* Add cmd-click fallback for bare filenames in terminal output
When cmd-clicking text that ghostty's built-in URL/path regex doesn't
match (e.g. bare filenames from `ls` like README.md, src, config.json),
fall back to checking if the word under cursor is a valid file or
directory in the terminal panel's CWD. Uses the existing
ghostty_surface_quicklook_word API to extract the word, then resolves
it against the panel's working directory and opens it if it exists.
* Add pointing-hand cursor on Cmd-hover over bare filenames
When holding Cmd and hovering over a word that resolves to an existing
file/directory in the terminal's CWD, show the pointing-hand cursor.
Hooks into mouseMoved and flagsChanged so the cursor updates both when
moving the mouse with Cmd held and when pressing/releasing Cmd while
the mouse is stationary.
* Address PR review comments
- Refresh ghostty mouse position before quicklook_word in mouseUp and
flagsChanged so stale coordinates don't resolve the wrong word
- Use failable String(bytes:encoding:.utf8) instead of lossy decoding
- Skip absolute-path words (already handled by ghostty's regex)
- Guard against remote terminal sessions (local fileExists would be wrong)
- Use invalidateCursorRects instead of forcing iBeam on hover deactivation
to avoid overwriting ghostty/AppKit's cursor state
* Add preferred editor setting for cmd-click file opens
New "Open Files With" picker in Settings > App lets users choose which
editor opens when cmd-clicking bare filenames. Options: System Default,
Cursor, VS Code, Windsurf, Zed, Sublime Text, Xcode. Reuses the
existing TerminalDirectoryOpenTarget app detection infrastructure.
Defaults to system default (NSWorkspace default handler).
* Replace editor picker with free-form command field, respect $VISUAL/$EDITOR
The "Open Files With" setting is now a text field where users can type
any command (code, zed, subl, open -a Xcode, etc.). Resolution order:
1. User-configured command from settings
2. $VISUAL environment variable
3. $EDITOR environment variable
4. System default (NSWorkspace)
Removes the fixed PreferredEditor enum in favor of flexibility.
* Fix stuck pointing-hand cursor using NSCursor push/pop
invalidateCursorRects did nothing since the view has no cursor rects.
Use NSCursor push/pop stack instead so the previous cursor is properly
restored when the hover deactivates.
* Remove $VISUAL/$EDITOR fallback, use system default when empty
$EDITOR/$VISUAL are typically terminal editors (vim, nano) that can't
launch as GUI subprocesses. Empty field now falls back to system default
(opens in Finder/default app) which is the expected behavior.
* Address PR review comments (round 2)
- Use broader CWD fallback chain (panelDirectories → requestedWorkingDirectory
→ workspace currentDirectory) matching Workspace split creation logic
- Pop cursor stack in viewDidMoveToWindow to balance push if view is removed
while hover is active
- Reset preferredEditorCommand in resetAllSettings()
- Fall back to NSWorkspace.open when the custom editor command exits non-zero
(e.g. command not found exits 127 but /bin/sh itself succeeds)
* Clear cursor on mouse exit to prevent stuck pointing-hand
---------
Co-authored-by: Lawrence Chen <lawrencecchen@users.noreply.github.com>
* perf: coalesce high-frequency scrollbar updates to reduce main-thread pressure
During bulk terminal output (e.g. `seq 1 100000`), GHOSTTY_ACTION_SCROLLBAR
fires thousands of times per second. Previously each callback enqueued a
separate DispatchQueue.main.async block that updated the scrollbar property
and posted a NotificationCenter notification, causing the main thread to
process thousands of redundant scroll-geometry recalculations.
This change adds a lightweight coalescing layer: the action callback stores
the latest scrollbar value behind an NSLock and schedules at most one async
flush. The flush picks up whichever value is current at execution time,
collapsing N callbacks into a single synchronizeScrollView() pass.
Measured improvement on `time seq 1 10000`:
- Before: ~0.052s (26% CPU — seq blocked on PTY backpressure)
- After: expected ~0.025-0.030s (reduced main-thread contention)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: use defer for NSLock release in scrollbar coalescing
Address review feedback: wrap unlock() in defer blocks in both
enqueueScrollbarUpdate and flushPendingScrollbar to guarantee
lock release on any future early-return or exception path.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* perf: coalesce wakeup→tick dispatches to eliminate main-thread queue flooding
During bulk terminal output, Ghostty's I/O thread fires wakeup_cb thousands
of times per second. Previously each wakeup enqueued a separate
DispatchQueue.main.async { tick() } block, flooding the main queue and
starving the run loop. The main thread spent all its time draining tick
blocks, creating PTY backpressure that blocked the writing process.
