@genex-ai/cli-demo 1.34.2 → 1.34.3-dev.704

package/dist/index.js

@@ -30,7 +30,6 @@ import {
   reportForceRefused,
   reportStale,
   reportTermsRefusal,
-  restrictFilePermissions,
   rotateRejectedEnv,
   run,
   runAccept,
@@ -40,15 +39,18 @@ import {
   sourceTreeHash,
   urlHasEmbeddedCredentials,
   writeProject,
+  writeSecretFile,
   writeUserToken,
   writeWorkspace
-} from "./chunk-OJAXYQ5L.js";
+} from "./chunk-MRV3Q3WU.js";
 import {
   CLI_CHANNEL,
   DEFAULT_API_URL,
   DEFAULT_AUTH_URL,
-  ENV_TOKEN_KEY,
+  ENV_FILE_ENV,
   STANDS,
+  assertAuthorizationOrigin,
+  bindToken,
   c,
   getAnimsBase,
   getAnimsCacheDir,
@@ -58,8 +60,10 @@ import {
   getGenexDir,
   getGenexEnvPath,
   getTemplatesDir,
+  normalizeApiOrigin,
+  originKey,
   resolveAgentTargets
-} from "./chunk-5FA2WLM7.js";
+} from "./chunk-AQW7HUPV.js";
 
 // src/instrument.ts
 import * as Sentry from "@sentry/node";
@@ -169,32 +173,45 @@ import os2 from "os";
 import readline from "readline";
 import { spawn } from "child_process";
 import { URL as URL2 } from "url";
+import path2 from "path";
 
 // src/lib/pending-auth.ts
 import fs from "fs/promises";
 import path from "path";
-function pendingAuthPath() {
+function pendingAuthPath(apiUrl = getApiUrl(), envPath) {
+  return path.join(`${getGenexEnvPath(envPath)}.auth`, `${originKey(apiUrl)}.json`);
+}
+function legacyPath() {
   return path.join(getGenexDir(), "pending-auth.json");
 }
-async function readPendingAuth(apiUrl) {
+function defaultProfile(envPath) {
+  return !envPath && !process.env[ENV_FILE_ENV];
+}
+async function readRecord(file, apiUrl) {
   try {
-    const raw = JSON.parse(await fs.readFile(pendingAuthPath(), "utf8"));
-    if (!raw?.deviceCode || !raw.userCode || raw.apiUrl !== apiUrl) return null;
-    if (Date.now() >= raw.expiresAt) return null;
-    return raw;
+    const raw = JSON.parse(await fs.readFile(file, "utf8"));
+    if (!raw?.deviceCode || !raw.userCode || !raw.verifyUrl || normalizeApiOrigin(raw.apiUrl) !== normalizeApiOrigin(apiUrl) || !Number.isFinite(raw.expiresAt) || Date.now() >= raw.expiresAt) return null;
+    return { ...raw, apiUrl: normalizeApiOrigin(raw.apiUrl) };
   } catch {
     return null;
   }
 }
-async function writePendingAuth(pending) {
-  const file = pendingAuthPath();
-  await fs.mkdir(path.dirname(file), { recursive: true });
-  await fs.writeFile(file, JSON.stringify(pending, null, 2), { mode: 384 });
-  await restrictFilePermissions(file);
+async function readPendingAuth(apiUrl, envPath) {
+  const current = await readRecord(pendingAuthPath(apiUrl, envPath), apiUrl);
+  if (current) return current;
+  return defaultProfile(envPath) ? readRecord(legacyPath(), apiUrl) : null;
 }
-async function clearPendingAuth() {
-  await fs.rm(pendingAuthPath(), { force: true }).catch(() => {
+async function writePendingAuth(pending, envPath) {
+  const apiUrl = normalizeApiOrigin(pending.apiUrl);
+  await writeSecretFile(pendingAuthPath(apiUrl, envPath), JSON.stringify({ ...pending, apiUrl }) + "\n");
+}
+async function clearPendingAuth(apiUrl = getApiUrl(), envPath) {
+  await fs.rm(pendingAuthPath(apiUrl, envPath), { force: true }).catch(() => {
   });
+  if (defaultProfile(envPath) && await readRecord(legacyPath(), apiUrl)) {
+    await fs.rm(legacyPath(), { force: true }).catch(() => {
+    });
+  }
 }
 
 // src/lib/auth.ts
@@ -206,11 +223,15 @@ var AuthPendingError = class extends Error {
   // .ts sources directly by stripping types) forbids the shorthand.
   userCode;
   verifyUrl;
-  constructor(userCode, verifyUrl) {
+  apiUrl;
+  envPath;
+  constructor(userCode, verifyUrl, apiUrl, envPath) {
     super("Authorization is still pending.");
     this.name = "AuthPendingError";
     this.userCode = userCode;
     this.verifyUrl = verifyUrl;
+    this.apiUrl = apiUrl;
+    this.envPath = envPath;
   }
 };
 function formatUserCode(code) {
@@ -218,12 +239,13 @@ function formatUserCode(code) {
 }
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function authorize(apiBaseUrl, authBaseUrl, options) {
-  const { log, inlineWaitMs = DEFAULT_INLINE_WAIT_MS, open = openBrowser, label } = options;
-  const resumed = await readPendingAuth(apiBaseUrl);
+  apiBaseUrl = normalizeApiOrigin(apiBaseUrl);
+  const { log, inlineWaitMs = DEFAULT_INLINE_WAIT_MS, open = openBrowser, label, envPath } = options;
+  const resumed = await readPendingAuth(apiBaseUrl, options.envPath);
   if (resumed) {
     log.step("Picking up where the last sign-in left off\u2026");
     printCode(log, resumed.userCode, resumed.verifyUrl);
-    return await pollForToken(apiBaseUrl, resumed, { log, inlineWaitMs });
+    return await pollForToken(apiBaseUrl, resumed, { log, inlineWaitMs, envPath: options.envPath });
   }
   let started;
   try {
@@ -231,7 +253,7 @@ async function authorize(apiBaseUrl, authBaseUrl, options) {
   } catch (err) {
     if (err instanceof LegacyApiError) {
       log.dim("This Genex API doesn't support device sign-in yet \u2014 using the legacy browser flow.");
-      return await authorizeLoopback(authBaseUrl, { log, open, timeoutMs: inlineWaitMs });
+      return bindToken(await authorizeLoopback(authBaseUrl, { log, open, timeoutMs: inlineWaitMs }), apiBaseUrl);
     }
     throw err;
   }
@@ -242,7 +264,7 @@ async function authorize(apiBaseUrl, authBaseUrl, options) {
     expiresAt: Date.now() + started.expiresIn * 1e3,
     apiUrl: apiBaseUrl
   };
-  await writePendingAuth(pending);
+  await writePendingAuth(pending, envPath);
   printCode(log, started.userCode, started.verifyUrl);
   let warned = false;
   const warnManual = () => {
@@ -251,7 +273,7 @@ async function authorize(apiBaseUrl, authBaseUrl, options) {
     log.dim("  (couldn't open a browser here \u2014 open the link above yourself)");
   };
   if (!open(started.verifyUrl, warnManual)) warnManual();
-  return await pollForToken(apiBaseUrl, pending, { log, inlineWaitMs, interval: started.interval });
+  return await pollForToken(apiBaseUrl, pending, { log, inlineWaitMs, interval: started.interval, envPath });
 }
 var LegacyApiError = class extends Error {
 };
@@ -314,23 +336,28 @@ async function pollForToken(apiBaseUrl, pending, opts) {
       res = new Response(null, { status: 599 });
     }
     if (res.status === 410) {
-      await clearPendingAuth();
+      await clearPendingAuth(apiBaseUrl, opts.envPath);
       throw new Error("That sign-in code expired. Re-run this command for a fresh one.");
     }
     if (res.ok) {
       const body = await res.json().catch(() => null);
       if (body?.status === "approved" && body.token) {
-        await clearPendingAuth();
-        return body.token;
+        await clearPendingAuth(apiBaseUrl, opts.envPath);
+        return bindToken(body.token, apiBaseUrl);
       }
       if (body?.status === "denied") {
-        await clearPendingAuth();
+        await clearPendingAuth(apiBaseUrl, opts.envPath);
         throw new Error("Sign-in was cancelled in the browser. Re-run this command to try again.");
       }
       if (body?.interval) intervalMs = Math.max(body.interval * 1e3, MIN_POLL_INTERVAL_MS);
     }
     if (Date.now() + intervalMs > deadline) {
-      throw new AuthPendingError(pending.userCode, pending.verifyUrl);
+      throw new AuthPendingError(
+        pending.userCode,
+        pending.verifyUrl,
+        apiBaseUrl,
+        opts.envPath || process.env[ENV_FILE_ENV] ? getGenexEnvPath(opts.envPath) : void 0
+      );
     }
     if (Date.now() >= nextReassureAt) {
       log.dim("  still waiting for you to approve\u2026");
@@ -340,22 +367,24 @@ async function pollForToken(apiBaseUrl, pending, opts) {
   }
 }
 function printAuthHandoff(log, err) {
+  const quote2 = (value) => /^[A-Za-z0-9_./:@-]+$/.test(value) ? value : process.platform === "win32" ? "'" + value.replace(/'/g, "''") + "'" : "'" + value.replace(/'/g, "'\\''") + "'";
+  const command = "npx genex auth" + (err.apiUrl ? ` --api-url ${quote2(err.apiUrl)}` : "") + (err.envPath ? ` --env ${quote2(path2.resolve(err.envPath))}` : "");
   log.plain("");
   log.warn("Not approved yet \u2014 nothing is broken, the sign-in is still waiting for you.");
   log.plain(
     [
       `  ${c.cyan("\u2192")} Approve at ${c.cyan(err.verifyUrl)}  (code ${c.bold(formatUserCode(err.userCode))})`,
-      `  ${c.cyan("\u2192")} Then run ${c.cyan("npx genex auth")} \u2014 it picks up exactly where this left off.`,
+      `  ${c.cyan("\u2192")} Then run ${c.cyan(command)} \u2014 it picks up exactly where this left off.`,
       ""
     ].join("\n")
   );
 }
 async function resumeAuthorization(apiBaseUrl, options) {
-  const pending = await readPendingAuth(apiBaseUrl);
+  const pending = await readPendingAuth(apiBaseUrl, options.envPath);
   if (!pending) return null;
   const { log, inlineWaitMs = DEFAULT_INLINE_WAIT_MS } = options;
   printCode(log, pending.userCode, pending.verifyUrl);
-  return await pollForToken(apiBaseUrl, pending, { log, inlineWaitMs });
+  return await pollForToken(apiBaseUrl, pending, { log, inlineWaitMs, envPath: options.envPath });
 }
 var SUCCESS_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Genex</title>
 <style>body{font-family:system-ui,sans-serif;background:#0b0b0f;color:#eaeaea;display:grid;place-items:center;height:100vh;margin:0}
@@ -626,7 +655,7 @@ async function runAuth(opts) {
   const authUrl = getAuthUrl(opts.authUrl);
   const inlineWaitMs = opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0;
   if (!opts.force) {
-    const existing = await readUserToken(opts.envPath);
+    const existing = await readUserToken(opts.envPath, apiUrl);
     if (existing) {
       const email2 = await fetchSignedInEmail(apiUrl, existing);
       if (email2) {
@@ -639,8 +668,8 @@ async function runAuth(opts) {
   }
   let token;
   try {
-    token = await resumeAuthorization(apiUrl, { log, inlineWaitMs }) ?? "";
-    if (!token) token = await authorize(apiUrl, authUrl, { log, inlineWaitMs });
+    token = await resumeAuthorization(apiUrl, { log, inlineWaitMs, envPath: opts.envPath }) ?? "";
+    if (!token) token = await authorize(apiUrl, authUrl, { log, inlineWaitMs, envPath: opts.envPath });
   } catch (err) {
     if (err instanceof AuthPendingError) {
       printAuthHandoff(log, err);
@@ -650,7 +679,7 @@ async function runAuth(opts) {
     process.exitCode = 1;
     return;
   }
-  const { path: tokenPath } = await writeUserToken(token, opts.envPath);
+  const { path: tokenPath } = await writeUserToken(token, opts.envPath, apiUrl);
   log.success(`Connected. Saved your token to ${c.cyan(tokenPath)}.`);
   const email = await fetchSignedInEmail(apiUrl, token);
   if (email) log.plain(`  signed in as ${c.cyan(email)}`);
@@ -660,13 +689,13 @@ async function runAuth(opts) {
 
 // src/commands/remix.ts
 import fs18 from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 import crypto4 from "crypto";
 import { spawn as spawn4 } from "child_process";
 
 // src/lib/game-config.ts
 import fs2 from "fs/promises";
-import path2 from "path";
+import path3 from "path";
 var DEFAULT_DASHBOARD_ORIGIN = new URL(DEFAULT_AUTH_URL).origin;
 function renderGenexConfig(slug) {
   return `// src/genex.config.ts \u2014 written by \`genex init\`. DO NOT hardcode URLs here.
@@ -759,20 +788,20 @@ async function ensureEnvVar(file, key, value, log) {
   return true;
 }
 async function writeGameConfigFiles(meta, log, cwd = process.cwd()) {
-  await fs2.mkdir(path2.join(cwd, "src"), { recursive: true });
-  await writeIfAbsent(path2.join(cwd, "src", "genex.config.ts"), renderGenexConfig(meta.slug), log);
-  await writeIfAbsent(path2.join(cwd, ".env"), renderSlugEnv(meta.slug), log);
+  await fs2.mkdir(path3.join(cwd, "src"), { recursive: true });
+  await writeIfAbsent(path3.join(cwd, "src", "genex.config.ts"), renderGenexConfig(meta.slug), log);
+  await writeIfAbsent(path3.join(cwd, ".env"), renderSlugEnv(meta.slug), log);
   const overrides = renderDevOverrides(meta);
   if (overrides) {
-    await writeIfAbsent(path2.join(cwd, ".env.development.local"), overrides, log);
+    await writeIfAbsent(path3.join(cwd, ".env.development.local"), overrides, log);
   }
 }
 
 // src/lib/ssh.ts
 import fs3 from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 async function writeGitignore(dir, log) {
-  const file = path3.join(dir, ".gitignore");
+  const file = path4.join(dir, ".gitignore");
   let content = "";
   try {
     content = await fs3.readFile(file, "utf8");
@@ -815,7 +844,7 @@ var LFS_PATTERNS = [
   "*.webm"
 ];
 async function writeGitattributes(dir, log) {
-  const file = path3.join(dir, ".gitattributes");
+  const file = path4.join(dir, ".gitattributes");
   let content = "";
   try {
     content = await fs3.readFile(file, "utf8");
@@ -834,12 +863,12 @@ async function writeGitattributes(dir, log) {
 
 // src/lib/remix-profile.ts
 import fs8 from "fs/promises";
-import path8 from "path";
+import path9 from "path";
 
 // src/lib/agents-contract.ts
 import fs4 from "fs/promises";
 import os3 from "os";
-import path4 from "path";
+import path5 from "path";
 var CONTRACT_BEGIN = "<!-- genex:contract:begin (managed by genex \u2014 edits inside this block are overwritten on sync) -->";
 var CONTRACT_END = "<!-- genex:contract:end -->";
 var GENEX_CONTRACT_BLOCK = `${CONTRACT_BEGIN}
@@ -933,7 +962,7 @@ ${block}
 async function writeAgentsContract(projectDir, contractBlock = GENEX_CONTRACT_BLOCK) {
   let changed = false;
   try {
-    const agentsPath = path4.join(projectDir, "AGENTS.md");
+    const agentsPath = path5.join(projectDir, "AGENTS.md");
     let existing = null;
     try {
       existing = await fs4.readFile(agentsPath, "utf8");
@@ -945,7 +974,7 @@ async function writeAgentsContract(projectDir, contractBlock = GENEX_CONTRACT_BL
       await fs4.writeFile(agentsPath, next, "utf8");
       changed = true;
     }
-    const claudePath = path4.join(projectDir, "CLAUDE.md");
+    const claudePath = path5.join(projectDir, "CLAUDE.md");
     let claude = null;
     try {
       claude = await fs4.readFile(claudePath, "utf8");
@@ -972,21 +1001,21 @@ async function writeToolsContract(projectDir, opts = {}) {
 }
 async function healAncestorContracts(projectDir, stopDir = os3.homedir()) {
   const findings = [];
-  const stop = path4.resolve(stopDir);
-  let dir = path4.dirname(path4.resolve(projectDir));
+  const stop = path5.resolve(stopDir);
+  let dir = path5.dirname(path5.resolve(projectDir));
   for (let depth = 0; depth < 20; depth++) {
     try {
       let isWorkspace = false;
       for (const marker of ["project.json", "workspace.json"]) {
         try {
-          await fs4.access(path4.join(dir, ".genex", marker));
+          await fs4.access(path5.join(dir, ".genex", marker));
           isWorkspace = true;
           break;
         } catch {
         }
       }
       if (!isWorkspace) {
-        const agentsPath = path4.join(dir, "AGENTS.md");
+        const agentsPath = path5.join(dir, "AGENTS.md");
         let content = null;
         try {
           content = await fs4.readFile(agentsPath, "utf8");
@@ -1000,7 +1029,7 @@ async function healAncestorContracts(projectDir, stopDir = os3.homedir()) {
           if (remainder.trim() === "") {
             await fs4.unlink(agentsPath);
             try {
-              const claudePath = path4.join(dir, "CLAUDE.md");
+              const claudePath = path5.join(dir, "CLAUDE.md");
               if ((await fs4.readFile(claudePath, "utf8")).trim() === CLAUDE_IMPORT_LINE) {
                 await fs4.unlink(claudePath);
               }
@@ -1015,7 +1044,7 @@ async function healAncestorContracts(projectDir, stopDir = os3.homedir()) {
     } catch {
     }
     if (dir === stop) break;
-    const parent = path4.dirname(dir);
+    const parent = path5.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1024,7 +1053,7 @@ async function healAncestorContracts(projectDir, stopDir = os3.homedir()) {
 async function healAncestorContractsAndReport(log, projectDir) {
   try {
     for (const f of await healAncestorContracts(projectDir)) {
-      const file = path4.join(f.dir, "AGENTS.md");
+      const file = path5.join(f.dir, "AGENTS.md");
       if (f.removed) {
         log.plain(
           `\u{1F9F9} Removed a stray genex build contract from ${file} \u2014 it belongs in each game's folder, and a stale copy above the project misleads agents.`
@@ -1041,9 +1070,9 @@ async function healAncestorContractsAndReport(log, projectDir) {
 
