* fix(rules): continue --no-course-rules when markers need repair
Malformed, duplicate, or out-of-order sentinels still fail-close on a
default rules write, but opt-out no longer aborts the whole lesson.
Default get now returns a rules_markers_need_repair envelope instead of
a stack dump.
* chore(release): prepare v1.23.1
---------
Co-authored-by: Claude <noreply@anthropic.com>
* docs: add corporate network allowlist for security/sysadmin teams
Polish sysadmin spec plus a machine-readable host list and a source-scan
test so new CLI destinations cannot land undocumented.
* chore(release): prepare v1.23.1
* docs: rewrite corporate allowlist in sysadmin language (PL+EN)
Plain host/port/protocol tables, matching English document, and an
allowlist test that covers both language files.
* docs: drop localhost from the corporate network allowlist
Public DNS names only; the source scan skips IP literals and
single-label hosts so local-dev URLs stay out of the sysadmin spec.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Register a `kiro` profile that writes artifacts under `.kiro/` (skills,
prompts, config templates) and co-owns the root `AGENTS.md` for course
rules alongside codex, devin-desktop and generic. Content is delivered in
the generic variant because the delivery API exposes no `kiro` transform
yet.
Auto-detection reports Kiro from `.kiro/.10x-cli-manifest.json`,
`.kiro/steering/`, `.kiro/specs/`, `.kiro/hooks/`, `.kiro/settings/` or a
bare `.kiro/` directory. Every branch is `strong`: the directory name is
Kiro-specific with no plausible false positive, so a Kiro workspace never
loses the `AGENTS.md` confidence tie to codex and `PROFILE_ORDER` needs no
reshuffle. The profile takes its place in the resolution order ahead of
generic.
Extend `--tool` help text for `get` and `sync`, document the new paths,
the `.kiro/config-templates/` staging caveat and the exact limits of
`AGENTS.md` co-ownership (byte-identical rules only, so `kiro` pairs with
generic but reports `incompatible_shared_owner` next to codex or
devin-desktop) in the platform support reference and README, and cover the
profile in the detection, profile, tool-switch, writer and install-contract
test suites — including the divergent-content case that must fail closed.
The bundled `skills/10x-cli-guide/SKILL.md` is deliberately left unchanged:
`helpers install` is create-only and exits 1 on a byte difference, so a
documentation-only edit there would break every existing install.
The bootstrap decides the depth (`baseRepoClone.depth`: 1 = HEAD only,
null = full history); this side only executes it. `--deep` on
`bench-kit init` sends `deepClone: true` in the request.
`--depth` is silently ignored for a local path, so a shallow clone goes
through a `file://` URL: that gives up object hardlinking, which is the
point — one commit's objects instead of the whole history. Origin is
re-pointed at the registered remote as before, so `git fetch
--unshallow` in the clone adds the history later.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(release): wait for npm metadata before verifying publish
Direct publish-npm verified immediately after npm accepted 1.22.1,
while registry metadata still lacked dist.tarball. Poll until
integrity exists, then keep the strict pack/gitHead compare. When
the version is already on npm and matches the pack from cli_sha,
skip publish and only complete tag/Release.
* chore(release): prepare v1.22.2
---------
Co-authored-by: Claude <noreply@anthropic.com>
Master push enumerated every open PR and failed Prepare version when
the PR had not integrated current master. Classify that as a branch
update, write no record, and continue so unrelated open PRs cannot
turn the trusted writer red.
Co-authored-by: Claude <noreply@anthropic.com>
* feat(skills): guide CLI setup, named downloads and updates
* fix(skills): bound npm inventory checks on cold Windows runners
* fix(skills): align launch guide with 10xCards PRD journey
* fix(tests): make helper checks portable on Windows
* test(helpers): trace Windows npm pack startup
* fix(helpers): allow bounded Windows npm startup time
* fix(helpers): use released lesson-scoped skill filters
Correct setup/guide examples and sync ownership to match CLI 1.21.
Exercise the documented preview/write commands through CAC and the
real partial writer, preserving all three trees and the PRD schema.
Refs: https://github.com/przeprogramowani/10x-cli/pull/41
---------
Co-authored-by: Claude <noreply@anthropic.com>
The tag step compared the tag ref's object SHA with the source commit, so an
existing annotated tag at the correct commit failed the run (v1.21.0). Peel
the tag to its commit before comparing, and add an idempotent step that
creates the GitHub Release with the verified npm tarball, which was missing
for 1.21.0 and had to be created by hand.
