fix(tui): preserve editor results when terminal restoration fails

Own the temporary prompt file through completion and retain saved edits while reporting restoration errors.

refactor(cli): centralize HTTP response ownership

Keep bounded reads and stream cleanup in shared helpers while preserving endpoint limits and status handling.

feat(extensions): quarantine an extension the daemon cannot run

One broken extension used to stop the daemon: a failing initialiser, a blank or repeated name, a missing requirement, or a default selection it made invalid all aborted the boot. Loading extensions nobody here wrote makes that the wrong trade. install now answers the extensions that work and the ones it quarantined with their reasons. Quarantine cascades through requirements, so what needed an absent extension goes with it, and only storage the host owns still stops the boot. A quarantined extension is in no session's selection, is listed by /extensions with its reason, and enabling it is refused with that reason. The picker shows it as bad and will not toggle it.

feat(extensions): refuse broken plugins instead of dying with them

A tool that errors or raises used to end the turn, and an extension that failed to load or prepare used to take the whole session. Third-party extensions run in our processes, so neither can stay fatal. Tool invocation answers Result(Output, Failure): Refused(reason) becomes the call's result and the turn continues, Fatal(reason) ends it, which only the python tool uses when a cell's source or outcome will not store. A tool that raises is refused with its crash and an unknown-effects note. Composition leaves out a context plugin that will not load, a managed plugin that fails to prepare, and a contribution colliding with another's tool, command, module, or route, each with a warning the session shows. Enabling an extension by name still fails with its reason, and so does a settings refresh that breaks something that was working. Observers, close callbacks, command handlers, and compaction prepare are guarded too, through the new shared albedo/harness/protect.

refactor(cli): migrate commands to Cobra

Separate CLI workflows, terminal interaction, and storage cleanup.

fix(tui): capture background command inputs

lcm: dont error on nonexistent IDs

fix(cli): share strict JSON decoding for live previews

Use encoding/json for escapes and surrogate pairs. Keep incremental boundary tracking and TUI tab formatting.

fix(tui): close clipboard stdout on cancellation

fix(tui): enforce markdown cache admission budget

Bound retained key and rendered text to 1 MiB per generation. Rejecting a 4 MiB entry now allocates zero bytes instead of copying 4 MiB.

docs: require full gopls analysis for Go changes

refactor(cli): resolve remaining gopls diagnostics

perf(tui): render only visible session rows

Full view: O(n²) -> O(n+v). Temporary list output: O(n) -> O(v). 5,000 sessions, 16 visible rows: list rendering 124 ms -> 0.23 ms, allocations 3.8 MB -> 11 KB.

perf(tui): index session and archive lookups

Session lookup: O(n) -> expected O(1). Archive membership across a rebuild: O(n*a) -> O(n+a). Sorting is unchanged.

feat(cli): add albedo -p, albedo models, and a readable sessions list

albedo -p <prompt> runs one turn in a new session in the current directory, or in an existing one with --session, and prints only the final assistant text. A failed or interrupted turn exits non-zero with its error; ctrl-c and the opt-in --timeout stop the turn they started. --model takes exact ids the way agent spawn does: provider/model, or a bare id from the active provider, else the one provider offering it. albedo models lists every provider/model. On an existing session the switch goes through the new POST /sessions/:id/model (capability session_model), which unlike /model leaves the default for new sessions alone. albedo sessions hides archived sessions and prints an aligned table.

feat(paperclips): let the model resolve a vent it fixed, with a note

docs: say how to get ruff outside nix

properly tell model to await jobs

perf(tui): cache visible agent tail rows

Unchanged tail wrapping: O(B) -> O(1), for B retained bytes.

perf(tui): bound agent previews and decode streams incrementally

Stream accumulation and argument decoding: O(n²) -> O(n) time. Preview storage: O(n) -> O(1) per agent with fixed limits.

perf(cli): reduce struct padding

refactor(tui): replace pick helpers with explicit branches

UTF-16 counting uses O(1) auxiliary space instead of O(n). Time remains O(n).

test(cli): declare Unix requirements and check scanner errors

refactor(cli): simplify validation and error handling

fix(cli): handle clipboard exits and reap subprocesses

Kill oversized clipboard writers before waiting and report exit failures.

perf(cli): select sessions with constant space

Use O(1) auxiliary space instead of O(n), with O(n) time. Copy the selected session so the chat does not retain the whole list.

cli: look for a starting daemon every 10ms instead of every 100ms

Signed-off-by: dawn <90008@klbr.net>

e2e: hold the live toggles test's busy turn on an event instead of a two-second reply

Signed-off-by: dawn <90008@klbr.net>

quota: test the backoff's growth and caps as arithmetic, and keep only one backoff wait in the e2e cadence test

Signed-off-by: dawn <90008@klbr.net>

cli: start the daemon on the open-file limit the CLI raised, not macOS's 256

Signed-off-by: dawn <90008@klbr.net>