refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-font/src/codepoint_map.rs

@@ -16,7 +16,7 @@ mod tests {
 
     fn desc(family: &str) -> Descriptor {
         Descriptor {
-            family: Some(family.to_string()),
+            family: Some(family.into()),
             ..Default::default()
         }
     }
@@ -35,11 +35,27 @@ mod tests {
         // Exact range
         assert!(m.get(1).is_none());
         m.add(entry(1, 1, "A"));
-        assert_eq!("A", m.get(1).unwrap().family.as_deref().unwrap());
+        assert_eq!(
+            "A",
+            m.get(1)
+                .unwrap()
+                .family
+                .as_ref()
+                .map(ghostty_os::osbytes::EncodedOs::as_encoded)
+                .unwrap()
+        );
 
         // Later entry takes priority
         m.add(entry(1, 2, "B"));
-        assert_eq!("B", m.get(1).unwrap().family.as_deref().unwrap());
+        assert_eq!(
+            "B",
+            m.get(1)
+                .unwrap()
+                .family
+                .as_ref()
+                .map(ghostty_os::osbytes::EncodedOs::as_encoded)
+                .unwrap()
+        );
 
         // Non-matching
         assert!(m.get(0).is_none());
@@ -47,8 +63,24 @@ mod tests {
 
         m.add(entry(3, 4, "C"));
         m.add(entry(5, 6, "D"));
-        assert_eq!("C", m.get(3).unwrap().family.as_deref().unwrap());
-        assert_eq!("B", m.get(1).unwrap().family.as_deref().unwrap());
+        assert_eq!(
+            "C",
+            m.get(3)
+                .unwrap()
+                .family
+                .as_ref()
+                .map(ghostty_os::osbytes::EncodedOs::as_encoded)
+                .unwrap()
+        );
+        assert_eq!(
+            "B",
+            m.get(1)
+                .unwrap()
+                .family
+                .as_ref()
+                .map(ghostty_os::osbytes::EncodedOs::as_encoded)
+                .unwrap()
+        );
     }
 
     #[test]

crates/ghostty-font/src/codepoint_resolver.rs

@@ -385,7 +385,9 @@ impl CodepointResolver {
         {
             log::debug!(
                 "codepoint override based on config codepoint={cp} family={}",
-                desc.family.as_deref().unwrap_or("")
+                desc.family
+                    .as_ref()
+                    .map_or("", ghostty_os::osbytes::EncodedOs::as_encoded)
             );
 
             return Some(idx);

crates/ghostty-font/src/discovery.rs

@@ -37,10 +37,10 @@ mod fc_impl {
     pub fn to_fc_pattern(desc: &Descriptor) -> fc::Pattern {
         let mut pat = fc::Pattern::create();
         if let Some(family) = &desc.family {
-            assert!(pat.add_string(fc::Property::Family, family));
+            assert!(pat.add_string_bytes(fc::Property::Family, &family.to_bytes()));
         }
         if let Some(style) = &desc.style {
-            assert!(pat.add_string(fc::Property::Style, style));
+            assert!(pat.add_string_bytes(fc::Property::Style, &style.to_bytes()));
         }
         if desc.codepoint > 0 {
             let mut cs = fc::CharSet::create();
@@ -162,6 +162,43 @@ mod fc_impl {
 mod tests {
     use super::*;
 
+    #[cfg(font_fontconfig)]
+    #[test]
+    fn configured_font_names_reach_fontconfig_as_original_bytes() {
+        use ghostty_config::config::Config;
+        use ghostty_os::osbytes::os_bytes;
+
+        use crate::fontconfig::Property;
+        let mut config = Config::default();
+        config
+            .parse_field("font-family", Some("Family\u{fdd0}é"))
+            .unwrap();
+        config
+            .parse_field("font-style", Some("Style\u{fdd0}é"))
+            .unwrap();
+        config
+            .parse_field_bytes("font-codepoint-map", Some(b"U+0041=Family\xff"))
+            .unwrap();
+        let pat = to_fc_pattern(&Descriptor {
+            family: Some(config.font_family.list[0].clone()),
+            style: config.font_style.name_value().cloned(),
+            ..Descriptor::default()
+        });
+        assert_eq!(
+            os_bytes(&pat.get_os_string(Property::Family, 0).unwrap()),
+            "Family\u{fdd0}é".as_bytes()
+        );
+        assert_eq!(
+            os_bytes(&pat.get_os_string(Property::Style, 0).unwrap()),
+            "Style\u{fdd0}é".as_bytes()
+        );
+        let pat = to_fc_pattern(&config.font_codepoint_map.map.list[0].descriptor);
+        assert_eq!(
+            os_bytes(&pat.get_os_string(Property::Family, 0).unwrap()),
+            b"Family\xff"
+        );
+    }
+
     #[test]
     fn descriptor_hash() {
         let d = Descriptor::default();

crates/ghostty-font/src/discovery_coretext.rs

@@ -71,7 +71,9 @@ pub fn to_coretext_descriptor(
 
     // Family
     if let Some(family) = &desc.family {
-        let family = CFString::from_str(family);
+        let family = CFString::from_str(
+            std::str::from_utf8(&family.to_bytes()).map_err(|_| DiscoverError::DescriptorFailed)?,
+        );
         // SAFETY: valid static key.
         keys.push(unsafe { kCTFontFamilyNameAttribute });
         values.push(as_type(&*family));
@@ -79,7 +81,9 @@ pub fn to_coretext_descriptor(
 