 // src/lib/copy-templates.ts
 import fs5 from "fs/promises";
-import path5 from "path";
+import path6 from "path";
 function isGenexManaged(rel) {
-  return rel.split(path5.sep).some((seg) => seg.startsWith("genex"));
+  return rel.split(path6.sep).some((seg) => seg.startsWith("genex"));
 }
 async function copyTemplates(srcDir, destDir, opts = {}) {
   const result = { copied: [], updated: [], skipped: [] };
@@ -1053,9 +1082,9 @@ async function copyTemplates(srcDir, destDir, opts = {}) {
 async function walk(rootSrc, src, dest, opts, result) {
   const entries = await fs5.readdir(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path5.join(src, entry.name);
-    const destPath = path5.join(dest, entry.name);
-    const rel = path5.relative(rootSrc, srcPath);
+    const srcPath = path6.join(src, entry.name);
+    const destPath = path6.join(dest, entry.name);
+    const rel = path6.relative(rootSrc, srcPath);
     if (opts.exclude?.includes(rel)) continue;
     if (opts.filter && !opts.filter(rel)) continue;
     if (entry.isDirectory()) {
@@ -1072,7 +1101,7 @@ async function walk(rootSrc, src, dest, opts, result) {
       result.skipped.push(rel);
       continue;
     }
-    await fs5.mkdir(path5.dirname(destPath), { recursive: true });
+    await fs5.mkdir(path6.dirname(destPath), { recursive: true });
     await fs5.copyFile(srcPath, destPath);
     result.copied.push(rel);
     if (present) result.updated.push(rel);
@@ -1090,11 +1119,11 @@ async function exists(p) {
 // src/lib/updates.ts
 import fs7 from "fs/promises";
 import os4 from "os";
-import path7 from "path";
+import path8 from "path";
 
 // src/lib/workspace.ts
 import fs6 from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 async function resolveWorkspace(cwd = process.cwd()) {
   const project = await readProject(cwd);
   const slug = project && typeof project.slug === "string" && project.slug.trim() ? project.slug.trim() : null;
@@ -1148,7 +1177,7 @@ function reportPlatformRefused(log, command) {
 }
 async function hasRemixProfile(cwd = process.cwd()) {
   try {
-    const pkg = JSON.parse(await fs6.readFile(path6.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(await fs6.readFile(path7.join(cwd, "package.json"), "utf8"));
     return pkg.genex?.agentProfile === "remix";
   } catch {
     return false;
@@ -1173,7 +1202,7 @@ function isNewerVersion(a, b) {
 var SKILLS_VERSION_MARKER = "genex-skills-version.json";
 async function readSkillsMarker(skillsDir) {
   try {
-    const raw = await fs7.readFile(path7.join(skillsDir, SKILLS_VERSION_MARKER), "utf8");
+    const raw = await fs7.readFile(path8.join(skillsDir, SKILLS_VERSION_MARKER), "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed.version === "string" ? parsed.version : null;
   } catch {
@@ -1183,7 +1212,7 @@ async function readSkillsMarker(skillsDir) {
 async function writeSkillsMarker(skillsDir, version = getCliVersion()) {
   await fs7.mkdir(skillsDir, { recursive: true });
   await fs7.writeFile(
-    path7.join(skillsDir, SKILLS_VERSION_MARKER),
+    path8.join(skillsDir, SKILLS_VERSION_MARKER),
     JSON.stringify({ version, syncedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n"
   );
 }
@@ -1259,7 +1288,7 @@ var REMOVED_SKILLS = [
 async function pruneRemovedSkills(skillsDir, log) {
   const removed = [];
   for (const name of REMOVED_SKILLS) {
-    const target = path7.join(skillsDir, name);
+    const target = path8.join(skillsDir, name);
     try {
       await fs7.access(target);
     } catch {
@@ -1279,11 +1308,11 @@ async function pruneRemovedSkills(skillsDir, log) {
   return removed.length > 0;
 }
 async function syncSkillsForTarget(target, templatesDir = getTemplatesDir(), version = getCliVersion(), log, family = "game", hosted = false) {
-  const skillsDir = path7.join(target.baseDir, "skills");
+  const skillsDir = path8.join(target.baseDir, "skills");
   if (!await hasGenexSkills(skillsDir)) return false;
   if (family === "remix") await pruneRemixWorkflow(target.baseDir);
   if (await readSkillsMarker(skillsDir) === version) return false;
-  const src = target.full ? templatesDir : path7.join(templatesDir, "skills");
+  const src = target.full ? templatesDir : path8.join(templatesDir, "skills");
   const dest = target.full ? target.baseDir : skillsDir;
   const familyFilter = skillFamilyFilter(family, { hosted });
   const filter = target.full ? familyFilter : (rel) => familyFilter(`skills/${rel}`);
@@ -1299,13 +1328,13 @@ async function cleanupLegacyGlobalSkills(log) {
   try {
     const home = os4.homedir();
     const [realCwd, realHome] = await Promise.all([
-      fs7.realpath(process.cwd()).catch(() => path7.resolve(process.cwd())),
-      fs7.realpath(home).catch(() => path7.resolve(home))
+      fs7.realpath(process.cwd()).catch(() => path8.resolve(process.cwd())),
+      fs7.realpath(home).catch(() => path8.resolve(home))
     ]);
     if (realCwd === realHome) return false;
     let removed = false;
     for (const dirName of [".claude", ".codex", ".cursor"]) {
-      const skillsDir = path7.join(home, dirName, "skills");
+      const skillsDir = path8.join(home, dirName, "skills");
       let entries = [];
       try {
         entries = await fs7.readdir(skillsDir);
@@ -1315,18 +1344,18 @@ async function cleanupLegacyGlobalSkills(log) {
       for (const name of entries) {
         if (!name.startsWith("genex-")) continue;
         try {
-          await fs7.rm(path7.join(skillsDir, name), { recursive: true });
+          await fs7.rm(path8.join(skillsDir, name), { recursive: true });
           removed = true;
         } catch {
         }
       }
     }
     for (const rel of [
-      path7.join("agents", "genex-helper.md"),
-      path7.join("commands", "genex-status.md")
+      path8.join("agents", "genex-helper.md"),
+      path8.join("commands", "genex-status.md")
     ]) {
       try {
-        await fs7.rm(path7.join(home, ".claude", rel));
+        await fs7.rm(path8.join(home, ".claude", rel));
         removed = true;
       } catch {
       }
@@ -1387,7 +1416,7 @@ var PUBLISHED_PACKAGES = [
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var REGISTRY_TIMEOUT_MS = 1500;
 function getUpdateCachePath() {
-  return path7.join(getGenexDir(), "update-check.json");
+  return path8.join(getGenexDir(), "update-check.json");
 }
 function isCacheFresh(cache, nowMs) {
   const at = Date.parse(cache.checkedAt);
@@ -1449,7 +1478,7 @@ function startUpdateCheck() {
 }
 async function installedPackageVersion(cwd, name) {
   try {
-    const raw = await fs7.readFile(path7.join(cwd, "node_modules", name, "package.json"), "utf8");
+    const raw = await fs7.readFile(path8.join(cwd, "node_modules", name, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
@@ -1496,23 +1525,23 @@ async function recordNotified(cache, announced, cachePath) {
       notified: { ...cache.notified ?? {}, ...announced },
       notifiedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    await fs7.mkdir(path7.dirname(cachePath), { recursive: true });
+    await fs7.mkdir(path8.dirname(cachePath), { recursive: true });
     await fs7.writeFile(cachePath, JSON.stringify(next, null, 2) + "\n");
   } catch {
   }
 }
 async function pruneRemixWorkflow(baseDir) {
   for (const name of REMIX_EXCLUDED_SKILLS) {
-    await fs7.rm(path7.join(baseDir, "skills", name), { recursive: true, force: true });
+    await fs7.rm(path8.join(baseDir, "skills", name), { recursive: true, force: true });
   }
   for (const rel of ["agents/genex-helper.md", "commands/genex-status.md"]) {
-    await fs7.rm(path7.join(baseDir, rel), { force: true });
+    await fs7.rm(path8.join(baseDir, rel), { force: true });
   }
 }
 
 // src/lib/remix-profile.ts
 async function persistRemixProfile(cwd, apiUrl) {
-  const file = path8.join(cwd, "package.json");
+  const file = path9.join(cwd, "package.json");
   let pkg = {};
   try {
     pkg = JSON.parse(await fs8.readFile(file, "utf8"));
@@ -1526,25 +1555,25 @@ async function persistRemixProfile(cwd, apiUrl) {
 }
 async function installRemixProfile(cwd, apiUrl, log) {
   await persistRemixProfile(cwd, apiUrl);
-  if (path8.resolve(cwd) !== path8.resolve(process.cwd())) throw new Error("Remix profile must be installed from its workspace.");
+  if (path9.resolve(cwd) !== path9.resolve(process.cwd())) throw new Error("Remix profile must be installed from its workspace.");
   const family = skillFamilyFilter("remix");
   for (const target of resolveAgentTargets()) {
-    const src = target.full ? getTemplatesDir() : path8.join(getTemplatesDir(), "skills");
-    const dest = target.full ? target.baseDir : path8.join(target.baseDir, "skills");
+    const src = target.full ? getTemplatesDir() : path9.join(getTemplatesDir(), "skills");
+    const dest = target.full ? target.baseDir : path9.join(target.baseDir, "skills");
     await pruneRemixWorkflow(target.baseDir);
     await copyTemplates(src, dest, {
       exclude: ["controllers", "motion", "asset-viewer", "blender-service"],
       filter: target.full ? family : (rel) => family(`skills/${rel}`)
     });
-    await pruneRemovedSkills(path8.join(target.baseDir, "skills"), log);
-    await writeSkillsMarker(path8.join(target.baseDir, "skills"));
+    await pruneRemovedSkills(path9.join(target.baseDir, "skills"), log);
+    await writeSkillsMarker(path9.join(target.baseDir, "skills"));
   }
   await writeRemixContract(cwd);
 }
 
 // src/lib/local-install.ts
 import fs9 from "fs/promises";
-import path9 from "path";
+import path10 from "path";
 import { spawn as spawn2 } from "child_process";
 var CLI_PACKAGE = "@genex-ai/cli-demo";
 var FULL_NAME_FALLBACK = `npx ${CLI_PACKAGE}@${CLI_CHANNEL}`;
@@ -1564,10 +1593,10 @@ async function exists2(p) {
   }
 }
 async function detectPackageManager(cwd, opts = {}) {
-  let dir = path9.resolve(cwd);
+  let dir = path10.resolve(cwd);
   for (; ; ) {
     try {
-      const raw = await fs9.readFile(path9.join(dir, "package.json"), "utf8");
+      const raw = await fs9.readFile(path10.join(dir, "package.json"), "utf8");
       const pm = JSON.parse(raw).packageManager;
       if (typeof pm === "string") {
         const name = pm.split("@")[0];
@@ -1576,18 +1605,18 @@ async function detectPackageManager(cwd, opts = {}) {
     } catch {
     }
     for (const [file, pm] of LOCKFILES) {
-      if (await exists2(path9.join(dir, file))) return pm;
+      if (await exists2(path10.join(dir, file))) return pm;
     }
-    const parent = path9.dirname(dir);
+    const parent = path10.dirname(dir);
     if (opts.walkParents === false || parent === dir) return "npm";
     dir = parent;
   }
 }
 async function findLocalCli(cwd) {
-  let dir = path9.resolve(cwd);
+  let dir = path10.resolve(cwd);
   for (; ; ) {
-    if (await exists2(path9.join(dir, "node_modules", CLI_PACKAGE, "package.json"))) return dir;
-    const parent = path9.dirname(dir);
+    if (await exists2(path10.join(dir, "node_modules", CLI_PACKAGE, "package.json"))) return dir;
+    const parent = path10.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -1605,7 +1634,7 @@ function installArgs(pm, spec) {
   }
 }
 function manifestName(cwd) {
-  const slug = path9.basename(path9.resolve(cwd)).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 100);
+  const slug = path10.basename(path10.resolve(cwd)).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 100);
   return slug || "genex-tools-workspace";
 }
 function isSourceRun(moduleUrl = import.meta.url) {
@@ -1663,10 +1692,10 @@ async function ensureLocalCli(log, cwd = process.cwd(), opts = {}) {
     return;
   }
   const pm = await detectPackageManager(cwd);
-  const hadManifest = await exists2(path9.join(cwd, "package.json"));
+  const hadManifest = await exists2(path10.join(cwd, "package.json"));
   if (!hadManifest) {
     await fs9.writeFile(
-      path9.join(cwd, "package.json"),
+      path10.join(cwd, "package.json"),
       JSON.stringify({ name: manifestName(cwd), private: true }, null, 2) + "\n"
     );
     await ensureIgnored(cwd, "node_modules/");
@@ -1686,7 +1715,7 @@ async function ensureLocalCli(log, cwd = process.cwd(), opts = {}) {
   }
 }
 async function ensureIgnored(dir, entry) {
-  const file = path9.join(dir, ".gitignore");
+  const file = path10.join(dir, ".gitignore");
   let content = "";
   try {
     content = await fs9.readFile(file, "utf8");
@@ -1700,7 +1729,7 @@ async function ensureIgnored(dir, entry) {
 
 // src/lib/remix-archive.ts
 import fs10 from "fs/promises";
-import path10 from "path";
+import path11 from "path";
 var MAX_SOURCE_ARCHIVE_BYTES = 2 * 1024 * 1024 * 1024;
 var MAX_ENTRIES = 12e3;
 var CHUNK_BYTES = 64 * 1024;
@@ -1850,8 +1879,8 @@ async function extractSourceArchive(file, dest, rootFolder) {
       if (crc !== e.crc) badArchive("Source archive checksum mismatch. Retry the same remix command.");
       if (e.symlink) {
         const target = linkTargets.get(e.name) ?? "";
-        if (!target || target.includes("\\") || target.includes("\0") || path10.posix.isAbsolute(target) || target.includes(":")) badArchive("Source archive link points outside the source.");
-        const resolved = path10.posix.normalize(path10.posix.join(path10.posix.dirname(e.name), target));
+        if (!target || target.includes("\\") || target.includes("\0") || path11.posix.isAbsolute(target) || target.includes(":")) badArchive("Source archive link points outside the source.");
+        const resolved = path11.posix.normalize(path11.posix.join(path11.posix.dirname(e.name), target));
         if (resolved === ".." || resolved.startsWith("../") || excludedSourcePath(resolved) || !entries.some((f) => f.name === resolved && !f.symlink || f.name.startsWith(resolved + "/"))) badArchive("Source archive link has an unsafe or missing target.");
       }
     }
@@ -1861,12 +1890,12 @@ async function extractSourceArchive(file, dest, rootFolder) {
         excluded.push(e.name);
         continue;
       }
-      const target = path10.join(dest, e.name);
+      const target = path11.join(dest, e.name);
       if (e.dir) {
         await fs10.mkdir(target, { recursive: true });
         continue;
       }
-      await fs10.mkdir(path10.dirname(target), { recursive: true });
+      await fs10.mkdir(path11.dirname(target), { recursive: true });
       const output = await fs10.open(target, "wx", e.mode & 73 ? 493 : 420);
       try {
         for (let offset = 0; offset < e.size; offset += CHUNK_BYTES) await output.writeFile(await readAt(handle, e.dataOffset + offset, Math.min(CHUNK_BYTES, e.size - offset)));
@@ -1880,8 +1909,8 @@ async function extractSourceArchive(file, dest, rootFolder) {
         excluded.push(e.name);
         continue;
       }
-      await fs10.mkdir(path10.dirname(path10.join(dest, e.name)), { recursive: true });
-      await fs10.symlink(linkTargets.get(e.name), path10.join(dest, e.name));
+      await fs10.mkdir(path11.dirname(path11.join(dest, e.name)), { recursive: true });
+      await fs10.symlink(linkTargets.get(e.name), path11.join(dest, e.name));
       files.push(e.name);
     }
     return { files, excluded };
@@ -1895,8 +1924,8 @@ import "child_process";
 
