Follow-up testing showed that the mailbox limit did not fix the base64
hang: moving the pointer stalled the app, and opening a tab could hang it.
Mouse link lookup copied the entire wrapped line before checking modifier
eligibility, while renderer link searches had no whole-search work budget.
Filter eligible links before traversing scrollback. Add bounded logical
line selection and skip automatic regex lookup on lines exceeding 65,536
grid cells. Keep explicit line selection and OSC8 handling unrestricted.
Skip oversized lines instead of truncating URLs into different targets.
Apply the existing terminal StringMap retry budget to renderer searches
and handle search errors without panicking. The regression triggered a
retry-limit panic through the old onig search API and now returns normally,
allowing subsequent link patterns to run.
Document the lookup limits and correct the earlier mailbox fix entry to
record that it did not resolve the reported hang on its own.
Test Plan:
- 1,513 unit/integration tests and one doctest pass across core, renderer,
and terminal with Mesa software OpenGL; one existing doctest is ignored.
- Release application build, formatting, and all-target Clippy pass.
- GTK handles 400 pointer moves, including Ctrl hover, during continuous
base64 output, opens/closes a tab, handles Ctrl+C, prints a marker, and
exits cleanly. Normal URL hover still works after a hard newline.
Reference: docs/rewrite/DEVIANT_FIXES.md (entry 41)
A freeze report from continuous newline-free base64 output exposed an
unbounded mailbox drain: producers can keep refilling the queue and prevent
one app tick from returning to the runtime for input, timers, and drawing.
Process at most 64 messages per tick and wake the runtime if work remains.
Messages retain their order and are not dropped. Document the scheduling
contract and the deliberate deviation from the upstream drain loop.
Add a finite refilling-producer regression that fails with the original
loop and verifies yielding, wakeup rearming, and eventual completion. The
reported full freeze was not consistently reproduced in headless GTK, so
this fixes a demonstrated starvation risk without claiming its root cause.
Test Plan:
- All 119 ghostty-core tests pass with Mesa software OpenGL.
- Release build, Clippy for all core targets with -D warnings, and fmt pass.
- GTK handles Ctrl+C, a follow-up command, and quit after a 15-second flood.
Reference: docs/rewrite/DEVIANT_FIXES.md (entry 40)
Relocating a Cargo-installed binary loses executable-relative resource
lookup even when themes and shell integration exist under /usr/share.
Allow packagers to set GHOSTTY_BUILD_RESOURCES_DIR when compiling.
Absolute paths are used directly; relative paths resolve against the
running executable's directory for relocatable installations. Explicit
paths do not require terminfo sentinels. A nonempty runtime override wins
in every profile when the build option is configured. Unset or empty
build options preserve existing discovery, including debug precedence.
Cargo watches the build option so changing or unsetting it recompiles
lookup. Resource files still need to be installed separately.
Document this requested upstream deviation and the build option in the
README, architecture overview, and deviation register.
Test Plan:
- Eight resource lookup unit tests pass.
- Nightly formatting and ghostty-os Clippy with -D warnings pass.
- Production build with /usr/share/ghostty succeeds; a copied executable
lists all 463 themes with no runtime override.
- Compiled probes verify absolute, relative, unset, and empty options,
Cargo rebuilds, relocation, runtime overrides, and unrelated cwd.
Deviation-Register: docs/rewrite/DEVIANT_FIXES.md
Repeated production builds recompiled build-info, GTK and their dependents
because build scripts watched missing optional files and generated outputs.
Watch packed-refs only when present and the prebuilt GTK bundle only when
consumed. Loose refs remain watched so packing them refreshes Git inputs.
Invoke glib-compile-resources directly instead of using a helper that also
watches generated XML and UI files. The existing resources directory watch
covers their source inputs. Remove the unused helper dependency and document
the build input rules.
Test Plan:
- Run cargo build --profile production three times; repeats compile nothing.
- Run cargo clippy, cargo clippy --benches and cargo clippy --tests.
- Run cargo +nightly fmt and repeat all three Clippy checks.
Documentation: docs/rewrite/ARCHITECTURE.md
The Node smoke test expected shaper info logs after the default logger
became errors-only. Its failure also exposed config finalization calling
an unsupported passwd lookup on wasm and returning Unexpected before
normalization completed.
Skip shell defaults on wasm, matching upstream Zig. Assert successful
config finalization and window-width clamping in the Node test. Check
shaper output directly while verifying that info logs stay suppressed.
Document these behaviors in the wasm port notes.