     // Style
     if let Some(style) = &desc.style {
-        let style = CFString::from_str(style);
+        let style = CFString::from_str(
+            std::str::from_utf8(&style.to_bytes()).map_err(|_| DiscoverError::DescriptorFailed)?,
+        );
         // SAFETY: valid static key.
         keys.push(unsafe { kCTFontStyleNameAttribute });
         values.push(as_type(&*style));
@@ -414,7 +418,11 @@ fn score(desc: &Descriptor, ct_desc: &CTFontDescriptor) -> Score {
     // The first string in this slice will be used for the exact match,
     // and for the fuzzy match, all matching substrings will increase
     // the rank.
-    let desired_styles = math::desired_styles(desc.style.as_deref(), desc.bold, desc.italic);
+    let style = desc
+        .style
+        .as_ref()
+        .map(ghostty_os::osbytes::EncodedOs::to_text_lossy);
+    let desired_styles = math::desired_styles(style.as_deref(), desc.bold, desc.italic);
     let (exact, fuzzy) = math::style_scores(&style_str, &desired_styles);
     this.exact_style = exact;
     this.fuzzy_style = fuzzy;

crates/ghostty-font/src/shape.rs

@@ -59,5 +59,5 @@ pub struct Options {
     /// Note: eventually, this will move to font.Face probably as we may
     /// want to support per-face feature configuration. For now, we only
     /// support applying features globally.
-    pub features: Vec<String>,
+    pub features: Vec<ghostty_os::osbytes::EncodedOs>,
 }

crates/ghostty-font/src/shaper/coretext.rs

@@ -74,12 +74,17 @@ pub enum ShapeRunError {
 
 /// Create a CoreFoundation Dictionary suitable for settings the font
 /// features of a CoreText font (`makeFeaturesDict`).
-fn make_features_dict(feats: &[Feature]) -> CfBox<CFDictionary> {
+fn make_features_dict(feats: &[Feature]) -> Result<CfBox<CFDictionary>, ShapeError> {
     let mut items: Vec<CFRetained<CFDictionary<CFString, CFType>>> = Vec::new();
 
     for feat in feats {
         // Keys can only be ASCII.
-        let key = CFString::from_str(&String::from_utf8_lossy(&feat.tag));
+        if !feat.tag.is_ascii() {
+            return Err(ShapeError::CoreTextFailed);
+        }
+        let key = CFString::from_str(
+            std::str::from_utf8(&feat.tag).map_err(|_| ShapeError::CoreTextFailed)?,
+        );
         let value = CFNumber::new_i32(feat.value as i32);
 
         // SAFETY: valid static keys.
@@ -98,7 +103,9 @@ fn make_features_dict(feats: &[Feature]) -> CfBox<CFDictionary> {
     let k = unsafe { kCTFontFeatureSettingsAttribute };
     let dict = CFDictionary::<CFString, CFType>::from_slices(&[k], &[list.as_ref()]);
     // SAFETY: the attribute dictionary is used as an untyped CFDictionary.
-    CfBox::new(unsafe { CFRetained::cast_unchecked::<CFDictionary>(dict) })
+    Ok(CfBox::new(unsafe {
+        CFRetained::cast_unchecked::<CFDictionary>(dict)
+    }))
 }
 
 /// Shaper that uses CoreText.
@@ -146,7 +153,7 @@ impl Shaper {
     pub fn new(opts: &shape::Options) -> Result<Shaper, ShapeError> {
         let mut feature_list = FeatureList::default();
         for feature_str in &opts.features {
-            feature_list.append_from_string(feature_str);
+            feature_list.append_from_bytes(&feature_str.to_bytes());
         }
 
         // We need to construct two attrs dictionaries for font features;
@@ -155,8 +162,8 @@ impl Shaper {
         let mut feats_df: Vec<Feature> = DEFAULT_FEATURES.to_vec();
         feats_df.extend_from_slice(feats);
 
-        let features = make_features_dict(&feats_df);
-        let features_no_default = make_features_dict(feats);
+        let features = make_features_dict(&feats_df)?;
+        let features_no_default = make_features_dict(feats)?;
 
