@genex-ai/cli-demo 0.24.0 → 0.26.0

package/README.md

@@ -28,26 +28,28 @@ genex controller <type>    # install a tuned character|car|drone controller →
    agents/ + commands/), Codex (`~/.codex/skills`), and Cursor
    (`~/.cursor/skills`). genex-owned skills (`genex-*`) are **always refreshed**
    to the package version so a stale copy can't linger; your own files are never
-   overwritten. Pick agents explicitly with `--agents claude,codex,cursor`, or a
-   single custom dir with `--dir`.
+   overwritten. After init, **every** `genex` command re-syncs them to the
+   installed CLI version automatically (printing `🔄 Genex skills updated to
+   X.Y.Z` when it does). Pick agents explicitly with `--agents
+   claude,codex,cursor`, or a single custom dir with `--dir`.
 2. **Authorizes you** — opens the Genex auth site (web) in your browser. If the
    browser can't open, it prints the URL to open manually.
 3. **Saves your token** — writes `GENEX_TOKEN` to `~/.genex/env` (per-user;
    reused across projects).
-4. **Creates the draft project** — generates a per-project SSH deploy key
-   (`genex_key`, gitignored automatically), registers its public half with a new
-   repo via `POST /api/projects`, and stores the project metadata (id, slug,
-   `sshUrl`, urls) in `./.genex/project.json`. The game shows up in your
-   dashboard's **My games** immediately.
+4. **Creates the draft project** — `POST /api/projects` provisions a managed
+   Forgejo repo (one per user; no SSH key) and stores the project metadata (id,
+   slug, `cloneUrl`, urls) in `./.genex/project.json`. Source pushes to that repo
+   over HTTPS with a per-push token minted by the API (see below), so it works
+   from any device with a Genex login. The game shows up in your dashboard's
+   **My games** immediately.
 
 `genex link <slug>` is the recovery counterpart of step 4 for a game that
 already exists: run it inside a fresh clone of the game's source repo (or any
-folder that lost its link) and it re-authorizes if needed, reuses or generates
-`genex_key`, registers the public half via `POST /api/projects/:id/deploy-key`
-(keys are added, never replaced), and rewrites `./.genex/project.json` — after
-which `preview`/`publish` update the **same** live game. It never creates a
-project; the dashboard's "Continue building" flow uses it when the original
-folder can't be found.
+folder that lost its link) and it re-authorizes if needed and rewrites
+`./.genex/project.json` — nothing to register, since source pushes authorize per
+push over HTTPS. After it, `preview`/`publish` update the **same** live game. It
+never creates a project; the dashboard's "Continue building" flow uses it when
+the original folder can't be found.
 
 `genex preview` and `genex publish` share a build-aware deploy core: each runs
 `npm run build` (when the project has a build script), then uploads the built

package/dist/index.js

@@ -1,12 +1,7 @@
 #!/usr/bin/env node
 
-// src/index.ts
-import { readFileSync } from "fs";
-import path12 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-
 // src/commands/init.ts
-import path7 from "path";
+import path8 from "path";
 
 // src/config.ts
 import fs from "fs";
@@ -43,6 +38,17 @@ function getTemplatesDir() {
   const here = path.dirname(fileURLToPath(import.meta.url));
   return path.resolve(here, "..", "templates");
 }
+function getCliVersion() {
+  try {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const pkg = JSON.parse(
+      fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")
+    );
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
 var KNOWN_AGENTS = {
   claude: { label: "Claude Code", dirName: ".claude", full: true },
   codex: { label: "Codex", dirName: ".codex", full: false },
@@ -121,6 +127,172 @@ async function exists(p) {
   }
 }
 
+// src/lib/updates.ts
+import fs3 from "fs/promises";
+import path3 from "path";
+function parseSemver(v) {
+  const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v.trim());
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function isNewerVersion(a, b) {
+  const pa = parseSemver(a);
+  const pb = parseSemver(b);
+  if (!pa || !pb) return false;
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] !== pb[i]) return pa[i] > pb[i];
+  }
+  return false;
+}
+var SKILLS_VERSION_MARKER = "genex-skills-version.json";
+async function readSkillsMarker(skillsDir) {
+  try {
+    const raw = await fs3.readFile(path3.join(skillsDir, SKILLS_VERSION_MARKER), "utf8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed.version === "string" ? parsed.version : null;
+  } catch {
+    return null;
+  }
+}
+async function writeSkillsMarker(skillsDir, version = getCliVersion()) {
+  await fs3.mkdir(skillsDir, { recursive: true });
+  await fs3.writeFile(
+    path3.join(skillsDir, SKILLS_VERSION_MARKER),
+    JSON.stringify({ version, syncedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n"
+  );
+}
+async function hasGenexSkills(skillsDir) {
+  try {
+    const entries = await fs3.readdir(skillsDir);
+    return entries.some((name) => name.startsWith("genex-"));
+  } catch {
+    return false;
+  }
+}
+async function syncSkillsForTarget(target, templatesDir = getTemplatesDir(), version = getCliVersion()) {
+  const skillsDir = path3.join(target.baseDir, "skills");
+  if (!await hasGenexSkills(skillsDir)) return false;
+  if (await readSkillsMarker(skillsDir) === version) return false;
+  const src = target.full ? templatesDir : path3.join(templatesDir, "skills");
+  const dest = target.full ? target.baseDir : skillsDir;
+  await copyTemplates(src, dest, { exclude: ["controllers"] });
+  await writeSkillsMarker(skillsDir, version);
+  return true;
+}
+async function syncSkills(log) {
+  try {
+    const version = getCliVersion();
+    const templatesDir = getTemplatesDir();
+    let refreshed = false;
+    for (const target of resolveAgentTargets()) {
+      try {
+        refreshed = await syncSkillsForTarget(target, templatesDir, version) || refreshed;
+      } catch {
+      }
+    }
+    if (refreshed) log.plain(`\u{1F504} Genex skills updated to ${version}`);
+  } catch {
+  }
+}
+var PUBLISHED_PACKAGES = [
+  { name: "@genex-ai/cli-demo", label: "CLI", install: "npm i -D @genex-ai/cli-demo@latest" },
+  { name: "@genex-ai/embed-sdk", label: "embed SDK", install: "npm i @genex-ai/embed-sdk@latest" },
+  {
+    name: "@genex-ai/multiplayer",
+    label: "multiplayer SDK",
+    install: "npm i @genex-ai/multiplayer@latest"
+  }
+];
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var REGISTRY_TIMEOUT_MS = 1500;
+function getUpdateCachePath() {
+  return path3.join(getGenexDir(), "update-check.json");
+}
+function isCacheFresh(cache, nowMs) {
+  const at = Date.parse(cache.checkedAt);
+  return Number.isFinite(at) && nowMs - at < CHECK_INTERVAL_MS;
+}
+async function readUpdateCache() {
+  try {
+    const raw = await fs3.readFile(getUpdateCachePath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.checkedAt !== "string" || typeof parsed.latest !== "object") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function fetchLatestFromRegistry(name) {
+  try {
+    const res = await fetch(
+      `https://registry.npmjs.org/-/package/${encodeURIComponent(name)}/dist-tags`,
+      { signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS) }
+    );
+    if (!res.ok) return null;
+    const tags = await res.json();
+    return typeof tags.latest === "string" && parseSemver(tags.latest) ? tags.latest : null;
+  } catch {
+    return null;
+  }
+}
+function startUpdateCheck() {
+  return (async () => {
+    try {
+      const cached = await readUpdateCache();
+      if (cached && isCacheFresh(cached, Date.now())) return cached;
+      const latest = { ...cached?.latest ?? {} };
+      const results = await Promise.allSettled(
+        PUBLISHED_PACKAGES.map((p) => fetchLatestFromRegistry(p.name))
+      );
+      results.forEach((r, i) => {
+        if (r.status === "fulfilled" && r.value) latest[PUBLISHED_PACKAGES[i].name] = r.value;
+      });
+      const next = { checkedAt: (/* @__PURE__ */ new Date()).toISOString(), latest };
+      await fs3.mkdir(getGenexDir(), { recursive: true });
+      await fs3.writeFile(getUpdateCachePath(), JSON.stringify(next, null, 2) + "\n");
+      return next;
+    } catch {
+      return null;
+    }
+  })();
+}
+async function installedPackageVersion(cwd, name) {
+  try {
+    const raw = await fs3.readFile(path3.join(cwd, "node_modules", name, "package.json"), "utf8");
+    const pkg = JSON.parse(raw);
+    return typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+function formatNudge(label, latest, installed, install) {
+  return `\u2B06 Genex ${label} ${latest} available (installed ${installed}) \u2014 run: ${install}`;
+}
+async function reportUpdateNudges(check, log, cwd = process.cwd()) {
+  try {
+    const cache = await check;
+    if (!cache) return;
+    const lines = [];
+    let whatsNew = null;
+    for (const pkg of PUBLISHED_PACKAGES) {
+      const latest = cache.latest[pkg.name];
+      if (!latest) continue;
+      const installed = pkg.name === "@genex-ai/cli-demo" ? getCliVersion() : await installedPackageVersion(cwd, pkg.name);
+      if (!installed) continue;
+      if (isNewerVersion(latest, installed)) {
+        lines.push(formatNudge(pkg.label, latest, installed, pkg.install));
+        whatsNew ??= `https://www.npmjs.com/package/${pkg.name}`;
+      }
+    }
+    if (lines.length === 0) return;
+    for (const line of lines) log.plain(line);
+    log.dim(
+      `  Apply at a safe moment (never mid-task) \u2014 see the genex-updates skill. What's new: ${whatsNew}`
+    );
+  } catch {
+  }
+}
+
 // src/lib/auth.ts
 import http from "http";
 import crypto from "crypto";
@@ -388,22 +560,45 @@ var c = {
   gray: code(90, 39)
 };
 
