mac: harden terminal bridge callbacks and output links - #183
Merged
Conversation
SupaReviewReview failed. |
🛠️ Tuist Run Report 🛠️Tests 🧪
Builds 🔨
|
The bridge reported completed actions as unhandled and could release a surface bridge before queued close delivery reached the main thread. Return each direct result, keep the bridge alive across that queue hop, and remove state that no caller reads.
Clipboard denial could release native request state from inside its own callback, while cached terminal text could expire during a concurrent read. Defer denials until the next main turn and lock cache access.
OSC 8 links come from terminal output and must not enter Launch Services through the generic opener. Allow known schemes, confirm custom handlers, block deceptive or executable targets, and show the effective destination.
khoi
force-pushed
the
fix/ghostty-security
branch
from
August 8, 2026 20:34
d5f4b79 to
1fe3e2d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The updated terminal core exposed four host gaps: OSC 8 output links reached the unrestricted system opener, immediate clipboard denials could invalidate embedded callback state, off-main close delivery could outlive its bridge, and several performed actions returned false. The bridge also retained write-only state for actions Supaterm did not perform.
What changed
This uses the terminal fork baseline merged in #187.
Verification
make mac-checkpassedPer-surface color handling remains in the next stacked PR.