         // For now we only support LTR text. If we shape RTL text then
         // rendering will be very wrong so we need to explicitly force

crates/ghostty-font/src/shaper/feature.rs

@@ -344,7 +344,11 @@ impl FeatureList {
     /// Append features to this list from a string with a comma separated list.
     /// See `Feature::from_reader` for more docs.
     pub fn append_from_string(&mut self, s: &str) {
-        let mut reader = Reader::new(s.as_bytes());
+        self.append_from_bytes(s.as_bytes());
+    }
+
+    pub fn append_from_bytes(&mut self, s: &[u8]) {
+        let mut reader = Reader::new(s);
         while !reader.at_end() {
             let i = reader.pos;
             if let Some(feature) = Feature::from_reader(&mut reader) {
@@ -352,7 +356,7 @@ impl FeatureList {
             } else {
                 log::warn!(
                     "failed to parse font feature setting: \"{}\"",
-                    String::from_utf8_lossy(&s.as_bytes()[i..reader.pos])
+                    String::from_utf8_lossy(&s[i..reader.pos])
                 );
             }
         }

crates/ghostty-font/src/shaper/harfbuzz.rs

@@ -76,7 +76,7 @@ impl Shaper {
         let mut feature_list = FeatureList::default();
         feature_list.features.extend_from_slice(&DEFAULT_FEATURES);
         for feature_str in &opts.features {
-            feature_list.append_from_string(feature_str);
+            feature_list.append_from_bytes(&feature_str.to_bytes());
         }
 
         let hb_feats = feature_list
@@ -351,7 +351,7 @@ mod tests {
     fn shape_ligatures_disabled_by_feature() {
         let f = face(embedded::INCONSOLATA);
         let mut s = Shaper::new(&shape::Options {
-            features: vec!["-liga".to_string()],
+            features: vec!["-liga".into()],
         })
         .unwrap();
         let cells = s.shape_text(Some(&f), &text("===")).unwrap();

crates/ghostty-font/src/shaper/test_util.rs

@@ -93,7 +93,7 @@ pub(crate) fn test_shaper_with_font(font_req: TestFont) -> TestShaper {
     let grid = SharedGrid::new(CodepointResolver::new(c)).unwrap();
     let shaper = Shaper::new(&shape::Options {
         // Some of our tests rely on dlig being enabled by default
-        features: vec!["dlig".to_string()],
+        features: vec!["dlig".into()],
     })
     .unwrap();
 
@@ -112,7 +112,7 @@ pub(crate) fn test_shaper_with_discovered_font(font_req: &str) -> Option<TestSha
         let disco = Fontconfig::init();
         let mut it = disco
             .discover(&Descriptor {
-                family: Some(font_req.to_string()),
+                family: Some(font_req.into()),
                 size: 12.0,
                 monospace: false,
                 ..Descriptor::default()

crates/ghostty-font/src/shared_grid_set.rs

@@ -251,7 +251,9 @@ impl SharedGridSet {
 
                     log::warn!(
                         "font-family {style:?} not found: {}",
-                        desc.family.as_deref().unwrap_or("")
+                        desc.family
+                            .as_ref()
+                            .map_or("", ghostty_os::osbytes::EncodedOs::as_encoded)
                     );
                 }
             }
@@ -501,8 +503,8 @@ impl Key {
         let mut descriptors: Vec<Descriptor> = Vec::new();
         for family in &config.font_family.list {
             descriptors.push(Descriptor {
-                family: Some(ghostty_os::osbytes::config_str_to_text(family)),
-                style: config.font_style.name_value().map(str::to_string),
+                family: Some(family.clone()),
+                style: config.font_style.name_value().cloned(),
                 size: font_size.points,
                 variations: config.font_variation.list.clone(),
                 ..Descriptor::default()
@@ -518,9 +520,9 @@ impl Key {
         // no results would be found if we restrict to ALSO searching for
         // italic.
         for family in &config.font_family_bold.list {
-            let style = config.font_style_bold.name_value().map(str::to_string);
+            let style = config.font_style_bold.name_value().cloned();
             descriptors.push(Descriptor {
-                family: Some(ghostty_os::osbytes::config_str_to_text(family)),
+                family: Some(family.clone()),
                 bold: style.is_none(),
                 style,
                 size: font_size.points,
@@ -529,9 +531,9 @@ impl Key {
             });
         }
         for family in &config.font_family_italic.list {
-            let style = config.font_style_italic.name_value().map(str::to_string);
+            let style = config.font_style_italic.name_value().cloned();
             descriptors.push(Descriptor {
-                family: Some(ghostty_os::osbytes::config_str_to_text(family)),
+                family: Some(family.clone()),
                 italic: style.is_none(),
                 style,
                 size: font_size.points,
@@ -540,12 +542,9 @@ impl Key {
             });
         }
         for family in &config.font_family_bold_italic.list {
-            let style = config
-                .font_style_bold_italic
-                .name_value()
-                .map(str::to_string);
+            let style = config.font_style_bold_italic.name_value().cloned();
             descriptors.push(Descriptor {
-                family: Some(ghostty_os::osbytes::config_str_to_text(family)),
+                family: Some(family.clone()),
                 bold: style.is_none(),
                 italic: style.is_none(),
                 style,