Co-authored-by: Claude <noreply@anthropic.com>
Dispatch-only workflow that packs, smoke-installs and publishes an exact
source SHA once with the existing NPM_TOKEN, verifies the actual registry
bytes and gitHead afterwards, and tags the source. It carries no Toolkit
receipt, lease or coordinator contract.
Co-authored-by: Claude <noreply@anthropic.com>
* docs(10xdevs4-cli-access): record membership gates and bootstrap context (p1)
Add canonical access plan, accepted decisions and supporting context.
Record phase 1 verification, Toolkit revision and remaining evidence gaps.
* docs(10xdevs4-cli-access): record course access gates and scoped review (p2)
Update canonical Progress, change status, evidence and implementation review.
Record Toolkit revisions, inherited typecheck limitation and phase 3 prerequisites.
* docs(10xdevs4-cli-access): persist reviewed revisions and phase 3 boundary
Record final reviewed Toolkit and CLI context revisions.
Persist Progress attribution and unresolved W04/W05/W08 prerequisites.
Keep phases 3–6, phase 7 and Manual criteria open.
* docs(10xdevs4-cli-access): record squash-safe source prerequisite
Record PR #30, verified gates, permanent-pin lessons and the remaining merge dependency.
Keep phase 3 and all manual rollout criteria pending.
* docs(10xdevs4-cli-access): record source prerequisite review
Record independent review of PR #30 and verified CI evidence.
Keep the master pin and delivery phase completion pending.
* docs(10xdevs4-cli-access): distinguish candidate checks from final master pins
Record passing pre-merge v4 checks and defer workflow suspension.
Keep the final v3 maintenance pin dependent on the resulting master SHA.
* feat: prepare v4 course delivery and protected project sync
Capture the reviewed implementation and manual rehearsal for draft PR review. Master source prerequisites, full clean verification and coordinated Windows CI remain open; production rollout is separate.
* fix: keep paid CI evidence private and converge cumulative sync
* docs: record merged source prerequisite and passing clean gate
* fix: preserve generated API type line endings on Windows
---------
Co-authored-by: Claude <noreply@anthropic.com>
Kit zna siebie, CLI zna maszynę użytkownika: init/update klonują
template i wołają .bench-kit/bootstrap/index.mjs z klonu (żądanie JSON
na stdin, odpowiedź w ostatniej linii stdout). Update wykonuje bootstrap
z NOWEJ wersji kitu, więc migracje układu jadą z tagiem. Wchłania
TEMPLATE_ONLY_PATHS (gałąź fix/bench-kit-template-only-paths zbędna).
Minimalna wersja template'u: v0.10.0 (brak bootstrapu → template_incomplete).
Testy zawężone do kontraktu: fake runBootstrap, asercje na żądanie,
render, koperty --json i kody wyjścia.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Local working copy for the authoring skills (bench-task, bench-refresh,
bench-wiring): cloned from the surrounding product repo (instant,
offline, full history) with origin pointed at the registered remote.
Gitignored via ensureIgnored so older template tags never commit it;
clone failure degrades to a hint.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The bench-kit command is feature-complete (zone-aware update, agent-tool
profiles, safe init defaults shipped in v1.17.0), so the experimental
opt-in has served its purpose. The command now registers unconditionally,
shows up in --help, and is documented in the README; the gating module
and its error envelope (experimental_locked) are removed.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
- init pins placeholder tasks (repo: demo-app + all-zeros commit) to the
detected base repo and its HEAD; company tasks never touched
- init and update run npm ci in .bench-kit/runner (update's wholesale
swap deletes node_modules); failure degrades to a hint
- detected SSH remote is probed over https (git ls-remote, no terminal
prompt) and rewritten when the repo answers publicly
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Template v0.6.0 ships AGENTS.md (agent instructions: skill order and
purpose). init already materializes it with the template root; update
now syncs it with the same proposal semantics as skills — added or
overwritten in the working tree, reviewable via git diff, never
deleting company edits silently.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
- init resolves the agent tool (--tool flag > manifest on repair >
interactive pick pre-filled by marker detection > claude-code) and
materializes template skills under the profile's skill root
(.claude/skills, .agents/skills, ...); the chosen tool is recorded in
instance.json so update knows where to propose skill diffs
- update works zone by zone: .bench-kit/ replaced wholesale (staged swap,
manifest survives version-bumped), workflows and skills synced into the
working tree as an uncommitted proposal reviewed via git diff, company
content never touched; clean-worktree gate keeps the proposal reviewable
