From a5b3fccc779e373451bfabcba85d143d6e13986d Mon Sep 17 00:00:00 2001
From: vetcoders-agents <agents@vetcoders.io>
Date: Tue, 11 Aug 2026 20:07:18 +0200
Subject: [PATCH 01/12] fix(server): refuse to bind over a live session socket

A starting server unlinked the session socket file unconditionally and
bound its own. The previous server kept running - unreachable, with zero
clients, and with no reaper that ever collects it. Session discovery made
this routine: a server too busy to answer a ConnStatus probe within 250ms
was reported as nonexistent, so a new server was spawned and stole the
name.

Probe the path for ownership before touching it: on Unix a successful
connect means some process holds the listening end, whatever its health;
on Windows the marker PID answers. Only a missing, stale or non-socket
path is cleaned up and re-bound. Anything else - including an
unclassifiable transport error - refuses the start with a log line.

Since the losing server now exits instead of stealing, its client can
reach the surviving server and ask it for a new session. Reject that too:
re-initializing would replace a live session's state wholesale.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 CHANGELOG.md                      |   1 +
 docs/VC_FRAME_OPERATOR_SURFACE.md |  15 ++++
 zellij-server/src/lib.rs          |  51 ++++++++++-
 zellij-utils/src/sessions.rs      | 136 ++++++++++++++++++++++++++++++
 4 files changed, 202 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b64d9529..723a040d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ## [Unreleased]
 
+* fix(server): a starting server no longer unlinks and re-binds a session socket that a live server still owns — it probes the path first and refuses to start when someone is listening, even if that server is too busy to answer a health probe; only missing, stale or non-socket paths are cleaned up. A server already running a session likewise rejects a second new-session request instead of re-initializing over live state
 * feat(input): `Cmd+K` / `Super+k` opens the existing `❯_ Quick cmd` mini-console in every mode including LOCK; the keybind messages the active compact-bar so keyboard and click share one runner, geometry and pane-title contract, with matching Alacritty CSI-u translation and help
 
 ## [0.47.3] - 2026-08-06
diff --git a/docs/VC_FRAME_OPERATOR_SURFACE.md b/docs/VC_FRAME_OPERATOR_SURFACE.md
index c63fd12d..aed98d20 100644
--- a/docs/VC_FRAME_OPERATOR_SURFACE.md
+++ b/docs/VC_FRAME_OPERATOR_SURFACE.md
@@ -72,6 +72,21 @@ resolve to that built-in plugin. An unrelated `file:` or remote plugin is not
 treated as the built-in status bar merely because its filename looks similar;
 custom replacements must implement and wire their own sampling lifecycle.
 
+## Session Socket Ownership
+
+A session name maps to one socket file, and exactly one live server may own it.
+A starting server probes that path before binding: if a process is listening
+there — even one too busy to answer a health probe — the newcomer refuses to
+start and says so in the log instead of unlinking the file and binding over it.
+Only a path that nothing is listening on (missing, stale after a crash, or not
+a socket at all) is cleaned up and re-bound.
+
+The rule exists because stealing a socket does not stop the previous server: it
+keeps running, unreachable, with zero clients, and nothing ever reaps it. A
+server that already runs a session also rejects a second new-session request
+rather than re-initializing over live state; the caller sees the refusal and
+can attach to the existing session instead.
+
 ## Key Contract
 
 The shipped defaults promise one navigation language — one modifier per
diff --git a/zellij-server/src/lib.rs b/zellij-server/src/lib.rs
index dbcf8a09..427c22c0 100644
--- a/zellij-server/src/lib.rs
+++ b/zellij-server/src/lib.rs
@@ -77,6 +77,7 @@ use zellij_utils::{
         plugins::PluginAliases,
     },
     ipc::{ClientAttributes, ExitReason, ServerToClientMsg},
+    sessions::SocketOwnership,
     shared::{default_palette, web_server_base_url},
 };
 
@@ -807,7 +808,33 @@ pub fn start_server(mut os_input: Box<dyn ServerOsApi>, socket_path: PathBuf) {
             let to_server = to_server.clone();
             let socket_path = socket_path.clone();
             move || {
-                drop(std::fs::remove_file(&socket_path));
+                // Never take a socket away from a server that is still alive.
+                // Unlinking and re-binding here leaves the previous process
+                // running but unreachable: an orphan with zero clients that no
+                // reaper ever collects, burning CPU until reboot. A stale file
+                // left by a crashed server stays legal to clean up.
+                match zellij_utils::sessions::probe_socket_ownership(&socket_path) {
+                    SocketOwnership::Vacant => {
+                        drop(std::fs::remove_file(&socket_path));
+                    },
+                    SocketOwnership::Live => {
+                        log::error!(
+                            "Refusing to start: another server is alive on {}. \
+                             Attach to the existing session instead.",
+                            socket_path.display()
+                        );
+                        std::process::exit(1);
+                    },
+                    SocketOwnership::Unknown(reason) => {
+                        log::error!(
+                            "Refusing to start: cannot determine whether a server is alive on {} \
+                             ({}). Not evicting a possibly-live session.",
+                            socket_path.display(),
+                            reason
+                        );
+                        std::process::exit(1);
+                    },
+                }
                 let listener = ipc_bind(&socket_path).unwrap();
                 // set the sticky bit to avoid the socket file being potentially cleaned up
                 // https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html states that for XDG_RUNTIME_DIR:
@@ -951,6 +978,28 @@ pub fn start_server(mut os_input: Box<dyn ServerOsApi>, socket_path: PathBuf) {
         err_ctx.add_call(ContextType::IPCServer((&instruction).into()));
         match instruction {
             ServerInstruction::FirstClientConnected(cli_assets, is_web_client, client_id) => {
+                if session_data.read().unwrap().is_some() {
+                    // A client that lost the create-session race spawned its
+                    // own server, that server refused to steal this socket and
+                    // exited, and the client landed here instead. Initializing
+                    // again would replace a live session's state wholesale, so
+                    // refuse: the caller retries and finds the session through
+                    // the ordinary attach path.
+                    log::error!(
+                        "Rejecting a new-session request for client {}: this server already runs a session",
+                        client_id
+                    );
+                    let _ = os_input.send_to_client(
+                        client_id,
+                        ServerToClientMsg::Exit {
+                            exit_reason: ExitReason::Error(
+                                "Session already exists on this server".to_owned(),
+                            ),
+                        },
+                    );
+                    remove_client!(client_id, os_input, session_state, session_data);
+                    continue;
+                }
                 let (config, layout) = cli_assets.load_config_and_layout();
                 let layout_is_welcome_screen = cli_assets.layout
                     == Some(LayoutInfo::BuiltIn("welcome".to_owned()))
diff --git a/zellij-utils/src/sessions.rs b/zellij-utils/src/sessions.rs
index 5dc6e28c..be7e15f9 100644
--- a/zellij-utils/src/sessions.rs
+++ b/zellij-utils/src/sessions.rs
@@ -238,6 +238,95 @@ fn assert_socket(_name: &str) -> bool {
     true
 }
 
+/// Whether a session socket path is currently held by a live server.
+///
+/// This asks a deliberately different question than [`assert_socket`]: not "is
+/// the server behind this socket healthy" but "may this path be unlinked and
+/// re-bound". A server that is alive yet too busy to answer a `ConnStatus`
+/// probe within the discovery deadline must never lose its own socket — the
+/// old process keeps running, unreachable and clientless, and nothing reaps it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum SocketOwnership {
+    /// Nothing is listening: no file at all, or a leftover from a crashed
+    /// server. Removing it and binding is legal cleanup.
+    Vacant,
+    /// A process is listening on this path right now.
+    Live,
+    /// The path could not be classified. Treated as occupied by callers,
+    /// because guessing wrong destroys a running session.
+    Unknown(String),
+}
+
+/// Deadline for the ownership probe. Longer than `SESSION_PROBE_TIMEOUT`
+/// because the answer decides whether another server gets evicted, and the
+/// call happens exactly once per server start.
+#[cfg(unix)]
+pub const SOCKET_OWNERSHIP_PROBE_TIMEOUT: Duration = Duration::from_millis(1000);
+
+/// On Unix, a successful `connect()` means some process holds the listening
+/// end. That is enough: whether it replies to `ConnStatus` in time says
+/// something about its health, not about its ownership of the name.
+#[cfg(unix)]
+pub fn probe_socket_ownership(path: &std::path::Path) -> SocketOwnership {
+    use crate::consts::ipc_connect_timeout;
+    match fs::symlink_metadata(path) {
+        // Nothing is there, or what is there cannot be a listening socket —
+        // either way nobody can be reached through it.
+        Err(e) if e.kind() == io::ErrorKind::NotFound => return SocketOwnership::Vacant,
+        Ok(metadata) if !is_ipc_socket(&metadata.file_type()) => return SocketOwnership::Vacant,
+        _ => {},
+    }
+    match ipc_connect_timeout(path, SOCKET_OWNERSHIP_PROBE_TIMEOUT) {
+        Ok(_stream) => SocketOwnership::Live,
+        Err(e)
+            if matches!(
+                e.kind(),
+                io::ErrorKind::ConnectionRefused | io::ErrorKind::NotFound
+            ) =>
+        {
+            SocketOwnership::Vacant
+        },
+        Err(e) => SocketOwnership::Unknown(e.to_string()),
+    }
+}
+
+/// On Windows the socket path is a marker file holding the server PID (the
+/// listener itself is a named pipe, which the OS already refuses to bind
+/// twice). Liveness of that PID is the ownership answer.
+#[cfg(windows)]
+pub fn probe_socket_ownership(path: &std::path::Path) -> SocketOwnership {
+    use windows_sys::Win32::Foundation::CloseHandle;
+    use windows_sys::Win32::System::Threading::{OpenProcess, PROCESS_QUERY_LIMITED_INFORMATION};
+
+    let Ok(pid_str) = fs::read_to_string(path) else {
+        return SocketOwnership::Vacant;
+    };
+    let Ok(pid) = pid_str.trim().parse::<u32>() else {
+        // Marker file exists but carries no valid PID (eg. empty, written by
+        // an older version) — nobody can be reached through it.
+        return SocketOwnership::Vacant;
+    };
+    let alive = unsafe {
+        let handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, 0, pid);
+        if handle.is_null() {
+            false
+        } else {
+            CloseHandle(handle);
+            true
+        }
+    };
+    if alive {
+        SocketOwnership::Live
+    } else {
+        SocketOwnership::Vacant
+    }
+}
+
+#[cfg(not(any(unix, windows)))]
+pub fn probe_socket_ownership(_path: &std::path::Path) -> SocketOwnership {
+    SocketOwnership::Vacant
+}
+
 #[cfg(all(test, unix))]
 mod session_probe_timeout_tests {
     use super::*;
@@ -278,6 +367,53 @@ mod session_probe_timeout_tests {
         server.join().expect("silent server thread");
     }
 
+    #[test]
+    fn a_busy_but_listening_socket_still_belongs_to_its_server() {
+        let dir = tempfile::TempDir::new().expect("tempdir");
+        let socket = dir.path().join("busy-session.sock");
+        let listener = ListenerOptions::new()
+            .name(socket.as_path().to_fs_name::<GenericFilePath>().unwrap())
+            .create_sync()
+            .expect("bind busy socket");
+        // A server that never answers ConnStatus: `assert_socket` reports it as
+        // gone, which is exactly the misread that used to cost it its socket.
+        let server = std::thread::spawn(move || {
+            let _listener = listener;
+            std::thread::sleep(Duration::from_millis(500));
+        });
+
+        assert_eq!(probe_socket_ownership(&socket), SocketOwnership::Live);
+        server.join().expect("busy server thread");
+    }
+
+    #[test]
+    fn a_stale_socket_file_is_vacant() {
+        let dir = tempfile::TempDir::new().expect("tempdir");
+        let socket = dir.path().join("stale-session.sock");
+        {
+            let listener = ListenerOptions::new()
+                .name(socket.as_path().to_fs_name::<GenericFilePath>().unwrap())
+                .create_sync()
+                .expect("bind stale socket");
+            drop(listener);
+        }
+
+        assert_eq!(probe_socket_ownership(&socket), SocketOwnership::Vacant);
+        assert_eq!(
+            probe_socket_ownership(&dir.path().join("never-existed.sock")),
+            SocketOwnership::Vacant
+        );
+
+        // Junk left at a session path must not block that session name
+        // forever just because connect() reports an unfamiliar error.
+        let not_a_socket = dir.path().join("not-a-socket");
+        std::fs::write(&not_a_socket, b"stale").expect("write junk");
+        assert_eq!(
+            probe_socket_ownership(&not_a_socket),
+            SocketOwnership::Vacant
+        );
+    }
+
     #[test]
     fn kill_ack_timer_is_entered_inside_its_runtime() {
         let dir = tempfile::TempDir::new().expect("tempdir");

From c04a1726c7db89d110f1579cbb66b487f682f072 Mon Sep 17 00:00:00 2001
From: vetcoders-agents <agents@vetcoders.io>
Date: Tue, 11 Aug 2026 20:07:33 +0200
Subject: [PATCH 02/12] fix(chrome): park the chrome a detaching client leaves
 behind

Both chrome target sets are derived from active_tab_ids, so the last
detach empties them and nobody is told it stopped being visible. The
plugin instances outlive their client: a session rail latched visible
kept re-arming its 1Hz timer and re-reading every live session's KDL
metadata on a server nobody was watching - the dominant idle CPU cost,
quadratic in the number of live sessions on the machine.

Remember which targets were told they are visible and park those whose
client is no longer connected. Targets of still-connected clients stay
governed by all-minus-active, so tab switching and projector bindings
are untouched. Attach re-activates through the existing active-target
path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 CHANGELOG.md                           |  1 +
 docs/VC_FRAME_OPERATOR_SURFACE.md      |  7 +++-
 zellij-server/src/screen.rs            | 27 +++++++++++++-
 zellij-server/src/unit/screen_tests.rs | 51 ++++++++++++++++++++++++++
 4 files changed, 83 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 723a040d..f0935966 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ## [Unreleased]
 
 * fix(server): a starting server no longer unlinks and re-binds a session socket that a live server still owns — it probes the path first and refuses to start when someone is listening, even if that server is too busy to answer a health probe; only missing, stale or non-socket paths are cleaned up. A server already running a session likewise rejects a second new-session request instead of re-initializing over live state
+* fix(chrome): the chrome a client had visible is parked when that client detaches, so a server with nobody attached stops refreshing the cross-session list once a second; attaching re-activates it and rebuilds the list on the spot
 * feat(input): `Cmd+K` / `Super+k` opens the existing `❯_ Quick cmd` mini-console in every mode including LOCK; the keybind messages the active compact-bar so keyboard and click share one runner, geometry and pane-title contract, with matching Alacritty CSI-u translation and help
 
 ## [0.47.3] - 2026-08-06
diff --git a/docs/VC_FRAME_OPERATOR_SURFACE.md b/docs/VC_FRAME_OPERATOR_SURFACE.md
index aed98d20..31e021d6 100644
--- a/docs/VC_FRAME_OPERATOR_SURFACE.md
+++ b/docs/VC_FRAME_OPERATOR_SURFACE.md
@@ -56,7 +56,12 @@ once from the session snapshot it already owns and sends a small scalar message
 only to the status-bar plugin/client pairs viewing active tabs. When a client
 switches tabs, the server sends an exact plugin/client deactivation signal to
 the status bar it left; sampling does not rely on the tab-global `Visible`
-event, which cannot distinguish multiple clients in one session. Per-tab
+event, which cannot distinguish multiple clients in one session. A client that
+detaches is covered by the same transition: the chrome it had visible is parked
+as the client leaves, so a server with nobody attached holds no chrome that
+keeps polling for cross-session state. Attaching re-activates that chrome
+through the ordinary active-target path, and the session list it shows is
+rebuilt on the spot. Per-tab
 status bars never subscribe to the full cross-session `SessionUpdate`, and
 unrelated `CustomMessage` consumers are not awakened. Host resource sampling
 also runs only in active status-bar instances, and clipboard timers cannot
diff --git a/zellij-server/src/screen.rs b/zellij-server/src/screen.rs
index f145ccde..4e615c27 100644
--- a/zellij-server/src/screen.rs
+++ b/zellij-server/src/screen.rs
@@ -1691,6 +1691,12 @@ pub(crate) struct Screen {
     pane_render_subscribers: HashMap<ClientId, PaneRenderSubscription>,
     plugins_need_ansi_pane_contents: bool,
     background_plugin_subscriptions: HashMap<(PluginId, ClientId), HashSet<EventType>>,
+    /// Chrome plugin/client targets that were told they are visible by the
+    /// previous transition. Kept so a target can still be parked after the
+    /// tab (or the whole client) it belonged to is gone — otherwise the last
+    /// detach leaves both target sets empty and the chrome stays latched
+    /// visible, refreshing once a second on a server nobody is watching.
+    last_visible_chrome_targets: BTreeSet<ChromePluginTarget>,
     has_clients_flag: Arc<AtomicBool>,
     /// Monotonic counter used to tag each forwarded host-terminal query
     /// with a unique token. 0 is reserved as a sentinel (see
@@ -2795,6 +2801,7 @@ impl Screen {
             pane_render_subscribers: HashMap::new(),
             plugins_need_ansi_pane_contents: false,
             background_plugin_subscriptions: HashMap::new(),
+            last_visible_chrome_targets: BTreeSet::new(),
             has_clients_flag,
             next_forward_token: 1, // 0 is reserved as the startup sentinel
             pending_forwarded_queries: HashMap::new(),
@@ -6496,12 +6503,28 @@ impl Screen {
         &mut self,
     ) -> (Vec<ChromePluginTarget>, Vec<ChromePluginTarget>) {
         let active_targets = self.active_status_bar_plugin_targets();
-        let hidden_targets = self
+        let mut hidden_targets: BTreeSet<ChromePluginTarget> = self
             .all_status_bar_plugin_targets()
             .difference(&active_targets)
             .copied()
             .collect();
-        (active_targets.into_iter().collect(), hidden_targets)
+        // Both target sets are built from `active_tab_ids`, so a client that
+        // detaches takes its own chrome out of them and would never be told it
+        // stopped being visible — while its plugin instances outlive it and
+        // keep refreshing. Park what a departed client leaves behind; targets
+        // of still-connected clients stay governed by `all - active` above.
+        let connected_clients: BTreeSet<ClientId> = self.active_tab_ids.keys().copied().collect();
+        hidden_targets.extend(
+            self.last_visible_chrome_targets
+                .iter()
+                .filter(|(_, client_id)| !connected_clients.contains(client_id))
+                .copied(),
+        );
+        self.last_visible_chrome_targets = active_targets.clone();
+        (
+            active_targets.into_iter().collect(),
+            hidden_targets.into_iter().collect(),
+        )
     }
 
     fn log_and_report_session_state(&mut self) -> Result<()> {
diff --git a/zellij-server/src/unit/screen_tests.rs b/zellij-server/src/unit/screen_tests.rs
index 5706cb25..da62514c 100644
--- a/zellij-server/src/unit/screen_tests.rs
+++ b/zellij-server/src/unit/screen_tests.rs
@@ -378,6 +378,57 @@ fn status_bar_target_transition_hides_only_the_client_that_switched_tabs() {
     );
 }
 
+#[test]
+fn last_client_detach_parks_the_chrome_it_leaves_behind() {
+    let mut screen = create_new_screen(Size { cols: 80, rows: 24 }, true, true);
+    let (to_plugin, _plugin_receiver): ChannelWithContext<PluginInstruction> =
+        channels::unbounded();
+    screen.bus.senders.to_plugin = Some(SenderWithContext::new(to_plugin));
+    new_tab_with_status_bar_and_worker(&mut screen, 0, 1, 42, 99);
+    screen.active_tab_ids = BTreeMap::from([(1, 0)]);
+
+    let (active, hidden) = screen.status_bar_plugin_target_transition();
+    assert_eq!(active, vec![(42, 1)]);
+    assert!(hidden.is_empty());
+
+    // The last client detaches: Screen::remove_client drops it from
+    // active_tab_ids, so both target sets collapse to empty.
+    screen.active_tab_ids.remove(&1);
+    let (active_after_detach, hidden_after_detach) = screen.status_bar_plugin_target_transition();
+
+    assert!(
+        active_after_detach.is_empty(),
+        "a server with no clients has no visible chrome"
+    );
+    assert_eq!(
+        hidden_after_detach,
+        vec![(42, 1)],
+        "chrome that was visible must be told it no longer is, or it keeps \
+         refreshing the session list once a second on a server nobody watches"
+    );
+
+    let updates = session_update_events(
+        vec![fleet_session("working", &[(false, false, false)])],
+        vec![],
+        active_after_detach,
+        hidden_after_detach,
+    );
+    assert!(matches!(
+        updates.first(),
+        Some((
+            Some(42),
+            Some(1),
+            Event::CustomMessage(message, payload),
+        )) if message == VC_STATUS_BAR_VISIBILITY_MESSAGE && payload == "false"
+    ));
+
+    let (_, hidden_while_still_detached) = screen.status_bar_plugin_target_transition();
+    assert!(
+        hidden_while_still_detached.is_empty(),
+        "parking is a transition, not a per-broadcast message"
+    );
+}
+
 #[test]
 fn projector_tab_keeps_shared_status_bar_runtime_active() {
     let mut screen = create_new_screen(Size { cols: 80, rows: 24 }, true, true);

From 13394b1d167421ea8bc59dbc667fe518665a2a07 Mon Sep 17 00:00:00 2001
From: vetcoders-agents <agents@vetcoders.io>
Date: Tue, 11 Aug 2026 20:07:43 +0200
Subject: [PATCH 03/12] perf(plugins): stop get_session_list from
 re-broadcasting session info

A plugin-initiated read sent its result to Screen, which broadcast
SessionUpdate to every plugin - including the caller, which rebuilt its
model and asked again on its next timer. One visible rail therefore woke
every plugin in the session once a second, and the payload is the sum of
all live sessions' metadata on the machine.

Screen's cache is owned by the session-metadata background job, which
already refreshes it on its own cadence, so the read stays a read.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 CHANGELOG.md                                |  1 +
 zellij-server/src/plugins/zellij_exports.rs | 14 +++++++-------
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f0935966..fd23c631 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 * fix(server): a starting server no longer unlinks and re-binds a session socket that a live server still owns — it probes the path first and refuses to start when someone is listening, even if that server is too busy to answer a health probe; only missing, stale or non-socket paths are cleaned up. A server already running a session likewise rejects a second new-session request instead of re-initializing over live state
 * fix(chrome): the chrome a client had visible is parked when that client detaches, so a server with nobody attached stops refreshing the cross-session list once a second; attaching re-activates it and rebuilds the list on the spot
+* perf(plugins): `get_session_list` no longer feeds its result back into Screen — a plugin-initiated read used to trigger a `SessionUpdate` broadcast to every plugin (including the caller), a self-sustaining loop whose cost grew with the square of the live session count
 * feat(input): `Cmd+K` / `Super+k` opens the existing `❯_ Quick cmd` mini-console in every mode including LOCK; the keybind messages the active compact-bar so keyboard and click share one runner, geometry and pane-title contract, with matching Alacritty CSI-u translation and help
 
 ## [0.47.3] - 2026-08-06
diff --git a/zellij-server/src/plugins/zellij_exports.rs b/zellij-server/src/plugins/zellij_exports.rs
index 7806062f..97c8d103 100644
--- a/zellij-server/src/plugins/zellij_exports.rs
+++ b/zellij-server/src/plugins/zellij_exports.rs
@@ -4214,13 +4214,13 @@ fn get_session_list(env: &PluginEnv) {
                 &plugin_list,
             );
 
-            let _ = env
-                .senders
-                .send_to_screen(ScreenInstruction::UpdateSessionInfos(
-                    live_sessions_map.clone(),
-                    resurrectable_sessions_map.clone(),
-                ));
-
+            // Deliberately no `ScreenInstruction::UpdateSessionInfos` here.
+            // This is a plugin-initiated read: feeding it back to Screen made
+            // Screen broadcast `SessionUpdate` to every plugin, including the
+            // caller, which rebuilt its model and asked again on its next
+            // timer — a self-sustaining loop whose cost is quadratic in the
+            // number of live sessions. Screen's cache is kept fresh by the
+            // session-metadata background job, which owns that cadence.
             let snapshot = SessionListSnapshot {
                 live_sessions: live_sessions_map.into_values().collect(),
                 resurrectable_sessions: resurrectable_sessions_map.into_iter().collect(),

From 99fd26af09bf3324c32a061ec379b5ba2df66ee6 Mon Sep 17 00:00:00 2001
From: vetcoders-agents <agents@vetcoders.io>
Date: Tue, 11 Aug 2026 21:38:33 +0200
Subject: [PATCH 04/12] fix(server): keep client cleanup safe outside the
 initialized window
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two cleanup paths acted on state that need not exist yet.

RemoveClient unconditionally unwrapped `session_data` to notify Screen and
the plugin thread. A connection can end before this server ever initialized
a session — the socket-ownership probe of a racing server connects and drops
immediately, and so does any client that gives up inside the startup window.
The unwrap then panicked the server that had just won the socket, leaving
both racers with nothing. Notify only when a session is actually there.

The rejection path for a losing create-session client freed its client id
right away, while its route thread stayed alive and would send its own
RemoveClient later. Since `SessionState::new_client` always reuses the lowest
vacant id, an attach accepted in that window could receive the rejected id
and be disconnected by the late cleanup. Leave the id reserved until the
route terminates and sends the removal itself.
---
 zellij-server/src/lib.rs | 40 +++++++++++++++++++++++++---------------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/zellij-server/src/lib.rs b/zellij-server/src/lib.rs
index 427c22c0..9824bc31 100644
--- a/zellij-server/src/lib.rs
+++ b/zellij-server/src/lib.rs
@@ -997,7 +997,12 @@ pub fn start_server(mut os_input: Box<dyn ServerOsApi>, socket_path: PathBuf) {
                             ),
                         },
                     );
-                    remove_client!(client_id, os_input, session_state, session_data);
+                    // Deliberately no cleanup here. This client's route thread
+                    // is still alive and sends its own `RemoveClient` once the
+                    // connection ends; freeing the id now would hand it to the
+                    // next attach (`SessionState::new_client` always reuses the
+                    // lowest vacant id), and the late cleanup would then
+                    // disconnect that unrelated client instead.
                     continue;
                 }
                 let (config, layout) = cli_assets.load_config_and_layout();
@@ -1421,22 +1426,27 @@ pub fn start_server(mut os_input: Box<dyn ServerOsApi>, socket_path: PathBuf) {
                 } else {
                     // Handle regular client removal
                     remove_client!(client_id, os_input, session_state, session_data);
-                    session_data
-                        .write()
-                        .unwrap()
-                        .as_ref()
-                        .unwrap()
-                        .senders
-                        .send_to_screen(ScreenInstruction::RemoveClient(client_id))
-                        .unwrap();
-                    session_data
-                        .write()
+                    // A connection can end before this server ever initialized
+                    // a session: the socket-ownership probe of a racing server
+                    // connects and drops immediately, and so does any client
+                    // that gives up inside the startup window. There is no
+                    // Screen or plugin thread to notify yet, and unwrapping the
+                    // still-empty `session_data` here would panic the server
+                    // that just won the socket — leaving both racers with
+                    // nothing.
+                    let senders = session_data
+                        .read()
                         .unwrap()
                         .as_ref()
-                        .unwrap()
-                        .senders
-                        .send_to_plugin(PluginInstruction::RemoveClient(client_id))
-                        .unwrap();
+                        .map(|session_data| session_data.senders.clone());
+                    if let Some(senders) = senders {
+                        senders
+                            .send_to_screen(ScreenInstruction::RemoveClient(client_id))
+                            .unwrap();
+                        senders
+                            .send_to_plugin(PluginInstruction::RemoveClient(client_id))
+                            .unwrap();
+                    }
                 }
             },
             ServerInstruction::SendWebClientsForbidden(client_id) => {

From c5c7779f9181b69c3e7c88ce39ab549d4b3af4d9 Mon Sep 17 00:00:00 2001
From: vetcoders-agents <agents@vetcoders.io>
Date: Tue, 11 Aug 2026 21:38:40 +0200
Subject: [PATCH 05/12] fix(sessions): drop the non-Unix ownership probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Windows implementation answered ownership from the PID written in the
session marker file. A PID recycled after a crash reads as live, which
strands the session name until someone removes the marker by hand — strictly
worse than not probing at all.

