refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-apprt-gtk/src/class/application.rs

@@ -401,10 +401,7 @@ impl Application {
         // Keep the inherited bytes: LANG need not be UTF-8.
         let saved_language = std::env::var_os("LANG");
         if let Some(language) = &config.language {
-            set_env(
-                "LANG",
-                ghostty_os::osbytes::EncodedOs::from_encoded(language.clone()).to_os(),
-            );
+            set_env("LANG", language.to_os());
         }
 
         // Set gettext global domain to be our app so that our unqualified
@@ -447,7 +444,9 @@ impl Application {
 
         // Our app ID determines uniqueness and maps to our desktop file.
         let app_id: String = match &config.class {
-            Some(class) if gio::Application::id_is_valid(class) => class.clone(),
+            Some(class) if gio::Application::id_is_valid(&class.to_text_lossy()) => {
+                class.to_text_lossy()
+            }
             Some(_) => {
                 log::warn!("invalid 'class' in config, ignoring");
                 crate::APPLICATION_ID.to_owned()
@@ -1102,7 +1101,7 @@ impl Application {
         let mut working_directory: Option<ghostty_os::osbytes::EncodedOs> = None;
         let mut title: Option<String> = None;
         let mut command: Option<Command> = None;
-        let mut args: Vec<String> = Vec::new();
+        let mut args: Vec<ghostty_os::osbytes::EncodedOs> = Vec::new();
 
         'overrides: {
             // were we given a parameter?
@@ -1121,7 +1120,7 @@ impl Application {
                 log::debug!("new-window argument: {i} {s}");
 
                 if e_seen {
-                    args.push(s.clone());
+                    args.push(ghostty_os::osbytes::EncodedOs::from_plain_text(s));
                     continue;
                 }
                 if s == "-e" {
@@ -1138,9 +1137,9 @@ impl Application {
                     continue;
                 }
                 if let Some(v) = s.strip_prefix("--working-directory=") {
-                    // IPC carries the encoded form of the OS string.
+                    // D-Bus strings are plain UTF-8, including literal U+FDD0.
                     working_directory =
-                        Some(ghostty_os::osbytes::EncodedOs::from_encoded(v.trim()));
+                        Some(ghostty_os::osbytes::EncodedOs::from_plain_text(v.trim()));
                     continue;
                 }
                 if let Some(v) = s.strip_prefix("--title=") {
@@ -1449,7 +1448,7 @@ impl Application {
                 true
             }
             Action::SetTitle(v) => {
-                tgt.with_surface_void("set_title", |s| s.set_title(Some(&v.title)));
+                tgt.with_surface_void("set_title", |s| s.set_title(Some(&v.title.to_text_lossy())));
                 true
             }
             Action::SetTabTitle(v) => {
@@ -1462,11 +1461,8 @@ impl Application {
                         log::warn!("surface is not in a tab, ignoring set_tab_title");
                         return false;
                     };
-                    tab.set_title_override(if v.title.is_empty() {
-                        None
-                    } else {
-                        Some(&v.title)
-                    });
+                    let title = v.title.to_text_lossy();
+                    tab.set_title_override(if title.is_empty() { None } else { Some(&title) });
                     true
                 })
             }

crates/ghostty-apprt-gtk/src/class/command_palette.rs

@@ -110,9 +110,7 @@ mod command_imp {
         fn prop_get_title(&self) -> Option<String> {
             let mut data = self.data.borrow_mut();
             match &mut *data {
-                CommandData::Regular { command } => {
-                    Some(ghostty_os::osbytes::config_str_to_text(&command.title))
-                }
+                CommandData::Regular { command } => Some(command.title.to_text_lossy()),
                 CommandData::Jump { surface, title, .. } => {
                     if let Some(t) = title {
                         return Some(t.clone());
@@ -127,9 +125,7 @@ mod command_imp {
         fn prop_get_description(&self) -> Option<String> {
             let mut data = self.data.borrow_mut();
             match &mut *data {
-                CommandData::Regular { command } => Some(ghostty_os::osbytes::config_str_to_text(
-                    &command.description,
-                )),
+                CommandData::Regular { command } => Some(command.description.to_text_lossy()),
                 CommandData::Jump {
                     surface,
                     description,

crates/ghostty-apprt-gtk/src/class/config.rs

@@ -8,6 +8,27 @@ use std::{cell::RefCell, sync::Arc};
 use ghostty_config::config::Config as CoreConfig;
 use gtk::{glib, glib::subclass::prelude::*};
 