- template skill source auto-detects the planned .agents/skills migration
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
GitHub only runs workflows from .github/workflows/, so init copies
.bench-kit/workflows/* there; repair mode keeps existing files (the
company may have customized triggers or secrets).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: lazy-load yaml so CLI startup stays within budget
The top-level 'yaml' import in bench-kit.ts is pulled in by index.ts,
so every CLI start paid for loading the YAML parser and the binary
smoke test's 50ms startup budget blew on CI (~58ms). Import yaml
dynamically inside registerBaseRepo — the only code path that needs
it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: raise unix startup budget to 60ms
Local measurements show bench-kit added no startup cost (~38ms avg at
pre-bench-kit, merged, and lazy-import refs alike) — the 50ms budget
was simply too tight for shared CI runners, which hover just above it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The top-level 'yaml' import in bench-kit.ts is pulled in by index.ts,
so every CLI start paid for loading the YAML parser and the binary
smoke test's 50ms startup budget blew on CI (~58ms). Import yaml
dynamically inside registerBaseRepo — the only code path that needs
it.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Running 'bench-kit init' from inside a product repo is the common flow,
so init now detects the git repo containing the invocation cwd (git
rev-parse --show-toplevel + origin remote + HEAD) and replaces the
template's demo-app placeholder in bench.config.yaml with that repo,
editing the YAML document in place so company-zone comments survive.
The detection also lands in instance.json (incl. HEAD as a candidate
pin for the first task). No detection, no origin, or detecting the
instance itself → the placeholder stays. Adds the 'yaml' dependency.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: add bench-kit command (init + update stub)
'10x bench-kit init [dir]' creates a benchmark instance from the
przeprogramowani/10x-bench-kit template: preflight (git required,
container engine advisory), shallow clone at a tag, materialization
without git history, fresh git init + initial commit, and an instance
manifest in .bench-kit/instance.json. Re-running init on an existing
instance repairs missing template files without touching company
content. 'bench-kit update' is a not_implemented stub.
CAC has no nested command groups, so the command follows the auth
precedent: one 'bench-kit <action>' command dispatching internally.
Side effects are injectable (BenchKitDeps) so tests exercise the full
flow against fixture trees without network or real git.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: gate experimental commands behind TENX_CLI_EXPERIMENTAL
New src/lib/experimental.ts exposes experimentalEnabled() and
requireExperimental(), which exits with a stable 'experimental_locked'
envelope (exit 4 FORBIDDEN) unless TENX_CLI_EXPERIMENTAL=1 (or 'true')
is set. bench-kit stays registered so help remains discoverable and the
command never dies silently, but its action is locked before any side
effects. This lets the branch merge to master ahead of the feature
being student-ready.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: hide experimental commands entirely without the opt-in
All-or-nothing per review: registerBenchKitCommand returns early when
TENX_CLI_EXPERIMENTAL is unset, so bench-kit is absent from --help and
behaves like any unknown command instead of appearing half-locked. The
requireExperimental gate stays in the action as defense in depth.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
New public command (no auth) that fetches the preprocessed top-10
leaderboard from https://10xbench.ai/api/leaderboard.json and renders
color-coded score bars on stderr, or the standard JSON envelope when
piped. The bench client is deliberately separate from api-client.ts:
its own strict BENCH_BASE_URL allowlist, and non-JSON 200 responses
(the static site's catch-all) surface as bench_unavailable. Colors are
hand-rolled ANSI gated on stderr TTY + NO_COLOR; remote strings are
sanitized before printing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Allow lesson numbers >= 0 so general, non-lesson-bound artifacts can be
fetched via m0l0 (e.g. `10x get m0l0`). Update the parser doc comment
and tests; lesson 0 is now valid, negatives still rejected by the regex.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
F2: writeManifest now writes to a sibling .tmp then renameSync into
place (matching saveAuth), so an interrupt mid-sweep can't truncate the
manifest into an unreadable state that drops all per-lesson tracking.
F3: the sync sweep's AbortController was inert (signal threaded but
abort never called). Wire process.once("SIGINT") to controller.abort()
so Ctrl-C cancels the in-flight fetch and stops the sweep at the next
lesson boundary; handler removed in finally.
przeprogramowani