,12 +3735,15 @@ import {
   writeOutput
 } from "@bunizao/cli-kit";
 import { realpathSync as realpathSync3 } from "fs";
-import path3 from "path";
+import path4 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/moodle-client-core.ts
 import { z as z2 } from "zod";
 
+// src/moodle-assign-core.ts
+import { parse as parse4 } from "node-html-parser";
+
 // src/html-utils.ts
 import { parse as parse2 } from "node-html-parser";
 function htmlToStructuredContent(html, baseUrl) {
@@ -3111,262 +3813,6 @@ function decodeHtml2(value) {
   return value.replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
 }
 
-// src/parsers.ts
-function schema(parser) {
-  return { parse: parser };
-}
-var UserInfoSchema = schema(parseUserInfo);
-var CourseSchema = schema(parseCourse);
-var CoursesSchema = schema(parseCourses);
-var ActivitySchema = schema(parseActivity);
-var SectionSchema = schema(parseSection);
-var CourseContentsSchema = schema(parseCourseContents);
-var TodoItemSchema = schema(parseTodoItem);
-function parseUserInfo(value) {
-  const data = asRecord(value);
-  return {
-    userid: numberValue(data.userid),
-    username: stringValue(data.username),
-    fullname: stringValue(data.fullname),
-    sitename: stringValue(data.sitename),
-    siteurl: stringValue(data.siteurl),
-    lang: stringValue(data.lang),
-    ...data.timezone ? { timezone: String(data.timezone) } : {}
-  };
-}
-function parseCourse(value, nowSeconds = Math.floor(Date.now() / 1e3)) {
-  const data = asRecord(value);
-  const course = {
-    id: numberValue(data.id),
-    shortname: stringValue(data.shortname),
-    fullname: stringValue(data.fullname),
-    category: numberValue(data.category),
-    visible: booleanValue(data.visible, true),
-    startdate: numberValue(data.startdate)
-  };
-  const enddate = numberValue(data.enddate);
-  if (enddate > 0) {
-    course.enddate = enddate;
-  }
-  return course;
-}
-function parseCourses(value) {
-  return asArray(value).map((item) => parseCourse(item));
-}
-function parseActivity(value) {
-  const data = asRecord(value);
-  return {
-    id: numberValue(data.id),
-    name: stringValue(data.name),
-    modname: stringValue(data.modname),
-    url: stringValue(data.url),
-    visible: booleanValue(data.visible, true),
-    description: stringValue(data.description),
-    ...data.completiondata && typeof data.completiondata === "object" ? { completion: numberValue(asRecord(data.completiondata).state) } : {},
-    ...Array.isArray(data.contents) ? { file_entries: data.contents.filter((f) => asRecord(f).fileurl).map((f) => ({ name: stringValue(asRecord(f).filename), url: stringValue(asRecord(f).fileurl), requires_authentication: true })) } : {}
-  };
-}
-function parseSection(value) {
-  const data = asRecord(value);
-  return {
-    id: numberValue(data.id),
-    name: stringValue(data.name),
-    section: numberValue(data.section),
-    visible: booleanValue(data.visible, true),
-    summary: stringValue(data.summary),
-    ...data.current !== void 0 ? { current: booleanValue(data.current) } : {},
-    activities: asArray(data.modules).map((item) => parseActivity(item))
-  };
-}
-function parseCourseContents(value) {
-  return asArray(value).map((item) => parseSection(item));
-}
-function parseCourseFormatState(value, baseUrl) {
-  const state = asRecord(parseJsonValue(value));
-  const activities = /* @__PURE__ */ new Map();
-  const activitiesBySection = /* @__PURE__ */ new Map();
-  for (const item of asArray(state.cm)) {
-    const data = asRecord(item);
-    const id2 = numberValue(data.id);
-    const sectionId = stringValue(data.sectionid);
-    const module = stringValue(data.module) || stringValue(data.plugin).replace(/^mod_/u, "") || stringValue(data.modname).toLowerCase();
-    const activity = {
-      id: id2,
-      name: htmlText(data.name, baseUrl),
-      modname: module.toLowerCase(),
-      url: stringValue(data.url) ? resolveUrl(baseUrl, stringValue(data.url)) : "",
-      visible: booleanValue(data.visible, true) && booleanValue(data.uservisible, true) && !booleanValue(data.stealth),
-      description: htmlText(data.content ?? data.description, baseUrl),
-      ...data.completionstate !== void 0 && data.completionstate !== null ? { completion: numberValue(data.completionstate) } : {}
-    };
-    activities.set(String(id2), activity);
-    const sectionActivities = activitiesBySection.get(sectionId) ?? [];
-    sectionActivities.push(activity);
-    activitiesBySection.set(sectionId, sectionActivities);
-  }
-  return asArray(state.section).map((item) => {
-    const data = asRecord(item);
-    const id2 = numberValue(data.id);
-    const hasActivityList = Array.isArray(data.cmlist);
-    const listedActivities = asArray(data.cmlist).map((activityId) => activities.get(stringValue(activityId))).filter((activity) => activity !== void 0);
-    return {
-      id: id2,
-      name: htmlText(data.title || data.rawtitle, baseUrl),
-      section: numberValue(data.section ?? data.number),
-      visible: booleanValue(data.visible, true),
-      summary: htmlText(data.summary, baseUrl),
-      ...data.current !== void 0 ? { current: booleanValue(data.current) } : {},
-      activities: hasActivityList ? listedActivities : activitiesBySection.get(String(id2)) ?? []
-    };
-  });
-}
-function parseTodoItem(value) {
-  const data = asRecord(value);
-  const course = asRecord(data.course);
-  const action = asRecord(data.action);
-  const progress = course.progress;
-  return {
-    id: numberValue(data.id),
-    name: stringValue(data.name),
-    activity_name: stringValue(data.activityname),
-    modname: stringValue(data.modulename),
-    course_id: numberValue(course.id),
-    course_name: stringValue(course.fullname),
-    due_at: numberValue(data.timesort) || numberValue(data.timestart),
-    overdue: booleanValue(data.overdue),
-    actionable: booleanValue(action.actionable),
-    action_name: stringValue(action.name),
-    action_url: stringValue(action.url),
-    url: stringValue(data.url),
-    event_type: stringValue(data.eventtype),
-    course_progress: typeof progress === "number" ? progress : void 0
-  };
-}
-function parseTodoItems(value) {
-  return asArray(value).map((item) => parseTodoItem(item));
-}
-function parseAlertNotification(value) {
-  const data = asRecord(value);
-  return {
-    id: numberValue(data.id),
-    subject: stringValue(data.subject),
-    short_subject: stringValue(data.shortenedsubject),
-    event_type: stringValue(data.eventtype),
-    component: stringValue(data.component),
-    created_at: numberValue(data.timecreated),
-    created_pretty: stringValue(data.timecreatedpretty),
-    read: booleanValue(data.read),
-    context_url: stringValue(data.contexturl),
-    context_name: stringValue(data.contexturlname)
-  };
-}
-function parseAlertSummary(notificationsData, countsData, unreadCountsData) {
-  const notificationsRecord = asRecord(notificationsData);
-  const counts2 = asRecord(countsData);
-  const unreadCounts = asRecord(unreadCountsData);
-  const types = asRecord(counts2.types);
-  const unreadTypes = asRecord(unreadCounts.types);
-  const notifications = asArray(notificationsRecord.notifications).map((item) => parseAlertNotification(item));
-  return {
-    notifications,
-    notification_count: notifications.length,
-    unread_notification_count: notifications.filter((notification) => !notification.read).length,
-    starred_message_count: numberValue(counts2.favourites),
-    direct_message_count: numberValue(types["1"]),
-    group_message_count: numberValue(types["2"]),
-    self_message_count: numberValue(types["3"]),
-    unread_starred_message_count: numberValue(unreadCounts.favourites),
-    unread_direct_message_count: numberValue(unreadTypes["1"]),
-    unread_group_message_count: numberValue(unreadTypes["2"]),
-    unread_self_message_count: numberValue(unreadTypes["3"])
-  };
-}
-function parseForumPostAuthor(value) {
-  const data = asRecord(value);
-  const urls = asRecord(data.urls);
-  return {
-    id: numberValue(data.id),
-    fullname: stringValue(data.fullname),
-    profile_url: stringValue(urls.profile),
-    profile_image_url: stringValue(urls.profileimage)
-  };
-}
-function parseForumPost(value, baseUrl = "") {
-  const data = asRecord(value);
-  const urls = asRecord(data.urls);
-  const messageHtml = stringValue(data.message);
-  const structured = htmlToStructuredContent(messageHtml, stringValue(urls.view || urls.discuss) || baseUrl);
-  return {
-    id: numberValue(data.id),
-    discussion_id: numberValue(data.discussionid),
-    subject: stringValue(data.subject),
-    message_html: messageHtml,
-    message_text: structured.text,
-    image_urls: structured.image_urls,
-    links: structured.links,
-    tables: structured.tables,
-    author: parseForumPostAuthor(data.author),
-    parent_id: numberValue(data.parentid),
-    time_created: numberValue(data.timecreated),
-    time_modified: numberValue(data.timemodified),
-    created_pretty: "",
-    unread: booleanValue(data.unread),
-    is_deleted: booleanValue(data.isdeleted),
-    is_private_reply: booleanValue(data.isprivatereply),
-    url: stringValue(urls.view || urls.viewisolated),
-    reply_url: stringValue(urls.reply)
-  };
-}
-function parseForumDiscussion(value, discussionId, baseUrl = "") {
-  const data = asRecord(value);
-  const posts = asArray(data.posts).map((item) => parseForumPost(item, baseUrl));
-  return {
-    id: discussionId,
-    subject: posts[0]?.subject ?? "",
-    course_id: numberValue(data.courseid),
-    forum_id: numberValue(data.forumid),
-    group_id: numberValue(data.groupid),
-    group_name: stringValue(data.groupname),
-    url: posts[0]?.url ? posts[0].url.split("#", 1)[0] : "",
-    posts
-  };
-}
-function asRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function asArray(value) {
-  return Array.isArray(value) ? value : [];
-}
-function stringValue(value) {
-  return typeof value === "string" ? value : value == null ? "" : String(value);
-}
-function numberValue(value) {
-  if (typeof value === "number" && Number.isFinite(value)) {
-    return value;
-  }
-  if (typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value))) {
-    return Number(value);
-  }
-  return 0;
-}
-function booleanValue(value, defaultValue = false) {
-  if (value === void 0 || value === null) {
-    return defaultValue;
-  }
-  return Boolean(value);
-}
-function parseJsonValue(value) {
-  if (typeof value !== "string") return value;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return {};
-  }
-}
-function htmlText(value, baseUrl) {
-  return htmlToStructuredContent(stringValue(value), baseUrl).text;
-}
-
 // src/scraper.ts
 import { parse as parse3 } from "node-html-parser";
 function parseMoodleErrorHtml(html) {
@@ -3398,8 +3844,8 @@ function parseMoodleErrorHtml(html) {
 function parsePageContext(html, baseUrl) {
   const root = parse3(html);
   const config = parseMoodleConfig(html);
-  const sesskey = stringValue2(config.sesskey).trim();
-  const userid = numberValue2(config.userId) || numberValue2(root.querySelector("[data-user-id]")?.getAttribute("data-user-id"));
+  const sesskey = stringValue(config.sesskey).trim();
+  const userid = numberValue(config.userId) || numberValue(root.querySelector("[data-user-id]")?.getAttribute("data-user-id"));
   if (!sesskey || !userid) {
     throw new Error("Session appears invalid: could not load authenticated Moodle context");
   }
@@ -3411,8 +3857,8 @@ function parsePageContext(html, baseUrl) {
       fullname: cleanNodeText(root.querySelector(".userfullname")),
       sitename: extractSitename(root),
       siteurl: baseUrl,
-      ...config.timezone ? { timezone: stringValue2(config.timezone) } : {},
-      lang: stringValue2(config.language) || root.querySelector("html")?.getAttribute("lang") || ""
+      ...config.timezone ? { timezone: stringValue(config.timezone) } : {},
+      lang: stringValue(config.language) || root.querySelector("html")?.getAttribute("lang") || ""
     }
   };
 }
@@ -3895,62 +4341,671 @@ function extractSitename(root) {
 function pageTitle(html) {
   return cleanNodeText(parse3(html).querySelector("h1"));
 }
-function activityContext(html) {
-  const root = parse3(html);
-  const context = { course_id: parseCourseIdFromPageHtml(html) ?? 0, course_name: "", section_name: "" };
-  const breadcrumbs = root.querySelectorAll('nav[aria-label="Breadcrumb"] a[href], #page-navbar .breadcrumb a[href]');
-  const links = breadcrumbs.length ? breadcrumbs : root.querySelectorAll('a[href*="/course/view.php?id="]');
-  for (const link2 of links) {
-    const href = link2.getAttribute("href") ?? "";
-    const courseId = numberQueryValue(href, "id");
-    if (courseId !== null) {
-      context.course_id = courseId;
-    }
-    if (numberQueryValue(href, "section") === null) {
-      context.course_name ||= cleanNodeText(link2);
-    } else {
-      context.section_name = cleanNodeText(link2);
-    }
-  }
-  return context;
+function activityContext(html) {
+  const root = parse3(html);
+  const context = { course_id: parseCourseIdFromPageHtml(html) ?? 0, course_name: "", section_name: "" };
+  const breadcrumbs = root.querySelectorAll('nav[aria-label="Breadcrumb"] a[href], #page-navbar .breadcrumb a[href]');
+  const links = breadcrumbs.length ? breadcrumbs : root.querySelectorAll('a[href*="/course/view.php?id="]');
+  for (const link2 of links) {
+    const href = link2.getAttribute("href") ?? "";
+    const courseId = numberQueryValue(href, "id");
+    if (courseId !== null) {
+      context.course_id = courseId;
+    }
+    if (numberQueryValue(href, "section") === null) {
+      context.course_name ||= cleanNodeText(link2);
+    } else {
+      context.section_name = cleanNodeText(link2);
+    }
+  }
+  return context;
+}
+function extractLabeledText(html, label) {
+  const root = parse3(html);
+  for (const node of root.querySelectorAll("strong, b")) {
+    if (cleanNodeText(node) !== label) {
+      continue;
+    }
+    const parent = node.parentNode;
+    return cleanText(parent?.textContent.replace(label, "") ?? "");
+  }
+  return "";
+}
+function findTableValue(html, label) {
+  const root = parse3(html);
+  for (const row of root.querySelectorAll("tr")) {
+    const cells = row.querySelectorAll("th, td");
+    if (cleanNodeText(cells[0]) === label) {
+      return cleanTableCell(cells[1]);
+    }
+  }
+  return "";
+}
+function cleanTableCell(node) {
+  if (!node) {
+    return "";
+  }
+  const clone = parse3(node.toString());
+  for (const unwanted of clone.querySelectorAll(".action-menu, .dropdown, script, style")) {
+    unwanted.remove();
+  }
+  return cleanText(clone.textContent.replace("( Empty )", "(Empty)"));
+}
+function numberQueryValue(href, key) {
+  try {
+    return numericQueryValue(new URL(href, "https://moodle.invalid"), key);
+  } catch {
+    return null;
+  }
+}
+function numberValue(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value;
+  }
+  if (typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value))) {
+    return Number(value);
+  }
+  return 0;
+}
+function stringValue(value) {
+  return typeof value === "string" ? value : value == null ? "" : String(value);
+}
+function fileEntry(name, url, baseUrl) {
+  return {
+    name,
+    url,
+    requires_authentication: new URL(url).origin === new URL(baseUrl).origin
+  };
+}
+function unique(items) {
+  return [...new Set(items)];
+}
+
+// src/moodle-assign-core.ts
+async function submitAssignmentFiles(deps, request) {
+  const id2 = request.activityId;
+  if (!Number.isSafeInteger(id2) || id2 <= 0) throw deps.usage("The assignment id must be a positive integer.");
+  if (!request.files.length && !request.final) throw deps.usage("Give at least one file to upload, or use --final to submit the existing draft.");
+  const seen = /* @__PURE__ */ new Set();
+  for (const file2 of request.files) {
+    if (!file2.name || /[\\/]/u.test(file2.name)) throw deps.usage(`'${file2.name}' is not a plain file name.`);
+    if (seen.has(file2.name.toLowerCase())) throw deps.usage(`'${file2.name}' is given twice; Moodle keeps one file per name.`);
+    seen.add(file2.name.toLowerCase());
+  }
+  const viewUrl = `${deps.baseUrl}${ASSIGN_VIEW_PATH}?id=${id2}`;
+  request.onProgress?.("Reading the assignment");
+  const before = parseReceiptPage(await pageText(deps, viewUrl), id2, deps.baseUrl);
+  const form = parseSubmissionForm(await pageText(deps, `${viewUrl}&action=editsubmission`), deps);
+  const draft = await listDraftFiles(deps, form);
+  const removed = request.replace ? draft.map((file2) => file2.name) : [];
+  const kept = request.replace ? [] : draft.filter((file2) => !seen.has(file2.name.toLowerCase()));
+  checkLimits(deps, form, kept, request.files);
+  let statement = form.statement;
+  let confirm2;
+  if (request.final && !statement) {
+    confirm2 = parseConfirmForm(await pageText(deps, `${viewUrl}&action=submit`), deps);
+    statement = confirm2.statement;
+  }
+  if (statement && !request.acceptStatement) {
+    throw deps.usage(`Moodle requires you to accept this statement: "${statement}"`, "Re-run with --accept-statement once you agree.");
+  }
+  const limits = describeLimits(form);
+  const uploads = request.files.map((file2) => ({ name: file2.name, bytes: file2.bytes.byteLength, ...file2.path ? { path: file2.path } : {} }));
+  if (request.dryRun) {
+    return {
+      ...before,
+      action: "planned",
+      files: draft.map((file2) => ({ name: file2.name, bytes: file2.bytes })),
+      uploads,
+      removed,
+      limits,
+      ...statement ? { statement, statement_accepted: true } : {},
+      checked_at: timestamp(deps)
+    };
+  }
+  if (removed.length) {
+    request.onProgress?.(`Removing ${removed.join(", ")}`);
+    await deleteDraftFiles(deps, form, draft);
+  }
+  const storedNames = [];
+  for (const [index, file2] of request.files.entries()) {
+    request.onProgress?.(`Uploading ${file2.name} (${index + 1}/${request.files.length})`);
+    storedNames.push(await uploadDraftFile(deps, form, file2));
+  }
+  if (storedNames.length || removed.length) {
+    request.onProgress?.("Saving the submission");
+    const savedHtml = await postForm(deps, form.action, [...form.fields, ...form.statement ? [["submissionstatement", "1"]] : [], ["submitbutton", "Save changes"]]);
+    if (savedHtml !== null) throw deps.fail(`Moodle did not save the submission: ${noticesOf(savedHtml) || "it returned the edit form again without a reason"}`);
+  }
+  request.onProgress?.("Reading the receipt");
+  let receipt = parseReceiptPage(await pageText(deps, viewUrl), id2, deps.baseUrl);
+  const listed = new Set(receipt.files.map((file2) => file2.name.toLowerCase()));
