ddidderr/ghostty-rs
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(rewrite): record final verification RV9

Browse Source
This commit is contained in:
ddidderr committed 2026-10-12 12:07:37 +02:00
1 parent 0ed59764e1
commit 6420062670
1 file changed
+52
Download Patch File Download Diff File Expand all files Collapse all files
docs/rewrite/notes/review-rv9-codex.md
+52
View File
@@ -0,0 +1,52 @@
# Codex final verification (RV9, 2026-10-12)
**All nine specific RV8 defects are resolved. Parity remains incomplete: six additional verified gap groups remain.**
Reviewed `0ed59764e19a2d9ad705f01ed362d1bb949b7ab6`. No files changed.
| RV8 finding | Status | Current-code evidence |
|---|---|---|
| 1. Windows malformed filesystem bytes | Resolved | Checked WTF-8 conversion in [osbytes.rs:417](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-os/src/osbytes.rs:417); config loading propagates failure. |
| 2. Windows process inputs accept surrogates | Resolved | Application, cwd and argv require UTF-8 in [command_windows.rs:138](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-termio/src/command_windows.rs:138); environment conversion also validates UTF-8. |
| 3. Kitty paths reject separately encoded surrogate pairs | Resolved | [osbytes.rs:186](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-os/src/osbytes.rs:186) accepts these pairs without canonical-reencoding comparison. |
| 4. Literal U+FDD0 key trigger | Resolved | Triggers decode original UTF-8 in [binding/mod.rs:179](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-input/src/binding/mod.rs:179). |
| 5. Invalid selection delimiters | Resolved | Original bytes undergo codepoint validation in [types_a.rs:638](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-config/src/types_a.rs:638). |
| 6. Invalid clipboard replacements | Resolved | UTF-8 validation precedes storage in [types_a.rs:930](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-config/src/types_a.rs:930). |
| 7. Encoded font styles/family names | Resolved | Original bytes reach Fontconfig in [discovery.rs:40](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-font/src/discovery.rs:40); CoreText validates decoded bytes. |
| 8. C title actions lose invalid bytes | Resolved | Raw title bytes reach callbacks in [action_c.rs:130](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-lib/src/action_c.rs:130). Interior NUL handling remains a separate gap below. |
| 9. D-Bus internal encoding/substitution | Resolved | Plain argument strings in [new_window.rs:55](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-apprt-gtk/src/ipc/new_window.rs:55); whole-value GLib substitution in [flatpak.rs:2](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-os/src/flatpak.rs:2). |
The fresh inventory, public-function, stub-marker and export sweep covered **461 Zig files**, including platform, C/WASM and build code. Behavioral checks included invalid-byte probes for **all 202 config fields**, 58 additional grammar cases, and targeted consumer checks. This is not exhaustive behavioral-equivalence certification.
Verified sweep findings:
1. **P2 — Interior NULs in font names panic.**
`font-family=monospace<NUL>suffix`, `font-style=Regular<NUL>suffix`, and a codepoint-map family containing NUL all make Rust exit **101**; Zig exits **0** and uses the prefix before NUL. `CString::new` rejects the bytes, then discovery asserts success. [fontconfig.rs:194](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-font/src/fontconfig.rs:194), [discovery.rs:40](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-font/src/discovery.rs:40); [Zig discovery.zig:115](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty/src/font/discovery.zig:115).
2. **P2 — Numeric grammars remain narrower than Zig’s.**
Differential probes confirm Rust rejects values Zig accepts: `window-height=0X10`, `window-height=1__0`, `font-size=1_4`, `font-size=0x1.cp+3`, `window-padding-x=1_0`, and numeric binding parameters containing underscores. Variations, metric adjustments and quick-terminal sizes also exhibit this mismatch. [cli_args.rs:526](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-config/src/cli_args.rs:526), [cli_args.rs:620](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-config/src/cli_args.rs:620), [types_b.rs:1204](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-config/src/types_b.rs:1204), [action.rs:311](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-input/src/binding/action.rs:311); [Zig args.zig:429](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty/src/cli/args.zig:429).
3. **P2 — C getters and actions delete interior NULs.**
A live C API probe loading `title=a<NUL>b` returns `"ab"`. Zig preserves the backing bytes, so a C-string consumer sees `"a"`. Title callbacks use the same deletion policy. [config_capi.rs:111](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-lib/src/config_capi.rs:111), [action_c.rs:45](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-lib/src/action_c.rs:45); [Zig c_get.zig:32](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty/src/config/c_get.zig:32).
4. **P2 — Incoming GTK new-window arguments lose Unicode whitespace.**
Rust’s `trim()` removes trailing U+00A0 from `--working-directory=/tmp/name<U+00A0>` and from titles. Zig trims only ASCII whitespace, preserving that pathname/title. Source-verified. [application.rs:1142](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-apprt-gtk/src/class/application.rs:1142); [Zig application.zig:1749](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty/src/apprt/gtk/class/application.zig:1749).
5. **P2 — Shell-command tokenization omits CR/LF separators.**
Rust splits only spaces/tabs; Zig’s `ArgIteratorGeneral` also splits CR/LF. Thus `bash<LF>-i` yields one argument in Rust and two in Zig, changing shell detection and integration. Source-verified. [command.rs:74](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-config/src/command.rs:74), [shell_integration.rs:128](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-termio/src/shell_integration.rs:128); [Zig Args.zig:895](/usr/lib/zig/std/process/Args.zig:895).
6. **P3 — Parser diagnostics differ, including a refactor regression.**
For raw `FF`, metric adjustments now report `InvalidValue` instead of Zig’s `InvalidFormat`; quick-terminal size reports `InvalidValue` instead of `MissingUnit`; `link` reports `InvalidValue` instead of `NotImplemented`. These were reproduced against both binaries. Early UTF-8 validation changes the field-specific error contract. [metric_modifier.rs:103](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-config/src/metric_modifier.rs:103), [types_b.rs:633](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-config/src/types_b.rs:633), [types_a.rs:1057](/pantheon/pfs/git/rust/ghostty-rewrite/ghostty-rs/crates/ghostty-config/src/types_a.rs:1057).
| Verdict count | Result |
|---|---:|
| RV8 resolved / partial / unresolved | **9 / 0 / 0** |
| Additional verified gap groups | **6: five P2, one P3** |
| Wholly unimplemented features verified | **0** |
| Literal C/WASM export names checked / unmatched | **159 / 0** |
| Existing-binary tests passed / environment-blocked | **464 / 3** |
| WASM Node smoke test | **Passed** |
`+show-config --default --docs` matches except for the expected debug-build `gtk-opengl-debug` value. Three test wrappers were blocked by temporary-file/build requirements; no fresh build was performed.
Native macOS execution—Metal, CoreText, AppKit/Carbon integration and platform callbacks—and native Windows execution—ConPTY, CreateProcessW, filesystem and locale behavior—remain unverifiable on this Linux machine. Source checks and portable conversion tests do not replace those runs.