v0.4.0

Features

• Add dym ext: user-defined HTTP extensions declared in a YAML config file (default $XDG_CONFIG_HOME/dym/extensions.yaml or the platform equivalent, overridable via --extensions-file/-e or DYM_EXTENSIONS_FILE). Each extension becomes its own subcommand, calling an arbitrary URL (templated with {{.BaseURL}}/{{.Args.*}}), with optional bearer auth ({{.DymmerToken}}), optional request body templating for non-GET methods, and either the built-in --filter/--select/--output table|json|csv|tsv pipeline (via response_path) or a fully custom response_template (Go template rendered against {Args, Body}, so it can combine request-time parameters with response data the server never echoes back — e.g. building a Dovecot/Postfix map line that needs both the domain and the response's mailbox fields).

Other changes

• Harden dym ext after security review: validate --filter/--select before making any HTTP request (a malformed filter no longer fires a mutating POST first), redact the auth token from error messages even when it's embedded in the URL, bound response-body buffering to avoid unbounded memory use on a pathological response, reject extension names that would collide with built-in subcommands (list/help/completion) or contain whitespace, and replace a hand-rolled argument scan with the same run-time command-tree pattern already used by dym domain so --extensions-file handles --, repeated flags, and = correctly and is actually testable.
• Ignore .claude/ session artifacts in git.

Full Changelog: v0.3.0...v0.4.0