+// src/lib/api.ts
+var CLI_VERSION_HEADER = "x-genex-cli-version";
+function formatUpdateRequired(body) {
+  const action = body.action ?? "npm i -D @genex-ai/cli-demo@latest";
+  const message = body.message ?? `Genex CLI ${body.clientVersion ?? getCliVersion()} is below the minimum supported version${body.minVersion ? ` ${body.minVersion}` : ""}.`;
+  return [`${c.red("\u2717")} ${message}`, `  Update now \u2014 run: ${action}  (then re-run this command)`];
+}
+async function apiFetch(url, init = {}) {
+  const headers = new Headers(init.headers);
+  if (!headers.has(CLI_VERSION_HEADER)) headers.set(CLI_VERSION_HEADER, getCliVersion());
+  const res = await fetch(url, { ...init, headers });
+  if (res.status === 426) {
+    try {
+      const body = await res.clone().json();
+      if (body?.error === "cli_update_required") {
+        for (const line of formatUpdateRequired(body)) process.stderr.write(line + "\n");
+      }
+    } catch {
+    }
+  }
+  return res;
+}
+
 // src/lib/project.ts
 async function createDraftProject(opts) {
-  const { apiUrl, token, deployKey, colyseusUrl, dashboardUrl, log } = opts;
+  const { apiUrl, token, colyseusUrl, dashboardUrl, log } = opts;
   log.step("Creating your project\u2026");
   const names = [opts.name, `${opts.name}-${randomSuffix()}`];
   for (let i = 0; i < names.length; i++) {
     const name = names[i];
     let res;
     try {
-      res = await fetch(`${apiUrl}/api/projects`, {
+      res = await apiFetch(`${apiUrl}/api/projects`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
           Authorization: `Bearer ${token}`
         },
-        body: JSON.stringify({ name, deployKey })
+        body: JSON.stringify({ name })
       });
     } catch (err) {
       log.warn(`Couldn't reach the API at ${apiUrl} to create the project.`);
@@ -415,17 +610,13 @@ async function createDraftProject(opts) {
       log.warn("Not authorized to create the project (token rejected).");
       return null;
     }
-    if (res.status === 400) {
-      log.warn("The API rejected the deploy key (must be an OpenSSH public key).");
-      return null;
-    }
     if (!res.ok) {
       log.warn(`Couldn't create the project (HTTP ${res.status}).`);
       return null;
     }
     const data = await res.json().catch(() => null);
     const project = data?.project;
-    if (!project || !data?.sshUrl) {
+    if (!project || !project.cloneUrl) {
       log.warn("Project created, but the API response was unexpected.");
       return null;
     }
@@ -435,7 +626,7 @@ async function createDraftProject(opts) {
     return {
       id: project.id,
       slug: project.slug,
-      sshUrl: data.sshUrl,
+      cloneUrl: project.cloneUrl,
       apiUrl,
       colyseusUrl,
       playUrl: project.playUrl ?? void 0,
@@ -453,90 +644,39 @@ function randomSuffix() {
 }
 
 // src/lib/ssh.ts
-import fs3 from "fs/promises";
-import path3 from "path";
-import { spawn as spawn2 } from "child_process";
-var KEY_NAME = "genex_key";
-async function generateSshKeypair(dir, log) {
-  const keyPath = path3.join(dir, KEY_NAME);
-  const pubPath = `${keyPath}.pub`;
-  try {
-    const existing = (await fs3.readFile(pubPath, "utf8")).trim();
-    if (existing) {
-      log.dim(`Reusing existing deploy key (${KEY_NAME}).`);
-      return { publicKey: existing };
-    }
-  } catch {
-  }
-  log.step("Generating a deploy key\u2026");
-  const ok = await runSshKeygen(keyPath, log);
-  if (!ok) return null;
-  try {
-    const pub = (await fs3.readFile(pubPath, "utf8")).trim();
-    if (!pub) {
-      log.warn("ssh-keygen produced no public key.");
-      return null;
-    }
-    await fs3.chmod(keyPath, 384).catch(() => {
-    });
-    return { publicKey: pub };
-  } catch (err) {
-    log.warn(`Couldn't read the generated public key: ${String(err)}`);
-    return null;
-  }
-}
-function runSshKeygen(keyPath, log) {
-  return new Promise((resolve) => {
-    let child;
-    try {
-      child = spawn2(
-        "ssh-keygen",
-        ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "genex-agent"],
-        { stdio: "ignore" }
-      );
-    } catch {
-      log.warn("ssh-keygen not found \u2014 install OpenSSH (ssh-keygen) and re-run.");
-      resolve(false);
-      return;
-    }
-    child.on("error", () => {
-      log.warn("ssh-keygen not found \u2014 install OpenSSH (ssh-keygen) and re-run.");
-      resolve(false);
-    });
-    child.on("close", (code2) => resolve(code2 === 0));
-  });
-}
+import fs4 from "fs/promises";
+import path4 from "path";
 async function writeGitignore(dir, log) {
-  const file = path3.join(dir, ".gitignore");
+  const file = path4.join(dir, ".gitignore");
   let content = "";
   try {
-    content = await fs3.readFile(file, "utf8");
+    content = await fs4.readFile(file, "utf8");
   } catch {
   }
   const present = new Set(content.split("\n").map((l) => l.trim()));
-  const toAdd = [KEY_NAME, `${KEY_NAME}.pub`, ".genex/"].filter((e) => !present.has(e));
+  const toAdd = [".genex/", ".env", ".env.*", "!.env.example"].filter((e) => !present.has(e));
   if (toAdd.length === 0) return;
   let next = content;
   if (next.length > 0 && !next.endsWith("\n")) next += "\n";
-  if (!content.trim()) next += "# genex (deploy key + local metadata \u2014 never publish)\n";
+  if (!content.trim()) next += "# genex local metadata + secrets \u2014 never publish\n";
   next += toAdd.join("\n") + "\n";
-  await fs3.writeFile(file, next);
+  await fs4.writeFile(file, next);
   log.dim(`Updated .gitignore (${toAdd.join(", ")}).`);
 }
 