 // src/lib/generation-ledger.ts
 import fs11 from "fs/promises";
-import path11 from "path";
-var ledgerPath = (cwd) => path11.join(cwd, ".genex", "generations.ndjson");
+import path12 from "path";
+var ledgerPath = (cwd) => path12.join(cwd, ".genex", "generations.ndjson");
 async function appendAdmissionRow(cwd, event) {
   const file = await fs11.open(ledgerPath(cwd), "a");
   try {
@@ -1923,7 +1952,7 @@ async function readAdmissionRows(cwd) {
 }
 async function append(cwd, event) {
   try {
-    await fs11.access(path11.join(cwd, ".genex"));
+    await fs11.access(path12.join(cwd, ".genex"));
     await fs11.appendFile(ledgerPath(cwd), `${JSON.stringify(event)}
 `, "utf8");
   } catch {
@@ -2013,11 +2042,11 @@ async function countOutcomes(kind, cwd = process.cwd()) {
 
 // src/lib/detect-features.ts
 import fs13 from "fs/promises";
-import path13 from "path";
+import path14 from "path";
 
 // src/lib/download-assets.ts
 import fs12 from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 var RUNG_ROLE = /@\d+$/;
 function isPrimaryRole(role) {
   return !RUNG_ROLE.test(role);
@@ -2050,7 +2079,7 @@ async function downloadAssets(files, opts) {
   }
   const multi = wanted.length > 1;
   for (const file of wanted) {
-    const dest = path12.join(opts.outDir, localAssetName(opts.kind, opts.prompt, opts.id, file, multi));
+    const dest = path13.join(opts.outDir, localAssetName(opts.kind, opts.prompt, opts.id, file, multi));
     try {
       const res = await fetch(file.url);
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
@@ -2080,7 +2109,7 @@ async function undeliveredFiles(files, opts) {
   const multi = wanted.length > 1;
   const missing = [];
   for (const file of wanted) {
-    const dest = path12.join(opts.outDir, localAssetName(opts.kind, opts.prompt, opts.id, file, multi));
+    const dest = path13.join(opts.outDir, localAssetName(opts.kind, opts.prompt, opts.id, file, multi));
     try {
       await fs12.access(dest);
     } catch {
@@ -2093,7 +2122,7 @@ async function undeliveredFiles(files, opts) {
 // src/lib/detect-features.ts
 async function detectEmbedSdkVersion(cwd = process.cwd()) {
   try {
-    const raw = await fs13.readFile(path13.join(cwd, "package.json"), "utf8");
+    const raw = await fs13.readFile(path14.join(cwd, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     const version = pkg.dependencies?.["@genex-ai/embed-sdk"] ?? pkg.devDependencies?.["@genex-ai/embed-sdk"];
     return typeof version === "string" && version ? version : null;
@@ -2103,7 +2132,7 @@ async function detectEmbedSdkVersion(cwd = process.cwd()) {
 }
 async function detectMultiplayer(cwd = process.cwd()) {
   try {
-    const raw = await fs13.readFile(path13.join(cwd, "package.json"), "utf8");
+    const raw = await fs13.readFile(path14.join(cwd, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     return Boolean(
       pkg.dependencies?.["@genex-ai/multiplayer"] ?? pkg.devDependencies?.["@genex-ai/multiplayer"]
@@ -2115,7 +2144,7 @@ async function detectMultiplayer(cwd = process.cwd()) {
 async function detectMatchmaking(log, cwd = process.cwd()) {
   let pkg;
   try {
-    pkg = JSON.parse(await fs13.readFile(path13.join(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(await fs13.readFile(path14.join(cwd, "package.json"), "utf8"));
   } catch (err) {
     log.dim(`  (skipping matchmaking \u2014 couldn't read package.json: ${String(err)})`);
     return null;
@@ -2133,12 +2162,12 @@ async function detectMatchmaking(log, cwd = process.cwd()) {
 var TOUCH_KIT_MARKERS = /controllers\/touch\/|controllers\/character\/touch-joystick|TouchJoystick|VirtualButton|DragZone|RotateOverlay/;
 async function detectMobileControls(cwd = process.cwd()) {
   try {
-    const raw = await fs13.readFile(path13.join(cwd, "package.json"), "utf8");
+    const raw = await fs13.readFile(path14.join(cwd, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     if (pkg.genex?.mobileControls === true) return true;
   } catch {
   }
-  const srcDir = path13.join(cwd, "src");
+  const srcDir = path14.join(cwd, "src");
   let entries;
   try {
     entries = await fs13.readdir(srcDir, { recursive: true });
@@ -2149,7 +2178,7 @@ async function detectMobileControls(cwd = process.cwd()) {
     if (rel.includes("node_modules")) continue;
     if (!/\.(ts|js|mts|mjs|tsx|jsx)$/.test(rel)) continue;
     try {
-      const content = await fs13.readFile(path13.join(srcDir, rel), "utf8");
+      const content = await fs13.readFile(path14.join(srcDir, rel), "utf8");
       if (TOUCH_KIT_MARKERS.test(content)) return true;
     } catch {
     }
@@ -2158,7 +2187,7 @@ async function detectMobileControls(cwd = process.cwd()) {
 }
 var GAME_STATE_CALLS = /savePlayerState|saveWorldState|submitScore/;
 async function detectGameStateUsage(cwd = process.cwd()) {
-  const srcDir = path13.join(cwd, "src");
+  const srcDir = path14.join(cwd, "src");
   let entries;
   try {
     entries = await fs13.readdir(srcDir, { recursive: true });
@@ -2169,7 +2198,7 @@ async function detectGameStateUsage(cwd = process.cwd()) {
     if (rel.includes("node_modules")) continue;
     if (!/\.(ts|js|mts|mjs|tsx|jsx)$/.test(rel)) continue;
     try {
-      const content = await fs13.readFile(path13.join(srcDir, rel), "utf8");
+      const content = await fs13.readFile(path14.join(srcDir, rel), "utf8");
       if (GAME_STATE_CALLS.test(content)) return true;
     } catch {
     }
@@ -2219,7 +2248,7 @@ var LOOP_START = /\b(?:requestAnimationFrame|setAnimationLoop)\s*\((?!\s*null\b)
 var INIT_EMBED_CALL = /\binitEmbed\s*\(/;
 async function detectEmbedBoot(cwd = process.cwd()) {
   const found = { awaitsIdentity: [], callsInitEmbed: false, rendererAfterAwait: [], loopAfterAwait: [] };
-  const srcDir = path13.join(cwd, "src");
+  const srcDir = path14.join(cwd, "src");
   let entries;
   try {
     entries = await fs13.readdir(srcDir, { recursive: true });
@@ -2228,11 +2257,11 @@ async function detectEmbedBoot(cwd = process.cwd()) {
   }
   for (const nativeRel of entries) {
     if (nativeRel.includes("node_modules")) continue;
-    if (nativeRel.split(path13.sep)[0] === "controllers") continue;
+    if (nativeRel.split(path14.sep)[0] === "controllers") continue;
     if (!/\.(ts|js|mts|mjs|tsx|jsx)$/.test(nativeRel)) continue;
-    const raw = await fs13.readFile(path13.join(srcDir, nativeRel), "utf8").catch(() => "");
+    const raw = await fs13.readFile(path14.join(srcDir, nativeRel), "utf8").catch(() => "");
     if (!raw) continue;
-    const rel = nativeRel.split(path13.sep).join("/");
+    const rel = nativeRel.split(path14.sep).join("/");
     const content = blankComments(raw);
     if (INIT_EMBED_CALL.test(content)) found.callsInitEmbed = true;
     const awaits = [];
@@ -2327,7 +2356,7 @@ async function detectSurfaceScan(cwd = process.cwd()) {
     deferredAudioContext: [],
     usesThree: false
   };
-  const srcDir = path13.join(cwd, "src");
+  const srcDir = path14.join(cwd, "src");
   let entries;
   try {
     entries = await fs13.readdir(srcDir, { recursive: true });
@@ -2337,9 +2366,9 @@ async function detectSurfaceScan(cwd = process.cwd()) {
   for (const nativeRel of entries) {
     if (nativeRel.includes("node_modules")) continue;
     if (!/\.(ts|js|mts|mjs|tsx|jsx)$/.test(nativeRel)) continue;
-    const raw = await fs13.readFile(path13.join(srcDir, nativeRel), "utf8").catch(() => "");
+    const raw = await fs13.readFile(path14.join(srcDir, nativeRel), "utf8").catch(() => "");
     if (!raw) continue;
-    const rel = nativeRel.split(path13.sep).join("/");
+    const rel = nativeRel.split(path14.sep).join("/");
     const content = blankComments(raw);
     const repeatRe = /\.repeat\.set\(\s*(-?\d+(?:\.\d+)?)\s*,\s*(-?\d+(?:\.\d+)?)\s*\)/g;
     let m;
@@ -2432,7 +2461,7 @@ async function detectGenerationAudit(cwd = process.cwd()) {
   const read = async (file) => {
     try {
       const raw = await fs13.readFile(file, "utf8");
-      const ext = path13.extname(file).toLowerCase();
+      const ext = path14.extname(file).toLowerCase();
       if (ext === ".txt") return;
       haystack += ext === ".ts" || ext === ".tsx" || ext === ".js" || ext === ".jsx" || ext === ".css" ? blankComments(raw) : ext === ".html" ? raw.replace(/<!--[\s\S]*?-->/g, (m) => m.replace(/[^\n]/g, " ")) : raw;
     } catch {
@@ -2441,18 +2470,18 @@ async function detectGenerationAudit(cwd = process.cwd()) {
   try {
     for (const entry of await fs13.readdir(cwd, { withFileTypes: true })) {
       if (entry.isFile() && /\.(ts|tsx|js|jsx|css|html|json)$/.test(entry.name)) {
-        await read(path13.join(cwd, entry.name));
+        await read(path14.join(cwd, entry.name));
       }
     }
   } catch {
   }
   for (const sub of ["src", "public"]) {
     try {
-      const entries = await fs13.readdir(path13.join(cwd, sub), { recursive: true });
+      const entries = await fs13.readdir(path14.join(cwd, sub), { recursive: true });
       for (const rel of entries) {
         if (rel.includes("node_modules")) continue;
         if (!/\.(ts|tsx|js|jsx|css|html|json|txt)$/.test(rel)) continue;
-        await read(path13.join(cwd, sub, rel));
+        await read(path14.join(cwd, sub, rel));
       }
     } catch {
     }
@@ -2623,7 +2652,7 @@ async function borrowEvidence(meta, cwd) {
   } catch {
     return true;
   }
-  const gitConfig = await fs13.readFile(path13.join(cwd, ".git", "config"), "utf8").catch(() => "");
+  const gitConfig = await fs13.readFile(path14.join(cwd, ".git", "config"), "utf8").catch(() => "");
   for (const m of gitConfig.matchAll(/url\s*=\s*(\S+)/g)) {
     try {
       const u = new URL(m[1]);
@@ -2631,7 +2660,7 @@ async function borrowEvidence(meta, cwd) {
     } catch {
     }
   }
-  const readme = await fs13.readFile(path13.join(cwd, "README.md"), "utf8").catch(() => "");
+  const readme = await fs13.readFile(path14.join(cwd, "README.md"), "utf8").catch(() => "");
   return readme.includes(host) || /\b(upstream|originally by|ported from|borrowed from)\b/i.test(readme);
 }
 
@@ -2816,11 +2845,11 @@ function auditGenerationPlan(input) {
 import crypto2 from "crypto";
 import fs17 from "fs/promises";
 import os5 from "os";
-import path16 from "path";
+import path17 from "path";
 
 // src/lib/source-size.ts
 import fs14 from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 var FALLBACK_SOURCE_LIMITS = {
   maxTotalBytes: 2 * 1024 * 1024 * 1024,
   maxFiles: 5e3
@@ -2862,7 +2891,7 @@ async function measurePayload(cwd, staged) {
   for (const file of staged) {
     let size = 0;
     try {
-      size = (await fs14.stat(path14.join(cwd, file))).size;
+      size = (await fs14.stat(path15.join(cwd, file))).size;
     } catch {
       size = 0;
     }
@@ -3135,7 +3164,7 @@ function tierFor(estVramMb) {
 
 // src/commands/ui.ts
 import fs16 from "fs/promises";
-import path15 from "path";
+import path16 from "path";
 import { PNG as PNG2 } from "pngjs";
 
