refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-apprt-gtk/src/class/application.rs

@@ -78,7 +78,7 @@ pub enum QuitTimer {
 #[derive(Debug, Default, Clone)]
 pub struct WindowOverrides {
     pub command: Option<Command>,
-    pub working_directory: Option<String>,
+    pub working_directory: Option<ghostty_os::osbytes::EncodedOs>,
     pub title: Option<String>,
 }
 
@@ -1141,7 +1141,7 @@ impl Application {
     fn action_new_window(&self, parameter: Option<&glib::Variant>) {
         log::debug!("received new window action");
 
-        let mut working_directory: Option<String> = None;
+        let mut working_directory: Option<ghostty_os::osbytes::EncodedOs> = None;
         let mut title: Option<String> = None;
         let mut command: Option<Command> = None;
         let mut args: Vec<String> = Vec::new();
@@ -1180,7 +1180,9 @@ impl Application {
                     continue;
                 }
                 if let Some(v) = s.strip_prefix("--working-directory=") {
-                    working_directory = Some(v.trim().to_owned());
+                    // IPC carries the encoded form of the OS string.
+                    working_directory =
+                        Some(ghostty_os::osbytes::EncodedOs::from_encoded(v.trim()));
                     continue;
                 }
                 if let Some(v) = s.strip_prefix("--title=") {
@@ -1791,7 +1793,7 @@ impl Application {
             action::OpenUrlKind::Text => ghostty_os::open::OpenUrlKind::Text,
             action::OpenUrlKind::Html => ghostty_os::open::OpenUrlKind::Html,
         };
-        if let Err(err) = ghostty_os::open::open(kind, &value.url) {
+        if let Err(err) = ghostty_os::open::open(kind, &value.url.to_os()) {
             log::warn!("unable to open url: {err}");
         }
     }

crates/ghostty-apprt-gtk/src/class/command_palette.rs

@@ -138,7 +138,10 @@ mod command_imp {
                     let title = surface
                         .get_effective_title()
                         .unwrap_or_else(|| "Untitled".to_string());
-                    if let Some(pwd) = surface.get_pwd()
+                    // Display text only.
+                    if let Some(pwd) = surface
+                        .get_pwd()
+                        .map(|p| String::from_utf8_lossy(&p.to_bytes()).into_owned())
                         && !title.contains(&pwd)
                     {
                         *description = Some(pwd);

crates/ghostty-apprt-gtk/src/class/surface.rs

@@ -132,7 +132,7 @@ pub enum DebugImKey {
 #[derive(Debug, Clone, Default)]
 pub struct SurfaceOverrides {
     pub command: Option<Command>,
-    pub working_directory: Option<String>,
+    pub working_directory: Option<ghostty_os::osbytes::EncodedOs>,
     pub title: Option<String>,
 }
 
@@ -268,7 +268,7 @@ impl Surface {
             if ghostty_apprt::surface::should_inherit_working_directory(context, &config_obj.get())
                 && let Some(pwd) = parent.get_pwd()
             {
-                imp.pwd.replace(Some(pwd));
+                imp.pwd.replace(Some(pwd.into_encoded()));
                 self.notify("pwd");
             }
         }
@@ -1500,7 +1500,7 @@ impl Surface {
     pub fn set_clipboard(
         &self,
         clipboard_type: Clipboard,
-        contents: &[(String, String)],
+        contents: &[(String, Vec<u8>)],
         confirm: bool,
     ) {
         clipboard::set(self, clipboard_type, contents, confirm);
@@ -1582,7 +1582,7 @@ impl Surface {
         }
         self.set_clipboard(
             Clipboard::Standard,
-            &[("text/plain".to_owned(), title)],
+            &[("text/plain".to_owned(), title.into_bytes())],
             false,
         );
         true
@@ -1608,13 +1608,22 @@ impl Surface {
     }
 
     /// Returns the pwd property.
-    pub fn get_pwd(&self) -> Option<String> {
-        self.imp().pwd.borrow().clone()
+    pub fn get_pwd(&self) -> Option<ghostty_os::osbytes::EncodedOs> {
+        // The GObject `pwd` property is a (UTF-8) string, so it stores the
+        // encoded form of the OS string; this accessor is the only place it
+        // is converted back to the typed value.
+        self.imp()
+            .pwd
+            .borrow()
+            .clone()
+            .map(ghostty_os::osbytes::EncodedOs::from_encoded)
     }
 
     /// Set the pwd for this surface, copies the value.
-    pub fn set_pwd(&self, pwd: Option<&str>) {
-        self.imp().pwd.replace(pwd.map(str::to_owned));
+    pub fn set_pwd(&self, pwd: Option<&ghostty_os::osbytes::EncodedOs>) {
+        self.imp()
+            .pwd
+            .replace(pwd.map(|p| p.as_encoded().to_owned()));
         self.notify("pwd");
     }
 
@@ -1806,8 +1815,10 @@ impl Surface {
 
             let volume = config.bell_audio_volume.clamp(0.0, 1.0);
 
-            debug_assert!(std::path::Path::new(path).is_absolute());
-            let media_file = gtk::MediaFile::for_filename(path);
+            // The config path is an encoded OS string: decode it first.
+            let path = path.to_path();
+            debug_assert!(path.is_absolute());
+            let media_file = gtk::MediaFile::for_filename(&path);
 
             // If the audio file is marked as required, we'll emit an error if
             // there was a problem playing it. Otherwise there will be silence.
@@ -2125,7 +2136,7 @@ impl Surface {
 