 // src/lib/store.ts
-import fs5 from "fs/promises";
-import path5 from "path";
+import fs6 from "fs/promises";
+import path6 from "path";
 
 // src/lib/env.ts
-import fs4 from "fs/promises";
-import path4 from "path";
-import { spawn as spawn3 } from "child_process";
+import fs5 from "fs/promises";
+import path5 from "path";
+import { spawn as spawn2 } from "child_process";
 async function writeEnvVar(envPath, key, value) {
   let content = "";
   let existed = false;
   try {
-    content = await fs4.readFile(envPath, "utf8");
+    content = await fs5.readFile(envPath, "utf8");
     existed = true;
   } catch {
   }
@@ -556,14 +696,14 @@ async function writeEnvVar(envPath, key, value) {
     next = prefix + assignment + "\n";
     mode = existed ? "appended" : "created";
   }
-  await fs4.mkdir(path4.dirname(envPath), { recursive: true });
-  await fs4.writeFile(envPath, next, { mode: 384 });
+  await fs5.mkdir(path5.dirname(envPath), { recursive: true });
+  await fs5.writeFile(envPath, next, { mode: 384 });
   await restrictFilePermissions(envPath);
   return { mode, path: envPath };
 }
 async function restrictFilePermissions(filePath) {
   if (process.platform !== "win32") {
-    await fs4.chmod(filePath, 384).catch(() => {
+    await fs5.chmod(filePath, 384).catch(() => {
     });
     return;
   }
@@ -571,7 +711,7 @@ async function restrictFilePermissions(filePath) {
   if (!user) return;
   await new Promise((resolve) => {
     try {
-      const child = spawn3(
+      const child = spawn2(
         "icacls",
         [filePath, "/inheritance:r", "/grant:r", `${user}:F`],
         { stdio: "ignore" }
@@ -595,7 +735,7 @@ function escapeRegExp(s) {
 
 // src/lib/store.ts
 function getProjectMetadataPath(cwd = process.cwd()) {
-  return path5.join(cwd, ".genex", "project.json");
+  return path6.join(cwd, ".genex", "project.json");
 }
 async function writeUserToken(token, envPath) {
   const { path: written } = await writeEnvVar(getGenexEnvPath(envPath), ENV_TOKEN_KEY, token);
@@ -605,14 +745,14 @@ async function readUserToken(envPath) {
   const fromGenex = await readTokenFromFile(getGenexEnvPath(envPath));
   if (fromGenex) return fromGenex;
   if (!envPath) {
-    return readTokenFromFile(path5.join(process.cwd(), ".env"));
+    return readTokenFromFile(path6.join(process.cwd(), ".env"));
   }
   return null;
 }
 async function readTokenFromFile(file) {
   let content;
   try {
-    content = await fs5.readFile(file, "utf8");
+    content = await fs6.readFile(file, "utf8");
   } catch {
     return null;
   }
@@ -628,7 +768,7 @@ function stripQuotes(v) {
 }
 async function readProject(cwd = process.cwd()) {
   try {
-    const raw = await fs5.readFile(getProjectMetadataPath(cwd), "utf8");
+    const raw = await fs6.readFile(getProjectMetadataPath(cwd), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -636,16 +776,16 @@ async function readProject(cwd = process.cwd()) {
 }
 async function writeProject(meta, cwd = process.cwd()) {
   const file = getProjectMetadataPath(cwd);
-  await fs5.mkdir(path5.dirname(file), { recursive: true });
-  await fs5.writeFile(file, JSON.stringify(meta, null, 2) + "\n", { mode: 384 });
-  await fs5.chmod(file, 384).catch(() => {
+  await fs6.mkdir(path6.dirname(file), { recursive: true });
+  await fs6.writeFile(file, JSON.stringify(meta, null, 2) + "\n", { mode: 384 });
+  await fs6.chmod(file, 384).catch(() => {
   });
   return { path: file };
 }
 
 // src/lib/game-config.ts
-import fs6 from "fs/promises";
-import path6 from "path";
+import fs7 from "fs/promises";
+import path7 from "path";
 var DEFAULT_DASHBOARD_ORIGIN = new URL(DEFAULT_AUTH_URL).origin;
 function renderGenexConfig() {
   return `// src/genex.config.ts \u2014 written by \`genex init\`. DO NOT hardcode URLs here.
@@ -686,7 +826,7 @@ ${overrides.join("\n")}
 }
 async function writeIfAbsent(file, content, log) {
   try {
-    await fs6.writeFile(file, content, { flag: "wx" });
+    await fs7.writeFile(file, content, { flag: "wx" });
     log.dim(`  wrote ${c.cyan(file)}`);
     return true;
   } catch (err) {
@@ -698,12 +838,12 @@ async function writeIfAbsent(file, content, log) {
   }
 }
 async function writeGameConfigFiles(meta, log, cwd = process.cwd()) {
-  await fs6.mkdir(path6.join(cwd, "src"), { recursive: true });
-  await writeIfAbsent(path6.join(cwd, "src", "genex.config.ts"), renderGenexConfig(), log);
-  await writeIfAbsent(path6.join(cwd, ".env"), renderSlugEnv(meta.slug), log);
+  await fs7.mkdir(path7.join(cwd, "src"), { recursive: true });
+  await writeIfAbsent(path7.join(cwd, "src", "genex.config.ts"), renderGenexConfig(), log);
+  await writeIfAbsent(path7.join(cwd, ".env"), renderSlugEnv(meta.slug), log);
   const overrides = renderDevOverrides(meta);
   if (overrides) {
-    await writeIfAbsent(path6.join(cwd, ".env.development.local"), overrides, log);
+    await writeIfAbsent(path7.join(cwd, ".env.development.local"), overrides, log);
   }
 }
 