No probe is needed there. Off Unix the listener is a named pipe whose name
the OS refuses to hand out twice, and `ipc_bind` writes the marker only after
that bind succeeds, so the bind itself already decides ownership. Probing by
connecting to the pipe would be worse still: it occupies the target server's
accept loop, which pairs every accepted stream with a blocking accept on the
reply pipe.

Document the probe as the Unix-only mechanism it is.
---
 docs/VC_FRAME_OPERATOR_SURFACE.md |  6 +++++
 zellij-utils/src/sessions.rs      | 44 ++++++-------------------------
 2 files changed, 14 insertions(+), 36 deletions(-)

diff --git a/docs/VC_FRAME_OPERATOR_SURFACE.md b/docs/VC_FRAME_OPERATOR_SURFACE.md
index 31e021d6..a24b34d3 100644
--- a/docs/VC_FRAME_OPERATOR_SURFACE.md
+++ b/docs/VC_FRAME_OPERATOR_SURFACE.md
@@ -92,6 +92,12 @@ server that already runs a session also rejects a second new-session request
 rather than re-initializing over live state; the caller sees the refusal and
 can attach to the existing session instead.
 
+The probe is a Unix-only mechanism, because only there is the session path a
+socket that a second server can unlink and rebind. Off Unix the path is a
+marker file and the listener is a named pipe whose name the OS refuses to hand
+out twice, so the bind itself already decides ownership — the marker is written
+only after it succeeds.
+
 ## Key Contract
 
 The shipped defaults promise one navigation language — one modifier per
diff --git a/zellij-utils/src/sessions.rs b/zellij-utils/src/sessions.rs
index be7e15f9..91339a73 100644
--- a/zellij-utils/src/sessions.rs
+++ b/zellij-utils/src/sessions.rs
@@ -290,42 +290,14 @@ pub fn probe_socket_ownership(path: &std::path::Path) -> SocketOwnership {
     }
 }
 
-/// On Windows the socket path is a marker file holding the server PID (the
-/// listener itself is a named pipe, which the OS already refuses to bind
-/// twice). Liveness of that PID is the ownership answer.
-#[cfg(windows)]
-pub fn probe_socket_ownership(path: &std::path::Path) -> SocketOwnership {
-    use windows_sys::Win32::Foundation::CloseHandle;
-    use windows_sys::Win32::System::Threading::{OpenProcess, PROCESS_QUERY_LIMITED_INFORMATION};
-
-    let Ok(pid_str) = fs::read_to_string(path) else {
-        return SocketOwnership::Vacant;
-    };
-    let Ok(pid) = pid_str.trim().parse::<u32>() else {
-        // Marker file exists but carries no valid PID (eg. empty, written by
-        // an older version) — nobody can be reached through it.
-        return SocketOwnership::Vacant;
-    };
-    let alive = unsafe {
-        let handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, 0, pid);
-        if handle.is_null() {
-            false
-        } else {
-            CloseHandle(handle);
-            true
-        }
-    };
-    if alive {
-        SocketOwnership::Live
-    } else {
-        SocketOwnership::Vacant
-    }
-}
-
-#[cfg(not(any(unix, windows)))]
-pub fn probe_socket_ownership(_path: &std::path::Path) -> SocketOwnership {
-    SocketOwnership::Vacant
-}
+// Deliberately no non-Unix implementation. Off Unix the session path is a
+// marker file and the listener is a named pipe whose name the OS refuses to
+// hand out twice, so `ipc_bind` — which writes the marker only after that bind
+// succeeds — already answers the ownership question without a probe. Guessing
+// from the marker's PID would be strictly worse: a PID recycled after a crash
+// reads as live and strands the session name, while connecting to the pipe to
+// check would occupy the target server's accept loop, which pairs every
+// accepted stream with a blocking accept on the reply pipe.
 
 #[cfg(all(test, unix))]
 mod session_probe_timeout_tests {

From 622227cf859dc504bc4681b4e45be63118fd73ad Mon Sep 17 00:00:00 2001
From: vetcoders-agents <agents@vetcoders.io>
Date: Tue, 11 Aug 2026 22:01:43 +0200
Subject: [PATCH 06/12] fix(server): keep the socket ownership probe Unix-only

`probe_socket_ownership` only exists under `#[cfg(unix)]`, but the server
startup path called it unconditionally, so the Windows build stopped
resolving it. Gate the call and its import the same way and say in place
why the non-Unix path needs no probe: there the session path is a marker
file and the listener is a named pipe whose name the OS refuses to hand
out twice, so `ipc_bind` already decides ownership.
---
 zellij-server/src/lib.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/zellij-server/src/lib.rs b/zellij-server/src/lib.rs
index 9824bc31..48ab5391 100644
--- a/zellij-server/src/lib.rs
+++ b/zellij-server/src/lib.rs
@@ -77,9 +77,11 @@ use zellij_utils::{
         plugins::PluginAliases,
     },
     ipc::{ClientAttributes, ExitReason, ServerToClientMsg},
-    sessions::SocketOwnership,
     shared::{default_palette, web_server_base_url},
 };
+// Only the Unix startup path probes socket ownership.
+#[cfg(unix)]
+use zellij_utils::sessions::SocketOwnership;
 
 pub type ClientId = u16;
 
@@ -813,6 +815,12 @@ pub fn start_server(mut os_input: Box<dyn ServerOsApi>, socket_path: PathBuf) {
                 // running but unreachable: an orphan with zero clients that no
                 // reaper ever collects, burning CPU until reboot. A stale file
                 // left by a crashed server stays legal to clean up.
+                //
+                // Unix only: elsewhere the path is a marker file and the
+                // listener is a named pipe whose name the OS refuses to hand
+                // out twice, so the bind below already decides ownership and
+                // there is nothing here to take away.
+                #[cfg(unix)]
                 match zellij_utils::sessions::probe_socket_ownership(&socket_path) {
                     SocketOwnership::Vacant => {
                         drop(std::fs::remove_file(&socket_path));

From 23d68e3f6381c0afd2b6b7d851cc42c8f02d5259 Mon Sep 17 00:00:00 2001
From: div0-space <void@div0.space>
Date: Tue, 11 Aug 2026 21:29:50 +0200
Subject: [PATCH 07/12] [claude/interactive] fix(rail): stop bare arrows from
 switching sessions on a focused rail

- LOCK (^g) routes raw keys to the focused pane; a focused rail consuming
  bare Up/Down became a hidden, mode-proof session switcher
- product key-contract v3: arrow session switching lives only in the ^T
  tab-mode binds (vc_rail_nav pipe) and the always-on Super chords
- rail keeps Enter/ordinals/bucket hotkeys/+/-/Esc; mouse hover+click untouched
- new contract test rail_ignores_bare_arrow_keys (RED observed pre-cut);
  session-manager suite 120/120, fmt + clippy -D warnings clean

Authored-By: claude <agents@vetcoders.io>
---
 default-plugins/session-manager/src/main.rs | 25 +++++++++++++--------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/default-plugins/session-manager/src/main.rs b/default-plugins/session-manager/src/main.rs
index 0f752824..fbb476a2 100644
--- a/default-plugins/session-manager/src/main.rs
+++ b/default-plugins/session-manager/src/main.rs
@@ -1857,16 +1857,11 @@ impl State {
         }
     }
     fn handle_session_rail_key(&mut self, key: KeyWithModifier) -> bool {
+        // Bare arrows are deliberately NOT handled here. Session switching by
+        // arrow lives only in the ^T tab-mode keybinds (vc_rail_nav pipe) and
+        // the always-on Super chords; a focused rail consuming raw arrows made
+        // LOCK mode switch sessions, since LOCK routes keys to the focused pane.
         match key.bare_key {
-            BareKey::Down if key.has_no_modifiers() => {
-                // Operator contract: arrow = immediate switch, no Enter confirm.
-                self.switch_session_relative(1);
-                true
-            },
-            BareKey::Up if key.has_no_modifiers() => {
-                self.switch_session_relative(-1);
-                true
-            },
             BareKey::Enter if key.has_no_modifiers() => {
                 self.handle_session_rail_selection();
                 true
@@ -3287,6 +3282,18 @@ mod rail_tests {
         }
     }
 
+    /// Product key-contract v3: bare arrows switch sessions ONLY through the
+    /// ^T tab-mode keybinds (vc_rail_nav pipe). A focused rail pane must not
+    /// consume them — LOCK routes raw keys to the focused pane, so a rail
+    /// arrow handler becomes a hidden mode-proof session switcher.
+    #[test]
+    fn rail_ignores_bare_arrow_keys() {
+        let mut state = State::default();
+        state.sessions.session_ui_infos = vec![session("solo", true)];
+        assert!(!state.handle_session_rail_key(KeyWithModifier::new(BareKey::Up)));
+        assert!(!state.handle_session_rail_key(KeyWithModifier::new(BareKey::Down)));
+    }
+
     fn session_launched_at(name: &str, is_current_session: bool, secs: u64) -> SessionUiInfo {
         SessionUiInfo {
             creation_time: Duration::from_secs(secs),

From afbe74b84fc989bb4aca40cfe16048a4ce935b22 Mon Sep 17 00:00:00 2001
From: div0-space <void@div0.space>
Date: Tue, 11 Aug 2026 23:06:24 +0200
Subject: [PATCH 08/12] [codex/headless] fix(ci): stabilize runtime and
 cross-platform gates

Fix held-command reruns by reserving active PTY identifiers before respawn, harden E2E readiness around exact accepted frames, and isolate command fixtures. Extend triage startup budgets for real fresh-session latency, normalize wire-contract line endings, reject symlink traversal during legacy migration, refresh deterministic snapshots and plugin assets, and inventory the clinic current-exe diagnostic in the Semgrep evidence surface.

Authored-By: codex <agents@vetcoders.io>

session_id: 019ff225-49ff-72b0-9078-139cdc37ff61

time: 2026-08-11T23:06:24:z

runtime: headless
---
 security/semgrep/EVIDENCE.md                  |   6 +-
 security/semgrep/baseline.json                |  12 +-
 security/semgrep/findings.jsonl               | 647 +++++++++---------
 src/run_triage_cli.rs                         |   8 +-
 src/tests/e2e/cases.rs                        |  66 +-
 src/tests/e2e/remote_runner.rs                |  13 +-
 ...e__tests__e2e__cases__bracketed_paste.snap |   1 +
 ...lly_when_active_terminal_is_too_small.snap |   1 +
 ..._frame__tests__e2e__cases__close_pane.snap |   1 +
 ...e2e__cases__detach_and_attach_session.snap |  48 +-
 ...ts__e2e__cases__focus_pane_with_mouse.snap |   2 +-
 ...load_plugins_in_background_on_startup.snap |  48 +-
 ...c_frame__tests__e2e__cases__lock_mode.snap |   2 +-
 ...ests__e2e__cases__mirrored_sessions-2.snap |  48 +-
 ..._tests__e2e__cases__mirrored_sessions.snap |  16 +-
 ...__tests__e2e__cases__move_tab_to_left.snap |   1 +
 ...ove_tab_to_left_until_it_wraps_around.snap |   1 +
 ..._tests__e2e__cases__move_tab_to_right.snap |   1 +
 ...ve_tab_to_right_until_it_wraps_around.snap |   1 +
 ...ers_in_different_panes_and_same_tab-2.snap |  48 +-
 ...users_in_different_panes_and_same_tab.snap |  16 +-
 ...s__multiple_users_in_different_tabs-2.snap |  48 +-
 ...ses__multiple_users_in_different_tabs.snap |  16 +-
 ...multiple_users_in_same_pane_and_tab-2.snap |  48 +-
 ...__multiple_users_in_same_pane_and_tab.snap |  16 +-
 ...rame__tests__e2e__cases__open_new_tab.snap |   1 +
 ...erride_layout_from_default_to_compact.snap |   2 +-
 ...tests__e2e__cases__pin_floating_panes.snap |   4 +-
 ...2e__cases__quit_and_resurrect_session.snap |  25 +-
 ...t_session_with_viewport_serialization.snap |  25 +-
 ...frame__tests__e2e__cases__resize_pane.snap |   2 +-
 ...s__e2e__cases__resize_terminal_window.snap |   2 +-
 ...__e2e__cases__scrolling_inside_a_pane.snap |   2 +-
 ...s__scrolling_inside_a_pane_with_mouse.snap |  44 +-
 ...send_blocking_command_through_the_cli.snap |   7 +-
 ...__cases__send_command_through_the_cli.snap |  11 +-
 ...2e__cases__split_terminals_vertically.snap |   2 +-
 ...e2e__cases__start_without_pane_frames.snap |  48 +-
 ..._e2e__cases__starts_with_one_terminal.snap |   1 +
 ...__status_bar_loads_custom_keybindings.snap |  48 +-
 ...c_frame__tests__e2e__cases__tmux_mode.snap |   2 +-
 ...ts__e2e__cases__toggle_floating_panes.snap |   3 +-
 ...s__e2e__cases__toggle_pane_fullscreen.snap |   2 +-
 ...__e2e__cases__typing_exit_closes_pane.snap |   1 +
 ...__tests__e2e__cases__undo_rename_pane.snap |   1 +
 ...e__tests__e2e__cases__undo_rename_tab.snap |   1 +
 ..._use_custom_layout_with_relative_path.snap |   2 +-
 ...cases__watcher_client_functionality-2.snap |  16 +-
 ...__cases__watcher_client_functionality.snap |  48 +-
 src/tests/fixtures/append-echo-script.sh      |   8 +-
 tools/semgrep_inventory.py                    |  20 +
 zellij-server/src/os_input_output.rs          |  10 +-
 zellij-server/src/os_input_output_unix.rs     |  49 ++
 zellij-server/src/os_input_output_windows.rs  |  21 +
 ...s__dump_layout_success_plugin_command.snap |   2 +-
 ...tests__override_layout_plugin_command.snap |   2 +-
 .../assets/plugins/session-manager.wasm       | Bin 1720322 -> 1720103 bytes
 .../src/client_server_contract/mod.rs         |  23 +-
 zellij-utils/src/consts.rs                    |  34 +-
 ..._config_from_default_assets_to_string.snap |   6 +
 ...efault_assets_to_string_with_comments.snap |   6 +
 ..._default_config_with_no_cli_arguments.snap | 406 +++++++++++
 ...out_env_vars_override_config_env_vars.snap | 406 +++++++++++
 ..._layout_themes_override_config_themes.snap | 406 +++++++++++
 ..._ui_config_overrides_config_ui_config.snap | 406 +++++++++++
 65 files changed, 2552 insertions(+), 668 deletions(-)

diff --git a/security/semgrep/EVIDENCE.md b/security/semgrep/EVIDENCE.md
index e3294df5..80a11d8c 100644
--- a/security/semgrep/EVIDENCE.md
+++ b/security/semgrep/EVIDENCE.md
@@ -1,8 +1,8 @@
 # Semgrep adjudication evidence
 
 Receiver baseline: Semgrep 1.172.0, explicit registry pack `p/rust`, 60 resolved
-rules, 57 rules executed over 358 targets, 326 blocking findings and zero scan
-errors at `6ba1ab7b`. The exact raw JSON hash is pinned in `baseline.json`;
+rules, 57 rules executed over 363 targets, 327 blocking findings and zero scan
+errors at `09656c0c`. The exact raw JSON hash is pinned in `baseline.json`;
 `findings.jsonl` is the checked-in machine-verifiable verdict surface.
 The gate also hashes Semgrep's normalized resolved rule representation, so a
 registry rule-body change fails even when rule IDs stay the same. Scanner
@@ -85,6 +85,8 @@ temp directory and contain only the current user's terminal dump.
 