+/// GTK accepts UTF-8, while the diagnostic formatter transports original bytes.
+/// Upstream inserts each diagnostic separately, skipping invalid text but still
+/// inserting its newline, and skips diagnostics exceeding its 4095-byte buffer.
+fn diagnostics_text(config: &CoreConfig) -> String {
+    let mut text = String::new();
+    for diag in config.diagnostics.items() {
+        let bytes = ghostty_os::osbytes::config_str_to_bytes(&diag.to_string());
+        if bytes.len() > 4095 {
+            log::warn!("diagnostic exceeds GTK buffer capacity");
+            continue;
+        }
+        if !bytes.contains(&0)
+            && let Ok(line) = std::str::from_utf8(&bytes)
+        {
+            text.push_str(line);
+        }
+        text.push('\n');
+    }
+    text
+}
+
 mod imp {
     use gtk::{
         glib,
@@ -57,15 +78,7 @@ mod imp {
                 return None;
             }
             let buf = gtk::TextBuffer::new(None);
-            let mut text = String::new();
-            for diag in config.diagnostics.items() {
-                if let Err(err) = diag.format(&mut text) {
-                    log::warn!("error writing diagnostic to buffer err={err}");
-                    continue;
-                }
-                text.push('\n');
-            }
-            buf.set_text(&text);
+            buf.set_text(&super::diagnostics_text(&config));
             Some(buf)
         }
     }
@@ -125,6 +138,20 @@ impl Default for Config {
 mod tests {
     use super::*;
 
+    #[test]
+    fn diagnostics_display_original_text_and_skip_invalid_utf8() {
+        let mut config = CoreConfig::default();
+        config
+            .load_iter(&mut ghostty_config::cli_args::LineIterator::new(
+                b"font-size=\xef\xb7\x90\xc3\xa9\nfont-size=\xff\n".as_slice(),
+            ))
+            .expect("parse diagnostics");
+        let text = diagnostics_text(&config);
+        assert!(text.contains("invalid value \"\u{fdd0}é\""));
+        assert!(!text.contains("\u{fdd0}\u{fdd0}"));
+        assert!(text.ends_with("\n\n"));
+    }
+
     #[test]
     fn ghostty_config() {
         // No display needed; GObject only.

crates/ghostty-apprt-gtk/src/class/surface.rs

@@ -278,7 +278,7 @@ impl Surface {
             if ghostty_apprt::surface::should_inherit_working_directory(context, &config_obj.get())
                 && let Some(pwd) = parent.get_pwd()
             {
-                imp.pwd.replace(Some(pwd.into_encoded()));
+                imp.pwd.replace(Some(pwd));
                 self.notify("pwd");
             }
         }
@@ -391,7 +391,7 @@ impl Surface {
         self.notify("key-table");
 
         match value {
-            KeyTable::Activate(name) => imp.key_tables.borrow_mut().push(name.clone()),
+            KeyTable::Activate(name) => imp.key_tables.borrow_mut().push(name.to_text_lossy()),
             KeyTable::Deactivate => {
                 imp.key_tables.borrow_mut().pop();
             }
@@ -1615,21 +1615,13 @@ impl Surface {
 
     /// Returns the pwd property.
     pub fn get_pwd(&self) -> Option<ghostty_os::osbytes::EncodedOs> {
-        // The GObject `pwd` property is a (UTF-8) string, so it stores the
-        // encoded form of the OS string; this accessor is the only place it
-        // is converted back to the typed value.
-        self.imp()
-            .pwd
-            .borrow()
-            .clone()
-            .map(ghostty_os::osbytes::EncodedOs::from_encoded)
+        // The typed backing retains bytes; the GObject property renders text.
+        self.imp().pwd.borrow().clone()
     }
 
     /// Set the pwd for this surface, copies the value.
     pub fn set_pwd(&self, pwd: Option<&ghostty_os::osbytes::EncodedOs>) {
-        self.imp()
-            .pwd
-            .replace(pwd.map(|p| p.as_encoded().to_owned()));
+        self.imp().pwd.replace(pwd.cloned());
         self.notify("pwd");
     }
 
@@ -1822,7 +1814,10 @@ impl Surface {
             let volume = config.bell_audio_volume.clamp(0.0, 1.0);
 