@@ -739,12 +879,13 @@ async function runInit(opts) {
   let totalNew = 0;
   let totalUpdated = 0;
   for (const t of targets) {
-    const src = t.full ? templatesDir : path7.join(templatesDir, "skills");
-    const dest = t.full ? t.baseDir : path7.join(t.baseDir, "skills");
+    const src = t.full ? templatesDir : path8.join(templatesDir, "skills");
+    const dest = t.full ? t.baseDir : path8.join(t.baseDir, "skills");
     const { copied, updated } = await copyTemplates(src, dest, {
       force: opts.force,
       exclude: ["controllers"]
     });
+    await writeSkillsMarker(path8.join(t.baseDir, "skills"));
     const added = copied.length - updated.length;
     totalNew += added;
     totalUpdated += updated.length;
@@ -775,24 +916,14 @@ async function runInit(opts) {
   const { path: tokenPath } = await writeUserToken(token, opts.envPath);
   log.success(`Saved your token to ${c.cyan(tokenPath)} (${ENV_TOKEN_KEY}).`);
   log.plain("");
-  const key = await generateSshKeypair(process.cwd(), log);
   await writeGitignore(process.cwd(), log);
-  if (!key) {
-    log.warn(
-      "Skipping project creation \u2014 no deploy key. Install ssh-keygen (OpenSSH) and re-run `genex init`."
-    );
-    log.plain("");
-    log.success("Workspace ready (no project created yet).");
-    return;
-  }
   const apiUrl = getApiUrl(opts.apiUrl);
   const colyseusUrl = getColyseusUrl(opts.colyseusUrl);
-  const projectName = opts.name?.trim() || path7.basename(process.cwd());
+  const projectName = opts.name?.trim() || path8.basename(process.cwd());
   const meta = await createDraftProject({
     apiUrl,
     token,
     name: projectName,
-    deployKey: key.publicKey,
     colyseusUrl,
     dashboardUrl: authBaseUrl,
     log
@@ -807,8 +938,8 @@ async function runInit(opts) {
 }
 
 // src/commands/link.ts
-import fs7 from "fs/promises";
-import path8 from "path";
+import fs8 from "fs/promises";
+import path9 from "path";
 async function runLink(opts) {
   const log = createLogger({ quiet: opts.quiet });
   log.plain(c.bold("genex link"));
@@ -845,23 +976,11 @@ async function runLink(opts) {
     process.exitCode = 1;
     return;
   }
-  const key = await generateSshKeypair(process.cwd(), log);
-  if (!key) {
-    log.error("No deploy key \u2014 install ssh-keygen (OpenSSH) and re-run `genex link`.");
-    process.exitCode = 1;
-    return;
-  }
   await writeGitignore(process.cwd(), log);
-  log.step("Registering this folder's deploy key\u2026");
-  const linked = await registerDeployKey(apiUrl, token, project.id, key.publicKey, log);
-  if (!linked) {
-    process.exitCode = 1;
-    return;
-  }
   const meta = {
     id: project.id,
     slug: project.slug,
-    sshUrl: linked.sshUrl,
+    cloneUrl: project.cloneUrl ?? "",
     apiUrl,
     colyseusUrl: getColyseusUrl(opts.colyseusUrl),
     playUrl: project.playUrl ?? void 0,
@@ -879,29 +998,29 @@ async function runLink(opts) {
   if (project.playUrl) log.dim(`  play URL: ${project.playUrl}`);
 }
 async function ensureSlugEnv(slug, log, cwd = process.cwd()) {
-  const file = path8.join(cwd, ".env");
+  const file = path9.join(cwd, ".env");
   let content;
   try {
-    content = await fs7.readFile(file, "utf8");
+    content = await fs8.readFile(file, "utf8");
   } catch {
     return;
   }
   const re = /^(\s*VITE_GENEX_SLUG=)(.*)$/m;
   const m = content.match(re);
   if (!m) {
-    await fs7.appendFile(file, `${content.endsWith("\n") ? "" : "\n"}VITE_GENEX_SLUG=${slug}
+    await fs8.appendFile(file, `${content.endsWith("\n") ? "" : "\n"}VITE_GENEX_SLUG=${slug}
 `);
     log.dim(`  added VITE_GENEX_SLUG=${slug} to .env`);
     return;
   }
   if (m[2].trim() === slug) return;
-  await fs7.writeFile(file, content.replace(re, `$1${slug}`));
+  await fs8.writeFile(file, content.replace(re, `$1${slug}`));
   log.dim(`  updated .env: VITE_GENEX_SLUG=${slug} (was ${m[2].trim()})`);
 }
 async function fetchOwnProject(apiUrl, token, slug, log) {
   let res;
   try {
-    res = await fetch(`${apiUrl}/api/projects/by-slug/${encodeURIComponent(slug)}`, {
+    res = await apiFetch(`${apiUrl}/api/projects/by-slug/${encodeURIComponent(slug)}`, {
       headers: { Authorization: `Bearer ${token}` }
     });
   } catch (err) {
@@ -933,7 +1052,7 @@ async function fetchOwnProject(apiUrl, token, slug, log) {
 }
 async function listOwnSlugs(apiUrl, token, log) {
   try {
-    const res = await fetch(`${apiUrl}/api/projects`, {
+    const res = await apiFetch(`${apiUrl}/api/projects`, {
       headers: { Authorization: `Bearer ${token}` }
     });
     if (!res.ok) return;
@@ -947,49 +1066,18 @@ async function listOwnSlugs(apiUrl, token, log) {
   } catch {
   }
 }
-async function registerDeployKey(apiUrl, token, projectId, deployKey, log) {
-  let res;
-  try {
-    res = await fetch(`${apiUrl}/api/projects/${projectId}/deploy-key`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${token}`
-      },
-      body: JSON.stringify({ deployKey })
-    });
-  } catch (err) {
-    log.error(`Couldn't reach the API at ${apiUrl}.`);
-    log.dim(`  ${String(err)}`);
-    return null;
-  }
-  if (res.status === 429) {
-    log.error("Rate limited \u2014 too many link attempts. Try again in a bit.");
-    return null;
-  }
-  if (!res.ok) {
-    log.error(`Couldn't register the deploy key (HTTP ${res.status}).`);
-    return null;
-  }
-  const data = await res.json().catch(() => null);
-  if (!data?.sshUrl) {
-    log.error("Unexpected API response while registering the deploy key.");
-    return null;
-  }
-  return { sshUrl: data.sshUrl };
-}
 