 // src/lib/png-tools.ts
@@ -3684,7 +3713,7 @@ async function uiExtract(opts, log) {
         rimPixels: speckle.sampled
       });
     }
-    const outPath = path15.join(outDir, `${name}.png`);
+    const outPath = path16.join(outDir, `${name}.png`);
     await writePng(outPath, out);
     const sidecar = {
       name,
@@ -3712,7 +3741,7 @@ async function uiExtract(opts, log) {
       `${name}.png  ${cropW}x${cropH} (ar ${sidecar.aspectRatio}) at sheet ${padX0},${padY0}`
     );
   }
-  const debugPath = path15.join(outDir, "extract-debug.json");
+  const debugPath = path16.join(outDir, "extract-debug.json");
   await fs16.writeFile(
     debugPath,
     JSON.stringify(
@@ -4228,11 +4257,11 @@ async function uiMasks(opts, log) {
       });
     }
     const overlay = makeOverlay(clean2, converted.png);
-    const framePath = path15.join(outDir, `${pair.name}-frame.png`);
-    const maskPath = path15.join(outDir, `${pair.name}-mask.png`);
-    const annotatedPath = path15.join(outDir, `${pair.name}-annotated-source.png`);
-    const overlayPath = path15.join(outDir, `${pair.name}-overlay.png`);
-    const metaPath = path15.join(outDir, `${pair.name}.annotated-progress.json`);
+    const framePath = path16.join(outDir, `${pair.name}-frame.png`);
+    const maskPath = path16.join(outDir, `${pair.name}-mask.png`);
+    const annotatedPath = path16.join(outDir, `${pair.name}-annotated-source.png`);
+    const overlayPath = path16.join(outDir, `${pair.name}-overlay.png`);
+    const metaPath = path16.join(outDir, `${pair.name}.annotated-progress.json`);
     await writePng(framePath, clean2);
     await writePng(maskPath, converted.png);
     await writePng(annotatedPath, annotated);
@@ -4295,7 +4324,7 @@ async function uiMasks(opts, log) {
       );
     }
   }
-  const indexPath = path15.join(outDir, "annotated-progress.json");
+  const indexPath = path16.join(outDir, "annotated-progress.json");
   await fs16.writeFile(indexPath, `${JSON.stringify({ input, loosened, pairs: results }, null, 2)}
 `);
   log.plain("");
@@ -4561,7 +4590,7 @@ async function uiPlate(opts, log) {
     fail("No interior found \u2014 the image is fully transparent (or erode ate everything). Check --in / lower --erode.");
   }
   await writePng(outPath, out);
-  const name = path15.basename(outPath);
+  const name = path16.basename(outPath);
   log.plain(c.bold("genex ui plate"));
   log.success(`${outPath}  ${W}x${H}, interior ${(count / (W * H) * 100).toFixed(1)}% (erode ${erode}px)`);
   log.dim("  Wire it as the plate's silhouette (same box as the frame <img>, plate UNDER the art):");
@@ -4732,7 +4761,7 @@ async function walkFiles(dir) {
   }
   for (const entry of entries) {
     if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
-    const p = path15.join(dir, entry.name);
+    const p = path16.join(dir, entry.name);
     if (entry.isDirectory()) out.push(...await walkFiles(p));
     else out.push(p);
   }
@@ -4741,7 +4770,7 @@ async function walkFiles(dir) {
 async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   const viewportFindings = [];
   try {
-    const indexHtml = await fs16.readFile(path15.join(cwd, "index.html"), "utf8");
+    const indexHtml = await fs16.readFile(path16.join(cwd, "index.html"), "utf8");
     if (!/<meta[^>]+name=["']viewport["']/i.test(indexHtml)) {
       viewportFindings.push({
         kind: "viewport-meta",
@@ -4755,7 +4784,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
     }
   } catch {
   }
-  const absAssets = path15.resolve(cwd, assetDir);
+  const absAssets = path16.resolve(cwd, assetDir);
   try {
     if (!(await fs16.stat(absAssets)).isDirectory()) {
       return viewportFindings.length > 0 ? viewportFindings : null;
@@ -4763,20 +4792,20 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   } catch {
     return viewportFindings.length > 0 ? viewportFindings : null;
   }
-  const srcFiles = (await walkFiles(path15.resolve(cwd, srcDir))).filter(
-    (p) => AUDIT_SRC_EXTS.has(path15.extname(p).toLowerCase())
+  const srcFiles = (await walkFiles(path16.resolve(cwd, srcDir))).filter(
+    (p) => AUDIT_SRC_EXTS.has(path16.extname(p).toLowerCase())
   );
   try {
     for (const name of await fs16.readdir(cwd)) {
-      const ext = path15.extname(name).toLowerCase();
-      if (ext === ".html" || ext === ".css") srcFiles.push(path15.join(cwd, name));
+      const ext = path16.extname(name).toLowerCase();
+      if (ext === ".html" || ext === ".css") srcFiles.push(path16.join(cwd, name));
     }
   } catch {
   }
   const sources = [];
   for (const p of srcFiles) {
     try {
-      sources.push({ rel: path15.relative(cwd, p), text: await fs16.readFile(p, "utf8") });
+      sources.push({ rel: path16.relative(cwd, p), text: await fs16.readFile(p, "utf8") });
     } catch {
     }
   }
@@ -4786,7 +4815,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   const metaByName = /* @__PURE__ */ new Map();
   const bboxByPng = /* @__PURE__ */ new Map();
   for (const p of assetFiles) {
-    const base = path15.basename(p);
+    const base = path16.basename(p);
     const metaMatch = /^(.+)\.annotated-progress\.json$/.exec(base);
     if (metaMatch) {
       try {
@@ -4810,7 +4839,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   for (const [name, meta] of metaByName) {
     if (!meta.cleanCrop || !referenced(`${name}-mask.png`)) continue;
     for (const p of assetFiles) {
-      const base = path15.basename(p);
+      const base = path16.basename(p);
       if (!base.toLowerCase().endsWith(".png")) continue;
       if (base !== `${name}.png` && !base.startsWith(`${name}-`)) continue;
       if (/-mask\.png$|-frame\.png$|-overlay\.png$|-annotated-source\.png$/.test(base)) continue;
@@ -4834,7 +4863,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   }
   const pngByBase = /* @__PURE__ */ new Map();
   for (const p of assetFiles) {
-    const base = path15.basename(p);
+    const base = path16.basename(p);
     if (base.toLowerCase().endsWith(".png")) pngByBase.set(base, p);
   }
   for (const [maskBase, maskPath] of pngByBase) {
@@ -4887,7 +4916,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   }
   const maskReported = /* @__PURE__ */ new Set();
   for (const p of assetFiles) {
-    const m = /^(.+)\.annotated-progress\.json$/.exec(path15.basename(p));
+    const m = /^(.+)\.annotated-progress\.json$/.exec(path16.basename(p));
     if (!m) continue;
     const maskBase = `${m[1]}-mask.png`;
     if (!referenced(maskBase)) {
@@ -4899,14 +4928,14 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
     }
   }
   for (const p of assetFiles) {
-    const base = path15.basename(p);
+    const base = path16.basename(p);
     if (!base.toLowerCase().endsWith(".png")) continue;
     if (/-annotated-source\.png$|-overlay\.png$/.test(base)) continue;
     if (maskReported.has(base)) continue;
     if (!referenced(base)) {
       findings.push({
         kind: "unwired-sprite",
-        message: `${path15.relative(cwd, p)} is on disk but never referenced in ${srcDir}/index.html/CSS \u2014 wire it, or record the one-line reason it was cut. (Computed-string references are invisible here \u2014 check.)`
+        message: `${path16.relative(cwd, p)} is on disk but never referenced in ${srcDir}/index.html/CSS \u2014 wire it, or record the one-line reason it was cut. (Computed-string references are invisible here \u2014 check.)`
       });
     }
   }
@@ -5021,7 +5050,7 @@ async function printUiAuditPreflight(log) {
 }
 async function printPipelineStatePreflight(log, cwd = process.cwd()) {
   try {
-    const design = await fs17.readFile(path16.join(cwd, "DESIGN.md"), "utf8").catch(() => "");
+    const design = await fs17.readFile(path17.join(cwd, "DESIGN.md"), "utf8").catch(() => "");
     const warnings = [];
     if (design.length > 0 && !/##\s*build plan & status/i.test(design)) {
       warnings.push(
@@ -5029,7 +5058,7 @@ async function printPipelineStatePreflight(log, cwd = process.cwd()) {
       );
     }
     if (!/player character:/i.test(design)) {
-      const hasCharacter = await fs17.access(path16.join(cwd, "public", "assets", "meshy-character.json")).then(() => true, () => false);
+      const hasCharacter = await fs17.access(path17.join(cwd, "public", "assets", "meshy-character.json")).then(() => true, () => false);
       if (!hasCharacter && await loadsPlayerBody(cwd)) {
         warnings.push(
           `Player character is the stock avatar \u2014 no generated character is wired. The game's own generated character is the player's body wherever a human body appears on screen, first-person included (genex-ai-character). Generate it, or record "Player character: VRM \u2014 <reason>" in DESIGN.md (no human body in this game / out of credits / player declined).`
@@ -5046,12 +5075,12 @@ async function printPipelineStatePreflight(log, cwd = process.cwd()) {
 async function loadsPlayerBody(cwd) {
   const BODY_LOADERS = /\bloadPlayerCharacter\s*\(|\bloadVrm(?:Clone)?\s*\(/;
   try {
-    const entries = await fs17.readdir(path16.join(cwd, "src"), { recursive: true });
+    const entries = await fs17.readdir(path17.join(cwd, "src"), { recursive: true });
     for (const rel of entries) {
       if (rel.includes("node_modules")) continue;
-      if (rel.split(path16.sep)[0] === "controllers" || rel.startsWith("controllers/")) continue;
+      if (rel.split(path17.sep)[0] === "controllers" || rel.startsWith("controllers/")) continue;
       if (!/\.(ts|tsx|js|jsx)$/.test(rel)) continue;
-      const text = await fs17.readFile(path16.join(cwd, "src", rel), "utf8").catch(() => "");
+      const text = await fs17.readFile(path17.join(cwd, "src", rel), "utf8").catch(() => "");
       if (BODY_LOADERS.test(text)) return true;
     }
   } catch {
@@ -5088,9 +5117,9 @@ async function deployGame(ctx, opts, log) {
     }
     log.success("Built.");
   }
-  const distDir = path16.join(cwd, "dist");
+  const distDir = path17.join(cwd, "dist");
   const siteDir = await isDir(distDir) ? distDir : cwd;
-  const rel = path16.relative(cwd, siteDir) || ".";
+  const rel = path17.relative(cwd, siteDir) || ".";
   if (siteDir === cwd) await writeGitignore(cwd, log);
   const files = await collectFiles(siteDir);
   if (files.length === 0) {
@@ -5181,7 +5210,7 @@ async function deployGame(ctx, opts, log) {
 }
 async function hasBuildScript(cwd) {
   try {
-    const pkg = JSON.parse(await fs17.readFile(path16.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(await fs17.readFile(path17.join(cwd, "package.json"), "utf8"));
     return Boolean(pkg.scripts?.build);
   } catch {
     return false;
@@ -5193,9 +5222,9 @@ async function collectFiles(root) {
     for (const e of await fs17.readdir(dir, { withFileTypes: true })) {
       const relPath = prefix ? `${prefix}/${e.name}` : e.name;
       if (e.isDirectory()) {
-        if (!EXCLUDE_DIRS.has(e.name)) await walk2(path16.join(dir, e.name), relPath);
+        if (!EXCLUDE_DIRS.has(e.name)) await walk2(path17.join(dir, e.name), relPath);
       } else if (e.isFile() && !isSecretEnvFile(e.name)) {
-        out.push({ relPath, bytes: await fs17.readFile(path16.join(dir, e.name)) });
+        out.push({ relPath, bytes: await fs17.readFile(path17.join(dir, e.name)) });
       }
     }
   };
@@ -5468,7 +5497,7 @@ async function pushWorktree(cwd, pushUrl, managed, log, branch = "main", onCommi
     log.error("Couldn't save your game's source \u2014 please try again.");
     return "failed";
   };
-  const gitDir = await fs17.mkdtemp(path16.join(os5.tmpdir(), "genex-source-"));
+  const gitDir = await fs17.mkdtemp(path17.join(os5.tmpdir(), "genex-source-"));
   const base = { GIT_DIR: gitDir };
   if (urlHasEmbeddedCredentials(pushUrl)) {
     base.GIT_CONFIG_COUNT = "1";
@@ -5483,8 +5512,8 @@ async function pushWorktree(cwd, pushUrl, managed, log, branch = "main", onCommi
   };
   try {
     if ((await run("git", ["init", "-q"], base)).code !== 0) return failed();
-    await fs17.writeFile(path16.join(gitDir, "info", "exclude"), excludeFile());
-    const env = { ...base, GIT_WORK_TREE: cwd, GIT_INDEX_FILE: path16.join(gitDir, "index-source") };
+    await fs17.writeFile(path17.join(gitDir, "info", "exclude"), excludeFile());
+    const env = { ...base, GIT_WORK_TREE: cwd, GIT_INDEX_FILE: path17.join(gitDir, "index-source") };
     let lfs = (await run("git", ["lfs", "version"], base)).code !== 0 ? false : true;
     if (!lfs) {
       log.step("Installing git-lfs (keeps large binary assets out of the source push)\u2026");
@@ -5737,7 +5766,8 @@ async function runPreview(opts) {
     process.exitCode = 1;
     return;
   }
-  const token = await readUserToken(opts.envPath);
+  const apiUrl = getApiUrl(meta.apiUrl);
+  const token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not authorized. Run `genex init` first to sign in.");
     process.exitCode = 1;
@@ -5746,7 +5776,6 @@ async function runPreview(opts) {
   const detections = await detectFeatures(log);
   advisoryNudges(log, detections);
   await exploreReuseNudge(log, meta);
-  const apiUrl = getApiUrl(meta.apiUrl);
   const ok = await deployGame(
     { projectId: meta.id, apiUrl, token, slug: meta.slug },
     // Detections reach the server on every preview too: matchmaking so a draft's
@@ -5823,7 +5852,7 @@ function loggerFor(opts) {
 }
 async function readState(directory) {
   try {
-    const marker = path17.join(directory, ".genex", "remix-operation.json");
+    const marker = path18.join(directory, ".genex", "remix-operation.json");
     if ((await fs18.lstat(marker)).isSymbolicLink()) return null;
     const value = JSON.parse(await fs18.readFile(marker, "utf8"));
     return value.schema === 1 && value.directory === directory && typeof value.operationId === "string" && /^[a-zA-Z0-9_-]{8,128}$/.test(value.operationId) && value.source && /^[a-f0-9]{40}$/.test(value.source.sourceCommitSha) ? value : null;
@@ -5832,11 +5861,11 @@ async function readState(directory) {
   }
 }
 async function saveState(state) {
-  const dir = path17.join(state.directory, ".genex");
+  const dir = path18.join(state.directory, ".genex");
   await fs18.mkdir(dir, { recursive: true, mode: 448 });
-  const temp = path17.join(dir, "remix-operation.next.json");
+  const temp = path18.join(dir, "remix-operation.next.json");
   await fs18.writeFile(temp, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
-  await fs18.rename(temp, path17.join(dir, "remix-operation.json"));
+  await fs18.rename(temp, path18.join(dir, "remix-operation.json"));
 }
 async function checkDestination(directory) {
   try {
@@ -5844,7 +5873,7 @@ async function checkDestination(directory) {
     if (!stat.isDirectory() || stat.isSymbolicLink()) throw new RemixError("destination_occupied", "The destination is not a fresh directory. Choose a new folder.");
     const entries = await fs18.readdir(directory);
     if (!entries.length) return null;
-    const genex = await fs18.lstat(path17.join(directory, ".genex")).catch(() => null);
+    const genex = await fs18.lstat(path18.join(directory, ".genex")).catch(() => null);
     const state = genex?.isDirectory() && !genex.isSymbolicLink() ? await readState(directory) : null;
     if (state) return state;
     throw new RemixError("destination_occupied", "The destination already contains files. Choose a fresh folder; remix never clears an existing project.");
@@ -5855,7 +5884,7 @@ async function checkDestination(directory) {
 }
 async function assertReferenceParents(cwd) {
   for (const rel of [".genex", ".genex/refs"]) {
-    const stat = await fs18.lstat(path17.join(cwd, rel)).catch((err) => {
+    const stat = await fs18.lstat(path18.join(cwd, rel)).catch((err) => {
       if (err.code === "ENOENT") return null;
       throw err;
     });
@@ -5863,16 +5892,16 @@ async function assertReferenceParents(cwd) {
   }
 }
 async function archiveSourceInstructions(directory) {
-  const archive = path17.join(directory, ".genex", "source-instructions");
+  const archive = path18.join(directory, ".genex", "source-instructions");
   const rootArtifacts = /* @__PURE__ */ new Set([".claude", ".codex", ".cursor", ".agents", ".mcp.json", ".cursorrules", "DESIGN.md"]);
   const instructionNames = /* @__PURE__ */ new Set(["AGENTS.md", "CLAUDE.md", "GEMINI.md"]);
   const visit = async (dir) => {
     for (const entry of await fs18.readdir(dir, { withFileTypes: true })) {
       if (entry.name === ".genex" || entry.name === ".git" || entry.name === "node_modules") continue;
-      const from = path17.join(dir, entry.name), rel = path17.relative(directory, from);
+      const from = path18.join(dir, entry.name), rel = path18.relative(directory, from);
       if (instructionNames.has(entry.name) || dir === directory && rootArtifacts.has(entry.name)) {
-        const to = path17.join(archive, rel);
-        await fs18.mkdir(path17.dirname(to), { recursive: true });
+        const to = path18.join(archive, rel);
+        await fs18.mkdir(path18.dirname(to), { recursive: true });
         if (await fs18.lstat(to).catch(() => null)) throw new RemixError("destination_changed", `Source instructions at ${rel} changed during preparation; both copies were retained.`);
         await fs18.rename(from, to);
       } else if (entry.isDirectory()) await visit(from);
@@ -5881,7 +5910,7 @@ async function archiveSourceInstructions(directory) {
   await visit(directory);
 }
 async function acquireLock(directory) {
-  const lock = path17.join(directory, ".genex", "remix.lock");
+  const lock = path18.join(directory, ".genex", "remix.lock");
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
       const handle = await fs18.open(lock, "wx", 384);
@@ -5983,13 +6012,13 @@ function pinRemixDependencies(pkg, version) {
   return warnings;
 }
 async function installRemixDependencies(cwd, pm, version, log, runner = childRun) {
-  const pkgPath = path17.join(cwd, "package.json");
+  const pkgPath = path18.join(cwd, "package.json");
   const pkg = JSON.parse(await fs18.readFile(pkgPath, "utf8"));
   const warnings = pinRemixDependencies(pkg, version);
   await fs18.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
   log.step(`Restoring dependencies with ${pm}; pinning ${CLI_PACKAGE}@${version} (${CLI_CHANNEL}).`);
   const args = pm === "npm" ? ["install", "--workspaces=false", "--no-audit", "--no-fund"] : pm === "pnpm" ? ["install", "--ignore-workspace", "--no-frozen-lockfile"] : ["install"];
-  if (pm === "yarn") await fs18.writeFile(path17.join(cwd, "yarn.lock"), "", { flag: "wx" }).catch((err) => {
+  if (pm === "yarn") await fs18.writeFile(path18.join(cwd, "yarn.lock"), "", { flag: "wx" }).catch((err) => {
     if (err.code !== "EEXIST") throw err;
   });
   await runner(cwd, pm, args);
@@ -6023,7 +6052,7 @@ function rebindRemixConfig(content, slug) {
 async function configureIdentity(state, log) {
   const cwd = state.directory, meta = state.project;
   await writeProject(meta, cwd);
-  const configFile = path17.join(cwd, "src", "genex.config.ts");
+  const configFile = path18.join(cwd, "src", "genex.config.ts");
   const config = await fs18.readFile(configFile, "utf8").catch((err) => {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -6032,7 +6061,7 @@ async function configureIdentity(state, log) {
   await writeGameConfigFiles(meta, log, cwd);
   await writeGitignore(cwd, log);
   await installRemixProfile(cwd, state.apiUrl, log);
-  const manifestFile = path17.join(cwd, "package.json");
+  const manifestFile = path18.join(cwd, "package.json");
   const manifest = JSON.parse(await fs18.readFile(manifestFile, "utf8"));
   manifest.genex.remixSource = { projectId: state.source.projectId, slug: state.source.slug, sourceCommitSha: state.source.sourceCommitSha, version: state.source.version, versionCertainty: state.source.versionCertainty };
   await fs18.writeFile(manifestFile, JSON.stringify(manifest, null, 2) + "\n");
@@ -6041,9 +6070,9 @@ async function configureIdentity(state, log) {
   const scan = async (dir) => {
     for (const entry of await fs18.readdir(dir, { withFileTypes: true })) {
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-      const file = path17.join(dir, entry.name);
+      const file = path18.join(dir, entry.name);
       if (entry.isDirectory()) await scan(file);
-      else if (entry.isFile() && /\.(?:[cm]?[jt]sx?|html)$/.test(entry.name) && (await fs18.stat(file)).size < 1024 * 1024 && quoted.test(await fs18.readFile(file, "utf8"))) possible.push(path17.relative(cwd, file));
+      else if (entry.isFile() && /\.(?:[cm]?[jt]sx?|html)$/.test(entry.name) && (await fs18.stat(file)).size < 1024 * 1024 && quoted.test(await fs18.readFile(file, "utf8"))) possible.push(path18.relative(cwd, file));
     }
   };
   await scan(cwd);
@@ -6068,14 +6097,14 @@ async function runRemix(opts, deps = {}) {
     const apiUrl = getApiUrl(opts.apiUrl), dashboardUrl = new URL(getAuthUrl(opts.authUrl)).origin;
     if (opts.sourceOnly && !opts.destination) await assertReferenceParents(originalCwd);
     const selected = parseRemixSource(opts.remixSource, apiUrl, dashboardUrl);
-    let directory = opts.destination ? path17.resolve(originalCwd, opts.destination) : !opts.sourceOnly ? path17.resolve(originalCwd, `${selected.slug}-remix`) : void 0;
+    let directory = opts.destination ? path18.resolve(originalCwd, opts.destination) : !opts.sourceOnly ? path18.resolve(originalCwd, `${selected.slug}-remix`) : void 0;
     if (directory) state = await checkDestination(directory);
     resumed = state !== null;
     if (state && (state.apiUrl !== apiUrl || state.sourceOnly !== Boolean(opts.sourceOnly) || ![state.requestedSlug, state.source.slug].includes(selected.slug) || opts.operationId && state.operationId !== opts.operationId || opts.name && state.name !== opts.name || selected.version && selected.version !== state.source.version)) throw new RemixError("operation_mismatch", "This folder belongs to a different remix operation. Resume with its original source/options or choose a fresh folder.");
-    let token = await readUserToken(opts.envPath);
+    let token = await readUserToken(opts.envPath, apiUrl);
     if (!token) {
-      token = await authorize(apiUrl, dashboardUrl, { log, inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0 });
-      await writeUserToken(token, opts.envPath);
+      token = await authorize(apiUrl, dashboardUrl, { envPath: opts.envPath, log, inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0 });
+      await writeUserToken(token, opts.envPath, apiUrl);
     }
     const headers = { Authorization: `Bearer ${token}` };
     if (!state) {
@@ -6086,7 +6115,7 @@ async function runRemix(opts, deps = {}) {
       log.step(`Resolving source for ${selected.slug}\u2026`);
       const body = await responseJson(await request(`${apiUrl}/api/projects/${encodeURIComponent(selected.slug)}/source?${query}`, { headers, redirect: "error" }));
       validateSource(body, Boolean(opts.sourceOnly));
-      directory ??= path17.resolve(originalCwd, ".genex", "refs", `${body.source.slug}-${body.source.sourceCommitSha.slice(0, 12)}`);
+      directory ??= path18.resolve(originalCwd, ".genex", "refs", `${body.source.slug}-${body.source.sourceCommitSha.slice(0, 12)}`);
       const existing = await checkDestination(directory);
       if (existing) {
         if (!existing.sourceOnly || !opts.sourceOnly || existing.apiUrl !== apiUrl || existing.source.sourceCommitSha !== body.source.sourceCommitSha || existing.source.projectId !== body.source.projectId) throw new RemixError("destination_occupied", "This reference destination already belongs to another operation. Choose a fresh folder.");
@@ -6096,18 +6125,18 @@ async function runRemix(opts, deps = {}) {
         state = { schema: 1, operationId: opts.operationId ?? crypto4.randomUUID(), directory, apiUrl, dashboardUrl, requestedSlug: selected.slug, source: body.source, sourceToken: body.sourceToken, sourceOnly: Boolean(opts.sourceOnly), cliVersion: getCliVersion(), name: opts.name?.trim() || `${body.source.title.slice(0, 74)} remix`, stage: "download", warnings: [...body.source.warnings] };
         await fs18.mkdir(directory, { recursive: true });
         if ((await fs18.readdir(directory)).length) throw new RemixError("destination_occupied", "The destination changed during setup. Choose a fresh folder.");
-        await fs18.mkdir(path17.join(directory, ".genex"), { mode: 448 });
+        await fs18.mkdir(path18.join(directory, ".genex"), { mode: 448 });
         await saveState(state);
       }
     }
     unlock = await acquireLock(state.directory);
     state = await readState(state.directory) ?? state;
     if (resumed && state.stage === "download") await renewSource(state, request, headers);
-    const staging = path17.join(state.directory, ".genex", "remix-stage");
+    const staging = path18.join(state.directory, ".genex", "remix-stage");
     if (state.stage === "download") {
       await fs18.rm(staging, { recursive: true, force: true });
       await fs18.mkdir(staging, { recursive: true });
-      const archive = path17.join(staging, "source.zip"), sourceDir = path17.join(staging, "source");
+      const archive = path18.join(staging, "source.zip"), sourceDir = path18.join(staging, "source");
       await fs18.mkdir(sourceDir);
       const archiveUrl = new URL(state.source.archiveUrl, state.apiUrl);
       if (archiveUrl.origin !== new URL(state.apiUrl).origin || !archiveUrl.pathname.startsWith("/api/projects/")) throw new RemixError("invalid_source_response", "Source archive must be served by the selected Genex API.");
@@ -6123,12 +6152,12 @@ async function runRemix(opts, deps = {}) {
       if (!state.sourceOnly) {
         let pkg;
         try {
-          pkg = JSON.parse(await fs18.readFile(path17.join(sourceDir, "package.json"), "utf8"));
+          pkg = JSON.parse(await fs18.readFile(path18.join(sourceDir, "package.json"), "utf8"));
         } catch (error) {
-          const staticEntry = await fs18.stat(path17.join(sourceDir, "index.html")).catch(() => null);
+          const staticEntry = await fs18.stat(path18.join(sourceDir, "index.html")).catch(() => null);
           if (error.code !== "ENOENT" || !staticEntry?.isFile()) throw new RemixError("source_unavailable", "Source has neither a readable package.json nor a static index.html. Use --source-only to inspect it.");
           pkg = { name: manifestName(state.directory), private: true };
-          await fs18.writeFile(path17.join(sourceDir, "package.json"), JSON.stringify(pkg, null, 2) + "\n");
+          await fs18.writeFile(path18.join(sourceDir, "package.json"), JSON.stringify(pkg, null, 2) + "\n");
           state.warnings.push("This static game had no package.json; added a minimal private manifest for the local CLI. Its source and index.html remain unchanged.");
         }
         if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) throw new RemixError("source_unavailable", "Source package.json is not a project manifest.");
@@ -6139,7 +6168,7 @@ async function runRemix(opts, deps = {}) {
     }
     if (state.stage === "transfer") {
       for (const entry of state.transferEntries ?? []) {
-        const from = path17.join(staging, "source", entry), to = path17.join(state.directory, entry);
+        const from = path18.join(staging, "source", entry), to = path18.join(state.directory, entry);
         if (await fs18.lstat(from).catch(() => null)) {
           if (await fs18.lstat(to).catch(() => null)) throw new RemixError("destination_changed", `A file appeared at ${entry} during source preparation. It was left untouched.`);
           await fs18.rename(from, to);
@@ -6223,7 +6252,7 @@ async function runRemix(opts, deps = {}) {
 