+  const missing = storedNames.filter((name) => !listed.has(name.toLowerCase()));
+  if (missing.length) throw deps.fail(`Moodle saved the submission but its page does not list ${missing.join(", ")}; check the assignment in a browser before submitting.`);
+  let action = "saved";
+  if (isSubmitted(receipt.submission_status)) action = "submitted";
+  else if (request.final) {
+    request.onProgress?.("Submitting for grading");
+    confirm2 ??= parseConfirmForm(await pageText(deps, `${viewUrl}&action=submit`), deps);
+    const errorHtml = await postForm(deps, confirm2.action, [...confirm2.fields, ...confirm2.statement ? [["submissionstatement", "1"]] : [], ["submitbutton", "Continue"]]);
+    if (errorHtml !== null) throw deps.fail(`Moodle did not submit the assignment for grading: ${noticesOf(errorHtml) || "it returned the confirmation page again without a reason"}`);
+    receipt = parseReceiptPage(await pageText(deps, viewUrl), id2, deps.baseUrl);
+    if (!isSubmitted(receipt.submission_status)) throw deps.fail(`Moodle accepted the confirmation but still reports "${receipt.submission_status || "no status"}"; check the assignment in a browser.`);
+    action = "submitted";
+  }
+  return {
+    ...receipt,
+    action,
+    uploads,
+    removed,
+    limits,
+    ...statement ? { statement, statement_accepted: true } : {},
+    checked_at: timestamp(deps)
+  };
+}
+function parseSubmissionForm(html, deps) {
+  const root = parse4(html);
+  const form = formWithAction(root, "savesubmission");
+  if (!form) {
+    const notice = noticesOf(html);
+    if (root.querySelectorAll("input[type=submit], button").some((button) => /begin assignment/iu.test(cleanText(button.getAttribute("value") ?? button.textContent)))) {
+      throw deps.fail("This is a timed assignment; start it in a browser before uploading files.");
+    }
+    throw deps.fail(notice ? `Moodle is not accepting a submission: ${notice}` : "Moodle did not show a submission form for this assignment.");
+  }
+  const itemid = form.querySelector("input[name=files_filemanager]")?.getAttribute("value")?.trim() ?? "";
+  if (!itemid) throw deps.fail("This assignment does not accept file uploads.");
+  const options = filemanagerOptions(html, itemid);
+  if (!options) throw deps.fail("Moodle did not describe the file upload area for this assignment.");
+  const fields2 = formFields(form);
+  const sesskey = fields2.find(([name]) => name === "sesskey")?.[1] ?? "";
+  if (!sesskey) throw deps.fail("The submission form has no session key.");
+  const picker = record2(options.filepicker);
+  const repositories = (Array.isArray(picker.repositories) ? picker.repositories : Object.values(record2(picker.repositories))).map(record2);
+  const upload = repositories.find((repo) => repo.type === "upload");
+  if (!upload || upload.id === void 0) throw deps.fail("The site does not allow direct file uploads for this assignment.");
+  const accepted = options.accepted_types;
+  const acceptedTypes = Array.isArray(accepted) ? accepted.map(String).filter(Boolean) : accepted === void 0 || accepted === "*" ? "*" : [String(accepted)];
+  return {
+    action: resolveUrl(deps.baseUrl, form.getAttribute("action") || `${deps.baseUrl}${ASSIGN_VIEW_PATH}`),
+    fields: fields2,
+    sesskey,
+    itemid,
+    clientId: String(options.client_id ?? ""),
+    contextId: String(record2(options.context).id ?? ""),
+    repoId: String(upload.id),
+    author: String(picker.author ?? ""),
+    license: String(picker.defaultlicense ?? ""),
+    maxBytes: integer(options.maxbytes),
+    areaMaxBytes: integer(options.areamaxbytes),
+    maxFiles: integer(options.maxfiles),
+    acceptedTypes: acceptedTypes.length === 1 && acceptedTypes[0] === "*" ? "*" : acceptedTypes,
+    ...statementOf(form)
+  };
+}
+function parseConfirmForm(html, deps) {
+  const root = parse4(html);
+  const form = formWithAction(root, "confirmsubmit");
+  if (!form) {
+    const notice = noticesOf(html);
+    throw deps.fail(notice ? `Moodle is not accepting a submission for grading: ${notice}` : "Moodle did not show the submit-for-grading confirmation.");
+  }
+  return { action: resolveUrl(deps.baseUrl, form.getAttribute("action") || `${deps.baseUrl}${ASSIGN_VIEW_PATH}`), fields: formFields(form), ...statementOf(form) };
+}
+function parseReceiptPage(html, activityId, baseUrl) {
+  const page = parseAssignmentHtml(html, activityId, baseUrl);
+  const root = parse4(html);
+  const files = /* @__PURE__ */ new Map();
+  const add = (link2) => {
+    const name = cleanText(link2.textContent);
+    const href = link2.getAttribute("href") ?? "";
+    if (name && !files.has(name.toLowerCase())) files.set(name.toLowerCase(), { name, ...href ? { url: resolveUrl(baseUrl, href) } : {} });
+  };
+  for (const link2 of root.querySelectorAll(".fileuploadsubmission a[href]")) add(link2);
+  for (const link2 of tableCell(root, "File submissions")?.querySelectorAll("a[href]") ?? []) add(link2);
+  return {
+    id: activityId,
+    name: page.name,
+    ...page.course_id ? { unit_id: page.course_id } : {},
+    url: page.url,
+    submission_status: page.submission_status,
+    grading_status: page.grading_status,
+    due: page.due_pretty || cleanText(tableCell(root, "Due date")?.textContent),
+    time_remaining: page.time_remaining,
+    last_modified: cleanText(tableCell(root, "Last modified")?.textContent),
+    files: [...files.values()]
+  };
+}
+function noticesOf(html) {
+  const root = parse4(html);
+  const texts = [];
+  for (const node of root.querySelectorAll(".alert, .invalid-feedback, .form-control-feedback, .error, [data-fieldtype] .text-danger")) {
+    for (const junk of node.querySelectorAll("button, .close")) junk.remove();
+    const text2 = cleanText(node.textContent);
+    if (text2 && !texts.includes(text2)) texts.push(text2);
+  }
+  return texts.join(" ");
+}
+function formWithAction(root, action) {
+  for (const form of root.querySelectorAll("form")) {
+    if (form.querySelectorAll("input[name=action]").some((input2) => input2.getAttribute("value") === action)) return form;
+  }
+  return null;
+}
+function formFields(form) {
+  const fields2 = [];
+  for (const element of form.querySelectorAll("input, textarea, select")) {
+    const name = element.getAttribute("name");
+    if (!name) continue;
+    const tag = element.tagName.toLowerCase();
+    if (tag === "textarea") {
+      fields2.push([name, element.textContent]);
+      continue;
+    }
+    if (tag === "select") {
+      const options = element.querySelectorAll("option");
+      const chosen = options.find((option) => option.hasAttribute("selected")) ?? options[0];
+      if (chosen) fields2.push([name, chosen.getAttribute("value") ?? cleanText(chosen.textContent)]);
+      continue;
+    }
+    const type = (element.getAttribute("type") ?? "text").toLowerCase();
+    if (["submit", "button", "image", "file", "reset"].includes(type)) continue;
+    if ((type === "checkbox" || type === "radio") && !element.hasAttribute("checked")) continue;
+    fields2.push([name, element.getAttribute("value") ?? (type === "checkbox" ? "on" : "")]);
+  }
+  return fields2;
+}
+function statementOf(form) {
+  const box = form.querySelector("input[name=submissionstatement]");
+  if (!box) return {};
+  const id2 = box.getAttribute("id");
+  const label = (id2 ? form.querySelector(`label[for="${id2}"]`) : null) ?? box.closest("label") ?? box.parentNode?.querySelector("label") ?? null;
+  const text2 = cleanText(label?.textContent).replace(/\s*Required\s*$/u, "").trim();
+  return { statement: text2 || "Submission statement" };
+}
+function filemanagerOptions(html, itemid) {
+  const pattern = /M\.form_filemanager\.init\(\s*Y\s*,\s*/gu;
+  let match;
+  while (match = pattern.exec(html)) {
+    const json = balancedObject(html, match.index + match[0].length);
+    if (!json) continue;
+    try {
+      const options = JSON.parse(json);
+      if (isRecord4(options) && String(options.itemid) === itemid) return options;
+    } catch {
+    }
+  }
+  return null;
+}
+function balancedObject(text2, start) {
+  if (text2[start] !== "{") return null;
+  let depth = 0;
+  let quoted = false;
+  for (let index = start; index < text2.length; index += 1) {
+    const char = text2[index];
+    if (quoted) {
+      if (char === "\\") index += 1;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === "{") depth += 1;
+    else if (char === "}") {
+      depth -= 1;
+      if (depth === 0) return text2.slice(start, index + 1);
+    }
+  }
+  return null;
+}
+function tableCell(root, label) {
+  for (const row of root.querySelectorAll("tr")) {
+    const cells = row.querySelectorAll("th, td");
+    if (cells.length > 1 && cleanText(cells[0].textContent) === label) return cells[1];
+  }
+  return null;
+}
+async function pageText(deps, url) {
+  return (await deps.request(url)).text();
+}
+async function postForm(deps, action, fields2) {
+  const response = await deps.request(action, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(fields2).toString()
+  });
+  const html = await response.text();
+  return landedOnView(response.url) ? null : html;
+}
+function landedOnView(url) {
+  try {
+    const parsed = new URL(url);
+    return parsed.pathname.endsWith(ASSIGN_VIEW_PATH) && (parsed.searchParams.get("action") ?? "view") === "view";
+  } catch {
+    return false;
+  }
+}
+async function draftAjax(deps, form, action, params) {
+  const body = new URLSearchParams({ sesskey: form.sesskey, client_id: form.clientId, itemid: form.itemid, ...params });
+  const response = await deps.request(`${deps.baseUrl}/repository/draftfiles_ajax.php?action=${action}`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  }, { allowErrorStatus: true });
+  return jsonOf(deps, response, `draft file ${action}`);
+}
+async function listDraftFiles(deps, form) {
+  const data = record2(await draftAjax(deps, form, "list", { filepath: "/" }));
+  const list2 = Array.isArray(data.list) ? data.list.map(record2) : [];
+  return list2.filter((item) => item.type !== "folder").map((item) => ({ name: String(item.filename ?? item.fullname ?? ""), path: String(item.filepath ?? "/"), bytes: integer(item.size) })).filter((item) => item.name);
+}
+async function deleteDraftFiles(deps, form, files) {
+  const selected = JSON.stringify(files.map((file2) => ({ filename: file2.name, filepath: file2.path })));
+  const result = await draftAjax(deps, form, "deleteselected", { selected });
+  if (result === false) throw deps.fail("Moodle did not remove the existing submission files.");
+}
+async function uploadDraftFile(deps, form, file2) {
+  const body = new FormData();
+  body.set("sesskey", form.sesskey);
+  body.set("client_id", form.clientId);
+  body.set("repo_id", form.repoId);
+  body.set("itemid", form.itemid);
+  body.set("env", "filemanager");
+  body.set("ctx_id", form.contextId);
+  body.set("title", file2.name);
+  body.set("author", form.author);
+  body.set("license", form.license);
+  body.set("savepath", "/");
+  body.set("maxbytes", String(form.maxBytes));
+  body.set("areamaxbytes", String(form.areaMaxBytes));
+  for (const type of form.acceptedTypes === "*" ? ["*"] : form.acceptedTypes) body.append("accepted_types[]", type);
+  body.set("overwrite", "1");
+  body.set("repo_upload_file", new Blob([Uint8Array.from(file2.bytes)]), file2.name);
+  const response = await deps.request(`${deps.baseUrl}/repository/repository_ajax.php?action=upload`, { method: "POST", body }, { allowErrorStatus: true });
+  const data = record2(await jsonOf(deps, response, `upload of ${file2.name}`));
+  if (typeof data.error === "string" && data.error) throw deps.fail(`Moodle refused ${file2.name}: ${data.error}`, typeof data.errorcode === "string" ? data.errorcode : void 0);
+  if (data.event === "fileexists") throw deps.fail(`Moodle reports ${file2.name} already exists and did not overwrite it.`);
+  const stored = typeof data.file === "string" && data.file ? data.file : file2.name;
+  if (!data.url && !data.id && !data.file) throw deps.fail(`Moodle did not confirm the upload of ${file2.name}.`);
+  return stored;
+}
+async function jsonOf(deps, response, step) {
+  const text2 = await response.text();
+  try {
+    return JSON.parse(text2);
+  } catch {
+    const notice = noticesOf(text2);
+    throw deps.fail(`Moodle did not answer the ${step} with JSON (HTTP ${response.status})${notice ? `: ${notice}` : ""}`);
+  }
+}
+function checkLimits(deps, form, kept, files) {
+  if (form.maxFiles > 0 && kept.length + files.length > form.maxFiles) {
+    throw deps.usage(`This assignment allows ${form.maxFiles} file${form.maxFiles === 1 ? "" : "s"}; the submission would hold ${kept.length + files.length}.`, kept.length ? "Use --replace to drop the existing files first." : void 0);
+  }
+  for (const file2 of files) {
+    if (form.maxBytes > 0 && file2.bytes.byteLength > form.maxBytes) throw deps.usage(`${file2.name} is ${size(file2.bytes.byteLength)}; the limit is ${size(form.maxBytes)}.`);
+    if (form.acceptedTypes !== "*" && form.acceptedTypes.every((type) => type.startsWith(".")) && !form.acceptedTypes.some((type) => file2.name.toLowerCase().endsWith(type.toLowerCase()))) {
+      throw deps.usage(`${file2.name} is not an accepted type; allowed: ${form.acceptedTypes.join(", ")}.`);
+    }
+  }
+  const total = kept.reduce((sum, file2) => sum + file2.bytes, 0) + files.reduce((sum, file2) => sum + file2.bytes.byteLength, 0);
+  if (form.areaMaxBytes > 0 && total > form.areaMaxBytes) throw deps.usage(`The submission would total ${size(total)}; the limit is ${size(form.areaMaxBytes)}.`, kept.length ? "Use --replace to drop the existing files first." : void 0);
+}
+function describeLimits(form) {
+  return {
+    ...form.maxBytes > 0 ? { max_bytes: form.maxBytes } : {},
+    ...form.maxFiles > 0 ? { max_files: form.maxFiles } : {},
+    ...form.areaMaxBytes > 0 ? { area_max_bytes: form.areaMaxBytes } : {},
+    ...form.acceptedTypes !== "*" ? { accepted_types: form.acceptedTypes } : {}
+  };
+}
+function isSubmitted(status) {
+  return /\bsubmitted\b/iu.test(status) && !/\bnot submitted\b/iu.test(status);
+}
+function size(bytes) {
+  if (bytes >= 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
+  if (bytes >= 1024) return `${(bytes / 1024).toFixed(1)} KiB`;
+  return `${bytes} B`;
+}
+function timestamp(deps) {
+  return (deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+}
+function integer(value) {
+  const number = Number(value);
+  return Number.isSafeInteger(number) ? number : 0;
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function record2(value) {
+  return isRecord4(value) ? value : {};
+}
+
+// src/parsers.ts
+function schema(parser) {
+  return { parse: parser };
+}
+var UserInfoSchema = schema(parseUserInfo);
+var CourseSchema = schema(parseCourse);
+var CoursesSchema = schema(parseCourses);
+var ActivitySchema = schema(parseActivity);
+var SectionSchema = schema(parseSection);
+var CourseContentsSchema = schema(parseCourseContents);
+var TodoItemSchema = schema(parseTodoItem);
+function parseUserInfo(value) {
+  const data = asRecord(value);
+  return {
+    userid: numberValue2(data.userid),
+    username: stringValue2(data.username),
+    fullname: stringValue2(data.fullname),
+    sitename: stringValue2(data.sitename),
+    siteurl: stringValue2(data.siteurl),
+    lang: stringValue2(data.lang),
+    ...data.timezone ? { timezone: String(data.timezone) } : {}
+  };
+}
+function parseCourse(value, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const data = asRecord(value);
+  const course = {
+    id: numberValue2(data.id),
+    shortname: stringValue2(data.shortname),
+    fullname: stringValue2(data.fullname),
+    category: numberValue2(data.category),
+    visible: booleanValue(data.visible, true),
+    startdate: numberValue2(data.startdate)
+  };
+  const enddate = numberValue2(data.enddate);
+  if (enddate > 0) {
+    course.enddate = enddate;
+  }
+  return course;
+}
+function parseCourses(value) {
+  return asArray(value).map((item) => parseCourse(item));
+}
+function parseActivity(value) {
+  const data = asRecord(value);
+  return {
+    id: numberValue2(data.id),
+    name: stringValue2(data.name),
+    modname: stringValue2(data.modname),
+    url: stringValue2(data.url),
+    visible: booleanValue(data.visible, true),
+    description: stringValue2(data.description),
+    ...data.completiondata && typeof data.completiondata === "object" ? { completion: numberValue2(asRecord(data.completiondata).state) } : {},
+    ...Array.isArray(data.contents) ? { file_entries: data.contents.filter((f) => asRecord(f).fileurl).map((f) => ({ name: stringValue2(asRecord(f).filename), url: stringValue2(asRecord(f).fileurl), requires_authentication: true })) } : {}
+  };
+}
+function parseSection(value) {
+  const data = asRecord(value);
+  return {
+    id: numberValue2(data.id),
+    name: stringValue2(data.name),
+    section: numberValue2(data.section),
+    visible: booleanValue(data.visible, true),
+    summary: stringValue2(data.summary),
+    ...data.current !== void 0 ? { current: booleanValue(data.current) } : {},
+    activities: asArray(data.modules).map((item) => parseActivity(item))
+  };
+}
+function parseCourseContents(value) {
+  return asArray(value).map((item) => parseSection(item));
+}
+function parseCourseFormatState(value, baseUrl) {
+  const state = asRecord(parseJsonValue(value));
+  const activities = /* @__PURE__ */ new Map();
+  const activitiesBySection = /* @__PURE__ */ new Map();
+  for (const item of asArray(state.cm)) {
+    const data = asRecord(item);
+    const id2 = numberValue2(data.id);
+    const sectionId = stringValue2(data.sectionid);
+    const module = stringValue2(data.module) || stringValue2(data.plugin).replace(/^mod_/u, "") || stringValue2(data.modname).toLowerCase();
+    const activity = {
+      id: id2,
+      name: htmlText(data.name, baseUrl),
+      modname: module.toLowerCase(),
+      url: stringValue2(data.url) ? resolveUrl(baseUrl, stringValue2(data.url)) : "",
+      visible: booleanValue(data.visible, true) && booleanValue(data.uservisible, true) && !booleanValue(data.stealth),
+      description: htmlText(data.content ?? data.description, baseUrl),
+      ...data.completionstate !== void 0 && data.completionstate !== null ? { completion: numberValue2(data.completionstate) } : {}
+    };
+    activities.set(String(id2), activity);
+    const sectionActivities = activitiesBySection.get(sectionId) ?? [];
+    sectionActivities.push(activity);
+    activitiesBySection.set(sectionId, sectionActivities);
+  }
+  return asArray(state.section).map((item) => {
+    const data = asRecord(item);
+    const id2 = numberValue2(data.id);
+    const hasActivityList = Array.isArray(data.cmlist);