 // src/lib/deploy.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import crypto3 from "crypto";
-import fs8 from "fs/promises";
+import fs9 from "fs/promises";
 import os2 from "os";
-import path9 from "path";
+import path10 from "path";
 function run(cmd, args, env) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn4(cmd, args, { env: env ? { ...process.env, ...env } : process.env });
+      child = spawn3(cmd, args, { env: env ? { ...process.env, ...env } : process.env });
     } catch {
       resolve({ code: -1, out: "", err: `${cmd} not found` });
       return;
@@ -1003,6 +1091,9 @@ function run(cmd, args, env) {
   });
 }
 var EXCLUDE_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".genex", "dist"]);
+function isSecretEnvFile(name) {
+  return name === ".env" || name.startsWith(".env.") && name !== ".env.example";
+}
 async function deployGame(ctx, opts, log) {
   const cwd = process.cwd();
   if (!opts.noBuild && await hasBuildScript(cwd)) {
@@ -1016,15 +1107,11 @@ async function deployGame(ctx, opts, log) {
     }
     log.success("Built.");
   }
-  const distDir = path9.join(cwd, "dist");
+  const distDir = path10.join(cwd, "dist");
   const siteDir = await isDir2(distDir) ? distDir : cwd;
-  const rel = path9.relative(cwd, siteDir) || ".";
+  const rel = path10.relative(cwd, siteDir) || ".";
   if (siteDir === cwd) await writeGitignore(cwd, log);
   const files = await collectFiles(siteDir);
-  if (files.some((f) => /(^|\/)genex_key(\.pub)?$/.test(f.relPath))) {
-    log.error(`Refusing to deploy: ${KEY_NAME} is in ${rel}. Add it to .gitignore and retry.`);
-    return false;
-  }
   if (files.length === 0) {
     log.warn("Nothing to deploy \u2014 the build produced no files.");
     return false;
@@ -1057,12 +1144,7 @@ async function deployGame(ctx, opts, log) {
     log.error("Couldn't upload your game \u2014 please try again.");
     return false;
   }
-  const keyPath = path9.resolve(cwd, KEY_NAME);
-  if (!await fileExists(keyPath)) {
-    log.error(`No deploy key (${KEY_NAME}) here \u2014 run \`genex init\` in this folder first.`);
-    return false;
-  }
-  if (!await pushSource(cwd, ctx.sshUrl, keyPath, log)) return false;
+  if (!await pushSource(cwd, ctx, log)) return false;
   log.step("Publishing\u2026");
   if (!await callPublish(ctx, commit, opts, log)) return false;
   const index = files.find((f) => f.relPath === "index.html");
@@ -1071,7 +1153,7 @@ async function deployGame(ctx, opts, log) {
 }
 async function hasBuildScript(cwd) {
   try {
-    const pkg = JSON.parse(await fs8.readFile(path9.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(await fs9.readFile(path10.join(cwd, "package.json"), "utf8"));
     return Boolean(pkg.scripts?.build);
   } catch {
     return false;
@@ -1080,12 +1162,12 @@ async function hasBuildScript(cwd) {
 async function collectFiles(root) {
   const out = [];
   const walk2 = async (dir, prefix) => {
-    for (const e of await fs8.readdir(dir, { withFileTypes: true })) {
+    for (const e of await fs9.readdir(dir, { withFileTypes: true })) {
       const relPath = prefix ? `${prefix}/${e.name}` : e.name;
       if (e.isDirectory()) {
-        if (!EXCLUDE_DIRS.has(e.name)) await walk2(path9.join(dir, e.name), relPath);
-      } else if (e.isFile() && e.name !== KEY_NAME && e.name !== `${KEY_NAME}.pub`) {
-        out.push({ relPath, bytes: await fs8.readFile(path9.join(dir, e.name)) });
+        if (!EXCLUDE_DIRS.has(e.name)) await walk2(path10.join(dir, e.name), relPath);
+      } else if (e.isFile() && !isSecretEnvFile(e.name)) {
+        out.push({ relPath, bytes: await fs9.readFile(path10.join(dir, e.name)) });
       }
     }
   };
@@ -1104,7 +1186,7 @@ function contentCommit(files) {
 async function getUploadToken(ctx, commit, log) {
   let res;
   try {
-    res = await fetch(`${ctx.apiUrl}/api/games/${ctx.projectId}/upload-token`, {
+    res = await apiFetch(`${ctx.apiUrl}/api/games/${ctx.projectId}/upload-token`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: `Bearer ${ctx.token}` },
       body: JSON.stringify({ commit })
@@ -1151,7 +1233,7 @@ async function uploadAll(uploadUrl, uploadToken, files, log) {
 async function callPublish(ctx, commit, opts, log) {
   let res;
   try {
-    res = await fetch(`${ctx.apiUrl}/api/games/${ctx.projectId}/publish`, {
+    res = await apiFetch(`${ctx.apiUrl}/api/games/${ctx.projectId}/publish`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: `Bearer ${ctx.token}` },
       // Detections ride every go-live (preview AND publish): matchmaking is
@@ -1175,13 +1257,15 @@ async function callPublish(ctx, commit, opts, log) {
   }
   return true;
 }
-async function pushSource(cwd, sshUrl, keyPath, log) {
+async function pushSource(cwd, ctx, log) {
   const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
   const failed = () => {
     log.error("Couldn't save your game's source \u2014 please try again.");
     return false;
   };
-  const gitDir = await fs8.mkdtemp(path9.join(os2.tmpdir(), "genex-source-"));
+  const pushUrl = await fetchPushUrl(ctx, log);
+  if (!pushUrl) return false;
+  const gitDir = await fs9.mkdtemp(path10.join(os2.tmpdir(), "genex-source-"));
   const base = { GIT_DIR: gitDir };
   const ident = {
     GIT_AUTHOR_NAME: "genex",
@@ -1191,49 +1275,58 @@ async function pushSource(cwd, sshUrl, keyPath, log) {
   };
   try {
     if ((await run("git", ["init", "-q"], base)).code !== 0) return failed();
-    await fs8.writeFile(
-      path9.join(gitDir, "info", "exclude"),
-      ["node_modules/", "dist/", ".git/", KEY_NAME, `${KEY_NAME}.pub`, ".genex/", ""].join("\n")
+    await fs9.writeFile(
+      path10.join(gitDir, "info", "exclude"),
+      // .env* are secrets — the managed repo is public. `!` keeps the non-secret template.
+      ["node_modules/", "dist/", ".git/", ".genex/", ".env", ".env.*", "!.env.example", ""].join("\n")
     );
-    const env = { ...base, GIT_WORK_TREE: cwd, GIT_INDEX_FILE: path9.join(gitDir, "index-source") };
+    const env = { ...base, GIT_WORK_TREE: cwd, GIT_INDEX_FILE: path10.join(gitDir, "index-source") };
     await run("git", ["add", "-A"], env);
-    const tracked = await run("git", ["ls-files"], env);
-    if (/(^|\/)genex_key(\.pub)?$/m.test(tracked.out)) {
-      log.error(`Refusing to publish: ${KEY_NAME} is in your project. Add it to .gitignore and retry.`);
-      return false;
-    }
-    const tree = tracked.out.trim() ? (await run("git", ["write-tree"], env)).out.trim() : "";
+    const tree = (await run("git", ["ls-files"], env)).out.trim() ? (await run("git", ["write-tree"], env)).out.trim() : "";
     if (!tree || tree === EMPTY_TREE) {
       log.error("Nothing to publish \u2014 the project has no files.");
       return false;
     }
     const commit = (await run("git", ["commit-tree", tree, "-m", "source"], { ...base, ...ident })).out.trim();
     await run("git", ["update-ref", "refs/heads/main", commit], base);
-    const push = await run("git", ["push", "-q", sshUrl, "+refs/heads/main:main"], {
-      ...base,
-      // Quote the key path: git splits GIT_SSH_COMMAND shell-like, so a folder with a
-      // space would otherwise break the `-i` argument.
-      GIT_SSH_COMMAND: `ssh -i "${keyPath}" -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new`
-    });
+    const push = await run("git", ["push", "-q", pushUrl, "+refs/heads/main:main"], base);
     return push.code === 0 ? true : failed();
   } catch {
     return failed();
   } finally {
-    await fs8.rm(gitDir, { recursive: true, force: true }).catch(() => {
+    await fs9.rm(gitDir, { recursive: true, force: true }).catch(() => {
     });
   }
 }
-async function isDir2(p) {
+async function fetchPushUrl(ctx, log) {
+  let res;
   try {
-    return (await fs8.stat(p)).isDirectory();
-  } catch {
-    return false;
+    res = await apiFetch(`${ctx.apiUrl}/api/projects/${ctx.projectId}/push-token`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${ctx.token}` }
+    });
+  } catch (err) {
+    log.error(`Couldn't reach the API to authorize the source push: ${String(err)}`);
+    return null;
+  }
+  if (res.status === 401) {
+    log.error("Not authorized \u2014 your token may have expired. Re-run `genex init`.");
+    return null;
+  }
+  if (!res.ok) {
+    log.error(`Couldn't authorize the source push (HTTP ${res.status}).`);
+    return null;
   }
+  const data = await res.json().catch(() => null);
+  if (!data?.pushUrl) {
+    log.error("The API didn't return a push URL.");
+    return null;
+  }
+  return data.pushUrl;
 }
-async function fileExists(p) {
+async function isDir2(p) {
   try {
-    await fs8.access(p);
-    return true;
+    return (await fs9.stat(p)).isDirectory();
   } catch {
     return false;
   }
@@ -1266,11 +1359,11 @@ async function waitUntilLive(playUrl, fingerprint, timeoutMs, log) {
 }
 