 // src/commands/init.ts
 import fs19 from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 
 // src/lib/printed.ts
 var printed = /* @__PURE__ */ new WeakSet();
@@ -6331,8 +6360,8 @@ async function runInit(opts) {
   let totalNew = 0;
   let totalUpdated = 0;
   for (const t of targets) {
-    const src = t.full ? templatesDir : path18.join(templatesDir, "skills");
-    const dest = t.full ? t.baseDir : path18.join(t.baseDir, "skills");
+    const src = t.full ? templatesDir : path19.join(templatesDir, "skills");
+    const dest = t.full ? t.baseDir : path19.join(t.baseDir, "skills");
     const family = remixing ? skillFamilyFilter("remix") : converting ? skillFamilyFilter("tools", { hosted: true }) : skillFamilyFilter("game");
     if (remixing) await pruneRemixWorkflow(t.baseDir);
     const { copied, updated } = await copyTemplates(src, dest, {
@@ -6340,8 +6369,8 @@ async function runInit(opts) {
       exclude: ["controllers", "motion", "asset-viewer", "blender-service"],
       filter: t.full ? family : (rel) => family(`skills/${rel}`)
     });
-    await pruneRemovedSkills(path18.join(t.baseDir, "skills"), log);
-    await writeSkillsMarker(path18.join(t.baseDir, "skills"));
+    await pruneRemovedSkills(path19.join(t.baseDir, "skills"), log);
+    await writeSkillsMarker(path19.join(t.baseDir, "skills"));
     const added = copied.length - updated.length;
     totalNew += added;
     totalUpdated += updated.length;
@@ -6364,11 +6393,12 @@ async function runInit(opts) {
   }
   const authBaseUrl = getAuthUrl(opts.authUrl);
   const authApiUrl = getApiUrl(opts.apiUrl);
-  let token = await readUserToken(opts.envPath);
+  let token = await readUserToken(opts.envPath, authApiUrl);
   let savedToken = Boolean(token);
   if (!token) {
     try {
       token = await authorize(authApiUrl, authBaseUrl, {
+        envPath: opts.envPath,
         log,
         inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
@@ -6382,8 +6412,8 @@ async function runInit(opts) {
       log.dim("Your workspace files were installed. Re-run `genex init` to finish authorizing.");
       throw markPrinted(err);
     }
-    const { path: tokenPath } = await writeUserToken(token, opts.envPath);
-    log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)} (${ENV_TOKEN_KEY}).`);
+    const { path: tokenPath } = await writeUserToken(token, opts.envPath, authApiUrl);
+    log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)}.`);
     log.plain("");
     savedToken = false;
   }
@@ -6398,7 +6428,7 @@ async function runInit(opts) {
     if (email) log.plain(`  signed in as ${c.cyan(email)}`);
   };
   await echoIdentity();
-  const projectName = opts.name?.trim() || path18.basename(process.cwd());
+  const projectName = opts.name?.trim() || path19.basename(process.cwd());
   const create = (bearer) => createDraftProject({
     apiUrl,
     token: bearer,
@@ -6413,10 +6443,11 @@ async function runInit(opts) {
   if (!created.meta && created.unauthorized && savedToken) {
     log.plain("");
     log.warn("Your saved sign-in was rejected \u2014 reconnecting in the browser\u2026");
-    const aside = await rotateRejectedEnv(opts.envPath);
+    const aside = await rotateRejectedEnv(opts.envPath, authApiUrl);
     if (aside) log.dim(`  moved the rejected credential to ${c.cyan(aside)}`);
     try {
       token = await authorize(authApiUrl, authBaseUrl, {
+        envPath: opts.envPath,
         log,
         inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
@@ -6430,8 +6461,8 @@ async function runInit(opts) {
       log.dim("Your workspace files were installed. Re-run `genex init` to finish authorizing.");
       throw markPrinted(err);
     }
-    const { path: tokenPath } = await writeUserToken(token, opts.envPath);
-    log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)} (${ENV_TOKEN_KEY}).`);
+    const { path: tokenPath } = await writeUserToken(token, opts.envPath, authApiUrl);
+    log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)}.`);
     await echoIdentity();
     created = await create(token);
   }
@@ -6449,7 +6480,7 @@ async function runInit(opts) {
     if (await writeToolsContract(process.cwd(), { hosted: true })) {
       log.dim("  wrote the Genex Tools publishing rules into AGENTS.md (managed block)");
     }
-    await ensureEnvVar(path18.join(process.cwd(), ".env"), "VITE_GENEX_SLUG", meta.slug, log);
+    await ensureEnvVar(path19.join(process.cwd(), ".env"), "VITE_GENEX_SLUG", meta.slug, log);
     await reportCliEvent(apiUrl, token, "tools_converted");
   }
   if (!remixing) warnPreexisting(log, preexisting);
@@ -6478,7 +6509,7 @@ async function runInit(opts) {
 // src/commands/link.ts
 import fs20 from "fs/promises";
 import os6 from "os";
-import path19 from "path";
+import path20 from "path";
 async function runLink(opts) {
   const log = createLogger({ quiet: opts.quiet });
   log.plain(c.bold("genex link"));
@@ -6499,10 +6530,11 @@ async function runLink(opts) {
   }
   const authBaseUrl = getAuthUrl(opts.authUrl);
   const apiUrl = getApiUrl(opts.apiUrl);
-  let token = await readUserToken(opts.envPath);
+  let token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     try {
       token = await authorize(apiUrl, authBaseUrl, {
+        envPath: opts.envPath,
         log,
         inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
@@ -6514,7 +6546,7 @@ async function runLink(opts) {
       }
       throw err;
     }
-    const { path: tokenPath } = await writeUserToken(token, opts.envPath);
+    const { path: tokenPath } = await writeUserToken(token, opts.envPath, apiUrl);
     log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)}.`);
     log.plain("");
   }
@@ -6573,13 +6605,13 @@ async function downloadSource(apiUrl, token, project, log) {
     return false;
   }
   log.step(`Downloading the ${grant.sourceRef === "preview" ? "draft" : "published"} source\u2026`);
-  const staging = await fs20.mkdtemp(path19.join(os6.tmpdir(), "genex-link-"));
-  const fresh = path19.join(staging, "source");
+  const staging = await fs20.mkdtemp(path20.join(os6.tmpdir(), "genex-link-"));
+  const fresh = path20.join(staging, "source");
   try {
     if (!await cloneSource(grant, fresh, log)) return false;
-    await fs20.rm(path19.join(fresh, ".git"), { recursive: true, force: true });
+    await fs20.rm(path20.join(fresh, ".git"), { recursive: true, force: true });
     for (const entry of await fs20.readdir(fresh)) {
-      await fs20.cp(path19.join(fresh, entry), path19.join(process.cwd(), entry), {
+      await fs20.cp(path20.join(fresh, entry), path20.join(process.cwd(), entry), {
         recursive: true,
         force: true
       });
@@ -6592,7 +6624,7 @@ async function downloadSource(apiUrl, token, project, log) {
   }
 }
 async function ensureSlugEnv(slug, log, cwd = process.cwd()) {
-  const file = path19.join(cwd, ".env");
+  const file = path20.join(cwd, ".env");
   let content;
   try {
     content = await fs20.readFile(file, "utf8");
@@ -6663,7 +6695,7 @@ async function listOwnSlugs(apiUrl, token, log) {
 
 // src/commands/pull.ts
 import fs21 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import os7 from "os";
 function isMachineLocal(entry) {
   if (entry === ".genex" || entry === "node_modules" || entry === ".git") return true;
@@ -6682,13 +6714,13 @@ async function runPull(opts) {
     process.exitCode = 1;
     return;
   }
-  const token = await readUserToken(opts.envPath);
+  const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
+  const token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error(`Not signed in. Run ${c.cyan("npx genex auth")} first.`);
     process.exitCode = 1;
     return;
   }
-  const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
   if (!opts.force) {
     const tree2 = await sourceTreeHash(cwd);
     if (!meta.sourceTree) {
@@ -6723,19 +6755,19 @@ async function runPull(opts) {
     process.exitCode = 1;
     return;
   }
-  const staging = await fs21.mkdtemp(path20.join(os7.tmpdir(), "genex-pull-"));
-  const fresh = path20.join(staging, "source");
+  const staging = await fs21.mkdtemp(path21.join(os7.tmpdir(), "genex-pull-"));
+  const fresh = path21.join(staging, "source");
   try {
     if (!await cloneSource(grant, fresh, log)) {
       process.exitCode = 1;
       return;
     }
-    await fs21.rm(path20.join(fresh, ".git"), { recursive: true, force: true });
+    await fs21.rm(path21.join(fresh, ".git"), { recursive: true, force: true });
     const kept = await keepReplaced(cwd, log);
     await replaceTree(cwd, fresh);
     if (kept) {
       log.plain("");
-      log.info(`What was here is kept at ${c.cyan(path20.relative(cwd, kept) || kept)}`);
+      log.info(`What was here is kept at ${c.cyan(path21.relative(cwd, kept) || kept)}`);
       log.dim("  Nothing was thrown away \u2014 re-apply from there, or delete it when you are done.");
     }
   } finally {
@@ -6759,13 +6791,13 @@ async function runPull(opts) {
 }
 async function keepReplaced(cwd, log) {
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const dest = path20.join(cwd, ".genex", `replaced-${stamp}`);
+  const dest = path21.join(cwd, ".genex", `replaced-${stamp}`);
   try {
     const entries = (await fs21.readdir(cwd)).filter((e) => !isMachineLocal(e));
     if (entries.length === 0) return null;
     await fs21.mkdir(dest, { recursive: true });
     for (const entry of entries) {
-      await fs21.cp(path20.join(cwd, entry), path20.join(dest, entry), { recursive: true });
+      await fs21.cp(path21.join(cwd, entry), path21.join(dest, entry), { recursive: true });
     }
     return dest;
   } catch (err) {
@@ -6777,17 +6809,17 @@ async function keepReplaced(cwd, log) {
 async function replaceTree(dest, src) {
   for (const entry of await fs21.readdir(dest)) {
     if (isMachineLocal(entry)) continue;
-    await fs21.rm(path20.join(dest, entry), { recursive: true, force: true });
+    await fs21.rm(path21.join(dest, entry), { recursive: true, force: true });
   }
   for (const entry of await fs21.readdir(src)) {
     if (isMachineLocal(entry)) continue;
-    await fs21.cp(path20.join(src, entry), path20.join(dest, entry), { recursive: true });
+    await fs21.cp(path21.join(src, entry), path21.join(dest, entry), { recursive: true });
   }
 }
 