+    const listedActivities = asArray(data.cmlist).map((activityId) => activities.get(stringValue2(activityId))).filter((activity) => activity !== void 0);
+    return {
+      id: id2,
+      name: htmlText(data.title || data.rawtitle, baseUrl),
+      section: numberValue2(data.section ?? data.number),
+      visible: booleanValue(data.visible, true),
+      summary: htmlText(data.summary, baseUrl),
+      ...data.current !== void 0 ? { current: booleanValue(data.current) } : {},
+      activities: hasActivityList ? listedActivities : activitiesBySection.get(String(id2)) ?? []
+    };
+  });
+}
+function parseTodoItem(value) {
+  const data = asRecord(value);
+  const course = asRecord(data.course);
+  const action = asRecord(data.action);
+  const progress = course.progress;
+  return {
+    id: numberValue2(data.id),
+    name: stringValue2(data.name),
+    activity_name: stringValue2(data.activityname),
+    modname: stringValue2(data.modulename),
+    course_id: numberValue2(course.id),
+    course_name: stringValue2(course.fullname),
+    due_at: numberValue2(data.timesort) || numberValue2(data.timestart),
+    overdue: booleanValue(data.overdue),
+    actionable: booleanValue(action.actionable),
+    action_name: stringValue2(action.name),
+    action_url: stringValue2(action.url),
+    url: stringValue2(data.url),
+    event_type: stringValue2(data.eventtype),
+    course_progress: typeof progress === "number" ? progress : void 0
+  };
+}
+function parseTodoItems(value) {
+  return asArray(value).map((item) => parseTodoItem(item));
+}
+function parseAlertNotification(value) {
+  const data = asRecord(value);
+  return {
+    id: numberValue2(data.id),
+    subject: stringValue2(data.subject),
+    short_subject: stringValue2(data.shortenedsubject),
+    event_type: stringValue2(data.eventtype),
+    component: stringValue2(data.component),
+    created_at: numberValue2(data.timecreated),
+    created_pretty: stringValue2(data.timecreatedpretty),
+    read: booleanValue(data.read),
+    context_url: stringValue2(data.contexturl),
+    context_name: stringValue2(data.contexturlname)
+  };
+}
+function parseAlertSummary(notificationsData, countsData, unreadCountsData) {
+  const notificationsRecord = asRecord(notificationsData);
+  const counts2 = asRecord(countsData);
+  const unreadCounts = asRecord(unreadCountsData);
+  const types = asRecord(counts2.types);
+  const unreadTypes = asRecord(unreadCounts.types);
+  const notifications = asArray(notificationsRecord.notifications).map((item) => parseAlertNotification(item));
+  return {
+    notifications,
+    notification_count: notifications.length,
+    unread_notification_count: notifications.filter((notification) => !notification.read).length,
+    starred_message_count: numberValue2(counts2.favourites),
+    direct_message_count: numberValue2(types["1"]),
+    group_message_count: numberValue2(types["2"]),
+    self_message_count: numberValue2(types["3"]),
+    unread_starred_message_count: numberValue2(unreadCounts.favourites),
+    unread_direct_message_count: numberValue2(unreadTypes["1"]),
+    unread_group_message_count: numberValue2(unreadTypes["2"]),
+    unread_self_message_count: numberValue2(unreadTypes["3"])
+  };
+}
+function parseForumPostAuthor(value) {
+  const data = asRecord(value);
+  const urls = asRecord(data.urls);
+  return {
+    id: numberValue2(data.id),
+    fullname: stringValue2(data.fullname),
+    profile_url: stringValue2(urls.profile),
+    profile_image_url: stringValue2(urls.profileimage)
+  };
+}
+function parseForumPost(value, baseUrl = "") {
+  const data = asRecord(value);
+  const urls = asRecord(data.urls);
+  const messageHtml = stringValue2(data.message);
+  const structured = htmlToStructuredContent(messageHtml, stringValue2(urls.view || urls.discuss) || baseUrl);
+  return {
+    id: numberValue2(data.id),
+    discussion_id: numberValue2(data.discussionid),
+    subject: stringValue2(data.subject),
+    message_html: messageHtml,
+    message_text: structured.text,
+    image_urls: structured.image_urls,
+    links: structured.links,
+    tables: structured.tables,
+    author: parseForumPostAuthor(data.author),
+    parent_id: numberValue2(data.parentid),
+    time_created: numberValue2(data.timecreated),
+    time_modified: numberValue2(data.timemodified),
+    created_pretty: "",
+    unread: booleanValue(data.unread),
+    is_deleted: booleanValue(data.isdeleted),
+    is_private_reply: booleanValue(data.isprivatereply),
+    url: stringValue2(urls.view || urls.viewisolated),
+    reply_url: stringValue2(urls.reply)
+  };
 }
-function extractLabeledText(html, label) {
-  const root = parse3(html);
-  for (const node of root.querySelectorAll("strong, b")) {
-    if (cleanNodeText(node) !== label) {
-      continue;
-    }
-    const parent = node.parentNode;
-    return cleanText(parent?.textContent.replace(label, "") ?? "");
-  }
-  return "";
+function parseForumDiscussion(value, discussionId, baseUrl = "") {
+  const data = asRecord(value);
+  const posts = asArray(data.posts).map((item) => parseForumPost(item, baseUrl));
+  return {
+    id: discussionId,
+    subject: posts[0]?.subject ?? "",
+    course_id: numberValue2(data.courseid),
+    forum_id: numberValue2(data.forumid),
+    group_id: numberValue2(data.groupid),
+    group_name: stringValue2(data.groupname),
+    url: posts[0]?.url ? posts[0].url.split("#", 1)[0] : "",
+    posts
+  };
 }
-function findTableValue(html, label) {
-  const root = parse3(html);
-  for (const row of root.querySelectorAll("tr")) {
-    const cells = row.querySelectorAll("th, td");
-    if (cleanNodeText(cells[0]) === label) {
-      return cleanTableCell(cells[1]);
-    }
-  }
-  return "";
+function asRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function cleanTableCell(node) {
-  if (!node) {
-    return "";
-  }
-  const clone = parse3(node.toString());
-  for (const unwanted of clone.querySelectorAll(".action-menu, .dropdown, script, style")) {
-    unwanted.remove();
-  }
-  return cleanText(clone.textContent.replace("( Empty )", "(Empty)"));
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
 }
-function numberQueryValue(href, key) {
-  try {
-    return numericQueryValue(new URL(href, "https://moodle.invalid"), key);
-  } catch {
-    return null;
-  }
+function stringValue2(value) {
+  return typeof value === "string" ? value : value == null ? "" : String(value);
 }
 function numberValue2(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -3961,18 +5016,22 @@ function numberValue2(value) {
   }
   return 0;
 }
-function stringValue2(value) {
-  return typeof value === "string" ? value : value == null ? "" : String(value);
+function booleanValue(value, defaultValue = false) {
+  if (value === void 0 || value === null) {
+    return defaultValue;
+  }
+  return Boolean(value);
 }
-function fileEntry(name, url, baseUrl) {
-  return {
-    name,
-    url,
-    requires_authentication: new URL(url).origin === new URL(baseUrl).origin
-  };
+function parseJsonValue(value) {
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return {};
+  }
 }
-function unique(items) {
-  return [...new Set(items)];
+function htmlText(value, baseUrl) {
+  return htmlToStructuredContent(stringValue2(value), baseUrl).text;
 }
 
 // src/moodle-forum-core.ts
@@ -4109,13 +5168,13 @@ var ForumModule = class {
   }
 };
 function shouldFallbackForumAjax(error) {
-  if (!isRecord4(error)) {
+  if (!isRecord5(error)) {
     return false;
   }
   const code = typeof error.moodleErrorCode === "string" ? error.moodleErrorCode : "";
   return code === "servicenotavailable" || code === "accessexception" || error instanceof Error && error.message.includes("Web service is not available");
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -4247,9 +5306,9 @@ async function searchForumContent(source, query, options = {}) {
   hits.sort(sortBy === "recent" ? sortRecent : sortRelevant);
   return hits.slice(0, options.limit ?? 20).map(([, hit]) => includePostText ? hit : { ...hit, snippet: "" });
 }
-async function inParallel2(items, size, run) {
+async function inParallel2(items, size2, run) {
   const results = [];
-  for (let index = 0; index < items.length; index += size) results.push(...await Promise.all(items.slice(index, index + size).map(run)));
+  for (let index = 0; index < items.length; index += size2) results.push(...await Promise.all(items.slice(index, index + size2).map(run)));
   return results;
 }
 function normalizeQuery(value) {
@@ -4425,7 +5484,7 @@ var MoodleClientCore = class {
         await this.ensureSession();
         return this.call(functionName, args);
       },
-      getPage: (path4, params) => this.get(path4, params),
+      getPage: (path5, params) => this.get(path5, params),
       getCourses: () => this.getCourses(),
       getCourseContents: (courseId) => this.getCourseContents(courseId)
     });
@@ -4435,7 +5494,7 @@ var MoodleClientCore = class {
     try {
       if (this.unavailable.has(FUNC_GET_SITE_INFO) && this.userInfo?.fullname) return this.userInfo;
       const data = await this.call(FUNC_GET_SITE_INFO);
-      if (isRecord5(data) && "userid" in data) {
+      if (isRecord6(data) && "userid" in data) {
         const info = parseUserInfo(data);
         this.sesskey = typeof data.sesskey === "string" ? data.sesskey : this.sesskey;
         this.userid = info.userid;
@@ -4534,9 +5593,9 @@ var MoodleClientCore = class {
     let type = "";
     try {
       const data = await this.call(FUNC_GET_COURSE_MODULE, { cmid: id2 });
-      const module = isRecord5(data) && isRecord5(data.cm) ? data.cm : data;
-      type = isRecord5(module) && typeof module.modname === "string" ? module.modname : "";
-      courseId = isRecord5(module) && typeof module.course === "number" ? module.course : void 0;
+      const module = isRecord6(data) && isRecord6(data.cm) ? data.cm : data;
+      type = isRecord6(module) && typeof module.modname === "string" ? module.modname : "";
+      courseId = isRecord6(module) && typeof module.course === "number" ? module.course : void 0;
     } catch (error) {
       if (!this.errors.isApi(error) || error.moodleErrorCode !== "servicenotavailable") {
         throw error;
@@ -4580,14 +5639,14 @@ var MoodleClientCore = class {
       } else {
         data = await this.call(FUNC_GET_ACTION_EVENTS, { ...window, limittononsuspendedevents: true });
       }
-      const events = isRecord5(data) && Array.isArray(data.events) ? data.events : [];
+      const events = isRecord6(data) && Array.isArray(data.events) ? data.events : [];
       for (const item of parseTodoItems(events)) if (!seen.has(item.id)) {
         seen.add(item.id);
         items.push(item);
       }
       if (events.length < batchSize) break;
       const last = events.at(-1);
-      const next = isRecord5(last) && typeof last.id === "number" ? last.id : void 0;
+      const next = isRecord6(last) && typeof last.id === "number" ? last.id : void 0;
       if (!next || next === aftereventid) throw this.errors.api("Moodle repeated a calendar page; refine the date window.");
       aftereventid = next;
     }
@@ -4754,8 +5813,18 @@ var MoodleClientCore = class {
   async getFolder(id2) {
     return parseFolderHtml(await this.get(FOLDER_VIEW_PATH, { id: id2 }), id2, this.baseUrl);
   }
-  async requestAbsolute(url, init = {}) {
-    return this.requestAbsoluteInternal(url, init, true);
+  async requestAbsolute(url, init = {}, options = {}) {
+    return this.requestAbsoluteInternal(url, init, true, Boolean(options.allowErrorStatus));
+  }
+  /** Uploads files into an assignment and reads the receipt back from the site. */
+  async submitAssignment(request) {
+    await this.ensureSession();
+    return submitAssignmentFiles({
+      baseUrl: this.baseUrl,
+      request: (url, init, options) => this.requestAbsolute(url, init, options),
+      fail: (message, moodleErrorCode) => this.errors.api(message, moodleErrorCode),
+      usage: (message, hint) => this.errors.usage ? this.errors.usage(message, hint) : new MoodleClientCoreError("usage", message, hint)
+    }, request);
   }
   async getNewsForums(courseId) {
     const units = courseId === void 0 ? await this.getCourses() : (await this.getCourses()).filter((c) => c.id === courseId);
@@ -4765,7 +5834,7 @@ var MoodleClientCore = class {
       await this.ensureSession();
       const data = await this.call("mod_forum_get_forums_by_courses", { courseids: units.map((c) => c.id) });
       for (const f of Array.isArray(data) ? data : []) {
-        if (!isRecord5(f) || f.type !== "news" || typeof f.cmid !== "number") continue;
+        if (!isRecord6(f) || f.type !== "news" || typeof f.cmid !== "number") continue;
         const c = units.find((c2) => c2.id === f.course);
         forums.push({ id: f.cmid, name: String(f.name || ""), course_id: Number(f.course), course_name: c?.fullname || "", url: `${this.baseUrl}/mod/forum/view.php?id=${f.cmid}` });
       }
@@ -4893,16 +5962,16 @@ var MoodleClientCore = class {
   async getAbsolute(url) {
     return (await this.requestAbsolute(url)).text();
   }
-  async requestAbsoluteInternal(url, init, allowRetry) {
+  async requestAbsoluteInternal(url, init, allowRetry, allowErrorStatus = false) {
     const response = await fetchWithSession(url, init, this.baseUrl, this.cookie, this.fetchImpl);
     if (response.url.includes("/login/")) {
       if (this.onLoginRequired && allowRetry && !this.retryingLogin) {
         await this.reauthenticate();
-        return this.requestAbsoluteInternal(url, init, false);
+        return this.requestAbsoluteInternal(url, init, false, allowErrorStatus);
       }
       throw this.errors.api("Session expired", "servicerequireslogin");
     }
-    if (!response.ok) {
+    if (!response.ok && !allowErrorStatus) {
       const context = `HTTP ${response.status} loading ${safeUrl(url)}`;
       const contentType3 = response.headers.get("content-type")?.toLowerCase() ?? "";
       if (contentType3.includes("text/html") || contentType3.includes("application/xhtml+xml")) {
@@ -4920,7 +5989,7 @@ var MoodleClientCore = class {
     let offset = 0;
     while (true) {
       const data = await this.call(FUNC_GET_COURSES_BY_TIMELINE, { classification: "all", limit: 100, offset });
-      if (!isRecord5(data) || !Array.isArray(data.courses) || !data.courses.length) {
+      if (!isRecord6(data) || !Array.isArray(data.courses) || !data.courses.length) {
         break;
       }
       courses.push(...data.courses);
@@ -5080,19 +6149,19 @@ function placeholderUserInfo(baseUrl, userid) {
   };
 }
 function parseTodoPayload(value) {
-  return parseTodoItems(isRecord5(value) && Array.isArray(value.events) ? value.events : []);
+  return parseTodoItems(isRecord6(value) && Array.isArray(value.events) ? value.events : []);
 }
 function errorMessage(value) {
   return value instanceof Error ? value.message : "Unknown Moodle error";
 }
-function chunks(values, size) {
+function chunks(values, size2) {
   const result = [];
-  for (let index = 0; index < values.length; index += size) {
-    result.push(values.slice(index, index + size));
+  for (let index = 0; index < values.length; index += size2) {
+    result.push(values.slice(index, index + size2));
   }
   return result;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function isLoginErrorCode2(code) {
@@ -5114,10 +6183,30 @@ function safeUrl(value) {
   }
 }
 
+// src/submit.ts
+import { readFile as readFile6, stat as stat2 } from "fs/promises";
+import { homedir as homedir10 } from "os";
+import path from "path";
+function resolveSubmissionPath(given, cwd = process.cwd()) {
+  return path.resolve(cwd, given.startsWith("~/") ? path.join(homedir10(), given.slice(2)) : given);
+}
+async function readSubmissionFiles(paths, cwd = process.cwd()) {
+  const files = [];
+  for (const given of paths) {
+    const resolved = resolveSubmissionPath(given, cwd);
+    const info = await stat2(resolved).catch(() => null);
+    if (!info) throw new UsageError(`File not found: ${given}`);
+    if (!info.isFile()) throw new UsageError(`Not a file: ${given}`, "Zip a folder before uploading it.");
+    files.push({ name: path.basename(resolved), bytes: await readFile6(resolved), path: resolved });
+  }
+  return files;
+}
+
 // src/client.ts
 var NODE_ERROR_ADAPTER = {
   api: (message, moodleErrorCode) => new MoodleAPIError(message, moodleErrorCode),
   notFound: (message) => new NotFoundError(message),
+  usage: (message, hint) => new UsageError(message, hint),
   isApi: (error) => error instanceof MoodleAPIError,
   isLoginRequired: isLoginRequiredError
 };
@@ -5126,6 +6215,11 @@ var MoodleClient = class extends MoodleClientCore {
     const resolvedOptions = typeof options === "string" ? { cookie: { name: "MoodleSession", value: options } } : options;
     super(baseUrl, { ...resolvedOptions, errorAdapter: NODE_ERROR_ADAPTER });
   }
+  /** Reads local files, then uploads them into the assignment. Only the Node client has a filesystem. */
+  async submitAssignmentFiles(request) {
+    const { files, cwd, ...rest } = request;
+    return this.submitAssignment({ ...rest, files: await readSubmissionFiles(files, cwd) });
+  }
 };
 async function createMoodleClient(baseUrl, options = {}) {
   const cacheOptions2 = {
@@ -5153,7 +6247,7 @@ async function createMoodleClient(baseUrl, options = {}) {
       });
     }
   }
-  const stale = options.noCache ? null : await readCachedSession(baseUrl, { ...cacheOptions2, ttlMs: Number.MAX_SAFE_INTEGER }).catch(() => null);
+  const stale = options.noCache ? null : await readCachedSession(baseUrl, { ...cacheOptions2, allowExpired: true }).catch(() => null);
   const session = authToClientSession(await getAuthenticatedSession(baseUrl, authOptions));
   return new MoodleClient(baseUrl, {
     fetchImpl: options.fetchImpl,
@@ -5166,11 +6260,21 @@ async function createMoodleClient(baseUrl, options = {}) {
 }
 function persistenceCallbacks(baseUrl, options) {
   return {
-    clearSessionCache: () => deleteCachedSession(baseUrl, options),
-    writeSessionCache: (session) => writeCachedSession({
-      ...session,
-      savedAt: (options.now ?? Date.now)()
-    }, options)
+    clearSessionCache: async () => {
+      const cached = await readCachedSession(baseUrl, { ...options, allowExpired: true });
+      if (cached) await writeCachedSession({ ...cached, cookieInvalidated: true }, options);
+    },
+    writeSessionCache: async (session) => {
+      const previous = await readCachedSession(baseUrl, { ...options, allowExpired: true });
+      await writeCachedSession({
+        ...session,
+        // Client snapshots contain cookie state only. Keep renewal credentials
+        // for the same account without carrying them across an account switch.
