The Kitty graphics file and temporary file mediums open a
client-supplied path and the Kitty specification only specifies the
blocklist for Unix-style machines.
Windows has various unsafe paths as well that we should very obviously
block. This diverges from the Kitty specification for now (I plan
on reporting this upstream and asking for feedback) but I think its the
right move for security.
Windows dangerous namespaces:
- A UNC path (`\\server\share\x`, also `//server/share/x`) makes the
process resolve the host and authenticate to it over SMB.
- The device namespaces (`\\.\`, `\\?\`, `\??\`) reach raw volumes and
named pipes, where the open connects to something or blocks.
- Reserved DOS device names (CON, NUL, COM1, ...) resolve to devices
from inside any directory.
These are now blocked.
This commit also heap allocates the path buffer because max path on
windows is around 100KB. :)
Normalize empty buffers and borrowed strings at the libghostty-vt C
boundary to null pointers.
Zig can use sentinel addresses such as 0x1 for empty slices. Returning
these pointers to Go can cause a fatal invalid-pointer error when the
runtime relocates a goroutine's stack, even though the length is zero.
Normalize empty buffers and borrowed strings at the libghostty-vt C
boundary to null pointers.
Zig can use sentinel addresses such as 0x1 for empty slices. Returning
these pointers to Go can cause a fatal invalid-pointer error when the
runtime relocates a goroutine's stack, even though the length is zero.
Fixes#14150
drawFrame called syncDisplayLink from its no-redraw path while still
holding draw_mutex, and syncDisplayLink stops the CVDisplayLink when
there is no work left. CVDisplayLinkStop is a blocking join on
CoreVideo's IO thread. On macOS the apprt also calls drawFrame from the
CoreAnimation layer display callback on the main thread, which takes the
same mutex, so any CoreVideo stall inside that stop deadlocked.
## Why
`RepeatableCommand.clone` copies `value_c` shallowly: the cloned
`Command.C` structs keep string pointers into the *source* config's
memory, so the clone only stays valid as long as its source lives. Every
other field of a config clone is a deep copy — this is the one spot
where the clone silently borrows.
The macOS app never notices because of how it rotates configs: its
clone's source is the core-owned live config, and both are replaced
together on the next reload, so a clone never outlives its source. An
embedder that clones a config and then frees the source — a legal
sequence, e.g. promoting the clone to be the new active config — reads
freed memory the next time it fetches `command-palette-entry` through
the C API. Caught by AddressSanitizer.
History: the shallow copy is as old as the C exposure itself.
`dbe6035da` introduced `RepeatableCommand` with a correct deep `clone`
(zig-side `value` only); `017021787` added the `value_c` mirror for
`ghostty_config_get`, maintaining it carefully in `init`/`parseCLI` but
extending `clone` with only the mechanical `ArrayList.clone` — the
struct array copies, the string ownership doesn't. Nothing in-tree
exercises clone-then-free-source, so it stayed latent.
## What
Rebuild the C mirror from the cloned commands using the same
`Command.cval` path `parseCLI` uses, so the clone's C strings live in
the clone's own allocation. A regression test asserts the clone's C
strings do not alias the source's while staying equal in content.
## AI disclosure
Developed with AI assistance (Claude Code). The bug was found by
AddressSanitizer while testing the Windows embedding host; the
root-cause analysis, the fix, and the regression test were produced in
an AI-assisted session, then reviewed and verified by the submitter
(ASan clean after the fix, `RepeatableCommand` tests passing).
Fixes#14150
drawFrame called syncDisplayLink from its no-redraw path while still
holding draw_mutex, and syncDisplayLink stops the CVDisplayLink when
there is no work left. CVDisplayLinkStop is a blocking join on
CoreVideo's IO thread. On macOS the apprt also calls drawFrame from the
CoreAnimation layer display callback on the main thread, which takes
the same mutex, so any CoreVideo stall inside that stop deadlocked.
