On Linux the Keybindings page wrapped action names one to three CJK
glyphs per line and spilled them over the rows below, even though the
keycaps beside them left plenty of room. The label was a shrinkable
block sized to its own measured text, so any layout pass that measured
it narrower than it finally ended up left its painted lines wrapped at
that narrower width.
An action name is a single line: make it nowrap, and beside the keycaps
let it take the space they leave (flex_1) instead of sizing to its text,
so neither its box nor its lines depend on that measurement. Stacked
rows keep the whole row for the name as before.
The Agents half of the report (a long Codex install-failure note
squeezing the agent name to a glyph per line) is #897, already fixed on
main by #898 and not yet in a stable release.
Two places could turn the tail of an escape sequence into visible text.
The replay ring evicts from the front at an arbitrary byte once it reaches
its cap, and a replay starts the client's emulator in its ground state. A
cut through Pi's `ESC ] 133;C BEL` line mark was painted as `33;C` on every
re-attach; a cut through a CJK character as a replacement glyph. The ring
now folds evicted bytes through a minimal VT state machine and keeps
evicting until the front is outside every sequence and not on a UTF-8
continuation byte.
The OSC 5522 tokenizer dropped a held `ESC ]` (plus any undecided
identifier bytes) and the `ESC` that interrupted it, so `ESC ]` split from
`ESC [31m` by a read boundary reached the client as literal `[31m`. It now
forwards those bytes and lets the new sequence be judged normally; only an
interrupted clipboard write's own payload is still dropped.
The daemon's out-of-band stripping moves into `lift_out_of_band` so tests
can drive it: a Pi-style streamed frame passes through byte for byte at
every split point, and the client's emulator parses it to the same grid at
every split point.
A native SSH pane is owned by this machine's daemon, so its paths are
kept away from every Host call and it never gets a git_status_cwd. The
sidebar only grouped from git_status_cwd, which left every native SSH
tab in Scratch under repo-or-directory grouping, even though the remote
shell reports its cwd over OSC 7.
Fall back to that reported cwd for native SSH panes (absolute POSIX
paths only) and resolve it as a settled 'no repo': repo-or-directory
files the tab under the folder, repo grouping keeps it in Scratch.
Typed 'ssh' and WSL panes are unchanged.
Fixes#891
A pane running wsl.exe reports its cwd as a POSIX path from OSC 7, but its
host is this machine. The Files panel rooted the tree at that path verbatim
and handed it to the local read_dir, so on Windows /home/me was read as
C:\home\me and the panel showed "Could not be read"; drops into the tree
failed the same way since they target the rooted directory.
Root the tree at TerminalView::files_cwd instead: a cwd the pane's host
resolves is used as-is, a WSL pane's POSIX cwd goes through the distro's
\\wsl$ share (the same mapping Tab completion already uses), and a cwd no
host here can read (a shell ssh'd onward) roots nothing instead of an
unreadable directory.
#827 stopped a declined prompt from being asked again, but left the
prompts themselves with no notion of whether anyone was still waiting on
them. A routed auth prompt sat in the mailbox, in the parked queue behind
the sheet on screen, or on screen itself, until somebody answered it —
even after the connection attempt that raised it had timed out and moved
on. Answering it sent the secret into a dropped channel.
That is the report's sequence. A link drops while nobody is at the
keyboard; each reconnect attempt raises a password prompt and times out
unanswered, and before #827 the supervisor dialled again and again, so one
dead prompt per attempt piled up behind the first sheet. The user comes
back, types the password into a sheet nobody is listening to, the next one
comes up, one of them happens to be the live attempt and connects — and
the dead ones keep coming up however they are closed. #827 ends the
attempt loop on a timed-out password, but a key passphrase declined by
timeout still falls through to other methods and a transient failure, and
a single stale sheet is still left on screen either way.
A PendingAuth now carries a weak handle whose only strong count lives in
the responder for as long as it waits, so it can say when it has been
abandoned. The pump drops abandoned prompts instead of raising or parking
them, and takes down an on-screen routed sheet whose asker has gone,
moving on to whatever else is asking. The GUI also waits no longer than
the daemon's handshake does (the broker's 120s rather than 180s), so the
sheet comes down when the attempt behind it actually fails, not a minute
later.
On a resize-echoing route (the local daemon and current remote servers)
the grid only reflows when the daemon's Size echo comes back. The
per-frame early-out trusted the request instead: once a size had been
asked for it was never sent again, so a Resize or echo that went missing
left the pane painting a grid shorter than its bounds, with the child
still drawing for the old size, until a divider drag asked for a
different size.
