refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-lib/src/action_c.rs

@@ -131,7 +131,7 @@ pub fn action_to_c(action: &Action, keep: &mut Keep) -> ghostty_action_s {
         Action::SetTabTitle(t) => v.set_tab_title.title = keep.cstr(&t.title),
         Action::PromptTitle(p) => v.prompt_title = *p as c_int,
         Action::Pwd(p) => {
-            v.pwd.pwd = keep.cstr_bytes(&ghostty_os::osbytes::config_str_to_bytes(&p.pwd));
+            v.pwd.pwd = keep.cstr_bytes(&p.pwd.to_bytes());
         }
         Action::MouseShape(s) => v.mouse_shape = *s as c_int,
         Action::MouseVisibility(m) => v.mouse_visibility = *m as c_int,
@@ -185,7 +185,7 @@ pub fn action_to_c(action: &Action, keep: &mut Keep) -> ghostty_action_s {
             v.open_url.kind = u.kind as c_int;
             // The URL may be the escaped form of a non-UTF-8 path; hand the
             // embedder the real bytes.
-            let url = ghostty_os::osbytes::config_str_to_bytes(&u.url);
+            let url = u.url.to_bytes();
             v.open_url.url = keep.cstr_bytes(&url);
             v.open_url.len = url.len();
         }

crates/ghostty-lib/src/benchmark.rs

@@ -7,27 +7,27 @@ use ghostty_bench::{args::Args, benches};
 
 /// Split the argument string like `std.process.ArgIteratorGeneral(.{})`:
 /// whitespace separated, with double quotes grouping and backslash
-/// escapes inside quotes.
-fn split_args(s: &str) -> Vec<String> {
+/// escapes inside quotes. Works on raw bytes: file names need not be UTF-8.
+fn split_args(s: &[u8]) -> Vec<std::ffi::OsString> {
     let mut out = Vec::new();
-    let mut cur = String::new();
+    let mut cur: Vec<u8> = Vec::new();
     let mut have = false;
     let mut in_quote = false;
-    let mut chars = s.chars().peekable();
-    while let Some(c) = chars.next() {
+    let mut bytes = s.iter().copied();
+    while let Some(c) = bytes.next() {
         match c {
-            '"' => {
+            b'"' => {
                 in_quote = !in_quote;
                 have = true;
             }
-            '\\' if in_quote => {
-                if let Some(n) = chars.next() {
+            b'\\' if in_quote => {
+                if let Some(n) = bytes.next() {
                     cur.push(n);
                 }
             }
-            c if c.is_whitespace() && !in_quote => {
+            c if c.is_ascii_whitespace() && !in_quote => {
                 if have {
-                    out.push(std::mem::take(&mut cur));
+                    out.push(ghostty_os::osbytes::os_from_bytes(std::mem::take(&mut cur)));
                     have = false;
                 }
             }
@@ -38,7 +38,7 @@ fn split_args(s: &str) -> Vec<String> {
         }
     }
     if have {
-        out.push(cur);
+        out.push(ghostty_os::osbytes::os_from_bytes(cur));
     }
     out
 }
@@ -62,7 +62,7 @@ pub unsafe extern "C" fn ghostty_benchmark_cli(
         log::warn!("unknown action={action}");
         return false;
     }
-    let argv = split_args(&args.to_string_lossy());
+    let argv = split_args(args.to_bytes());
     let parsed = match Args::parse(argv) {
         Ok(a) => a,
         Err(err) => {
@@ -85,9 +85,18 @@ mod tests {
 
     #[test]
     fn split_args_basic() {
-        assert_eq!(split_args("a b  c"), ["a", "b", "c"]);
-        assert_eq!(split_args("--x=\"a b\" c"), ["--x=a b", "c"]);
-        assert_eq!(split_args("   ").len(), 0);
+        assert_eq!(split_args(b"a b  c"), ["a", "b", "c"]);
+        assert_eq!(split_args(b"--x=\"a b\" c"), ["--x=a b", "c"]);
+        assert_eq!(split_args(b"   ").len(), 0);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn split_args_keeps_non_utf8_bytes() {
+        use std::os::unix::ffi::OsStrExt;
+        let v = split_args(b"--data=/tmp/a\xffb x");
+        assert_eq!(v[0].as_bytes(), b"--data=/tmp/a\xffb");
+        assert_eq!(v[1], "x");
     }
 