Bumps
[c-hive/gha-remove-artifacts](https://github.com/c-hive/gha-remove-artifacts)
from 1.4.0 to 1.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/c-hive/gha-remove-artifacts/releases">c-hive/gha-remove-artifacts's
releases</a>.</em></p>
<blockquote>
<h2>v1.8.0</h2>
<p>Enhancements:</p>
<ul>
<li>New <code>skip-recent-commits</code> input keeps every artifact of
the N most recent commits, regardless of how many artifacts each commit
produced. Applied before <code>skip-recent</code>, so the two can be
combined. Fixes <a
href="https://redirect.github.com/c-hive/gha-remove-artifacts/issues/28">#28</a></li>
<li><code>GITHUB_TOKEN</code> can now be set on both <code>env:</code>
and <code>with:</code> (for example when it is exported for all steps)
without the action failing. The input takes precedence. Fixes <a
href="https://redirect.github.com/c-hive/gha-remove-artifacts/issues/48">#48</a></li>
</ul>
<h2>v1.7.0</h2>
<p>Enhancements:</p>
<ul>
<li>New <code>dry-run</code> input: logs which artifacts would be
removed without deleting anything.</li>
<li>Stricter input validation. <code>age</code> now rejects fractional
amounts and units that are not durations (for example <code>30 D</code>,
which moment silently treated as zero); <code>skip-recent</code> and
<code>max-retries</code> must be non-negative integers. Previously such
values could make every artifact eligible for deletion.</li>
<li>Artifacts without commit information are reported separately from
tagged ones when <code>skip-tags</code> is on.</li>
</ul>
<p>Maintenance:</p>
<ul>
<li>Rewritten in TypeScript under <code>src/</code>, bundled with
esbuild</li>
<li>Unit tests for input parsing and the cleanup plan, plus end-to-end
tests against a mock GitHub API covering deletion, rate limit retries
and failure handling</li>
<li>CI split into lint, typecheck, test, build and run jobs</li>
<li>Dropped dependencies: yn, dotenv-safe, cross-env,
eslint-plugin-import</li>
</ul>
<h2>v1.6.0</h2>
<p>Enhancements:</p>
<ul>
<li>Artifacts are now listed repo-wide instead of per workflow run. This
cuts API requests by roughly two orders of magnitude and removes the
hardcoded 90-day window, so artifacts on repositories with longer
retention are now cleaned up too. Fixes <a
href="https://redirect.github.com/c-hive/gha-remove-artifacts/issues/62">#62</a></li>
<li>A failed deletion no longer aborts the run: remaining artifacts are
still processed and the action fails at the end with a count.</li>
<li>With <code>skip-tags</code>, artifacts without commit information
are kept rather than deleted.</li>
<li>The log ends with a summary of removed and skipped artifacts. Fixes
<a
href="https://redirect.github.com/c-hive/gha-remove-artifacts/issues/21">#21</a></li>
</ul>
<p>Maintenance:</p>
<ul>
<li>CI checks that <code>dist/</code> matches the source instead of
auto-committing it</li>
<li>Removed CodeQL workflow, pre-commit hooks and
eslint-plugin-import</li>
<li>Dependency purposes documented in <code>package.json</code></li>
</ul>
<h2>v1.5.0</h2>
<p>Enhancements:</p>
<ul>
<li>New <code>max-retries</code> input caps how often a rate-limited
request is retried before the action fails. <strong>Default: 5.</strong>
Previously requests were retried indefinitely; set a larger value to
keep the old behaviour. Fixes <a
href="https://redirect.github.com/c-hive/gha-remove-artifacts/issues/36">#36</a>,
<a
href="https://redirect.github.com/c-hive/gha-remove-artifacts/issues/49">#49</a>,
<a
href="https://redirect.github.com/c-hive/gha-remove-artifacts/issues/51">#51</a></li>
<li>Action runtime updated to Node 24 (<a
href="https://redirect.github.com/c-hive/gha-remove-artifacts/issues/63">#63</a>)</li>
</ul>
<p>Maintenance:</p>
<ul>
<li>All dependencies upgraded (<code>@actions/core</code> 3,
<code>@octokit/action</code> 8, <code>@octokit/plugin-throttling</code>