+        ...previous?.userid === session.userid ? { mobileToken: previous.mobileToken } : {},
+        mobileServiceEnabled: previous?.mobileServiceEnabled,
+        savedAt: (options.now ?? Date.now)()
+      }, options);
+    }
   };
 }
 function authToClientSession(auth) {
@@ -5234,6 +6338,35 @@ function formatDownloadReceipt(receipt) {
     ["Final URL", receipt.final_url]
   ], { title: "Download" });
 }
+function formatSubmissionReceipt(receipt) {
+  const size2 = (bytes) => bytes >= 1024 * 1024 ? `${(bytes / (1024 * 1024)).toFixed(1)} MiB` : bytes >= 1024 ? `${(bytes / 1024).toFixed(1)} KiB` : `${bytes} B`;
+  const limits = [
+    receipt.limits.max_files ? `${receipt.limits.max_files} files` : "",
+    receipt.limits.max_bytes ? `${size2(receipt.limits.max_bytes)} each` : "",
+    receipt.limits.area_max_bytes ? `${size2(receipt.limits.area_max_bytes)} total` : "",
+    receipt.limits.accepted_types?.length ? receipt.limits.accepted_types.join(" ") : ""
+  ].filter(Boolean).join(", ");
+  const table = renderKeyValueTable([
+    ["Assignment", receipt.name],
+    ["Unit id", receipt.unit_id ? String(receipt.unit_id) : ""],
+    ["URL", receipt.url],
+    ["Action", receipt.action],
+    ["Status", receipt.submission_status],
+    ["Grading", receipt.grading_status],
+    ["Due", receipt.due],
+    ["Time remaining", receipt.time_remaining],
+    ["Last modified", receipt.last_modified],
+    [receipt.action === "planned" ? "Files now" : "Files", receipt.files.map((file2) => file2.bytes ? `${file2.name} (${size2(file2.bytes)})` : file2.name).join(", ")],
+    ["Uploads", receipt.uploads.map((file2) => `${file2.name} (${size2(file2.bytes)})`).join(", ")],
+    ["Removed", receipt.removed.join(", ")],
+    ["Statement", receipt.statement ? `${receipt.statement_accepted ? "accepted" : "not accepted"}: ${receipt.statement}` : ""],
+    ["Limits", limits],
+    ["Checked", receipt.checked_at]
+  ], { title: receipt.action === "planned" ? "Submission plan" : "Submission" });
+  const note = receipt.action === "planned" ? "Plan only; nothing was uploaded. Re-run without --dry-run to upload." : receipt.action === "saved" && /draft|not submitted/iu.test(receipt.submission_status) ? "Saved as a draft. Re-run with --final to submit it for grading." : "";
+  return note ? `${table}
+${note}` : table;
+}
 function formatForumDiscussion(discussion, options = {}) {
   const lines = [`Discussion: ${discussion.id}`];
   if (discussion.subject) {
@@ -5351,10 +6484,10 @@ function formatTimestamp(value) {
 import { createWriteStream } from "fs";
 import { link, lstat, rename as rename2, unlink } from "fs/promises";
 import { randomUUID } from "crypto";
-import path from "path";
+import path2 from "path";
 import { Readable, Transform } from "stream";
 import { pipeline } from "stream/promises";
-import { parse as parse4 } from "node-html-parser";
+import { parse as parse5 } from "node-html-parser";
 var ACCEPTED_SOURCE_HINT = "Use a positive resource activity ID, a same-site resource URL, or a same-site pluginfile URL.";
 var FILE_SYSTEM_ERROR_CODES = /* @__PURE__ */ new Set([
   "EACCES",
@@ -5374,14 +6507,14 @@ var FILE_SYSTEM_ERROR_CODES = /* @__PURE__ */ new Set([
 ]);
 async function downloadMoodleFile(client, request, signal) {
   throwIfCancelled(signal);
-  const explicitDestination = request.destination ? path.resolve(request.destination) : void 0;
+  const explicitDestination = request.destination ? path2.resolve(request.destination) : void 0;
   if (explicitDestination && !request.force) {
     await ensureDestinationAvailable(explicitDestination);
   }
   const resolved = await resolveDownload(client, request.source, signal);
   throwIfCancelled(signal);
-  const filename = explicitDestination ? path.basename(explicitDestination) : chooseUpstreamFilename(resolved);
-  const destination = explicitDestination ?? path.resolve(request.directory ?? process.cwd(), filename);
+  const filename = explicitDestination ? path2.basename(explicitDestination) : chooseUpstreamFilename(resolved);
+  const destination = explicitDestination ?? path2.resolve(request.directory ?? process.cwd(), filename);
   if (!explicitDestination && !request.force) {
     await ensureDestinationAvailable(destination);
   }
@@ -5476,7 +6609,7 @@ async function responseOrWrapper(client, requestUrl, sourceUrl, targetName, sign
   };
 }
 function resourceLinks2(html, baseUrl) {
-  const root = parse4(html);
+  const root = parse5(html);
   const entries = root.querySelectorAll(".resourceworkaround a[href], .resourcecontent a[href], a.resourceworkaround[href]").map((linkNode) => ({
     name: linkNode.textContent.trim(),
     url: new URL(linkNode.getAttribute("href") ?? "", baseUrl).toString()
@@ -5492,7 +6625,7 @@ function isHtmlWrapper(response) {
   return type.includes("text/html") || type.includes("application/xhtml+xml");
 }
 function looksLikeLoginPage3(html) {
-  const root = parse4(html);
+  const root = parse5(html);
   return root.querySelector('form[action*="/login/"], input[name="password"], #page-login-index') !== null || /<title>\s*(?:log in|login)/iu.test(html);
 }
 function chooseUpstreamFilename(resolved) {
@@ -5553,7 +6686,7 @@ async function ensureDestinationAvailable(destination) {
   throw new UsageError(`Destination already exists: ${destination}`, "Choose another --dest path or pass --force to replace this exact file.");
 }
 async function writeResponse(response, destination, force, signal) {
-  const temporaryPath = path.join(path.dirname(destination), `.${path.basename(destination)}.moodle-${randomUUID()}.tmp`);
+  const temporaryPath = path2.join(path2.dirname(destination), `.${path2.basename(destination)}.moodle-${randomUUID()}.tmp`);
   let bytesWritten = 0;
   const counter = new Transform({
     transform(chunk, _encoding, callback) {
@@ -5625,7 +6758,7 @@ function isFileSystemError(error) {
 // src/skills.ts
 import { spawnSync as spawnSync3 } from "child_process";
 import { mkdirSync, readFileSync, writeFileSync, rmSync } from "fs";
-import path2 from "path";
+import path3 from "path";
 
 // src/command-contract.ts
 import { VERBS } from "@bunizao/cli-kit";
@@ -5682,7 +6815,7 @@ function isMutating(command) {
 var SKILL_NAME = "moodle-cli";
 var SKILL_SOURCE = "https://github.com/bunizao/moodle-cli";
 var SKILLS_SPEC_URL = "https://github.com/vercel-labs/skills";
-var SKILL_DESCRIPTION = "Read Moodle units, deadlines, grades, announcements and files; diagnose sign-in and manage a private MCP server.";
+var SKILL_DESCRIPTION = "Read Moodle units, deadlines, grades, announcements and files; submit assignment files; diagnose sign-in and manage a private MCP server.";
 var SKILL_BUNDLE_TEMPLATES = [
   ["SKILL.md", "skill.template.md"],
   ["references/setup-and-auth.md", "skill-references/setup-and-auth.md"],
@@ -5729,10 +6862,10 @@ function extractCommanderCommands(program) {
   return describeProgram(program).commands.flatMap((command) => commandDescriptionRows(command));
 }
 function commandDescriptionRows(command, parentPath = []) {
-  const path4 = [...parentPath, command.name];
+  const path5 = [...parentPath, command.name];
   const row = {
     name: command.name,
-    path: path4,
+    path: path5,
     description: command.description,
     arguments: command.positionals.map((argument) => ({
       name: argument.name,
@@ -5746,15 +6879,15 @@ function commandDescriptionRows(command, parentPath = []) {
       return { name, alias, description: option.description, required: option.required };
     })
   };
-  return [row, ...command.commands.flatMap((child) => commandDescriptionRows(child, path4))];
+  return [row, ...command.commands.flatMap((child) => commandDescriptionRows(child, path5))];
 }
 function writeGeneratedSkill(program, target = "SKILL.md") {
   const commands = extractCommanderCommands(program);
-  const targetDir = path2.dirname(target);
-  for (const obsolete of ["profile-and-courses", "deadlines-and-alerts", "coursework-and-grades", "downloads", "forums", "output-and-errors", "maintenance"]) rmSync(path2.join(targetDir, "references", `${obsolete}.md`), { force: true });
+  const targetDir = path3.dirname(target);
+  for (const obsolete of ["profile-and-courses", "deadlines-and-alerts", "coursework-and-grades", "downloads", "forums", "output-and-errors", "maintenance"]) rmSync(path3.join(targetDir, "references", `${obsolete}.md`), { force: true });
   for (const [relativeTarget, relativeTemplate] of SKILL_BUNDLE_TEMPLATES) {
-    const outputPath = relativeTarget === "SKILL.md" ? target : path2.join(targetDir, relativeTarget);
-    mkdirSync(path2.dirname(outputPath), { recursive: true });
+    const outputPath = relativeTarget === "SKILL.md" ? target : path3.join(targetDir, relativeTarget);
+    mkdirSync(path3.dirname(outputPath), { recursive: true });
     const template = readSkillTemplate(relativeTemplate);
     writeFileSync(outputPath, renderSkillMarkdown(commands, template), "utf8");
   }
@@ -5862,11 +6995,168 @@ function isCommandAvailable(name, runCommand) {
   return !result.error && result.status === 0;
 }
 function readSkillTemplate(relativePath = "skill.template.md") {
-  return readFileSync(path2.join(process.cwd(), "src", relativePath), "utf8");
+  return readFileSync(path3.join(process.cwd(), "src", relativePath), "utf8");
+}
+
+// src/onboarding.ts
+async function signInInteractively(ui, deps) {
+  deps.showWordmark(ui);
+  const login = loginUrl(deps.baseUrl);
+  let blocked = await deps.storesBlocked();
+  ui.note([
+    `No Moodle session for ${deps.baseUrl}.`,
+    "Sign in once; later commands reuse that session.",
+    ...blocked ? ["", "This terminal cannot read your browser's cookies, so the sign-in happens in a browser window the CLI opens."] : []
+  ].join("\n"), "One-time setup");
+  let session;
+  for (let attempt = 0; !session; attempt++) {
+    const method = await ui.select(attempt ? "Try another way?" : "How do you want to sign in?", [
+      ...blocked ? [] : [{ value: "own-browser", label: "Sign in in my own browser", hint: "the login page opens; press Enter here when done" }],
+      { value: "cli-browser", label: "Open a browser window from here", hint: "a Chrome, Edge or Brave the CLI controls" },
+      { value: "paste", label: "Paste the MoodleSession cookie", hint: "from the browser's developer tools" },
+      { value: "stop", label: "Not now", hint: "moodle auth login works any time" }
+    ]);
+    if (method === "stop") throw new AuthError(`No usable MoodleSession found for ${deps.baseUrl}.`, "Run moodle auth login when you are ready.");
+    if (method === "own-browser") {
+      await deps.openInBrowser(login).catch(() => void 0);
+      if (!await ui.confirm(`Signed in at ${login}? Enter reads the session from your browser`, { initial: true })) continue;
+      const spin = ui.spinner();
+      spin.start("Reading the session from your browser");
+      try {
+        session = await deps.readBrowserSession();
+        spin.stop(`Signed in as userid ${session.userid}`);
+      } catch (error) {
+        if (!(error instanceof AuthError)) {
+          spin.error("Could not read the browser session");
+          throw error;
+        }
+        spin.error(error.message);
+        blocked = await deps.storesBlocked();
+        if (blocked) ui.warn(error.hint ?? "The browser cookie store could not be read.");
+        else ui.info(`Finish signing in at ${login} in the browser you use, then choose the first option again.`);
+      }
+    } else if (method === "cli-browser") {
+      const spin = ui.spinner();
+      spin.start("Opening a browser window");
+      try {
+        session = await deps.browserLogin((url) => spin.message(`Finish signing in at ${url}`));
+        spin.stop(`Signed in as userid ${session.userid}`);
+      } catch (error) {
+        if (!(error instanceof AuthError)) {
+          spin.error("Sign-in did not complete");
+          throw error;
+        }
+        spin.error(error.message);
+        if (error.hint) ui.info(error.hint);
+      }
+    } else {
+      try {
+        session = await deps.pasteLogin();
+        ui.step(`Signed in as userid ${session.userid}`);
+      } catch (error) {
+        if (!(error instanceof AuthError)) throw error;
+        ui.warn([error.message, error.hint].filter(Boolean).join("\n"));
+      }
+    }
+  }
+  await offerRenewal(ui, deps);
+  return session;
+}
+async function offerRenewal(ui, deps) {
+  if (deps.platform !== "darwin" || await deps.keepaliveInstalled()) return;
+  ui.note([
+    `A background job can renew this session every ${KEEPALIVE_DEFAULT_INTERVAL_MINUTES} minutes, so it rarely expires.`,
+    "It runs moodle auth keepalive; moodle auth keepalive uninstall removes it."
+  ].join("\n"), "Stay signed in");
+  const wanted = await ui.confirm("Renew the session automatically?", { initial: true }).catch((error) => {
+    if (error instanceof CliError2 && error.code === "cancelled") return false;
+    throw error;
+  });
+  if (!wanted) {
+    ui.info("Later: moodle auth keepalive install");
+    return;
+  }
+  try {
+    const result = await deps.installKeepalive();
+    ui.step(`Renewing every ${result.interval_minutes} min; agent at ${result.plist_path}`);
+  } catch (error) {
+    ui.warn(`${error instanceof Error ? error.message : String(error)}
+Later: moodle auth keepalive install`);
+  }
+}
+
+// src/secret-input.ts
+var PASTE_MODE_ON = "\x1B[?2004h";
+var PASTE_MODE_OFF = "\x1B[?2004l";
+var PASTE_START = "\x1B[200~";
+var PASTE_END = "\x1B[201~";
+async function readSecretLine(input2, output, prompt) {
+  if (!input2.isTTY) {
+    return (await readAll(input2)).trim();
+  }
+  const wasRaw = input2.isRaw;
+  input2.setRawMode(true);
+  input2.resume();
+  output.write(prompt);
+  output.write(PASTE_MODE_ON);
+  try {
+    return await new Promise((resolve) => {
+      let content = "";
+      let pasting = false;
+      let esc = "";
+      const finish = (value) => {
+        input2.off("data", onData);
+        resolve(value);
+      };
+      const onData = (chunk) => {
+        for (const ch of chunk.toString("utf8")) {
+          if (esc) {
+            esc += ch;
+            if (esc === PASTE_START) {
+              pasting = true;
+              esc = "";
+            } else if (esc === PASTE_END) {
+              esc = "";
+              return finish(content.trim());
+            } else if (!PASTE_START.startsWith(esc) && !PASTE_END.startsWith(esc)) {
+              esc = "";
+            }
+            continue;
+          }
+          const code = ch.charCodeAt(0);
+          if (code === 27) {
+            esc = "\x1B";
+            continue;
+          }
+          if (pasting) {
+            content += ch;
+            continue;
+          }
+          if (code === 3 || code === 4) return finish(null);
+          if (code === 13 || code === 10) return finish(content.trim());
+          if (code === 8 || code === 127) content = content.slice(0, -1);
+          else if (code >= 32) content += ch;
+        }
+      };
+      input2.on("data", onData);
+    });
+  } finally {
+    output.write(PASTE_MODE_OFF);
+    input2.setRawMode(wasRaw);
+    input2.pause();
+    output.write("\n");
+  }
+}
+async function readAll(input2) {
+  const chunks2 = [];
+  for await (const chunk of input2) {
+    chunks2.push(typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8"));
+  }
+  return chunks2.join("");
 }
 
 // src/version.ts
-var VERSION = "0.8.0";
+var VERSION = "0.9.1";
 
 // src/forum.ts
 function parseDiscussionReference(value) {
@@ -5957,7 +7247,7 @@ function resolveTopLevelUrl(baseUrlOrOptions, targetValue, resolveCourseIdForUrl
   if (parsed.host.toLowerCase() !== configuredHost) {
     throw new UsageError(`URL host '${parsed.host.toLowerCase()}' does not match configured Moodle site '${configuredHost}'.`);
   }
-  const path4 = parsed.pathname.replace(/\/$/, "");
+  const path5 = parsed.pathname.replace(/\/$/, "");
   const intParam = (key, label) => {
     const value = parsed.searchParams.get(key);
     if (!value || !/^\d+$/.test(value)) {
@@ -5965,45 +7255,45 @@ function resolveTopLevelUrl(baseUrlOrOptions, targetValue, resolveCourseIdForUrl
     }
     return value;
   };
-  if (path4.endsWith("/mod/forum/discuss.php")) {
+  if (path5.endsWith("/mod/forum/discuss.php")) {
     return objectMode ? { commandName: "forum_discussion", kwargs: { discussion: intParam("d", "discussion ID"), postId: parsed.hash, asJson: false, asYaml: false } } : { commandName: "forum:discussion", args: [intParam("d", "discussion ID"), parsed.hash] };
   }
-  if (path4.endsWith("/mod/forum/view.php")) {
+  if (path5.endsWith("/mod/forum/view.php")) {
     return objectMode ? { commandName: "forum_discussions", kwargs: { forum: intParam("id", "forum module ID"), asJson: false, asYaml: false } } : { commandName: "forum:discussions", args: [intParam("id", "forum module ID")] };
   }
-  if (path4.endsWith("/mod/assign/view.php")) {
+  if (path5.endsWith("/mod/assign/view.php")) {
     const id2 = intParam("id", "assignment module ID");
     return objectMode ? { commandName: "assign", kwargs: { assign: id2, asJson: false, asYaml: false } } : { commandName: "assign", args: [id2] };
   }
-  if (path4.endsWith("/mod/quiz/view.php")) {
+  if (path5.endsWith("/mod/quiz/view.php")) {
     const id2 = intParam("id", "quiz module ID");
     return objectMode ? { commandName: "quiz", kwargs: { quiz: id2, asJson: false, asYaml: false } } : { commandName: "quiz", args: [id2] };
   }
-  if (path4.endsWith("/mod/resource/view.php")) {
+  if (path5.endsWith("/mod/resource/view.php")) {
     const id2 = intParam("id", "resource module ID");
     return objectMode ? { commandName: "resource", kwargs: { resource: id2, asJson: false, asYaml: false } } : { commandName: "resource", args: [id2] };
   }
-  if (path4.endsWith("/mod/url/view.php")) {
+  if (path5.endsWith("/mod/url/view.php")) {
     const id2 = intParam("id", "link module ID");
     return objectMode ? { commandName: "link", kwargs: { link: id2, asJson: false, asYaml: false } } : { commandName: "link", args: [id2] };
   }
-  if (path4.endsWith("/mod/page/view.php")) {
+  if (path5.endsWith("/mod/page/view.php")) {
     const id2 = intParam("id", "page module ID");
     return objectMode ? { commandName: "page", kwargs: { page: id2, asJson: false, asYaml: false } } : { commandName: "page", args: [id2] };
   }
-  if (path4.endsWith("/mod/folder/view.php")) {
+  if (path5.endsWith("/mod/folder/view.php")) {
     const id2 = intParam("id", "folder module ID");
     return objectMode ? { commandName: "folder", kwargs: { folder: id2, asJson: false, asYaml: false } } : { commandName: "folder", args: [id2] };
   }
-  if (path4.endsWith("/course/view.php")) {
+  if (path5.endsWith("/course/view.php")) {
     const id2 = intParam("id", "course ID");
     return objectMode ? { commandName: "course", kwargs: { course: id2, asJson: false, asYaml: false } } : { commandName: "course", args: [id2] };
   }
-  if (path4.endsWith("/course/user.php") && parsed.searchParams.get("mode") === "grade" || path4.includes("/grade/report/")) {
+  if (path5.endsWith("/course/user.php") && parsed.searchParams.get("mode") === "grade" || path5.includes("/grade/report/")) {
     const id2 = intParam("id", "course ID");
     return objectMode ? { commandName: "grades", kwargs: { course: id2, asJson: false, asYaml: false } } : { commandName: "grades", args: [id2] };
   }
-  if (path4.includes("/mod/") && path4.endsWith("/view.php")) {
+  if (path5.includes("/mod/") && path5.endsWith("/view.php")) {
     if (!resolveCourseIdForUrl) {
       throw new UsageError("Could not resolve course ID from the activity page.");
     }
@@ -6021,10 +7311,10 @@ function resolveTopLevelUrl(baseUrlOrOptions, targetValue, resolveCourseIdForUrl
 
 // src/mcp/cli.ts
 import { createHash as createHash3 } from "crypto";
-import { readFile as readFile8 } from "fs/promises";
-import { homedir as homedir11 } from "os";
-import { join as join11 } from "path";
-import { createInterface as createInterface3 } from "readline/promises";
+import { readFile as readFile9 } from "fs/promises";
+import { homedir as homedir14 } from "os";
+import { join as join13 } from "path";
+import { createInterface } from "readline/promises";
 import { fileURLToPath } from "url";
 
 // src/mcp/protocol.ts
@@ -6076,7 +7366,7 @@ function parseJsonRpcRequest(input2) {
   return JsonRpcRequestSchema.parse(input2);
 }
 function resolveProtocolVersion(request, context = {}) {
-  const meta = isRecord6(request.params?._meta) ? request.params._meta : void 0;
+  const meta = isRecord7(request.params?._meta) ? request.params._meta : void 0;