 `current_exe` starts another internal mode of the already running vc-frame
 binary. It establishes no identity, trust, privilege or update provenance.
+The clinic also resolves the current executable for a read-only mtime and
+local process-name drift diagnosis; it neither executes nor authorizes it.
 The triage transfer-lock tests additionally re-enter the same test executable
 under fixed test names with only the selected isolated scenario or the lock
 path and expected lock state. The macOS-only xtask installer test copies its
diff --git a/security/semgrep/baseline.json b/security/semgrep/baseline.json
index e8eff265..7bf2a8ad 100644
--- a/security/semgrep/baseline.json
+++ b/security/semgrep/baseline.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
-  "captured_at": "2026-08-04T17:31:51Z",
-  "repo_sha": "6ba1ab7bcec7a3e5a2c5c6466ef156a598aafd41",
+  "captured_at": "2026-08-11T21:03:51Z",
+  "repo_sha": "09656c0c6cfd91252cfe229281e2b12bf7d8435b",
   "scanner_version": "1.172.0",
   "config": "p/rust",
   "config_kind": "explicit_registry_pack",
@@ -70,14 +70,14 @@
     "skills.command-execution.skill-rust-command-dev-tcp.skill-rust-command-dev-tcp",
     "skills.command-execution.skill-rust-command-network-tools.skill-rust-command-network-tools"
   ],
-  "target_count": 358,
-  "finding_count": 326,
+  "target_count": 363,
+  "finding_count": 327,
   "finding_counts_by_rule": {
     "rust.actix.path-traversal.tainted-path.tainted-path": 9,
     "rust.lang.security.args-os.args-os": 1,
-    "rust.lang.security.current-exe.current-exe": 12,
+    "rust.lang.security.current-exe.current-exe": 13,
     "rust.lang.security.temp-dir.temp-dir": 34,
     "rust.lang.security.unsafe-usage.unsafe-usage": 270
   },
-  "raw_results_sha256": "508a49446d03581fa523f582e748282873df1b2df272a854bebd5802c6feed7f"
+  "raw_results_sha256": "422c956f69fccb40ac787be7299ab9b38fcb19ad3aedbed168b8ada902d30530"
 }
diff --git a/security/semgrep/findings.jsonl b/security/semgrep/findings.jsonl
index 2c178317..edad5e91 100644
--- a/security/semgrep/findings.jsonl
+++ b/security/semgrep/findings.jsonl
@@ -1,326 +1,327 @@
 {"column":19,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","default-plugins/link/src/main.rs"],"fingerprint":"39f76ce6f4bb74784f53e05d7f20f57bcab46fba85d369b4f16d95916be6181432905b1cf4c63ced6355827d84439b2e9bb1519203307650071dcb98b33dd3d9_0","id":"SG-0001","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":506,"owner":"Rust test harness","path":"default-plugins/link/src/main.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
 {"column":20,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","default-plugins/strider/src/file_list_view.rs"],"fingerprint":"59025770226c12a15e8c43bea49f4393aa49ac2ff3fa878e3e58ef3c65b8aadd011cdce60f8aedf486b7ec60142c5216a9ad81f8270b0995a6bbcdb30b194ee0_0","id":"SG-0002","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":318,"owner":"Rust test harness","path":"default-plugins/strider/src/file_list_view.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
 {"column":20,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","default-plugins/strider/src/main.rs"],"fingerprint":"73a79fec102c14856700fa8df2d3ba6217f79a9d15cdb6e95700d8438031cd56970634047c89603dbf11ab80fc8bcdd92b460de0c1e690cc526914009f0f37df_0","id":"SG-0003","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":281,"owner":"Rust test harness","path":"default-plugins/strider/src/main.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":20,"evidence":["security/semgrep/EVIDENCE.md#transfer-lock-descriptor","src/run_triage_cli.rs"],"fingerprint":"6c902f1851ead06091728b45e6a060e439c0e38eaa83fc3f192125c17abed294ce2e55be3f3aa17e5f5bf9ccdfdec3f999670291bc320ca177ffe8eedae8f6e1_0","id":"SG-0004","invariant":"The inherited descriptor is validated as open, marked close-on-exec, matched to the canonical lock path by device and inode, and adopted by exactly one Rust owner.","line":98,"owner":"Triage transfer lock","path":"src/run_triage_cli.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":26,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_0","id":"SG-0005","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":338,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":35,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_1","id":"SG-0006","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2237,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":41,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_2","id":"SG-0007","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2296,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":44,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_3","id":"SG-0008","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2310,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":41,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_4","id":"SG-0009","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2341,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":44,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_5","id":"SG-0010","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2355,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":25,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","src/run_triage_cli.rs"],"fingerprint":"47dae781288c73b0bd85c5f04dfa363a58b6ef7c5289e9cb35353306672cd0106770fe0b232c2ca410ee39a3e8edece1cc74dd4f04ad282514d42a1bcb9d4eb3_0","id":"SG-0011","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2673,"owner":"Rust test harness","path":"src/run_triage_cli.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":25,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","src/run_triage_cli.rs"],"fingerprint":"47dae781288c73b0bd85c5f04dfa363a58b6ef7c5289e9cb35353306672cd0106770fe0b232c2ca410ee39a3e8edece1cc74dd4f04ad282514d42a1bcb9d4eb3_1","id":"SG-0012","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2721,"owner":"Rust test harness","path":"src/run_triage_cli.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":29,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","xtask/src/pipelines.rs"],"fingerprint":"88eed7e3a59cdf5959bd7e74e2211ca358869824e8e94b6392fdb51c6268fb581656ac0378da29f5d9a35e97513ab51113778eaf5ff39ce4fdb0070a29073b33_0","id":"SG-0013","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1256,"owner":"Rust test harness","path":"xtask/src/pipelines.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#current-executable","xtask/src/pipelines.rs"],"fingerprint":"cd2183f84fb155fb87f62b8b770a81cc7a77d846d6243b3a5e6487e8980668e8ac690c6fe442fa765b617d99534fb4d94e145b27db34649b42c4a762ab365b6d_0","id":"SG-0014","invariant":"The executable path remains inside cfg(test), is copied into a process-private test directory, and is never executed with elevated trust.","line":1859,"owner":"Rust test harness","path":"xtask/src/pipelines.rs","reason":"The macOS-only installer test copies its own real Mach-O test executable as local fixture bytes.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/lib.rs"],"fingerprint":"c87420950484497eb9b425f1f3993dd775cbdfa0ca86acf4c12695080cc455902293b3821d2a63b86f49f57389153a758db42382753e5e348ec3f6bdce71525f_0","id":"SG-0015","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":261,"owner":"Client process lifecycle","path":"zellij-client/src/lib.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/lib.rs"],"fingerprint":"c87420950484497eb9b425f1f3993dd775cbdfa0ca86acf4c12695080cc455902293b3821d2a63b86f49f57389153a758db42382753e5e348ec3f6bdce71525f_1","id":"SG-0016","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":303,"owner":"Client process lifecycle","path":"zellij-client/src/lib.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/lib.rs"],"fingerprint":"c87420950484497eb9b425f1f3993dd775cbdfa0ca86acf4c12695080cc455902293b3821d2a63b86f49f57389153a758db42382753e5e348ec3f6bdce71525f_2","id":"SG-0017","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":363,"owner":"Client process lifecycle","path":"zellij-client/src/lib.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/lib.rs"],"fingerprint":"c87420950484497eb9b425f1f3993dd775cbdfa0ca86acf4c12695080cc455902293b3821d2a63b86f49f57389153a758db42382753e5e348ec3f6bdce71525f_3","id":"SG-0018","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":391,"owner":"Client process lifecycle","path":"zellij-client/src/lib.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":18,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-client/src/os_input_output_windows.rs"],"fingerprint":"52ce911ce8f90612c71d0c6a47e51730525436de1f1f363a0e3b58552f475fb5186121aa6d5f3e958087da03d3b8f533dd22e6075fd18468862832dd60e8fd62_0","id":"SG-0019","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":106,"owner":"Windows platform I/O","path":"zellij-client/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-client/src/stdin_handler_windows.rs"],"fingerprint":"8518e91bd06482347ee54f4f1f4bdbd24ce69a309c1bb7858da4f0c8c94ddc562222ac501a779825e47b9b9999f4952d0ce8028c51135eda228c390518239db2_0","id":"SG-0020","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":30,"owner":"Windows platform I/O","path":"zellij-client/src/stdin_handler_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-client/src/stdin_handler_windows.rs"],"fingerprint":"8518e91bd06482347ee54f4f1f4bdbd24ce69a309c1bb7858da4f0c8c94ddc562222ac501a779825e47b9b9999f4952d0ce8028c51135eda228c390518239db2_1","id":"SG-0021","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":78,"owner":"Windows platform I/O","path":"zellij-client/src/stdin_handler_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":15,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/web_client/mod.rs"],"fingerprint":"d3359c43a06aa4e074f8d62eaeb46106e7d4bc95b81dd9a7e45d46abe01722ee027a8534ecacbe32f15764a019fd53ca478bfab4fad84bd4b20039aff6673141_0","id":"SG-0022","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":408,"owner":"Client process lifecycle","path":"zellij-client/src/web_client/mod.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_0","id":"SG-0023","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":84,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_1","id":"SG-0024","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":144,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_2","id":"SG-0025","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":216,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_3","id":"SG-0026","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":283,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_4","id":"SG-0027","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":499,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_5","id":"SG-0028","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":678,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_6","id":"SG-0029","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":728,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_7","id":"SG-0030","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":790,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_8","id":"SG-0031","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":937,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_9","id":"SG-0032","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1114,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_10","id":"SG-0033","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1262,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_11","id":"SG-0034","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1397,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_12","id":"SG-0035","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1496,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_13","id":"SG-0036","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1673,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_14","id":"SG-0037","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1787,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_15","id":"SG-0038","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1960,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_16","id":"SG-0039","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2144,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_17","id":"SG-0040","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2314,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_18","id":"SG-0041","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2413,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_19","id":"SG-0042","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2500,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_20","id":"SG-0043","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2620,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_21","id":"SG-0044","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2717,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_22","id":"SG-0045","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2800,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_23","id":"SG-0046","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2855,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#process-probes","zellij-server/src/lib.rs"],"fingerprint":"b1fc0b3cf8af62bac26937a0171ed3d10d9868e626ed76f45c82465875ad082d0a77c261c3fe56bb8efc7eb93e9a01c7e6766e7a967636a212bf68cbd5473592_0","id":"SG-0047","invariant":"Unix daemonization is isolated to startup before threaded work and every fork outcome is handled.","line":773,"owner":"Server process lifecycle","path":"zellij-server/src/lib.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":21,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_0","id":"SG-0048","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":95,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_1","id":"SG-0049","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":129,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_2","id":"SG-0050","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":372,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":23,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_3","id":"SG-0051","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":399,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":19,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_4","id":"SG-0052","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":418,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_5","id":"SG-0053","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":879,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":26,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_6","id":"SG-0054","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":990,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_7","id":"SG-0055","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":1008,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_8","id":"SG-0056","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":1045,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":19,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_9","id":"SG-0057","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":1059,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_0","id":"SG-0058","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":68,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":27,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_1","id":"SG-0059","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":100,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":12,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_2","id":"SG-0060","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":106,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_3","id":"SG-0061","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":110,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_4","id":"SG-0062","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":117,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_5","id":"SG-0063","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":180,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":12,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_6","id":"SG-0064","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":212,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_7","id":"SG-0065","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":223,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_8","id":"SG-0066","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":226,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_9","id":"SG-0067","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":229,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":24,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_10","id":"SG-0068","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":284,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":18,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_11","id":"SG-0069","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":389,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":18,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_12","id":"SG-0070","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":405,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_13","id":"SG-0071","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":417,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":14,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_14","id":"SG-0072","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":437,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_15","id":"SG-0073","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":455,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":8,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_16","id":"SG-0074","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":461,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":8,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_17","id":"SG-0075","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":470,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_18","id":"SG-0076","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":482,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":34,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_19","id":"SG-0077","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":487,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":39,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_20","id":"SG-0078","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":508,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":14,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_21","id":"SG-0079","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":510,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_22","id":"SG-0080","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":525,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_23","id":"SG-0081","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":535,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":12,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_24","id":"SG-0082","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":596,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_25","id":"SG-0083","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":597,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":17,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_26","id":"SG-0084","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":608,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_27","id":"SG-0085","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":619,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":21,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_28","id":"SG-0086","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":629,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":30,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_29","id":"SG-0087","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":758,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":26,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_30","id":"SG-0088","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":787,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":26,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_31","id":"SG-0089","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":818,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":18,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_32","id":"SG-0090","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":843,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":25,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-server/src/plugins/plugin_loader.rs"],"fingerprint":"d647f9d8f9936be80fe7d44f27fc5f8f8dca37dea71e15520eec66ee7f021024f71ab1c51ef7aef6f93816f54b61aa9381bdb3b6423e81923be5c0a3ea078e54_0","id":"SG-0091","invariant":"The path is a host-selected WASI preopen, not an HTTP parameter.","line":36,"owner":"Plugin filesystem capability","path":"zellij-server/src/plugins/plugin_loader.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"060633d99d0466ed8923e22ea91c43c825d863aa68e7fc933e02afddf38ffc28c5eaaced579a027b9ef9f3ef3749982fefb3c7b49b39061e3faa69294b6c5927_0","id":"SG-0092","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":390,"owner":"Rust test harness","path":"zellij-server/src/plugins/unit/plugin_tests.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"060633d99d0466ed8923e22ea91c43c825d863aa68e7fc933e02afddf38ffc28c5eaaced579a027b9ef9f3ef3749982fefb3c7b49b39061e3faa69294b6c5927_1","id":"SG-0093","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":478,"owner":"Rust test harness","path":"zellij-server/src/plugins/unit/plugin_tests.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"060633d99d0466ed8923e22ea91c43c825d863aa68e7fc933e02afddf38ffc28c5eaaced579a027b9ef9f3ef3749982fefb3c7b49b39061e3faa69294b6c5927_2","id":"SG-0094","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":574,"owner":"Rust test harness","path":"zellij-server/src/plugins/unit/plugin_tests.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":13,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"060633d99d0466ed8923e22ea91c43c825d863aa68e7fc933e02afddf38ffc28c5eaaced579a027b9ef9f3ef3749982fefb3c7b49b39061e3faa69294b6c5927_3","id":"SG-0095","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":670,"owner":"Rust test harness","path":"zellij-server/src/plugins/unit/plugin_tests.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":37,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-server/src/plugins/watch_filesystem.rs"],"fingerprint":"762af5f57e999ca9e5a3e0272cf8a536a6269709d4a3f18b3229f8cb5023f33bb5cf0525b4293ff7afa3370116373571f0311f01b4516b0d3d4a00d1954255ad_0","id":"SG-0096","invariant":"The hit only converts an authorized host cwd before a local watcher is registered.","line":47,"owner":"Plugin filesystem capability","path":"zellij-server/src/plugins/watch_filesystem.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
-{"column":15,"evidence":["security/semgrep/EVIDENCE.md#process-environment","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"c17076ebe456293ec9c60a89a0dbe0ee9dffb54eed6ca254f62487cc294b9af551ef8a2eb8d19568307fb2a1949d03c504ca8be6390443ad183901969802a756_0","id":"SG-0097","invariant":"Environment mutation is confined to synchronous host-command handling and the explicitly requested variable.","line":3936,"owner":"Plugin host API","path":"zellij-server/src/plugins/zellij_exports.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":24,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-server/src/tab/mod.rs#edit_scrollback"],"fingerprint":"1955a32a03ba838c7b6b14e92daf3cb943bd16a51f21c79ad312af6b60451522cae6895077dccf14966fdad727ba3816f70345ec559d9c30c8be545fea56cc73_0","id":"SG-0098","invariant":"Every editor dump has a new UUID v4 and carries only current-user terminal contents.","line":5328,"owner":"Terminal scrollback","path":"zellij-server/src/tab/mod.rs","reason":"The rule flags temp_dir itself; each scrollback file appends a fresh UUID v4.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":24,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-server/src/tab/mod.rs#edit_scrollback"],"fingerprint":"1955a32a03ba838c7b6b14e92daf3cb943bd16a51f21c79ad312af6b60451522cae6895077dccf14966fdad727ba3816f70345ec559d9c30c8be545fea56cc73_1","id":"SG-0099","invariant":"Every editor dump has a new UUID v4 and carries only current-user terminal contents.","line":5355,"owner":"Terminal scrollback","path":"zellij-server/src/tab/mod.rs","reason":"The rule flags temp_dir itself; each scrollback file appends a fresh UUID v4.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":28,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-server/src/tab/mod.rs#edit_scrollback"],"fingerprint":"1955a32a03ba838c7b6b14e92daf3cb943bd16a51f21c79ad312af6b60451522cae6895077dccf14966fdad727ba3816f70345ec559d9c30c8be545fea56cc73_2","id":"SG-0100","invariant":"Every editor dump has a new UUID v4 and carries only current-user terminal contents.","line":5381,"owner":"Terminal scrollback","path":"zellij-server/src/tab/mod.rs","reason":"The rule flags temp_dir itself; each scrollback file appends a fresh UUID v4.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":28,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-server/src/tab/mod.rs#edit_scrollback"],"fingerprint":"1955a32a03ba838c7b6b14e92daf3cb943bd16a51f21c79ad312af6b60451522cae6895077dccf14966fdad727ba3816f70345ec559d9c30c8be545fea56cc73_3","id":"SG-0101","invariant":"Every editor dump has a new UUID v4 and carries only current-user terminal contents.","line":5405,"owner":"Terminal scrollback","path":"zellij-server/src/tab/mod.rs","reason":"The rule flags temp_dir itself; each scrollback file appends a fresh UUID v4.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_0","id":"SG-0102","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":57,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_1","id":"SG-0103","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":66,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_2","id":"SG-0104","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":76,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_3","id":"SG-0105","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":87,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_4","id":"SG-0106","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":94,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_5","id":"SG-0107","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":103,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_6","id":"SG-0108","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":114,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_7","id":"SG-0109","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":129,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_8","id":"SG-0110","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":148,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_9","id":"SG-0111","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":180,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_10","id":"SG-0112","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":191,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_11","id":"SG-0113","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":210,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_12","id":"SG-0114","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":265,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_13","id":"SG-0115","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":310,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_14","id":"SG-0116","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":346,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_15","id":"SG-0117","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":380,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_16","id":"SG-0118","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":396,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_17","id":"SG-0119","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":417,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_18","id":"SG-0120","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":432,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_19","id":"SG-0121","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":447,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_20","id":"SG-0122","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":464,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_21","id":"SG-0123","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":482,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_22","id":"SG-0124","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":495,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_23","id":"SG-0125","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":510,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_24","id":"SG-0126","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":527,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_25","id":"SG-0127","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":546,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_26","id":"SG-0128","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":562,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_27","id":"SG-0129","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":581,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_28","id":"SG-0130","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":597,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_29","id":"SG-0131","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":614,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_30","id":"SG-0132","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":632,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_31","id":"SG-0133","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":652,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_32","id":"SG-0134","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":669,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_33","id":"SG-0135","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":692,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_34","id":"SG-0136","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":720,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_35","id":"SG-0137","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":748,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_36","id":"SG-0138","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":776,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_37","id":"SG-0139","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":792,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_38","id":"SG-0140","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":805,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_39","id":"SG-0141","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":813,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_40","id":"SG-0142","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":822,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_41","id":"SG-0143","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":836,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_42","id":"SG-0144","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":855,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_43","id":"SG-0145","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":873,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_44","id":"SG-0146","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":881,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_45","id":"SG-0147","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":889,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_46","id":"SG-0148","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":897,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_47","id":"SG-0149","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":906,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_48","id":"SG-0150","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":914,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_49","id":"SG-0151","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":922,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_50","id":"SG-0152","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":930,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_51","id":"SG-0153","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":941,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_52","id":"SG-0154","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":957,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_53","id":"SG-0155","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":972,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_54","id":"SG-0156","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":995,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_55","id":"SG-0157","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1019,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_56","id":"SG-0158","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1036,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_57","id":"SG-0159","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1049,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_58","id":"SG-0160","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1057,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_59","id":"SG-0161","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1070,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_60","id":"SG-0162","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1078,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_61","id":"SG-0163","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1091,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_62","id":"SG-0164","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1099,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_63","id":"SG-0165","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1107,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_64","id":"SG-0166","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1115,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_65","id":"SG-0167","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1123,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_66","id":"SG-0168","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1131,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_67","id":"SG-0169","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1139,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_68","id":"SG-0170","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1147,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_69","id":"SG-0171","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1155,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_70","id":"SG-0172","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1166,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_71","id":"SG-0173","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1174,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_72","id":"SG-0174","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1182,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_73","id":"SG-0175","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1190,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_74","id":"SG-0176","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1198,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_75","id":"SG-0177","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1206,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_76","id":"SG-0178","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1214,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_77","id":"SG-0179","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1222,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_78","id":"SG-0180","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1230,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_79","id":"SG-0181","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1238,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_80","id":"SG-0182","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1246,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_81","id":"SG-0183","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1254,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_82","id":"SG-0184","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1262,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_83","id":"SG-0185","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1270,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_84","id":"SG-0186","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1277,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_85","id":"SG-0187","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1285,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_86","id":"SG-0188","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1293,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_87","id":"SG-0189","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1301,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_88","id":"SG-0190","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1308,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_89","id":"SG-0191","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1316,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_90","id":"SG-0192","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1324,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_91","id":"SG-0193","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1332,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_92","id":"SG-0194","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1340,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_93","id":"SG-0195","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1348,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_94","id":"SG-0196","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1359,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_95","id":"SG-0197","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1366,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_96","id":"SG-0198","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1374,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_97","id":"SG-0199","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1382,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_98","id":"SG-0200","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1398,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_99","id":"SG-0201","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1414,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_100","id":"SG-0202","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1425,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_101","id":"SG-0203","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1436,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_102","id":"SG-0204","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1447,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_103","id":"SG-0205","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1458,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_104","id":"SG-0206","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1469,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_105","id":"SG-0207","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1482,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_106","id":"SG-0208","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1494,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_107","id":"SG-0209","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1512,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_108","id":"SG-0210","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1523,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_109","id":"SG-0211","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1543,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_110","id":"SG-0212","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1561,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_111","id":"SG-0213","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1569,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_112","id":"SG-0214","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1577,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_113","id":"SG-0215","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1585,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_114","id":"SG-0216","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1593,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_115","id":"SG-0217","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1601,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_116","id":"SG-0218","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1619,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_117","id":"SG-0219","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1638,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_118","id":"SG-0220","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1647,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_119","id":"SG-0221","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1656,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_120","id":"SG-0222","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1680,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_121","id":"SG-0223","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1707,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_122","id":"SG-0224","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1733,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_123","id":"SG-0225","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1741,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_124","id":"SG-0226","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1749,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_125","id":"SG-0227","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1760,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_126","id":"SG-0228","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1768,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_127","id":"SG-0229","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1791,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_128","id":"SG-0230","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1800,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_129","id":"SG-0231","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1822,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_130","id":"SG-0232","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1848,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_131","id":"SG-0233","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1856,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_132","id":"SG-0234","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1864,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_133","id":"SG-0235","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1872,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_134","id":"SG-0236","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1880,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_135","id":"SG-0237","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1935,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_136","id":"SG-0238","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1956,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_137","id":"SG-0239","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2019,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_138","id":"SG-0240","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2053,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_139","id":"SG-0241","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2107,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_140","id":"SG-0242","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2171,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_141","id":"SG-0243","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2204,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_142","id":"SG-0244","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2230,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_143","id":"SG-0245","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2238,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_144","id":"SG-0246","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2246,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_145","id":"SG-0247","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2254,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_146","id":"SG-0248","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2262,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_147","id":"SG-0249","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2270,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_148","id":"SG-0250","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2278,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_149","id":"SG-0251","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2286,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_150","id":"SG-0252","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2294,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_151","id":"SG-0253","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2302,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_152","id":"SG-0254","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2310,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_153","id":"SG-0255","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2318,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_154","id":"SG-0256","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2330,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_155","id":"SG-0257","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2348,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_156","id":"SG-0258","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2364,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_157","id":"SG-0259","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2384,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_158","id":"SG-0260","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2405,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_159","id":"SG-0261","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2418,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_160","id":"SG-0262","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2438,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_161","id":"SG-0263","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2454,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_162","id":"SG-0264","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2461,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_163","id":"SG-0265","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2468,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_164","id":"SG-0266","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2475,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_165","id":"SG-0267","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2484,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_166","id":"SG-0268","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2495,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_167","id":"SG-0269","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2507,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_168","id":"SG-0270","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2520,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_169","id":"SG-0271","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2527,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_170","id":"SG-0272","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2534,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_171","id":"SG-0273","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2541,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_172","id":"SG-0274","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2548,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_173","id":"SG-0275","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2555,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_174","id":"SG-0276","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2570,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_175","id":"SG-0277","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2581,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_176","id":"SG-0278","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2588,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_177","id":"SG-0279","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2595,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_178","id":"SG-0280","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2602,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_179","id":"SG-0281","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2609,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_180","id":"SG-0282","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2619,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_181","id":"SG-0283","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2635,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_182","id":"SG-0284","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2650,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_183","id":"SG-0285","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2672,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_184","id":"SG-0286","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2687,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_185","id":"SG-0287","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2701,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_186","id":"SG-0288","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2708,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_187","id":"SG-0289","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2723,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_188","id":"SG-0290","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2769,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_189","id":"SG-0291","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2802,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_190","id":"SG-0292","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2810,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_191","id":"SG-0293","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2818,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_192","id":"SG-0294","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2832,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_193","id":"SG-0295","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2855,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_194","id":"SG-0296","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2888,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_195","id":"SG-0297","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2900,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":26,"evidence":["security/semgrep/EVIDENCE.md#cli-arguments","zellij-utils/src/cli.rs#CliArgs::parse"],"fingerprint":"81692b1a6bf7ade1ede3d20ca569ec43f7296e98485adc7c77399626b65f8b0f51720ed28ac0cb9395cb0a5d77a785133a29c2e2f2c0e981561ccdc8e436b8de_0","id":"SG-0298","invariant":"All arguments flow into typed clap parsing and command validation before execution.","line":102,"owner":"CLI parsing","path":"zellij-utils/src/cli.rs","reason":"args_os is the CLI entrypoint preserving platform arguments for typed clap parsing.","rule":"rust.lang.security.args-os.args-os","verdict":"scoped_false_positive"}
-{"column":23,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/consts.rs"],"fingerprint":"46b531fa474d19b29774d87e5dfcca6a6f504aca6a32cefaf551cac267f87896ae2edf6ba3bc229f4c174bcc0a3aad7b9e31d77a217681dad45c363206cac856_0","id":"SG-0299","invariant":"Source and target are fixed legacy/current ProjectDirs owned by the local OS user.","line":196,"owner":"Runtime directories","path":"zellij-utils/src/consts.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
-{"column":36,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/consts.rs"],"fingerprint":"3f19955c060f783b96c4ead9b1a77f8778bb6364b312c113476fcde03b4ce9f856888ef088f294794cff1cb289c306d827cba35442b37f02b651fb3be3308e69_0","id":"SG-0300","invariant":"Source and target are fixed legacy/current ProjectDirs owned by the local OS user.","line":202,"owner":"Runtime directories","path":"zellij-utils/src/consts.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
-{"column":42,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_0","id":"SG-0301","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":384,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":18,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_1","id":"SG-0302","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":405,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":14,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_2","id":"SG-0303","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":409,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":26,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_3","id":"SG-0304","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":410,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":12,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_4","id":"SG-0305","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":412,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":26,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_5","id":"SG-0306","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":423,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":31,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_6","id":"SG-0307","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":457,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":16,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_7","id":"SG-0308","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":474,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":8,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_8","id":"SG-0309","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":493,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#process-environment","zellij-utils/src/envs.rs"],"fingerprint":"90cfa7ce844fa5e8028ae397be3b9db8ff0b8b78e5a840065a478a62de32de3e7a03ca267e63f1e17566edf5a4a519a34e2dd753bdf3e95c91f52ab712dbcc52_0","id":"SG-0310","invariant":"Environment mutation is serialized during process initialization or isolated test cleanup.","line":127,"owner":"Process environment","path":"zellij-utils/src/envs.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#process-environment","zellij-utils/src/envs.rs"],"fingerprint":"90cfa7ce844fa5e8028ae397be3b9db8ff0b8b78e5a840065a478a62de32de3e7a03ca267e63f1e17566edf5a4a519a34e2dd753bdf3e95c91f52ab712dbcc52_1","id":"SG-0311","invariant":"Environment mutation is serialized during process initialization or isolated test cleanup.","line":143,"owner":"Process environment","path":"zellij-utils/src/envs.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":28,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/input/plugins.rs"],"fingerprint":"d8d9b76c3d0d855c7875b0d8f60f908d7c95f86c54f4eb1ede785442173ecee3835d7071eb4697932a2ce3a3596350c9fa0563df924a79261c45e182d877b03a_0","id":"SG-0312","invariant":"Reading an operator-selected plugin is the explicit plugin capability; builtins resolve from embedded assets first.","line":157,"owner":"Plugin loading","path":"zellij-utils/src/input/plugins.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
-{"column":9,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-utils/src/input/unit/layout_test.rs"],"fingerprint":"3c7821e25c122dd2c6b0171cc548b7e6dc5d16e591ca980d650dafb0fedc024463dab4cb3ba8af7064f8d3c739c150f0bba6b73ca4a866339d5830b5e6c93353_0","id":"SG-0313","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":2516,"owner":"Rust test harness","path":"zellij-utils/src/input/unit/layout_test.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":28,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-utils/src/input/unit/layout_test.rs"],"fingerprint":"3c7821e25c122dd2c6b0171cc548b7e6dc5d16e591ca980d650dafb0fedc024463dab4cb3ba8af7064f8d3c739c150f0bba6b73ca4a866339d5830b5e6c93353_1","id":"SG-0314","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":2523,"owner":"Rust test harness","path":"zellij-utils/src/input/unit/layout_test.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":21,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-utils/src/input/unit/layout_test.rs"],"fingerprint":"3c7821e25c122dd2c6b0171cc548b7e6dc5d16e591ca980d650dafb0fedc024463dab4cb3ba8af7064f8d3c739c150f0bba6b73ca4a866339d5830b5e6c93353_2","id":"SG-0315","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":2525,"owner":"Rust test harness","path":"zellij-utils/src/input/unit/layout_test.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":5,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-utils/src/input/unit/layout_test.rs"],"fingerprint":"3c7821e25c122dd2c6b0171cc548b7e6dc5d16e591ca980d650dafb0fedc024463dab4cb3ba8af7064f8d3c739c150f0bba6b73ca4a866339d5830b5e6c93353_3","id":"SG-0316","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":2535,"owner":"Rust test harness","path":"zellij-utils/src/input/unit/layout_test.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":33,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/ipc/protobuf_conversion.rs"],"fingerprint":"ecc4edae4907b25051dbddf7e12526902896b40f5c5638c00f00212cf0db535ee73672a09f6c9b88fd5270cd1956eb0d723e7c4784a91c183aa75ef2a6ca36d5_0","id":"SG-0317","invariant":"The hit is data-only PathBuf construction; no filesystem operation occurs.","line":3345,"owner":"IPC data model","path":"zellij-utils/src/ipc/protobuf_conversion.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
-{"column":47,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/ipc/protobuf_conversion.rs"],"fingerprint":"efe2f6d779d50ae6d4f9c293d0a47ed4e20fa00676abc411133a3b984e52e482ca3c25e2cc58b44256ba48a41a5deb9a67c81ab5ce255f8c4d71f1d2fee1635c_0","id":"SG-0318","invariant":"The hit is data-only PathBuf construction; no filesystem operation occurs.","line":4276,"owner":"IPC data model","path":"zellij-utils/src/ipc/protobuf_conversion.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
-{"column":17,"evidence":["security/semgrep/EVIDENCE.md#process-probes","zellij-utils/src/sessions.rs"],"fingerprint":"db9103e89f65c322a57e2591d9a4f46c92320ef2c4426efa070ca0a2bd72107c0c0b0c58503d3184326598ebf6e1abdfe58a9fa3b65b445d9217cae8d51fc849_0","id":"SG-0319","invariant":"The libc process probe is read-only and accepts only a PID parsed from a locally owned socket name.","line":221,"owner":"Session discovery","path":"zellij-utils/src/sessions.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":55,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_0","id":"SG-0320","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1014,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":48,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_1","id":"SG-0321","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1200,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":50,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_2","id":"SG-0322","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1203,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":25,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_3","id":"SG-0323","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1206,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":29,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_4","id":"SG-0324","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1587,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
-{"column":32,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/vibecrafted_install.rs"],"fingerprint":"4828a8f32be886a1c1f894a23012c8181a9225042b7cde1c853a2a0bc0bb00f734c011dd6997183c8bfc42ce8195aa36a9d461005d689f73ad33d2aa066b5108_0","id":"SG-0325","invariant":"The source is enumerated from a validated framework root and destination is the current-user layouts directory.","line":396,"owner":"Vibecrafted layout installer","path":"zellij-utils/src/vibecrafted_install.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
-{"column":66,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/web_server_commands.rs"],"fingerprint":"fa7c454a17b1c0aa7fc35de868dcbdd68bef8cbb676e43ba20b4bdb69ff6b61df5359b9ac567b4657749a168258dd7db486017bff5358df7e145296a0e216621_0","id":"SG-0326","invariant":"Socket paths are discovered below the current-user runtime directory and connect probing is bounded.","line":63,"owner":"Local webserver IPC","path":"zellij-utils/src/web_server_commands.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