11, moment 2.30). <code>pnpm audit</code> reports no known
vulnerabilities.</li>
<li>Source converted to ESM, bundled with <code>@vercel/ncc</code></li>
<li>Tooling: pnpm, ESLint 10, Prettier 3, CI on Node 24</li>
<li>Docs: <code>action.yml</code> description, updated retention docs
link</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="62c2fbea93"><code>62c2fbe</code></a>
Bump version to 1.8.0</li>
<li><a
href="449a616233"><code>449a616</code></a>
Add skip-recent-commits input and accept GITHUB_TOKEN from env and
input</li>
<li><a
href="4bff15786b"><code>4bff157</code></a>
Bump version to 1.7.0</li>
<li><a
href="a52e55eb4f"><code>a52e55e</code></a>
Add end-to-end tests against a mock GitHub API</li>
<li><a
href="03f14e2351"><code>03f14e2</code></a>
Simplify config parsing, logging and tsconfig</li>
<li><a
href="04de7b0694"><code>04de7b0</code></a>
Address review findings on the TypeScript rewrite</li>
<li><a
href="8b74b1b6fc"><code>8b74b1b</code></a>
Rewrite in TypeScript, add tests, merge CI workflows</li>
<li><a
href="73aaf4a5bf"><code>73aaf4a</code></a>
Bump version to 1.6.0</li>
<li><a
href="c4da97c8ee"><code>c4da97c</code></a>
Ignore CLAUDE.local.md</li>
<li><a
href="614c11c542"><code>614c11c</code></a>
Describe each dependency in package.json</li>
<li>Additional commits viewable in <a
href="44fc7acaf1...62c2fbea93">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Supersedes #14071 (just additional review and local re-generation/re-org
of needed headers).
This updates our own bundled fontconfig (for static builds) to 2.18.3.
Note that fontconfig has changed their build process a bit since this
has been updated last; they are leaning on the Autoconf (and Meson as
they are now deprecating use of Autoconf) toolchain(s) to now generate a
number of headers that are a part of the build process.
Since servicing this dependency in an effort to keep the build pure Zig
is starting to get more complex, I've added some documentation on how to
actually get a snapshot of the fontconfig repository in a state where
files can be looked for and copied over as needed. Otherwise, we might
want to in the future consider removing this altogether and just rely on
system integrations.
Cloning value_c copied Command.C structs whose string pointers
still referenced the source config's memory; once the source was
freed, an embedded host reading the command list after a config
replace (ghostty_config_clone + ghostty_config_free of the old
one) hit use-after-free, caught by ASan. Rebuild the mirror from
the cloned commands with the same cval path parseCLI uses, and add
a regression test asserting the clone's C strings do not alias the
source's.
Legacy Alt-as-Escape now prefixes the complete UTF-8 sequence for
non-ASCII input. When text is unavailable, the encoder falls back to the
UTF-8 encoding of the unshifted codepoint.
This fixes 16 xterm legacy cases and eight fixterms cases without
changing MOK2. The cases I'm talking about are in my comparison
harness...
The helper now writes Escape and the selected payload directly. It
preserves macOS Option-as-Alt translation and shifted ASCII behavior.
Legacy Alt-as-Escape now prefixes the complete UTF-8 sequence for
non-ASCII input. When text is unavailable, the encoder falls back to
the UTF-8 encoding of the unshifted codepoint.
This fixes 16 xterm legacy cases and eight fixterms cases without changing
MOK2. The cases I'm talking about are in my comparison harness...
The helper now writes Escape and the selected payload directly. It
preserves macOS Option-as-Alt translation and shifted ASCII behavior.
Follow-up to #14144
I wrote a harness that created all possible US-layout keyboard input
combinations with xterm patch 411 and Ghostty main and compared their
full encoding sequence. There are various miscompatibilities on purpose
but these were definitely bugs I wanted to address first.