 // src/lib/detect-features.ts
-import fs9 from "fs/promises";
-import path10 from "path";
+import fs10 from "fs/promises";
+import path11 from "path";
 async function detectEmbedSdkVersion(cwd = process.cwd()) {
   try {
-    const raw = await fs9.readFile(path10.join(cwd, "package.json"), "utf8");
+    const raw = await fs10.readFile(path11.join(cwd, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     const version = pkg.dependencies?.["@genex-ai/embed-sdk"] ?? pkg.devDependencies?.["@genex-ai/embed-sdk"];
     return typeof version === "string" && version ? version : null;
@@ -1280,7 +1373,7 @@ async function detectEmbedSdkVersion(cwd = process.cwd()) {
 }
 async function detectMultiplayer(cwd = process.cwd()) {
   try {
-    const raw = await fs9.readFile(path10.join(cwd, "package.json"), "utf8");
+    const raw = await fs10.readFile(path11.join(cwd, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     return Boolean(
       pkg.dependencies?.["@genex-ai/multiplayer"] ?? pkg.devDependencies?.["@genex-ai/multiplayer"]
@@ -1292,7 +1385,7 @@ async function detectMultiplayer(cwd = process.cwd()) {
 async function detectMatchmaking(log, cwd = process.cwd()) {
   let pkg;
   try {
-    pkg = JSON.parse(await fs9.readFile(path10.join(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(await fs10.readFile(path11.join(cwd, "package.json"), "utf8"));
   } catch (err) {
     log.dim(`  (skipping matchmaking \u2014 couldn't read package.json: ${String(err)})`);
     return null;
@@ -1309,10 +1402,10 @@ async function detectMatchmaking(log, cwd = process.cwd()) {
 }
 var GAME_STATE_CALLS = /savePlayerState|saveWorldState|submitScore/;
 async function detectGameStateUsage(cwd = process.cwd()) {
-  const srcDir = path10.join(cwd, "src");
+  const srcDir = path11.join(cwd, "src");
   let entries;
   try {
-    entries = await fs9.readdir(srcDir, { recursive: true });
+    entries = await fs10.readdir(srcDir, { recursive: true });
   } catch {
     return false;
   }
@@ -1320,7 +1413,7 @@ async function detectGameStateUsage(cwd = process.cwd()) {
     if (rel.includes("node_modules")) continue;
     if (!/\.(ts|js|mts|mjs|tsx|jsx)$/.test(rel)) continue;
     try {
-      const content = await fs9.readFile(path10.join(srcDir, rel), "utf8");
+      const content = await fs10.readFile(path11.join(srcDir, rel), "utf8");
       if (GAME_STATE_CALLS.test(content)) return true;
     } catch {
     }
@@ -1375,7 +1468,7 @@ async function runPublish(opts) {
   advisoryNudges(log, detections);
   if (!opts.noPush) {
     const ok = await deployGame(
-      { projectId: meta.id, sshUrl: meta.sshUrl, apiUrl, token },
+      { projectId: meta.id, apiUrl, token },
       {
         noBuild: opts.noBuild,
         matchmaking: detections.matchmaking,
@@ -1406,7 +1499,7 @@ async function runPublish(opts) {
     body.multiplayer = detections.multiplayer;
     body.matchmaking = detections.matchmaking ?? null;
     body.gameStateUsed = detections.gameStateUsed;
-    res = await fetch(`${apiUrl}/api/projects/${meta.id}/publish`, {
+    res = await apiFetch(`${apiUrl}/api/projects/${meta.id}/publish`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
       body: JSON.stringify(body)
@@ -1447,7 +1540,7 @@ async function runPreview(opts) {
   advisoryNudges(log, detections);
   const apiUrl = getApiUrl(meta.apiUrl);
   const ok = await deployGame(
-    { projectId: meta.id, sshUrl: meta.sshUrl, apiUrl, token },
+    { projectId: meta.id, apiUrl, token },
     // Detections reach the server on every preview too: matchmaking so a draft's
     // declared preset doesn't silently run the default (null clears a removed
     // config), embedSdkVersion/multiplayer so the dashboard's Publish button can
@@ -1533,7 +1626,7 @@ async function runGenerate(kind, opts) {
   log.plain("");
   let id;
   try {
-    const res = await fetch(`${apiUrl}/api/generations`, {
+    const res = await apiFetch(`${apiUrl}/api/generations`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
       body: JSON.stringify({ kind, prompt, options })
@@ -1599,7 +1692,7 @@ async function waitViaSSE(apiUrl, token, id, onProgress, deadline) {
     try {
       let res;
       try {
-        res = await fetch(`${apiUrl}/api/generations/${id}/events`, {
+        res = await apiFetch(`${apiUrl}/api/generations/${id}/events`, {
           headers: { Authorization: `Bearer ${token}`, Accept: "text/event-stream" },
           signal: abort.signal
         });
@@ -1646,7 +1739,7 @@ async function poll(apiUrl, token, id, onProgress) {
   let last = -1;
   while (Date.now() < deadline) {
     try {
-      const res = await fetch(`${apiUrl}/api/generations/${id}`, {
+      const res = await apiFetch(`${apiUrl}/api/generations/${id}`, {
         headers: { Authorization: `Bearer ${token}` }
       });
       if (res.ok) {
@@ -1678,8 +1771,8 @@ function printHint(kind, files, log) {
 }
 