+{"column":19,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/clinic.rs"],"fingerprint":"fc52f869477f7fc6a37c86ff25892e4c10b15266cc07263c7ae11fe517b228b1d8cf7d7ed943a158b25515689a00f769d9d413239e40489440941aeb07bd0f4f_0","id":"SG-0004","invariant":"The resolved path is used only for metadata and local process-name comparison; it is never executed or trusted as update provenance.","line":1261,"owner":"Clinic runtime diagnostics","path":"src/clinic.rs","reason":"current_exe is read only to identify the running binary for a local drift diagnosis.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":20,"evidence":["security/semgrep/EVIDENCE.md#transfer-lock-descriptor","src/run_triage_cli.rs"],"fingerprint":"6c902f1851ead06091728b45e6a060e439c0e38eaa83fc3f192125c17abed294ce2e55be3f3aa17e5f5bf9ccdfdec3f999670291bc320ca177ffe8eedae8f6e1_0","id":"SG-0005","invariant":"The inherited descriptor is validated as open, marked close-on-exec, matched to the canonical lock path by device and inode, and adopted by exactly one Rust owner.","line":98,"owner":"Triage transfer lock","path":"src/run_triage_cli.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":26,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_0","id":"SG-0006","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":340,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":35,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_1","id":"SG-0007","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2247,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":41,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_2","id":"SG-0008","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2306,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":44,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_3","id":"SG-0009","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2320,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":41,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_4","id":"SG-0010","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2351,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":44,"evidence":["security/semgrep/EVIDENCE.md#current-executable","src/run_triage_cli.rs"],"fingerprint":"76eb61b1dedf6fd92c522899f1384f37364396354aadafe9f809471a35063e13f727b70ed9dd81927e4dd5f129989dceac6b111b4e2bfa5e26a0d845740d4f94_5","id":"SG-0011","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":2365,"owner":"Client process lifecycle","path":"src/run_triage_cli.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":25,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","src/run_triage_cli.rs"],"fingerprint":"47dae781288c73b0bd85c5f04dfa363a58b6ef7c5289e9cb35353306672cd0106770fe0b232c2ca410ee39a3e8edece1cc74dd4f04ad282514d42a1bcb9d4eb3_0","id":"SG-0012","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2687,"owner":"Rust test harness","path":"src/run_triage_cli.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":25,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","src/run_triage_cli.rs"],"fingerprint":"47dae781288c73b0bd85c5f04dfa363a58b6ef7c5289e9cb35353306672cd0106770fe0b232c2ca410ee39a3e8edece1cc74dd4f04ad282514d42a1bcb9d4eb3_1","id":"SG-0013","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2735,"owner":"Rust test harness","path":"src/run_triage_cli.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":29,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","xtask/src/pipelines.rs"],"fingerprint":"88eed7e3a59cdf5959bd7e74e2211ca358869824e8e94b6392fdb51c6268fb581656ac0378da29f5d9a35e97513ab51113778eaf5ff39ce4fdb0070a29073b33_0","id":"SG-0014","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1256,"owner":"Rust test harness","path":"xtask/src/pipelines.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#current-executable","xtask/src/pipelines.rs"],"fingerprint":"cd2183f84fb155fb87f62b8b770a81cc7a77d846d6243b3a5e6487e8980668e8ac690c6fe442fa765b617d99534fb4d94e145b27db34649b42c4a762ab365b6d_0","id":"SG-0015","invariant":"The executable path remains inside cfg(test), is copied into a process-private test directory, and is never executed with elevated trust.","line":1859,"owner":"Rust test harness","path":"xtask/src/pipelines.rs","reason":"The macOS-only installer test copies its own real Mach-O test executable as local fixture bytes.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/lib.rs"],"fingerprint":"c87420950484497eb9b425f1f3993dd775cbdfa0ca86acf4c12695080cc455902293b3821d2a63b86f49f57389153a758db42382753e5e348ec3f6bdce71525f_0","id":"SG-0016","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":261,"owner":"Client process lifecycle","path":"zellij-client/src/lib.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/lib.rs"],"fingerprint":"c87420950484497eb9b425f1f3993dd775cbdfa0ca86acf4c12695080cc455902293b3821d2a63b86f49f57389153a758db42382753e5e348ec3f6bdce71525f_1","id":"SG-0017","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":303,"owner":"Client process lifecycle","path":"zellij-client/src/lib.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/lib.rs"],"fingerprint":"c87420950484497eb9b425f1f3993dd775cbdfa0ca86acf4c12695080cc455902293b3821d2a63b86f49f57389153a758db42382753e5e348ec3f6bdce71525f_2","id":"SG-0018","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":363,"owner":"Client process lifecycle","path":"zellij-client/src/lib.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/lib.rs"],"fingerprint":"c87420950484497eb9b425f1f3993dd775cbdfa0ca86acf4c12695080cc455902293b3821d2a63b86f49f57389153a758db42382753e5e348ec3f6bdce71525f_3","id":"SG-0019","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":391,"owner":"Client process lifecycle","path":"zellij-client/src/lib.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":18,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-client/src/os_input_output_windows.rs"],"fingerprint":"52ce911ce8f90612c71d0c6a47e51730525436de1f1f363a0e3b58552f475fb5186121aa6d5f3e958087da03d3b8f533dd22e6075fd18468862832dd60e8fd62_0","id":"SG-0020","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":106,"owner":"Windows platform I/O","path":"zellij-client/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-client/src/stdin_handler_windows.rs"],"fingerprint":"8518e91bd06482347ee54f4f1f4bdbd24ce69a309c1bb7858da4f0c8c94ddc562222ac501a779825e47b9b9999f4952d0ce8028c51135eda228c390518239db2_0","id":"SG-0021","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":30,"owner":"Windows platform I/O","path":"zellij-client/src/stdin_handler_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-client/src/stdin_handler_windows.rs"],"fingerprint":"8518e91bd06482347ee54f4f1f4bdbd24ce69a309c1bb7858da4f0c8c94ddc562222ac501a779825e47b9b9999f4952d0ce8028c51135eda228c390518239db2_1","id":"SG-0022","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":78,"owner":"Windows platform I/O","path":"zellij-client/src/stdin_handler_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":15,"evidence":["security/semgrep/EVIDENCE.md#current-executable","zellij-client/src/web_client/mod.rs"],"fingerprint":"d3359c43a06aa4e074f8d62eaeb46106e7d4bc95b81dd9a7e45d46abe01722ee027a8534ecacbe32f15764a019fd53ca478bfab4fad84bd4b20039aff6673141_0","id":"SG-0023","invariant":"The resolved current binary receives fixed internal flags plus already-validated configuration paths.","line":432,"owner":"Client process lifecycle","path":"zellij-client/src/web_client/mod.rs","reason":"current_exe only spawns another mode of the running vc-frame binary; it establishes no trust.","rule":"rust.lang.security.current-exe.current-exe","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_0","id":"SG-0024","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":109,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_1","id":"SG-0025","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":169,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_2","id":"SG-0026","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":241,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_3","id":"SG-0027","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":308,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_4","id":"SG-0028","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":524,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_5","id":"SG-0029","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":703,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_6","id":"SG-0030","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":753,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_7","id":"SG-0031","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":815,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_8","id":"SG-0032","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":962,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_9","id":"SG-0033","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1139,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_10","id":"SG-0034","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1287,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_11","id":"SG-0035","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1422,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_12","id":"SG-0036","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1521,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_13","id":"SG-0037","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1698,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_14","id":"SG-0038","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1812,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_15","id":"SG-0039","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":1985,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_16","id":"SG-0040","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2169,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_17","id":"SG-0041","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2339,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_18","id":"SG-0042","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2438,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_19","id":"SG-0043","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2525,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_20","id":"SG-0044","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2645,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_21","id":"SG-0045","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2742,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_22","id":"SG-0046","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2825,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-client/src/web_client/unit/web_client_tests.rs"],"fingerprint":"ffb112958ca27f0bc3ba9d43207cffede8313ec15699a99034474e5c9e62f37958247f3566c5b7316282b67afd4a658fa61aec06154ca9179b2882be83c23621_23","id":"SG-0047","invariant":"Test data is process-local, cleaned by the test, and never trusted by production code.","line":2880,"owner":"Rust test harness","path":"zellij-client/src/web_client/unit/web_client_tests.rs","reason":"The hit is inside cfg(test), not a production security boundary.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#process-probes","zellij-server/src/lib.rs"],"fingerprint":"b1fc0b3cf8af62bac26937a0171ed3d10d9868e626ed76f45c82465875ad082d0a77c261c3fe56bb8efc7eb93e9a01c7e6766e7a967636a212bf68cbd5473592_0","id":"SG-0048","invariant":"Unix daemonization is isolated to startup before threaded work and every fork outcome is handled.","line":776,"owner":"Server process lifecycle","path":"zellij-server/src/lib.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":21,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_0","id":"SG-0049","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":95,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_1","id":"SG-0050","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":129,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_2","id":"SG-0051","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":376,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":23,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_3","id":"SG-0052","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":403,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":19,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_4","id":"SG-0053","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":422,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_5","id":"SG-0054","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":877,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":26,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_6","id":"SG-0055","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":1016,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_7","id":"SG-0056","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":1034,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_8","id":"SG-0057","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":1071,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":19,"evidence":["security/semgrep/EVIDENCE.md#unix-platform-ffi","zellij-server/src/os_input_output_unix.rs"],"fingerprint":"daf3af297c9ec5a5b2e7e9a3054fa76b97856fb047e9f44bbc702afe7fcd40762bc94c54341af565db13d1991b047a08b349cb42fe77a166380d6fac7ddc6d03_9","id":"SG-0058","invariant":"Unsafe blocks are narrow libc/terminal adapters; descriptors and pointers are validated and exposed as safe types.","line":1085,"owner":"Unix platform I/O","path":"zellij-server/src/os_input_output_unix.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_0","id":"SG-0059","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":68,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":27,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_1","id":"SG-0060","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":100,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":12,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_2","id":"SG-0061","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":106,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_3","id":"SG-0062","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":110,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_4","id":"SG-0063","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":117,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_5","id":"SG-0064","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":180,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":12,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_6","id":"SG-0065","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":212,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_7","id":"SG-0066","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":223,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_8","id":"SG-0067","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":226,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_9","id":"SG-0068","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":229,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":24,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_10","id":"SG-0069","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":284,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":18,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_11","id":"SG-0070","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":389,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":18,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_12","id":"SG-0071","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":405,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_13","id":"SG-0072","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":417,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":14,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_14","id":"SG-0073","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":437,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_15","id":"SG-0074","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":455,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":8,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_16","id":"SG-0075","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":461,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":8,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_17","id":"SG-0076","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":470,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_18","id":"SG-0077","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":482,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":34,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_19","id":"SG-0078","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":487,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":39,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_20","id":"SG-0079","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":508,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":14,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_21","id":"SG-0080","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":510,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_22","id":"SG-0081","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":525,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_23","id":"SG-0082","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":535,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":12,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_24","id":"SG-0083","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":596,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_25","id":"SG-0084","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":597,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":17,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_26","id":"SG-0085","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":608,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_27","id":"SG-0086","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":619,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":21,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_28","id":"SG-0087","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":629,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":30,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_29","id":"SG-0088","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":758,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":26,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_30","id":"SG-0089","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":787,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":26,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_31","id":"SG-0090","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":818,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":18,"evidence":["security/semgrep/EVIDENCE.md#windows-platform-ffi","zellij-server/src/os_input_output_windows.rs"],"fingerprint":"4f8da78378ea82512d10403ae577cc82a37c3082bb81c2c0d1115d7b1715a8acc44d381b30de5e9273ed7dcc435a97ec99c8202b1d2aa7191a85855d38974ea7_32","id":"SG-0091","invariant":"Unsafe blocks are narrow Win32/ConPTY adapters; handles are checked and wrapped before safe code observes them.","line":843,"owner":"Windows platform I/O","path":"zellij-server/src/os_input_output_windows.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":25,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-server/src/plugins/plugin_loader.rs"],"fingerprint":"d647f9d8f9936be80fe7d44f27fc5f8f8dca37dea71e15520eec66ee7f021024f71ab1c51ef7aef6f93816f54b61aa9381bdb3b6423e81923be5c0a3ea078e54_0","id":"SG-0092","invariant":"The path is a host-selected WASI preopen, not an HTTP parameter.","line":36,"owner":"Plugin filesystem capability","path":"zellij-server/src/plugins/plugin_loader.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"060633d99d0466ed8923e22ea91c43c825d863aa68e7fc933e02afddf38ffc28c5eaaced579a027b9ef9f3ef3749982fefb3c7b49b39061e3faa69294b6c5927_0","id":"SG-0093","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":431,"owner":"Rust test harness","path":"zellij-server/src/plugins/unit/plugin_tests.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"060633d99d0466ed8923e22ea91c43c825d863aa68e7fc933e02afddf38ffc28c5eaaced579a027b9ef9f3ef3749982fefb3c7b49b39061e3faa69294b6c5927_1","id":"SG-0094","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":519,"owner":"Rust test harness","path":"zellij-server/src/plugins/unit/plugin_tests.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"060633d99d0466ed8923e22ea91c43c825d863aa68e7fc933e02afddf38ffc28c5eaaced579a027b9ef9f3ef3749982fefb3c7b49b39061e3faa69294b6c5927_2","id":"SG-0095","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":615,"owner":"Rust test harness","path":"zellij-server/src/plugins/unit/plugin_tests.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":13,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"060633d99d0466ed8923e22ea91c43c825d863aa68e7fc933e02afddf38ffc28c5eaaced579a027b9ef9f3ef3749982fefb3c7b49b39061e3faa69294b6c5927_3","id":"SG-0096","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":711,"owner":"Rust test harness","path":"zellij-server/src/plugins/unit/plugin_tests.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":37,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-server/src/plugins/watch_filesystem.rs"],"fingerprint":"762af5f57e999ca9e5a3e0272cf8a536a6269709d4a3f18b3229f8cb5023f33bb5cf0525b4293ff7afa3370116373571f0311f01b4516b0d3d4a00d1954255ad_0","id":"SG-0097","invariant":"The hit only converts an authorized host cwd before a local watcher is registered.","line":47,"owner":"Plugin filesystem capability","path":"zellij-server/src/plugins/watch_filesystem.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
+{"column":15,"evidence":["security/semgrep/EVIDENCE.md#process-environment","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"c17076ebe456293ec9c60a89a0dbe0ee9dffb54eed6ca254f62487cc294b9af551ef8a2eb8d19568307fb2a1949d03c504ca8be6390443ad183901969802a756_0","id":"SG-0098","invariant":"Environment mutation is confined to synchronous host-command handling and the explicitly requested variable.","line":3938,"owner":"Plugin host API","path":"zellij-server/src/plugins/zellij_exports.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":24,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-server/src/tab/mod.rs#edit_scrollback"],"fingerprint":"1955a32a03ba838c7b6b14e92daf3cb943bd16a51f21c79ad312af6b60451522cae6895077dccf14966fdad727ba3816f70345ec559d9c30c8be545fea56cc73_0","id":"SG-0099","invariant":"Every editor dump has a new UUID v4 and carries only current-user terminal contents.","line":5507,"owner":"Terminal scrollback","path":"zellij-server/src/tab/mod.rs","reason":"The rule flags temp_dir itself; each scrollback file appends a fresh UUID v4.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":24,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-server/src/tab/mod.rs#edit_scrollback"],"fingerprint":"1955a32a03ba838c7b6b14e92daf3cb943bd16a51f21c79ad312af6b60451522cae6895077dccf14966fdad727ba3816f70345ec559d9c30c8be545fea56cc73_1","id":"SG-0100","invariant":"Every editor dump has a new UUID v4 and carries only current-user terminal contents.","line":5534,"owner":"Terminal scrollback","path":"zellij-server/src/tab/mod.rs","reason":"The rule flags temp_dir itself; each scrollback file appends a fresh UUID v4.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":28,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-server/src/tab/mod.rs#edit_scrollback"],"fingerprint":"1955a32a03ba838c7b6b14e92daf3cb943bd16a51f21c79ad312af6b60451522cae6895077dccf14966fdad727ba3816f70345ec559d9c30c8be545fea56cc73_2","id":"SG-0101","invariant":"Every editor dump has a new UUID v4 and carries only current-user terminal contents.","line":5560,"owner":"Terminal scrollback","path":"zellij-server/src/tab/mod.rs","reason":"The rule flags temp_dir itself; each scrollback file appends a fresh UUID v4.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":28,"evidence":["security/semgrep/EVIDENCE.md#temporary-paths","zellij-server/src/tab/mod.rs#edit_scrollback"],"fingerprint":"1955a32a03ba838c7b6b14e92daf3cb943bd16a51f21c79ad312af6b60451522cae6895077dccf14966fdad727ba3816f70345ec559d9c30c8be545fea56cc73_3","id":"SG-0102","invariant":"Every editor dump has a new UUID v4 and carries only current-user terminal contents.","line":5584,"owner":"Terminal scrollback","path":"zellij-server/src/tab/mod.rs","reason":"The rule flags temp_dir itself; each scrollback file appends a fresh UUID v4.","rule":"rust.lang.security.temp-dir.temp-dir","verdict":"scoped_false_positive"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_0","id":"SG-0103","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":57,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_1","id":"SG-0104","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":66,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_2","id":"SG-0105","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":76,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_3","id":"SG-0106","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":87,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_4","id":"SG-0107","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":94,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_5","id":"SG-0108","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":103,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_6","id":"SG-0109","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":114,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_7","id":"SG-0110","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":129,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_8","id":"SG-0111","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":148,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_9","id":"SG-0112","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":180,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_10","id":"SG-0113","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":191,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_11","id":"SG-0114","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":210,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_12","id":"SG-0115","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":265,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_13","id":"SG-0116","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":310,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_14","id":"SG-0117","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":346,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_15","id":"SG-0118","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":380,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_16","id":"SG-0119","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":396,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_17","id":"SG-0120","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":417,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_18","id":"SG-0121","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":432,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_19","id":"SG-0122","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":447,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_20","id":"SG-0123","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":464,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_21","id":"SG-0124","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":482,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_22","id":"SG-0125","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":495,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_23","id":"SG-0126","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":510,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_24","id":"SG-0127","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":527,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_25","id":"SG-0128","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":546,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_26","id":"SG-0129","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":562,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_27","id":"SG-0130","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":581,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_28","id":"SG-0131","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":597,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_29","id":"SG-0132","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":614,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_30","id":"SG-0133","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":632,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_31","id":"SG-0134","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":652,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_32","id":"SG-0135","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":669,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_33","id":"SG-0136","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":692,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_34","id":"SG-0137","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":720,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_35","id":"SG-0138","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":748,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_36","id":"SG-0139","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":776,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_37","id":"SG-0140","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":792,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_38","id":"SG-0141","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":805,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_39","id":"SG-0142","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":813,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_40","id":"SG-0143","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":822,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_41","id":"SG-0144","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":836,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_42","id":"SG-0145","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":855,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_43","id":"SG-0146","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":873,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_44","id":"SG-0147","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":881,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_45","id":"SG-0148","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":889,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_46","id":"SG-0149","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":897,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_47","id":"SG-0150","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":906,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_48","id":"SG-0151","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":914,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_49","id":"SG-0152","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":922,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_50","id":"SG-0153","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":930,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_51","id":"SG-0154","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":941,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_52","id":"SG-0155","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":957,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_53","id":"SG-0156","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":972,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_54","id":"SG-0157","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":995,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_55","id":"SG-0158","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1019,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_56","id":"SG-0159","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1036,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_57","id":"SG-0160","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1049,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_58","id":"SG-0161","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1057,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_59","id":"SG-0162","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1070,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_60","id":"SG-0163","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1078,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_61","id":"SG-0164","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1091,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_62","id":"SG-0165","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1099,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_63","id":"SG-0166","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1107,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_64","id":"SG-0167","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1115,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_65","id":"SG-0168","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1123,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_66","id":"SG-0169","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1131,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_67","id":"SG-0170","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1139,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_68","id":"SG-0171","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1147,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_69","id":"SG-0172","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1155,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_70","id":"SG-0173","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1166,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_71","id":"SG-0174","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1174,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_72","id":"SG-0175","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1182,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_73","id":"SG-0176","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1190,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_74","id":"SG-0177","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1198,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_75","id":"SG-0178","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1206,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_76","id":"SG-0179","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1214,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_77","id":"SG-0180","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1222,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_78","id":"SG-0181","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1230,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_79","id":"SG-0182","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1238,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_80","id":"SG-0183","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1246,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_81","id":"SG-0184","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1254,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_82","id":"SG-0185","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1262,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_83","id":"SG-0186","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1270,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_84","id":"SG-0187","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1277,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_85","id":"SG-0188","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1285,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_86","id":"SG-0189","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1293,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_87","id":"SG-0190","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1301,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_88","id":"SG-0191","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1308,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_89","id":"SG-0192","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1316,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_90","id":"SG-0193","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1324,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_91","id":"SG-0194","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1332,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_92","id":"SG-0195","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1340,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_93","id":"SG-0196","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1348,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_94","id":"SG-0197","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1359,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_95","id":"SG-0198","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1366,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_96","id":"SG-0199","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1374,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_97","id":"SG-0200","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1382,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_98","id":"SG-0201","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1398,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_99","id":"SG-0202","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1414,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_100","id":"SG-0203","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1425,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_101","id":"SG-0204","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1436,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_102","id":"SG-0205","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1447,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_103","id":"SG-0206","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1458,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_104","id":"SG-0207","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1469,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_105","id":"SG-0208","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1482,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_106","id":"SG-0209","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1494,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_107","id":"SG-0210","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1512,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_108","id":"SG-0211","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1523,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_109","id":"SG-0212","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1543,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_110","id":"SG-0213","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1561,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_111","id":"SG-0214","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1569,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_112","id":"SG-0215","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1577,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_113","id":"SG-0216","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1585,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_114","id":"SG-0217","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1593,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_115","id":"SG-0218","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1601,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_116","id":"SG-0219","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1619,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_117","id":"SG-0220","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1638,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_118","id":"SG-0221","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1647,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_119","id":"SG-0222","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1656,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_120","id":"SG-0223","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1680,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_121","id":"SG-0224","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1707,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_122","id":"SG-0225","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1733,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_123","id":"SG-0226","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1741,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_124","id":"SG-0227","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1749,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_125","id":"SG-0228","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1760,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_126","id":"SG-0229","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1768,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_127","id":"SG-0230","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1791,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_128","id":"SG-0231","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1800,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_129","id":"SG-0232","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1822,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_130","id":"SG-0233","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1848,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_131","id":"SG-0234","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1856,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_132","id":"SG-0235","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1864,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_133","id":"SG-0236","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1872,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_134","id":"SG-0237","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1880,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_135","id":"SG-0238","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1935,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_136","id":"SG-0239","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":1956,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_137","id":"SG-0240","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2019,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_138","id":"SG-0241","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2053,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_139","id":"SG-0242","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2107,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_140","id":"SG-0243","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2171,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_141","id":"SG-0244","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2204,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_142","id":"SG-0245","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2230,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_143","id":"SG-0246","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2238,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_144","id":"SG-0247","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2246,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_145","id":"SG-0248","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2254,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_146","id":"SG-0249","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2262,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_147","id":"SG-0250","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2270,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_148","id":"SG-0251","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2278,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_149","id":"SG-0252","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2286,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_150","id":"SG-0253","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2294,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_151","id":"SG-0254","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2302,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_152","id":"SG-0255","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2310,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_153","id":"SG-0256","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2318,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_154","id":"SG-0257","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2330,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_155","id":"SG-0258","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2348,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_156","id":"SG-0259","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2364,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_157","id":"SG-0260","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2384,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_158","id":"SG-0261","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2405,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_159","id":"SG-0262","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2418,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_160","id":"SG-0263","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2438,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_161","id":"SG-0264","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2454,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_162","id":"SG-0265","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2461,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_163","id":"SG-0266","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2468,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_164","id":"SG-0267","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2475,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_165","id":"SG-0268","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2484,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_166","id":"SG-0269","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2495,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_167","id":"SG-0270","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2507,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_168","id":"SG-0271","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2520,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_169","id":"SG-0272","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2527,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_170","id":"SG-0273","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2534,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_171","id":"SG-0274","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2541,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_172","id":"SG-0275","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2548,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_173","id":"SG-0276","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2555,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_174","id":"SG-0277","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2570,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_175","id":"SG-0278","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2581,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_176","id":"SG-0279","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2588,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_177","id":"SG-0280","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2595,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_178","id":"SG-0281","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2602,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_179","id":"SG-0282","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2609,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_180","id":"SG-0283","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2619,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_181","id":"SG-0284","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2635,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_182","id":"SG-0285","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2650,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_183","id":"SG-0286","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2672,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_184","id":"SG-0287","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2687,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_185","id":"SG-0288","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2701,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_186","id":"SG-0289","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2708,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_187","id":"SG-0290","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2723,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_188","id":"SG-0291","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2767,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_189","id":"SG-0292","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2800,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_190","id":"SG-0293","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2808,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_191","id":"SG-0294","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2816,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_192","id":"SG-0295","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2830,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_193","id":"SG-0296","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2853,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_194","id":"SG-0297","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2886,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#plugin-api-ffi","zellij-server/src/plugins/unit/plugin_tests.rs"],"fingerprint":"048d51457f908ab4a3347f50b235ae93c72ea919f26d848087481d398bc0d706f2355df2904f19f37c873febc0fa259d6e69500421b09fefb8649ed45d8a6676_195","id":"SG-0298","invariant":"Unsafe calls are the wasm host-call boundary; values are serialized before the single host trampoline and no raw host pointer crosses the API.","line":2898,"owner":"Plugin API FFI","path":"zellij-tile/src/shim.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":26,"evidence":["security/semgrep/EVIDENCE.md#cli-arguments","zellij-utils/src/cli.rs#CliArgs::parse"],"fingerprint":"81692b1a6bf7ade1ede3d20ca569ec43f7296e98485adc7c77399626b65f8b0f51720ed28ac0cb9395cb0a5d77a785133a29c2e2f2c0e981561ccdc8e436b8de_0","id":"SG-0299","invariant":"All arguments flow into typed clap parsing and command validation before execution.","line":102,"owner":"CLI parsing","path":"zellij-utils/src/cli.rs","reason":"args_os is the CLI entrypoint preserving platform arguments for typed clap parsing.","rule":"rust.lang.security.args-os.args-os","verdict":"scoped_false_positive"}
+{"column":23,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/consts.rs"],"fingerprint":"46b531fa474d19b29774d87e5dfcca6a6f504aca6a32cefaf551cac267f87896ae2edf6ba3bc229f4c174bcc0a3aad7b9e31d77a217681dad45c363206cac856_0","id":"SG-0300","invariant":"Source and target are fixed legacy/current ProjectDirs owned by the local OS user.","line":221,"owner":"Runtime directories","path":"zellij-utils/src/consts.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
+{"column":36,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/consts.rs"],"fingerprint":"3f19955c060f783b96c4ead9b1a77f8778bb6364b312c113476fcde03b4ce9f856888ef088f294794cff1cb289c306d827cba35442b37f02b651fb3be3308e69_0","id":"SG-0301","invariant":"Source and target are fixed legacy/current ProjectDirs owned by the local OS user.","line":227,"owner":"Runtime directories","path":"zellij-utils/src/consts.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
+{"column":42,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_0","id":"SG-0302","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":409,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":18,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_1","id":"SG-0303","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":430,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":14,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_2","id":"SG-0304","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":434,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":26,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_3","id":"SG-0305","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":435,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":12,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_4","id":"SG-0306","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":437,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":26,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_5","id":"SG-0307","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":448,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":31,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_6","id":"SG-0308","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":482,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":16,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_7","id":"SG-0309","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":499,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":8,"evidence":["security/semgrep/EVIDENCE.md#ipc-libc","zellij-utils/src/ipc/tests/socket_tests.rs"],"fingerprint":"465c27e7d3dc26f67b7594128f19f445660e9c1f80f6dd942e72feeed999f6e9766aa9113a31647fdd6172afdd133066f3abe1a2befd9fb6f653f2f666e5cf55_8","id":"SG-0310","invariant":"OwnedFd owns the socket, sockaddr length is checked, connect is poll-bounded, and flags are restored before return.","line":518,"owner":"IPC transport","path":"zellij-utils/src/consts.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#process-environment","zellij-utils/src/envs.rs"],"fingerprint":"90cfa7ce844fa5e8028ae397be3b9db8ff0b8b78e5a840065a478a62de32de3e7a03ca267e63f1e17566edf5a4a519a34e2dd753bdf3e95c91f52ab712dbcc52_0","id":"SG-0311","invariant":"Environment mutation is serialized during process initialization or isolated test cleanup.","line":127,"owner":"Process environment","path":"zellij-utils/src/envs.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#process-environment","zellij-utils/src/envs.rs"],"fingerprint":"90cfa7ce844fa5e8028ae397be3b9db8ff0b8b78e5a840065a478a62de32de3e7a03ca267e63f1e17566edf5a4a519a34e2dd753bdf3e95c91f52ab712dbcc52_1","id":"SG-0312","invariant":"Environment mutation is serialized during process initialization or isolated test cleanup.","line":143,"owner":"Process environment","path":"zellij-utils/src/envs.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":28,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/input/plugins.rs"],"fingerprint":"d8d9b76c3d0d855c7875b0d8f60f908d7c95f86c54f4eb1ede785442173ecee3835d7071eb4697932a2ce3a3596350c9fa0563df924a79261c45e182d877b03a_0","id":"SG-0313","invariant":"Reading an operator-selected plugin is the explicit plugin capability; builtins resolve from embedded assets first.","line":157,"owner":"Plugin loading","path":"zellij-utils/src/input/plugins.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
+{"column":9,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-utils/src/input/unit/layout_test.rs"],"fingerprint":"3c7821e25c122dd2c6b0171cc548b7e6dc5d16e591ca980d650dafb0fedc024463dab4cb3ba8af7064f8d3c739c150f0bba6b73ca4a866339d5830b5e6c93353_0","id":"SG-0314","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":2561,"owner":"Rust test harness","path":"zellij-utils/src/input/unit/layout_test.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":28,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-utils/src/input/unit/layout_test.rs"],"fingerprint":"3c7821e25c122dd2c6b0171cc548b7e6dc5d16e591ca980d650dafb0fedc024463dab4cb3ba8af7064f8d3c739c150f0bba6b73ca4a866339d5830b5e6c93353_1","id":"SG-0315","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":2568,"owner":"Rust test harness","path":"zellij-utils/src/input/unit/layout_test.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":21,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-utils/src/input/unit/layout_test.rs"],"fingerprint":"3c7821e25c122dd2c6b0171cc548b7e6dc5d16e591ca980d650dafb0fedc024463dab4cb3ba8af7064f8d3c739c150f0bba6b73ca4a866339d5830b5e6c93353_2","id":"SG-0316","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":2570,"owner":"Rust test harness","path":"zellij-utils/src/input/unit/layout_test.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":5,"evidence":["security/semgrep/EVIDENCE.md#test-only-unsafe","zellij-utils/src/input/unit/layout_test.rs"],"fingerprint":"3c7821e25c122dd2c6b0171cc548b7e6dc5d16e591ca980d650dafb0fedc024463dab4cb3ba8af7064f8d3c739c150f0bba6b73ca4a866339d5830b5e6c93353_3","id":"SG-0317","invariant":"Unsafe environment mutation is test-only, restores prior state, and does not ship in production binaries.","line":2580,"owner":"Rust test harness","path":"zellij-utils/src/input/unit/layout_test.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":33,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/ipc/protobuf_conversion.rs"],"fingerprint":"ecc4edae4907b25051dbddf7e12526902896b40f5c5638c00f00212cf0db535ee73672a09f6c9b88fd5270cd1956eb0d723e7c4784a91c183aa75ef2a6ca36d5_0","id":"SG-0318","invariant":"The hit is data-only PathBuf construction; no filesystem operation occurs.","line":3360,"owner":"IPC data model","path":"zellij-utils/src/ipc/protobuf_conversion.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
+{"column":47,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/ipc/protobuf_conversion.rs"],"fingerprint":"efe2f6d779d50ae6d4f9c293d0a47ed4e20fa00676abc411133a3b984e52e482ca3c25e2cc58b44256ba48a41a5deb9a67c81ab5ce255f8c4d71f1d2fee1635c_0","id":"SG-0319","invariant":"The hit is data-only PathBuf construction; no filesystem operation occurs.","line":4291,"owner":"IPC data model","path":"zellij-utils/src/ipc/protobuf_conversion.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
+{"column":17,"evidence":["security/semgrep/EVIDENCE.md#process-probes","zellij-utils/src/sessions.rs"],"fingerprint":"db9103e89f65c322a57e2591d9a4f46c92320ef2c4426efa070ca0a2bd72107c0c0b0c58503d3184326598ebf6e1abdfe58a9fa3b65b445d9217cae8d51fc849_0","id":"SG-0320","invariant":"The libc process probe is read-only and accepts only a PID parsed from a locally owned socket name.","line":221,"owner":"Session discovery","path":"zellij-utils/src/sessions.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":55,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_0","id":"SG-0321","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1014,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":48,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_1","id":"SG-0322","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1200,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":50,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_2","id":"SG-0323","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1203,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":25,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_3","id":"SG-0324","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1206,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":29,"evidence":["security/semgrep/EVIDENCE.md#vendored-termwiz","zellij-utils/src/vendored/termwiz/mod.rs"],"fingerprint":"3617041ddb34b2893096e69e16cc2f6e4a299acc6f522e4028ac7b0e8d7fd809abfb7ba52957262ccb5ced44cee7d38d0fbf8fd10baf4564e846528421b1a01a_4","id":"SG-0325","invariant":"Unsafe accesses decode Windows tagged unions or validated UTF-8 inside the vendored module; callers receive owned safe Rust values.","line":1587,"owner":"Upstream termwiz boundary","path":"zellij-utils/src/vendored/termwiz/input.rs","reason":"Required FFI, process-global, or test-only unsafe boundary reviewed in its owner module.","rule":"rust.lang.security.unsafe-usage.unsafe-usage","verdict":"accepted_unsafe_boundary"}
+{"column":32,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/vibecrafted_install.rs"],"fingerprint":"4828a8f32be886a1c1f894a23012c8181a9225042b7cde1c853a2a0bc0bb00f734c011dd6997183c8bfc42ce8195aa36a9d461005d689f73ad33d2aa066b5108_0","id":"SG-0326","invariant":"The source is enumerated from a validated framework root and destination is the current-user layouts directory.","line":396,"owner":"Vibecrafted layout installer","path":"zellij-utils/src/vibecrafted_install.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
+{"column":66,"evidence":["security/semgrep/EVIDENCE.md#path-traversal","zellij-utils/src/web_server_commands.rs"],"fingerprint":"fa7c454a17b1c0aa7fc35de868dcbdd68bef8cbb676e43ba20b4bdb69ff6b61df5359b9ac567b4657749a168258dd7db486017bff5358df7e145296a0e216621_0","id":"SG-0327","invariant":"Socket paths are discovered below the current-user runtime directory and connect probing is bounded.","line":63,"owner":"Local webserver IPC","path":"zellij-utils/src/web_server_commands.rs","reason":"The Actix taint rule matched a generic path operation outside an Actix request flow.","rule":"rust.actix.path-traversal.tainted-path.tainted-path","verdict":"scoped_false_positive"}
diff --git a/src/run_triage_cli.rs b/src/run_triage_cli.rs
index b55bb2de..9a17e995 100644
--- a/src/run_triage_cli.rs
+++ b/src/run_triage_cli.rs
@@ -195,6 +195,8 @@ struct CliTriageIo {
 const CLI_COMMAND_TIMEOUT: Duration = Duration::from_secs(10);
 const NEW_TAB_COMMAND_TIMEOUT: Duration = Duration::from_secs(30);
 const VIEWER_CREATION_RECONCILIATION_TIMEOUT: Duration = Duration::from_secs(30);
+const INVENTORY_RETRY_TIMEOUT: Duration = Duration::from_secs(10);
+const SESSION_READY_TIMEOUT: Duration = Duration::from_secs(20);
 
