Add isolated scene renderer libraries

[lawrencecchen]

Summary

• add the isolated Ghostty config and scene-renderer libraries used by cmux
• preserve current Ghostty main through normal merges
• fail closed for process replacement, spawning, waiting, and killing in the scene renderer I/O capability table

Verification

• hosted cmux Build GhosttyKit workflow regenerates and audits the universal scene archive before upload
• cmux final renderer linkage audit rejects process, PTY, app, surface, parser, and dynamic-loader symbols

Parent: manaflow-ai/cmux#8378

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Adds isolated config and semantic-scene renderer libraries for cmux’s out-of-process rendering. Hardens isolation by failing closed over process syscalls (fork/execve) and rejecting process I/O at runtime.

• New Features

  • Scene renderer kit: ghostty_scene.h + GhosttySceneRendererKit XCFramework with a single-threaded C API, frame-lease events, IOSurface provenance/ID export, and health reporting. Metal-only with strict capability checks (no process/PTY/app/surface/parser/dynamic-loader access).
  • Config kit: ghostty_config.h + GhosttyConfigKit XCFramework for file discovery, recursive loads, finalization, and canonical serialization (no CLI/app/PTY/parser/render APIs).
  • Deterministic scene wire format and encoder in ghostty/vt/render_scene.h with cached canonical deltas and bounded limits.
  • macOS key translation: ghostty_key_from_macos_keycode for layout-independent input in separate processes.
  • Renderer internals for scenes: capture/materialize pipeline, capability-gated I/O during materialization, Kitty image fidelity (incl. animation), frame lease pool, stable Metal labels, IOSurface ID export.
  • Terminal search via C: derive a selection from a full-screen search match without scrolling.
  • Process census: monotonic counters for runtime app/surface/PTY ownership attempts and allocations.
  • Process isolation hardening: fail-closed syscall overrides (fork/execve return ENOTSUP) with a linkage probe; scene I/O vtable rejects process operations at runtime.

• Dependencies

  • New build flags: -Demit-scene-xcframework=true, -Demit-config-xcframework=true, and -Demit-lib-vt-shared (native-only shared lib toggle).
  • New build modes: scene_renderer_only and config_only roots; main Ghostty app remains unchanged.
  • Smoke tests and audits: kits regenerate/audit symbols; scene linkage rejects process/PTY/app/surface/parser/dynamic-loader; end-to-end C smokes for both kits.
  • Fix: compile-time scene IO selection uses the isolated IO vtable and excludes disallowed APIs in scene-only builds.

^{Written for commit 825c6bd. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d1ca36c-37e4-45ff-b227-5495fc2a823e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}