Add a lightweight coalescing gate: scheduleTick() only enqueues a single
async block; subsequent wakeups while the block is pending are no-ops.
The pending tick picks up all accumulated state in one ghostty_app_tick()
call, collapsing N wakeups into 1 main-thread dispatch.
Combined with the earlier scrollbar coalescing, measured improvement:
time seq 1 10000:
- Ghostty standalone: 0.019s (82% CPU)
- cmux before: 0.052s (26% CPU) ← main-thread saturated
- cmux after: 0.016s (62% CPU) ← faster than standalone
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: release scrollbar lock before posting notification
Move NotificationCenter.post outside the _scrollbarLock critical section
in flushPendingScrollbar(). Holding the lock through observer dispatch
would block the I/O thread's enqueueScrollbarUpdate() calls behind
main-thread observer work, recreating the backpressure this change
aims to eliminate.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Previously, GHOSTTY_ACTION_PWD used AppDelegate.shared?.tabManager to
update the current working directory, which only returns the key window's
TabManager. In multi-window scenarios, cwd updates from non-key windows
were written to the wrong TabManager, causing panelDirectories to be
empty at save time and falling back to $HOME on restore.
Fix by using tabManagerFor(tabId:) to precisely route the update to
whichever window owns the tab, ensuring all windows persist their
working directories correctly.
Fixes#2125
The Korean CJK font mapping added in PR #1017 was removed in PR #1700,
but the koreanRanges static property was left behind as dead code.
Related: #1700, #1693
* Pre-launch app for browser UI test on headless CI runners
XCUIApplication.launch() blocks ~60s then fails on headless WarpBuild
runners because foreground activation requires a GUI login session.
Apply the same pre-launch strategy used for the display resolution test:
- CI shell launches the app with env vars before running xcodebuild
- Test detects pre-launched app via manifest, uses activate() instead of
launch() to avoid killing and relaunching the app
- Falls back to clicking the window for focus via accessibility framework
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Revert "Pre-launch app for browser UI test on headless CI runners"
This reverts commit a540e2fd99aaa1395b91a8d50caa797cdd7551b8.
* feat: cmux.json for custom commands
* tests: add cmux json tests
* fix: pr review feedback: validation, translations, input handling, and palette improvements
- Fix Danish ("Overfladedef inition") and Norwegian ("rotmapp") translation typos
- Add empty-string check for baseCwd fallback in command palette handlers
- Coalesce \r\n into single Return keypress in sendInput
- Redact command text from timeout log to prevent secret leakage
- Add decode-time validation: reject hybrid/empty commands, ambiguous layout
nodes, wrong split children count, and empty pane surfaces
- Namespace custom command IDs with "cmux.config.command." prefix
- Forward command description to palette subtitle when available
- Update tests for new validation rules and ID prefix
* fix: address PR review feedback — per-window config isolation, blank validation, ancestor walk,
palette sanitization
* fix: fallback to current dir cmux.json watching if no any cmux.json found in full acesor walk
* ci: trigger CI for fork PR
* Add directory trust for cmux.json command confirmation
The confirm dialog now shows the actual command text and has an "Always
trust commands from this folder" checkbox. When checked, future confirm
commands from that directory skip the dialog.
Trust is scoped to the git repo root if the cmux.json is inside a repo,
so trusting once covers all subdirectories. Non-git directories are
trusted by exact path. Global config is always trusted.
Trusted directories are persisted in ~/Library/Application Support/cmux/
trusted-directories.json.
* Add trusted directories section to Settings
Shows all trusted directories with per-directory revoke buttons and a
Clear All option. Placed in a "Custom Commands" section between
Automation and Browser in Settings.
* Replace trusted directories list with editable textarea
One path per line, with a Save button that activates on changes.
Users can add, remove, or edit paths directly.
* Auto-save trusted directories on edit, remove Save button
Matches the behavior of other textarea settings (browser host
whitelist, external URL patterns) which auto-save via @AppStorage.
* Sanitize command text in confirm dialog against BiDi attacks
Strip zero-width and BiDi override characters from the command preview
so the dialog shows exactly what will be executed.