 // src/commands/controller.ts
-import fs10 from "fs/promises";
-import path11 from "path";
+import fs11 from "fs/promises";
+import path12 from "path";
 var CONTROLLER_KINDS = ["character", "car", "drone"];
 var SHARED = [
   "shared/math.ts",
@@ -1758,8 +1851,8 @@ var CONTROLLER_FILE_SETS = {
     ]
   }
 };
-var CODE_DEST = path11.join("src", "controllers");
-var ASSETS_DEST = path11.join("public", "assets");
+var CODE_DEST = path12.join("src", "controllers");
+var ASSETS_DEST = path12.join("public", "assets");
 async function runController(opts) {
   const log = createLogger({ quiet: opts.quiet });
   const kind = opts.kind?.trim();
@@ -1772,31 +1865,31 @@ async function runController(opts) {
     process.exitCode = 1;
     return;
   }
-  const srcDir = path11.join(getTemplatesDir(), "controllers");
+  const srcDir = path12.join(getTemplatesDir(), "controllers");
   const root = opts.cwd ?? process.cwd();
   const set = CONTROLLER_FILE_SETS[kind];
   log.plain(c.bold(`genex controller ${kind}`));
   log.plain("");
-  log.step(`Installing the ${kind} controller into ${c.cyan(CODE_DEST + path11.sep)}`);
+  log.step(`Installing the ${kind} controller into ${c.cyan(CODE_DEST + path12.sep)}`);
   const plan = [
-    ...set.code.map((rel) => ({ from: rel, rel: path11.join(CODE_DEST, rel) })),
+    ...set.code.map((rel) => ({ from: rel, rel: path12.join(CODE_DEST, rel) })),
     ...set.assets.map((rel) => ({
       from: rel,
-      rel: path11.join(ASSETS_DEST, path11.basename(rel))
+      rel: path12.join(ASSETS_DEST, path12.basename(rel))
     }))
   ];
   let copied = 0;
   let skipped = 0;
   try {
     for (const file of plan) {
-      const dest = path11.join(root, file.rel);
+      const dest = path12.join(root, file.rel);
       if (!opts.force && await exists2(dest)) {
         skipped++;
         log.dim(`  skipped ${file.rel} (exists \u2014 use --force to overwrite)`);
         continue;
       }
-      await fs10.mkdir(path11.dirname(dest), { recursive: true });
-      await fs10.copyFile(path11.join(srcDir, file.from), dest);
+      await fs11.mkdir(path12.dirname(dest), { recursive: true });
+      await fs11.copyFile(path12.join(srcDir, file.from), dest);
       copied++;
       log.dim(`  ${file.rel}`);
     }
@@ -1828,11 +1921,11 @@ async function runController(opts) {
 }
 async function installOwnerAvatar(args) {
   const { root, srcDir, apiUrl, token, log } = args;
-  const dest = path11.join(root, ASSETS_DEST, "avatar.vrm");
-  await fs10.mkdir(path11.dirname(dest), { recursive: true });
+  const dest = path12.join(root, ASSETS_DEST, "avatar.vrm");
+  await fs11.mkdir(path12.dirname(dest), { recursive: true });
   if (token) {
     try {
-      const res = await fetch(`${apiUrl}/api/avatars/me`, {
+      const res = await apiFetch(`${apiUrl}/api/avatars/me`, {
         headers: { Authorization: `Bearer ${token}` }
       });
       if (res.ok) {
@@ -1841,7 +1934,7 @@ async function installOwnerAvatar(args) {
           const vrmRes = await fetch(me.vrmUrl);
           if (vrmRes.ok) {
             const buf = Buffer.from(await vrmRes.arrayBuffer());
-            await fs10.writeFile(dest, buf);
+            await fs11.writeFile(dest, buf);
             log.dim(`  public/assets/avatar.vrm (your avatar \u2014 ${(buf.length / 1e6).toFixed(1)} MB)`);
             return;
           }
@@ -1852,14 +1945,14 @@ async function installOwnerAvatar(args) {
       log.dim("  avatar fetch failed (offline?); using the bundled default.");
     }
   }
-  await fs10.copyFile(path11.join(srcDir, "assets", "default-avatar.vrm"), dest);
+  await fs11.copyFile(path12.join(srcDir, "assets", "default-avatar.vrm"), dest);
   log.dim(
     token ? "  public/assets/avatar.vrm (bundled default)" : "  public/assets/avatar.vrm (bundled default \u2014 sign in and re-run for your own)"
   );
 }
 async function exists2(p) {
   try {
-    await fs10.access(p);
+    await fs11.access(p);
     return true;
   } catch {
     return false;
@@ -1873,7 +1966,7 @@ async function runExplore(opts) {
   const apiUrl = getApiUrl(opts.apiUrl);
   let res;
   try {
-    res = await fetch(`${apiUrl}/api/gallery/search-corpus?curated=1`);
+    res = await apiFetch(`${apiUrl}/api/gallery/search-corpus?curated=1`);
   } catch {
     log.error("Couldn't reach Genex \u2014 please try again.");
     process.exitCode = 1;
@@ -1933,17 +2026,6 @@ function rank(items, query) {
 
 // src/index.ts
 var GEN_KINDS = /* @__PURE__ */ new Set(["model", "skybox", "sfx", "texture"]);
-function getVersion() {
-  try {
-    const here = path12.dirname(fileURLToPath2(import.meta.url));
-    const pkg = JSON.parse(
-      readFileSync(path12.resolve(here, "..", "package.json"), "utf8")
-    );
-    return pkg.version ?? "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
 var HELP = `${c.bold("genex")} \u2014 set up your ~/.claude workspace, authorize, and publish 3D games.
 
 ${c.bold("Usage")}
@@ -2206,43 +2288,50 @@ async function main() {
     return;
   }
   if (parsed.version) {
-    log.plain(getVersion());
+    log.plain(getCliVersion());
     return;
   }
   if (parsed.help || parsed.command === void 0) {
     log.plain(HELP);
     return;
   }
-  if (GEN_KINDS.has(parsed.command)) {
-    await runGenerate(parsed.command, {
-      ...parsed.options,
-      prompt: parsed.options.name
-    });
-    return;
-  }
-  switch (parsed.command) {
-    case "init":
-      await runInit(parsed.options);
-      break;
-    case "link":
-      await runLink(parsed.options);
-      break;
-    case "controller":
-      await runController({ ...parsed.options, kind: parsed.options.name });
-      break;
-    case "preview":
-      await runPreview(parsed.options);
-      break;
-    case "publish":
-      await runPublish(parsed.options);
-      break;
-    case "explore":
-      await runExplore({ ...parsed.options, query: parsed.options.name });
-      break;
-    default:
-      log.error(`Unknown command: ${parsed.command}`);
-      log.plain(`Run ${c.cyan("genex --help")} for usage.`);
-      process.exitCode = 1;
+  const updateLog = createLogger({ quiet: parsed.options.quiet });
+  if (parsed.command !== "init") await syncSkills(updateLog);
+  const updateCheck = startUpdateCheck();
+  try {
+    if (GEN_KINDS.has(parsed.command)) {
+      await runGenerate(parsed.command, {
+        ...parsed.options,
+        prompt: parsed.options.name
+      });
+      return;
+    }
+    switch (parsed.command) {
+      case "init":
+        await runInit(parsed.options);
+        break;
+      case "link":
+        await runLink(parsed.options);
+        break;
+      case "controller":
+        await runController({ ...parsed.options, kind: parsed.options.name });
+        break;
+      case "preview":
+        await runPreview(parsed.options);
+        break;
+      case "publish":
+        await runPublish(parsed.options);
+        break;
+      case "explore":
+        await runExplore({ ...parsed.options, query: parsed.options.name });
+        break;
+      default:
+        log.error(`Unknown command: ${parsed.command}`);
+        log.plain(`Run ${c.cyan("genex --help")} for usage.`);
+        process.exitCode = 1;
+    }
+  } finally {
+    await reportUpdateNudges(updateCheck, updateLog);
   }
 }
 main().catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genex-ai/cli-demo",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Set up your ~/.claude workspace, authorize, create a game project, generate AI assets, and publish (genex CLI).",
   "type": "module",
   "bin": {

package/templates/README.md

@@ -8,9 +8,9 @@ for making 3D games in the browser.
 Genex is built around agent superpowers for browser games: Three.js skills,
 one-click publishing, multiplayer-ready architecture, and team workflows.
 