             // The config path is an encoded OS string: decode it first.
-            let path = path.to_path();
+            let Ok(path) = path.to_path() else {
+                log::warn!("invalid bell audio path: BadPathName");
+                return;
+            };
             debug_assert!(path.is_absolute());
             let media_file = gtk::MediaFile::for_filename(&path);
 
@@ -2403,8 +2398,10 @@ impl RtSurface for RtSurfaceHandle {
         None
     }
 
-    fn get_title(&self) -> Option<String> {
-        self.gobj().and_then(|s| s.get_title())
+    fn get_title(&self) -> Option<ghostty_os::osbytes::EncodedOs> {
+        self.gobj()
+            .and_then(|s| s.get_title())
+            .map(ghostty_os::osbytes::EncodedOs::from)
     }
 
     fn get_content_scale(&self) -> ContentScale {
@@ -2843,8 +2840,8 @@ mod imp {
         /// If this is set prior to initialization then the surface will
         /// start in this pwd. If it is set after, it has no impact on the
         /// core surface.
-        #[property(get, set, nullable)]
-        pub pwd: RefCell<Option<String>>,
+        #[property(get = Self::pwd_text, set = Self::set_pwd_text, type = Option<String>, nullable)]
+        pub pwd: RefCell<Option<ghostty_os::osbytes::EncodedOs>>,
 
         /// The title of this surface, if any has been set.
         #[property(get, set, nullable)]
@@ -3068,6 +3065,18 @@ mod imp {
     }
 
     impl Surface {
+        fn pwd_text(&self) -> Option<String> {
+            self.pwd
+                .borrow()
+                .as_ref()
+                .map(ghostty_os::osbytes::EncodedOs::to_text_lossy)
+        }
+
+        fn set_pwd_text(&self, value: Option<String>) {
+            self.pwd
+                .replace(value.map(ghostty_os::osbytes::EncodedOs::from));
+        }
+
         fn mouse_shape_prop(&self) -> i32 {
             self.mouse_shape.get() as i32
         }
@@ -3388,7 +3397,7 @@ mod imp {
                 // Binding payloads are config strings: the needle is plain
                 // UI text, so escape it instead of decoding it.
                 &ghostty_input::binding::Action::Search(
-                    ghostty_os::osbytes::valid_str_to_config_string(&needle.unwrap_or_default()),
+                    ghostty_os::osbytes::EncodedOs::from_plain_text(&needle.unwrap_or_default()),
                 ),
             ) {
                 log::warn!("unable to perform search action err={err}");

crates/ghostty-apprt-gtk/src/class/tab.rs

@@ -315,7 +315,12 @@ mod imp {
             // exists, otherwise the overridden title if it exists,
             // otherwise the terminal title if it exists, otherwise a
             // default string.
-            let config_title = config.as_ref().and_then(|c| c.get().title.clone());
+            let config_title = config.as_ref().and_then(|c| {
+                c.get()
+                    .title
+                    .as_ref()
+                    .map(ghostty_os::osbytes::EncodedOs::to_text_lossy)
+            });
             let plain = tab_override
                 .or(surface_override)
                 .or(terminal)

crates/ghostty-apprt-gtk/src/class/window.rs

@@ -313,7 +313,7 @@ mod imp {
                 // so that any applications inspecting the window states see
                 // an immediate title set when the window appears.
                 if let Some(title) = &config.title {
-                    obj.set_title(Some(&ghostty_os::osbytes::config_str_to_text(title)));
+                    obj.set_title(Some(&title.to_text_lossy()));
                 }
             }
 

crates/ghostty-apprt-gtk/src/css.rs

@@ -113,6 +113,13 @@ impl CssProviders {
                 Path::Optional(path) => (path.to_path(), true),
                 Path::Required(path) => (path.to_path(), false),
             };
+            let path = match path {
+                Ok(path) => path,
+                Err(error) => {
+                    log::warn!("invalid custom CSS path: {error}");
+                    continue;
+                }
+            };
             let shown = path.display();
             let meta = match std::fs::metadata(&path) {
                 Ok(m) => m,
@@ -215,7 +222,7 @@ pub fn runtime_css(config: &Config, gtk_416: bool) -> String {
     }
 
     if let Some(family) = &config.window_title_font_family {
-        let family = ghostty_os::osbytes::config_str_to_text(family);
+        let family = family.to_text_lossy();
         let _ = write!(
             out,
             ".window headerbar {{\n  font-family: \"{family}\";\n}}\n"

crates/ghostty-apprt-gtk/src/ipc/new_window.rs

@@ -16,7 +16,7 @@
 //! ```
 
 use ghostty_apprt::ipc::{Error, NewWindow, Target};
-use gtk::prelude::*;
+use gtk::glib;
 
 use super::dbus::DBus;
 
