[BunsDev]

Context

• Summary: one slice of [TUI v2][P0] T10: establish terminal safety, accessibility, performance, and cross-platform acceptance gates #417, covering untrusted-output safety for the Next renderer at the buffer and real-PTY level, plus the size/color/glyph matrix. Building it found and fixed six places where untrusted text reached the terminal raw, or in color under NO_COLOR.
• Stacked on feat(tui): read-only Next Memory page over daemon familiar-memory reads (#415) #436 ([TUI v2][P1] T8: add a private, read-only familiar-memory inspector and explicit context selection #415) → feat(tui): read-only Next Research page over session search and fetch (#414) #434 ([TUI v2][P1] T7: add a native research workbench with source provenance, citations, and resumable artifacts #414) → feat(tui): read-only Next Work page over engine-local work (T6 slice) #432 ([TUI v2][P1] T6: expose Psyche-backed tasks, dependency tracking, lanes, and durable goals natively #413). Retarget to main as the stack lands.
• Part of [TUI v2][P0] T10: establish terminal safety, accessibility, performance, and cross-platform acceptance gates #417 under [TUI v2] Epic: a unified Coven terminal for coding, tasks, research, and memory #406. [TUI v2][P0] T10: establish terminal safety, accessibility, performance, and cross-platform acceptance gates #417 stays open. Not in this slice:
  • performance targets and the PTY baseline (test(tui-tests): add raw PTY performance baseline harness #425);
  • the 80x24 help overlay (Classic help overlay corrupts and overflows at 80x24 #423) and the 0x0 panic (Interactive render panics on a 0x0 terminal size #424), which are another lane;
  • Windows ConPTY and SSH journeys;
  • high-contrast, terminal-native and reduced-motion iteration in the matrix;
  • large-workload fixtures (100,000-line transcript, 10,000-line diff).
• Related: Classic terminal title writes untrusted session titles raw into the OSC sequence #437 tracks Classic's raw terminal title, which this slice deliberately leaves unchanged.

What the tests found and what changed (Next only)

Leak	Path	Fix
Notification toast drew its message raw, in hard-coded truecolor even under NO_COLOR	Next reused Classic's banner	A Next-native one-row toast in the selected color mode, with inert text, placed in the transcript pane. It never covers the header, an approval or the inspector. Classic keeps its banner.
Error notices drew provider error text raw and in color	Next handed the whole frame to Classic's error modal	Next draws its own inert, wrapped error panel over the composer. Esc still dismisses it through the shared key handling.
Header showed the session title, project, model and familiar raw	workspace_line	Every part goes through safe_one_line
Session page and approval details showed model, provider, familiar, project and title raw	field()	field() makes every value inert
Attachment labels showed media type, document title and pasted file name raw	application/view.rs	Made inert
Terminal title could carry a stored session title's control characters into the OSC title sequence	update_terminal_title at 4 call sites	In Next, terminal_title_topic drops control characters and bidi overrides. Classic is unchanged; see #437.

Classic is unchanged. notifications.rs and render.rs are not touched. The one changed parity test now states the new contract: Next draws error notices itself.

Tests

• tui/tests/next_hostile_output.rs (9 tests). One corpus is placed in every untrusted field Next shows. It contains:

  • OSC 52 clipboard writes, OSC 8 hyperlinks and OSC 0 titles;
  • a screen clear and cursor homing;
  • C1 CSI and OSC, CR, BS, BEL and NUL;
  • a bidi override and isolate;
  • CJK, a combining mark and a ZWJ emoji.

  The suite runs these checks:

  • Control-character matrix: 3 variants (approval pending, plain, error notice) × 2 glyph sets × 4 color modes × 7 pages (no page plus all 6) × 6 sizes (20x6 to 180x50) = 1008 frames, with no C0, DEL or C1 in any cell.
  • Page coverage: every page draws a distinct frame, so a hidden inspector cannot pass for coverage.
  • NO_COLOR: no color on any page in any variant.
  • Way back: "Esc" stays visible on every page from 40x12 up.
  • Toast: it never covers the approval or the inspector title.
  • Error panel: Next draws it, and Esc dismisses it.
  • Title: the title topic carries no control characters.

• presentation_parity.rs: the error modal is no longer in the list of surfaces handed to Classic. A new test covers the Next error panel and Esc.

• tmux case 11: a fake claude answers with control sequences, and tmux's set-clipboard is on so a leak would be observable. The case checks that:

  • no paste buffer appears and the title carries no raw ESC or BEL;
  • a screen clear does not wipe earlier content;
  • the model's own OSC 52 and OSC 8 show as caret text.

  Honest note: at the PTY level, pasted prompt controls already arrive in the composer as caret text. A raw byte capture showed the base binary emits no raw OSC 52 for this journey either, so case 11 is a regression guard. The leaks above were proven red at buffer level against the parent commit.

Verification

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace: 2932 passed, 0 failed
• tmux suite with a disposable HOME and SHELL=/bin/bash: 93/93
• n/a python3 scripts/check-secrets.py: this repository has no such script. Fixtures are synthetic.

Independent review

A fresh reviewer read 993754c. Verdict: not ready. The matrix could not see most surfaces, because a pending approval hid the inspector. Resolved in 588e85f:

Finding	Resolution
High: the matrix never drew the transcript or the pages	Three variants, plus the distinct-frame test
High: error notices raw through Classic's modal	Next error panel; delegation updated
Session page model, provider, familiar and project raw	field() makes every value inert
Attachment labels raw	Made inert in view.rs
Toast covered the approval or inspector title	Placed in the transcript pane; skipped while an approval is pending
Delegated Classic frames not covered	Named in the test header as a gap; tracked here
The way-back test could pass on the toast's "Esc"	Notifications cleared in that test
tmux OSC 52 check satisfied by the pasted prompt	The model has its own payload; OSC 8 and BEL checks added
Bidi branch can't fire in buffer tests	Documented; it matters on the title path, which filters it
Nits	Ellipsis on cut toasts; title call sites reformatted

Accepted gaps:

• Frames still handed to Classic (suggestions, the effort picker, the familiar switcher, other modals) draw their text and transcript the way Classic does.
• Direction marks (U+200E/F, U+061C) and line separators are not filtered from the title.

Risk and Rollback

• Risk level: low to medium. The changes are display only and Next only. Error notices now render through Next instead of Classic.
• Rollback plan: revert this PR. No data or format migrates.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 2, 2026 7:19am UTC

[BunsDev]

Added e5146da (tests only, no product change):

• Appearance matrix: dark and light schemes × full and reduced motion × all color modes, pages and sizes. Every frame keeps cells inert and keeps the way back visible.
• Large content: next_workload.rs covers a 100,000-line answer, a 10,000-line diff-shaped result and 64 KiB of binary output. All render inert from 20x6 to 180x50, with the live end and the way back visible. Scrolling away and Alt+L back to live work.
• Observation: frame cost grows with transcript length (about 1.7 ms at 1,000 lines and about 90 ms at 100,000, debug build). Filed as Next renders the whole transcript every frame: cost grows with transcript length #439, together with the missing jump-to-start key.

Workspace: 2936 passed, 0 failed. Clippy is clean.