Dropping my own terminal format for Ghostty's

Kodosi shows the same live terminal on several computers. To do that it saves a terminal’s whole state and sends it: the screen, the scrollback, the cursor, the modes. Kodosi is built on libghostty, and for months it carried its own JSON checkpoint for this, patched into Ghostty.

In October I had our patches audited. The audit counted 23 patches and 10,144 changed lines, and 7,693 of those lines were the checkpoint. It also found that Ghostty already had a binary snapshot that kept the same state. On our test terminals the snapshot was 5 to 19 times smaller and 40 to 60 times faster.

The audit came with an estimate of 6 to 9 working days. I closed it the same day. My rule is that an investigation ends in code, so the next step was the change itself.

Our format was close to its limit anyway. The JSON checkpoint of a 400-column terminal with 1,024 rows of history came to 8.5 MB, over the 8 MiB limit.

The change took two pull requests. The first moved our Ghostty pin forward. The second, a day later, replaced the format: 8,143 lines removed, 1,661 added, 21 patches down to 19, and the network header for a terminal from 19 bytes to 9.

The decoder trusted its input

The snapshot decoder believed the size a snapshot declared. A crafted 3 KB snapshot that declared 16,384 by 16,384 cells made it allocate about 135 MB. Kodosi now refuses anything above 512 rows or 1,024 columns before it decodes.

The patches that are left, and why each one exists, are listed in PROVENANCE.md.