Guard Ghostty callbacks against stale runtime surfaces

Closed
AU
1mo ago
+151-39

Summary

  • gate Ghostty callback access through live-surface validation instead of reusing stale runtime pointers
  • seal terminal surface lifecycle state when stale runtime surfaces are detected so background restart paths do not recreate freed Ghostty surfaces
  • update terminal controller send/read/wait paths to use the validated surface accessor

Closes #2963.

[!NOTE]
Medium Risk
Touches terminal lifecycle and cross-thread access to the Ghostty C surface pointer; mistakes could cause deadlocks (main-queue sync) or regress surface creation/teardown timing.

Overview
Prevents Ghostty callbacks and controller actions from reusing stale ghostty_surface_t* pointers by introducing thread-safe, main-thread-validated accessors (liveRuntimeSurface/liveSurface) and updating clipboard, sizing, focus, input, and attach/refresh paths to use them.

Adds a restart-suppression flag/lock on TerminalSurface and triggers suppression on close/child-exit and lifecycle close sealing, so background surface-start logic won’t recreate a freed/closing runtime surface; TerminalController send/read/wait flows are updated to rely on the validated accessor as well.

Reviewed by Cursor Bugbot for commit 4bde67f5f31d3818cfd31ff9f343d9de963653ec. Bugbot is set up for automated code reviews on this repo. Configure here.

Summary by cubic

Guards Ghostty callbacks and terminal I/O against stale or freed surfaces by validating a live surface on the main thread before every access. Suppresses unsafe background restarts during close lifecycles to prevent freezes and use-after-free crashes.

  • Bug Fixes
    • Added a main-thread validated live surface accessor and routed all Ghostty callbacks and TerminalController send/read/wait paths through it.
    • Replaced direct surface reads in view attach, display ID updates, geometry/refresh/focus/occlusion, input/selection, and binding actions with the validated accessor.
    • Introduced restart suppression on close lifecycle transitions; do not suppress before confirm-close is accepted to avoid stranding panels.
    • Ensured background threads sync to main when resolving a live surface, eliminating stale pointer reuse.

Summary by CodeRabbit

  • Bug Fixes
    • Enhanced thread-safety for terminal surface operations
    • Improved stability during terminal close and lifecycle transitions
    • Prevented potential issues with stale terminal references