     /// The first `focused` surface other than ourselves, used to inherit the
     /// working directory like `App.focusedSurface` does in the core.
-    fn focused_surface_pwd(&self) -> Option<String> {
+    fn focused_surface_pwd(&self) -> Option<ghostty_os::osbytes::EncodedOs> {
         Surface::all()
             .into_iter()
             .find(|s| s != self && s.core().is_some() && s.get_focused())
@@ -2178,7 +2189,7 @@ impl Surface {
         if let Some(size) = *imp.font_size_request.borrow() {
             config.font_size = size.0.points;
         }
-        if let Some(pwd) = imp.pwd.borrow().clone() {
+        if let Some(pwd) = self.get_pwd() {
             let mut wd_val = WorkingDirectory::Path(pwd);
             wd_val.finalize();
             config.working_directory = Some(wd_val);
@@ -2421,7 +2432,7 @@ impl RtSurface for RtSurfaceHandle {
             .is_some_and(|s| s.clipboard_request(clipboard, state))
     }
 
-    fn set_clipboard(&self, clipboard: Clipboard, contents: &[(String, String)], confirm: bool) {
+    fn set_clipboard(&self, clipboard: Clipboard, contents: &[(String, Vec<u8>)], confirm: bool) {
         if let Some(s) = self.gobj() {
             s.set_clipboard(clipboard, contents, confirm);
         }
@@ -2485,15 +2496,16 @@ mod clipboard {
     pub(super) fn set(
         surface: &Surface,
         clipboard_type: Clipboard,
-        contents: &[(String, String)],
+        contents: &[(String, Vec<u8>)],
         confirm: bool,
     ) {
         // Grab our plaintext content for use in confirmation dialogs
-        // and signals. We always expect one to exist.
+        // and signals (display text only; the clipboard gets the raw bytes).
+        // We always expect one to exist.
         let Some(text) = contents
             .iter()
             .find(|(mime, _)| mime == "text/plain")
-            .map(|(_, data)| data.clone())
+            .map(|(_, data)| String::from_utf8_lossy(data).into_owned())
         else {
             return;
         };
@@ -2505,7 +2517,7 @@ mod clipboard {
             let providers: Vec<gdk::ContentProvider> = contents
                 .iter()
                 .map(|(mime, data)| {
-                    let bytes = glib::Bytes::from(data.as_bytes());
+                    let bytes = glib::Bytes::from(data.as_slice());
                     if mime == "text/plain" {
                         // Add an explicit UTF-8 encoding parameter to the
                         // text/plain type. The default charset when there is

crates/ghostty-apprt-gtk/src/class/window.rs

@@ -73,7 +73,7 @@ pub enum SelectTab {
 #[derive(Debug, Clone, Default)]
 pub struct TabOverrides {
     pub command: Option<ConfigCommand>,
-    pub working_directory: Option<String>,
+    pub working_directory: Option<ghostty_os::osbytes::EncodedOs>,
     pub title: Option<String>,
 }
 

crates/ghostty-apprt-gtk/src/css.rs

@@ -110,29 +110,30 @@ impl CssProviders {
 
         for p in &config.gtk_custom_css.value {
             let (path, optional) = match p {
-                Path::Optional(path) => (path, true),
-                Path::Required(path) => (path, false),
+                Path::Optional(path) => (path.to_path(), true),
+                Path::Required(path) => (path.to_path(), false),
             };
-            let meta = match std::fs::metadata(path) {
+            let shown = path.display();
+            let meta = match std::fs::metadata(&path) {
                 Ok(m) => m,
                 Err(e) => {
                     if e.kind() != std::io::ErrorKind::NotFound || !optional {
-                        log::warn!("error opening gtk-custom-css file {path}: {e}");
+                        log::warn!("error opening gtk-custom-css file {shown}: {e}");
                     }
                     continue;
                 }
             };
-            log::info!("loading gtk-custom-css path={path}");
+            log::info!("loading gtk-custom-css path={shown}");
             if meta.len() > CSS_FILE_SIZE_LIMIT {
                 log::warn!(
-                    "gtk-custom-css file {path} was larger than {CSS_FILE_SIZE_LIMIT} bytes"
+                    "gtk-custom-css file {shown} was larger than {CSS_FILE_SIZE_LIMIT} bytes"
                 );
                 continue;
             }
-            let contents = match std::fs::read(path) {
+            let contents = match std::fs::read(&path) {
                 Ok(c) => c,
                 Err(e) => {
-                    log::warn!("error reading gtk-custom-css file {path}: {e}");
+                    log::warn!("error reading gtk-custom-css file {shown}: {e}");
                     continue;
                 }
             };

crates/ghostty-apprt-gtk/src/flatpak.rs

@@ -1,6 +1,6 @@
 //! Flatpak helpers (port of `apprt/gtk/flatpak.zig`).
 
-use ghostty_os::ResourcesDir;
+use ghostty_os::{ResourcesDir, osbytes::EncodedOs};
 use gtk::glib;
 
 /// Returns the resources directory, consulting the Flatpak runtime data
@@ -9,7 +9,7 @@ pub fn resources_dir() -> std::io::Result<ResourcesDir> {
     // Only consult Flatpak runtime data for the host case.
     if ghostty_os::is_flatpak() {
         let mut result = ResourcesDir {
-            app_path: Some("/app/share/ghostty".to_owned()),
+            app_path: Some(EncodedOs::from_plain_text("/app/share/ghostty")),
             host_path: None,
         };
 
@@ -24,13 +24,11 @@ pub fn resources_dir() -> std::io::Result<ResourcesDir> {
             return Ok(result);
         };
 
-        result.host_path = Some(
-            std::path::Path::new(app_dir.as_str())
+        result.host_path = Some(EncodedOs::from_path(
+            &std::path::Path::new(app_dir.as_str())
                 .join("share")
-                .join("ghostty")
-                .to_string_lossy()
-                .into_owned(),
-        );
+                .join("ghostty"),
+        ));
         return Ok(result);
     }