[arzafran]

What this does

Fixes the top ten items from the October 19 audit. Programs running in a terminal can no longer write the clipboard without asking, and opening a folder can no longer make the app run commands that folder's git config defines. Idle terminals stop waking the CPU ten times a second. The sidebar no longer reshuffles itself on notifications. The app drops the bundled ghostty CLI helper and the omo/omx/omc wrappers.

Summary

Suggested review order: the security commits first (11521e0, b47674f, e2c3113, 0c5a094), then the scrollback log (cb35dde, 5345052, 929f5bb), then the rest.

Security:

• Clipboard writes (OSC 52) now ask first. The prompt shows a preview and the workspace name, with Deny, Allow, and "Always allow until this terminal closes".
  • After Deny, that terminal's writes are refused silently for 30 seconds.
  • Requests that arrive while a prompt is open are refused, and the open prompt stays. A program writing in a loop can't keep replacing it.
  • The default is set as inline config ahead of the user's files, so an explicit clipboard-write setting still wins.
• Background git calls neutralize filter drivers defined in the repo's own config. A repo-local lfs.extension.* key also turns off filter.lfs.
  • status and diff pass --ignore-submodules=dirty, so git doesn't run status inside submodules.
  • The filter check is cached per directory. The cached answer is reused only while the inode and ctime of every .git and config that git's discovery could read are unchanged, so a repo extracted into an already-probed folder is read fresh.
• Shell integration only sends the branch. zsh and bash no longer run git status on every prompt. The app works out whether the repo has changes with its own guarded probe.
• Worktree commands handle an unknown branch state safely. When git can't say whether the branch exists, add refuses and the cleanup leaves the branch alone.
• Reported working directories are checked. The OSC 7 directory check runs off the main thread.

Scrollback log:

• No polling. Logs drain when bytes arrive instead of on a 10 Hz timer, and the heartbeat is hourly.
• Turning scrollback saving off stops all log work. Escrowed sessions are the exception: they keep logging until they end.
• Stale snapshots from debug and bench builds expire after 14 days. Release and staging snapshots always stay pinned.
• Compatibility code older than the 30-day upgrade window is removed: v1 escrow, the unspecified-deny compat, and the one-time geometry migration.
  • The closed-window handling stays, because builds up to 2026-09-30 still write it.

Other:

• Sidebar: notifications no longer move a workspace to the top, and the sidebar scrolls to the selected workspace.
• Socket client: keeps reading the reply when setsockopt fails with EINVAL after the server closed. This was the cause of the MCP test flake.
• CI: ui-regressions no longer waits for the unit-test shards.
• Removals:
  • The bundled ghostty CLI goes; programa themes is Swift now, and the zig installs and signing steps for the helper are removed from CI.
  • The omo/omx/omc wrappers go; see docs/removed/omo-omx-omc-wrappers.md.
  • Dead sidebar helpers and legacy tab-color keys go.
• Docs: CHANGELOG and README cleanups.

Accepted risks, per the 30-day decision:

• A holder process from before August that is still running doesn't know about the scrollback-off setting.
• A window closed in a 0.5.0-era build could reopen once.
• Uncommitted changes inside a submodule no longer mark the parent repo as changed. A submodule moved to a new commit still does.
• The filter-check cache doesn't follow include.path or a linked worktree's common config dir. Using either needs write access to the repo.

A security review covered every security commit up to 0c5a094 and approved them; it was static, with no tests run. A cross-model review covered the first eight commits, and its findings are fixed.

Test Plan

• CI is green, including the new tests in ConfigFixSweepRegressionTests and TerminalAndGhosttyTests and tests/test_cli_themes.py. These have only been compiled so far.
• In a tagged build, run printf '\e]52;c;aGk=\a' in a terminal and expect a prompt. Click Deny, run it again within 30 seconds, and expect no prompt and an unchanged clipboard.
• Run while :; do printf '\e]52;c;aGk=\a'; done and expect one prompt that stays put. Clicking Deny should work.
• In a repo with a local filter.x.clean = touch /tmp/marker and a .gitattributes that uses it, open a terminal there and expect /tmp/marker never to appear.
• In bash, edit a file in a repo and expect the dirty dot within a few seconds. Only the syntax of the bash script has been checked so far; zsh was run.
• With 8 idle workspaces, a tagged Debug build went from 0.67% to 0.20% CPU in one run on one machine. Production was not measured.