@genex-ai/cli-demo 1.7.0-dev.449 → 1.7.2-dev.451

package/dist/index.js

@@ -1881,6 +1881,21 @@ function isStale(local, remote) {
   if (!local || !remote) return false;
   return local !== remote;
 }
+function inHostedSession() {
+  return process.env.GENEX_HOSTED_SESSION === "1";
+}
+function mayForceOverAnotherDevice() {
+  return !inHostedSession();
+}
+function reportForceRefused(log) {
+  log.error("`--force` is not available inside a Genex chat session.");
+  log.dim("  It would replace work shipped from another machine, and that is not yours to discard here.");
+  log.dim(`  Do this instead \u2014 it keeps both sides:`);
+  log.dim(`    1. ${c.cyan("npx genex pull --force")}   takes the other machine's work (a copy of this folder is kept under .genex/replaced-*)`);
+  log.dim(`    2. redo your change on top of it \u2014 you know what you just changed`);
+  log.dim(`    3. ${c.cyan("npx genex preview")}`);
+  log.dim("  If the user explicitly wants their chat version to win, ask them to run `npx genex preview --force` themselves.");
+}
 function reportStale(log, slug, local, remote) {
   log.error(`${c.cyan(slug)} was updated from another device \u2014 nothing was deployed.`);
   if (remote && local) {
@@ -4726,6 +4741,10 @@ function isSecretEnvFile(name) {
 async function deployGame(ctx, opts, log) {
   const cwd = process.cwd();
   const meta = await readProject(cwd);
+  if (opts.force && !mayForceOverAnotherDevice()) {
+    reportForceRefused(log);
+    return false;
+  }
   const expectStagingCommit = opts.force ? void 0 : meta?.stagingCommit;
   if (expectStagingCommit) {
     const remote = await readRemoteSource(ctx.apiUrl, ctx.token, ctx.projectId);
@@ -5178,6 +5197,10 @@ async function fetchPushUrl(ctx, log, expectStagingCommit) {
   }
   if (res.status === 409) {
     const body = await res.json().catch(() => null);
+    if (body?.error === "force_not_allowed_in_session") {
+      reportForceRefused(log);
+      return "stale";
+    }
     reportStale(log, ctx.slug ?? "this game", expectStagingCommit, body?.stagingCommit ?? null);
     return "stale";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genex-ai/cli-demo",
-  "version": "1.7.0-dev.449",
+  "version": "1.7.2-dev.451",
   "description": "Set up your project's agent workspace (.claude/.codex/.cursor in the game folder), authorize, create a game project, generate AI assets, and publish (genex CLI).",
   "type": "module",
   "bin": {

package/templates/skills/genex-getting-started/SKILL.md

@@ -200,6 +200,11 @@ Either way **say which version you are keeping before you run it** — both comm
 are irreversible for one side, and the user may know something you don't about what
 is on the other machine.
 
+Inside a Genex chat session `preview --force` is **refused** — you cannot discard
+what somebody shipped from their own machine, because you cannot see it. Pull, redo
+your change, preview. If the user wants their chat version to win, they can run the
+forced deploy from their terminal themselves.
+
 `link` never creates a project: it signs in if needed (the browser opens once)
 and rewrites the local link (source pushes authorize over HTTPS, so there's no
 key to set up — it works from any machine).