The early-out now checks that the grid actually holds the requested
geometry. While an echo can still be in flight (RESIZE_ECHO_GRACE) it
keeps waiting as before; past that, a grid that disagrees gets the size
sent again. The check try-locks the grid like the painter does, so the
UI thread never queues behind the reader. A size comparison that honours
alacritty's minimum grid also stops a one-column pane from resending on
the non-echo path.
Tests: a lost echo is retried after the grace and not before, a late
Size frame is corrected on echoing routes too, and a relink delivers a
resize made while the old link was down.
`\e[0 q` / `\e[ q` already fall back to `Config::cursor_style`: alacritty
resolves an unset style to `default_cursor_style`, which we seed from the
config and re-apply on every live config change. What nvim actually sends
on exit is terminfo `Se`, and for `xterm-256color` that is `\e[2 q` -- an
explicit steady block, since that is xterm's default -- so the emulator
honours it and every prompt after nvim/vim is stuck on Block.
Track the shell-integration command marks in the pty reader, cut at their
exact byte offsets: note the cursor style at OSC 133;C and, if the command
left a different one behind by 133;D, restore it (back to "unset" when the
prompt was on the configured default, so it keeps following live config
changes). D is the first thing our precmd writes, so shell hooks that style
their own cursor (vi-mode plugins, precmd echoes) still have the last word.
Replayed snapshots go through the same cuts.
Tests: reset via `\e[0 q` and `\e[ q` lands on a configured bar/underline;
C, `\e[2 q`, D restores bar/underline, in one frame and split across frames;
unit tests for the mark parser and restore rules.
Un-zoom routed focus through the tab's `last_focused`, which only
focus-in writes, so any gap between that record and the pane actually
zoomed put the cursor in a different pane when the split came back.
Since #843 the record is kept current on focus-in, which is why the
reported sequence no longer reproduces on main, but the zoomed pane is
the answer outright: hand it to the tab before focusing, so un-zoom no
longer depends on the record having caught up.
Zooming with focus off the panes (a palette just closed, the tab strip)
also zoomed the tab's first leaf rather than the pane the tab
remembers; it now falls back to `focus_target`, the same pane a switch
back to the tab would focus.
The last two passes at the avatar — a flat theme disc, then a bare mark
painted in the brand colour — each gave something up the solid disc had:
the flat disc lost the hue that tells one agent from another down a
column of rows, and the bare mark read lighter and less settled than the
disc beside the status dot. Neither was better than where it started.
Back to a solid fill of the agent's brand with the mark in its own ink,
and the hairline `needs_edge` adds for Codex and Grok's pure black on a
dark window. The shell avatar goes back to its muted disc. `mark_ink`
goes with the style it served; the toolbar changes from the same PR stay.
responsibility_get_pid_responsible_for_pid reports a process as its own
responsible process both when it truly is and when the one it inherited
has exited. A daemon that outlived its GUI - the state a handoff is
meant to repair - therefore looked already disclaimed and was skipped.
Verified headless: a daemon from origin/main launched by a process that
then exits gives new panes no attribution (the shell reports itself);
an in-place restart to this build keeps the pid and existing shells, and
new panes then report the daemon as responsible; a fresh start does too.
macOS attributes Local Network (and other TCC) decisions to a process's
responsible process, fixed at spawn and inherited from the parent. The
daemon is spawned by the GUI, so it and every shell it forks answered to
that GUI. Once the GUI exits while the daemon lives on - every in-place
update, a crash, a force-quit - new panes are no longer attributed to
tty7.app and non-platform binaries get EHOSTUNREACH on the LAN until a
full quit-and-relaunch.
At the top of run_daemon, re-exec in place via posix_spawn with
POSIX_SPAWN_SETEXEC and responsibility_spawnattrs_setdisclaim, so the
daemon (tty7.app's own executable) is responsible for itself. Running
there also covers the far side of a handoff, which repairs a daemon
started by an older build without losing its panes. The SPI is looked
up with dlsym; if it is missing or anything fails, startup continues as
before. A marker argument prevents a second attempt if the first did not
take.
write_atomic renamed its temp file over the given path. When that path is
a symlink (config.json linked into a dotfiles repo), rename(2) replaces
the link itself, so the first save — dragging the sidebar, running a
palette command — silently turned it into a plain file and broke sync.
Resolve the symlink chain first and write next to, and rename over, the
file it finally points at. Covers every write_atomic caller (config.json,
views.json, window.json, machines, presets, agent hooks).
The sidebar avatar dropped its brand-coloured disc for a flat theme one,
which left a column of identical grey marks: hue had been the fast way to
tell one agent from another down twenty rows, and the disc was the only
thing carrying it. Painting the mark itself restores the reading at a
third of the coloured area, so it no longer competes with the status dot
beside it — colour says who, the dot says what it wants. `mark_ink`
keeps the hue and only lifts a value that cannot be seen on the surface
under it, which is Codex and Grok's pure black on a dark theme.