- Normal-mode numeric keypad keys now preserve their numeric output
instead of falling through to generic MOK2 encoding. Application keypad
behavior is unchanged.
- F13 through F25 now emit their xterm-compatible function-key
sequences, including modifier parameters.
- Help and Context Menu now emit editing-key codes 28 and 29.
- Alt+Escape now emits `CSI 27;3;27~` under MOK2 while retaining the
traditional `ESC ESC` encoding otherwise.
After these changes, 2,081 of 2,096 cases match xterm exactly. The
remaining 15 differences are intentional.
#7425
Control-modified characters use xterm's MOK2 encoding.
I incorrectly believed previously that MOK2 ctrl chars were still
encoded as C0 bytes. This is wrong. I'm going to do a more in depth
audit if possible with every possible key combination against xterm to
see where we diverge but this fixes this for now without regressing any
tests.
Background: https://invisible-island.net/xterm/modified-keys.html
#7425
Control-modified characters use xterm's MOK2 encoding.
I incorrectly believed previously that MOK2 ctrl chars were still encoded
as C0 bytes. This is wrong. I'm going to do a more in depth audit if
possible with every possible key combination against xterm to see where
we diverge but this fixes this for now without regressing any tests.
Background: https://invisible-island.net/xterm/modified-keys.html
This focuses explicitly on the non-mmap allocations for a
`ghostty_terminal_new` result. The result is that we lower this portion
of the memory by almost half. The total benefit is smaller since 70% of
a terminal is mmap'd allocations, but this still yields an absolute ~5KB
savings on macOS on every new terminal (not just empty, but also with a
normal prompt and so on).
Four changes to make it happy, broken down into individual commits.
Nothing crazy:
- **Page list nodes are pooled individually.** The node pool was a
`std.heap.MemoryPool`, which sits on an arena that preheats and grows
1.5x, so we paid for wasted space. Nodes now come from `UntouchedPool`
(the same pool as page buffers) with a preheat of one, so the cost is
exactlyone node (well, exactly one bucket element size in whatever
allocator).
- **Pin pool and tracked pin set are sized for two pins.** Every screen
tracks exactly a viewport pin and a cursor pin at creation, but we
preheated eight pins and let the tracked pin map grow to 17 slots on the
first insert via doubling.
- **The kitty temp dir path is allocated only when set.** The C wrapper
embedded a 1 KiB `max_path_bytes` buffer that only embedders that set
`kitty_image_medium_temp_file` ever wrote to.
- **The default palette is shared instead of copied.** `DynamicPalette`
carried two full 1 KiB palettes, `current` and `original`, and
`original` was almost always the built-in default. It is now a pointer
to the shared built-in default, or to an allocator-owned copy when a
custom default is set. This introduces a new OOM path but we gracefully
handle it by either ignoring or resetting.
Memory measurements:
| Per terminal | Before | After |
|---------------------------------------------|----------|----------|
| phys_footprint delta, fresh | 30,066 B | 25,069 B |
| phys_footprint delta, styled prompt written | 47,023 B | 41,944 B |
| malloc zone bytes dirtied, fresh | 12,698 B | 7,782 B |
| malloc blocks live after `terminal_new` | 11,904 B | 6,688 B |
| malloc blocks live after the prompt | 12,320 B | 7,104 B |
I ran `ghostty-bench +terminal-stream` on a 500 MB ascii corpus, main vs
this branch interleaved, and there is no noticeable change.
**AI usage:** Fable did validation of the work, I did the
implementations, commit messages, and PR notes.
This updates all our page data structures so that the `0` value
(literally `@memset(0)`) means empty. This way, when we initialize a new
page via mmap (OS-guaranteed zeroed), we don't need to write to it, and
don't trigger the kernel to physically map the memory.
From Ghostty 1.3.1, our empty terminal physical memory usage goes from
128 KB to 48 KB (#14130) to 16 KB (this PR). And even with an empty
prompt written on my machine, it holds at 16KB, only increasing to two
pages (32 KB) with 24 rows written.
