From 33ea7e821cb54a6a64689bdc606603c859034aed Mon Sep 17 00:00:00 2001 From: ddidderr Date: Mon, 12 Oct 2026 12:07:37 +0200 Subject: [PATCH] docs(rewrite): record final verification RV9 --- docs/rewrite/notes/review-rv9-codex.md | 52 ++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 docs/rewrite/notes/review-rv9-codex.md diff --git a/docs/rewrite/notes/review-rv9-codex.md b/docs/rewrite/notes/review-rv9-codex.md new file mode 100644 index 0000000..17be04c --- /dev/null +++ b/docs/rewrite/notes/review-rv9-codex.md @@ -0,0 +1,52 @@ +# Codex final verification (RV9, 2026-10-12) + +**All nine specific RV8 defects are resolved. Parity remains incomplete: six additional verified gap groups remain.** + +Reviewed `0ed59764e19a2d9ad705f01ed362d1bb949b7ab6`. No files changed. + +| RV8 finding | Status | Current-code evidence | +|---|---|---| +| 1. Windows malformed filesystem bytes | Resolved | Checked WTF-8 conversion in [osbytes.rs:417](../../../crates/ghostty-os/src/osbytes.rs:417); config loading propagates failure. | +| 2. Windows process inputs accept surrogates | Resolved | Application, cwd and argv require UTF-8 in [command_windows.rs:138](../../../crates/ghostty-termio/src/command_windows.rs:138); environment conversion also validates UTF-8. | +| 3. Kitty paths reject separately encoded surrogate pairs | Resolved | [osbytes.rs:186](../../../crates/ghostty-os/src/osbytes.rs:186) accepts these pairs without canonical-reencoding comparison. | +| 4. Literal U+FDD0 key trigger | Resolved | Triggers decode original UTF-8 in [binding/mod.rs:179](../../../crates/ghostty-input/src/binding/mod.rs:179). | +| 5. Invalid selection delimiters | Resolved | Original bytes undergo codepoint validation in [types_a.rs:638](../../../crates/ghostty-config/src/types_a.rs:638). | +| 6. Invalid clipboard replacements | Resolved | UTF-8 validation precedes storage in [types_a.rs:930](../../../crates/ghostty-config/src/types_a.rs:930). | +| 7. Encoded font styles/family names | Resolved | Original bytes reach Fontconfig in [discovery.rs:40](../../../crates/ghostty-font/src/discovery.rs:40); CoreText validates decoded bytes. | +| 8. C title actions lose invalid bytes | Resolved | Raw title bytes reach callbacks in [action_c.rs:130](../../../crates/ghostty-lib/src/action_c.rs:130). Interior NUL handling remains a separate gap below. | +| 9. D-Bus internal encoding/substitution | Resolved | Plain argument strings in [new_window.rs:55](../../../crates/ghostty-apprt-gtk/src/ipc/new_window.rs:55); whole-value GLib substitution in [flatpak.rs:2](../../../crates/ghostty-os/src/flatpak.rs:2). | + +The fresh inventory, public-function, stub-marker and export sweep covered **461 Zig files**, including platform, C/WASM and build code. Behavioral checks included invalid-byte probes for **all 202 config fields**, 58 additional grammar cases, and targeted consumer checks. This is not exhaustive behavioral-equivalence certification. + +Verified sweep findings: + +1. **P2 — Interior NULs in font names panic.** + `font-family=monospacesuffix`, `font-style=Regularsuffix`, and a codepoint-map family containing NUL all make Rust exit **101**; Zig exits **0** and uses the prefix before NUL. `CString::new` rejects the bytes, then discovery asserts success. [fontconfig.rs:194](../../../crates/ghostty-font/src/fontconfig.rs:194), [discovery.rs:40](../../../crates/ghostty-font/src/discovery.rs:40); [Zig discovery.zig:115](../../../../ghostty/src/font/discovery.zig:115). + +2. **P2 — Numeric grammars remain narrower than Zig’s.