Test Plan:
- cargo test -p ghostty-wasm --test node (passed)
- cargo test -p ghostty-config --lib (291 passed)
- cargo clippy --target wasm32-unknown-unknown -p ghostty-wasm -- -D warnings
- cargo clippy; cargo clippy --benches; cargo clippy --tests
- cargo +nightly fmt, followed by the native Clippy checks again
- git diff --check
Related-commit: 4fb9faa667
The error-only logging default suppressed replay output, causing five
GTK tests to fail and two layer-shell tests to skip their assertions.
Set RUST_LOG=debug and GHOSTTY_LOG=stderr for the child app so both replay
output and capability detection are independent of inherited settings.
Document the harness logging contract without changing application defaults.
Test plan:
- cargo test -p ghostty-rs --all-features --test gtk_replay (7 passed)
- cargo clippy, cargo clippy --benches, cargo clippy --tests
- cargo +nightly fmt and repeat the clippy checks
Related-commit: 4fb9faa
Ghostty's stylesheets (style.css, style-dark.css, style-hc*.css) were
never loaded. AdwApplication loads them from `resource-base-path` once,
during startup, and only if the resources exist at that moment. Zig's
gresource is registered by a glib-compile-resources C constructor before
main; the Rust build registered it lazily on first template instantiation
(windows, dialogs), i.e. after startup.
Visible effect: every rule in style.css was missing, e.g. the clipboard
confirmation dialog (`clipboard-read = ask`) rendered its preview without
the rounded inset and overlapping the "Remember choice" row.
Registering in Application::new restores parity; the Adwaita
"style-dark.css is deprecated" warnings Zig logs now appear too, which
confirms the files are picked up.
Test Plan:
- clipboard-read = ask, run `printf '\e]52;c;?\a'`: dialog is
pixel-identical to Ghostty 1.3.1 (nested weston capture)
Ghostty's macOS app stays the original, unchanged Swift app (agreed
scope); it is wired to the Rust core instead of the Zig core.
scripts/macos-swift-app.sh (`just macos-swift-app <ghostty-src>`)
mirrors the Zig build's GhosttyXcodebuild.zig:
1. scripts/xcframework.sh builds the Rust libghostty (identical
include/ghostty.h ABI) as <src>/macos/GhosttyKit.xcframework,
2. `just install <src>/zig-out` provides the resources the Xcode project
bundles from ../zig-out/share (ghostty, terminfo, completions, man,
locale, vim, nvim, bat),
3. xcodebuild -target Ghostty in a clean environment.
macOS + Xcode only; DRY_RUN=1 previews the steps (verified on Linux).
Test Plan:
- DRY_RUN=1 scripts/macos-swift-app.sh ../ghostty
- on macOS: just macos-swift-app ../ghostty && open the built app
Reverts 4861015 ("feat(macos): foundation of the macOS app ported from
Swift to Rust"). Decision with the user: keep Ghostty's original Swift
macOS app unchanged and link it against the Rust core instead of the
Zig core. The Rust libghostty exports the identical include/ghostty.h
ABI (ABI-checked), so the Swift app does not need to be rewritten; a
second, Rust-based macOS app would duplicate it without being runnable
or testable here.
Phase 9, MA1: crates/ghostty-macos (AppKit via objc2; empty stub on
non-Apple targets) ports the foundation of Ghostty 1.3.1's Swift macOS
app (ghostty/macos): main, AppDelegate (+Ghostty) with lifecycle, dock
menu, open-file, notifications, shortcut sync and quit/reopen paths;
MainMenu.xib as generated menu tables built into NSMenus; the
Ghostty.App/Config/Surface wrappers driving libghostty in-process via
ghostty-lib; the generic helpers; scripts/macos-bundle.sh to assemble
Ghostty.app (dry-run on Linux). Feature areas are stubbed for MA2-MA5.
Design and type mapping: docs/rewrite/notes/macos-app-design.md
(App Intents is a Swift-only framework and cannot be ported).
Compile-checked only (no macOS here): just check-macos passes for
aarch64/x86_64-apple-darwin with -D warnings; 125 platform-independent
tests run on Linux.
Test Plan:
- just check-macos
- cargo test -p ghostty-macos
Adds scripts/live-dbus-test.sh (`just live-dbus`): each scenario runs
the installed Ghostty 1.3.1 and the Rust build on a private
dbus-run-session bus inside a private headless weston (the user's
session bus is never written to), with Python/Gio mocks for
org.freedesktop.Notifications, the GlobalShortcuts/Settings portal and
org.freedesktop.systemd1, plus a real xdg-desktop-portal run. Scenarios:
single-instance (+detect), +new-window with arguments, notifications,
global shortcuts, color-scheme settings, cgroup scope creation, URL
opening. tests/live_dbus.rs compares the Rust build against goldens
recorded from the original (skips when tools or a fresh production
build are missing).