The toolbar above it had the opposite problem: `+` and the panel toggle
were drawn at `sidebar_foreground`, the rung a tab title uses, so the two
controls were the darkest marks in the sidebar. They drop to
`muted_foreground`, level with the workspace chip, and the hover fill the
variant already carried answers the pointer.
The glyphs themselves: the panel icons fill their compartment so they
read as a sidebar rather than a split box, and the plus carries a sixth
more stroke than the closed shapes beside it — an open form at the family
weight reads both larger and fainter, which is what made it the odd one
out. Its cap now lands on a half pixel rather than a whole one; the
whole-pixel rungs are 10px and 12px in a 16px box, and neither is the
size.
Claude-Session: https://claude.ai/code/session_01FG2s9mbZu6LbjjmU54X7kt
A window that reattaches to a pane mid-command (app restart during a long
agent session) replays the daemon's 8 MiB output ring. Once the session
outgrows it, the command's 133;C is gone while its OSC 0/2 titles remain,
so TitleLifetime treated them as prompt titles and the command's D never
retired them: the tab stayed stuck exactly as in #889, while the daemon's
own record had already cleared.
The replayed Prompt state already says a command owns the pane. When it
does and the replay carried no prompt mark at all, everything replayed was
written under that command, so seed the reader's TitleLifetime as running
with a command-owned title.
The latch added for #912 was cleared only on an event that was not part
of a gesture — but a new gesture's first event is `Started`, which
`track_scroll_gesture` reports as live, so the previous gesture's answer
was still sitting there for `get_or_insert` to find.
That is the same bug wearing the other coat: one ⌘-zoom, and every later
two-finger flick kept zooming with nothing held at all, until some wheel
notch or a stray non-gesture event happened to clear it. Deterministic,
where the original was merely likely.
Reset the latch (and the leftover zoom debt) when fingers go back down,
so each gesture answers "scroll or zoom?" for itself.
Guard: `a_new_gesture_is_not_bound_by_what_the_last_one_answered`,
verified red against the commit it fixes.
Claude-Session: https://claude.ai/code/session_01FG2s9mbZu6LbjjmU54X7kt
The install guide said only releases up to 26.8.2 needed it, but 26.8.3
through 26.9.2 were built the same way and import VCRUNTIME140.dll too.
Also correct the CI comment: cc-built code follows +crt-static by itself;
what can bring the import back is a prebuilt native library or RUSTFLAGS.
macOS stamps every event of a momentum tail with the modifiers held at
delivery, so grabbing ⌘ while a two-finger flick was still coasting turned
the rest of a plain scroll into a zoom — dozens of font steps in a few
frames, down to FONT_SIZE_MIN and saved to config.json, which is why it
outlived a relaunch and read as the font randomly shrinking.
A trackpad gesture now answers "scroll or zoom?" once, at its first event,
and holds that answer until the stream dies. A wheel has no gesture to
belong to and still decides notch by notch. The latch is symmetric: a zoom
gesture that outlives its modifier keeps zooming rather than dumping its
tail into the scrollback.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The right-click menu and the File menu sit next to Split / New Tab items,
so the surrounding context already says what closes; plain "Close" (⌘W)
matches the macOS convention. The palette and Keybindings page keep the
full name, where there is no surrounding menu to disambiguate.
A tab went on reading "✳ fixing the switcher" long after Claude Code had
quit and the pane was back at its own prompt in a real directory. An OSC
0/2 had no owner and no end — only another OSC 0/2 ever replaced it — so
the last title any program wrote in a pane outlived it forever, and the
`Osc` rung of the label ladder kept outranking the `Cwd` below it with a
name for a session that no longer existed.
The shell integration already says when a command starts and stops. A new
`core::osc::TitleLifetime` reads OSC 133;C / 133;D alongside the titles:
a title set *between* them belongs to that command and is retired by its
`D`; a title set at a prompt — the shell's own, or one pinned by hand —
belongs to nobody in particular and is left alone; a pane with no shell
integration sees neither mark and keeps every title, exactly as before.
Both readers run it over the same bytes, in stream order, so the tab strip
and the switcher can never disagree about whether a title is still current:
- the daemon's `OscSniffer` turns a retirement into the reset it already
understood, clearing `PaneRecord::osc_title` for the switcher and CLI;
- the window's pane reader sends `AlacEvent::ResetTitle` after the chunk
the emulator just parsed, so its own terminal's title goes back to the
pane's default and `stated_title` says nothing.
Stream order is what keeps a re-titling shell whole: tty7's zsh helper
prepends the `D` emitter to precmd and the PowerShell one titles inside
its prompt function, so a shell's own OSC 0/2 lands after the `D` and is
simply the last word rather than something to undo.