   const initializeVersion = request.method === "initialize" && typeof request.params?.protocolVersion === "string" ? request.params.protocolVersion : void 0;
   const requested = context.protocolVersion ?? stringValue3(meta?.["io.modelcontextprotocol/protocolVersion"]) ?? initializeVersion ?? MODERN_PROTOCOL_VERSION;
   if (!isSupportedProtocolVersion(requested)) {
@@ -6085,7 +7375,7 @@ function resolveProtocolVersion(request, context = {}) {
   return requested;
 }
 function assertRequestMetadata(request, protocolVersion2, context = {}) {
-  const meta = isRecord6(request.params?._meta) ? request.params._meta : void 0;
+  const meta = isRecord7(request.params?._meta) ? request.params._meta : void 0;
   const metaVersion = stringValue3(meta?.["io.modelcontextprotocol/protocolVersion"]);
   if (protocolVersion2 === MODERN_PROTOCOL_VERSION) {
     const parsed = ModernClientMetadataSchema.safeParse(meta);
@@ -6116,7 +7406,7 @@ function jsonRpcSuccess(id2, result) {
 function jsonRpcFailure(id2, error) {
   return { jsonrpc: "2.0", id: id2, error };
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringValue3(value) {
@@ -6191,7 +7481,7 @@ async function bridgeRemoteMcp(options) {
       await writeRemoteError(options.output, request.id, response.status);
       return;
     }
-    if (request.method === "initialize" && isRecord7(payload) && "result" in payload) {
+    if (request.method === "initialize" && isRecord8(payload) && "result" in payload) {
       negotiatedProtocolVersion = responseProtocolVersion(payload) ?? initializedProtocolVersion(request) ?? negotiatedProtocolVersion;
     }
     await writeJson(options.output, payload);
@@ -6216,7 +7506,7 @@ function normalizeMcpEndpoint(value) {
   return url.toString();
 }
 function protocolVersion(request, negotiatedVersion) {
-  const meta = isRecord7(request.params?._meta) ? request.params?._meta : void 0;
+  const meta = isRecord8(request.params?._meta) ? request.params?._meta : void 0;
   const metadataVersion = meta?.["io.modelcontextprotocol/protocolVersion"];
   if (typeof metadataVersion === "string") return metadataVersion;
   return initializedProtocolVersion(request) ?? negotiatedVersion;
@@ -6226,7 +7516,7 @@ function initializedProtocolVersion(request) {
   return typeof initialized === "string" ? initialized : void 0;
 }
 function responseProtocolVersion(payload) {
-  const result = isRecord7(payload.result) ? payload.result : void 0;
+  const result = isRecord8(payload.result) ? payload.result : void 0;
   return typeof result?.protocolVersion === "string" ? result.protocolVersion : void 0;
 }
 async function writeSseMessages(output, body, id2) {
@@ -6260,10 +7550,10 @@ async function forwardProtocolNegotiationError(output, response, id2) {
   }
   try {
     const payload = await response.json();
-    if (!isRecord7(payload) || payload.jsonrpc !== "2.0" || payload.id !== id2 || !isRecord7(payload.error)) {
+    if (!isRecord8(payload) || payload.jsonrpc !== "2.0" || payload.id !== id2 || !isRecord8(payload.error)) {
       return false;
     }
-    const data = isRecord7(payload.error.data) ? payload.error.data : void 0;
+    const data = isRecord8(payload.error.data) ? payload.error.data : void 0;
     const supported = Array.isArray(data?.supported) ? data.supported.filter((version) => typeof version === "string") : [];
     if (payload.error.code !== -32022 || typeof data?.requested !== "string" || supported.length === 0) {
       return false;
@@ -6283,9 +7573,9 @@ async function writeJson(output, value) {
 `);
 }
 function isBridgeRequest(value) {
-  return isRecord7(value) && value.jsonrpc === "2.0" && typeof value.method === "string";
+  return isRecord8(value) && value.jsonrpc === "2.0" && typeof value.method === "string";
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -6557,13 +7847,13 @@ function resolveConnection(options) {
 }
 
 // src/mcp/connectors/node-connectors.ts
-import { chmod as chmod4, mkdir as mkdir6, readFile as readFile6, rm as rm5, stat as stat2, writeFile as writeFile6 } from "fs/promises";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname6, join as join8 } from "path";
+import { chmod as chmod4, mkdir as mkdir7, readFile as readFile7, rm as rm5, stat as stat3, writeFile as writeFile6 } from "fs/promises";
+import { homedir as homedir11 } from "os";
+import { dirname as dirname6, join as join10 } from "path";
 var NodeConnectorFileSystem = class {
-  async exists(path4) {
+  async exists(path5) {
     try {
-      await stat2(path4);
+      await stat3(path5);
       return true;
     } catch (error) {
       if (isMissing3(error)) {
@@ -6572,20 +7862,20 @@ var NodeConnectorFileSystem = class {
       throw error;
     }
   }
-  async readText(path4) {
-    return readFile6(path4, "utf8");
+  async readText(path5) {
+    return readFile7(path5, "utf8");
   }
-  async writePrivate(path4, content) {
-    await mkdir6(dirname6(path4), { recursive: true, mode: 448 });
-    await writeFile6(path4, content, { encoding: "utf8", mode: 384 });
-    await chmod4(path4, 384);
+  async writePrivate(path5, content) {
+    await mkdir7(dirname6(path5), { recursive: true, mode: 448 });
+    await writeFile6(path5, content, { encoding: "utf8", mode: 384 });
+    await chmod4(path5, 384);
   }
-  async remove(path4) {
-    await rm5(path4, { force: true });
+  async remove(path5) {
+    await rm5(path5, { force: true });
   }
 };
 function createDefaultClientConnectors(profile, options = {}) {
-  const home = options.homeDirectory ?? homedir8();
+  const home = options.homeDirectory ?? homedir11();
   const platform = options.platform ?? process.platform;
   const fileSystem = options.fileSystem ?? new NodeConnectorFileSystem();
   const runtime = runtimeCommand(options.command, options.commandArgs);
@@ -6597,14 +7887,14 @@ function createDefaultClientConnectors(profile, options = {}) {
     endpoint: options.endpoint,
     accessToken: options.accessToken
   };
-  const claudeDesktop = platform === "darwin" ? join8(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : platform === "win32" ? join8(home, "AppData", "Roaming", "Claude", "claude_desktop_config.json") : join8(home, ".config", "Claude", "claude_desktop_config.json");
-  const vscodeUser = platform === "darwin" ? join8(home, "Library", "Application Support", "Code", "User", "mcp.json") : platform === "win32" ? join8(home, "AppData", "Roaming", "Code", "User", "mcp.json") : join8(home, ".config", "Code", "User", "mcp.json");
+  const claudeDesktop = platform === "darwin" ? join10(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : platform === "win32" ? join10(home, "AppData", "Roaming", "Claude", "claude_desktop_config.json") : join10(home, ".config", "Claude", "claude_desktop_config.json");
+  const vscodeUser = platform === "darwin" ? join10(home, "Library", "Application Support", "Code", "User", "mcp.json") : platform === "win32" ? join10(home, "AppData", "Roaming", "Code", "User", "mcp.json") : join10(home, ".config", "Code", "User", "mcp.json");
   return [
-    createCodexConnector({ ...shared, configPath: join8(home, ".codex", "config.toml"), detectionPath: join8(home, ".codex") }, fileSystem),
+    createCodexConnector({ ...shared, configPath: join10(home, ".codex", "config.toml"), detectionPath: join10(home, ".codex") }, fileSystem),
     createClaudeDesktopConnector({ ...shared, configPath: claudeDesktop, detectionPath: dirname6(claudeDesktop) }, fileSystem),
-    createClaudeCodeConnector({ ...shared, configPath: join8(home, ".claude.json"), detectionPath: join8(home, ".claude") }, fileSystem),
+    createClaudeCodeConnector({ ...shared, configPath: join10(home, ".claude.json"), detectionPath: join10(home, ".claude") }, fileSystem),
     createVsCodeConnector({ ...shared, configPath: vscodeUser, detectionPath: dirname6(vscodeUser) }, fileSystem),
-    createCursorConnector({ ...shared, configPath: join8(home, ".cursor", "mcp.json"), detectionPath: join8(home, ".cursor") }, fileSystem)
+    createCursorConnector({ ...shared, configPath: join10(home, ".cursor", "mcp.json"), detectionPath: join10(home, ".cursor") }, fileSystem)
   ];
 }
 var DefaultClientIntegration = class {
@@ -7365,16 +8655,19 @@ function asDeploymentError(error) {
   if (error instanceof DeploymentApplyError) {
     return error;
   }
+  if (error instanceof CliError2) {
+    return error;
+  }
   const detail = error instanceof Error && error.message ? `: ${error.message}` : "";
   return new DeploymentApplyError("DEPLOYMENT_FAILED", `The managed Moodle MCP deployment failed${detail}`, { cause: error });
 }
 
 // src/mcp/wrangler.ts
-import { createInterface as createInterface2 } from "readline/promises";
-import { mkdir as mkdir7 } from "fs/promises";
+import { createUi as createUi2 } from "@bunizao/cli-kit";
+import { mkdir as mkdir8, writeFile as writeFile7 } from "fs/promises";
 import { existsSync } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir12 } from "os";
+import { join as join11 } from "path";
 async function resolveWrangler(runner, options = {}) {
   const env = options.env ?? process.env;
   const notice = options.notice ?? ((text2) => process.stderr.write(`${text2}
@@ -7385,8 +8678,8 @@ async function resolveWrangler(runner, options = {}) {
     if (version && sameMajorAtLeast(version, WRANGLER_VERSION)) return { command: existing, args: [] };
     notice(`Ignoring ${existing} (${version ?? "unknown version"}); Cloudflare management needs Wrangler ${WRANGLER_VERSION.split(".")[0]}.x.`);
   }
-  const root = join9(options.homeDir ?? homedir9(), ".config", "moodle-cli", "tools", `wrangler@${WRANGLER_VERSION}`);
-  const script = join9(root, "node_modules", "wrangler", "bin", "wrangler.js");
+  const root = join11(options.homeDir ?? homedir12(), ".config", "moodle-cli", "tools", `wrangler@${WRANGLER_VERSION}`);
+  const script = join11(root, "node_modules", "wrangler", "bin", "wrangler.js");
   const bun = findExecutable("bun", env);
   const node = findExecutable("node", env);
   if (!bun && !node) throw new Error("Cloudflare management needs Bun or Node 22.13+. Install either, then retry moodle mcp deploy.");
@@ -7395,19 +8688,23 @@ async function resolveWrangler(runner, options = {}) {
     if (!bun && !npm) throw new Error("Install Bun or npm to download the pinned Cloudflare toolchain.");
     const yes = options.yes ?? (process.argv.includes("--yes") || process.argv.includes("-y"));
     if (!yes) {
-      if (!process.stdin.isTTY) throw new UsageError("Cloudflare management needs a first-use Wrangler download.", "Rerun with --yes to download and cache the pinned toolchain.");
-      const reader = createInterface2({ input: process.stdin, output: process.stderr });
-      try {
-        const answer = await reader.question(`Download Cloudflare Wrangler ${WRANGLER_VERSION} (cached for next time)? [Y/n] `);
-        if (answer.trim() && !/^y(?:es)?$/iu.test(answer.trim())) throw new UsageError("Wrangler download cancelled.", "Retry when ready to install Cloudflare's toolchain.");
-      } finally {
-        reader.close();
+      const ui = createUi2({ input: process.stdin, output: process.stderr });
+      if (!ui.interactive) throw new UsageError("Cloudflare management needs a first-use Wrangler download.", "Rerun with --yes to download and cache the pinned toolchain.");
+      if (!await ui.confirm(`Download Cloudflare Wrangler ${WRANGLER_VERSION} (cached for next time)?`, { initial: true })) {
+        throw new UsageError("Wrangler download cancelled.", "Retry when ready to install Cloudflare's toolchain.");
       }
     }
     notice(`Cloudflare management needs Wrangler ${WRANGLER_VERSION}; downloading once to ${root}.`);
-    await mkdir7(root, { recursive: true, mode: 448 });
-    await runner.run(bun ?? npm, bun ? ["install", "--cwd", root, "--no-save", `wrangler@${WRANGLER_VERSION}`] : ["install", "--prefix", root, "--no-save", "--package-lock=false", "--no-audit", "--no-fund", `wrangler@${WRANGLER_VERSION}`]);
-    if (!existsSync(script)) throw new Error("Wrangler installation did not create the expected executable. Retry moodle mcp deploy.");
+    await mkdir8(root, { recursive: true, mode: 448 });
+    await writeFile7(join11(root, "package.json"), '{ "private": true }\n');
+    const result = await runner.run(bun ?? npm, bun ? ["install", "--cwd", root, "--no-save", `wrangler@${WRANGLER_VERSION}`] : ["install", "--prefix", root, "--no-save", "--package-lock=false", "--no-audit", "--no-fund", `wrangler@${WRANGLER_VERSION}`]);
+    if (!existsSync(script)) {
+      const output = `${result.stderr}
+${result.stdout}`.trim().split(/\r?\n/u).slice(-5).join("\n");
+      throw new Error(`Wrangler installation did not create ${script}.${output ? `
+${output}` : ""}
+Remove ${root} and retry moodle mcp deploy.`);
+    }
   }
   return { command: node ?? bun, args: [script] };
 }
@@ -7419,18 +8716,18 @@ function sameMajorAtLeast(actual, pinned) {
 
 // src/mcp/deployment/node-adapters.ts
 import { isDeepStrictEqual } from "util";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
-import { chmod as chmod5, mkdir as mkdir8, mkdtemp, readFile as readFile7, rm as rm6, writeFile as writeFile7 } from "fs/promises";
-import { homedir as homedir10, tmpdir } from "os";
-import { basename, dirname as dirname7, join as join10 } from "path";
+import { chmod as chmod5, mkdir as mkdir9, mkdtemp, readFile as readFile8, rm as rm6, writeFile as writeFile8 } from "fs/promises";
+import { homedir as homedir13, tmpdir } from "os";
+import { basename, dirname as dirname7, join as join12 } from "path";
 var MODERN_MCP_VERSION = "2026-07-28";
 var WORKER_PROPAGATION_ATTEMPTS = 10;
 var WORKER_PROPAGATION_MAX_DELAY_MS = 4e3;
 var NodeDeploymentCommandRunner = class {
   async run(command, args, environment = {}) {
     return new Promise((resolve, reject) => {
-      const child = spawn2(command, args, {
+      const child = spawn3(command, args, {
         env: { ...process.env, ...environment },
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true
@@ -7614,7 +8911,7 @@ ${error.stderr}`)) {
       const binding = (value, name) => {
         let result2 = null;
         visit(value, (_key, item) => {
-          if (isRecord8(item) && item.name === name && typeof item.text === "string") result2 = item.text;
+          if (isRecord9(item) && item.name === name && typeof item.text === "string") result2 = item.text;
         });
         return result2;
       };
@@ -7646,6 +8943,10 @@ ${error.stderr}`)) {
     }
     await this.wrangler(["delete", input2.workerName, "--force"], input2.accountId);
   }
+  /** Locate or download Wrangler now, so a first-use prompt is not drawn under a spinner later. */
+  async prepare(options = {}) {
+    if (!this.wranglerBinPath) await resolveWrangler(this.runner, options);
+  }
   async wrangler(args, accountId, environmentOverrides = {}) {
     const environment = { ...environmentOverrides };
     if (accountId) {
@@ -7660,7 +8961,7 @@ ${error.stderr}`)) {
   }
 };
 async function copyReleaseBundle(source, destination) {
-  await writeFile7(destination, await readFile7(source));
+  await writeFile8(destination, await readFile8(source));
 }
 var NodeReleaseMaterializer = class {
   constructor(options) {
@@ -7669,13 +8970,13 @@ var NodeReleaseMaterializer = class {
   options;
   async prepare(plan, credentials) {
     const temporaryRoot = this.options.temporaryRoot ?? tmpdir();
-    await mkdir8(temporaryRoot, { recursive: true });
-    const artifactDirectory = await mkdtemp(join10(temporaryRoot, "moodle-mcp-"));
+    await mkdir9(temporaryRoot, { recursive: true });
+    const artifactDirectory = await mkdtemp(join12(temporaryRoot, "moodle-mcp-"));
     await chmod5(artifactDirectory, 448);
-    const workerFile = join10(artifactDirectory, basename(this.options.workerBundlePath));
+    const workerFile = join12(artifactDirectory, basename(this.options.workerBundlePath));
     await copyReleaseBundle(this.options.workerBundlePath, workerFile);
-    const wranglerConfigPath = join10(artifactDirectory, "wrangler.json");
-    const secretsFilePath = join10(artifactDirectory, "secrets.json");
+    const wranglerConfigPath = join12(artifactDirectory, "wrangler.json");
+    const secretsFilePath = join12(artifactDirectory, "secrets.json");
     const expectedHosts = endpointHosts(plan.intent.workerName, plan.existing?.productionEndpoint);
     const config = {
       $schema: "node_modules/wrangler/config-schema.json",
@@ -7715,18 +9016,18 @@ var NodeReleaseMaterializer = class {
     if (credentials.previousTokensExpireAt !== void 0 && Number.isFinite(credentials.previousTokensExpireAt)) {
       secrets.TOKEN_OVERLAP_EXPIRES_AT = String(credentials.previousTokensExpireAt);
     }
-    await writeFile7(wranglerConfigPath, `${JSON.stringify(config, null, 2)}
+    await writeFile8(wranglerConfigPath, `${JSON.stringify(config, null, 2)}
 `, { mode: 384 });
-    await writeFile7(secretsFilePath, `${JSON.stringify(secrets)}
+    await writeFile8(secretsFilePath, `${JSON.stringify(secrets)}
 `, { mode: 384 });
     await chmod5(wranglerConfigPath, 384);
     await chmod5(secretsFilePath, 384);
     let recoveryConfigPath;
     try {
-      const recoveryBundle = process.env.MOODLE_BUNDLED_RECOVERY ?? join10(dirname7(this.options.workerBundlePath), "recovery.js");
-      await copyReleaseBundle(recoveryBundle, join10(artifactDirectory, "recovery.js"));
-      recoveryConfigPath = join10(artifactDirectory, "wrangler-recovery.json");
-      await writeFile7(recoveryConfigPath, `${JSON.stringify({ ...config, main: "./recovery.js" })}
+      const recoveryBundle = process.env.MOODLE_BUNDLED_RECOVERY ?? join12(dirname7(this.options.workerBundlePath), "recovery.js");
+      await copyReleaseBundle(recoveryBundle, join12(artifactDirectory, "recovery.js"));
+      recoveryConfigPath = join12(artifactDirectory, "wrangler-recovery.json");
+      await writeFile8(recoveryConfigPath, `${JSON.stringify({ ...config, main: "./recovery.js" })}
 `, { mode: 384 });
     } catch (error) {
       if (!isMissing4(error) || plan.existing) throw error;
@@ -7782,10 +9083,10 @@ var FetchManagedWorkerClient = class {
       })
     }, isRetryableSessionUpload);
     const body = await safeJson(response);
-    if (response.ok && isRecord8(body) && typeof body.revision === "number") {
+    if (response.ok && isRecord9(body) && typeof body.revision === "number") {
       return { revision: body.revision };
     }
-    const code = isRecord8(body) && typeof body.code === "string" ? body.code : "SESSION_UPLOAD_FAILED";
+    const code = isRecord9(body) && typeof body.code === "string" ? body.code : "SESSION_UPLOAD_FAILED";
     throw new DeploymentApplyError(code, `The Worker rejected the Moodle session update (${code})`);
   }
   async getReadiness(input2) {
@@ -7793,7 +9094,7 @@ var FetchManagedWorkerClient = class {
       headers: { authorization: `Bearer ${input2.sessionSyncToken}` }
     }, isRetryableSessionUpload);
     const body = await safeJson(response);
-    if (isRecord8(body) && (body.status === "pass" || body.status === "warn" || body.status === "fail")) {
+    if (isRecord9(body) && (body.status === "pass" || body.status === "warn" || body.status === "fail")) {
       const session = firstHealthCheck(body, "moodle:session");
       const upstream = firstHealthCheck(body, "moodle:upstream");
       return {
@@ -7820,7 +9121,7 @@ var FetchManagedWorkerClient = class {
       isRetryableWorkerPropagation
     );
     const healthBody = await safeJson(health);
-    if (!health.ok || !isRecord8(healthBody) || healthBody.status !== "pass") {
+    if (!health.ok || !isRecord9(healthBody) || healthBody.status !== "pass") {
       throw new DeploymentApplyError("HEALTH_CHECK_FAILED", "Worker liveness check failed");
     }
     let readiness = await this.getReadiness(input2);
@@ -7851,11 +9152,11 @@ var FetchManagedWorkerClient = class {
     if (!Array.isArray(courses)) throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP list_courses returned no course list");
     if (courses.length) {
       const first2 = courses[0];
-      if (!isRecord8(first2) || !Number.isSafeInteger(first2.id) || Number(first2.id) <= 0) {
+      if (!isRecord9(first2) || !Number.isSafeInteger(first2.id) || Number(first2.id) <= 0) {
         throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP list_courses returned no usable course ID");
       }
       const detail = readableToolResult(await this.mcpCall(input2.endpoint, input2.mcpAccessToken, "tools/call", { name: "get_course", arguments: { courseId: first2.id } }, 5));
-      if (!isRecord8(detail.course) || !isRecord8(detail.course.course) || detail.course.course.id !== first2.id || !Array.isArray(detail.course.sections)) {