Here are some measurements.
| Per terminal | Before (macOS) | After (macOS) | Before (Linux) | After
(Linux) |
|-------------------------------------------------------|----------------|---------------|----------------|---------------|
| Page-list memory dirty, fresh | 48 KiB | 16 KiB | 24 KiB | 8 KiB |
| Page-list memory dirty, 24 visible rows written | 64 KiB | 32 KiB | 36
KiB | 20 KiB |
Note macOS uses 16KB pages and Linux generally uses 4 KB pages.
I ran `ghostty-bench +terminal-stream` main vs this branch and with
every normal workload the results are within noise (sometimes faster
sometimes slower).
**AI usage:** It was used as a judge/validator. The actual changes were
me, commit messages and PR messages all me.
This replaces the `std.heap.MemoryPool` used for page buffers with a
custom pool called `UntouchedPool`. This keeps its free list in a side
array and never reads/writes items until `create()`. This means that
demand-driven allocations (like mmaped pages) don't incur physical costs
until they're actually used.
The standard `std.heap.MemoryPool` uses an intrusive linked list for its
items which causes every item to be touched, which forces a full page-in
of memory.
It turns out we also had a lot of assertions and logic to work around
this in various ways (size of rows, asserting we overwrite the free list
entry, etc.) that we can now remove because of this.
For an 80x24 terminal on macOS (16 KB pages):
| Per terminal | Before | After |
|------------------------------|----------|----------|
| Page-list memory dirty | 128 KiB | 48 KiB |
| Process phys_footprint delta | 143 KiB | 62 KiB |
| Page-list virtual size | 2208 KiB | 1600 KiB |
The remaining 48 KB is the active page, because we sprinkle metadata
around the page which forces every page to be paged in. I'm going to
follow this up with some work trying to move all our metadata to the
front of the page so we only page one in until the rest is needed, but
not sure if its achievable.
Micro-benchmarks on the pool show that its twice the speed (slower) to
create/free due to the side list, but in an actual `+terminal-stream`
benchmark churning through pages, there is no measurable difference. I
think its a good trade.
This replaces the `std.heap.MemoryPool` used for page buffers with
a custom pool called `UntouchedPool`. This keeps its free list in a side
array and never reads/writes items until `create()`. This means that
demand-driven allocations (like mmaped pages) don't incur physical costs
until they're actually used.
The standard `std.heap.MemoryPool` uses an intrusive linked list for
its items which causes every item to be touched, which forces a full
page-in of memory.
It turns out we also had a lot of assertions and logic to work around
this in various ways (size of rows, asserting we overwrite the free
list entry, etc.) that we can now remove because of this.
For an 80x24 terminal on macOS (16 KB pages):
| Per terminal | Before | After |
|------------------------------|----------|----------|
| Page-list memory dirty | 128 KiB | 48 KiB |
| Process phys_footprint delta | 143 KiB | 62 KiB |
| Page-list virtual size | 2208 KiB | 1600 KiB |
The remaining 48 KB is the active page, because we sprinkle metadata
around the page which forces every page to be paged in. I'm going to
follow this up with some work trying to move all our metadata to the
front of the page so we only page one in until the rest is needed,
but not sure if its achievable.
Micro-benchmarks on the pool show that its twice the speed (slower) to
create/free due to the side list, but in an actual `+terminal-stream`
benchmark churning through pages, there is no measurable difference. I
think its a good trade.
This fixes a regression of 9a6469743 introduced in 6e8ed4e8b.
With this fix the mouse pointer will be restored to the previous (which
could have be set to something else via OSC22), not a hardcoded .text or
.default.
It also will change the cursor to a text selection if shift is held even
without mouse tracking, I think this is the expected behavior when a
cursor is set via OSC22. (Kitty additionaly, once you start selecting
changes to text (I-beam), this would be a follow-up if we desire to
behave like kitty with OSC22 pointers).