 // src/commands/rename.ts
 import fs22 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 async function runRename(opts) {
   const log = createLogger({ quiet: opts.quiet });
   log.plain(c.bold("genex rename"));
@@ -6804,13 +6836,13 @@ async function runRename(opts) {
     process.exitCode = 1;
     return;
   }
-  const token = await readUserToken(opts.envPath);
+  const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
+  const token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not signed in. Run `genex auth` first.");
     process.exitCode = 1;
     return;
   }
-  const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
   const from = meta.slug;
   if (meta.status === "published" && !opts.yes) {
     log.warn(`This retires ${c.cyan(from)} for good \u2014 it will redirect here, and nobody can reuse it.`);
@@ -6875,7 +6907,7 @@ async function runRename(opts) {
   log.info("Run `genex preview` (or `publish`) to rebuild \u2014 the new slug is baked into the bundle.");
 }
 async function rewriteSlugEnv(from, to, log, cwd = process.cwd()) {
-  const file = path21.join(cwd, ".env");
+  const file = path22.join(cwd, ".env");
   let content;
   try {
     content = await fs22.readFile(file, "utf8");
@@ -6888,7 +6920,7 @@ async function rewriteSlugEnv(from, to, log, cwd = process.cwd()) {
   log.dim(`  .env: VITE_GENEX_SLUG=${to} (was ${from})`);
 }
 async function rewriteBakedSlug(from, to, log, cwd = process.cwd()) {
-  const file = path21.join(cwd, "src", "genex.config.ts");
+  const file = path22.join(cwd, "src", "genex.config.ts");
   let content;
   try {
     content = await fs22.readFile(file, "utf8");
@@ -6919,7 +6951,7 @@ async function runList(opts) {
   const meta = await readProject();
   const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
   const dashOrigin = (meta?.dashboardOrigins?.[0] ?? getAuthUrl(opts.authUrl)).replace(/\/+$/, "");
-  let token = opts.token ?? await readUserToken(opts.envPath);
+  let token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     if (opts.noAuth) {
       log.error("Not signed in. Re-run without --no-auth to connect.");
@@ -6928,7 +6960,9 @@ async function runList(opts) {
     }
     log.plain("Not signed in \u2014 connecting\u2026");
     try {
+      assertAuthorizationOrigin(apiUrl, getApiUrl(opts.apiUrl));
       token = await authorize(apiUrl, getAuthUrl(opts.authUrl), {
+        envPath: opts.envPath,
         log,
         inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
@@ -6942,7 +6976,7 @@ async function runList(opts) {
       process.exitCode = 1;
       return;
     }
-    const { path: tokenPath } = await writeUserToken(token, opts.envPath);
+    const { path: tokenPath } = await writeUserToken(token, opts.envPath, apiUrl);
     log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)}.`);
     log.plain("");
   }
@@ -6954,7 +6988,9 @@ async function runList(opts) {
     if (res.status === 401 && !opts.token && !opts.noAuth) {
       log.plain("Your saved sign-in was rejected \u2014 reconnecting\u2026");
       try {
+        assertAuthorizationOrigin(apiUrl, getApiUrl(opts.apiUrl));
         token = await authorize(apiUrl, getAuthUrl(opts.authUrl), {
+          envPath: opts.envPath,
           log,
           inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
         });
@@ -6968,7 +7004,7 @@ async function runList(opts) {
         process.exitCode = 1;
         return;
       }
-      await writeUserToken(token, opts.envPath);
+      await writeUserToken(token, opts.envPath, apiUrl);
       res = await fetchProjects(token);
     }
   } catch (err) {
@@ -7039,13 +7075,13 @@ async function runMakeRemixable(opts) {
     process.exitCode = 1;
     return;
   }
-  const token = await readUserToken(opts.envPath);
+  const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
+  const token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not authorized. Run `genex init` first to sign in.");
     process.exitCode = 1;
     return;
   }
-  const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
   log.step("Preparing a public repo for your game\u2026");
   let res;
   try {
@@ -7127,7 +7163,7 @@ async function runDomain(opts) {
     return;
   }
   const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
-  let token = opts.token ?? await readUserToken(opts.envPath);
+  let token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     if (opts.noAuth) {
       log.error("Not signed in. Re-run without --no-auth to connect.");
@@ -7136,7 +7172,9 @@ async function runDomain(opts) {
     }
     log.plain("Not signed in \u2014 connecting\u2026");
     try {
+      assertAuthorizationOrigin(apiUrl, getApiUrl(opts.apiUrl));
       token = await authorize(apiUrl, getAuthUrl(opts.authUrl), {
+        envPath: opts.envPath,
         log,
         inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
@@ -7150,7 +7188,7 @@ async function runDomain(opts) {
       process.exitCode = 1;
       return;
     }
-    await writeUserToken(token, opts.envPath);
+    await writeUserToken(token, opts.envPath, apiUrl);
   }
   const base = `${apiUrl}/api/projects/${encodeURIComponent(meta.id)}/domains`;
   const auth = { Authorization: `Bearer ${token}` };
@@ -7274,7 +7312,7 @@ async function runShop(opts) {
     return;
   }
   const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
-  let token = opts.token ?? await readUserToken(opts.envPath);
+  let token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     if (opts.noAuth) {
       log.error("Not signed in. Re-run without --no-auth to connect.");
@@ -7283,7 +7321,9 @@ async function runShop(opts) {
     }
     log.plain("Not signed in \u2014 connecting\u2026");
     try {
+      assertAuthorizationOrigin(apiUrl, getApiUrl(opts.apiUrl));
       token = await authorize(apiUrl, getAuthUrl(opts.authUrl), {
+        envPath: opts.envPath,
         log,
         inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
@@ -7297,7 +7337,7 @@ async function runShop(opts) {
       process.exitCode = 1;
       return;
     }
-    await writeUserToken(token, opts.envPath);
+    await writeUserToken(token, opts.envPath, apiUrl);
   }
   const auth = { Authorization: `Bearer ${token}`, "Content-Type": "application/json" };
   const call = (url, init2) => apiFetch(url, { ...init2, headers: { ...auth, ...init2?.headers ?? {} } });
@@ -7522,12 +7562,6 @@ async function runPublish(opts) {
   const log = createLogger({ quiet: opts.quiet });
   log.plain(c.bold("genex publish"));
   log.plain("");
-  const token = opts.token ?? await readUserToken(opts.envPath);
-  if (!token) {
-    log.error("Not authorized. Run `genex init` first to sign in.");
-    process.exitCode = 1;
-    return;
-  }
   const meta = await readProject();
   if (!meta) {
     log.error("No genex project here. Run `genex init` in this directory first.");
@@ -7535,6 +7569,12 @@ async function runPublish(opts) {
     return;
   }
   const apiUrl = getApiUrl(opts.apiUrl ?? meta.apiUrl);
+  const token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
+  if (!token) {
+    log.error("Not authorized. Run `genex init` first to sign in.");
+    process.exitCode = 1;
+    return;
+  }
   const detections = await detectFeatures(log);
   advisoryNudges(log, detections);
   if (!opts.noPush) {
@@ -7630,13 +7670,13 @@ async function runPromote(opts) {
     process.exitCode = 1;
     return;
   }
-  const token = await readUserToken(opts.envPath);
+  const apiUrl = getApiUrl(meta.apiUrl);
+  const token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not authorized. Run `genex init` first to sign in.");
     process.exitCode = 1;
     return;
   }
-  const apiUrl = getApiUrl(meta.apiUrl);
   log.step("Making your previewed build live\u2026");
   const result = await promoteBuild(apiUrl, meta.id, token, log);
   if (!result) {
@@ -7661,14 +7701,14 @@ async function runAcceptCommand(opts) {
   const log = createLogger({ quiet: opts.quiet });
   log.plain(c.bold("genex accept"));
   log.plain("");
-  const token = await readUserToken(opts.envPath);
+  const [meta, workspace] = await Promise.all([readProject(), readWorkspace()]);
+  const apiUrl = getApiUrl(meta?.apiUrl ?? workspace?.apiUrl);
+  const token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error(`Not signed in. Run ${c.cyan("npx genex auth")} first.`);
     process.exitCode = 1;
     return;
   }
-  const [meta, workspace] = await Promise.all([readProject(), readWorkspace()]);
-  const apiUrl = meta?.apiUrl ?? workspace?.apiUrl;
   const ok = await runAccept({
     token,
     log,
@@ -7686,13 +7726,13 @@ async function runSave(opts) {
     process.exitCode = 1;
     return;
   }
-  const token = await readUserToken(opts.envPath);
+  const apiUrl = meta.apiUrl ?? getApiUrl();
+  const token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not signed in.");
     process.exitCode = 1;
     return;
   }
-  const apiUrl = meta.apiUrl ?? getApiUrl();
   let res;
   try {
     res = await apiFetch(`${apiUrl}/api/projects/${meta.id}/push-token`, {
@@ -7859,13 +7899,13 @@ async function runRollback(opts) {
     process.exitCode = 1;
     return;
   }
-  const token = await readUserToken(opts.envPath);
+  const apiUrl = getApiUrl(meta.apiUrl);
+  const token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not authorized. Run `genex init` first to sign in.");
     process.exitCode = 1;
     return;
   }
-  const apiUrl = getApiUrl(meta.apiUrl);
   const previous = await readPreviousVersion(apiUrl, meta.id, token, log);
   if (!previous) {
     process.exitCode = 1;
@@ -7896,7 +7936,7 @@ async function runRollback(opts) {
 
 // src/commands/generate.ts
 import fs25 from "fs/promises";
-import path24 from "path";
+import path25 from "path";
 import { PNG as PNG4 } from "pngjs";
 
 // src/lib/glass.ts
@@ -8079,12 +8119,12 @@ function ceilingVerdict(input) {
 
 // src/lib/generation-admission.ts
 import fs24 from "fs/promises";
-import path23 from "path";
+import path24 from "path";
 import { createHash, randomUUID } from "crypto";
 
 // src/lib/asset-budget.ts
 import fs23 from "fs/promises";
-import path22 from "path";
+import path23 from "path";
 var DEFAULT_ASSET_BUDGET_SHARE = 0.5;
 var DEFAULT_ASSET_BUDGET_CAP = 500;
 function envShare(raw, fallback) {
@@ -8111,7 +8151,7 @@ function allowanceFor(input) {
   if (!Number.isFinite(spendable) || spendable <= 0) return 0;
   return Math.max(0, Math.min(Math.floor(spendable * config.share), config.cap));
 }
-var storePath = (cwd) => path22.join(cwd, ".genex", "asset-budget.json");
+var storePath = (cwd) => path23.join(cwd, ".genex", "asset-budget.json");
 async function readBudgetStore(cwd = process.cwd()) {
   try {
     const raw = await fs23.readFile(storePath(cwd), "utf8");
@@ -8133,7 +8173,7 @@ async function readBudgetStore(cwd = process.cwd()) {
 }
 async function writeBudgetStore(cwd, store) {
   try {
-    await fs23.access(path22.join(cwd, ".genex"));
+    await fs23.access(path23.join(cwd, ".genex"));
     await fs23.writeFile(storePath(cwd), `${JSON.stringify(store, null, 2)}
 `, "utf8");
     return true;
@@ -8249,7 +8289,7 @@ async function assetBudgetGate(input) {
 
 // src/lib/generation-admission.ts
 async function withAdmissionLock(cwd, work, waitMs = 3e4) {
-  const lock = path23.join(cwd, ".genex", "generation-admission.lock");
+  const lock = path24.join(cwd, ".genex", "generation-admission.lock");
   const deadline = Date.now() + waitMs;
   let file;
   while (!file) {
@@ -8524,7 +8564,7 @@ async function inlineLocalImage(filePath, flag) {
       error: `${flag} file is ${(bytes.length / 1048576).toFixed(1)} MB \u2014 over the ~4 MB inline limit. Downscale/compress it first, or pass an asset URL instead.`
     };
   }
-  const mime = IMAGE_MIME_BY_EXT[path24.extname(filePath).toLowerCase()] ?? "image/png";
+  const mime = IMAGE_MIME_BY_EXT[path25.extname(filePath).toLowerCase()] ?? "image/png";
   return { ok: true, dataUri: `data:${mime};base64,${bytes.toString("base64")}` };
 }
 var SKYBOX_ENVIRONMENT_SUFFIX = ". The image contains ONLY sky: cloud, atmosphere, light, weather and distant haze at the horizon. Every structure, object, plant and ground surface is outside the frame.";
@@ -8711,7 +8751,7 @@ async function runGenerate(kind, opts) {
   let typedPrompt = opts.prompt?.trim();
   if (!typedPrompt && kind === "model" && opts.imageUrl) {
     const ref = opts.imageUrl.startsWith("data:") ? "local image" : opts.imageUrl;
-    typedPrompt = `from image: ${path24.basename(ref).slice(0, 120)}`;
+    typedPrompt = `from image: ${path25.basename(ref).slice(0, 120)}`;
   }
   if (kind === "model" && opts.texture !== void 0 && !MODEL_TEXTURE_TIERS.includes(opts.texture)) {
     log.error(`--texture ${opts.texture} is a character texture size. \`genex model\` takes a texture TIER: ${MODEL_TEXTURE_TIERS.join("|")} (default detailed).`);
@@ -8831,14 +8871,14 @@ async function runGenerate(kind, opts) {
       `Voice text is ${prompt.length} chars \u2014 the server clamps at 1000 (billing follows the clamp). Split longer copy into separate lines.`
     );
   }
-  const token = opts.token ?? await readUserToken(opts.envPath);
+  const meta = await readProject();
+  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
+  const token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not authorized. Run `genex init` first to sign in.");
     process.exitCode = 1;
     return;
   }
-  const meta = await readProject();
-  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
   const mode = await workspaceMode();
   if (mode === "tools") {
     const lane = laneFor(await fetchLanes(apiUrl, token), kind);
@@ -8961,7 +9001,7 @@ async function reportGlassTerminal(view, outDir, log, json) {
       });
       continue;
     }
-    const outPath = path24.join(outDir, `glass-${i + 1}.png`);
+    const outPath = path25.join(outDir, `glass-${i + 1}.png`);
     await fs25.writeFile(outPath, PNG4.sync.write(r.png));
     solved.push({
       path: outPath,
@@ -9582,7 +9622,7 @@ function writeJson(value) {
 
 // src/commands/model-sub.ts
 import fs26 from "fs/promises";
-import path25 from "path";
+import path26 from "path";
 var MODEL_SUBCOMMANDS = ["segment", "rig", "animate", "import"];
 function apiErrorMessage(data, fallback) {
   if (typeof data !== "object" || data === null) return fallback;
@@ -9597,7 +9637,7 @@ async function importModelFile(args) {
   const { log } = args;
   const filePath = args.filePath.trim();
   if (!/\.glb$/i.test(filePath)) {
-    log.error(`\`import\` takes a .glb file (binary glTF 2.0). Export ${path25.basename(filePath) || "the model"} as GLB first \u2014 Blender: File \u2192 Export \u2192 glTF 2.0, format "glTF Binary".`);
+    log.error(`\`import\` takes a .glb file (binary glTF 2.0). Export ${path26.basename(filePath) || "the model"} as GLB first \u2014 Blender: File \u2192 Export \u2192 glTF 2.0, format "glTF Binary".`);
     return null;
   }
   let bytes;
@@ -9608,18 +9648,18 @@ async function importModelFile(args) {
     return null;
   }
   if (bytes.byteLength > MODEL_IMPORT_MAX_BYTES) {
-    log.error(`${path25.basename(filePath)} is ${(bytes.byteLength / 1e6).toFixed(1)} MB; imports are capped at ${MODEL_IMPORT_MAX_BYTES / 1024 / 1024} MB. Shrink its textures (they are usually the bulk) and try again.`);
+    log.error(`${path26.basename(filePath)} is ${(bytes.byteLength / 1e6).toFixed(1)} MB; imports are capped at ${MODEL_IMPORT_MAX_BYTES / 1024 / 1024} MB. Shrink its textures (they are usually the bulk) and try again.`);
     return null;
   }
   if (bytes.byteLength < 12 || bytes.readUInt32LE(0) !== GLB_MAGIC) {
-    log.error(`${path25.basename(filePath)} is not a GLB (no glTF magic). A .gltf + .bin pair must be exported as one binary .glb.`);
+    log.error(`${path26.basename(filePath)} is not a GLB (no glTF magic). A .gltf + .bin pair must be exported as one binary .glb.`);
     return null;
   }
   const headers = { "Content-Type": "application/json", Authorization: `Bearer ${args.token}` };
   const minted = await apiFetch(`${args.apiUrl}/api/generations/import`, {
     method: "POST",
     headers,
-    body: JSON.stringify({ filename: path25.basename(filePath), bytes: bytes.byteLength, contentType: "model/gltf-binary" })
+    body: JSON.stringify({ filename: path26.basename(filePath), bytes: bytes.byteLength, contentType: "model/gltf-binary" })
   });
   if (printedStructuredError(minted)) return null;
   if (!minted.ok) {
@@ -9628,7 +9668,7 @@ async function importModelFile(args) {
     return null;
   }
   const { id, uploadUrl, url } = await minted.json();
-  log.dim(`  uploading ${path25.basename(filePath)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
+  log.dim(`  uploading ${path26.basename(filePath)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
   const put = await fetch(uploadUrl, {
     method: "PUT",
     headers: { "Content-Type": "model/gltf-binary", "Content-Length": String(bytes.byteLength) },
@@ -9659,14 +9699,14 @@ async function runModelImport(opts) {
     process.exitCode = 1;
     return;
   }
-  const token = opts.token ?? await readUserToken(opts.envPath);
+  const project = await readProject();
+  const apiUrl = getApiUrl(opts.apiUrl ?? project?.apiUrl);
+  const token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not authorized. Run `genex init` first to sign in.");
     process.exitCode = 1;
     return;
   }
-  const project = await readProject();
-  const apiUrl = getApiUrl(opts.apiUrl ?? project?.apiUrl);
   const imported = await importModelFile({ apiUrl, token, filePath, log });
   if (!imported) {
     process.exitCode = 1;
@@ -9776,7 +9816,7 @@ async function runModelAnimate(opts) {
 }
 