 fn run_command_with_timeout(
     executable: &Path,
@@ -402,13 +404,13 @@ impl CliTriageIo {
     }
 
     fn tab_inventory(&self, session: &str) -> Result<String, String> {
-        retry_json_array_output("vc-frame tab inventory", Duration::from_secs(2), || {
+        retry_json_array_output("vc-frame tab inventory", INVENTORY_RETRY_TIMEOUT, || {
             self.run(&["-s", session, "action", "list-tabs", "--json"])
         })
     }
 
     fn pane_inventory(&self, session: &str) -> Result<String, String> {
-        retry_json_array_output("vc-frame pane inventory", Duration::from_secs(2), || {
+        retry_json_array_output("vc-frame pane inventory", INVENTORY_RETRY_TIMEOUT, || {
             self.run(&[
                 "-s",
                 session,
@@ -423,7 +425,7 @@ impl CliTriageIo {
     }
 
     fn wait_for_session_ready(&self, session: &str) -> Result<(), String> {
-        let deadline = Instant::now() + Duration::from_secs(5);
+        let deadline = Instant::now() + SESSION_READY_TIMEOUT;
         loop {
             let readiness = self
                 .tab_inventory(session)
diff --git a/src/tests/e2e/cases.rs b/src/tests/e2e/cases.rs
index 86a5acff..08dd497d 100644
--- a/src/tests/e2e/cases.rs
+++ b/src/tests/e2e/cases.rs
@@ -112,6 +112,7 @@ fn account_for_races_in_snapshot(snapshot: String) -> String {
     // stay about product layout, not runner load. Segments can appear in any
     // order or subset (e.g. only MEM|DISK|HEALTH when LIVE is zero/absent).
     let live_replace = Regex::new(r"LIVE \d+\s*").unwrap();
+    let rail_live_replace = Regex::new(r"Live (?:\d+|…)").unwrap();
     let cockpit_seg_replace = Regex::new(r"(?:\| )?(?:CPU|MEM|DISK|HDD|HEALTH) [^|\n]*").unwrap();
     // Rotating startup tips and the default-mode bottom tip chip row race with
     // snapshot timing (present/absent, and tip body changes). Strip them so
@@ -121,6 +122,10 @@ fn account_for_races_in_snapshot(snapshot: String) -> String {
     // Scroll-position totals vary with fixture prompt/newline edge cases
     // (e.g. 1/3 vs 1/4) while still proving scroll mode is active.
     let scroll_indicator_replace = Regex::new(r"SCROLL:\s*\d+/\d+").unwrap();
+    // Shells can repaint the prompt between the echoed `echo $?` command and
+    // its output. Keep the status line while ignoring whether the input echo
+    // survived that repaint.
+    let echo_status_command_replace = Regex::new(r"(?m)^(│\$) echo \$\?(\s+│)$").unwrap();
     let snapshot = base_replace.replace_all(&snapshot, "\n").to_string();
     let snapshot = base_replace_tmux_mode_1
         .replace_all(&snapshot, "\n")
@@ -129,6 +134,9 @@ fn account_for_races_in_snapshot(snapshot: String) -> String {
         .replace_all(&snapshot, "\n")
         .to_string();
     let snapshot = live_replace.replace_all(&snapshot, "").to_string();
+    let snapshot = rail_live_replace
+        .replace_all(&snapshot, "Live …")
+        .to_string();
     let snapshot = cockpit_seg_replace.replace_all(&snapshot, "").to_string();
     // Collapse leftover " | " runs and trailing pipes after cockpit strip.
     let pipe_ws_replace = Regex::new(r"(?: \| )+").unwrap();
@@ -140,6 +148,10 @@ fn account_for_races_in_snapshot(snapshot: String) -> String {
     let snapshot = scroll_indicator_replace
         .replace_all(&snapshot, "SCROLL:  N/M")
         .to_string();
+    let snapshot = echo_status_command_replace
+        // Preserve the terminal-grid width while erasing the optional echo.
+        .replace_all(&snapshot, "$1        $2")
+        .to_string();
 
     eol_arrow_replace.replace_all(&snapshot, "\n").to_string()
 }
@@ -162,19 +174,23 @@ pub fn starts_with_one_terminal() {
             name: "Wait for app to load",
             instruction: |remote_terminal: RemoteTerminal| -> bool {
                 let mut step_is_complete = false;
-                if remote_terminal.status_bar_appears() && remote_terminal.cursor_position_is(3, 2)
+                if remote_terminal.status_bar_appears()
+                    && remote_terminal.snapshot_contains("SESSION")
+                    && remote_terminal.cursor_position_is(3, 2)
                 {
                     step_is_complete = true;
                 }
                 step_is_complete
             },
         });
-        if runner.test_timed_out && test_attempts > 0 {
-            test_attempts -= 1;
-            continue;
-        } else {
-            break last_snapshot;
+        if runner.test_timed_out {
+            if test_attempts > 0 {
+                test_attempts -= 1;
+                continue;
+            }
+            panic!("starts_with_one_terminal exhausted all E2E retries");
         }
+        break last_snapshot;
     };
 
     let last_snapshot = account_for_races_in_snapshot(last_snapshot);
@@ -479,7 +495,7 @@ pub fn open_new_tab() {
                 let mut step_is_complete = false;
                 if remote_terminal.cursor_position_is(3, 2)
                     && remote_terminal.snapshot_contains("Tab #2")
-                    && remote_terminal.status_bar_appears()
+                    && remote_terminal.mode_status_bar_appears()
                 {
                     // cursor is in the newly opened second tab
                     step_is_complete = true;
@@ -1669,6 +1685,7 @@ pub fn mirrored_sessions() {
                 let mut step_is_complete = false;
                 if remote_terminal.cursor_position_is(63, 2)
                     && remote_terminal.snapshot_contains("┐┌")
+                    && remote_terminal.snapshot_contains("𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.")
                 {
                     // cursor is back in the first tab
                     step_is_complete = true;
@@ -1682,6 +1699,7 @@ pub fn mirrored_sessions() {
                 let mut step_is_complete = false;
                 if remote_terminal.cursor_position_is(63, 2)
                     && remote_terminal.snapshot_contains("┐┌")
+                    && remote_terminal.snapshot_contains("𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.")
                 {
                     // cursor is back in the first tab
                     step_is_complete = true;
@@ -2379,15 +2397,15 @@ pub fn send_command_through_the_cli() {
                 name: "Wait for command to run",
                 instruction: |mut remote_terminal: RemoteTerminal| -> bool {
                     let mut step_is_complete = false;
-                    if remote_terminal.snapshot_contains("<Ctrl-c>")
-                        && remote_terminal.cursor_position_is(76, 3)
+                    if remote_terminal.snapshot_contains("foo-1")
+                        && remote_terminal.snapshot_contains("<ENTER> re-run")
                     {
+                        // The banner reaches the SSH-side parser just before the
+                        // server finishes transitioning the pane back to Held.
                         std::thread::sleep(std::time::Duration::from_millis(100));
-                        remote_terminal.send_key(&SPACE); // re-run script - here we use SPACE
-                        // instead of the default ENTER because
-                        // sending ENTER over SSH can be a little
-                        // problematic (read: I couldn't get it
-                        // to pass consistently)
+                        // A held command accepts Enter or Space. Use Space in the SSH
+                        // harness because PTY newline translation makes Enter flaky.
+                        remote_terminal.send_key(&SPACE);
                         step_is_complete = true
                     }
                     step_is_complete
@@ -2397,8 +2415,8 @@ pub fn send_command_through_the_cli() {
                 name: "Wait for script to run again",
                 instruction: |mut remote_terminal: RemoteTerminal| -> bool {
                     let mut step_is_complete = false;
-                    if remote_terminal.snapshot_contains("<Ctrl-c>")
-                        && remote_terminal.cursor_position_is(76, 4)
+                    if remote_terminal.snapshot_contains("foo-2")
+                        && remote_terminal.snapshot_contains("<ENTER> re-run")
                     {
                         step_is_complete = true
                     }
@@ -2411,8 +2429,8 @@ pub fn send_command_through_the_cli() {
             name: "Wait for script to run twice",
             instruction: |remote_terminal: RemoteTerminal| -> bool {
                 let mut step_is_complete = false;
-                if remote_terminal.snapshot_contains("foo")
-                    && remote_terminal.cursor_position_is(76, 4)
+                if remote_terminal.snapshot_contains("foo-2")
+                    && remote_terminal.snapshot_contains("<ENTER> re-run")
                 {
                     step_is_complete = true
                 }
@@ -2420,12 +2438,14 @@ pub fn send_command_through_the_cli() {
             },
         });
 