     #[test]

crates/ghostty-lib/src/config_capi.rs

@@ -16,7 +16,7 @@ use ghostty_config::{
 use ghostty_input::binding::{Action as BindingAction, TriggerC, TriggerCTag};
 
 use crate::{
-    main_c::{EMPTY_STRING, string_from_owned},
+    main_c::{EMPTY_STRING, string_from_bytes},
     types::{
         ghostty_command_s,
         ghostty_config_color_list_s,
@@ -103,6 +103,15 @@ fn cstring(s: &str) -> CString {
     CString::new(s.replace('\0', "")).unwrap_or_default()
 }
 
+/// A C string for a config *value*: config strings carry non-UTF-8 bytes in
+/// the reversible [`ghostty_os::osbytes`] encoding, so the embedder gets the
+/// decoded bytes (Zig hands out the original byte slice).
+fn cstring_value(s: &str) -> CString {
+    let mut bytes = ghostty_os::osbytes::config_str_to_bytes(s);
+    bytes.retain(|b| *b != 0);
+    CString::new(bytes).unwrap_or_default()
+}
+
 /// Intern a string for the lifetime of the process (enum tag names).
 fn intern(s: &str) -> *const c_char {
     static POOL: OnceLock<Mutex<HashSet<Box<CStr>>>> = OnceLock::new();
@@ -122,8 +131,8 @@ fn intern(s: &str) -> *const c_char {
 fn build_backing(value: &CValue) -> Backing {
     let mut b = Backing::default();
     match value {
-        CValue::String(s) => b.strings.push(cstring(s)),
-        CValue::Path { path, .. } => b.strings.push(cstring(path)),
+        CValue::String(s) => b.strings.push(cstring_value(s)),
+        CValue::Path { path, .. } => b.strings.push(cstring_value(path)),
         CValue::ColorList(list) => {
             b.colors = list
                 .iter()
@@ -136,10 +145,10 @@ fn build_backing(value: &CValue) -> Backing {
         }
         CValue::Commands(cmds) => {
             for c in cmds {
-                b.strings.push(cstring(&c.action_key));
-                b.strings.push(cstring(&c.action));
-                b.strings.push(cstring(&c.title));
-                b.strings.push(cstring(&c.description));
+                b.strings.push(cstring_value(&c.action_key));
+                b.strings.push(cstring_value(&c.action));
+                b.strings.push(cstring_value(&c.title));
+                b.strings.push(cstring_value(&c.description));
             }
             // The CStrings' heap buffers don't move when the Vec grows.
             b.commands = b
@@ -252,9 +261,12 @@ pub unsafe extern "C" fn ghostty_config_load_file(ptr: ghostty_config_t, path: *
     // Non-UTF-8 file names are valid on Unix; keep the bytes (reversible
     // escape understood by the config file loader).
     let path =
-        ghostty_os::osbytes::bytes_to_config_string(unsafe { CStr::from_ptr(path) }.to_bytes());
+        ghostty_os::osbytes::EncodedOs::from_bytes(unsafe { CStr::from_ptr(path) }.to_bytes());
     if let Err(err) = c.config.load_file(&path) {
-        log::error!("error loading config from file path={path} err={err}");
+        log::error!(
+            "error loading config from file path={} err={err}",
+            path.as_encoded()
+        );
     }
 }
 
