v0.4.1

What's Changed

This release consolidates all work done in the v0.4.x cycle:

New Features

• Shell integration (OSC 133) — onPromptStart, onCommandStart, onCommandEnd events
• Cursor shape (OSC 22) — onMouseCursorChange event + CSS cursor applied to canvas
• Focus events (mode 1004) — \x1b[I / \x1b[O on focus/blur for vim/neovim/emacs
• Synchronized output (mode 2026) — defer canvas renders, eliminating mid-draw flicker
• Headless mode — TerminalCore base class via ghostty-web/headless entry point
• Ghostty 1.3 WASM — new C API, kitty graphics, structured row/cell iterators
• Powerline + block element rendering — pixel-perfect canvas vector paths
• Bootstrap blank state — blank canvas before first write(), no flash of unstyled content
• preserveScrollOnWrite — lock viewport on new output
• focusOnOpen — focus canvas immediately on open()
• emitTerminalResponses — suppress parser-generated DA/DSR replies
• ImagePasteAddon — clipboard image handling
• Dynamic theming — setTheme() + options.theme setter at runtime

Fixes

• IME composition window anchored to cursor position
• WASM page buffer zero-initialization (prevents memory corruption)
• Viewport corruption from page memory reuse
• Stale cell data visible after scroll with default cursor
• Ghost cursor at (0,0) on init + ESC k title leak
• Cursor shape (DECSCUSR), Ctrl+V, alt screen mouse scroll
• IME composition events routed to hidden textarea
• Alt→ESC prefix and macOS Alt-transformed keys
• Font metrics DPR alignment (no sub-pixel seams)
• Wheel events include cursor coordinates with mouse tracking
• URL detection handles balanced parentheses
• Wide-character continuation cells skipped during selection copy
• Demo RCE: cross-origin WebSocket + /dist/ path traversal
• Dependency CVEs: happy-dom v20, rollup 3.30.0, postcss 8.5.10

Tests & Docs

• Playwright E2E suite: 81 tests, 9 spec files covering the full public API
• CHANGELOG.md from v0.1.0 to v0.4.1
• README rewritten with full API reference, events table, headless examples

Full Changelog: https://github.com/diegosouzapw/ghostty-web/blob/main/CHANGELOG.md

v0.4.0

What's New

Features

• Headless mode — new TerminalCore base class and ghostty-web/headless entry point for server-side / DOM-free usage, mirroring the @xterm/headless API
• Ghostty 1.3 upgrade — updated WASM VT parser to Ghostty 1.3, adding full Kitty Graphics Protocol support and C API improvements
• Shell integration events (OSC 133) — onPromptStart, onCommandStart, onCommandEnd events on TerminalCore; works with any shell that emits FinalTerm/OSC 133 markers
• Mouse cursor shape (OSC 22) — onMouseCursorChange event on Terminal; automatically applies the requested CSS cursor to the canvas and container element
• Focus events (DEC mode 1004) — emits \x1b[I / \x1b[O when the terminal gains/loses focus, for apps that use focus tracking
• Synchronized output (DEC mode 2026) — defers canvas renders while the application holds the sync lock, with a 500 ms force-flush timeout
• Powerline & block character rendering — pixel-perfect rendering of Powerline glyphs and Unicode block characters without relying on the font
• Dynamic theme — Terminal.setTheme() and options.theme allow runtime palette changes
• focusOnOpen — option to control whether the terminal focuses on open()
• preserveScrollOnWrite — option to lock the viewport when new output arrives
• emitTerminalResponses — option to suppress parser-generated replies (e.g. DA responses)
• Image paste addon — ImagePasteAddon for clipboard image handling via iTerm2 inline images

Fixes

• IME textarea position synced to cursor for correct composition placement
• Viewport corruption and stale cell data from page memory reuse
• Alt key: ESC prefix enabled, macOS Alt-transformed keys corrected
• Cursor shape (DECSCUSR), Ctrl+V forwarding, and mouse scroll in alt screen
• WASM page buffers zero-initialized to prevent memory corruption
• Ghost cursor at (0,0) and ESC k title leak
• Font metrics aligned to device pixel boundaries to prevent rendering seams
• CJK selection: skip wide-character continuation cells when copying
• IME composition events routed to the hidden textarea
• Balanced parentheses in URL detection
• Wheel mouse tracking in applications that request it
• happy-dom upgraded to v20; rollup and postcss CVEs pinned

Performance

• Synchronous render after user input to reduce echo latency

Security

• Demo server: closed RCE via unauthenticated cross-origin WebSocket and path traversal in /dist/
• happy-dom CVEs resolved (GHSA-*)