 // src/commands/wait.ts
-import path26 from "path";
+import path27 from "path";
 var TERMINAL2 = /* @__PURE__ */ new Set(["completed", "failed"]);
 async function runWait(opts) {
   if (opts.all) return runWaitAll(opts);
@@ -9789,14 +9829,14 @@ async function runWait(opts) {
     process.exitCode = 1;
     return;
   }
-  const token = opts.token ?? await readUserToken(opts.envPath);
+  const meta = await readProject();
+  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
+  const token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not authorized. Run `genex init` first to sign in.");
     process.exitCode = 1;
     return;
   }
-  const meta = await readProject();
-  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
   let view;
   try {
     const res = await apiFetch(`${apiUrl}/api/generations/${id}`, {
@@ -9862,14 +9902,14 @@ async function runWaitAll(opts) {
     );
     return;
   }
-  const token = opts.token ?? await readUserToken(opts.envPath);
+  const meta = await readProject(cwd);
+  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
+  const token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     log.error("Not authorized. Run `genex init` first to sign in.");
     process.exitCode = 1;
     return;
   }
-  const meta = await readProject(cwd);
-  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
   const views = /* @__PURE__ */ new Map();
   try {
     const res = await apiFetch(`${apiUrl}/api/generations`, {
@@ -9915,7 +9955,7 @@ async function runWaitAll(opts) {
       if (v?.status !== "completed" || !v.files?.length) continue;
       const local = localDeliveryFor("tools", { ...opts, outDir: opts.outDir ?? e.outDir }, e.prompt || e.kind);
       if (!local) continue;
-      const outDir = path26.join(path26.relative(process.cwd(), cwd) || ".", local.outDir);
+      const outDir = path27.join(path27.relative(process.cwd(), cwd) || ".", local.outDir);
       const target = { kind: e.kind, prompt: local.prompt, id: e.id, outDir };
       const missing = await undeliveredFiles(v.files, target);
       if (missing.length === 0) continue;
@@ -10024,7 +10064,7 @@ async function toRow(e, v, cwd) {
 
 // src/commands/controller.ts
 import fs28 from "fs/promises";
-import path28 from "path";
+import path29 from "path";
 
 // ../../packages/meshy-animation-catalog/src/index.ts
 import { createHash as createHash2 } from "crypto";
@@ -19155,8 +19195,8 @@ function searchMeshyAnimations(query, options = {}) {
 
 // src/lib/anims.ts
 import fs27 from "fs/promises";
-import path27 from "path";
-var ANIMS_DEST = path27.join("public", "assets", "anims");
+import path28 from "path";
+var ANIMS_DEST = path28.join("public", "assets", "anims");
 var HIDDEN_TAG = "reference";
 async function runAnims(opts) {
   const log = createLogger({ quiet: opts.quiet });
@@ -19172,7 +19212,7 @@ async function runAnims(opts) {
     printCatalog(log, manifest, selectors);
     return;
   }
-  const controllerMarker = path27.join(root, "src", "controllers", "character");
+  const controllerMarker = path28.join(root, "src", "controllers", "character");
   if (!await exists3(controllerMarker)) {
     log.error(
       `No character controller in this game (missing ${c.cyan("src/controllers/character/")}).`
@@ -19181,11 +19221,11 @@ async function runAnims(opts) {
     process.exitCode = 1;
     return;
   }
-  const destDir = path27.join(root, ANIMS_DEST);
-  const gameManifestPath = path27.join(destDir, "manifest.json");
+  const destDir = path28.join(root, ANIMS_DEST);
+  const gameManifestPath = path28.join(destDir, "manifest.json");
   if (opts.reset) {
     await fs27.rm(destDir, { recursive: true, force: true });
-    log.step(`Cleared ${c.cyan(ANIMS_DEST + path27.sep)} (--reset)`);
+    log.step(`Cleared ${c.cyan(ANIMS_DEST + path28.sep)} (--reset)`);
   }
   if (selectors.length === 0) {
     const installed = await readGameManifest(gameManifestPath);
@@ -19223,7 +19263,7 @@ async function runAnims(opts) {
     }
   }
   const wanted = [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
-  const cacheDir = path27.join(
+  const cacheDir = path28.join(
     opts.cacheDir ?? getAnimsCacheDir(),
     `${manifest.library}-v${manifest.version}`
   );
@@ -19235,13 +19275,13 @@ async function runAnims(opts) {
   let addedBytes = 0;
   const failures = [];
   for (const entry of wanted) {
-    const dest = path27.join(destDir, entry.file);
+    const dest = path28.join(destDir, entry.file);
     if (await hasSize(dest, entry.bytes)) {
       presentCount++;
       continue;
     }
     try {
-      const cached = path27.join(cacheDir, entry.file);
+      const cached = path28.join(cacheDir, entry.file);
       if (!await hasSize(cached, entry.bytes)) {
         const res = await fetch(base + entry.file);
         if (!res.ok) throw new Error(`HTTP ${res.status}`);
@@ -19251,7 +19291,7 @@ async function runAnims(opts) {
       await fs27.copyFile(cached, dest);
       installedCount++;
       addedBytes += entry.bytes;
-      log.dim(`  ${path27.join(ANIMS_DEST, entry.file)} (${formatMb(entry.bytes)})`);
+      log.dim(`  ${path28.join(ANIMS_DEST, entry.file)} (${formatMb(entry.bytes)})`);
     } catch (err) {
       failures.push(`${entry.name} (${err instanceof Error ? err.message : String(err)})`);
     }
@@ -19273,7 +19313,7 @@ async function runAnims(opts) {
   if (presentCount > 0) parts.push(`${presentCount} already present`);
   if (bundledSkips > 0) parts.push(`${bundledSkips} already bundled in animation-library.glb`);
   log.success(
-    `${parts.join(", ")} \u2192 ${c.cyan(ANIMS_DEST + path27.sep)}${addedBytes > 0 ? ` (+${formatMb(addedBytes)})` : ""}`
+    `${parts.join(", ")} \u2192 ${c.cyan(ANIMS_DEST + path28.sep)}${addedBytes > 0 ? ` (+${formatMb(addedBytes)})` : ""}`
   );
   for (const [selector, entries] of resolved) {
     const names = entries.filter((e) => !coreNames.has(e.name)).map((e) => e.name);
@@ -19305,7 +19345,7 @@ async function loadManifest(baseOverride) {
     }
   } catch {
   }
-  const snapshotPath = path27.join(getTemplatesDir(), "controllers", "assets", "anims-manifest.json");
+  const snapshotPath = path28.join(getTemplatesDir(), "controllers", "assets", "anims-manifest.json");
   const manifest = JSON.parse(await fs27.readFile(snapshotPath, "utf8"));
   return { manifest, source: "snapshot" };
 }
@@ -19639,8 +19679,8 @@ var CONTROLLER_FILE_SETS = {
     ]
   }
 };
-var CODE_DEST = path28.join("src", "controllers");
-var ASSETS_DEST = path28.join("public", "assets");
+var CODE_DEST = path29.join("src", "controllers");
+var ASSETS_DEST = path29.join("public", "assets");
 async function runController(opts) {
   const log = createLogger({ quiet: opts.quiet });
   if (opts.kind?.trim() === "anims") {
@@ -19657,31 +19697,31 @@ async function runController(opts) {
     process.exitCode = 1;
     return;
   }
-  const srcDir = path28.join(getTemplatesDir(), "controllers");
+  const srcDir = path29.join(getTemplatesDir(), "controllers");
   const root = opts.cwd ?? process.cwd();
   const set = CONTROLLER_FILE_SETS[kind];
   log.plain(c.bold(`genex controller ${kind}`));
   log.plain("");
-  log.step(`Installing the ${kind} controller into ${c.cyan(CODE_DEST + path28.sep)}`);
+  log.step(`Installing the ${kind} controller into ${c.cyan(CODE_DEST + path29.sep)}`);
   const plan = [
-    ...set.code.map((rel) => ({ from: rel, rel: path28.join(CODE_DEST, rel) })),
+    ...set.code.map((rel) => ({ from: rel, rel: path29.join(CODE_DEST, rel) })),
     ...set.assets.map((rel) => ({
       from: rel,
-      rel: path28.join(ASSETS_DEST, path28.basename(rel))
+      rel: path29.join(ASSETS_DEST, path29.basename(rel))
     }))
   ];
   let copied = 0;
   let skipped = 0;
   try {
     for (const file of plan) {
-      const dest = path28.join(root, file.rel);
+      const dest = path29.join(root, file.rel);
       if (!opts.force && await exists4(dest)) {
         skipped++;
         log.dim(`  skipped ${file.rel} (exists \u2014 use --force to overwrite)`);
         continue;
       }
-      await fs28.mkdir(path28.dirname(dest), { recursive: true });
-      await fs28.copyFile(path28.join(srcDir, file.from), dest);
+      await fs28.mkdir(path29.dirname(dest), { recursive: true });
+      await fs28.copyFile(path29.join(srcDir, file.from), dest);
       copied++;
       log.dim(`  ${file.rel}`);
     }
@@ -19697,7 +19737,7 @@ async function runController(opts) {
   if (kind === "character") {
     if (opts.character) {
       try {
-        const token = opts.token !== void 0 ? opts.token : await readUserToken();
+        const token = opts.token !== void 0 ? opts.token : await readUserToken(void 0, getApiUrl(opts.apiUrl));
         if (!token) throw new Error("Not authorized. Run `genex init` before installing a Meshy character.");
         await installMeshyCharacterManifest({
           root,
@@ -19734,7 +19774,7 @@ async function runController(opts) {
   for (const line of set.sketch) {
     log.dim(`       ${line}`);
   }
-  if (kind === "character" && !await exists4(path28.join(root, ASSETS_DEST, "meshy-character.json"))) {
+  if (kind === "character" && !await exists4(path29.join(root, ASSETS_DEST, "meshy-character.json"))) {
     log.plain("");
     log.plain(
       `  ${stepOffset + 3}. This game has no generated character yet \u2014 ${c.cyan(
@@ -19766,8 +19806,8 @@ async function installMeshyCharacterManifest(args) {
     throw new Error("The API returned an invalid Meshy character manifest.");
   }
   assertCompleteMeshyControllerPack(manifest);
-  const destination = path28.join(args.root, ASSETS_DEST, "meshy-character.json");
-  await fs28.mkdir(path28.dirname(destination), { recursive: true });
+  const destination = path29.join(args.root, ASSETS_DEST, "meshy-character.json");
+  await fs28.mkdir(path29.dirname(destination), { recursive: true });
   await fs28.writeFile(
     destination,
     `${JSON.stringify(manifest, null, 2)}
@@ -19913,9 +19953,9 @@ function assertCompleteMeshyControllerPack(manifest) {
 }
 async function installFallbackAvatar(args) {
   const { root, srcDir, log } = args;
-  const dest = path28.join(root, ASSETS_DEST, "avatar.vrm");
-  await fs28.mkdir(path28.dirname(dest), { recursive: true });
-  await fs28.copyFile(path28.join(srcDir, "assets", "default-avatar.vrm"), dest);
+  const dest = path29.join(root, ASSETS_DEST, "avatar.vrm");
+  await fs28.mkdir(path29.dirname(dest), { recursive: true });
+  await fs28.copyFile(path29.join(srcDir, "assets", "default-avatar.vrm"), dest);
   log.dim("  public/assets/avatar.vrm (fallback avatar \u2014 bundled CC0 default)");
 }
 async function exists4(p) {
@@ -19929,7 +19969,7 @@ async function exists4(p) {
 
 // src/commands/character.ts
 import fs29 from "fs/promises";
-import path29 from "path";
+import path30 from "path";
 function exactAnimation(selector) {
   const trimmed = selector.trim();
   if (/^-?\d+$/.test(trimmed)) return animationById(Number(trimmed));
@@ -19955,10 +19995,11 @@ function resolveActionSelectors(selectors) {
   return { ok: true, actionIds: [...new Set(actionIds)] };
 }
 async function context(opts) {
-  const token = opts.token ?? await readUserToken(opts.envPath);
-  if (!token) return null;
   const project = await readProject();
-  return { token, apiUrl: getApiUrl(opts.apiUrl ?? project?.apiUrl) };
+  const apiUrl = getApiUrl(opts.apiUrl ?? project?.apiUrl);
+  const token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
+  if (!token) return null;
+  return { token, apiUrl };
 }
 var CHARACTER_BRIEF_MAX_CHARS = 600;
 function apiErrorMessage2(data, fallback) {
@@ -20009,7 +20050,7 @@ function showAmbiguity(selector, candidates, log, json = false) {
   }
   process.exitCode = 1;
 }
-var INSTALLED_MANIFEST = path29.join("public", "assets", "meshy-character.json");
+var INSTALLED_MANIFEST = path30.join("public", "assets", "meshy-character.json");
 async function resolveAdoptTarget(selector) {
   const trimmed = selector?.trim();
   if (trimmed && !trimmed.endsWith(".json")) {
@@ -20141,7 +20182,7 @@ async function runCharacterImport(opts) {
     opts,
     ctx,
     kind: "character",
-    prompt: `Import ${path29.basename(filePath)} as a rigged character`,
+    prompt: `Import ${path30.basename(filePath)} as a rigged character`,
     createPath: "/api/characters/import",
     body,
     quote: price,
@@ -20611,27 +20652,28 @@ import { basename } from "path";
 var VIDEO_SECONDS = [5, 6, 7, 8];
 var MAX_VIDEO_BYTES = 200 * 1024 * 1024;
 async function context2(opts) {
-  const token = opts.token ?? await readUserToken(opts.envPath);
-  if (!token) return null;
   const project = await readProject();
-  return { token, apiUrl: getApiUrl(opts.apiUrl ?? project?.apiUrl) };
+  const apiUrl = getApiUrl(opts.apiUrl ?? project?.apiUrl);
+  const token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
+  if (!token) return null;
+  return { token, apiUrl };
 }
-async function readVideo(path36, log) {
+async function readVideo(path37, log) {
   let bytes;
   try {
-    bytes = await readFile(path36);
+    bytes = await readFile(path37);
   } catch {
-    log.error(`Can't read ${path36}.`);
+    log.error(`Can't read ${path37}.`);
     return null;
   }
   if (bytes.byteLength > MAX_VIDEO_BYTES) {
-    log.error(`${basename(path36)} is ${(bytes.byteLength / 1e6).toFixed(0)} MB \u2014 the limit is ${MAX_VIDEO_BYTES / 1e6} MB.`);
+    log.error(`${basename(path37)} is ${(bytes.byteLength / 1e6).toFixed(0)} MB \u2014 the limit is ${MAX_VIDEO_BYTES / 1e6} MB.`);
     return null;
   }
   return bytes;
 }
-async function uploadVideo(apiUrl, token, characterId, path36, bytes, log) {
-  const contentType = /\.mov$/i.test(path36) ? "video/quicktime" : "video/mp4";
+async function uploadVideo(apiUrl, token, characterId, path37, bytes, log) {
+  const contentType = /\.mov$/i.test(path37) ? "video/quicktime" : "video/mp4";
   const minted = await apiFetch(
     `${apiUrl}/api/characters/${encodeURIComponent(characterId)}/motions/video-url`,
     {
@@ -20646,7 +20688,7 @@ async function uploadVideo(apiUrl, token, characterId, path36, bytes, log) {
     return null;
   }
   const { uploadUrl, videoUrl } = await minted.json();
-  log.dim(`  uploading ${basename(path36)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
+  log.dim(`  uploading ${basename(path37)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
   const put = await fetch(uploadUrl, {
     method: "PUT",
     headers: { "Content-Type": contentType, "Content-Length": String(bytes.byteLength) },
@@ -20979,7 +21021,7 @@ function rank(items, query) {
 
 // src/commands/motion.ts
 import fs30 from "fs/promises";
-import path30 from "path";
+import path31 from "path";
 