+      if (!isRecord9(detail.course) || !isRecord9(detail.course.course) || detail.course.course.id !== first2.id || !Array.isArray(detail.course.sections)) {
         throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP course lookup did not match the listed course");
       }
     }
@@ -7879,7 +9180,7 @@ var FetchManagedWorkerClient = class {
       headers: { authorization: `Bearer ${input2.sessionSyncToken}` }
     });
     const body = await safeJson(response);
-    if (!response.ok || !isRecord8(body) || typeof body.code !== "string" || typeof body.expiresAt !== "string") {
+    if (!response.ok || !isRecord9(body) || typeof body.code !== "string" || typeof body.expiresAt !== "string") {
       throw new DeploymentApplyError("PAIRING_UNAVAILABLE", "The Worker could not open a pairing window");
     }
     return {
@@ -7916,7 +9217,7 @@ var FetchManagedWorkerClient = class {
       })
     }, isRetryableSessionUpload);
     const body = await safeJson(response);
-    if (!response.ok || !isRecord8(body) || body.jsonrpc !== "2.0" || body.id !== id2 || "error" in body || !("result" in body)) {
+    if (!response.ok || !isRecord9(body) || body.jsonrpc !== "2.0" || body.id !== id2 || "error" in body || !("result" in body)) {
       throw new DeploymentApplyError("MCP_SMOKE_FAILED", `MCP ${method} check failed`);
     }
     if (method === "tools/call") readableToolResult(body.result);
@@ -7934,13 +9235,13 @@ var FetchManagedWorkerClient = class {
   }
 };
 var PrivateDeploymentReceiptStore = class {
-  constructor(baseDirectory = join10(homedir10(), ".config", "moodle-cli", "mcp", "deployments")) {
+  constructor(baseDirectory = join12(homedir13(), ".config", "moodle-cli", "mcp", "deployments")) {
     this.baseDirectory = baseDirectory;
   }
   baseDirectory;
   async read(profile) {
     try {
-      const parsed = JSON.parse(await readFile7(this.path(profile), "utf8"));
+      const parsed = JSON.parse(await readFile8(this.path(profile), "utf8"));
       return isReceipt(parsed) ? parsed : null;
     } catch (error) {
       if (isMissing4(error)) {
@@ -7950,11 +9251,11 @@ var PrivateDeploymentReceiptStore = class {
     }
   }
   async write(receipt) {
-    const path4 = this.path(receipt.profile);
-    await mkdir8(dirname7(path4), { recursive: true, mode: 448 });
-    await writeFile7(path4, `${JSON.stringify(receipt, null, 2)}
+    const path5 = this.path(receipt.profile);
+    await mkdir9(dirname7(path5), { recursive: true, mode: 448 });
+    await writeFile8(path5, `${JSON.stringify(receipt, null, 2)}
 `, { mode: 384 });
-    await chmod5(path4, 384);
+    await chmod5(path5, 384);
   }
   async delete(profile) {
     await rm6(this.path(profile), { force: true });
@@ -7963,11 +9264,11 @@ var PrivateDeploymentReceiptStore = class {
     if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(profile)) {
       throw new Error("Invalid Moodle MCP profile name");
     }
-    return join10(this.baseDirectory, `${profile}.json`);
+    return join12(this.baseDirectory, `${profile}.json`);
   }
 };
 function createDefaultManagedDeployment(options) {
-  const homeDirectory = options.homeDirectory ?? homedir10();
+  const homeDirectory = options.homeDirectory ?? homedir13();
   const platform = options.platform ?? process.platform;
   const runtime = runtimeCommand(options.executable, options.executableArgs);
   const defaults = {
@@ -7994,7 +9295,7 @@ function createDefaultManagedDeployment(options) {
       command: runtime.command,
       commandArgs: runtime.args
     }),
-    receipts: new PrivateDeploymentReceiptStore(join10(homeDirectory, ".config", "moodle-cli", "mcp", "deployments")),
+    receipts: new PrivateDeploymentReceiptStore(join12(homeDirectory, ".config", "moodle-cli", "mcp", "deployments")),
     createToken: () => randomBytes2(32).toString("base64url")
   };
   return new ManagedMcpDeployment({ ...defaults, ...options.dependencies });
@@ -8005,17 +9306,17 @@ function digest(value) {
 function ownershipId(accountId, workerName) {
   return `moodle-cli:${accountId}:${workerName}`;
 }
-function endpointUrl(endpoint, path4) {
-  return `${endpoint.replace(/\/$/u, "")}${path4}`;
+function endpointUrl(endpoint, path5) {
+  return `${endpoint.replace(/\/$/u, "")}${path5}`;
 }
 async function pinExpectedHosts(configPath, workerName, productionEndpoint) {
   let config;
   try {
-    config = JSON.parse(await readFile7(configPath, "utf8"));
+    config = JSON.parse(await readFile8(configPath, "utf8"));
   } catch {
     throw new DeploymentApplyError("RELEASE_CONFIG_INVALID", "The generated Wrangler configuration is invalid");
   }
-  if (!isRecord8(config) || !isRecord8(config.vars)) {
+  if (!isRecord9(config) || !isRecord9(config.vars)) {
     throw new DeploymentApplyError("RELEASE_CONFIG_INVALID", "The generated Wrangler configuration is invalid");
   }
   const hosts = endpointHosts(workerName, productionEndpoint);
@@ -8023,7 +9324,7 @@ async function pinExpectedHosts(configPath, workerName, productionEndpoint) {
     throw new DeploymentApplyError("MISSING_ENDPOINT", "The Worker production endpoint is invalid");
   }
   config.vars.EXPECTED_HOSTS = hosts.join(",");
-  await writeFile7(configPath, `${JSON.stringify(config, null, 2)}
+  await writeFile8(configPath, `${JSON.stringify(config, null, 2)}
 `, { mode: 384 });
 }
 function endpointHosts(workerName, endpoint) {
@@ -8055,18 +9356,18 @@ async function safeJson(response) {
 }
 function firstHealthCheck(body, name) {
   const checks = body.checks;
-  if (!isRecord8(checks) || !Array.isArray(checks[name])) {
+  if (!isRecord9(checks) || !Array.isArray(checks[name])) {
     return null;
   }
   const check = checks[name][0];
-  return isRecord8(check) ? check : null;
+  return isRecord9(check) ? check : null;
 }
 function readableToolResult(result) {
-  if (isRecord8(result) && result.isError !== true && Array.isArray(result.content)) {
+  if (isRecord9(result) && result.isError !== true && Array.isArray(result.content)) {
     try {
-      const text2 = result.content.filter((block) => isRecord8(block) && block.type === "text").map((block) => block.text).join("\n");
+      const text2 = result.content.filter((block) => isRecord9(block) && block.type === "text").map((block) => block.text).join("\n");
       const parsed = JSON.parse(text2);
-      if (isRecord8(parsed) && isDeepStrictEqual(parsed, result.structuredContent)) return parsed;
+      if (isRecord9(parsed) && isDeepStrictEqual(parsed, result.structuredContent)) return parsed;
     } catch {
     }
   }
@@ -8074,7 +9375,7 @@ function readableToolResult(result) {
 }
 function mcpUserFullname(result) {
   const user = readableToolResult(result).user;
-  return isRecord8(user) && typeof user.fullname === "string" && user.fullname.trim() ? user.fullname.trim() : null;
+  return isRecord9(user) && typeof user.fullname === "string" && user.fullname.trim() ? user.fullname.trim() : null;
 }
 function parseJsonOutput(output) {
   const candidates = [output.indexOf("{"), output.indexOf("[")].filter((index) => index >= 0).sort((a, b) => a - b);
@@ -8090,7 +9391,7 @@ function parseJsonOutput(output) {
 function deploymentHistory(value) {
   const entries = [];
   visit(value, (_key, item) => {
-    if (!isRecord8(item) || !Array.isArray(item.versions)) {
+    if (!isRecord9(item) || !Array.isArray(item.versions)) {
       return;
     }
     const versionId = activeVersionId(item.versions);
@@ -8098,7 +9399,7 @@ function deploymentHistory(value) {
       return;
     }
     const createdOn = typeof item.created_on === "string" ? Date.parse(item.created_on) : Number.NaN;
-    const message = isRecord8(item.annotations) ? item.annotations["workers/message"] : void 0;
+    const message = isRecord9(item.annotations) ? item.annotations["workers/message"] : void 0;
     entries.push({
       versionId,
       message: typeof message === "string" ? message : null,
@@ -8109,7 +9410,7 @@ function deploymentHistory(value) {
   return entries.sort((a, b) => b.createdOn - a.createdOn || b.index - a.index).map(({ versionId, message }) => ({ versionId, message }));
 }
 function activeVersionId(versions) {
-  const records = versions.filter(isRecord8);
+  const records = versions.filter(isRecord9);
   const active = records.find((version) => version.percentage === 100) ?? records[0];
   const id2 = active?.version_id ?? active?.versionId;
   return typeof id2 === "string" ? id2 : null;
@@ -8120,7 +9421,7 @@ function releaseDigestFromMessage(message) {
 function collectAccountObjects(value) {
   const accounts = [];
   visit(value, (_key, item) => {
-    if (!isRecord8(item)) {
+    if (!isRecord9(item)) {
       return;
     }
     const id2 = typeof item.id === "string" ? item.id : typeof item.account_id === "string" ? item.account_id : null;
@@ -8149,14 +9450,14 @@ function visit(value, visitor, key = "") {
     for (const item of value) {
       visit(item, visitor);
     }
-  } else if (isRecord8(value)) {
+  } else if (isRecord9(value)) {
     for (const [childKey, item] of Object.entries(value)) {
       visit(item, visitor, childKey);
     }
   }
 }
 function isReceipt(value) {
-  if (!isRecord8(value)) {
+  if (!isRecord9(value)) {
     return false;
   }
   return [
@@ -8170,7 +9471,7 @@ function isReceipt(value) {
     "releaseDigest"
   ].every((key) => typeof value[key] === "string") && typeof value.sessionRevision === "number";
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isMissing4(error) {
@@ -8234,13 +9535,23 @@ var READ_ONLY_ANNOTATIONS = {
   idempotentHint: true,
   openWorldHint: true
 };
+var WRITE_ANNOTATIONS = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
+};
+var WRITE_TOOLS = /* @__PURE__ */ new Set(["submit"]);
 var aliases = { get_overview: "home", list_courses: "units", get_course: "unit", get_activity: "item", get_grades: "grades", get_thread: "thread", get_file: "file" };
 var TOOL_CATALOG = Object.entries(intentContracts).map(([name, contract]) => ({
   name,
   description: intentDescription(name),
   inputSchema: compactSchema(z4.toJSONSchema(contract.input, { io: "input" })),
-  annotations: READ_ONLY_ANNOTATIONS
+  annotations: WRITE_TOOLS.has(name) ? WRITE_ANNOTATIONS : READ_ONLY_ANNOTATIONS
 }));
+function toolsFor(gateway) {
+  return gateway.submitAssignment ? TOOL_CATALOG : TOOL_CATALOG.filter((tool) => !WRITE_TOOLS.has(tool.name));
+}
 var TOOL_OUTPUT_SCHEMAS = Object.fromEntries(Object.entries(intentContracts).map(([name, contract]) => [name, compactSchema(z4.toJSONSchema(contract.output))]));
 function compactSchema(value) {
   if (Array.isArray(value)) return value.map(compactSchema);
@@ -8278,7 +9589,7 @@ function createMoodleMcpServer(gateway, options = {}) {
             protocolVersion: protocolVersion2,
             capabilities: { tools: { listChanged: false } },
             serverInfo,
-            instructions: "Read-only access to the authenticated user's Moodle data."
+            instructions: gateway.submitAssignment ? "Access to the authenticated user's Moodle data. Only submit writes; it defaults to a dry run." : "Read-only access to the authenticated user's Moodle data."
           });
         }
         if (request.method === "ping") {
@@ -8286,7 +9597,7 @@ function createMoodleMcpServer(gateway, options = {}) {
         }
         if (request.method === "tools/list") {
           return jsonRpcSuccess(id2, {
-            tools: TOOL_CATALOG,
+            tools: toolsFor(gateway),
             resultType: "complete",
             _meta: RESULT_META
           });
@@ -8342,8 +9653,9 @@ async function callTool(gateway, params) {
   const requested = typeof params?.name === "string" ? params.name : "";
   const name = Object.hasOwn(aliases, requested) ? aliases[requested] : requested;
   if (!Object.hasOwn(intentContracts, name) && !["get_user", "list_activities", "list_forums"].includes(name)) throw new McpCallError("TOOL_NOT_FOUND", `Unknown Moodle tool: ${requested || "<missing>"}`);
+  if (WRITE_TOOLS.has(name) && !gateway.submitAssignment) throw new McpCallError("TOOL_NOT_FOUND", `${requested} is only available on a local MCP server with access to the files.`);
   const raw = params?.arguments ?? {};
-  if (!isRecord9(raw)) throw new McpCallError("INVALID_TOOL_ARGUMENTS", "Tool arguments must be an object.");
+  if (!isRecord10(raw)) throw new McpCallError("INVALID_TOOL_ARGUMENTS", "Tool arguments must be an object.");
   const args = { ...raw };
   if (Object.hasOwn(aliases, requested)) {
     const renames = { courseId: "unit", activityId: "ref", discussionId: "discussion_id", source: "ref", todoDays: "days", gradedOnly: "graded_only" };
@@ -8391,7 +9703,7 @@ async function callTool(gateway, params) {
       const mapped2 = { type: "MOODLE_RESULT_INVALID", message: `Moodle returned ${name} data in an unexpected shape.`, hint: "Retry once; if it persists, run the same command locally with --verbose and report the tool name.", issues: error.issues.slice(0, 5).map((issue) => ({ path: issue.path.join("."), message: issue.message })) };
       return { content: [{ type: "text", text: JSON.stringify({ error: mapped2 }) }], structuredContent: { error: mapped2 }, isError: true, resultType: "complete", _meta: RESULT_META };
     }
-    const mapped = error instanceof ReferenceError ? { type: error.code, code: error.code, message: error.message, hint: error.hint, candidates: error.candidates } : mapMoodleError(error);
+    const mapped = error instanceof ReferenceError ? { type: error.code, code: error.code, message: error.message, hint: error.hint, candidates: error.candidates } : mapMoodleError(error, WRITE_TOOLS.has(name));
     return { content: [{ type: "text", text: JSON.stringify({ error: mapped }) }], structuredContent: { error: mapped }, isError: true, resultType: "complete", _meta: RESULT_META };
   }
 }
@@ -8410,9 +9722,11 @@ function toolContent(name, payload, structuredContent) {
     }
   ];
 }
-function mapMoodleError(error) {
-  const record2 = isRecord9(error) ? error : {};
-  const code = typeof record2.code === "string" ? record2.code : "";
+function mapMoodleError(error, verbatim = false) {
+  const record3 = isRecord10(error) ? error : {};
+  const code = typeof record3.code === "string" ? record3.code : "";
+  const own = verbatim && typeof record3.message === "string" && record3.message.trim() && code !== "auth" ? record3.message : void 0;
+  const ownHint = verbatim && typeof record3.hint === "string" && record3.hint.trim() ? record3.hint : void 0;
   const typeByCode = {
     auth: "MOODLE_AUTH_REQUIRED",
     not_found: "MOODLE_NOT_FOUND",
@@ -8421,8 +9735,8 @@ function mapMoodleError(error) {
   };
   const type = code.startsWith("MOODLE_") ? code : typeByCode[code] ?? "MOODLE_UPSTREAM_ERROR";
   const message = type === "MOODLE_AUTH_REQUIRED" ? "The Moodle session has expired. Sign in again." : type === "MOODLE_NOT_FOUND" || type === "MOODLE_COURSE_NOT_FOUND" ? "The requested Moodle item was not found." : type === "MOODLE_INVALID_REQUEST" ? "The Moodle request is invalid." : "Moodle could not complete the request.";
-  const moodleCode = typeof record2.moodleErrorCode === "string" && /^[a-z][a-z0-9_]{0,63}$/u.test(record2.moodleErrorCode) ? record2.moodleErrorCode : void 0;
-  return { type, message, hint: type === "MOODLE_AUTH_REQUIRED" ? "Run moodle mcp login for a remote server, or moodle auth login locally; then retry." : "Run moodle doctor, or refine the request using units and find.", ...type === "MOODLE_AUTH_REQUIRED" ? { recovery: { action: "moodle mcp login", where: "machine running moodle-cli", then: "retry this tool" } } : {}, ...moodleCode ? { moodleCode } : {} };
+  const moodleCode = typeof record3.moodleErrorCode === "string" && /^[a-z][a-z0-9_]{0,63}$/u.test(record3.moodleErrorCode) ? record3.moodleErrorCode : void 0;
+  return { type, message: own ?? message, hint: ownHint ?? (type === "MOODLE_AUTH_REQUIRED" ? "Run moodle mcp login for a remote server, or moodle auth login locally; then retry." : "Run moodle doctor, or refine the request using units and find."), ...type === "MOODLE_AUTH_REQUIRED" ? { recovery: { action: "moodle mcp login", where: "machine running moodle-cli", then: "retry this tool" } } : {}, ...moodleCode ? { moodleCode } : {} };
 }
 var McpCallError = class extends Error {
   type;
@@ -8434,11 +9748,11 @@ var McpCallError = class extends Error {
     this.details = details;
   }
 };
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isMoodleFile(value) {
-  return isRecord9(value) && typeof value.name === "string" && typeof value.mimeType === "string" && typeof value.bytes === "number" && typeof value.uri === "string" && typeof value.blob === "string";
+  return isRecord10(value) && typeof value.name === "string" && typeof value.mimeType === "string" && typeof value.bytes === "number" && typeof value.uri === "string" && typeof value.blob === "string";
 }
 
 // src/mcp/stdio.ts
@@ -8494,12 +9808,12 @@ async function writeResponse2(output, response) {
 `);
 }
 function initializeProtocolVersion(input2) {
-  if (!isRecord10(input2) || input2.method !== "initialize" || !isRecord10(input2.params)) {
+  if (!isRecord11(input2) || input2.method !== "initialize" || !isRecord11(input2.params)) {
     return void 0;
   }
   return typeof input2.params.protocolVersion === "string" ? input2.params.protocolVersion : void 0;
 }
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -8520,9 +9834,9 @@ function deriveMcpWorkerName(moodleOrigin) {
 var DefaultMcpCommandService = class {
   constructor(options) {
     this.options = options;
-    this.homeDirectory = options.homeDir ?? homedir11();
+    this.homeDirectory = options.homeDir ?? homedir14();
     this.wranglerInstance = options.wrangler;
-    this.receipts = options.receipts ?? new PrivateDeploymentReceiptStore(join11(this.homeDirectory, ".config", "moodle-cli", "mcp", "deployments"));
+    this.receipts = options.receipts ?? new PrivateDeploymentReceiptStore(join13(this.homeDirectory, ".config", "moodle-cli", "mcp", "deployments"));
     this.credentials = options.credentials ?? createDefaultCredentialStore({ platform: process.platform, homeDirectory: this.homeDirectory });
     this.worker = options.worker ?? new FetchManagedWorkerClient(options.fetchImpl);
     this.renewal = options.renewal ?? new DefaultRenewalIntegration({
@@ -8547,6 +9861,7 @@ var DefaultMcpCommandService = class {
   notifyRenewalSignIn;
   progressReporter;
   async deploy(input2) {
+    await this.prepareToolchain(input2.yes);
     const progress = this.progress();
     try {
       progress.begin("Reading Cloudflare account and deployment state");
@@ -8657,6 +9972,7 @@ var DefaultMcpCommandService = class {
   async status(input2) {
     const config = await this.config();
     const profile = deriveMcpProfile(config.baseUrl);
+    await this.prepareToolchain();
     const progress = this.progress();
     let managed;
     try {
@@ -8699,6 +10015,7 @@ var DefaultMcpCommandService = class {
   }
   async login() {
     const profile = deriveMcpProfile((await this.config()).baseUrl);
+    await this.prepareToolchain();
     const progress = this.progress();
     try {
       progress.begin("Reading your Moodle session (a browser sign-in may be required)");
@@ -8932,7 +10249,7 @@ var DefaultMcpCommandService = class {
   async pushSessionFromStdin() {
     const config = await this.config();
     const profile = deriveMcpProfile(config.baseUrl);
-    const raw = (await readAll(this.options.stdin ?? process.stdin)).trim();
+    const raw = (await readAll2(this.options.stdin ?? process.stdin)).trim();
     const cookieValue = raw.startsWith("MoodleSession=") ? raw.slice("MoodleSession=".length).trim() : raw;
     if (!cookieValue || /[\r\n]/u.test(cookieValue)) throw new UsageError("Standard input did not contain one Moodle session cookie.");
     const session = await getAuthenticatedSession(config.baseUrl, {
@@ -9077,7 +10394,7 @@ Selection: `)).trim());
     if (this.options.prompt) return this.options.prompt(question);
     const input2 = this.options.stdin ?? process.stdin;
     const output = this.options.stderr ?? process.stderr;
-    const readline = createInterface3({ input: input2, output });
+    const readline = createInterface({ input: input2, output });
     return readline.question(question).finally(() => readline.close());
   }
   workerBundlePath() {
@@ -9087,8 +10404,14 @@ Selection: `)).trim());
     this.wranglerInstance ??= new NodeWranglerDeploymentAdapter();
     return this.wranglerInstance;
   }
+  // The first-use Wrangler download asks a question, so it runs before a spinner
+  // owns the terminal rather than drawing its prompt underneath one.
