v0.3.0

Works through a UX and security review of 0.2.0. The themes are the filesystem
authority of an MCP tool, overwrite protection that covers a whole destination
rather than half of one, and telling a caller what actually happened.

Security

• Every path an MCP tool takes from an agent is confined to the project.
  out, out_dir, reference_images, and image were resolved against the
  working directory and never checked, so ../../.ssh/id_rsa was a readable
  reference and ../../../etc/cron.d/x.png was a writable destination.
  assets.yml already had a containment check; within() and realish() moved
  to core/fsx.ts and every path site now calls the same one. SECURITY.md
  states the scope: a path from an agent is in scope, a path typed into a shell
  is not.
• spx init --dry-run no longer prints the merged configuration file. The
  preview was built by merging subpixel's entry into the user's existing config
  and serialising the result, so a dry run of spx init claude printed back
  every other MCP server's API keys. Each writer renders only subpixel's own
  entry now.
• The sidecar is treated as half of the destination. writeManifest
  replaced <image>.json unconditionally, and it ran after the image had
  landed: finding hero.png free was enough to claim it, and the run then
  destroyed a neighbouring JSON nobody passed --overwrite for. The slot is
  checked while the destination is still being chosen, and the manifest is then
  published with link()/EEXIST like the image beside it, so the only file it
  can replace is one it has just read and recognised as subpixel's. A slot that
  cannot be read at all — a directory, a permission error — is not an empty
  slot, and the run steps to a sibling name.

Added

• spx generate reports progress on stderr. A multi-image run printed nothing
  until it finished. A TTY gets one rewritten line, a pipe gets one line per
  event, stdout stays the artifact paths and nothing else, and --quiet
  silences it.
• --json reports the variants that were written, the widths that were skipped,
  and a format redirect. The payload described only the primary image, so a
  caller consuming spx generate --json could not see which variant widths
  existed or that its requested format had been changed.

Changed

• spx sync --check reads the bytes back. A cache-key match says the inputs
  are unchanged. It says nothing about the file, which a half-finished copy can
  truncate and an optimiser can rewrite while the sidecar beside it still
  matches. Every artifact is verified, the primary and each variant: a variant
  is a file nothing in the cache key describes, so existing was not evidence of
  being intact. sync itself deliberately does not, because it is about to
  consult the cache and write anyway. A sidecar written before this release
  records no digest per variant and is taken on trust rather than reported as
  drift.
• Bad enum values and impossible dimensions are refused before a request is
  sent. --quality ultra and --format gif reached the backend and came back
  as a provider error after the wait, and --size 999999999x999999999 reached
  aspect-ratio arithmetic and threw a raw RangeError. The accepted values are
  declared once in core/types.ts and shared by the Commander options, the
  manifest validator, the MCP tool schemas, project config, and the assets.yml
  schema, so the five cannot drift. Dimensions are bounded at 16384.
• A reference image is refused at its stat, before it is read. The 12 MiB cap
  was applied to a buffer that was already resident, so the 3 GiB file someone
  pointed at by mistake was in the process before anything objected, and the
  objection was an allocation failure. The whole-request budget is threaded
  through the set, so the file that breaks the 32 MiB cap is named rather than
  reported as a grand total after every remaining file has been read.
• A JSONC configuration file is handed the exact entry to paste rather than
  pointed at --force. There is still no JSONC parser: the comments belong to
  the user and a round-trip would eat them.
• spx sync --check hashes its references instead of loading them.
  referenceHashes built a base64 data URL for a request body — a second copy
  of every file, a third longer than the first — and then read one field off the
  result. A check sends nothing anywhere, so all of it was discarded, once per
  reference per asset, on every run. The size caps still apply.
• spx icons packs the ICO from the PNGs it has already rendered.
  buildIconPack resized the source five times for the pack and three more for
  the ICO, two of them at 16 and 32 — sizes it had just written out. Eight
  resizes become six, and the ICO payloads are byte-identical to the files
  beside them.

Fixed

• A partial sync over MCP no longer discards the report. When some assets
  synced and one failed, the server threw and the successful half of the report
  went with it. Error metadata travels on a Symbol.for("subpixel.details")
  property, so the report survives without collapsing the error taxonomy or the
  exit code the way wrapping would.