** + Differential probes confirm Rust rejects values Zig accepts: `window-height=0X10`, `window-height=1__0`, `font-size=1_4`, `font-size=0x1.cp+3`, `window-padding-x=1_0`, and numeric binding parameters containing underscores. Variations, metric adjustments and quick-terminal sizes also exhibit this mismatch. [cli_args.rs:526](../../../crates/ghostty-config/src/cli_args.rs:526), [cli_args.rs:620](../../../crates/ghostty-config/src/cli_args.rs:620), [types_b.rs:1204](../../../crates/ghostty-config/src/types_b.rs:1204), [action.rs:311](../../../crates/ghostty-input/src/binding/action.rs:311); [Zig args.zig:429](../../../../ghostty/src/cli/args.zig:429). + +3. **P2 — C getters and actions delete interior NULs.** + A live C API probe loading `title=ab` returns `"ab"`. Zig preserves the backing bytes, so a C-string consumer sees `"a"`. Title callbacks use the same deletion policy. [config_capi.rs:111](../../../crates/ghostty-lib/src/config_capi.rs:111), [action_c.rs:45](../../../crates/ghostty-lib/src/action_c.rs:45); [Zig c_get.zig:32](../../../../ghostty/src/config/c_get.zig:32). + +4. **P2 — Incoming GTK new-window arguments lose Unicode whitespace.** + Rust’s `trim()` removes trailing U+00A0 from `--working-directory=/tmp/name` and from titles. Zig trims only ASCII whitespace, preserving that pathname/title. Source-verified. [application.rs:1142](../../../crates/ghostty-apprt-gtk/src/class/application.rs:1142); [Zig application.zig:1749](../../../../ghostty/src/apprt/gtk/class/application.zig:1749). + +5. **P2 — Shell-command tokenization omits CR/LF separators.** + Rust splits only spaces/tabs; Zig’s `ArgIteratorGeneral` also splits CR/LF. Thus `bash-i` yields one argument in Rust and two in Zig, changing shell detection and integration. Source-verified. [command.rs:74](../../../crates/ghostty-config/src/command.rs:74), [shell_integration.rs:128](../../../crates/ghostty-termio/src/shell_integration.rs:128); [Zig Args.zig:895](/usr/lib/zig/std/process/Args.zig:895). + +6. **P3 — Parser diagnostics differ, including a refactor regression.** + For raw `FF`, metric adjustments now report `InvalidValue` instead of Zig’s `InvalidFormat`; quick-terminal size reports `InvalidValue` instead of `MissingUnit`; `link` reports `InvalidValue` instead of `NotImplemented`. These were reproduced against both binaries. Early UTF-8 validation changes the field-specific error contract. [metric_modifier.rs:103](../../../crates/ghostty-config/src/metric_modifier.rs:103), [types_b.rs:633](../../../crates/ghostty-config/src/types_b.rs:633), [types_a.rs:1057](../../../crates/ghostty-config/src/types_a.rs:1057). + +| Verdict count | Result | +|---|---:| +| RV8 resolved / partial / unresolved | **9 / 0 / 0** | +| Additional verified gap groups | **6: five P2, one P3** | +| Wholly unimplemented features verified | **0** | +| Literal C/WASM export names checked / unmatched | **159 / 0** | +| Existing-binary tests passed / environment-blocked | **464 / 3** | +| WASM Node smoke test | **Passed** | + +`+show-config --default --docs` matches except for the expected debug-build `gtk-opengl-debug` value. Three test wrappers were blocked by temporary-file/build requirements; no fresh build was performed. + +Native macOS execution—Metal, CoreText, AppKit/Carbon integration and platform callbacks—and native Windows execution—ConPTY, CreateProcessW, filesystem and locale behavior—remain unverifiable on this Linux machine. Source checks and portable conversion tests do not replace those runs. \ No newline at end of file