---------
Co-authored-by: austinpower1258 <austinwang115@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Lawrence Chen <lawrencecchen@users.noreply.github.com>
* fix: prevent Japanese IME confirmation Enter from executing command
Korean IME commits a syllable and executes on a single Enter, but
Japanese/Chinese IME use Enter only to confirm conversion — a second
Enter is needed to execute. Restrict the extra Return forwarding in
shouldSendCommittedIMEConfirmKey to Korean input sources only.
* refactor: use case-insensitive check for Korean input source ID
* Export CMUX_SOCKET alongside CMUX_SOCKET_PATH in terminal environment
The app only exported CMUX_SOCKET_PATH when setting up the terminal
environment, but some scripts and hooks (e.g. claude-hook) expect
CMUX_SOCKET. The CLI launcher code already exports both (cmux.swift
lines 9288-9289), but the app-side terminal setup was missing the
alias. This caused claude-hook stop to fail with 'TabManager not
available' when CMUX_SOCKET was empty.
Fixes#1905
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Cache socketPath to avoid redundant call
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix all split panes appearing focused after layout restoration
Ghostty C surfaces default to focused=true (Terminal.zig), but
TerminalSurface.lastFocusState was initialized to false. During
restoration, unfocus() is called before C surfaces exist (views not in
window yet), so the ghostty_surface_set_focus(false) call was silently
dropped. When surfaces were later created, the dedup guard
(false != false) prevented the unfocus from ever reaching the renderer.
Three changes:
- Initialize lastFocusState=true to match Ghostty's default
- In setFocus(), update lastFocusState before the surface-nil guard so
the desired state is tracked even when the C surface doesn't exist yet
- In createSurface(), sync focus state after creation so surfaces that
were logically unfocused before the C surface existed get the correct
state applied
Fixes https://github.com/manaflow-ai/cmux/issues/2080
* Sync focus state unconditionally in createSurface
Per review feedback: always call ghostty_surface_set_focus(createdSurface,
lastFocusState) instead of only syncing when !lastFocusState. This avoids
coupling to Ghostty's default focused=true and is more robust if the
upstream default ever changes.
* Keep lastFocusState in sync with AppKit responder focus calls
The becomeFirstResponder, resignFirstResponder, and ctrl-key fast paths
call ghostty_surface_set_focus directly without updating lastFocusState.
This could cause the dedup guard in setFocus() to skip a needed call, or
createSurface() to replay a stale state on surface recreation.
Add recordExternalFocusState() and call it alongside each direct C focus
call so lastFocusState stays authoritative.
* Rename lastFocusState to desiredFocusState
The variable now tracks focus intent (may be set before the C surface
exists), not just the last-applied state. Update the name and doc
comment to reflect this.
---------
Co-authored-by: Lawrence Chen <lawrencecchen@users.noreply.github.com>
Double-clicking to select text in the terminal was causing unwanted cursor
movement because the mouse position was being updated on both the first and
second clicks. This disrupted the selection gesture and caused the cursor to
jump to a different position than intended.
Fix by only updating the mouse position on the first click (clickCount == 1),
allowing the terminal's selection logic to handle multi-click gestures without
cursor interference.
Fixesmanaflow-ai/cmux#1698
Co-authored-by: BillionClaw <267901332+BillionClaw@users.noreply.github.com>
Use charactersIgnoringModifiers instead of characters when redispatching
Cmd-modified key events in performKeyEquivalent. Cmd-modified keys don't
produce text characters, so event.characters returns an empty string for
Cmd+Shift combos, preventing Ghostty from encoding them as kitty protocol
sequences. charactersIgnoringModifiers returns the actual key character
(e.g. "k" for Cmd+Shift+K) while modifiers are preserved in modifierFlags.
Fixes#1718
Co-authored-by: CHE-3 <schumannzheng@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Publishing changes from background threads is not allowed in macOS 26
(Tahoe). Ghostty action callbacks run on I/O threads but were modifying
AppKit view properties and posting notifications without dispatching to
the main thread.