-        if runner.test_timed_out && test_attempts > 0 {
-            test_attempts -= 1;
-            continue;
-        } else {
-            break last_snapshot;
+        if runner.test_timed_out {
+            if test_attempts > 0 {
+                test_attempts -= 1;
+                continue;
+            }
+            panic!("send_command_through_the_cli exhausted all E2E retries");
         }
+        break last_snapshot;
     };
     let last_snapshot = account_for_races_in_snapshot(last_snapshot);
     assert_snapshot!(last_snapshot);
diff --git a/src/tests/e2e/remote_runner.rs b/src/tests/e2e/remote_runner.rs
index 1cd15c89..325ba33d 100644
--- a/src/tests/e2e/remote_runner.rs
+++ b/src/tests/e2e/remote_runner.rs
@@ -504,6 +504,10 @@ impl RemoteTerminal {
         let snap = self.last_snapshot.lock().unwrap().clone();
         chrome_appears_in(&snap)
     }
+    pub fn mode_status_bar_appears(&self) -> bool {
+        let snap = self.last_snapshot.lock().unwrap();
+        snap.contains("LOCK") && snap.contains("PANE") && snap.contains("SESSION")
+    }
     pub fn ctrl_plus_appears(&self) -> bool {
         let snap = self.last_snapshot.lock().unwrap().clone();
         // Dense chips may drop the superkey prefix; treat mode chrome as enough.
@@ -1086,14 +1090,19 @@ impl RemoteRunner {
                 return self.last_snapshot.lock().unwrap().clone();
             }
             let (cursor_x, cursor_y) = *self.cursor_coordinates.lock().unwrap();
+            // Evaluate the readiness predicate against the exact frame we will
+            // return. The reader thread can otherwise replace `last_snapshot`
+            // between the predicate and the clone, producing a frame that no
+            // longer satisfies the condition that accepted it.
+            let snapshot = self.last_snapshot.lock().unwrap().clone();
             let remote_terminal = RemoteTerminal {
                 cursor_x,
                 cursor_y,
-                last_snapshot: self.last_snapshot.clone(),
+                last_snapshot: Arc::new(Mutex::new(snapshot.clone())),
                 channel: self.channel.clone(),
             };
             if instruction(remote_terminal) {
-                return self.last_snapshot.lock().unwrap().clone();
+                return snapshot;
             } else {
                 retries_left -= 1;
                 std::thread::sleep(std::time::Duration::from_millis(100));
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__bracketed_paste.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__bracketed_paste.snap
index d85382c9..9aedc613 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__bracketed_paste.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__bracketed_paste.snap
@@ -25,3 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__cannot_split_terminals_vertically_when_active_terminal_is_too_small.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__cannot_split_terminals_vertically_when_active_terminal_is_too_small.snap
index 6ce98c4a..cefbd9a2 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__cannot_split_terminals_vertically_when_active_terminal_is_too_small.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__cannot_split_terminals_vertically_when_active_terminal_is_too_small.snap
@@ -21,3 +21,4 @@ expression: last_snapshot
 │      │
 │      │
 └──────┘
+  ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__close_pane.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__close_pane.snap
index 0181f276..17abb603 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__close_pane.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__close_pane.snap
@@ -25,3 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__detach_and_attach_session.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__detach_and_attach_session.snap
index cf03f56d..9f7427a2 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__detach_and_attach_session.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__detach_and_attach_session.snap
@@ -2,27 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: last_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (e2e-test)   ◉ Tab #1                                                          
-SESSIONS 1 · e2e-test   ┌ Pane #1 ─────────────────────────────────────────────────────────────────────────────────────┐
-01 ◉ e2e-test           │$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here    ○ Shell                            ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · e2e-test   ┌ Start here — map of this workspace ──────────────────────────────────────────────────────────┐
+ ● Live …               │          Start here — map of this workspace                                                  │
+01 ◉ e2e-test           │                                                                                              │
+                        │          vc-frame 0.47.3 · Vibecrafted operator layout                                       │
+                        │          You are looking at ONE session (this window). It has a fixed chrome:                │
+                        │            TOP    = this session: (name) · mode chip · tabs — ◉ marks where you are          │
+                        │            LEFT   = SESSIONS rail — other sessions / agent rooms (click to jump)             │
+                        │            CENTER = this Guide (help). Work happens on the Shell tab.                        │
+                        │            BOTTOM = status bar (modes: Ctrl+t TAB, Ctrl+p PANE, Ctrl+o SESSION)              │
+                        │                                                                                              │
+                        │          Do this first (60 seconds):                                                         │
+                        │            1. Open the Shell tab — click "Shell" on the top bar, or: Ctrl+t then 2           │
+                        │            2. Read the banner in the shell, then run:  vibecrafted start                     │
+                        │            3. Come back here anytime (Ctrl+t then 1) if you get lost.                        │
+                        │                                                                                              │
+                        │          Learn the chrome (click a topic):                                                   │
+                        │          1. Left rail = sessions (not tabs)                                                  │
+                        │          2. Top bar = tabs of this session                                                   │
+                        │          3. Keyboard + mouse cheat sheet                                                     │
+                        │          4. What to type on the Shell tab                                                    │
+                        │Help: <↓↑> - Navigate, <ESC> - Dismiss, <?> - Usage Tips                                      │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__focus_pane_with_mouse.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__focus_pane_with_mouse.snap
index f69e58dc..0a5e8565 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__focus_pane_with_mouse.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__focus_pane_with_mouse.snap
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                          ││                                                          │
 │                                                          ││                                                          │
 └──────────────────────────────────────────────────────────┘└──────────────────────────────────────────────────────────┘
-                                                        ...
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__load_plugins_in_background_on_startup.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__load_plugins_in_background_on_startup.snap
index ea8e4f1c..4b514870 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__load_plugins_in_background_on_startup.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__load_plugins_in_background_on_startup.snap
@@ -2,27 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: last_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (e2e-test)   ◉ Tab #1                                                          
-SESSIONS 1 · e2e-test   ┌ Pane #1 ─────────────────────────────────────────────────────────────────────────────────────┐
-01 ◉ e2e-test           │$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
- Ctrl g  UNLOCK                                       ...
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ⚿ L   ◉ Start here    ○ Shell                            ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · e2e-test   ┌ Start here — map of this workspace ──────────────────────────────────────────────────────────┐
+ ● Live …               │          Start here — map of this workspace                                                  │
+01 ◉ e2e-test           │                                                                                              │
+                        │          vc-frame 0.47.3 · Vibecrafted operator layout                                       │
+                        │          You are looking at ONE session (this window). It has a fixed chrome:                │
+                        │            TOP    = this session: (name) · mode chip · tabs — ◉ marks where you are          │
+                        │            LEFT   = SESSIONS rail — other sessions / agent rooms (click to jump)             │
+                        │            CENTER = this Guide (help). Work happens on the Shell tab.                        │
+                        │            BOTTOM = status bar (modes: Ctrl+t TAB, Ctrl+p PANE, Ctrl+o SESSION)              │
+                        │                                                                                              │
+                        │          Do this first (60 seconds):                                                         │
+                        │            1. Open the Shell tab — click "Shell" on the top bar, or: Ctrl+t then 2           │
+                        │            2. Read the banner in the shell, then run:  vibecrafted start                     │
+                        │            3. Come back here anytime (Ctrl+t then 1) if you get lost.                        │
+                        │                                                                                              │
+                        │          Learn the chrome (click a topic):                                                   │
+                        │          1. Left rail = sessions (not tabs)                                                  │
+                        │          2. Top bar = tabs of this session                                                   │
+                        │          3. Keyboard + mouse cheat sheet                                                     │
+                        │          4. What to type on the Shell tab                                                    │
+                        │Help: <↓↑> - Navigate, <ESC> - Dismiss, <?> - Usage Tips                                      │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  UNLOCK                                   ... LIVE  0
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__lock_mode.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__lock_mode.snap
index fc815559..690f7b88 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__lock_mode.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__lock_mode.snap
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
- Ctrl g  LOCK 
+ ⌃g  LOCK                                                LIVE  1
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__mirrored_sessions-2.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__mirrored_sessions-2.snap
index 4c203a36..95176f98 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__mirrored_sessions-2.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__mirrored_sessions-2.snap
@@ -2,27 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: second_runner_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (mirrored_sessions)   ◉ Tab #1                                                 
-SESSIONS 1 · mirrored_se┌ Pane #1 ─────────────────────────────────────────────────────────────────────────────────────┐
-01 ◉ mirrored_sessions  │$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here    ○ Shell                            ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · mirrored_se┌ Start here — map of this workspace ──────────────────────────────────────────────────────────┐
+ ● Live …               │          Start here — map of this workspace                                                  │
+01 ◉ mirrored_sessions  │                                                                                              │
+                        │          vc-frame 0.47.3 · Vibecrafted operator layout                                       │
+                        │          You are looking at ONE session (this window). It has a fixed chrome:                │
+                        │            TOP    = this session: (name) · mode chip · tabs — ◉ marks where you are          │
+                        │            LEFT   = SESSIONS rail — other sessions / agent rooms (click to jump)             │
+                        │            CENTER = this Guide (help). Work happens on the Shell tab.                        │
+                        │            BOTTOM = status bar (modes: Ctrl+t TAB, Ctrl+p PANE, Ctrl+o SESSION)              │
+                        │                                                                                              │
+                        │          Do this first (60 seconds):                                                         │
+                        │            1. Open the Shell tab — click "Shell" on the top bar, or: Ctrl+t then 2           │
+                        │            2. Read the banner in the shell, then run:  vibecrafted start                     │
+                        │            3. Come back here anytime (Ctrl+t then 1) if you get lost.                        │
+                        │                                                                                              │
+                        │          Learn the chrome (click a topic):                                                   │
+                        │          1. Left rail = sessions (not tabs)                                                  │
+                        │          2. Top bar = tabs of this session                                                   │
+                        │          3. Keyboard + mouse cheat sheet                                                     │
+                        │          4. What to type on the Shell tab                                                    │
+                        │Help: <↓↑> - Navigate, <ESC> - Dismiss, <?> - Usage Tips                                      │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__mirrored_sessions.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__mirrored_sessions.snap
index e6d6c582..230a43c8 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__mirrored_sessions.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__mirrored_sessions.snap
@@ -2,10 +2,10 @@
 source: src/tests/e2e/cases.rs
 expression: first_runner_snapshot
 ---
-                                                                                                                        
-SESSIONS 1 · mirrored_se┌ Pane #1 ─────────────────────────────────────────────────────────────────────────────────────┐
-01 ◉ mirrored_sessions  │$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here    ○ Shell                            ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · mirrored_se┌ Start here — map of this workspace ──────────────────────────────────────────────────────────┐
+ ● Live …               │                                                                                              │
+01 ◉ mirrored_sessions  │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
@@ -22,7 +22,7 @@ SESSIONS 1 · mirrored_se┌ Pane #1 ──────────────
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+                        │                                                                                              │
+                        │                                                                                              │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_left.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_left.snap
index ab9176f5..c3b08749 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_left.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_left.snap
@@ -25,3 +25,4 @@ expression: account_for_races_in_snapshot(last_snapshot)
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_left_until_it_wraps_around.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_left_until_it_wraps_around.snap
index ab9176f5..c3b08749 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_left_until_it_wraps_around.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_left_until_it_wraps_around.snap
@@ -25,3 +25,4 @@ expression: account_for_races_in_snapshot(last_snapshot)
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_right.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_right.snap
index 0504294a..d2cf917a 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_right.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_right.snap
@@ -25,3 +25,4 @@ expression: account_for_races_in_snapshot(last_snapshot)
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_right_until_it_wraps_around.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_right_until_it_wraps_around.snap
index 684f99b0..fb42d1c3 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_right_until_it_wraps_around.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__move_tab_to_right_until_it_wraps_around.snap
@@ -25,3 +25,4 @@ expression: account_for_races_in_snapshot(last_snapshot)
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_panes_and_same_tab-2.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_panes_and_same_tab-2.snap
index a5d4bde6..f600d56c 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_panes_and_same_tab-2.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_panes_and_same_tab-2.snap
@@ -2,27 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: second_runner_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (multiple_users_in_same_pane_and_tab)   ◉ Tab #1 [ ]                           
-SESSIONS 1 · multiple_us┌ Pane #1 ─────────────────────────────┤ MY FOCUS AND:   ├─────────────────────────────────────┐
-01 ◉ multiple_users_in_s│$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here [ ]   ○ Shell                         ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · multiple_us┌ Start here — map of this workspace ──┤ MY FOCUS AND:   ├─────────────────────────────────────┐
+ ● Live …               │          Start here — map of this workspace                                                  │
+01 ◉ multiple_users_in_s│                                                                                              │
+                        │          vc-frame 0.47.3 · Vibecrafted operator layout                                       │
+                        │          You are looking at ONE session (this window). It has a fixed chrome:                │
+                        │            TOP    = this session: (name) · mode chip · tabs — ◉ marks where you are          │
+                        │            LEFT   = SESSIONS rail — other sessions / agent rooms (click to jump)             │
+                        │            CENTER = this Guide (help). Work happens on the Shell tab.                        │
+                        │            BOTTOM = status bar (modes: Ctrl+t TAB, Ctrl+p PANE, Ctrl+o SESSION)              │
+                        │                                                                                              │
+                        │          Do this first (60 seconds):                                                         │
+                        │            1. Open the Shell tab — click "Shell" on the top bar, or: Ctrl+t then 2           │
+                        │            2. Read the banner in the shell, then run:  vibecrafted start                     │
+                        │            3. Come back here anytime (Ctrl+t then 1) if you get lost.                        │
+                        │                                                                                              │
+                        │          Learn the chrome (click a topic):                                                   │
+                        │          1. Left rail = sessions (not tabs)                                                  │
+                        │          2. Top bar = tabs of this session                                                   │
+                        │          3. Keyboard + mouse cheat sheet                                                     │
+                        │          4. What to type on the Shell tab                                                    │
+                        │Help: <↓↑> - Navigate, <ESC> - Dismiss, <?> - Usage Tips                                      │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_panes_and_same_tab.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_panes_and_same_tab.snap
index acdb072e..a75c76e8 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_panes_and_same_tab.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_panes_and_same_tab.snap
@@ -2,10 +2,10 @@
 source: src/tests/e2e/cases.rs
 expression: first_runner_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (multiple_users_in_same_pane_and_tab)   ◉ Tab #1 [ ]                           
-SESSIONS 1 · multiple_us┌ Pane #1 ─────────────────────────────┤ MY FOCUS AND:   ├─────────────────────────────────────┐
-01 ◉ multiple_users_in_s│$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here [ ]   ○ Shell                         ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · multiple_us┌ Start here — map of this workspace ──┤ MY FOCUS AND:   ├─────────────────────────────────────┐
+ ● Live …               │                                                                                              │
+01 ◉ multiple_users_in_s│                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
@@ -22,7 +22,7 @@ SESSIONS 1 · multiple_us┌ Pane #1 ──────────────
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+                        │                                                                                              │
+                        │                                                                                              │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_tabs-2.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_tabs-2.snap
index 8263e2f7..59532644 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_tabs-2.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_tabs-2.snap
@@ -2,27 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: second_runner_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (multiple_users_in_different_tabs)   ◉ Tab #1 [ ]                              
-SESSIONS 1 · multiple_us┌ Pane #1 ─────────────────────────────┤ MY FOCUS AND:   ├─────────────────────────────────────┐
-01 ◉ multiple_users_in_d│$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here [ ]   ○ Shell                         ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · multiple_us┌ Start here — map of this workspace ──┤ MY FOCUS AND:   ├─────────────────────────────────────┐
+ ● Live …               │          Start here — map of this workspace                                                  │
+01 ◉ multiple_users_in_d│                                                                                              │
+                        │          vc-frame 0.47.3 · Vibecrafted operator layout                                       │
+                        │          You are looking at ONE session (this window). It has a fixed chrome:                │
+                        │            TOP    = this session: (name) · mode chip · tabs — ◉ marks where you are          │
+                        │            LEFT   = SESSIONS rail — other sessions / agent rooms (click to jump)             │
+                        │            CENTER = this Guide (help). Work happens on the Shell tab.                        │
+                        │            BOTTOM = status bar (modes: Ctrl+t TAB, Ctrl+p PANE, Ctrl+o SESSION)              │
+                        │                                                                                              │
+                        │          Do this first (60 seconds):                                                         │
+                        │            1. Open the Shell tab — click "Shell" on the top bar, or: Ctrl+t then 2           │
+                        │            2. Read the banner in the shell, then run:  vibecrafted start                     │
+                        │            3. Come back here anytime (Ctrl+t then 1) if you get lost.                        │
+                        │                                                                                              │
+                        │          Learn the chrome (click a topic):                                                   │
+                        │          1. Left rail = sessions (not tabs)                                                  │
+                        │          2. Top bar = tabs of this session                                                   │
+                        │          3. Keyboard + mouse cheat sheet                                                     │
+                        │          4. What to type on the Shell tab                                                    │
+                        │Help: <↓↑> - Navigate, <ESC> - Dismiss, <?> - Usage Tips                                      │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_tabs.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_tabs.snap
index efcaec9c..c5c9fd41 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_tabs.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_different_tabs.snap
@@ -2,10 +2,10 @@
 source: src/tests/e2e/cases.rs
 expression: first_runner_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (multiple_users_in_different_tabs)   ◉ Tab #1 [ ]                              
-SESSIONS 1 · multiple_us┌ Pane #1 ─────────────────────────────┤ MY FOCUS AND:   ├─────────────────────────────────────┐
-01 ◉ multiple_users_in_d│$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here [ ]   ○ Shell                         ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · multiple_us┌ Start here — map of this workspace ──┤ MY FOCUS AND:   ├─────────────────────────────────────┐
+ ● Live …               │                                                                                              │
+01 ◉ multiple_users_in_d│                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
@@ -22,7 +22,7 @@ SESSIONS 1 · multiple_us┌ Pane #1 ──────────────
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+                        │                                                                                              │
+                        │                                                                                              │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_same_pane_and_tab-2.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_same_pane_and_tab-2.snap
index a5d4bde6..f600d56c 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_same_pane_and_tab-2.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_same_pane_and_tab-2.snap
@@ -2,27 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: second_runner_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (multiple_users_in_same_pane_and_tab)   ◉ Tab #1 [ ]                           
-SESSIONS 1 · multiple_us┌ Pane #1 ─────────────────────────────┤ MY FOCUS AND:   ├─────────────────────────────────────┐
-01 ◉ multiple_users_in_s│$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here [ ]   ○ Shell                         ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · multiple_us┌ Start here — map of this workspace ──┤ MY FOCUS AND:   ├─────────────────────────────────────┐
+ ● Live …               │          Start here — map of this workspace                                                  │
+01 ◉ multiple_users_in_s│                                                                                              │
+                        │          vc-frame 0.47.3 · Vibecrafted operator layout                                       │
+                        │          You are looking at ONE session (this window). It has a fixed chrome:                │
+                        │            TOP    = this session: (name) · mode chip · tabs — ◉ marks where you are          │
+                        │            LEFT   = SESSIONS rail — other sessions / agent rooms (click to jump)             │
+                        │            CENTER = this Guide (help). Work happens on the Shell tab.                        │
+                        │            BOTTOM = status bar (modes: Ctrl+t TAB, Ctrl+p PANE, Ctrl+o SESSION)              │
+                        │                                                                                              │
+                        │          Do this first (60 seconds):                                                         │
+                        │            1. Open the Shell tab — click "Shell" on the top bar, or: Ctrl+t then 2           │
+                        │            2. Read the banner in the shell, then run:  vibecrafted start                     │
+                        │            3. Come back here anytime (Ctrl+t then 1) if you get lost.                        │
+                        │                                                                                              │
+                        │          Learn the chrome (click a topic):                                                   │
+                        │          1. Left rail = sessions (not tabs)                                                  │
+                        │          2. Top bar = tabs of this session                                                   │
+                        │          3. Keyboard + mouse cheat sheet                                                     │
+                        │          4. What to type on the Shell tab                                                    │
+                        │Help: <↓↑> - Navigate, <ESC> - Dismiss, <?> - Usage Tips                                      │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_same_pane_and_tab.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_same_pane_and_tab.snap
index acdb072e..a75c76e8 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_same_pane_and_tab.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__multiple_users_in_same_pane_and_tab.snap
@@ -2,10 +2,10 @@
 source: src/tests/e2e/cases.rs
 expression: first_runner_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (multiple_users_in_same_pane_and_tab)   ◉ Tab #1 [ ]                           
-SESSIONS 1 · multiple_us┌ Pane #1 ─────────────────────────────┤ MY FOCUS AND:   ├─────────────────────────────────────┐
-01 ◉ multiple_users_in_s│$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here [ ]   ○ Shell                         ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · multiple_us┌ Start here — map of this workspace ──┤ MY FOCUS AND:   ├─────────────────────────────────────┐
+ ● Live …               │                                                                                              │
+01 ◉ multiple_users_in_s│                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
@@ -22,7 +22,7 @@ SESSIONS 1 · multiple_us┌ Pane #1 ──────────────
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+                        │                                                                                              │
+                        │                                                                                              │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__open_new_tab.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__open_new_tab.snap
index d13809af..4946f441 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__open_new_tab.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__open_new_tab.snap
@@ -25,3 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__override_layout_from_default_to_compact.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__override_layout_from_default_to_compact.snap
index f40a559f..51369e21 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__override_layout_from_default_to_compact.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__override_layout_from_default_to_compact.snap
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.  │ ▷ N   ◉ Tab #1                                                      ✍ Composer · ❯_ Quick cmd
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Tab #1                                           ✍ Composer     · ❯_ Quick cmd
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__pin_floating_panes.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__pin_floating_panes.snap
index c7841d5b..6dde661f 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__pin_floating_panes.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__pin_floating_panes.snap
@@ -9,7 +9,7 @@ expression: last_snapshot
 │line2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa │
 │line3aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa │
 │line4aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa │
-│line5aaaaaaaaaaaaaaaaaaaaaaaa┌ Pane #2 ──────────────────────────────────────── PIN [+] ┐aaaaaaaaaaaaaaaaaaaaaaaaaaaa │
+│line5aaaaaaaaaaaaaaaaaaaaaaaa┌ Pane #2 ────────────────────────────────────────── PIN ◉ ┐aaaaaaaaaaaaaaaaaaaaaaaaaaaa │
 │line6aaaaaaaaaaaaaaaaaaaaaaaa│$                                                         │aaaaaaaaaaaaaaaaaaaaaaaaaaaa │
 │line7aaaaaaaaaaaaaaaaaaaaaaaa│                                                          │aaaaaaaaaaaaaaaaaaaaaaaaaaaa │
 │line8aaaaaaaaaaaaaaaaaaaaaaaa│                                                          │aaaaaaaaaaaaaaaaaaaaaaaaaaaa │
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
- Ctrl p  PANE   n  New  ←↓↑→  Move  Ctrl q  Close  ... 
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__quit_and_resurrect_session.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__quit_and_resurrect_session.snap
index f585cd4d..e69a9b0e 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__quit_and_resurrect_session.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__quit_and_resurrect_session.snap
@@ -2,4 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: last_snapshot
 ---
-█
+ 𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (e2e-test)   ◉ Tab #1    ○ Tab #2    ○ Tab #3    ○ Tab #4                          Alt <[]>  STAGGERED 
+┌ Pane #1 ─────────────────────────────────────────────────┐┌ Pane #2 ─────────────────────────────────────────────────┐
+│$                                                         ││$                                                         │
+│                                                          ││                                                          │
+│                                                          ││                                                          │
+│                                                          ││                                                          │
+│                             ┌ Pane #4 ────────────────────────────────────────── PIN ○ ┐                             │
+│                             │$                                                         │                             │
+│                             │ ┌ Pane #6 ────────────────────────────────────────── PIN ○ ┐                           │
+│                             │ │$ █                                                       │                           │
+│                             │ │                                                          │                           │
+│                             │ │                                                          │───────────────────────────┘
+│                             │ │                                                          │───────────────────────────┐
+│                             │ │                                                          │                           │
+│                             │ │                                                          │                           │
+│                             └─│                                                          │                           │
+│                               │                                                          │                           │
+│                               └──────────────────────────────────────────────────────────┘                           │
+│                                                          ││                                                          │
+│                                                          ││                                                          │
+│                                                          ││                                                          │
+└──────────────────────────────────────────────────────────┘└──────────────────────────────────────────────────────────┘
+ ⌃ +g LOCK p PANE t TAB n RESIZE h MOVE s SEARCH o SESSION                      ⌥ + <[]>  STAGGERED 
+ (FLOATING PANES VISIBLE): Press Ctrl p, <w> to hide.
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__quit_and_resurrect_session_with_viewport_serialization.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__quit_and_resurrect_session_with_viewport_serialization.snap
index f585cd4d..e69a9b0e 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__quit_and_resurrect_session_with_viewport_serialization.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__quit_and_resurrect_session_with_viewport_serialization.snap
@@ -2,4 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: last_snapshot
 ---
-█
+ 𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (e2e-test)   ◉ Tab #1    ○ Tab #2    ○ Tab #3    ○ Tab #4                          Alt <[]>  STAGGERED 
+┌ Pane #1 ─────────────────────────────────────────────────┐┌ Pane #2 ─────────────────────────────────────────────────┐
+│$                                                         ││$                                                         │
+│                                                          ││                                                          │
+│                                                          ││                                                          │
+│                                                          ││                                                          │
+│                             ┌ Pane #4 ────────────────────────────────────────── PIN ○ ┐                             │
+│                             │$                                                         │                             │
+│                             │ ┌ Pane #6 ────────────────────────────────────────── PIN ○ ┐                           │
+│                             │ │$ █                                                       │                           │
+│                             │ │                                                          │                           │
+│                             │ │                                                          │───────────────────────────┘
+│                             │ │                                                          │───────────────────────────┐
+│                             │ │                                                          │                           │
+│                             │ │                                                          │                           │
+│                             └─│                                                          │                           │
+│                               │                                                          │                           │
+│                               └──────────────────────────────────────────────────────────┘                           │
+│                                                          ││                                                          │
+│                                                          ││                                                          │
+│                                                          ││                                                          │
+└──────────────────────────────────────────────────────────┘└──────────────────────────────────────────────────────────┘
+ ⌃ +g LOCK p PANE t TAB n RESIZE h MOVE s SEARCH o SESSION                      ⌥ + <[]>  STAGGERED 
+ (FLOATING PANES VISIBLE): Press Ctrl p, <w> to hide.
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__resize_pane.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__resize_pane.snap
index cc077680..2f55fb87 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__resize_pane.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__resize_pane.snap
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                    ││                                                                │
 │                                                    ││                                                                │
 └────────────────────────────────────────────────────┘└────────────────────────────────────────────────────────────────┘
-                                                        ...
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__resize_terminal_window.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__resize_terminal_window.snap
index bcf260d0..8309e420 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__resize_terminal_window.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__resize_terminal_window.snap
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                ││                                                │                    
 │                                                ││                                                │                    
 └────────────────────────────────────────────────┘└────────────────────────────────────────────────┘                    
-                                    ...
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION     BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__scrolling_inside_a_pane.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__scrolling_inside_a_pane.snap
index 26a8f8da..063d274f 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__scrolling_inside_a_pane.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__scrolling_inside_a_pane.snap
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                          ││line20                                                    │
 │                                                          ││li█e21                                                    │
 └──────────────────────────────────────────────────────────┘└──────────────────────────────────────────────────────────┘
- Ctrl s  SEARCH   s  Search  ↓↑  Scroll  ...      
+ ⌃s  SEARCH   s  Search  ↓↑  Scroll  PgDn|PgUp  Scroll  d|u  Scroll  e  Edit  ENTER  Select       BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__scrolling_inside_a_pane_with_mouse.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__scrolling_inside_a_pane_with_mouse.snap
index e72618ba..414240a3 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__scrolling_inside_a_pane_with_mouse.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__scrolling_inside_a_pane_with_mouse.snap
@@ -3,26 +3,26 @@ source: src/tests/e2e/cases.rs
 expression: last_snapshot
 ---
  𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (e2e-test)   ◉ Tab #1                                                                   
-┌ Pane #1 ─────────────────────────────────────────────────┐┌ Pane #2 ─────────────────────────────────────────────────┐
-│$                                                         ││$ █                                                       │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
-│                                                          ││                                                          │
+┌ Pane #1 ─────────────────────────────────────────────────┐┌ Pane #2 ─────────────────────────────────── SCROLL:  N/M ┐
+│$                                                         ││$ cat /usr/src/zellij/fixtures/e2e/scrolling_inside_a_pane│
+│                                                          ││line1                                                     │
+│                                                          ││line2                                                     │
+│                                                          ││line3                                                     │
+│                                                          ││line4                                                     │
+│                                                          ││line5                                                     │
+│                                                          ││line6                                                     │
+│                                                          ││line7                                                     │
+│                                                          ││line8                                                     │
+│                                                          ││line9                                                     │
+│                                                          ││line10                                                    │
+│                                                          ││line11                                                    │
+│                                                          ││line12                                                    │
+│                                                          ││line13                                                    │
+│                                                          ││line14                                                    │
+│                                                          ││line15                                                    │
+│                                                          ││line16                                                    │
+│                                                          ││line17                                                    │
+│                                                          ││line18                                                    │
+│                                                          ││li█e19                                                    │
 └──────────────────────────────────────────────────────────┘└──────────────────────────────────────────────────────────┘
-                                                        ...
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__send_blocking_command_through_the_cli.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__send_blocking_command_through_the_cli.snap
index 1f94a304..b9c304cc 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__send_blocking_command_through_the_cli.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__send_blocking_command_through_the_cli.snap
@@ -5,9 +5,10 @@ expression: last_snapshot
  𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (e2e-test)   ◉ Tab #1                                                                                                                   
 ┌ Pane #1 ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
 │$ /usr/src/zellij/zellij run --blocking --floating --close-on-exit -- bash -c 'sleep 2 && exit 42'                                                  │
+│terminal_1                                                                                                                                          │
 │$                                                                                                                                                   │
-│$ echo $?                                                                                                                                           │
-│42                                                                                                                                                  │
+│$                                                                                                                                                   │
+│0                                                                                                                                                   │
 │$                                                                                                                                                   │
 │$ █                                                                                                                                                 │
 │                                                                                                                                                    │
@@ -23,5 +24,5 @@ expression: last_snapshot
 │                                                                                                                                                    │
 │                                                                                                                                                    │
 │                                                                                                                                                    │
-│                                                                                                                                                    │
 └────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                        ⌥ +  <n> New Pane  <f> Floating 
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__send_command_through_the_cli.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__send_command_through_the_cli.snap
index 94a8dc9f..3f6df2c8 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__send_command_through_the_cli.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__send_command_through_the_cli.snap
@@ -4,11 +4,11 @@ expression: last_snapshot
 ---
  𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (e2e-test)   ◉ Tab #1                                                                                                 
 ┌ Pane #1 ────────────────────────────────────────────────────────────────┐┌ /usr/src/zellij/fixtures/append-echo-script.sh ─────────────────────────┐
-│$ /usr/src/zellij/zellij run -s -- "/usr/src/zellij/fixtures/append-echo-││foo                                                                      │
-│script.sh"                                                               ││foo                                                                      │
-│terminal_1                                                               ││foo                                                                      │
-│$                                                                        ││foo                                                                      │
-│$                                                                        ││█                                                                        │
+│$ /usr/src/zellij/zellij run -s -- "/usr/src/zellij/fixtures/append-echo-││foo-1                                                                    │
+│script.sh"                                                               ││foo-2                                                                    │
+│terminal_1                                                               ││█                                                                        │
+│$                                                                        ││                                                                         │
+│$                                                                        ││                                                                         │
 │                                                                         ││                                                                         │
 │                                                                         ││                                                                         │
 │                                                                         ││                                                                         │
@@ -25,3 +25,4 @@ expression: last_snapshot
 │                                                                         ││                                                                         │
 │                                                                         ││                                                                         │
 └─────────────────────────────────────────────────────────────────────────┘└ [ EXIT CODE: 0 ] <ENTER> re-run, <ESC> drop to shell, <Ctrl-c> exit ────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                                                  ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__split_terminals_vertically.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__split_terminals_vertically.snap
index e72618ba..9c24cf39 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__split_terminals_vertically.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__split_terminals_vertically.snap
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                          ││                                                          │
 │                                                          ││                                                          │
 └──────────────────────────────────────────────────────────┘└──────────────────────────────────────────────────────────┘
-                                                        ...
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__start_without_pane_frames.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__start_without_pane_frames.snap
index 2f5eb565..5ac997b3 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__start_without_pane_frames.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__start_without_pane_frames.snap
@@ -2,27 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: last_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (e2e-test)   ◉ Tab #1                                                          
-SESSIONS 1 · e2e-test  │$ █                                                                                             
-01 ◉ e2e-test          │                                                                                                
-   ◉ Tab #1 · terminal │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
-                       │                                                                                                
- f ○   ? · final       │                                                                                                
- x ○   ? · fail        │                                                                                                
- n ○   ? · needs       │                                                                                                
-                                                        ...
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here    ○ Shell                            ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1             │           Start here — map of this workspace                                                   
+ ● Live …              │                                                                                                
+01 ◉ e2e-test          │           vc-frame 0.47.3 · Vibecrafted operator layout                                        
+                       │           You are looking at ONE session (this window). It has a fixed chrome:                 
+                       │             TOP    = this session: (name) · mode chip · tabs — ◉ marks where you are           
+                       │             LEFT   = SESSIONS rail — other sessions / agent rooms (click to jump)              
+                       │             CENTER = this Guide (help). Work happens on the Shell tab.                         
+                       │             BOTTOM = status bar (modes: Ctrl+t TAB, Ctrl+p PANE, Ctrl+o SESSION)               
+                       │                                                                                                
+                       │           Do this first (60 seconds):                                                          
+                       │             1. Open the Shell tab — click "Shell" on the top bar, or: Ctrl+t then 2            
+                       │             2. Read the banner in the shell, then run:  vibecrafted start                      
+                       │             3. Come back here anytime (Ctrl+t then 1) if you get lost.                         
+                       │                                                                                                
+                       │           Learn the chrome (click a topic):                                                    
+                       │           1. Left rail = sessions (not tabs)                                                   
+                       │           2. Top bar = tabs of this session                                                    
+                       │           3. Keyboard + mouse cheat sheet                                                      
+                       │           4. What to type on the Shell tab                                                     
+                       │           5. Command Composer (Cmd+E)                                                          
+                       │           6. Look, themes & host terminal                                                      
+ 🅵… · 🆇… · 🅽…          │Help: <↓↑> - Navigate, <ESC> - Dismiss, <?> - Usage Tips                                        
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__starts_with_one_terminal.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__starts_with_one_terminal.snap
index 0181f276..17abb603 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__starts_with_one_terminal.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__starts_with_one_terminal.snap
@@ -25,3 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__status_bar_loads_custom_keybindings.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__status_bar_loads_custom_keybindings.snap
index 5ea2a649..51682603 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__status_bar_loads_custom_keybindings.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__status_bar_loads_custom_keybindings.snap
@@ -2,27 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: last_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (e2e-test)   ◉ Tab #1                                                                    BASE 
-SESSIONS 1 · e2e-test   ┌ Pane #1 ─────────────────────────────────────────────────────────────────────────────────────┐
-01 ◉ e2e-test           │$ █                                                                                           │
-   ◉ Tab #1 · terminal  │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                          
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here    ○ Shell                            ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · e2e-test   ┌ Start here — map of this workspace ──────────────────────────────────────────────────────────┐
+ ● Live …               │          Start here — map of this workspace                                                  │
+01 ◉ e2e-test           │                                                                                              │
+                        │          vc-frame 0.47.3 · Vibecrafted operator layout                                       │
+                        │          You are looking at ONE session (this window). It has a fixed chrome:                │
+                        │            TOP    = this session: (name) · mode chip · tabs — ◉ marks where you are          │
+                        │            LEFT   = SESSIONS rail — other sessions / agent rooms (click to jump)             │
+                        │            CENTER = this Guide (help). Work happens on the Shell tab.                        │
+                        │            BOTTOM = status bar (modes: Ctrl+t TAB, Ctrl+p PANE, Ctrl+o SESSION)              │
+                        │                                                                                              │
+                        │          Do this first (60 seconds):                                                         │
+                        │            1. Open the Shell tab — click "Shell" on the top bar, or: Ctrl+t then 2           │
+                        │            2. Read the banner in the shell, then run:  vibecrafted start                     │
+                        │            3. Come back here anytime (Ctrl+t then 1) if you get lost.                        │
+                        │                                                                                              │
+                        │          Learn the chrome (click a topic):                                                   │
+                        │          1. Left rail = sessions (not tabs)                                                  │
+                        │          2. Top bar = tabs of this session                                                   │
+                        │          3. Keyboard + mouse cheat sheet                                                     │
+                        │          4. What to type on the Shell tab                                                    │
+                        │Help: <↓↑> - Navigate, <ESC> - Dismiss, <?> - Usage Tips                                      │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ F1  LOCK  F2  PANE  F3  TAB  F4  RESIZE  F5  MOVE  F6  SEARCH  ⌥F7  SESSION  ⌃F8  QUIT           BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__tmux_mode.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__tmux_mode.snap
index e72618ba..9c24cf39 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__tmux_mode.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__tmux_mode.snap
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                          ││                                                          │
 │                                                          ││                                                          │
 └──────────────────────────────────────────────────────────┘└──────────────────────────────────────────────────────────┘
-                                                        ...
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__toggle_floating_panes.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__toggle_floating_panes.snap
index 8a547eb7..d82cae6a 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__toggle_floating_panes.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__toggle_floating_panes.snap
@@ -9,7 +9,7 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 │                                                                                                                      │
-│                             ┌ Pane #2 ──────────────────────────────────────── PIN [ ] ┐                             │
+│                             ┌ Pane #2 ────────────────────────────────────────── PIN ○ ┐                             │
 │                             │$ █                                                       │                             │
 │                             │                                                          │                             │
 │                             │                                                          │                             │
@@ -25,3 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__toggle_pane_fullscreen.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__toggle_pane_fullscreen.snap
index ffd11578..86ab1421 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__toggle_pane_fullscreen.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__toggle_pane_fullscreen.snap
@@ -25,4 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                        ...
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__typing_exit_closes_pane.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__typing_exit_closes_pane.snap
index 0181f276..17abb603 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__typing_exit_closes_pane.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__typing_exit_closes_pane.snap
@@ -25,3 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__undo_rename_pane.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__undo_rename_pane.snap
index 0181f276..17abb603 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__undo_rename_pane.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__undo_rename_pane.snap
@@ -25,3 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__undo_rename_tab.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__undo_rename_tab.snap
index 0181f276..17abb603 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__undo_rename_tab.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__undo_rename_tab.snap
@@ -25,3 +25,4 @@ expression: last_snapshot
 │                                                                                                                      │
 │                                                                                                                      │
 └──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                            ...
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__use_custom_layout_with_relative_path.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__use_custom_layout_with_relative_path.snap
index 3ea127ae..decd447b 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__use_custom_layout_with_relative_path.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__use_custom_layout_with_relative_path.snap
@@ -2,7 +2,7 @@
 source: src/tests/e2e/cases.rs
 expression: last_snapshot
 ---
- Ctrl +g LOCK p PANE t TAB n RESIZE h MOVE s SEARCH o SESSION 
+ ⌃ +g LOCK p PANE t TAB n RESIZE h MOVE s SEARCH o SESSION 
 ┌ Pane #1 ─────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
 │$ █                                                                                                                   │
 │                                                                                                                      │
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__watcher_client_functionality-2.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__watcher_client_functionality-2.snap
index e6654a24..caeddc08 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__watcher_client_functionality-2.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__watcher_client_functionality-2.snap
@@ -2,10 +2,10 @@
 source: src/tests/e2e/cases.rs
 expression: watcher_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (watcher_client_functionality)   ◉ shell [ ]                                   
-SESSIONS 1 · watcher_cli┌ Pane #1 ─────────────────────────────┤ MY FOCUS AND:   ├─────────────────────────────────────┐
-01 ◉ watcher_client_func│$ █                                                                                           │
-   ◉ shell · terminal   │                                                                                              │
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here [ ]   ○ Shell                         ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · watcher_cli┌ Start here — map of this workspace ──┤ MY FOCUS AND:   ├─────────────────────────────────────┐
+ ● Live …               │                                                                                              │
+01 ◉ watcher_client_func│                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
@@ -22,7 +22,7 @@ SESSIONS 1 · watcher_cli┌ Pane #1 ──────────────
                         │                                                                                              │
                         │                                                                                              │
                         │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                         ...
+                        │                                                                                              │
+                        │                                                                                              │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__watcher_client_functionality.snap b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__watcher_client_functionality.snap
index b4890dc1..83d14bdf 100644
--- a/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__watcher_client_functionality.snap
+++ b/src/tests/e2e/snapshots/vc_frame__tests__e2e__cases__watcher_client_functionality.snap
@@ -2,27 +2,27 @@
 source: src/tests/e2e/cases.rs
 expression: main_client_snapshot
 ---
-          𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. (watcher_client_functionality)   ◉ shell [ ]                                   
-SESSIONS 1 · watcher_cli┌ Pane #1 ─────────────────────────────┤ MY FOCUS AND:   ├─────────────────────────────────────┐
-01 ◉ watcher_client_func│$ █                                                                                           │
-   ◉ shell · terminal   │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
-                        │                                                                                              │
- f ○   ? · final        │                                                                                              │
- x ○   ? · fail         │                                                                                              │
- n ○   ? · needs        └──────────────────────────────────────────────────────────────────────────────────────────────┘
-                                                         ...
+        𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.    ⎮  ▷ N   ◉ Start here [ ]   ○ Shell                         ✍ Composer     · ❯_ Quick cmd       
+SESSIONS 1 · watcher_cli┌ Start here — map of this workspace ──┤ MY FOCUS AND:   ├─────────────────────────────────────┐
+ ● Live …               │          Start here — map of this workspace                                                  │
+01 ◉ watcher_client_func│                                                                                              │
+                        │          vc-frame 0.47.3 · Vibecrafted operator layout                                       │
+                        │          You are looking at ONE session (this window). It has a fixed chrome:                │
+                        │            TOP    = this session: (name) · mode chip · tabs — ◉ marks where you are          │
+                        │            LEFT   = SESSIONS rail — other sessions / agent rooms (click to jump)             │
+                        │            CENTER = this Guide (help). Work happens on the Shell tab.                        │
+                        │            BOTTOM = status bar (modes: Ctrl+t TAB, Ctrl+p PANE, Ctrl+o SESSION)              │
+                        │                                                                                              │
+                        │          Do this first (60 seconds):                                                         │
+                        │            1. Open the Shell tab — click "Shell" on the top bar, or: Ctrl+t then 2           │
+                        │            2. Read the banner in the shell, then run:  vibecrafted start                     │
+                        │            3. Come back here anytime (Ctrl+t then 1) if you get lost.                        │
+                        │                                                                                              │
+                        │          Learn the chrome (click a topic):                                                   │
+                        │          1. Left rail = sessions (not tabs)                                                  │
+                        │          2. Top bar = tabs of this session                                                   │
+                        │          3. Keyboard + mouse cheat sheet                                                     │
+                        │          4. What to type on the Shell tab                                                    │
+                        │Help: <↓↑> - Navigate, <ESC> - Dismiss, <?> - Usage Tips                                      │
+ 🅵… · 🆇… · 🅽…           └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ ⌃g  LOCK  ⌃p  PANE  ⌃t  TAB  ⌃n  RESIZE  ⌃h  MOVE  ⌃s  SEARCH  ⌃o  SESSION                    ...  BASE
diff --git a/src/tests/fixtures/append-echo-script.sh b/src/tests/fixtures/append-echo-script.sh
index d6b900cb..53aeb015 100755
--- a/src/tests/fixtures/append-echo-script.sh
+++ b/src/tests/fixtures/append-echo-script.sh
@@ -1,2 +1,8 @@
 #!/usr/bin/env bash
-echo foo >> /tmp/foo && cat /tmp/foo
+state_file="/tmp/vc-frame-e2e/cache/append-echo-script-output"
+run_count=1
+if [ -f "$state_file" ]; then
+    run_count=$(( $(wc -l < "$state_file") + 1 ))
+fi
+printf 'foo-%s\n' "$run_count" >> "$state_file"
+cat "$state_file"
diff --git a/tools/semgrep_inventory.py b/tools/semgrep_inventory.py
index b0ce1824..e4c459aa 100755
--- a/tools/semgrep_inventory.py
+++ b/tools/semgrep_inventory.py
@@ -34,6 +34,7 @@
 WEB_CLIENT_TEST_PATH = "zellij-client/src/web_client/unit/web_client_tests.rs"
 WEB_CLIENT_PARENT_PATH = "zellij-client/src/web_client/mod.rs"
 CURRENT_EXE_PATHS = {
+    "src/clinic.rs",
     "src/run_triage_cli.rs",
     "xtask/src/pipelines.rs",
     "zellij-client/src/lib.rs",
@@ -216,6 +217,17 @@ def require_current_exe_policy(path: str, lines: list[str], line: int) -> None:
     if path not in CURRENT_EXE_PATHS:
         raise InventoryError(f"current-exe finding has no source policy: {path}:{line}")
     source_line = lines[line - 1].strip()
+    if path == "src/clinic.rs":
+        nearby = [candidate.strip() for candidate in lines[line - 1:line + 8]]
+        if (
+            source_line != "let Ok(exe) = std::env::current_exe() else {"
+            or "let Ok(installed_at) = std::fs::metadata(&exe).and_then(|meta| meta.modified()) else {"
+            not in nearby
+        ):
+            raise InventoryError(
+                f"clinic current-exe drift probe source shape changed at {path}:{line}"
+            )
+        return
     if path == "src/run_triage_cli.rs":
         nearby = [candidate.strip() for candidate in lines[line - 1:line + 8]]
         production_shape = [
@@ -613,6 +625,14 @@ def adjudicate(
         )
     if rule == "rust.lang.security.current-exe.current-exe":
         require_current_exe_policy(path, lines, line)
+        if path == "src/clinic.rs":
+            return (
+                "scoped_false_positive",
+                "current_exe is read only to identify the running binary for a local drift diagnosis.",
+                "The resolved path is used only for metadata and local process-name comparison; it is never executed or trusted as update provenance.",
+                "Clinic runtime diagnostics",
+                ["security/semgrep/EVIDENCE.md#current-executable", path],
+            )
         if path == XTASK_INSTALL_PATH:
             return (
                 "scoped_false_positive",
diff --git a/zellij-server/src/os_input_output.rs b/zellij-server/src/os_input_output.rs
index e48a8ddc..d11b3d28 100644
--- a/zellij-server/src/os_input_output.rs
+++ b/zellij-server/src/os_input_output.rs
@@ -655,9 +655,15 @@ impl ServerOsApi for ServerOsInputOutput {
         run_command: RunCommand,
         quit_cb: Box<dyn Fn(PaneId, Option<i32>, RunCommand) + Send>,
     ) -> Result<(Box<dyn AsyncReader>, Option<u32>)> {
+        self.pty_backend
+            .reserve_terminal_id_for_rerun(terminal_id)?;
+        let spawn_result = self
+            .pty_backend
+            .spawn_terminal(run_command, None, quit_cb, terminal_id);
         let (async_reader, child_fd) =
-            self.pty_backend
-                .spawn_terminal(run_command, None, quit_cb, terminal_id)?;
+            resolve_reserved_terminal_spawn(terminal_id, spawn_result, |terminal_id| {
+                self.pty_backend.clear_terminal_id(terminal_id)
+            })?;
         Ok((async_reader, Some(child_fd as u32)))
     }
     fn clear_terminal_id(&self, terminal_id: u32) -> Result<()> {
diff --git a/zellij-server/src/os_input_output_unix.rs b/zellij-server/src/os_input_output_unix.rs
index 82176cc0..a24eefac 100644
--- a/zellij-server/src/os_input_output_unix.rs
+++ b/zellij-server/src/os_input_output_unix.rs
@@ -723,6 +723,27 @@ impl UnixPtyBackend {
             .insert(terminal_id, None);
     }
 