+  async prepareToolchain(yes = false) {
+    if (this.options.createDeployment || this.options.wrangler) return;
+    await this.wrangler().prepare({ yes });
+  }
   releaseDigest() {
-    return readFile8(this.workerBundlePath()).then((content) => sha256(content));
+    return readFile9(this.workerBundlePath()).then((content) => sha256(content));
   }
   // True when a deployment receipt exists but its recorded release digest no
   // longer matches the Worker bundle shipped with this CLI, i.e. the remote
@@ -9212,7 +10535,7 @@ function displayClientName(client) {
   };
   return names[client];
 }
-async function readAll(input2) {
+async function readAll2(input2) {
   const decoder = new TextDecoder();
   let value = "";
   for await (const chunk of input2) value += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
@@ -9233,12 +10556,12 @@ function sha256(value) {
 // src/cli.ts
 var NOUNS = [
   { name: "units", aliases: ["courses"], verbs: ["list", "show"], defaultByArity: { 0: "list", 1: "show" } },
-  { name: "activities", verbs: ["list", "show"], defaultByArity: { 1: "list" }, valueFlags: ["--limit", "--section"] },
+  { name: "activities", verbs: ["list", "show"], defaultByArity: { 0: "list", 1: "list" }, valueFlags: ["--limit", "--section"] },
   { name: "grades", verbs: ["list"], defaultByArity: { 0: "list", 1: "list" } },
   {
     name: "forums",
     verbs: ["list", "show", "search"],
-    defaultByArity: { 1: "list" },
+    defaultByArity: { 0: "list", 1: "list" },
     valueFlags: ["--limit", "--course", "--forum", "--limit-forums", "--limit-discussions", "--unit"]
   },
   { name: "threads", verbs: ["show"], defaultByArity: { 1: "show" }, valueFlags: ["--post", "--limit", "--offset"] }
@@ -9246,7 +10569,8 @@ var NOUNS = [
 function buildProgram(io = {}) {
   const stdout = io.stdout ?? process.stdout;
   const stderr = io.stderr ?? process.stderr;
-  const program = createProgram({ name: "moodle", version: VERSION, description: "Terminal-first CLI for Moodle LMS." });
+  const program = createProgram({ name: "moodle", version: VERSION, description: MOODLE_TAGLINE });
+  banner(program, MOODLE_WORDMARK);
   program.configureOutput({
     writeOut: (text2) => stdout.write(text2),
     writeErr: (text2) => stderr.write(text2),
@@ -9271,9 +10595,11 @@ function buildProgram(io = {}) {
     width: stdout.columns || void 0,
     color: !process.env.NO_COLOR && program.opts().color !== false && outputFormat({ ...program.opts(), ...options }, stdout) === "table"
   });
+  configureTerminalTables({ color: () => colorEnabled2(stdout, io.env) && program.opts().color !== false });
   const count = (key, local, fallback) => program.opts()[key] ?? local ?? fallback;
   const runtime = {
     client: null,
+    busy: false,
     screen,
     count,
     baseUrl: async () => (await loadConfig({ env: io.env, cwd: io.cwd, homeDir: io.homeDir, stdin: io.stdin, stderr, fetch: io.fetchImpl })).baseUrl,
@@ -9283,11 +10609,11 @@ function buildProgram(io = {}) {
         let inflight = 0;
         let displayed = false;
         let timer;
-        runtime.client = await createMoodleClient(baseUrl, {
+        const connect = () => createMoodleClient(baseUrl, {
           env: io.env,
           fetchImpl: async (input2, init) => {
             const started2 = Date.now();
-            const tty = Boolean("isTTY" in stderr && stderr.isTTY) && !program.opts().json && !io.rootArgs?.includes("--json");
+            const tty = Boolean("isTTY" in stderr && stderr.isTTY) && !program.opts().json && !io.rootArgs?.includes("--json") && !runtime.busy;
             if (tty && inflight++ === 0) timer = setTimeout(() => {
               displayed = true;
               stderr.write("Loading Moodle\u2026");
@@ -9313,14 +10639,23 @@ function buildProgram(io = {}) {
           homeDir: io.homeDir,
           noCache: Boolean(program.opts().cache === false)
         });
+        try {
+          runtime.client = await connect();
+        } catch (error) {
+          if (!(error instanceof AuthError) || !human()) throw error;
+          await signIn(baseUrl);
+          runtime.client = await connect();
+        }
       }
       return runtime.client;
     },
     output: async (data, formatter, options) => {
       const merged = { ...program.opts(), ...options };
       const format = outputFormat(merged, stdout);
-      const human = format === "table" ? formatter() : "";
-      const text2 = format === "table" ? `${human}${human.includes("Try  ") ? "" : "\n\nTry  moodle due \xB7 moodle units \xB7 moodle --help"}
+      const human2 = format === "table" ? formatter() : "";
+      const text2 = format === "table" ? `${human2}${human2.includes("Try  ") ? "" : `
+
+${tryLines(["moodle due", "moodle units", "moodle --help"])}`}
 ` : format === "json" ? `${JSON.stringify(JSON.parse(render(data, { format, fields: parseFields(data, merged.fields) })), null, merged.pretty ? 2 : void 0)}
 ` : render(data, { format, fields: parseFields(data, merged.fields) });
       if (io.stdout && !merged.output) {
@@ -9348,23 +10683,43 @@ function buildProgram(io = {}) {
     const result = await runner.run(name, args);
     await runtime.output(result, () => screen(result, options), options);
   };
+  const human = () => detectAudience({
+    stdin: io.stdin ?? process.stdin,
+    stdout: { isTTY: Boolean(stdout && "isTTY" in stdout && stdout.isTTY) },
+    env: io.env ?? process.env,
+    format: outputFormat(program.opts(), stdout)
+  }) === "human";
+  const theme = () => createTheme3(colorEnabled2(stderr, io.env) && program.opts().color !== false);
+  const signIn = async (baseUrl) => {
+    const ui = createUi3({ input: io.stdin ?? process.stdin, output: stderr, interactive: true });
+    const auth2 = { env: io.env, fetch: io.fetchImpl, homeDir: io.homeDir, captureMobileToken: true };
+    runtime.busy = true;
+    try {
+      await signInInteractively(ui, {
+        baseUrl,
+        platform: process.platform,
+        showWordmark,
+        storesBlocked: async () => cookieStoresBlocked(await browserCookieStores({ homeDir: io.homeDir })),
+        openInBrowser,
+        readBrowserSession: () => getAuthenticatedSession(baseUrl, { ...auth2, noCache: true, nonInteractive: true }),
+        browserLogin: (onBrowserOpened) => getAuthenticatedSessionWithBrowserFallback(baseUrl, { ...auth2, onBrowserOpened }),
+        pasteLogin: () => pasteLogin(baseUrl, true),
+        keepaliveInstalled: async () => (await keepaliveStatus(io.homeDir)).installed,
+        installKeepalive: () => installKeepalive({ homeDir: io.homeDir })
+      });
+    } finally {
+      runtime.busy = false;
+    }
+  };
   const choose = async (action, retry) => {
     try {
       return await action();
     } catch (error) {
-      if (!(error instanceof ReferenceError) || error.code !== "ambiguous" || !(io.stdin?.isTTY ?? process.stdin.isTTY) || outputFormat(program.opts(), stdout) !== "table") throw error;
-      stderr.write(`${error.message}
-${error.candidates.map((c, i) => `  ${i + 1}  ${c.name}`).join("\n")}
-`);
-      const reader = createInterface4({ input: io.stdin ?? process.stdin, output: stderr });
-      try {
-        const answer = await reader.question(`Pick [1-${error.candidates.length}]: `);
-        const chosen = error.candidates[Number(answer) - 1];
-        if (!chosen) throw error;
-        return await retry(chosen.id);
-      } finally {
-        reader.close();
-      }
+      if (!(error instanceof ReferenceError) || error.code !== "ambiguous" || !human()) throw error;
+      const ui = createUi3({ input: io.stdin ?? process.stdin, output: stderr, interactive: true });
+      const hint = (c) => c.code ?? c.type;
+      const chosen = await ui.select(error.message, error.candidates.map((c) => ({ value: c.id, label: c.name, ...hint(c) ? { hint: hint(c) } : {} })));
+      return await retry(chosen);
     }
   };
   program.action(async (targets, options) => {
@@ -9429,15 +10784,42 @@ ${error.candidates.map((c, i) => `  ${i + 1}  ${c.name}`).join("\n")}
     if (name === "due") command.option("--days <number>", "Deadline window in days.", parsePositiveInt);
     command.option("--limit <number>", "Maximum returned rows.", parsePositiveInt).action(async (unit, options) => execute(name, { unit, limit: count("limit", options.limit), ...name === "due" ? { days: count("days", options.days) } : {} }, options));
   }
-  addOutputOptions(program.command("find").description(humanDescription("find")).argument("<query>").argument("[unit]")).option("--limit <number>", "Maximum returned rows.", parsePositiveInt).option("--types <types>", "Comma-separated activity types.").action(async (query, unit, options) => execute("find", { query, unit, limit: count("limit", options.limit), types: options.types?.split(",") }, options));
-  addOutputOptions(program.command("get").description("Download a resource by id, URL, or UNIT TASK phrase.").argument("<ref>")).option("--to <directory>", "Destination directory.").option("--force", "Replace an existing file atomically.").action(async (ref2, options) => {
+  addOutputOptions(program.command("find").description(humanDescription("find")).argument("<query>", "Words to look for").argument("[unit]", "Unit code, name, id or URL")).option("--limit <number>", "Maximum returned rows.", parsePositiveInt).option("--types <types>", "Comma-separated activity types.").action(async (query, unit, options) => execute("find", { query, unit, limit: count("limit", options.limit), types: options.types?.split(",") }, options));
+  addOutputOptions(program.command("get").description("Download a resource by id, URL, or UNIT TASK phrase.").argument("<ref>", "Resource id, URL, or UNIT TASK phrase")).option("--to <directory>", "Destination directory.").option("--force", "Replace an existing file atomically.").action(async (ref2, options) => {
     const client = await runtime.getClient();
     const service = createIntentService(createMoodleGateway(client));
     const source = await choose(() => service.fileSource(ref2), (id2) => Promise.resolve(id2));
-    const receipt = await downloadMoodleFile(client, { source: String(source), directory: options.to ? path3.resolve(io.cwd ?? process.cwd(), options.to) : void 0, force: options.force });
+    const receipt = await downloadMoodleFile(client, { source: String(source), directory: options.to ? path4.resolve(io.cwd ?? process.cwd(), options.to) : void 0, force: options.force });
     await runtime.output(receipt, () => formatDownloadReceipt(receipt), options);
   });
-  addOutputOptions(program.command("open").description("Open a unit or activity reference in the browser.").argument("<ref>")).action(async (ref2, options) => {
+  addOutputOptions(mutating(program.command("submit").description(humanDescription("submit")).summary("Upload files into an assignment").argument("<ref>", "Assignment id, URL, or UNIT TASK phrase").argument("[files...]", "Local files to upload"))).option("--final", "Also submit for grading. Moodle does not allow undoing this.").option("--replace", "Remove the files already in the submission first.").option("--accept-statement", "Agree to the site's submission statement when it requires one.").action(async (ref2, files, options) => {
+    const interactive = human();
+    if (!program.opts().dryRun && !program.opts().yes && !interactive) throw new UsageError("Mutation requires --yes when stdin is not interactive.", "Run with --dry-run to see the plan first.");
+    const client = await runtime.getClient();
+    const service = createIntentService(createMoodleGateway(client));
+    const args = { files: files.map((file2) => resolveSubmissionPath(file2, io.cwd ?? process.cwd())), final: Boolean(options.final), replace: Boolean(options.replace), accept_statement: Boolean(options.acceptStatement) };
+    const plan = await choose(() => service.run("submit", { ref: ref2, ...args, dry_run: true }), (id2) => service.run("submit", { ref: id2, ...args, dry_run: true }));
+    const planned = plan.submission;
+    if (program.opts().dryRun) return runtime.output(plan, () => formatSubmissionReceipt(planned), options);
+    if (!await confirm({ summary: submissionSummary(planned, args.final, theme()) }, { yes: Boolean(program.opts().yes), dryRun: false, interactive })) return;
+    const spin = interactive ? createUi3({ input: io.stdin ?? process.stdin, output: stderr, interactive: true }).spinner() : void 0;
+    runtime.busy = true;
+    spin?.start("Preparing the upload");
+    let result;
+    try {
+      const live = createIntentService(createMoodleGateway(client, { onSubmitProgress: (message) => spin?.message(message) }));
+      result = await live.run("submit", { ref: planned.id, ...args, dry_run: false });
+      const receipt = result.submission;
+      spin?.stop(receipt.uploads.length ? `Uploaded ${receipt.uploads.map((file2) => file2.name).join(", ")} to ${receipt.name}` : `Submitted ${receipt.name}`);
+    } catch (error) {
+      spin?.error("The upload did not complete");
+      throw error;
+    } finally {
+      runtime.busy = false;
+    }
+    await runtime.output(result, () => formatSubmissionReceipt(result.submission), options);
+  });
+  addOutputOptions(program.command("open").description("Open a unit or activity reference in the browser.").argument("<ref>", "Unit or activity id, URL, or UNIT TASK phrase")).action(async (ref2, options) => {
     const client = await runtime.getClient();
     let url;
     if (looksLikeUrl(ref2)) {
@@ -9453,11 +10835,7 @@ ${error.candidates.map((c, i) => `  ${i + 1}  ${c.name}`).join("\n")}
       }
     }
     if (!url || !/^https?:/u.test(url)) throw new UsageError("This item has no browser URL.");
-    await new Promise((resolve, reject) => {
-      const child = spawn3(process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open", [url], { stdio: "ignore" });
-      child.once("error", reject);
-      child.once("exit", (code) => code === 0 ? resolve() : reject(new Error("Could not open the browser.")));
-    });
+    await openInBrowser(url);
     await runtime.output({ opened: url }, () => `Opened ${url}`, options);
   });
   addOutputOptions(program.command("user").description("Show authenticated user info.")).action(async (options) => {
@@ -9495,7 +10873,7 @@ ${error.candidates.map((c, i) => `  ${i + 1}  ${c.name}`).join("\n")}
     const result = stripEmpty({ activities: rows.slice(0, count("limit", options.limit)), total: rows.length });
     await runtime.output(result, () => runtime.screen(result, options), options);
   });
-  addOutputOptions(activities.command("show").description("Show activity details; resource and folder files can be passed to moodle get or download.").argument("<id>", "Course-module ID")).action(
+  addOutputOptions(activities.command("show").description("Show activity details; resource and folder files can be passed to moodle get or download.").summary("Show activity details").argument("<id>", "Course-module ID")).action(
     async (id2, options) => {
       await execute("item", { ref: parsePositiveInt(id2) }, options);
     }
@@ -9503,7 +10881,7 @@ ${error.candidates.map((c, i) => `  ${i + 1}  ${c.name}`).join("\n")}
   addOutputOptions(
     program.command("download").alias("dl").description("Download one authenticated Moodle file.").argument("<source>", "Course-module ID or authenticated Moodle file URL").option("--dest <path>", "Exact downloaded file path").option("--force", "Atomically replace an existing destination")
   ).action(async (source, options) => {
-    const destination = options.dest ? path3.resolve(io.cwd ?? process.cwd(), options.dest) : void 0;
+    const destination = options.dest ? path4.resolve(io.cwd ?? process.cwd(), options.dest) : void 0;
     const receipt = await downloadMoodleFile(await runtime.getClient(), {
       source,
       destination,
@@ -9548,12 +10926,15 @@ ${error.candidates.map((c, i) => `  ${i + 1}  ${c.name}`).join("\n")}
     await runtime.output(stripEmpty({ forums: forums2.map((f) => ({ id: f.id, name: f.name, unit_id: f.course_id })), total }), () => formatForumActivities(forums2), options);
   });
   addForumSearchCommand(forums.command("search").description("Search forum discussion titles and post text."), runtime, 20);
-  addOutputOptions(program.command("doctor").description("Diagnose runtime, browser access, session, background jobs and MCP setup.")).action(async (options) => {
+  addOutputOptions(program.command("doctor").description("Diagnose runtime, browser access, session, background jobs and MCP setup.").summary("Diagnose runtime, session and MCP setup")).action(async (options) => {
     const result = await doctor(io);
     await runtime.output(result, () => result.checks.map((c) => `${c.status.toUpperCase()} ${c.name}: ${c.detail}${c.hint ? `
-  ${c.hint}` : ""}`).join("\n") + "\n\nTry  moodle auth login \xB7 moodle mcp status", options);
+  ${c.hint}` : ""}`).join("\n") + `
+
+${tryLines(doctorNextSteps(result.checks))}`, options);
+    if (result.checks.some((c) => c.status === "fail")) process.exitCode = 3;
   });
-  program.command("completion").description("Print shell completion for zsh, bash or fish.").argument("<shell>").action((shell) => {
+  program.command("completion").description("Print shell completion for zsh, bash or fish.").addArgument(program.createArgument("<shell>", "Shell to target").choices(["zsh", "bash", "fish"])).action((shell) => {
     const names = program.commands.filter((c) => c.name() !== "help").flatMap((c) => [c.name(), ...c.aliases()]);
     if (shell === "bash") stdout.write(`complete -W '${names.join(" ")}' moodle
 `);
@@ -9563,22 +10944,22 @@ _arguments '1:command:(${names.join(" ")})' '*:reference:'
     else if (shell === "fish") stdout.write(names.map((n2) => `complete -c moodle -f -a '${n2}'`).join("\n") + "\n");
     else throw new UsageError("Choose zsh, bash or fish.");
   });
-  addOutputOptions(mutating(program.command("uninstall").description("Remove local background jobs; optionally remove the selected Worker and configuration."))).option("--remote", "Also remove the configured managed MCP deployment.").option("--purge", "Also delete local Moodle CLI configuration, receipts and cache.").action(async (options) => {
-    const home = io.homeDir ?? homedir12();
+  addOutputOptions(mutating(program.command("uninstall").description("Remove local background jobs; optionally remove the selected Worker and configuration.").summary("Remove background jobs, Worker and config"))).option("--remote", "Also remove the configured managed MCP deployment.").option("--purge", "Also delete local Moodle CLI configuration, receipts and cache.").action(async (options) => {
+    const home = io.homeDir ?? homedir15();
     const jobs = await ownedJobs(home);
-    const receipts = await readdir3(path3.join(home, ".config", "moodle-cli", "mcp", "deployments")).catch(() => []);
-    const result = { jobs: jobs.map((j) => j.path), remote: Boolean(options.remote), purge: Boolean(options.purge), config: path3.join(home, CONFIG_DIR_NAME), cache: path3.join(home, CACHE_DIR_NAME), package_command: "npm rm -g moodle-cli (or bun remove -g moodle-cli); for the standalone install: rm ~/.local/bin/moodle", remaining: options.remote ? "Only the configured Worker is removed. Other profiles remain remote." : "Remote Workers and credentials remain unless removed with moodle mcp remove." };
+    const receipts = await readdir4(path4.join(home, ".config", "moodle-cli", "mcp", "deployments")).catch(() => []);
+    const result = { jobs: jobs.map((j) => j.path), remote: Boolean(options.remote), purge: Boolean(options.purge), config: path4.join(home, CONFIG_DIR_NAME), cache: path4.join(home, CACHE_DIR_NAME), package_command: "npm rm -g moodle-cli (or bun remove -g moodle-cli); for the standalone install: rm ~/.local/bin/moodle", remaining: options.remote ? "Only the configured Worker is removed. Other profiles remain remote." : "Remote Workers and credentials remain unless removed with moodle mcp remove." };
     if (program.opts().dryRun) return runtime.output(result, () => JSON.stringify(result, null, 2), options);
     if (options.purge && receipts.length && !options.remote) throw new UsageError("Managed deployment receipts exist; remove the Worker before purging its recovery information.", "Run moodle mcp remove for each configured site, then moodle uninstall --purge.");
     if (options.purge && receipts.length > 1) throw new UsageError("Multiple managed deployment receipts exist; remove each Worker before purging configuration.");
-    if (!await confirm({ summary: `Remove Moodle background jobs${options.remote ? ", the configured Worker" : ""}${options.purge ? ", configuration and cache" : ""}.` }, { yes: Boolean(program.opts().yes), dryRun: false, interactive: Boolean(io.stdin?.isTTY ?? process.stdin.isTTY) })) return;
+    if (!await confirm({ summary: `Remove Moodle background jobs${options.remote ? ", the configured Worker" : ""}${options.purge ? ", configuration and cache" : ""}.` }, { yes: Boolean(program.opts().yes), dryRun: false, interactive: human() })) return;
     if (options.remote) await getMcpService().remove({ yes: true });
     if (process.platform === "darwin") await uninstallKeepalive({ homeDir: home });
     const renewal2 = new DefaultRenewalIntegration({ homeDirectory: home, executable: process.execPath });
     const profiles = new Set([...jobs.map((j) => j.profile), ...receipts.map((n2) => n2.replace(/\.json$/u, ""))].filter((p) => Boolean(p) && /^[a-z0-9_-]+$/u.test(p)));
     for (const profile of profiles) {
       await renewal2.remove(profile);
-      if (options.purge) await rm7(path3.join(home, "Library", "Logs", `com.moodle-cli.mcp-renewal.${profile}.log`), { force: true });
+      if (options.purge) await rm7(path4.join(home, "Library", "Logs", `com.moodle-cli.mcp-renewal.${profile}.log`), { force: true });
     }
     if (options.purge) {
       await rm7(result.config, { recursive: true, force: true });
@@ -9599,25 +10980,38 @@ ${result.package_command}`, options);
 ${note}`, options);
     }
   );
-  addOutputOptions(auth.command("login").description("Extract a fresh session, opening the browser when needed.")).action(
+  addOutputOptions(
+    auth.command("login").description("Sign in through a browser the CLI controls, then capture the session.").option("--paste", "Take the MoodleSession cookie from a prompt instead of the browser store.")