@@ -35,9 +35,78 @@ pub fn new_window(target: &Target, value: &NewWindow) -> Result<bool, Error> {
         // parameter is an array of strings that contain the arguments. They
         // will be sent to the main Ghostty instance and interpreted as CLI
         // arguments.
-        dbus.add_parameter(&arguments.to_variant());
+        dbus.add_parameter(&arguments_variant(arguments));
     }
 
     dbus.send()?;
     Ok(true)
 }
+
+/// Zig constructs each GVariant string from serialized bytes including its NUL.
+/// Keep valid wire bytes unchanged. Zig marks these strings trusted, causing
+/// GIO to abort when serializing invalid UTF-8 or an interior NUL. Fail the same
+/// way explicitly: an untrusted GVariant would silently substitute an empty
+/// string, while a malformed trusted variant would violate Rust GLib's contract.
+fn arguments_variant(arguments: &[Vec<u8>]) -> glib::Variant {
+    glib::Variant::array_from_iter_with_type(
+        glib::VariantTy::STRING,
+        arguments.iter().map(|arg| {
+            if arg.contains(&0) || std::str::from_utf8(arg).is_err() {
+                log::error!("invalid D-Bus string in new-window arguments");
+                std::process::abort();
+            }
+            let mut bytes = arg.clone();
+            bytes.push(0);
+            glib::Variant::from_bytes_with_type(
+                &glib::Bytes::from_owned(bytes),
+                glib::VariantTy::STRING,
+            )
+        }),
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+    #[cfg(unix)]
+    #[test]
+    fn invalid_dbus_strings_fail_without_substitution() {
+        use std::os::unix::process::ExitStatusExt;
+        const CHILD: &str = "GHOSTTY_TEST_INVALID_DBUS_VALUE";
+        if let Ok(kind) = std::env::var(CHILD) {
+            let value: &[u8] = if kind == "utf8" {
+                b"--title=bad\xff"
+            } else {
+                b"--title=bad\0tail"
+            };
+            arguments_variant(&[value.to_vec()]);
+            panic!("invalid D-Bus argument must abort like Zig/GIO");
+        }
+        for kind in ["utf8", "nul"] {
+            // Disable core dumps in the child without changing this test process.
+            let result = std::process::Command::new("/bin/sh")
+                .args(["-c", "ulimit -c 0; exec \"$@\"", "ghostty-dbus-test"])
+                .arg(std::env::current_exe().unwrap())
+                .args([
+                    "--exact",
+                    "ipc::new_window::tests::invalid_dbus_strings_fail_without_substitution",
+                ])
+                .env(CHILD, kind)
+                .output()
+                .unwrap();
+            assert_eq!(result.status.signal(), Some(libc::SIGABRT));
+        }
+    }
+
+    #[test]
+    fn arguments_are_plain_dbus_strings_not_escape_encoded() {
+        let argument = "--working-directory=/tmp/\u{fdd0}é";
+        let variant = arguments_variant(&[argument.as_bytes().to_vec()]);
+        assert_eq!(variant.get::<Vec<String>>().unwrap(), [argument]);
+        assert_eq!(
+            variant.child_value(0).data(),
+            [argument.as_bytes(), b"\0"].concat()
+        );
+    }
+}

crates/ghostty-apprt-gtk/src/winproto/wayland.rs

@@ -525,7 +525,7 @@ impl Window {
             QuickTerminalLayer::Background => layer_shell::Layer::Background,
         });
         window.set_namespace(Some(
-            ghostty_os::osbytes::config_str_to_text(&config.gtk_quick_terminal_namespace).as_str(),
+            config.gtk_quick_terminal_namespace.to_text_lossy().as_str(),
         ));
 
         window.set_keyboard_mode(match config.quick_terminal_keyboard_interactivity {

crates/ghostty-apprt-gtk/src/winproto/x11.rs

@@ -118,7 +118,7 @@ impl App {
         let xlib_display = unsafe { x11_display.xdisplay() };
 
         let program_name = match &config.x11_instance_name {
-            Some(pn) => pn.clone(),
+            Some(pn) => pn.to_text_lossy(),
             None if cfg!(debug_assertions) => "ghostty-debug".to_string(),
             None => "ghostty".to_string(),
         };