Fixes:
- GHOSTTY_ACTION_SCROLLBAR: wrap in DispatchQueue.main.async
- GHOSTTY_ACTION_CELL_SIZE: wrap in DispatchQueue.main.async
- GHOSTTY_ACTION_COLOR_CHANGE: wrap background color updates in main async
- GHOSTTY_ACTION_CONFIG_CHANGE: wrap background color clear in main async
ghostty_surface_quicklook_font returns an unretained CTFont pointer that
can become stale on Intel Macs, leading to EXC_BAD_ACCESS (SIGSEGV) when
creating a split. This is a follow-up to the same crash pattern fixed in
#1496.
Add malloc_size validation in cmuxCurrentSurfaceFontSizePoints to detect
freed heap allocations before interpreting the pointer as a CTFont. Also
add hasLiveSurface guards in inheritedTerminalConfig and
rememberTerminalConfigInheritanceSource to skip surfaces whose native
state is closing or closed. All callers already handle nil gracefully by
falling back to inherited config values.
Two root causes for issue #879:
1. GhosttyNSView was missing makeBackingLayer(), so AppKit provided a
generic CALayer as the view's backing layer. libghostty expects
(view.layer as? CAMetalLayer) != nil to set up Metal rendering on
the existing layer. Without a CAMetalLayer backing layer, the Metal
surface defaulted to isOpaque=true, making the terminal area fully
opaque regardless of background-opacity config.
Fix: override makeBackingLayer() to return a CAMetalLayer with
isOpaque=false and bgra8Unorm pixel format (matching standalone
Ghostty's SurfaceView behavior).
2. ghostty_set_window_background_blur(app, window) is exposed in
ghostty.h but was never called in cmux. Without this call the
macOS window never gets the NSVisualEffectView blur backdrop that
background-blur requires.
Fix: add applyWindowBlurIfNeeded() on GhosttyApp that reads
background-blur from config via ghostty_config_get and calls
ghostty_set_window_background_blur when the value is non-zero.
Called from applyBackgroundToKeyWindow() and
applyWindowBackgroundIfActive() whenever the window is made
transparent.
Fixes#879
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: skip Korean from CJK font-codepoint-map auto-injection
The automatic CJK font-codepoint-map injection (PR #1017) maps Korean
ranges to Apple SD Gothic Neo, which has a different style/weight from
the primary terminal font. This overrides Ghostty's native
CTFontCreateForString fallback, which dynamically selects a
better-matching font for Hangul.
Ghostty itself (ghostty-org/ghostty) has no hardcoded CJK font names
and relies entirely on CTFontCreateForString for fallback. For Korean,
this native fallback produces visually consistent results with the
primary font.
Remove the Korean branch from cjkFontMappings() so Ghostty's native
fallback handles Hangul rendering. Japanese and Chinese mappings are
unaffected.
* test: update CJK font mapping tests for Korean removal
- testCJKFontMappingsReturnsAppleSDGothicNeoWithHangulForKorean
→ renamed to testCJKFontMappingsReturnsNilForKoreanOnly
→ asserts nil since Korean is no longer auto-mapped
- testCJKFontMappingsMultiLanguageMapsScriptSpecificRanges
→ renamed to testCJKFontMappingsMultiLanguageSkipsKorean
→ asserts no Apple SD Gothic Neo mapping exists
→ Japanese mappings remain unchanged
---------
Co-authored-by: dante-ad-shield <danate@ad-shield.io>
Four call sites used `line.data(using: .utf8)!` to convert a String to
Data for FileHandle.write(). While .utf8 encoding never fails for Swift
strings (making the force unwrap safe in practice), `Data(line.utf8)` is
the idiomatic Swift equivalent that avoids the force unwrap entirely.
Changed files:
- GhosttyTerminalView.swift (3 occurrences: init log, surface log, size log)
- WorkspaceContentView.swift (1 occurrence: panel debug log)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test(terminal): cover Return after Korean IME commit
* fix(terminal): execute Return after Korean IME commit
---------
Co-authored-by: Lawrence Chen <lawrencecchen@users.noreply.github.com>
The synchronizeScrollView() method was constantly resetting the scroll
position to match the terminal's scrollbar state, even when the user had
manually scrolled up to review scrollback. This caused the 'doomscroll'
bug where panes would fight the user's scroll position.
- Add userScrolledAwayFromBottom flag to track scroll intent
- Only auto-scroll when at bottom or when scrollbar indicates following
- Reset flag when user scrolls back to bottom
- Add 5-point threshold to tolerate minor float drift
Fixes#1577
Co-authored-by: BillionClaw <267901332+BillionClaw@users.noreply.github.com>