Two Rust bugs found and fixed (no upstream deviation):
- GlobalShortcuts CreateSession/BindShortcuts payloads used the wrong
D-Bus signatures ((v), double-boxed values), which a real portal
rejects; signature tests added.
- CreateSession was sent twice at startup; the config is now bound only
after the D-Bus connection is set, as in Zig.
All nine scenarios now behave identically to the original
(docs/rewrite/notes/live-dbus.md).
Test Plan:
- just live-dbus
- cargo test --test live_dbus (needs target/vp/production/ghostty)
Intentional deviation from Ghostty 1.3.1 (DEVIANT_FIXES.md row 39).
Zig's Command.startWindows (Command.zig:261,347-358) passes the command
path as CreateProcessW's lpApplicationName, which is taken literally:
a partial name is completed with the current directory only, never the
search path. A bare `cmd.exe` (e.g. `command = direct:cmd.exe` or
`-e cmd.exe`) therefore fails to start in Ghostty on Windows.
A bare program name (no drive or separator) is now looked up on PATH,
appending .exe when there is no extension as CreateProcess does;
anything else or a failed lookup is passed through unchanged. Verified
under Wine by the exec_windows ConPTY tests.
Test Plan:
- cargo test -p ghostty-termio resolve_application_searches_path_for_bare_names
- just test-windows-wine
Intentional deviation from Ghostty 1.3.1 (DEVIANT_FIXES.md row 38).
Zig's Theme.parseCLI (config/Config.zig:9788-9799) treats any value
containing ',', '=' or ':' as a light/dark pair. Every absolute Windows
path (C:\themes\x, \\?\C:\..., \\server\share\x) contains a colon, so
Ghostty on Windows rejects all absolute theme paths.
A value that is a single Windows absolute path is now taken as a theme
path; the light:/dark: pair syntax still works, including with drive
paths as values.
Test Plan:
- cargo test -p ghostty-config windows_absolute_path_detection
theme_windows_absolute_path_and_pair_with_paths
Intentional deviation from Ghostty 1.3.1 (DEVIANT_FIXES.md row 37).
On shutdown Zig's termio/Exec.zig:1188-1224 (getpgid) loops until the
child's process group differs from ours, i.e. until the child has
called setsid. If the child exits before ever calling setsid and is not
yet reaped, its pgid stays ours forever and Zig spins indefinitely.
The Rust port previously capped the wait at ~5 s (which also differed
from Zig for slow children). It now waits without a cap like Zig, but
stops as soon as waitid(WNOWAIT) shows the child has exited.
Test Plan:
- cargo test -p ghostty-termio getpgid_waits_for_late_setsid
getpgid_gives_up_on_exited_child_without_setsid
Windows was previously only compile-checked. With Wine 11 (staging)
and mingw available, scripts/windows-wine-test.sh (`just
test-windows-wine`) builds expat/FreeType/fontconfig for mingw under
target/wine-deps and runs the test suites of ghostty-vt, unicode,
datastruct, input, os, config, terminal, crash, termio and cli under
Wine (~2,700 tests). New termio/tests/exec_windows.rs drives real
cmd.exe children over ConPTY through Termio (output, exit codes,
typing, 120 KiB writes, stop, start failure). Fixes found: Windows
paths from fs::canonicalize leaked the \\?\ prefix (new
ghostty_os::path::realpath strips it like Zig); ghostty-font compiles
hb-ft for bundled HarfBuzz on Windows; ~25 tests had Unix assumptions.
Wine limitations are ignored with reasons (ResizePseudoConsole stub,
no POSIX rename over existing files) - docs/rewrite/notes/windows-wine.md.
+list-themes preview parity (former KNOWN_DIFFERENCES rows 5-9): the
search box ports vaxis TextInput (word navigation and editing bindings,
grapheme-wise editing), ASCII-only case folding, light initial colors
until terminal reports arrive (no COLORFGBG), and load errors end the
preview with exit 1; PTY tests compare with /usr/bin/ghostty.