Claude-Session: https://claude.ai/code/session_01JRqYZ9E153WpSHGS2AW3BM
Every Windows binary tty7 has ever shipped imports `VCRUNTIME140.dll`. That
file is not part of Windows; it arrives with the "Visual C++ 2015-2022
Redistributable", which Visual Studio, the GitHub runners and most developer
machines install as a side effect of something else. On a machine that has
never installed it the loader fails before `main` — no window, no log, no
crash report, just
The code execution cannot proceed because VCRUNTIME140.dll was not found.
which is how 26.8.2 failed winget's install validation
(microsoft/winget-pkgs#415841).
Confirmed against the installed 26.x `tty7-app.exe` with
`dumpbin /dependents`: `VCRUNTIME140.dll` plus nine `api-ms-win-crt-*`
entries, and the same in `tty7.exe` and `tty7-updater.exe`. The UCRT half is
in-box from Windows 10 on and never was the problem; VCRUNTIME140 is the one
piece that has to come from the redistributable. The bundled ConPTY pair is
already CRT-static, so it was never implicated — only our own three binaries
are.
`-C target-feature=+crt-static` for the MSVC targets, in `.cargo/config.toml`
rather than in the release workflow, so CI's Windows `build & test` job
compiles under the same flag a release does and a dependency that cannot link
statically fails a pull request instead of a tag. The alternative — declaring
`Microsoft.VCRedist.2015+.x64` in the winget manifest, or shipping the DLLs
beside the exe — was rejected: it leaves the portable zip, the GitHub release
and every non-winget install path broken, this repository publishes no winget
manifest to carry the declaration, and the winget PR shows the declared
dependency did not actually resolve the failure. Static linking removes the
requirement instead of documenting it.
The regression is invisible to everyone who could catch it, because every
machine that builds tty7 has the redistributable, so
`assert-no-vcruntime.ps1` reads the PE import and delay-load tables directly
(no `dumpbin`, which would re-introduce the same "my machine has Visual
Studio" assumption) and fails on any VC++ redistributable import. It runs in
CI on the Windows debug build and, via `verify-windows-package.ps1`, over
both shipped payloads in release and nightly.
Verified on Windows 11 x86_64 with MSVC 14.44: a full
`cargo build --release --locked --target x86_64-pc-windows-msvc` links
cleanly, and `dumpbin /dependents` on the resulting `tty7-app.exe` shows 29
imports, all in-box — no `VCRUNTIME140.dll` and no `api-ms-win-crt-*` at all.
Same for `tty7.exe` and the `--features updater` `tty7-updater.exe`.
`cargo test --release -p tty7-core` under the flag: 1223 passed, 4 failed,
those four being the `remote_link`/`router` tests that fail on a clean tree
on this machine too.
Fixes#902
Claude-Session: https://claude.ai/code/session_01JRqYZ9E153WpSHGS2AW3BM
Alt+1..9 are vim's tab keys, and tty7 takes all nine for Go to Tab.
Two things stood between the reporter and getting them back.
**Nothing in the app could leave an action unbound.** Backspace on a
Keybindings row that has recorded nothing *reset* the row — dropped the
override so the action gets its shipped chord back. On a row nobody had
overridden, which is every row the first time it is looked at, that is a
no-op: pressing it over Alt+1 left Alt+1 sitting exactly where it was,
which reads as the default restoring itself. `config.json` has spelled
"no chord" as `[]` since #868, but no gesture wrote it.
Backspace now writes that empty list. The row falls to `—` and grows the
**Reset** button every overridden row has, which is the way back to the
default. The capture hint names the key, and the docs say what it is for.
**A keybinding line serde could not read failed the whole `Config`.**
`keybindings` is a hand-edited map and was strict, so `"ActivateTab1":
null` — or a number, or an object — quarantined `config.json` and started
the app on built-in defaults. Every rebinding in the file then read as
its shipped default, and the next settings write persisted those
defaults over what the user had written. It now reads one entry at a
time, like every other hand-edited nested key here: the lines that name
a shortcut bind, a line that does not is logged and skipped.
Tests, each failing on the unfixed code:
- `ui::app::keybinding_gpui_tests::backspace_on_a_row_unbinds_the_action_rather_than_restoring_its_default`
- `core::config::tests::a_keybinding_line_that_cannot_be_read_does_not_take_the_config_with_it`
and `ui::keymap::gpui_tests::alt_digits_can_be_moved_off_the_tab_actions_for_good`
pins the merge and a save/reload round trip: a list replaces the shipped
Alt+1, `[]` leaves nothing, and neither comes back after a restart.
Fixes#901
Claude-Session: https://claude.ai/code/session_01JRqYZ9E153WpSHGS2AW3BM
l0ng-ai
l0ng-ai
wenlingangandClaude Opus 5