-Files whose names start with `genex-` are managed by Genex: re-running
-`genex init` refreshes them to the latest version. Anything you add yourself is
-never touched.
+Files whose names start with `genex-` are managed by Genex: every `genex`
+command keeps them in sync with the installed CLI version automatically
+(re-running `genex init` does too). Anything you add yourself is never touched.
 
 - `skills/` - reusable Genex skills for 3D game creation.
 - `agents/` - example subagent definitions.

package/templates/skills/genex-getting-started/SKILL.md

@@ -13,9 +13,9 @@ architecture, and team-ready workflows.
 
 `genex init` installs the Genex skills into **every coding agent it detects** —
 Claude Code (`~/.claude`), Codex (`~/.codex`), and Cursor (`~/.cursor`) — so the
-same skills are available whichever agent you build with. Re-running `init`
-always refreshes the genex-owned skills to the latest version (your own files
-are never touched).
+same skills are available whichever agent you build with. After that, every
+`genex` command keeps the genex-owned skills in sync with the installed CLI
+automatically (re-running `init` does too); your own files are never touched.
 
 - **skills/** - reusable Genex skills for 3D browser-game work (all agents).
 - **agents/** - example subagent definitions (Claude Code).
@@ -92,8 +92,8 @@ refreshes the genex-owned ones.
 
 ## Reconnecting an existing game (`genex link`)
 
-Each game's connection to its live page is folder-local (`.genex/project.json`
-+ the `genex_key` deploy key). If that folder is gone — deleted, or the game
+Each game's connection to its live page is folder-local (`.genex/project.json`).
+If that folder is gone — deleted, or the game
 was built on another machine — **don't run `init` to "recover" it**: that
 creates a brand-new game at a new URL. Instead, clone the game's source repo
 and re-link the clone to the same live game:
@@ -104,12 +104,20 @@ npm install
 npx @genex-ai/cli-demo@latest link <slug>   # slug = the name in the play URL
 ```
 
-`link` never creates a project: it signs in if needed (the browser opens once),
-registers a fresh deploy key for this folder, and rewrites the local link.
+`link` never creates a project: it signs in if needed (the browser opens once)
+and rewrites the local link (source pushes authorize over HTTPS, so there's no
+key to set up — it works from any machine).
 After it, `npx genex preview` / `npx genex publish` update the **same live
 game** — plays, likes, and comments stay. It also fixes a folder whose
 authorization went stale ("Not authorized" from `preview`/`publish`).
 
+## Staying up to date
+
+Genex commands print an update nudge when a newer package exists
+(`⬆ Genex … available — run: …`). Follow `$genex-updates`: apply the printed
+command at a safe moment (never mid-task), then tell the user what changed.
+Skills need no action — they sync automatically on every `genex` command.
+
 ## Re-running setup
 
 Safe to run any time — genex-owned skills are refreshed to the latest version,

package/templates/skills/genex-updates/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: genex-updates
+description: Apply Genex platform updates safely. Use when a genex command prints an update nudge ("⬆ Genex … available — run: …"), a skills-refresh line ("🔄 Genex skills updated"), or an update-required refusal (HTTP 426, cli_update_required), or when the user asks about updating Genex packages.
+---
+
+# Genex Updates — apply platform updates at safe moments
+
+Genex ships improvements continuously. The `genex` CLI tells you when something
+is stale; you (the agent) apply the update at the right moment and tell the
+user what happened. The user never manages versions themselves.
+
+## The three signals in `genex` output
+
+| Line | Meaning | What you do |
+| -- | -- | -- |
+| `🔄 Genex skills updated to X.Y.Z` | Skills were auto-refreshed to match the installed CLI. | Nothing — informational. Skills stay in sync on their own. |
+| `⬆ Genex <package> X.Y.Z available (installed A.B.C) — run: <command>` | A newer npm package exists. | Run the printed command at a **safe moment** (below), then tell the user. |
+| `✗ … below the minimum supported version … Update now — run: <command>` | The API refuses this CLI version (HTTP 426, `cli_update_required`). | Run the printed command **now**, then re-run the refused genex command. |
+
+## Safe moments — when to apply a nudge
+
+Update when nothing is in flight:
+
+- at the start of a session, before you begin the user's task;
+- between tasks, after the current change is finished and working;
+- right before a `genex preview`/`publish` you have **not** started yet.
+
+Never mid-task: not during a build or deploy, not halfway through a code
+change, not while the user is waiting for something else. A nudge is a
+suggestion — if now is not a safe moment, finish first; the nudge reappears on
+the next command. (The 426 refusal is the exception: nothing works until you
+update, so update immediately.)
+
+## How to apply
+
+Run exactly the command the nudge printed, from the game project root:
+
+```bash
+npm i -D @genex-ai/cli-demo@latest   # the genex CLI (a dev dependency)
+npm i @genex-ai/embed-sdk@latest     # identity/saves SDK (ships inside the game)
+npm i @genex-ai/multiplayer@latest   # multiplayer SDK (only if the game uses it)
+```
+
+Skills refresh automatically on the next `genex` command after a CLI update —
+no extra step. Then tell the user in one short line what changed and why it
+matters, e.g. "I also updated Genex to 0.22 — skills and SDK refreshed." For
+what's new, check the package page: https://www.npmjs.com/package/@genex-ai/cli-demo
+
+## Hard rules
+
+- **Never touch game code as part of an update.** Everything in the game's
+  `src/` — including vendored controller code in `src/controllers/` — is
+  user-owned and may carry customizations. Updates never overwrite it. If a
+  newer controller exists you may *mention* that `genex controller <type>
+  --force` re-vendors it, but run that only when the user explicitly opts in
+  (it overwrites their changes).
+- **Never update silently.** `npm i …@latest` changes `package.json` — that is
+  the sanctioned path, but always say in chat that you did it.
+- **Never downgrade**, and never pin to an old version to "fix" an error —
+  report the error instead.
+- **Verify after updating**: the game should still build/run. If it does not,
+  say exactly what broke rather than quietly reverting.
+- If `npm i` fails (offline, registry down), say so and continue on the
+  current version — everything keeps working, and the nudge will reappear.
+- A published game is never affected by any of this: its live bundle is frozen
+  and keeps working regardless of local package versions.