 // src/lib/motion/npz.ts
 import zlib from "zlib";
@@ -22257,7 +22299,7 @@ async function expandTakes(selectors) {
     const st = await fs30.stat(sel).catch(() => null);
     if (st?.isDirectory()) {
       const names = await fs30.readdir(sel);
-      for (const n of names.sort()) if (n.endsWith(".npz")) out.push(path30.join(sel, n));
+      for (const n of names.sort()) if (n.endsWith(".npz")) out.push(path31.join(sel, n));
     } else if (st?.isFile()) {
       out.push(sel);
     } else {
@@ -22314,7 +22356,7 @@ async function motionVerify(opts, log) {
   }
   const reports = [];
   for (const file of files) {
-    const stem = path30.basename(file).replace(/\.npz$/, "");
+    const stem = path31.basename(file).replace(/\.npz$/, "");
     try {
       reports.push(analyzeTake(stem, await fs30.readFile(file), gates));
     } catch (err) {
@@ -22372,7 +22414,7 @@ async function motionCompile(opts, log) {
   }
   const inputs = [];
   for (const file of files) {
-    const stem = path30.basename(file).replace(/\.npz$/, "");
+    const stem = path31.basename(file).replace(/\.npz$/, "");
     try {
       inputs.push({ stem, take: loadTake(await fs30.readFile(file)) });
     } catch (err) {
@@ -22381,7 +22423,7 @@ async function motionCompile(opts, log) {
       return;
     }
   }
-  const setName = opts.set ?? path30.basename(opts.out).replace(/\.json$/, "");
+  const setName = opts.set ?? path31.basename(opts.out).replace(/\.json$/, "");
   let result;
   try {
     result = compileSet(inputs, setName, cfg);
@@ -22396,7 +22438,7 @@ async function motionCompile(opts, log) {
     process.exitCode = 1;
     return;
   }
-  await fs30.mkdir(path30.dirname(path30.resolve(opts.out)), { recursive: true });
+  await fs30.mkdir(path31.dirname(path31.resolve(opts.out)), { recursive: true });
   const json = JSON.stringify(result.data);
   await fs30.writeFile(opts.out, json);
   if (opts.json) {
@@ -22416,9 +22458,9 @@ var MOTION_RUNTIME_FILES = [
 var MOTION_PRESETS = {
   rifle: ["sets/rifle.json", "sets/jumps.json"]
 };
-var MOTION_DEST = path30.join("src", "motion");
+var MOTION_DEST = path31.join("src", "motion");
 async function motionInstall(opts, log) {
-  const srcDir = path30.join(getTemplatesDir(), "motion");
+  const srcDir = path31.join(getTemplatesDir(), "motion");
   const root = opts.cwd ?? process.cwd();
   const preset = opts.set;
   if (preset !== void 0 && !MOTION_PRESETS[preset]) {
@@ -22429,21 +22471,21 @@ async function motionInstall(opts, log) {
   const files = [...MOTION_RUNTIME_FILES, ...preset ? MOTION_PRESETS[preset] : []];
   log.plain(c.bold(`genex motion install${preset ? ` --set ${preset}` : ""}`));
   log.plain("");
-  log.step(`Vendoring the motion runtime into ${c.cyan(MOTION_DEST + path30.sep)}`);
+  log.step(`Vendoring the motion runtime into ${c.cyan(MOTION_DEST + path31.sep)}`);
   let copied = 0, skipped = 0;
   try {
     for (const rel of files) {
-      const dest = path30.join(root, MOTION_DEST, rel);
+      const dest = path31.join(root, MOTION_DEST, rel);
       const exists5 = await fs30.access(dest).then(() => true, () => false);
       if (!opts.force && exists5) {
         skipped++;
-        log.dim(`  skipped ${path30.join(MOTION_DEST, rel)} (exists \u2014 use --force to overwrite)`);
+        log.dim(`  skipped ${path31.join(MOTION_DEST, rel)} (exists \u2014 use --force to overwrite)`);
         continue;
       }
-      await fs30.mkdir(path30.dirname(dest), { recursive: true });
-      await fs30.copyFile(path30.join(srcDir, rel), dest);
+      await fs30.mkdir(path31.dirname(dest), { recursive: true });
+      await fs30.copyFile(path31.join(srcDir, rel), dest);
       copied++;
-      log.dim(`  ${path30.join(MOTION_DEST, rel)}`);
+      log.dim(`  ${path31.join(MOTION_DEST, rel)}`);
     }
   } catch (err) {
     log.error(`Copy failed: ${String(err)}`);
@@ -22522,12 +22564,12 @@ async function runMotion(opts) {
 
 // src/commands/blender.ts
 import fs31 from "fs/promises";
-import path31 from "path";
+import path32 from "path";
 var SUBS2 = ["demo", "exec", "snap", "scene", "import", "export", "reset", "mcp", "serve", "seat", "release"];
 var DEFAULT_OUT_DIR = "assets/blender";
 async function writeB64(dir, name, b64) {
   await fs31.mkdir(dir, { recursive: true });
-  const p = path31.join(dir, name);
+  const p = path32.join(dir, name);
   await fs31.writeFile(p, Buffer.from(b64, "base64"));
   return p;
 }
@@ -22545,7 +22587,7 @@ async function runBlender(opts) {
     return 1;
   }
   if (sub === "serve") {
-    const { serveLocalBlender } = await import("./blender-serve-PVVCH3S6.js");
+    const { serveLocalBlender } = await import("./blender-serve-GW3LTFOX.js");
     const port = Number(process.env.GENEX_BLENDER_PORT ?? 8088);
     log.step(`Starting a local Blender service on port ${port}`);
     log.plain(
@@ -22554,7 +22596,7 @@ async function runBlender(opts) {
     return serveLocalBlender({ port, log });
   }
   if (sub === "mcp") {
-    const { runBlenderMcp } = await import("./blender-mcp-X66ZZ4TN.js");
+    const { runBlenderMcp } = await import("./blender-mcp-XLEK6SLM.js");
     return runBlenderMcp();
   }
   if (sub === "seat") {
@@ -22612,7 +22654,7 @@ async function runBlender(opts) {
     log.plain(rest.join("\n"));
     return 1;
   }
-  const outDir = path31.resolve(opts.outDir ?? DEFAULT_OUT_DIR);
+  const outDir = path32.resolve(opts.outDir ?? DEFAULT_OUT_DIR);
   const mode = opts.mode;
   if (mode !== void 0 && !isRenderMode(mode)) {
     log.error(`Unknown --mode ${mode}. Use one of: ${RENDER_MODES.join(", ")}.`);
@@ -22652,13 +22694,13 @@ async function runBlender(opts) {
       return 0;
     }
     case "export": {
-      const target = opts.out ?? path31.join(outDir, "scene.glb");
+      const target = opts.out ?? path32.join(outDir, "scene.glb");
       const r = await blenderCall(base, "/export", { path: "/tmp/genex-export.glb" });
       if (!r.glbBase64) {
         log.error(`/export answered with no GLB bytes${r.uploaded ? " (it was uploaded, not inlined)" : ""}`);
         return 1;
       }
-      await fs31.mkdir(path31.dirname(target), { recursive: true });
+      await fs31.mkdir(path32.dirname(target), { recursive: true });
       await fs31.writeFile(target, Buffer.from(r.glbBase64, "base64"));
       log.success(`Exported ${r.bytes ?? 0} bytes`);
       log.plain(`  ${c.cyan(target)}`);
@@ -22697,7 +22739,7 @@ async function runBlender(opts) {
           log.error(`Can't read ${opts.input}`);
           return 1;
         }
-        label = path31.basename(opts.input);
+        label = path32.basename(opts.input);
       }
       const r = await blenderCall(base, "/exec", { script, ...mode ? { mode } : {}, sheet: { formats: SHEET_FORMATS } });
       if (r.stdout?.trim()) log.plain(r.stdout.trimEnd());
@@ -22818,7 +22860,7 @@ print(f"castle: {n} objects")
 // src/commands/asset-new.ts
 import fs32 from "fs";
 import fsp from "fs/promises";
-import path32 from "path";
+import path33 from "path";
 import { pathToFileURL } from "url";
 var EXTRA_FILES = [
   "genex-asset.example.json",
@@ -22912,7 +22954,7 @@ Every milestone ends with \`npm run verify\`, then \`npx genex preview --no-buil
 }
 async function runAssetNew(options) {
   const log = createLogger();
-  const cwd = options.dir ? path32.resolve(options.dir) : process.cwd();
+  const cwd = options.dir ? path33.resolve(options.dir) : process.cwd();
   const slug = options.assetSlug;
   if (!slug) {
     log.error('Usage: genex asset new <slug> [--title "<Name>"] [--dims WxDxH] [--tri-band LOW-HIGH] [--holder "<your name>"] [--out <dir>]');
@@ -22922,14 +22964,14 @@ async function runAssetNew(options) {
     log.error(`The slug must be kebab-case (letters, digits, dashes), got: ${slug}`);
     return 1;
   }
-  const templateDir = path32.join(getTemplatesDir(), "asset-viewer");
+  const templateDir = path33.join(getTemplatesDir(), "asset-viewer");
   if (!fs32.existsSync(templateDir)) {
     log.error(`Vendored asset-viewer template not found at ${templateDir} \u2014 reinstall the CLI.`);
     return 1;
   }
-  const manifestTools = await import(pathToFileURL(path32.join(templateDir, "tools", "emit-manifest.mjs")).href);
+  const manifestTools = await import(pathToFileURL(path33.join(templateDir, "tools", "emit-manifest.mjs")).href);
   const { SHARED_FILES, PARITY_FILENAME, hashSharedFiles, pascalCase } = manifestTools;
-  const lockPath = path32.join(templateDir, "shared-files.sha256.json");
+  const lockPath = path33.join(templateDir, "shared-files.sha256.json");
   const lock = JSON.parse(await fsp.readFile(lockPath, "utf8"));
   const actual = hashSharedFiles(templateDir);
   const drifted = SHARED_FILES.filter((rel) => lock.files[rel] !== actual[rel]);
@@ -22942,7 +22984,7 @@ async function runAssetNew(options) {
   const triBand = parseBand(options.triBand ?? "500-8000");
   const holder = options.holder?.trim() || HOLDER_PLACEHOLDER;
   const year = (/* @__PURE__ */ new Date()).getUTCFullYear();
-  const outDir = path32.resolve(cwd, options.out ?? slug);
+  const outDir = path33.resolve(cwd, options.out ?? slug);
   if (fs32.existsSync(outDir) && fs32.readdirSync(outDir).length > 0 && !options.force) {
     log.error(`${outDir} already holds files. Nothing was touched \u2014 pass --force to write into it anyway.`);
     return 1;
@@ -22971,24 +23013,24 @@ async function runAssetNew(options) {
   };
   await fsp.mkdir(outDir, { recursive: true });
   for (const rel of [...SHARED_FILES, ...EXTRA_FILES]) {
-    const to = path32.join(outDir, rel);
-    await fsp.mkdir(path32.dirname(to), { recursive: true });
-    await fsp.copyFile(path32.join(templateDir, rel), to);
+    const to = path33.join(outDir, rel);
+    await fsp.mkdir(path33.dirname(to), { recursive: true });
+    await fsp.copyFile(path33.join(templateDir, rel), to);
   }
-  const pkg = fillTemplate(await fsp.readFile(path32.join(templateDir, "package.json"), "utf8"), {
+  const pkg = fillTemplate(await fsp.readFile(path33.join(templateDir, "package.json"), "utf8"), {
     slug,
     name,
     version
   });
-  await fsp.writeFile(path32.join(outDir, "package.json"), pkg, "utf8");
-  await fsp.writeFile(path32.join(outDir, "asset.config.json"), JSON.stringify(config, null, 2) + "\n", "utf8");
-  await fsp.writeFile(path32.join(outDir, ".gitignore"), GITIGNORE, "utf8");
+  await fsp.writeFile(path33.join(outDir, "package.json"), pkg, "utf8");
+  await fsp.writeFile(path33.join(outDir, "asset.config.json"), JSON.stringify(config, null, 2) + "\n", "utf8");
+  await fsp.writeFile(path33.join(outDir, ".gitignore"), GITIGNORE, "utf8");
   await fsp.writeFile(
-    path32.join(outDir, "DESIGN.md"),
+    path33.join(outDir, "DESIGN.md"),
     designDoc({ name, slug, sizeMeters, triBand, holder }),
     "utf8"
   );
-  const placeholder = await fsp.readFile(path32.join(templateDir, "src", "asset", "PLACEHOLDER.ts"), "utf8");
+  const placeholder = await fsp.readFile(path33.join(templateDir, "src", "asset", "PLACEHOLDER.ts"), "utf8");
   const seeded = seedAssetSource(placeholder, {
     slug,
     name,
@@ -22999,8 +23041,8 @@ async function runAssetNew(options) {
     pascalCase
   });
   const assetFilename = `${slug.replace(/-([a-z0-9])/g, (_, ch) => ch.toUpperCase())}.ts`;
-  await fsp.mkdir(path32.join(outDir, "src", "asset"), { recursive: true });
-  await fsp.writeFile(path32.join(outDir, "src", "asset", assetFilename), seeded, "utf8");
+  await fsp.mkdir(path33.join(outDir, "src", "asset"), { recursive: true });
+  await fsp.writeFile(path33.join(outDir, "src", "asset", assetFilename), seeded, "utf8");
   const copied = hashSharedFiles(outDir);
   const mismatched = SHARED_FILES.filter((rel) => copied[rel] !== lock.files[rel]);
   if (mismatched.length) {
@@ -23008,7 +23050,7 @@ async function runAssetNew(options) {
     return 1;
   }
   await fsp.writeFile(
-    path32.join(outDir, PARITY_FILENAME),
+    path33.join(outDir, PARITY_FILENAME),
     JSON.stringify(
       {
         note: "Recorded by `genex asset new`. Gate G13 recomputes these; do not hand-edit the viewer.",
@@ -23052,10 +23094,10 @@ async function runAssetNew(options) {
 }
 
 // src/commands/tools.ts
-import path34 from "path";
+import path35 from "path";
 
 // src/commands/doctor.ts
-import path33 from "path";
+import path34 from "path";
 var LANE_ORDER = [
   "model",
   "image",
@@ -23114,7 +23156,7 @@ async function runDoctor(opts = {}) {
     fix: latest && isNewerVersion(latest, installed) ? "npm i -D @genex-ai/cli-demo@latest  (apply at a safe moment, never mid-task)" : void 0
   });
   const apiUrl = getApiUrl(opts.apiUrl ?? workspace?.apiUrl ?? project?.apiUrl);
-  const token = await readUserToken(opts.envPath);
+  const token = await readUserToken(opts.envPath, apiUrl);
   let email = null;
   let authState = "none";
   if (token) {
@@ -23336,7 +23378,7 @@ async function fetchLegalStatus(apiUrl, token) {
 }
 async function firstSkillsMarker() {
   for (const target of resolveAgentTargets()) {
-    const marker = await readSkillsMarker(path33.join(target.baseDir, "skills"));
+    const marker = await readSkillsMarker(path34.join(target.baseDir, "skills"));
     if (marker) return marker;
   }
   return null;
@@ -23387,8 +23429,8 @@ async function runTools(opts) {
   let totalNew = 0;
   let totalUpdated = 0;
   for (const t of targets) {
-    const dest = path34.join(t.baseDir, "skills");
-    const { copied, updated } = await copyTemplates(path34.join(templatesDir, "skills"), dest, {
+    const dest = path35.join(t.baseDir, "skills");
+    const { copied, updated } = await copyTemplates(path35.join(templatesDir, "skills"), dest, {
       filter: (rel) => skillFamilyFilter("tools")(`skills/${rel}`)
     });
     await pruneRemovedSkills(dest, log);
@@ -23416,10 +23458,11 @@ async function runTools(opts) {
   await ensureLocalCli(log, process.cwd(), { skip: opts.noInstall });
   log.plain("");
   const authBaseUrl = getAuthUrl(opts.authUrl);
-  let token = await readUserToken(opts.envPath);
+  let token = await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     try {
       token = await authorize(apiUrl, authBaseUrl, {
+        envPath: opts.envPath,
         log,
         inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
@@ -23435,8 +23478,8 @@ async function runTools(opts) {
       log.dim("The workspace is set up. Re-run `genex tools` to finish authorizing.");
       throw markPrinted(err);
     }
-    const { path: tokenPath } = await writeUserToken(token, opts.envPath);
-    log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)} (${ENV_TOKEN_KEY}).`);
+    const { path: tokenPath } = await writeUserToken(token, opts.envPath, apiUrl);
+    log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)}.`);
     log.plain("");
   }
   await reportToolsInit(apiUrl, token);
@@ -23448,7 +23491,7 @@ async function runTools(opts) {
 
 // src/commands/budget.ts
 import fs33 from "fs/promises";
-import path35 from "path";
+import path36 from "path";
 var BUDGET_SOURCE_LINE = "Live from your account; prices can change without a deploy.";
 var BUDGET_APPROVAL_REQUIRED = "STOP: raising the asset allowance requires the player's explicit approval. Re-run with --user-approved only after they agreed to the number.";
 function internalKind(kind) {
@@ -23456,7 +23499,7 @@ function internalKind(kind) {
 }
 async function isGenexProject(cwd) {
   try {
-    await fs33.access(path35.join(cwd, ".genex"));
+    await fs33.access(path36.join(cwd, ".genex"));
     return true;
   } catch {
     return false;
@@ -23491,13 +23534,13 @@ async function runBudget(opts = {}) {
     fail3(`--assets takes a whole number of credits, 0 or more (got ${String(opts.assets)}).`);
     return;
   }
-  const token = opts.token ?? await readUserToken(opts.envPath);
+  const meta = await readProject(cwd);
+  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
+  const token = opts.token ?? await readUserToken(opts.envPath, apiUrl);
   if (!token) {
     fail3("Not authorized. Run `genex init` first to sign in.");
     return;
   }
-  const meta = await readProject(cwd);
-  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
   const snapshot = await fetchCreditsSnapshot(apiUrl, token);
   let store;
   let persisted = true;