@@ -574,7 +586,8 @@ pub unsafe extern "C" fn ghostty_config_get_diagnostic(
 #[unsafe(no_mangle)]
 pub extern "C" fn ghostty_config_open_path() -> ghostty_string_s {
     match ghostty_config::edit::open_path() {
-        Ok(path) => string_from_owned(&path),
+        // The embedder gets the real bytes of the path.
+        Ok(path) => string_from_bytes(&path.to_bytes()),
         Err(err) => {
             log::error!("error opening config in editor err={err}");
             EMPTY_STRING
@@ -588,6 +601,23 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn config_values_reach_c_as_decoded_bytes() {
+        use ghostty_os::osbytes::EncodedOs;
+        let enc = EncodedOs::from_bytes(b"/a\xffb");
+        assert_ne!(enc.as_encoded().as_bytes(), b"/a\xffb");
+        let b = build_backing(&CValue::Path {
+            path: enc.as_encoded().to_owned(),
+            optional: false,
+        });
+        assert_eq!(b.strings[0].as_bytes(), b"/a\xffb");
+        let b = build_backing(&CValue::String(enc.into_encoded()));
+        assert_eq!(b.strings[0].as_bytes(), b"/a\xffb");
+        // Plain text (even with the escape char) is unchanged.
+        let b = build_backing(&CValue::String("h\u{e9}llo".to_owned()));
+        assert_eq!(b.strings[0].to_str().unwrap(), "h\u{e9}llo");
+    }
+
     fn get<T: Copy>(cfg: ghostty_config_t, key: &str, init: T) -> (bool, T) {
         let mut out = init;
         // SAFETY: `out` is a valid destination of the key's C type.

crates/ghostty-lib/src/embedded.rs

@@ -619,7 +619,7 @@ impl RtSurface for SurfaceRt {
         true
     }
 
-    fn set_clipboard(&self, clipboard: Clipboard, contents: &[(String, String)], confirm: bool) {
+    fn set_clipboard(&self, clipboard: Clipboard, contents: &[(String, Vec<u8>)], confirm: bool) {
         let Some(cb) = self.app.opts.write_clipboard_cb else {
             return;
         };
@@ -628,7 +628,8 @@ impl RtSurface for SurfaceRt {
             .map(|(m, d)| {
                 (
                     CString::new(m.replace('\0', "")).unwrap_or_default(),
-                    CString::new(d.replace('\0', "")).unwrap_or_default(),
+                    CString::new(d.iter().copied().filter(|b| *b != 0).collect::<Vec<u8>>())
+                        .unwrap_or_default(),
                 )
             })
             .collect();
@@ -889,7 +890,7 @@ unsafe fn apply_surface_options(config: &mut Config, opts: &ghostty_surface_conf
         && !wd.is_empty()
     {
         // Raw bytes are kept (reversible escape in the String based config).
-        let wd_str = osbytes::bytes_to_config_string(wd);
+        let wd_str = osbytes::EncodedOs::from_bytes(wd);
         let wd_os = osbytes::os_from_bytes(wd.to_vec());
         let wd_disp = String::from_utf8_lossy(wd);
         match std::fs::metadata(&wd_os) {
@@ -2207,7 +2208,7 @@ mod tests {
             .as_ref()
             .and_then(|w| w.value())
             .unwrap();
-        assert_eq!(osbytes::config_str_to_bytes(got_wd), dir);
+        assert_eq!(got_wd.to_bytes(), dir);
         let Some(Command::Shell(c)) = &config.command else {
             panic!("no command");
         };

crates/ghostty-lib/src/main_c.rs

@@ -21,9 +21,15 @@ static ARGS: OnceLock<Vec<String>> = OnceLock::new();
 /// Build the `ghostty_string_s` for an owned string (Zig:
 /// `String.fromSlice` of an allocated `[:0]const u8`). Free with
 /// `ghostty_string_free`.
+#[cfg(test)]
 pub(crate) fn string_from_owned(s: &str) -> ghostty_string_s {
+    string_from_bytes(s.as_bytes())
+}
+
+/// [`string_from_owned`] for raw bytes (paths need not be UTF-8).
+pub(crate) fn string_from_bytes(s: &[u8]) -> ghostty_string_s {
     let mut bytes = Vec::with_capacity(s.len() + 1);
-    bytes.extend_from_slice(s.as_bytes());
+    bytes.extend_from_slice(s);
     bytes.push(0);
     let boxed = bytes.into_boxed_slice();
     let len = boxed.len() - 1;