refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-lib/src/action_c.rs

@@ -127,8 +127,8 @@ pub fn action_to_c(action: &Action, keep: &mut Keep) -> ghostty_action_s {
             v.desktop_notification.title = keep.cstr(&n.title);
             v.desktop_notification.body = keep.cstr(&n.body);
         }
-        Action::SetTitle(t) => v.set_title.title = keep.cstr(&t.title),
-        Action::SetTabTitle(t) => v.set_tab_title.title = keep.cstr(&t.title),
+        Action::SetTitle(t) => v.set_title.title = keep.cstr_bytes(&t.title.to_bytes()),
+        Action::SetTabTitle(t) => v.set_tab_title.title = keep.cstr_bytes(&t.title.to_bytes()),
         Action::PromptTitle(p) => v.prompt_title = *p as c_int,
         Action::Pwd(p) => {
             v.pwd.pwd = keep.cstr_bytes(&p.pwd.to_bytes());
@@ -158,8 +158,9 @@ pub fn action_to_c(action: &Action, keep: &mut Keep) -> ghostty_action_s {
         }
         Action::KeyTable(KeyTable::Activate(name)) => {
             v.key_table.tag = 0;
-            v.key_table.value.activate.name = keep.cstr(name);
-            v.key_table.value.activate.len = name.len();
+            let bytes = name.to_bytes();
+            v.key_table.value.activate.name = keep.cstr_bytes(&bytes);
+            v.key_table.value.activate.len = bytes.len();
         }
         Action::KeyTable(KeyTable::Deactivate) => v.key_table.tag = 1,
         Action::KeyTable(KeyTable::DeactivateAll) => v.key_table.tag = 2,
@@ -240,6 +241,39 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn c_title_actions_and_key_table_names_forward_original_bytes() {
+        use ghostty_os::osbytes::EncodedOs;
+        let raw = b"name\xff\xef\xb7\x90\xc3\xa9";
+        let mut keep = Keep::default();
+        for tab in [false, true] {
+            let title = SetTitle {
+                title: EncodedOs::from_bytes(raw),
+            };
+            let action = if tab {
+                Action::SetTabTitle(title)
+            } else {
+                Action::SetTitle(title)
+            };
+            let c = action_to_c(&action, &mut keep);
+            // SAFETY: both title union members have identical layout, pointer owned by keep.
+            let title = unsafe { std::ffi::CStr::from_ptr(c.action.set_title.title) };
+            assert_eq!(title.to_bytes(), raw);
+        }
+        let c = action_to_c(
+            &Action::KeyTable(KeyTable::Activate(EncodedOs::from_bytes(raw))),
+            &mut keep,
+        );
+        // SAFETY: the tag is key_table.activate and keep owns the buffer.
+        let name = unsafe {
+            std::slice::from_raw_parts(
+                c.action.key_table.value.activate.name.cast::<u8>(),
+                c.action.key_table.value.activate.len,
+            )
+        };
+        assert_eq!(name, raw);
+    }
+
     #[test]
     fn target_cval() {
         let t = target_to_c(&Target::App);

crates/ghostty-lib/src/config_capi.rs

@@ -147,8 +147,8 @@ fn build_backing(value: &CValue) -> Backing {
             for c in cmds {
                 b.strings.push(cstring_value(&c.action_key));
                 b.strings.push(cstring_value(&c.action));
-                b.strings.push(cstring_value(&c.title));
-                b.strings.push(cstring_value(&c.description));
+                b.strings.push(cstring_value(c.title.as_encoded()));
+                b.strings.push(cstring_value(c.description.as_encoded()));
             }
             // The CStrings' heap buffers don't move when the Vec grows.
             b.commands = b
@@ -265,7 +265,7 @@ pub unsafe extern "C" fn ghostty_config_load_file(ptr: ghostty_config_t, path: *
     if let Err(err) = c.config.load_file(&path) {
         log::error!(
             "error loading config from file path={} err={err}",
-            path.as_encoded()
+            path.to_text_lossy()
         );
     }
 }
@@ -511,11 +511,7 @@ pub unsafe extern "C" fn ghostty_config_trigger(
     }
     // SAFETY: `str` points to `len` bytes.
     let s = unsafe { std::slice::from_raw_parts(str.cast::<u8>(), len) };
-    let Ok(s) = std::str::from_utf8(s) else {
-        log::error!("error finding trigger err=InvalidFormat");
-        return default_trigger();
-    };
-    match BindingAction::parse(s) {
+    match BindingAction::parse_bytes(s) {
         Ok(action) => {
             let trigger = c
                 .config

crates/ghostty-lib/src/embedded.rs

@@ -17,7 +17,6 @@ use std::{
     cell::{Cell, OnceCell, RefCell},
     collections::HashMap,
     ffi::{CStr, CString, c_char, c_int, c_void},
-    fmt::Write as _,
     rc::{Rc, Weak},
     sync::Arc,
 };
@@ -547,7 +546,7 @@ pub struct SurfaceRt {
     cursor_pos: Cell<CursorPos>,
     /// The current title of the surface. The embedded apprt saves this so
     /// that `get_title` works without the implementer needing to save it.
-    title: RefCell<Option<String>>,
+    title: RefCell<Option<ghostty_os::osbytes::EncodedOs>>,
 }
 
 impl SurfaceRt {
@@ -570,7 +569,7 @@ impl RtSurface for SurfaceRt {
         None
     }
 