+  ).action(
     async (options) => {
       const baseUrl = await runtime.baseUrl();
-      await invalidateCachedSession(baseUrl, { homeDir: io.homeDir });
       const humanOutput = outputFormat(options, stdout) === "table";
-      const session = await getAuthenticatedSessionWithBrowserFallback(baseUrl, {
+      const session = options.paste ? await pasteLogin(baseUrl, humanOutput) : await getAuthenticatedSessionWithBrowserFallback(baseUrl, {
         env: io.env,
         fetch: io.fetchImpl,
         homeDir: io.homeDir,
-        onBrowserOpened: humanOutput ? (url) => stderr.write(`No active Moodle session found. Complete login in your browser:
-${url}
-`) : void 0
+        captureMobileToken: true,
+        onBrowserOpened: humanOutput ? () => stderr.write("A browser window opened. Sign in there; I'll capture the session automatically.\n") : void 0
       });
       const result = { base_url: baseUrl, userid: session.userid, cookie_source: session.cookie.source ?? "unknown" };
       await runtime.output(result, () => `Authenticated as userid ${result.userid} via ${result.cookie_source}`, options);
     }
   );
+  async function pasteLogin(baseUrl, humanOutput) {
+    const input2 = io.stdin ?? process.stdin;
+    if (humanOutput && input2.isTTY) {
+      stderr.write(`Copy the ${MOODLE_SESSION_COOKIE_PREFIX} cookie for ${baseUrl} from your browser's developer tools.
+The value is not echoed and is stored in the encrypted session cache.
+`);
+    }
+    const raw = await readSecretLine(input2, stderr, input2.isTTY ? `${MOODLE_SESSION_COOKIE_PREFIX}: ` : "");
+    if (raw === null) {
+      throw new CliError2("cancelled", "Login cancelled.");
+    }
+    return authenticateWithPastedCookie(baseUrl, raw, { env: io.env, fetch: io.fetchImpl, homeDir: io.homeDir, captureMobileToken: true });
+  }
   const keepalive = addOutputOptions(
-    auth.command("keepalive").description("Renew the Moodle session once; used by the background keepalive agent.").option("--no-renew", "Only touch the session; skip re-login when it is expired.")
+    auth.command("keepalive").description("Renew the Moodle session once; used by the background keepalive agent.").summary("Renew the session once").option("--no-renew", "Only touch the session; skip re-login when it is expired.")
   ).action(async (options) => {
     const baseUrl = await runtime.baseUrl();
     const result = await keepAliveOnce(baseUrl, { homeDir: io.homeDir, fetchImpl: io.fetchImpl, renewOnExpiry: options.renew });
@@ -9629,10 +11023,10 @@ ${url}
     const globals = program.opts();
     if (!await confirm(
       { summary: `Install the Moodle session keepalive agent${options.interval ? ` with a ${options.interval}-minute interval` : ""}.` },
-      { yes: Boolean(globals.yes), dryRun: Boolean(globals.dryRun), interactive: Boolean(io.stdin?.isTTY ?? process.stdin.isTTY) }
+      { yes: Boolean(globals.yes), dryRun: Boolean(globals.dryRun), interactive: human() }
     )) return;
     const baseUrl = await runtime.baseUrl();
-    await getAuthenticatedSessionWithBrowserFallback(baseUrl, { env: io.env, homeDir: io.homeDir, fetch: io.fetchImpl, noCache: true, nonInteractive: true });
+    await getAuthenticatedSessionWithBrowserFallback(baseUrl, { env: io.env, homeDir: io.homeDir, fetch: io.fetchImpl, noCache: true, nonInteractive: true, captureMobileToken: true });
     const result = await installKeepalive({ homeDir: io.homeDir, intervalMinutes: options.interval });
     await runtime.output(result, () => `Keepalive installed: renews every ${result.interval_minutes} min
 Agent: ${result.plist_path}
@@ -9643,7 +11037,7 @@ Log: ${result.log_path}`, options);
       const globals = program.opts();
       if (!await confirm(
         { summary: "Remove the Moodle session keepalive agent." },
-        { yes: Boolean(globals.yes), dryRun: Boolean(globals.dryRun), interactive: Boolean(io.stdin?.isTTY ?? process.stdin.isTTY) }
+        { yes: Boolean(globals.yes), dryRun: Boolean(globals.dryRun), interactive: human() }
       )) return;
       const result = await uninstallKeepalive({ homeDir: io.homeDir });
       await runtime.output(result, () => `Keepalive removed (${result.plist_path})`, options);
@@ -9655,7 +11049,7 @@ Log: ${result.log_path}`, options);
       await runtime.output(result, () => result.installed ? `Keepalive installed (${result.plist_path})` : "Keepalive not installed", options);
     }
   );
-  const mcp = program.command("mcp").description("Deploy a private MCP Worker on Cloudflare; encrypted session storage and local renewal. Free-tier limits apply.");
+  const mcp = program.command("mcp").description("Deploy a private MCP Worker on Cloudflare; encrypted session storage and local renewal. Free-tier limits apply.").summary("Private MCP server on Cloudflare");
   addOutputOptions(mutating(mcp.command("deploy").description("Deploy or update the managed Moodle MCP server."))).option("--dry-run", "Preview deployment changes without applying them.").option("--repair", "Repair authentication and managed deployment state.").option("--rotate-key", "Rotate the session encryption key and migrate the active session.").option("--rotate-token", "Rotate the MCP access token with an overlap window.").option("--rollback", "Restore the previous healthy Worker release.").action(async (options) => {
     const dryRun = Boolean(options.dryRun || program.opts().dryRun);
     if (!dryRun && !await confirm(
@@ -9663,7 +11057,7 @@ Log: ${result.log_path}`, options);
       {
         yes: Boolean(program.opts().yes),
         dryRun: false,
-        interactive: Boolean(io.stdin?.isTTY ?? process.stdin.isTTY)
+        interactive: human()
       }
     )) return;
     const result = await getMcpService().deploy({
@@ -9705,11 +11099,11 @@ Log: ${result.log_path}`, options);
   addOutputOptions(mcp.command("clients").description("List pending and approved OAuth clients.")).action(async (options) => {
     await outputMcpResult(runtime, await getMcpService().manageClients({}), options);
   });
-  addOutputOptions(mutating(mcp.command("revoke").description("Revoke an OAuth client or all OAuth access.").argument("[client-id]"))).option("--all", "Revoke every client, token, pending authorization, and pairing window.").action(async (clientId, options) => {
+  addOutputOptions(mutating(mcp.command("revoke").description("Revoke an OAuth client or all OAuth access.").argument("[client-id]", "OAuth client id; omit with --all"))).option("--all", "Revoke every client, token, pending authorization, and pairing window.").action(async (clientId, options) => {
     if (Boolean(clientId) === Boolean(options.all)) throw new UsageError("Provide a client ID or --all.");
     await outputMcpResult(runtime, await getMcpService().manageClients({ revoke: true, clientId }), options);
   });
-  addOutputOptions(mutating(mcp.command("pair").description("Open a pairing window so Claude can connect to the remote MCP server."))).action(
+  addOutputOptions(mutating(mcp.command("pair").description("Open a pairing window so Claude can connect to the remote MCP server.").summary("Open a pairing window for Claude"))).action(
     async (options) => {
       await outputMcpResult(runtime, await getMcpService().pair(), options);
     }
@@ -9742,7 +11136,7 @@ Log: ${result.log_path}`, options);
       await runtime.output(description, () => JSON.stringify(description, null, 2), options);
     }
   );
-  const skills = program.command("skills").description("Show skill metadata or delegate to the shared skills CLI.");
+  const skills = program.command("skills").description("Show skill metadata or delegate to the shared skills CLI.").summary("Agent skill metadata");
   skills.action(() => {
     stdout.write(`${formatSkillSummary()}
 `);
@@ -9752,24 +11146,46 @@ Log: ${result.log_path}`, options);
     stdout.write("Generated Moodle skill bundle\n");
   });
   skills.command("add").description("Install the published skill through npx skills add.").allowUnknownOption(true).action((_options, command) => installSkill(command.args));
+  for (const [title, names] of Object.entries(HELP_SECTIONS)) {
+    for (const name of names) for (const command of program.commands) if (command.name() === name) helpSection(command, title);
+  }
+  examples(program, [
+    "moodle  # today: due items, alerts and news",
+    "moodle UNIT grades",
+    'moodle submit UNIT "Assignment 2" report.pdf'
+  ]);
   return program;
 }
+var HELP_SECTIONS = {
+  "Core commands": ["due", "news", "find", "get", "open", "submit", "units", "activities", "grades", "threads", "forums"],
+  "Additional commands": ["user", "todo", "alerts", "overview", "download", "auth", "doctor", "completion", "uninstall"],
+  "Agent commands": ["mcp", "commands", "skills"]
+};
 async function runCli(argv = process.argv, io = {}) {
   const stderr = io.stderr ?? process.stderr;
   const stdout = io.stdout ?? process.stdout;
   const args = insertDefaultVerb(argv.slice(2), NOUNS);
-  const program = buildProgram({ ...io, rootArgs: args });
+  const ui = createUi3({
+    input: io.stdin ?? process.stdin,
+    output: stderr,
+    interactive: detectAudience({
+      stdin: io.stdin ?? process.stdin,
+      stdout: { isTTY: Boolean(stdout && "isTTY" in stdout && stdout.isTTY) },
+      env: io.env ?? process.env,
+      format: errorOutputFormat(args, stdout)
+    }) === "human"
+  });
   try {
-    await program.parseAsync(args, { from: "user" });
+    await parseWithPrompts(() => buildProgram({ ...io, rootArgs: args }), args, { ui, fillers: { unit: pickUnit(io, ui) } });
     return 0;
   } catch (error) {
-    if (isCommanderCompletion(error)) {
+    if (isInformationalExit(error)) {
       return 0;
     }
     const format = errorOutputFormat(args, stdout);
-    const normalized = normalizeError(error);
+    const normalized = normalizeError(asNetworkError(error) ?? error);
     const reference = error instanceof ReferenceError ? error : void 0;
-    const reported = reportError(error, "json");
+    const reported = reportError(asNetworkError(error) ?? error, "json");
     const envelope = JSON.parse(reported.text);
     const hint = reference?.hint || normalized.hint || { auth: "Run moodle auth login, or moodle doctor.", config: "Run moodle doctor to check configuration.", not_found: "Run moodle units or moodle find QUERY.", usage: "Run moodle --help or moodle commands --json.", upstream: "Run moodle doctor, then retry.", network: "Check the connection, then retry.", unexpected: "Run moodle doctor; use --verbose for request timings.", cancelled: "Retry when ready." }[normalized.code];
     envelope.error.hint = hint;
@@ -9786,6 +11202,23 @@ ${hint}
     return envelope.exit_code;
   }
 }
+function openInBrowser(url) {
+  return new Promise((resolve, reject) => {
+    const child = spawn4(process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open", [url], { stdio: "ignore" });
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? resolve() : reject(new Error("Could not open the browser.")));
+  });
+}
+function doctorNextSteps(checks) {
+  const failing = new Set(checks.filter((c) => c.status !== "pass").map((c) => c.name));
+  const steps = [];
+  if (failing.has("browser")) steps.push("grant Full Disk Access, then rerun moodle doctor");
+  else if (failing.has("session")) steps.push("moodle auth login");
+  if (failing.has("sqlite")) steps.push("install Node 22.13+ or Bun");
+  if (failing.has("config")) steps.push("moodle units");
+  if (failing.has("job")) steps.push("moodle auth keepalive install");
+  return steps.length ? steps : ["moodle todo", "moodle mcp status"];
+}
 async function dispatchUrl(runtime, target, options) {
   const client = await runtime.getClient();
   const resolved = await resolveTopLevelUrl(client.baseUrl, target, (url) => client.resolveCourseIdForUrl(url));
@@ -9843,11 +11276,26 @@ function addForumSearchCommand(command, runtime, defaultLimit) {
   });
 }
 function addOutputOptions(command) {
-  return command.option("--pretty", "Indent JSON output.").option("--json", "Output as JSON.").option("--yaml", "Output as YAML.").option("--table", "Force human output.").option("--fields <fields>", "Keep only listed top-level fields in structured output.");
+  for (const [flags, description] of [
+    ["--pretty", "Indent JSON output."],
+    ["--json", "Output as JSON."],
+    ["--yaml", "Output as YAML."],
+    ["--table", "Force human output."],
+    ["--fields <fields>", "Keep only listed top-level fields in structured output."]
+  ]) command.addOption(command.createOption(flags, description).hideHelp());
+  return command;
 }
 function outputFormat(options, stdout) {
   return resolveFormat(options, Boolean(stdout && "isTTY" in stdout && stdout.isTTY));
 }
+function submissionSummary(plan, final, theme) {
+  const destination = `${theme.target(plan.name)}${plan.unit_id ? theme.dim(`  unit ${plan.unit_id}`) : ""}`;
+  const lines = plan.uploads.length ? [`${theme.dim("Upload")}  ${theme.subject(plan.uploads.map((file2) => file2.name).join(", "))}`, `${theme.dim("    to")}  ${destination}`] : [`${theme.dim("Submit")}  ${destination}`, `${theme.dim("      ")}  ${theme.subject("the files already there")} for grading`];
+  if (plan.removed.length) lines.push(`${theme.dim("Remove")}  ${theme.tone("danger", plan.removed.join(", "))} ${theme.dim("first")}`);
+  if (plan.statement) lines.push(`${theme.dim(" Agree")}  "${plan.statement}"`);
+  lines.push(final ? theme.tone("warning", "Then submit for grading. Moodle does not allow undoing this.") : theme.dim("Moodle keeps a draft where the assignment allows drafts; otherwise it submits at once."));
+  return lines.join("\n");
+}
 function parsePositiveInt(value) {
   const parsed = Number(value);
   if (!Number.isInteger(parsed) || parsed < 1) {
@@ -9888,11 +11336,24 @@ function parseFields(data, value) {
   }
   return fields2;
 }
-function isCommanderCompletion(error) {
-  if (!error || typeof error !== "object") return false;
-  if ("exitCode" in error && error.exitCode === 0) return true;
-  const code = "code" in error ? String(error.code) : "";
-  return code.startsWith("commander.help") || code === "commander.version";
+function pickUnit(io, ui) {
+  return async () => {
+    const spin = ui.spinner();
+    spin.start("Loading your units");
+    try {
+      return await selectUnit(spin);
+    } catch (error) {
+      spin.stop("Could not load your units");
+      throw error;
+    }
+  };
+  async function selectUnit(spin) {
+    const { baseUrl } = await loadConfig({ env: io.env, cwd: io.cwd, homeDir: io.homeDir, stdin: io.stdin, stderr: io.stderr ?? process.stderr, fetch: io.fetchImpl });
+    const client = await createMoodleClient(baseUrl, { env: io.env, fetchImpl: io.fetchImpl, homeDir: io.homeDir });
+    const courses = await client.getCourses();
+    spin.stop(`${courses.length} units`);
+    return ui.select("Which unit?", courses.map((course) => ({ value: String(course.id), label: course.fullname, ...course.shortname ? { hint: course.shortname } : {} })));
+  }
 }
 function parseRootOutputOptions(args) {
   const fieldsIndex = args.findIndex((arg) => arg === "--fields" || arg.startsWith("--fields="));
@@ -9925,7 +11386,7 @@ function pathsReferToSameFile(moduleUrl, executable) {
 var isMain = import.meta.main === true || pathsReferToSameFile(import.meta.url, process.argv[1]);
 if (isMain) {
   runCli().then((code) => {
-    process.exitCode = code;
+    process.exitCode = code || process.exitCode;
   });
 }
 export {