[psmyrdek]

Summary

10x changelog listed every release the account can access, so in a 10xDevs 3.0 project an account with both courses saw 4.0-only releases that sync can never deliver there. It now follows the project's course, the same one get / sync use.

Scope (highest first): --course <course> → the project's course (.10x-cli.json, else a tool manifest, via inspectProjectCourse) → outside a project, every granted course. Grants only authorize.

Project \ grants	3.0 only	4.0 only	both
3.0 project	3.0 releases	403: no access to 10xdevs3	3.0 releases (was: 4.0)
4.0 project	403	4.0 releases	4.0 releases
no project	3.0	4.0	all (= 4.0)
conflicting manifests	course_binding_conflict (as get/sync)	←	←

• Sends ?course=; the header names it (This 10xdevs3 project is on toolkit …), JSON adds course (null outside a project).
• 403 for the project's course explains which course; an unknown --course is a usage error (exit 2). A course_not_found 404 isn't mistaken for an old backend.
• sync / get record the newest release of the course they pulled, and clear a stored version when that course has none (a 1.27–1.29 record is account-wide and can name a release the project never got).
• Regenerated api-types.ts from the companion backend: https://github.com/przeprogramowani/10x-toolkit/pull/117. Merge this first.

Against the current production API (no course param yet) the param is ignored, so behaviour stays as before until the backend deploys.

Test plan

• bun test — 1017 pass (3 failing Stop-hook tests are the known local bash 3.2 failures); new: binding-file scope, --course override + blank, no-project null, conflict, 403 naming the course, unknown course, stale-record clearing vs. kept on failure
• generate-types --check against the backend branch's OpenAPI
• typecheck, lint, build, binary build, validate:cli-skills
• Live from a 3.0 project: request carries course: "10xdevs3"

🤖 Generated with Claude Code