-    fn get_title(&self) -> Option<String> {
+    fn get_title(&self) -> Option<ghostty_os::osbytes::EncodedOs> {
         self.title.borrow().clone()
     }
 
@@ -854,36 +853,21 @@ unsafe fn platform_view_from_c(
     }
 }
 
-/// Zig's `std.zig.stringEscape` with non-ASCII code points written as
-/// `\u{...}` (the config value is parsed as a Zig string; the bytes of
-/// valid UTF-8 round trip either way). Bytes that are not valid UTF-8 are
-/// emitted in the reversible OS-byte encoding, which the string parser
-/// copies through unchanged, so `string::parse_bytes(string_escape(b)) == b`.
-fn string_escape(input: &[u8]) -> String {
-    let mut out = String::with_capacity(input.len());
-    for chunk in input.utf8_chunks() {
-        for c in chunk.valid().chars() {
-            match c {
-                '\n' => out.push_str("\\n"),
-                '\r' => out.push_str("\\r"),
-                '\t' => out.push_str("\\t"),
-                '\\' => out.push_str("\\\\"),
-                '"' => out.push_str("\\\""),
-                ' ' | '!' | '#'..='&' | '\'' | '('..='[' | ']'..='~' => out.push(c),
-                c if c.is_ascii() => {
-                    let _ = write!(out, "\\x{:02x}", c as u32);
-                }
-                c => {
-                    let _ = write!(out, "\\u{{{:x}}}", c as u32);
-                }
-            }
-        }
-        for &b in chunk.invalid() {
-            out.push('\u{FDD0}');
-            out.push(char::from(b));
+/// Escape initial input for config/string while retaining arbitrary original bytes.
+fn string_escape(input: &[u8]) -> ghostty_os::osbytes::EncodedOs {
+    let mut out = Vec::with_capacity(input.len());
+    for &byte in input {
+        match byte {
+            b'\n' => out.extend_from_slice(b"\\n"),
+            b'\r' => out.extend_from_slice(b"\\r"),
+            b'\t' => out.extend_from_slice(b"\\t"),
+            b'\\' => out.extend_from_slice(b"\\\\"),
+            b'"' => out.extend_from_slice(b"\\\""),
+            0..=0x1f | 0x7f => out.extend_from_slice(format!("\\x{byte:02x}").as_bytes()),
+            _ => out.push(byte),
         }
     }
-    out
+    ghostty_os::osbytes::EncodedOs::from_bytes(&out)
 }
 
 /// Apply the surface options to the config (the first half of Zig's
@@ -921,7 +905,7 @@ unsafe fn apply_surface_options(config: &mut Config, opts: &ghostty_surface_conf
     if let Some(cmd) = unsafe { cstr(opts.command) }.map(CStr::to_bytes)
         && !cmd.is_empty()
     {
-        config.command = Some(Command::Shell(osbytes::bytes_to_config_string(cmd)));
+        config.command = Some(Command::Shell(osbytes::EncodedOs::from_bytes(cmd)));
         config.wait_after_command = true;
     }
 
@@ -934,10 +918,7 @@ unsafe fn apply_surface_options(config: &mut Config, opts: &ghostty_surface_conf
             let (Some(k), Some(v)) = (unsafe { cstr(var.key) }, unsafe { cstr(var.value) }) else {
                 continue;
             };
-            config.env.put(
-                &osbytes::bytes_to_config_string(k.to_bytes()),
-                &osbytes::bytes_to_config_string(v.to_bytes()),
-            );
+            config.env.put_bytes(k.to_bytes(), v.to_bytes());
         }
     }
 
@@ -1946,11 +1927,10 @@ pub unsafe extern "C" fn ghostty_surface_binding_action(
     let bytes = unsafe { std::slice::from_raw_parts(action.cast::<u8>(), len) };
     // The action text is bytes (Zig `[]const u8`); the parser works on the
     // reversible OS-byte encoding so a `text:` payload keeps invalid UTF-8.
-    let action_str = ghostty_os::osbytes::bytes_to_config_string(bytes);
-    let action = match BindingAction::parse(&action_str) {
+    let action = match BindingAction::parse_bytes(bytes) {
         Ok(a) => a,
         Err(err) => {
-            log::error!("error parsing binding action action={action_str} err={err:?}");
+            log::error!("error parsing binding action action={bytes:?} err={err:?}");
             return false;
         }
     };
@@ -2194,7 +2174,7 @@ mod tests {
         ] {
             let esc = string_escape(raw);
             assert_eq!(
-                ghostty_config::string::parse_bytes(&esc).unwrap(),
+                ghostty_config::string::parse_bytes(esc.to_bytes()).unwrap(),
                 raw,
                 "{esc:?}"
             );
@@ -2241,10 +2221,10 @@ mod tests {
         let Some(Command::Shell(c)) = &config.command else {
             panic!("no command");
         };
-        assert_eq!(osbytes::config_str_to_bytes(c), b"echo \xfe");
+        assert_eq!(c.to_bytes(), b"echo \xfe");
         let (k, v) = config.env.iter().next().unwrap();
-        assert_eq!(osbytes::config_str_to_bytes(k), b"K\xfd");
-        assert_eq!(osbytes::config_str_to_bytes(v), b"v\xfc");
+        assert_eq!(k.to_bytes(), b"K\xfd");
+        assert_eq!(v.to_bytes(), b"v\xfc");
         assert!(matches!(
             config.input.list.first(),
             Some(ReadableIO::Raw(_))