+    pub fn reserve_terminal_id_for_rerun(&self, terminal_id: u32) -> Result<()> {
+        let mut terminal_registry = self
+            .terminal_id_to_raw_fd
+            .lock()
+            .to_anyhow()
+            .context("failed to lock terminal registry before rerun")?;
+        match terminal_registry.get(&terminal_id) {
+            Some(Some(_)) => {
+                terminal_registry.insert(terminal_id, None);
+                Ok(())
+            },
+            // `start_suspended` reserves the id before the first run. The same
+            // rerun path activates both that initial reservation and a later
+            // held command, so an existing reservation is already ready.
+            Some(None) => Ok(()),
+            None => Err(anyhow!(
+                "terminal {terminal_id} cannot be rerun because it is not registered"
+            )),
+        }
+    }
+
     pub fn clear_terminal_id(&self, terminal_id: u32) {
         self.terminal_id_to_raw_fd
             .lock()
@@ -926,6 +947,34 @@ mod tests {
         );
     }
 
+    #[test]
+    fn rerun_transitions_an_active_terminal_back_to_reserved() {
+        let backend = UnixPtyBackend::new().expect("backend");
+        let terminal_id = 77;
+        backend
+            .terminal_id_to_raw_fd
+            .lock()
+            .expect("terminal registry")
+            .insert(terminal_id, Some(123));
+
+        backend
+            .reserve_terminal_id_for_rerun(terminal_id)
+            .expect("active terminal should become a reserved rerun slot");
+
+        assert!(matches!(
+            backend
+                .terminal_id_to_raw_fd
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner())
+                .get(&terminal_id),
+            Some(None)
+        ));
+
+        backend
+            .reserve_terminal_id_for_rerun(terminal_id)
+            .expect("a start-suspended reservation should remain usable");
+    }
+
     /// Verify that `try_write_to_fd` writes as many bytes as the kernel will
     /// accept in one pass and returns a partial count (not an error) when the
     /// PTY buffer fills up.
diff --git a/zellij-server/src/os_input_output_windows.rs b/zellij-server/src/os_input_output_windows.rs
index dc141bc1..32a9c318 100644
--- a/zellij-server/src/os_input_output_windows.rs
+++ b/zellij-server/src/os_input_output_windows.rs
@@ -860,6 +860,27 @@ impl WindowsPtyBackend {
             .insert(terminal_id, None);
     }
 
+    pub fn reserve_terminal_id_for_rerun(&self, terminal_id: u32) -> Result<()> {
+        let mut terminals = self
+            .terminals
+            .lock()
+            .to_anyhow()
+            .context("failed to lock terminal registry before rerun")?;
+        match terminals.get(&terminal_id) {
+            Some(Some(_)) => {
+                terminals.insert(terminal_id, None);
+                Ok(())
+            },
+            // `start_suspended` reserves the id before the first run. The same
+            // rerun path activates both that initial reservation and a later
+            // held command, so an existing reservation is already ready.
+            Some(None) => Ok(()),
+            None => Err(anyhow!(
+                "terminal {terminal_id} cannot be rerun because it is not registered"
+            )),
+        }
+    }
+
     pub fn clear_terminal_id(&self, terminal_id: u32) {
         self.terminals
             .lock()
diff --git a/zellij-server/src/plugins/unit/snapshots/zellij_server__plugins__plugin_tests__dump_layout_success_plugin_command.snap b/zellij-server/src/plugins/unit/snapshots/zellij_server__plugins__plugin_tests__dump_layout_success_plugin_command.snap
index 47558309..7aeefd4c 100644
--- a/zellij-server/src/plugins/unit/snapshots/zellij_server__plugins__plugin_tests__dump_layout_success_plugin_command.snap
+++ b/zellij-server/src/plugins/unit/snapshots/zellij_server__plugins__plugin_tests__dump_layout_success_plugin_command.snap
@@ -3,5 +3,5 @@ source: zellij-server/src/plugins/./unit/plugin_tests.rs
 expression: "format!(\"{:#?}\", plugin_bytes_event)"
 ---
 Some(
-    "Layout dump success: layout {\n\r    pane size=1 borderless=true {\n\r        plugin location=\"tab-bar\" {\n\r            // 🚥 zone: clear the macOS traffic lights in the native window\n\r            left_inset \"9\"\n\r        }\n\r    }\n\r    pane split_direction=\"vertical\" {\n\r        pane size=24 borderless=true {\n\r            plugin location=\"session-manager\" {\n\r                rail true\n\r                pane_title \"Sessions\"\n\r            }\n\r        }\n\r        pane\n\r    }\n\r    pane size=1 borderless=true {\n\r        plugin location=\"status-bar\"\n\r    }\n\r}\n\r",
+    "Layout dump success: layout {\n\r    session_layer {\n\r        pane size=1 borderless=true {\n\r            plugin location=\"tab-bar\" {\n\r                session_canvas true\n\r                session_canvas_kind \"compact-bar\"\n\r                // 🚥 zone: clear the macOS traffic lights in the native window\n\r                left_inset \"6\"\n\r            }\n\r        }\n\r        pane split_direction=\"vertical\" {\n\r            pane size=24 borderless=true {\n\r                plugin location=\"session-manager\" {\n\r                    session_canvas true\n\r                    session_canvas_kind \"session-manager\"\n\r                    rail true\n\r                    pane_title \"Sessions\"\n\r                }\n\r            }\n\r            pane { children; }\n\r        }\n\r        pane size=1 borderless=true {\n\r            plugin location=\"status-bar\" {\n\r                session_canvas true\n\r                session_canvas_kind \"status-bar\"\n\r            }\n\r        }\n\r    }\n\r\n\r    default_tab_template {\n\r        pane { children; }\n\r    }\n\r}\n\r",
 )
diff --git a/zellij-server/src/plugins/unit/snapshots/zellij_server__plugins__plugin_tests__override_layout_plugin_command.snap b/zellij-server/src/plugins/unit/snapshots/zellij_server__plugins__plugin_tests__override_layout_plugin_command.snap
index 111d9d91..d90598c3 100644
--- a/zellij-server/src/plugins/unit/snapshots/zellij_server__plugins__plugin_tests__override_layout_plugin_command.snap
+++ b/zellij-server/src/plugins/unit/snapshots/zellij_server__plugins__plugin_tests__override_layout_plugin_command.snap
@@ -52,7 +52,7 @@ Some(
                                             configuration: Some(
                                                 PluginUserConfiguration(
                                                     {
-                                                        "left_inset": "9",
+                                                        "left_inset": "6",
                                                     },
                                                 ),
                                             ),
diff --git a/zellij-utils/assets/plugins/session-manager.wasm b/zellij-utils/assets/plugins/session-manager.wasm
index d136672844bfcea2714972af36a45371b4e168bb..51f15b4ae9110800b5c1c4e9c02d3c56789a32c6 100755
GIT binary patch
delta 187
zcmY+ztqy`<6b4|vb3Q;kfIs-#n91fC#cDQt16q{m%*?49)#8jstBvLbxP7B}InKB8
zY|rVqd;YdBBlNwUD=8{bNM$8Ff75kcdLQ1<{jnq`Ib@->Qe~$STT{{#XR*q{NHKAp
tVu{@#@n=PD7&Y4Hpo<Oku!({`1{h)s+t|S_M%cqX4seL0GB@MP{tv$yLEr!Y

delta 367
zcmZw9uTH~I6vy%Qoc7+0+m6EcGu)+WvfF5a0&c=EC<IS114tB(GDzl-^Z_QYpz4Mv
zgCY=!B|HF*2O#_|1F?jYd~$McPQJHaNB!*h?n%*oep#wPsa&9<RJ=K&k6uxI<R0Y@
z`$FVf&s^CiPN(Cfu1uA7n&id89G=wb?0f#~u&=ZXJ3-5?wsF@f-<fdZz_`)pMV2|*
zZPF{p(qx#ky|8UR-Z&O^PuMt`G#QF+`u13MaUi0XYx{7bcUuTHY`XQ6-8JVkS^CQ+
zzghWjmbzi0<un^4gW;IL10MuPs6Z9wKtTW@)L<SWSb#;S!xAjR3amn-7>?JjPQL+&
Ca&XQ7

diff --git a/zellij-utils/src/client_server_contract/mod.rs b/zellij-utils/src/client_server_contract/mod.rs
index 6ae77975..21ec14a2 100644
--- a/zellij-utils/src/client_server_contract/mod.rs
+++ b/zellij-utils/src/client_server_contract/mod.rs
@@ -22,12 +22,25 @@ mod wire_contract_guard {
         "bafef87a5b86ae76f9ba26301ac4540f6d65d3a57bc3686a08980c3b2a47f076",
     );
 
+    fn normalized_source_bytes(source: &[u8]) -> Vec<u8> {
+        let mut normalized = Vec::with_capacity(source.len());
+        let mut bytes = source.iter().copied().peekable();
+        while let Some(byte) = bytes.next() {
+            if byte == b'\r' && bytes.peek() == Some(&b'\n') {
+                continue;
+            }
+            normalized.push(byte);
+        }
+        normalized
+    }
+
     #[test]
     fn wire_contract_changes_require_a_version_bump() {
-        let current = sha256_hex(include_bytes!(concat!(
+        let source = normalized_source_bytes(include_bytes!(concat!(
             env!("CARGO_MANIFEST_DIR"),
             "/assets/prost_ipc/client_server_contract.rs"
         )));
+        let current = sha256_hex(&source);
         assert_eq!(
             (CLIENT_SERVER_CONTRACT_VERSION, current.as_str()),
             PINNED_CONTRACT,
@@ -37,4 +50,12 @@ mod wire_contract_guard {
              commit — old servers cannot decode new message variants."
         );
     }
+
+    #[test]
+    fn wire_contract_hash_is_independent_of_checkout_line_endings() {
+        assert_eq!(
+            normalized_source_bytes(b"one\r\ntwo\r\nthree\n"),
+            b"one\ntwo\nthree\n"
+        );
+    }
 }
diff --git a/zellij-utils/src/consts.rs b/zellij-utils/src/consts.rs
index ebc8c7ac..050d8fc4 100644
--- a/zellij-utils/src/consts.rs
+++ b/zellij-utils/src/consts.rs
@@ -196,11 +196,23 @@ fn migrate_legacy_path(legacy_path: &Path, vc_frame_path: &Path) {
 }
 
 fn copy_path_if_target_absent(source: &Path, target: &Path) -> std::io::Result<()> {
-    if !source.exists() || target.exists() {
+    let source_metadata = match std::fs::symlink_metadata(source) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+        Err(error) => return Err(error),
+    };
+    if target.exists() {
         return Ok(());
     }
 
-    if source.is_dir() {
+    if source_metadata.file_type().is_symlink() {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("refusing to migrate symlink {}", source.display()),
+        ));
+    }
+
+    if source_metadata.is_dir() {
         copy_dir_recursively(source, target)
     } else {
         if let Some(parent) = target.parent() {
@@ -828,6 +840,24 @@ mod tests {
         );
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn copy_path_if_target_absent_refuses_symlinks() {
+        use std::os::unix::fs::symlink;
+
+        let tmp_dir = tempfile::tempdir().unwrap();
+        let outside = tmp_dir.path().join("outside");
+        let source = tmp_dir.path().join("source-link");
+        let target = tmp_dir.path().join("target");
+        std::fs::create_dir_all(&outside).unwrap();
+        std::fs::write(outside.join("secret.txt"), "do not copy").unwrap();
+        symlink(&outside, &source).unwrap();
+
+        let error = copy_path_if_target_absent(&source, &target).unwrap_err();
+        assert_eq!(error.kind(), std::io::ErrorKind::InvalidInput);
+        assert!(!target.exists());
+    }
+
     #[cfg(unix)]
     #[test]
     fn unix_tmp_dir_uses_vc_frame_namespace() {
diff --git a/zellij-utils/src/kdl/snapshots/zellij_utils__kdl__bare_config_from_default_assets_to_string.snap b/zellij-utils/src/kdl/snapshots/zellij_utils__kdl__bare_config_from_default_assets_to_string.snap
index cccffdff..f4eecd36 100644
--- a/zellij-utils/src/kdl/snapshots/zellij_utils__kdl__bare_config_from_default_assets_to_string.snap
+++ b/zellij-utils/src/kdl/snapshots/zellij_utils__kdl__bare_config_from_default_assets_to_string.snap
@@ -220,6 +220,12 @@ keybinds clear-defaults=true {
             }
         }
         bind "Super right" { GoToNextTab; }
+        bind "Super k" {
+            MessagePlugin "compact-bar" {
+                name "vc_quick_cmd"
+                floating false
+            }
+        }
     }
     shared_except "locked" {
         bind "Ctrl left" { GoToPreviousTab; }
diff --git a/zellij-utils/src/kdl/snapshots/zellij_utils__kdl__bare_config_from_default_assets_to_string_with_comments.snap b/zellij-utils/src/kdl/snapshots/zellij_utils__kdl__bare_config_from_default_assets_to_string_with_comments.snap
index cc90206a..ea9215e0 100644
--- a/zellij-utils/src/kdl/snapshots/zellij_utils__kdl__bare_config_from_default_assets_to_string_with_comments.snap
+++ b/zellij-utils/src/kdl/snapshots/zellij_utils__kdl__bare_config_from_default_assets_to_string_with_comments.snap
@@ -220,6 +220,12 @@ keybinds clear-defaults=true {
             }
         }
         bind "Super right" { GoToNextTab; }
+        bind "Super k" {
+            MessagePlugin "compact-bar" {
+                name "vc_quick_cmd"
+                floating false
+            }
+        }
     }
     shared_except "locked" {
         bind "Ctrl left" { GoToPreviousTab; }
diff --git a/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__default_config_with_no_cli_arguments.snap b/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__default_config_with_no_cli_arguments.snap
index 947c382d..aa92cf04 100644
--- a/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__default_config_with_no_cli_arguments.snap
+++ b/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__default_config_with_no_cli_arguments.snap
@@ -398,6 +398,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -675,6 +704,35 @@ Config {
                     input_mode: Normal,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
         },
         Resize: {
             KeyWithModifier {
@@ -1238,6 +1296,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -1918,6 +2005,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -2839,6 +2955,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -3554,6 +3699,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -4170,6 +4344,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -4809,6 +5012,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -5417,6 +5649,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -5970,6 +6231,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -6581,6 +6871,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -7381,6 +7700,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -7959,6 +8307,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -8681,6 +9058,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
diff --git a/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_env_vars_override_config_env_vars.snap b/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_env_vars_override_config_env_vars.snap
index c47dda98..566ddcf1 100644
--- a/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_env_vars_override_config_env_vars.snap
+++ b/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_env_vars_override_config_env_vars.snap
@@ -398,6 +398,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -675,6 +704,35 @@ Config {
                     input_mode: Normal,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
         },
         Resize: {
             KeyWithModifier {
@@ -1238,6 +1296,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -1918,6 +2005,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -2839,6 +2955,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -3554,6 +3699,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -4170,6 +4344,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -4809,6 +5012,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -5417,6 +5649,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -5970,6 +6231,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -6581,6 +6871,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -7381,6 +7700,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -7959,6 +8307,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -8681,6 +9058,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
diff --git a/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_themes_override_config_themes.snap b/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_themes_override_config_themes.snap
index 18fcb30e..d97cd80e 100644
--- a/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_themes_override_config_themes.snap
+++ b/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_themes_override_config_themes.snap
@@ -398,6 +398,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -675,6 +704,35 @@ Config {
                     input_mode: Normal,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
         },
         Resize: {
             KeyWithModifier {
@@ -1238,6 +1296,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -1918,6 +2005,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -2839,6 +2955,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -3554,6 +3699,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -4170,6 +4344,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -4809,6 +5012,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -5417,6 +5649,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -5970,6 +6231,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -6581,6 +6871,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -7381,6 +7700,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -7959,6 +8307,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -8681,6 +9058,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
diff --git a/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_ui_config_overrides_config_ui_config.snap b/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_ui_config_overrides_config_ui_config.snap
index 58dcc96a..733407ce 100644
--- a/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_ui_config_overrides_config_ui_config.snap
+++ b/zellij-utils/src/snapshots/zellij_utils__setup__setup_test__layout_ui_config_overrides_config_ui_config.snap
@@ -398,6 +398,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -675,6 +704,35 @@ Config {
                     input_mode: Normal,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
         },
         Resize: {
             KeyWithModifier {
@@ -1238,6 +1296,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -1918,6 +2005,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -2839,6 +2955,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -3554,6 +3699,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -4170,6 +4344,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -4809,6 +5012,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -5417,6 +5649,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -5970,6 +6231,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -6581,6 +6871,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -7381,6 +7700,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -7959,6 +8307,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',
@@ -8681,6 +9058,35 @@ Config {
                     direction: Up,
                 },
             ],
+            KeyWithModifier {
+                bare_key: Char(
+                    'k',
+                ),
+                key_modifiers: {
+                    Super,
+                },
+            }: [
+                KeybindPipe {
+                    name: Some(
+                        "vc_quick_cmd",
+                    ),
+                    payload: None,
+                    args: None,
+                    plugin: Some(
+                        "compact-bar",
+                    ),
+                    plugin_id: None,
+                    configuration: None,
+                    launch_new: false,
+                    skip_cache: false,
+                    floating: Some(
+                        false,
+                    ),
+                    in_place: None,
+                    cwd: None,
+                    pane_title: None,
+                },
+            ],
             KeyWithModifier {
                 bare_key: Char(
                     'l',

From 8522cb7d5ac097241925e17d617bd5b5cf5be4f5 Mon Sep 17 00:00:00 2001
From: div0-space <void@div0.space>
Date: Tue, 11 Aug 2026 23:18:06 +0200
Subject: [PATCH 09/12] [codex/headless] fix(assets): align session manager
 receipt

Update the canonical plugin SHA256 receipt for the deterministic session-manager WASM produced by the focused-rail change. This restores the asset-integrity contract on Windows and no-default-features CI jobs.

Authored-By: codex <agents@vetcoders.io>

session_id: 019ff225-49ff-72b0-9078-139cdc37ff61

time: 2026-08-11T23:18:06:z

runtime: headless
---
 zellij-utils/assets/plugins/SHA256SUMS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zellij-utils/assets/plugins/SHA256SUMS b/zellij-utils/assets/plugins/SHA256SUMS
index 1d923ce1..ee04ef48 100644
--- a/zellij-utils/assets/plugins/SHA256SUMS
+++ b/zellij-utils/assets/plugins/SHA256SUMS
@@ -6,7 +6,7 @@ e85317f3bbf566fe69dc796179003944178497537fb9fee3f61a3bf622235e00  layout-manager
 726e3833656301235729db179884bf71a983993b6d7ed05bbd26c89d0ba9fc31  link.wasm
 797089ea4dcba8f54bbc1fe70c36de4ce14c5bb56aa906c1c840facc18a7f644  multiple-select.wasm
 c1f637d73aad5a44eba5b0c3b891efa4e79c63bc09af0bc4eab8d5a20cad455f  plugin-manager.wasm
-818d9c6d26d4af9e69b17b77c2697b0d427eb6eabb3afe8e0488d28026b4b309  session-manager.wasm
+9752aa6885103fb9e28836d63dc1a7f2e0fb26183ed30aeb786e70b0dbabee4e  session-manager.wasm
 6edf6dd4d079bb747d8cf19b7b7f99ee62245d1471b2955b9d870fccb1c1b9eb  share.wasm
 61b7bbdf2bf623534fd48976ed057a0bd60dbf6bda6713050287780d9594b392  status-bar.wasm
 980d55d5cd679ddea39e24a6869d810ee40a22111ad3fa830b2d3ece837619af  strider.wasm

From 8e32cc2fc6ea50c12ef1ba051ff66477d707188b Mon Sep 17 00:00:00 2001
From: div0-space <void@div0.space>
Date: Tue, 11 Aug 2026 23:29:26 +0200
Subject: [PATCH 10/12] [codex/headless] test(windows): serialize panic-hook
 probes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Serialize the three intentional-panic pinned-executor tests. Windows backtrace symbolization writes through the global panic hook slowly enough that concurrent probes consumed one another’s five-second receipt deadlines even though the executor caught the panics and remained healthy.

