mirror of
https://github.com/ghostty-org/ghostty.git
synced 2026-09-03 12:50:27 +00:00
Add an explicit libghostty-vt title-report option and keep CSI 21 t disabled unless an embedder enables it. Previously, registering the general PTY write callback also caused the terminal to echo attacker-controlled window titles. This exposed embedders to command injection after user interaction. Gate the response in the shared terminal stream, append the C API option without renumbering existing values, and cover the default, opt-in, and reset behavior in Zig and C API tests.