Test Plan:
- just test-windows-wine
- cargo test -p ghostty-cli --test list_themes_pty
- cargo test --workspace --no-fail-fast (3601 passed)
README now describes the full scope (Linux app, C APIs, WASM, crash
reporting, macOS/Windows compile-checked), the verification tooling
(difftest, visual-parity, check-all) and links DEVIANT_FIXES.md and
KNOWN_DIFFERENCES.md. STATUS records completion and the stopping
criterion.
Intentional deviation from Ghostty 1.3.1 (DEVIANT_FIXES.md entry 10).
Two terminal inputs reach states that Zig handles only by assertion
(Debug/ReleaseSafe abort; ReleaseFast continues):
- Toggling mode 2027 around a BOM before a wide character hits
`assert(!b)` in print_grapheme. This repository's release profile
keeps debug assertions, so terminal output could crash a release
build. The assertion is removed and the path behaves like Zig
ReleaseFast.
- A grapheme (e.g. a Devanagari conjunct) at the right margin on the
bottom row with scrolling margins returned InvalidCoordinate and left
a grapheme flag without data, panicking later in the formatter. The
grapheme now moves from the cell that actually holds it and no cell is
flagged without data.
tools/difftest gains a Rust-only panic hunt (`difftest_fuzz panics`,
lenient driver): ~60k debug-build cases now run without any panic, and
3000 Zig differential cases show 0 divergences.
Test Plan:
- cargo test -p ghostty-terminal difftest_mode_2027_toggle_with_bom_does_not_panic
difftest_grapheme_wrap_scrolling_margins_keeps_grapheme
- cargo run -p difftest --bin difftest_fuzz -- panics
Final fix pass per the stopping criterion (docs/rewrite/PLAN.md),
resolving the remaining RV18 build/behaviour items (final-Z21.md):
- termio errno access uses the per-target libc accessor (__error on
FreeBSD/DragonFly/Apple, __errno on OpenBSD/NetBSD/Android) instead of
__errno_location everywhere, unblocking non-Linux BSD builds.
- FreeBSD resource discovery follows Zig (site-terminfo, local/share).
- Zig's Debug-only resource precedence (and the dev workspace-resources
fallback) key off a ghostty_debug_build cfg set from PROFILE=="debug"
instead of debug_assertions, so release builds with assertions honor
GHOSTTY_RESOURCES_DIR first like Zig ReleaseSafe.
- KNOWN_DIFFERENCES.md lists the remaining P3 differences deliberately
left unfixed (theme-preview editing details, a cleanup timeout edge
case) and what cannot be verified on this machine.
- DEVIANT_FIXES.md registers the PTY-hangup output drain (35), the
canvas BGRA conversion (36) and the dev resources fallback.
Test Plan:
- cargo test --workspace --no-fail-fast (exit 0)
- cargo check --target x86_64-unknown-freebsd -p ghostty-os
Intentional deviation from Ghostty 1.3.1 (DEVIANT_FIXES.md row 34).
When a Metal buffer grows, Zig's renderer/metal/buffer.zig:89 and :146
compute the new size as twice the required *byte* count and then
multiply by @sizeOf(T) again, so large cell buffers allocate
sizeof(T) times more GPU memory than intended. The Rust Metal backend
(since bab49ee) allocates exactly twice the required bytes; this commit
factors the computation into metal_layout::grown_buffer_bytes, adds a
regression test and records the deviation.
Test Plan:
- cargo test -p ghostty-renderer
grown_buffer_bytes_is_double_the_required_bytes_not_scaled_by_size_of_t
- just check-macos
Resolves the parity items of docs/rewrite/notes/review-rv17-codex.md
(final-Z20.md):
- FreeType-only font backend is also available on Apple targets
(discovery-free, embedded emoji fonts); ghostty_surface_quicklook_font
returns null for every backend except plain CoreText like Zig.
- The +list-fonts test keys off the font crate's selected backend
(HAS_DISCOVERY), correct under feature unification and on Apple.
- Inspector font: 32 px rasterized with FreeType (dear-imgui freetype)
like Ghostty; a new `visual-parity.sh inspector` scenario shows 0.031%
differing pixels (hover highlight) vs the original on Linux. Windows,
Apple and wasm keep stb_truetype at 32 px (registered as a deliberate
deviation).
- Inspector DCS/APC descriptions follow Zig 0.15.2's formatting
(checked by running Zig), incl. the terminal.Parser.Action prefix.
- The ImGui demo window appears only in dev-profile builds, mirroring
Zig's .Debug-only gate.
