Fix CLI recovery errors before beta publication

[TheDesignFounder]

Paid CLI commands now reject existing or invalid output destinations before uploads or submission. Re-running a completed command with the same output path cannot start a second paid job. The final write stays exclusive for destination races. README and help document the refusal.

A completed generation could be reported as a permanent generation failure when writing the local output failed. The CLI now reports local_output_failed, preserves the execution ID and retry key, and directs both JSON and text callers to recover with download instead of creating a second paid request.

Missing credentials, unreadable inputs, unavailable outputs and cancellation have distinct reasons and exit codes. Interrupted/incomplete execution recovery remains retryable without asserting generation failed. Both output paths refuse overwrite. Package publication defaults to beta, README/help links use existing pages, and built JavaScript excludes source comments.

Validation: 72 CLI/client/packaged-install tests passed against offline fixtures, including charged-completion simulation with local write failure in JSON and text modes, GET-only download recovery, overwrite refusal, cancellation, missing credentials and no-ID stream recovery. No live generation or publication.

Follow-up to the independent review on #5. Hold merge/publication for re-review; npm publisher authentication still needs restoring. Publish explicitly with --tag beta. Beta.2-only docs pages are held outside the docs site until the package exists on npm.

[TheDesignFounder]

Re-review at 2ea3387: original findings fixed; one new defect blocks publication

Both suites pass at this head (62/62), and the binaries were probed against a fake API. Original items: 1, 3, 5, 6, 7, 8, 9, 12 FIXED (local_output_failed with id, key and download guidance in JSON and text; distinct reasons and exit codes matching the table; follow() terminal errors now temporarily_unavailable exit 5; cancelled on stderr exit 4; publishConfig.tag: beta asserted from the tarball; comments stripped from dist); 13 PARTIAL (branches asserted; bytes still fetched before the wx refusal, harmless); 15 not fixed (trivial dead branch and -h anywhere). 4 PARTIAL: the four 404s are gone, but README.md:150 "MCP setup" links docs.dreamlayer.io/mcp, which is the docs host's MCP RPC endpoint (JSON to browsers, 405 to GET); the page is /mcp/index.

New, must fix before publishing (N1, src/cli.ts:258). Every paid command (generate, edit, cutout, upscale, sprite, answer) now refuses to overwrite an existing --out file, but only after the job has been submitted and charged. Probed: generate "a tree" --out same.png twice produced a second POST /v1/execute (a second credit) and then local_output_failed. The README's own batch loop, re-run after fixing one bad input, would pay again for every finished image and then refuse each write. Neither README nor --help mention the new refusal. Fix: check the destination before calling /v1/execute and fail with exit 1 before any charge, or keep overwrite semantics for an explicit --out on paid commands.

Smaller (N2-N5): a transport failure before anything was submitted now reads "Execution state is uncertain" with the real cause hidden (safe, but less diagnosable; print the cause); the text recovery block suggests download even for execution_cancelled and prints a blank line when guidance is empty; downloadOutput collapses 401/403 on the asset fetch into download_failed exit 5, so a revoked key no longer shows as exit 2 on that path.

Verdict: after N1 and the /mcp link, safe to publish as beta (tag now defaults correctly).

[TheDesignFounder]

Please re-review 538618b (new since 2ea3387).

N1 is fixed: all six paid commands resolve and check the output destination before uploads or /v1/execute. Existing files, directories and dangling symlinks return exit 1 without network calls; missing/unwritable parents are refused too. The final exclusive write still protects against a destination appearing during generation and retains download recovery.

README and --help document overwrite refusal. The MCP setup link now points to /mcp/index.

Validation: 72 tests passed, including one successful generation followed by a repeat with the same --out (exactly one POST total), all six paid commands refusing existing output without network calls, destination-type checks, and a file appearing after preflight in both JSON/text modes. Fresh CI is running. No merge, publication or paid calls.

[TheDesignFounder]

Re-review at 538618b: N1 fixed and proven; safe to publish as beta

Suite 72/72 at this head. The built binary was probed against a fake API:

• Second generate … --out same.png run: exit 1, output_exists, retryable: false, guidance present in JSON and text, zero network requests (no capabilities read, no POST /v1/execute), file bytes intact. Batch re-runs therefore stop on completed files before any charge.
• --out pointing at a directory → output_exists; read-only parent → output_unavailable; both before any request. Default --out in a fresh directory still generates normally.
• edit with a missing input but an existing --out refuses before submission; download behaviour unchanged.
• --help and README now state the refusal and the output_exists / output_unavailable reasons; the race after preflight is still closed by the exclusive final write with download recovery, and the retargeted test proves it.
• /mcp/index link: FIXED (live: /mcp/index is the HTML page, /mcp is the docs host's JSON RPC endpoint).

Still open, all low and not publication-blocking, unchanged from the previous round: N2 (transport failure before submission hides its cause behind "Execution state is uncertain"), N3 (download suggested for execution_cancelled; blank guidance line), N4 (asset-fetch 401/403 collapse into download_failed exit 5), 15 (dead branch, -h anywhere).

Verdict: publish 0.4.0-beta.2 with --tag beta once npm publisher authentication is restored. Do not merge or publish until the owner says so.