Authored-By: codex <agents@vetcoders.io>

session_id: 019ff225-49ff-72b0-9078-139cdc37ff61

time: 2026-08-11T23:29:26:z

runtime: headless
---
 zellij-server/src/plugins/pinned_executor.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/zellij-server/src/plugins/pinned_executor.rs b/zellij-server/src/plugins/pinned_executor.rs
index 03c15908..4255b2be 100644
--- a/zellij-server/src/plugins/pinned_executor.rs
+++ b/zellij-server/src/plugins/pinned_executor.rs
@@ -592,6 +592,11 @@ mod tests {
     use std::thread;
     use std::time::Duration;
 
+    // The panic hook writes and symbolizes a backtrace before `catch_unwind`
+    // can invoke the executor callback. Windows serializes that output slowly,
+    // so concurrent intentional-panic tests can consume each other's timeout.
+    static PANIC_TEST_LOCK: Mutex<()> = Mutex::new(());
+
     type TestDependencies = (
         ThreadSenders,
         Arc<Mutex<PluginMap>>,
@@ -988,6 +993,7 @@ mod tests {
 
     #[test]
     fn panicking_job_releases_busy_count_and_worker_accepts_next_job() {
+        let _panic_test_guard = PANIC_TEST_LOCK.lock().unwrap();
         let executor = create_test_executor(1);
         let (panic_tx, panic_rx) = channel();
         executor
@@ -1055,6 +1061,7 @@ mod tests {
 
     #[test]
     fn panicking_fire_and_forget_unload_retains_executor_assignment_for_retry() {
+        let _panic_test_guard = PANIC_TEST_LOCK.lock().unwrap();
         let executor = create_test_executor(1);
         executor.register_plugin(43);
 
@@ -1096,6 +1103,7 @@ mod tests {
 
     #[test]
     fn completion_aware_unload_panic_retains_assignment_for_retry() {
+        let _panic_test_guard = PANIC_TEST_LOCK.lock().unwrap();
         let executor = create_test_executor(1);
         executor.register_plugin(44);
 

From 6475d870edd7398d0a3fccfa4239430380ebc52b Mon Sep 17 00:00:00 2001
From: div0-space <void@div0.space>
Date: Tue, 11 Aug 2026 23:57:52 +0200
Subject: [PATCH 11/12] [codex/headless] test(e2e): require rendered top bar

Make mirrored-session snapshot readiness prove that the Vibecrafted brand is rendered in the first terminal row. The prior anywhere-in-frame predicate could match guide content while the top bar was still a transient blank frame.

Authored-By: codex <agents@vetcoders.io>

session_id: 019ff225-49ff-72b0-9078-139cdc37ff61

time: 2026-08-11T23:57:52:z

runtime: headless
---
 src/tests/e2e/cases.rs         | 4 ++--
 src/tests/e2e/remote_runner.rs | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/tests/e2e/cases.rs b/src/tests/e2e/cases.rs
index 08dd497d..5159f0e3 100644
--- a/src/tests/e2e/cases.rs
+++ b/src/tests/e2e/cases.rs
@@ -1685,7 +1685,7 @@ pub fn mirrored_sessions() {
                 let mut step_is_complete = false;
                 if remote_terminal.cursor_position_is(63, 2)
                     && remote_terminal.snapshot_contains("┐┌")
-                    && remote_terminal.snapshot_contains("𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.")
+                    && remote_terminal.top_bar_appears()
                 {
                     // cursor is back in the first tab
                     step_is_complete = true;
@@ -1699,7 +1699,7 @@ pub fn mirrored_sessions() {
                 let mut step_is_complete = false;
                 if remote_terminal.cursor_position_is(63, 2)
                     && remote_terminal.snapshot_contains("┐┌")
-                    && remote_terminal.snapshot_contains("𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍.")
+                    && remote_terminal.top_bar_appears()
                 {
                     // cursor is back in the first tab
                     step_is_complete = true;
diff --git a/src/tests/e2e/remote_runner.rs b/src/tests/e2e/remote_runner.rs
index 325ba33d..075ddcc7 100644
--- a/src/tests/e2e/remote_runner.rs
+++ b/src/tests/e2e/remote_runner.rs
@@ -508,6 +508,12 @@ impl RemoteTerminal {
         let snap = self.last_snapshot.lock().unwrap();
         snap.contains("LOCK") && snap.contains("PANE") && snap.contains("SESSION")
     }
+    pub fn top_bar_appears(&self) -> bool {
+        let snap = self.last_snapshot.lock().unwrap();
+        snap.lines()
+            .next()
+            .is_some_and(|line| line.contains("𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍."))
+    }
     pub fn ctrl_plus_appears(&self) -> bool {
         let snap = self.last_snapshot.lock().unwrap().clone();
         // Dense chips may drop the superkey prefix; treat mode chrome as enough.

From d709096866c89169f7a89598d0348f0c200aafd6 Mon Sep 17 00:00:00 2001
From: div0-space <void@div0.space>
Date: Wed, 12 Aug 2026 00:09:56 +0200
Subject: [PATCH 12/12] [codex/headless] fix(e2e): keep fixture servers in
 owned tree

Add an explicit foreground-server runtime contract for isolated supervisors and enable it in the triage runtime fixture. This prevents Unix double-fork reparenting from breaking the harness process-ownership proof while preserving normal daemon behavior outside the fixture.

Authored-By: codex <agents@vetcoders.io>
session_id: 019ff225-49ff-72b0-9078-139cdc37ff61
time: 2026-08-12T00:09:45+02:00
runtime: headless
---
 scripts/triage-runtime-e2e.py    | 161 +++++++++++++++++++++++++++++--
 tools/triage_runtime_e2e_test.py | 102 ++++++++++++++++++++
 zellij-client/src/lib.rs         |  13 ++-
 zellij-server/src/lib.rs         |  12 ++-
 zellij-utils/src/envs.rs         |   5 +
 5 files changed, 279 insertions(+), 14 deletions(-)

diff --git a/scripts/triage-runtime-e2e.py b/scripts/triage-runtime-e2e.py
index 02d013ff..b0087420 100755
--- a/scripts/triage-runtime-e2e.py
+++ b/scripts/triage-runtime-e2e.py
@@ -746,6 +746,11 @@ def isolated_env(
             # Set both spellings so even a compatibility path cannot fall back
             # to an inherited operator socket.
             "VC_FRAME_SOCKET_DIR": str(socket_root),
+            # Keep fixture servers as real descendants of the interrupted
+            # triage process. The fail-closed cleanup can then pin every exact
+            # PID through its stopped parent instead of trusting reparented
+            # daemon PIDs.
+            "VC_FRAME_SERVER_FOREGROUND": "1",
             "ZELLIJ_SOCKET_DIR": str(socket_root),
             "VIBECRAFTED_CONTROL_PLANE": str(control_plane),
         }
@@ -878,6 +883,10 @@ def namespace_preflight(
             socket_root == namespace_root / "sockets",
             f"{key} escaped the fixture namespace: {socket_root}",
         )
+    require(
+        env.get("VC_FRAME_SERVER_FOREGROUND") == "1",
+        "isolated runtime must keep server processes in the owned tree",
+    )
     for key in ISOLATION_PATH_KEYS:
         resolved = pathlib.Path(env[key]).resolve()
         require(
@@ -1820,6 +1829,45 @@ def validate_owned_process_group_leader(
         )
 
 
+def is_isolated_foreground_server_member(
+    process: subprocess.Popen[bytes],
+    member: dict[str, object],
+    leader: dict[str, object] | None,
+) -> bool:
+    """Prove a reparented fixture server still belongs to the fresh session."""
+    if (
+        getattr(process, "vc_frame_server_foreground", None) != "1"
+        or int(member.get("ppid", -1)) != 1
+        or leader is None
+    ):
+        return False
+    socket_root_value = getattr(process, "vc_frame_socket_root", None)
+    owned_binary = getattr(process, "vc_frame_owned_binary", None)
+    if not isinstance(socket_root_value, str) or not isinstance(owned_binary, str):
+        return False
+    try:
+        member_args = shlex.split(str(member.get("command", "")))
+        leader_args = shlex.split(str(leader.get("command", "")))
+    except ValueError:
+        return False
+    if (
+        not member_args
+        or not leader_args
+        or member_args[0] != leader_args[0]
+        or pathlib.Path(member_args[0]).resolve() != pathlib.Path(owned_binary).resolve()
+    ):
+        return False
+    server_paths = server_argument_paths(str(member.get("command", "")))
+    if len(server_paths) != 1:
+        return False
+    try:
+        server_path = server_paths[0].resolve()
+        socket_root = pathlib.Path(socket_root_value).resolve()
+    except OSError:
+        return False
+    return server_path.is_relative_to(socket_root)
+
+
 def annotate_owned_process_group_depths(
     process: subprocess.Popen[bytes],
     members: list[dict[str, object]],
@@ -1835,6 +1883,13 @@ def annotate_owned_process_group_depths(
         by_pid[pid] = member
 
     invalid: list[dict[str, object]] = []
+    leader = by_pid.get(process.pid)
+    detached_roots = {
+        int(member["pid"])
+        for member in annotated
+        if int(member.get("pid", -1)) != process.pid
+        and is_isolated_foreground_server_member(process, member, leader)
+    }
     for member in annotated:
         pid = int(member.get("pid", -1))
         if pid in duplicate_pids:
@@ -1846,13 +1901,24 @@ def annotate_owned_process_group_depths(
             member["depth"] = 0
             member["ancestry"] = [process.pid]
             continue
+        if pid in detached_roots:
+            member["depth"] = 1
+            member["ancestry"] = [pid, 1]
+            member["detached_owned"] = True
+            member["ownership_proof"] = "isolated_foreground_server"
+            continue
 
         ancestry = [pid]
         visited: set[int] = set()
         cursor = pid
         depth: int | None = None
         topology_error: str | None = None
+        detached_ancestor: int | None = None
         while cursor != process.pid:
+            if cursor in detached_roots:
+                detached_ancestor = cursor
+                depth = len(ancestry)
+                break
             if cursor in visited:
                 topology_error = f"cycle through pid {cursor}"
                 break
@@ -1880,6 +1946,11 @@ def annotate_owned_process_group_depths(
 
         member["depth"] = depth
         member["ancestry"] = ancestry
+        if detached_ancestor is not None:
+            member["detached_owned_subtree"] = True
+            member["ownership_proof"] = (
+                f"descendant_of_isolated_foreground_server:{detached_ancestor}"
+            )
         if topology_error is not None:
             member["topology_error"] = topology_error
             if "Z" not in str(member.get("state", "")):
@@ -1903,7 +1974,6 @@ def validated_owned_process_group_members(
         members, topology_invalid = annotate_owned_process_group_depths(
             process, members
         )
-        observations.append(members)
         leader = next(
             (member for member in members if int(member["pid"]) == process.pid),
             None,
@@ -1930,6 +2000,38 @@ def validated_owned_process_group_members(
             is not None
             and "Z" in str(parent.get("state", ""))
         ]
+        detached_foreign_uid_members = [
+            member
+            for member in members
+            if member.get("detached_owned_subtree") is True
+            and int(member.get("uid", -1)) != expected_uid
+            and "Z" not in str(member.get("state", ""))
+        ]
+        unsignalable_pids = {
+            int(member["pid"]) for member in detached_foreign_uid_members
+        }
+        for member in members:
+            ancestry = member.get("ancestry")
+            if member.get("detached_owned_subtree") is True and isinstance(
+                ancestry, list
+            ):
+                if any(
+                    isinstance(pid, int) and pid in unsignalable_pids
+                    for pid in ancestry
+                ):
+                    member["unsignalable_owned_descendant"] = True
+                    member["ownership_proof"] = (
+                        f"{member.get('ownership_proof')}+foreign_uid_evidence_only"
+                    )
+        sid_ambiguous_members = [
+            member
+            for member in sid_ambiguous_members
+            if member.get("unsignalable_owned_descendant") is not True
+        ]
+        sid_ambiguous_pids = {
+            int(member["pid"]) for member in sid_ambiguous_members
+        }
+        observations.append(members)
         ambiguous_members = list(
             {
                 int(member["pid"]): member
@@ -1938,13 +2040,17 @@ def validated_owned_process_group_members(
                     *unstable_parent_members,
                     *topology_invalid,
                 ]
+                if member.get("unsignalable_owned_descendant") is not True
             }.values()
         )
         invalid_members = [
             member
             for member in members
             if int(member.get("pgid", -1)) != process.pid
-            or int(member.get("uid", -1)) != expected_uid
+            or (
+                int(member.get("uid", -1)) != expected_uid
+                and member.get("detached_owned_subtree") is not True
+            )
             or (
                 member.get("sid") != process.pid
                 and int(member.get("pid", -1)) not in sid_ambiguous_pids
@@ -2098,6 +2204,7 @@ def wait_for_owned_member_quiescence(
     deadline: float,
     expected_stopped_parent: int | None,
     terminal: bool,
+    allow_disappearance: bool = False,
 ) -> None:
     """Observe a signalled PID only while its immediate parent stays stopped."""
     last_members: list[dict[str, object]] = []
@@ -2112,6 +2219,8 @@ def wait_for_owned_member_quiescence(
             None,
         )
         if member is None:
+            if allow_disappearance:
+                return
             parent = (
                 next(
                     (
@@ -2213,6 +2322,7 @@ def stop_owned_process_group(
             for member in last_members
             if "T" not in str(member.get("state", ""))
             and "Z" not in str(member.get("state", ""))
+            and member.get("unsignalable_owned_descendant") is not True
         ]
         if not running:
             signature = tuple(
@@ -2223,6 +2333,7 @@ def stop_owned_process_group(
                     member.get("depth"),
                 )
                 for member in last_members
+                if member.get("unsignalable_owned_descendant") is not True
             )
             if signature == quiesced_signature:
                 return last_members
@@ -2238,6 +2349,7 @@ def stop_owned_process_group(
             member
             for member in running
             if int(member["pid"]) == process.pid
+            or member.get("detached_owned") is True
             or (
                 (parent := members_by_pid.get(int(member.get("ppid", -1))))
                 is not None
@@ -2288,7 +2400,8 @@ def stop_owned_process_group(
             )
             continue
 
-        expected_parent = int(target["ppid"])
+        detached_owned = target.get("detached_owned") is True
+        expected_parent = None if detached_owned else int(target["ppid"])
         signalled = signal_exact_owned_group_member(
             process,
             target_pid,
@@ -2308,6 +2421,7 @@ def stop_owned_process_group(
             deadline=deadline,
             expected_stopped_parent=expected_parent,
             terminal=False,
+            allow_disappearance=detached_owned,
         )
         time.sleep(0.001)
     raise OwnedProcessGroupRefusal(
@@ -2328,6 +2442,7 @@ def continue_owned_process_group(
         for member in members
         if "Z" not in str(member.get("state", ""))
         and "T" not in str(member.get("state", ""))
+        and member.get("unsignalable_owned_descendant") is not True
     ]
     if unstopped:
         raise OwnedProcessGroupRefusal(
@@ -2335,7 +2450,10 @@ def continue_owned_process_group(
             f"unstopped={unstopped!r}, members={members!r}"
         )
     targets = [
-        member for member in members if "Z" not in str(member.get("state", ""))
+        member
+        for member in members
+        if "Z" not in str(member.get("state", ""))
+        and member.get("unsignalable_owned_descendant") is not True
     ]
     targets.sort(
         key=lambda member: (
@@ -2377,7 +2495,11 @@ def continue_owned_process_group(
             signal.SIGCONT,
             deadline=deadline,
             require_stopped=True,
-            expected_stopped_parent=int(member["ppid"]),
+            expected_stopped_parent=(
+                None
+                if member.get("detached_owned") is True
+                else int(member["ppid"])
+            ),
         )
 
 
@@ -2395,16 +2517,18 @@ def kill_owned_process_group(
         member
         for member in stopped_members
         if "Z" not in str(member.get("state", ""))
+        and member.get("unsignalable_owned_descendant") is not True
     ]
     targets.sort(
         key=lambda member: (
             -int(member.get("depth", -1)),
+            member.get("detached_owned") is True,
             int(member["pid"]),
         )
     )
     target_pids = {int(member["pid"]) for member in targets}
     addressed: set[int] = set()
-    for member in targets:
+    for target_index, member in enumerate(targets):
         member_pid = int(member["pid"])
         if member_pid in addressed:
             raise OwnedProcessGroupRefusal(
@@ -2416,6 +2540,7 @@ def kill_owned_process_group(
             current
             for current in current_members
             if "Z" not in str(current.get("state", ""))
+            and current.get("unsignalable_owned_descendant") is not True
             and int(current["pid"]) not in target_pids
         ]
         if unexpected_live:
@@ -2444,7 +2569,8 @@ def kill_owned_process_group(
                 )
             process.kill()
             return
-        expected_parent = int(member["ppid"])
+        detached_owned = member.get("detached_owned") is True
+        expected_parent = None if detached_owned else int(member["ppid"])
         signalled = signal_exact_owned_group_member(
             process,
             member_pid,
@@ -2455,12 +2581,26 @@ def kill_owned_process_group(
         )
         if not signalled:
             continue
+        remaining_nonleaders = [
+            candidate
+            for candidate in targets[target_index + 1 :]
+            if int(candidate["pid"]) != process.pid
+        ]
+        if member.get("detached_owned") is True and not remaining_nonleaders:
+            # Killing this last detached root intentionally dissolves the
+            # ancestry proof for its unsignalable evidence-only descendants.
+            # The exact unreaped Popen leader is still pinned, so terminate it
+            # now and let the mandatory stable-empty group proof decide whether
+            # any server residue survived.
+            process.kill()
+            return
         wait_for_owned_member_quiescence(
             process,
             member_pid,
             deadline=deadline,
             expected_stopped_parent=expected_parent,
             terminal=True,
+            allow_disappearance=detached_owned,
         )
     raise OwnedProcessGroupRefusal(
         f"owned process group {process.pid} lost its leader before exact KILL"
@@ -2760,6 +2900,13 @@ def interrupt_process_at_state(
             stderr=stderr,
             start_new_session=True,
         )
+        process.vc_frame_server_foreground = env.get(  # type: ignore[attr-defined]
+            "VC_FRAME_SERVER_FOREGROUND"
+        )
+        process.vc_frame_socket_root = env.get(  # type: ignore[attr-defined]
+            "VC_FRAME_SOCKET_DIR"
+        )
+        process.vc_frame_owned_binary = str(binary.resolve())  # type: ignore[attr-defined]
         try:
             wait_for_process_stop(process)
             for slices in range(1, max_slices + 1):
diff --git a/tools/triage_runtime_e2e_test.py b/tools/triage_runtime_e2e_test.py
index f328736b..9420adfd 100755
--- a/tools/triage_runtime_e2e_test.py
+++ b/tools/triage_runtime_e2e_test.py
@@ -40,6 +40,13 @@ def completed(
 
 
 class ProvenanceTests(unittest.TestCase):
+    def test_isolated_env_keeps_server_inside_owned_process_tree(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            root = pathlib.Path(temporary)
+            env = MODULE.isolated_env(root / "namespace", root / "control-plane")
+
+        self.assertEqual(env["VC_FRAME_SERVER_FOREGROUND"], "1")
+
     def test_makefile_preserves_ci_artifact_root_and_explicit_override(self) -> None:
         repo_root = MODULE_PATH.parents[1]
         makefile = repo_root / "Makefile"
@@ -1342,6 +1349,101 @@ def test_group_topology_rejects_disconnected_and_cycle_live_without_signal(
             exact_kill.assert_not_called()
             process.send_signal.assert_not_called()
 
+    def test_group_topology_accepts_only_exact_isolated_foreground_server(
+        self,
+    ) -> None:
+        process = mock.Mock()
+        process.pid = 9_731
+        process.poll.return_value = None
+        process.vc_frame_server_foreground = "1"
+        process.vc_frame_socket_root = "/tmp/proof/sockets"
+        process.vc_frame_owned_binary = "/bin/vc-frame"
+        leader = {
+            "pid": process.pid,
+            "ppid": 1,
+            "pgid": process.pid,
+            "uid": 501,
+            "sid": process.pid,
+            "sid_errno": None,
+            "sid_error": None,
+            "state": "T",
+            "command": "/bin/vc-frame triage-run --run proof",
+        }
+        detached = {
+            "pid": 9_732,
+            "ppid": 1,
+            "pgid": process.pid,
+            "uid": 501,
+            "sid": process.pid,
+            "sid_errno": None,
+            "sid_error": None,
+            "state": "T",
+            "command": (
+                "/bin/vc-frame --server "
+                "'/tmp/proof/sockets/contract_version_2/Needs attention'"
+            ),
+        }
+        detached_child = {
+            "pid": 9_733,
+            "ppid": 9_732,
+            "pgid": process.pid,
+            "uid": 501,
+            "sid": process.pid,
+            "sid_errno": None,
+            "sid_error": None,
+            "state": "T",
+            "command": "/bin/sh -c fixture-child",
+        }
+        unsignalable_child = {
+            **detached_child,
+            "pid": 9_734,
+            "uid": 0,
+            "command": "ps -ao ppid,args",
+        }
+        with mock.patch.object(
+            MODULE.os, "getpgid", return_value=process.pid
+        ), mock.patch.object(
+            MODULE.os, "getsid", return_value=process.pid
+        ), mock.patch.object(
+            MODULE.os, "geteuid", return_value=501
+        ), mock.patch.object(
+            MODULE,
+            "process_group_members",
+            return_value=[leader, detached, detached_child, unsignalable_child],
+        ):
+            validated = MODULE.validated_owned_process_group_members(process)
+
+        proven = next(member for member in validated if member["pid"] == 9_732)
+        self.assertTrue(proven["detached_owned"])
+        self.assertEqual(proven["ownership_proof"], "isolated_foreground_server")
+        self.assertNotIn("topology_error", proven)
+        child = next(member for member in validated if member["pid"] == 9_733)
+        self.assertTrue(child["detached_owned_subtree"])
+        self.assertEqual(child["depth"], 2)
+        unsignalable = next(
+            member for member in validated if member["pid"] == 9_734
+        )
+        self.assertTrue(unsignalable["unsignalable_owned_descendant"])
+
+        outside = {
+            **detached,
+            "command": "/bin/vc-frame --server /tmp/proof/sockets-neighbor/session",
+        }
+        with mock.patch.object(
+            MODULE.os, "getpgid", return_value=process.pid
+        ), mock.patch.object(
+            MODULE.os, "getsid", return_value=process.pid
+        ), mock.patch.object(
+            MODULE.os, "geteuid", return_value=501
+        ), mock.patch.object(
+            MODULE, "process_group_members", return_value=[leader, outside]
+        ), mock.patch.object(MODULE.time, "sleep"):
+            with self.assertRaisesRegex(
+                MODULE.OwnedProcessGroupRefusal,
+                r"persistently ambiguous process group 9731",
+            ):
+                MODULE.validated_owned_process_group_members(process)
+
     def test_transient_disconnected_live_member_disappears_without_signal(
         self,
     ) -> None:
diff --git a/zellij-client/src/lib.rs b/zellij-client/src/lib.rs
index dbde51a8..287a483d 100644
--- a/zellij-client/src/lib.rs
+++ b/zellij-client/src/lib.rs
@@ -356,8 +356,10 @@ fn check_ipc_pipe_length(ipc_pipe: &Path) {
 
 /// Spawn the Zellij server process.
 ///
-/// On Unix the server daemonizes (double-fork) inside start_server(), so
-/// the intermediate child exits immediately and `cmd.status()` returns.
+/// On Unix the server normally daemonizes (double-fork) inside start_server(),
+/// so the intermediate child exits immediately and `cmd.status()` returns.
+/// Isolated supervisors can request a directly-owned foreground server; in
+/// that mode the child handle is deliberately detached without waiting.
 #[cfg(not(windows))]
 pub fn spawn_server(socket_path: &Path, debug: bool) -> io::Result<()> {
     let mut cmd = Command::new(current_exe()?);
@@ -365,6 +367,13 @@ pub fn spawn_server(socket_path: &Path, debug: bool) -> io::Result<()> {
     if debug {
         cmd.arg("--debug");
     }
+    if zellij_utils::envs::server_foreground_requested() {
+        cmd.stdin(std::process::Stdio::null())
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null());
+        cmd.spawn()?;
+        return Ok(());
+    }
     let status = cmd.status()?;
     if status.success() {
         Ok(())
diff --git a/zellij-server/src/lib.rs b/zellij-server/src/lib.rs
index 48ab5391..bb03e473 100644
--- a/zellij-server/src/lib.rs
+++ b/zellij-server/src/lib.rs
@@ -760,11 +760,13 @@ pub fn start_server(mut os_input: Box<dyn ServerOsApi>, socket_path: PathBuf) {
         // preserve the current umask: read current value by setting to another mode, and then restoring it
         let current_umask = umask(Mode::all());
         umask(current_umask);
-        daemonize::Daemonize::new()
-            .working_directory(std::env::current_dir().unwrap())
-            .umask(current_umask.bits() as u32)
-            .start()
-            .expect("could not daemonize the server process");
+        if !zellij_utils::envs::server_foreground_requested() {
+            daemonize::Daemonize::new()
+                .working_directory(std::env::current_dir().unwrap())
+                .umask(current_umask.bits() as u32)
+                .start()
+                .expect("could not daemonize the server process");
+        }
     }
 
     #[cfg(windows)]
diff --git a/zellij-utils/src/envs.rs b/zellij-utils/src/envs.rs
index d782017d..edf02647 100644
--- a/zellij-utils/src/envs.rs
+++ b/zellij-utils/src/envs.rs
@@ -32,10 +32,15 @@ pub fn set_session_name(v: String) {
 
 pub const SOCKET_DIR_ENV_KEY: &str = "ZELLIJ_SOCKET_DIR";
 pub const VC_FRAME_SOCKET_DIR_ENV_KEY: &str = "VC_FRAME_SOCKET_DIR";
+pub const VC_FRAME_SERVER_FOREGROUND_ENV_KEY: &str = "VC_FRAME_SERVER_FOREGROUND";
 pub fn get_socket_dir() -> Result<String> {
     aliased_var(VC_FRAME_SOCKET_DIR_ENV_KEY, SOCKET_DIR_ENV_KEY)
 }
 
+pub fn server_foreground_requested() -> bool {
+    std::env::var(VC_FRAME_SERVER_FOREGROUND_ENV_KEY).as_deref() == Ok("1")
+}
+
 pub const PANE_ID_ENV_KEY: &str = "ZELLIJ_PANE_ID";
 pub const VC_FRAME_PANE_ID_ENV_KEY: &str = "VC_FRAME_PANE_ID";
 pub fn get_pane_id() -> Result<String> {