Test Plan:
- cargo test --workspace --no-fail-fast (3582 passed)
- just check-macos (both, also with --features font-backend-freetype)
- scripts/visual-parity.sh inspector
Intentional deviation from Ghostty 1.3.1 (DEVIANT_FIXES.md row 33).
Zig's os/systemd.zig:116 accepts a NOTIFY_SOCKET path of exactly 108
bytes and then writes the terminating NUL to path[108], one past the
end of sockaddr_un.sun_path (out-of-bounds write). The Rust port's
socket address construction (since f8c5ce0) accepts at most 108 bytes
without a NUL and rejects longer paths, so it never writes out of
bounds; this commit records that deviation and adds a regression test.
Test Plan:
- cargo test -p ghostty-os notify_maximum_length_socket_path_is_rejected_safely
Ghostty can be built with -Dfont-backend=freetype, which uses FreeType
without any font discovery. The Rust port only had fontconfig+freetype
(default on Linux) and the CoreText variants. The new cargo feature
`font-backend-freetype` on ghostty-font (forwarded by ghostty-cli and
the root crate; non-Apple, non-wasm targets) behaves like Zig's mode:
font-family discovery, fallback search and codepoint-map overrides are
skipped (embedded fonts only); +list-fonts and +show-face print Zig's
"built without a font discovery mechanism" message and exit 1; +version
reports `.freetype`. The default backend is unchanged.
Also registers the Rust-only benchmark tooling extensions (--time,
--handler=full, ghostty-synthetic +sgr) in DEVIANT_FIXES.md.
Note: `--all-features` now selects this backend for the workspace.
Test Plan:
- cargo test -p ghostty-font --features font-backend-freetype (198)
- cargo build --features font-backend-freetype && ghostty +list-fonts
Intentional deviation from Ghostty 1.3.1 (DEVIANT_FIXES.md row 32).
Zig's os/open.zig runs `try collectOutput(...)` before `wait()`: when
collection fails (e.g. a stream exceeds the 50 KiB limit), the error
returns early and the child is never waited for, leaving a zombie
process for the lifetime of Ghostty.
The Rust opener thread now always waits for the child (the pipes are
already closed at that point) and still logs the collection error.
Test Plan:
- cargo test -p ghostty-os open
Intentional deviation from Ghostty 1.3.1 (DEVIANT_FIXES.md row 31).
Zig's apprt/gtk/ipc/new_window.zig:49-53 builds the D-Bus argument
array from raw bytes as a *trusted* GVariant; an argument with invalid
UTF-8 or an interior NUL violates GVariant's string invariants, which
GLib turns into a process abort. The Rust port mirrored this with an
explicit abort().
new_window now validates every argument before touching the bus: a bad
argument prints an error to stderr and returns Error::IpcFailed, so the
CLI exits with failure and nothing crashes. Valid arguments are sent
byte-identically to Ghostty.
Test Plan:
- cargo test -p ghostty-apprt-gtk new_window
(invalid_dbus_strings_are_rejected_without_abort)
Resolves the parity items of docs/rewrite/notes/review-rv15-codex.md
(final-Z18.md):
- os::open inherits stdin like Zig's Child.init, strips LD_LIBRARY_PATH
only in Snap builds (new `snap` cargo feature, off by default, like
Zig's snap build option) and bounds output collection to 50 KiB per
stream (StdoutStreamTooLong/StderrStreamTooLong).
- +show-face writes diagnostics and lookup lines in the exact fragments
Zig's formatter produces, so buffer drains happen at the same byte
positions (0 diffs vs /usr/bin/ghostty over 0-44 bad options for
three codepoints); its tests no longer parse the test runner's argv.
- DEVIANT_FIXES.md: five entries reworded and four removed that were no
longer deviations (verified against code and oracle).
Test Plan:
- cargo test -p ghostty-os open; cargo test -p ghostty-cli show_face
Adds docs/rewrite/DEVIANT_FIXES.md, the single list of places where the
Rust port deliberately behaves differently from Ghostty 1.3.1:
- 30 upstream bugs fixed instead of replicated (memory safety/UB,
infinite loops, crashes, data loss), each with Zig file:line, both
behaviours, the commit that introduced the Rust behaviour and its test
(a few Zig locations are marked unverified);
- 11 upstream quirks deliberately kept as in Zig;
- 18 other deliberate deviations (out-of-scope Swift app, platforms that
are only compile-checked, library substitutions with observable
differences).
Deviations made from now on are committed alone as fix-deviant(<scope>)
and added here; earlier ones are bundled in larger commits, which is why
the register records their hashes.
ddidderr