@@ -995,5 +995,16 @@ each finding below was reproduced before it was fixed.
 | If the new install could not be moved in and the old one not moved back, the staging dir (holding the only copy) was deleted. | It is kept, and the error names it. |
 | Relaunch after an update dropped `--host` and `--shell`. | Forwarded (`--port` is not: the old process still holds it). |
 | Release signing ran in a job whose third-party actions were pinned by mutable tags, and checkout left the job token in `.git/config` for the build. | Actions pinned to the commits their tags named (checkout v5.1.0, setup-bun v2.2.0, attest-build-provenance v4.2.2); `persist-credentials: false`. |
-| Not changed: signing still shares the build job (moving it to its own job is a workflow redesign); `codesign --verify` without a requirement only proves a consistent signature (releases are ad hoc signed); a Linux update drops a setuid `chrome-sandbox`; redirects of signed downloads are not host-checked (the signature covers them). | — |
+| Security (critical). `git diff` looked inside submodules (it runs `git status` in each), and a submodule's own config is never read by the overrides: its filter ran from the Changes view. | `diff.ignoreSubmodules=all` in `HARDEN` and `--ignore-submodules=all` on the diff. |
+| Security (critical). The driver listing was capped at 1 MiB and parsed even when cut: a config padded past the cap left the drivers after it armed. | 16 MiB, and a cut or failed listing fails closed: no git call runs. |
+| Security. The overrides were cached until `.git/config` changed, but a config can include files the watcher does not see (a tracked file via `include.path`, `~/.gitconfig`): a driver added there later ran. | The drivers are listed again at the start of each operation (status, changes, blame, history, base, file list). |
+| `diff.renameLimit=0` made status and Changes run into the 30 s timeout on large renames and come back as a clean tree; `i18n.logOutputEncoding=UTF-16` broke history, blame and the HEAD line; `log.showRoot=false` dropped the commit that added a file. | Rename limits of 1000, UTF-8 log output and `--root` forced; a timed-out diff is reported as truncated. |
+| Search found nothing in a viewed folder that is itself git-ignored (git lists no files there). | An empty git list falls back to the file index. |
+| A shell that could not start (deleted folder, bad `--shell`, out of fds) threw in the socket handler and exited the server; sessions were unlimited. | That terminal gets an exit notice and is closed; at most 64 live shells. |
+| Deleting files rescanned the whole index per path: a 1 500-file `rm` froze the server for 20 s on a 200 000-file tree. | Only a path that was a directory is scanned for children. |
+| A file written more often than every 200 ms (a log) held git status back for as long as it was written: every poke restarted the wait. | Throttled: a pending refresh keeps its time. |
+| Regressions from the first pass: a capped REP left the cursor elsewhere; heavy-dir events restarted the index build; search reported a match under a symlink instead of its target; tooltips still showed raw names; two doc comments ended up on the wrong code. | REP runs the cap plus the remainder of one row's period; heavy dirs don't invalidate; a link whose target is also listed is skipped; tooltips escaped per line; comments moved. |
+| Client: a second jump into a file still loading was undone by the first; reconnecting the events socket resynced nothing; Changes counts went stale on a second edit of a modified file; ⌘B/⌘J did nothing from the terminal on macOS; image tabs never revoked their blob: URLs; Enter confirming an IME composition ran the palette's top item; the change gutter kept an old HEAD base after a discarded fetch. | Each fixed; the reproductions were rerun in Chromium against the build. |
+| Settings: each window PUT its whole snapshot, so two windows (or two folders) erased each other's keys, the snapshot grew forever (`tabs:<root>`), and over 64 KB the save on close was dropped (keepalive limit); a layout change in the last 200 ms was lost. | `PATCH /api/settings` with only the changed keys, merged on the server in the write queue; the 100 most recent `tabs:` roots are kept; layout flushes before the save on close. |
+| Not changed: signing still shares the build job; the index caps file count, not path bytes or directories; the recursive watcher can use the account's whole inotify budget on huge trees; `/api/list` on a 1M-entry directory takes ~10 s (sort); a repository path containing a newline gets no git integration; OSC 8 links stop for good after 65 534 distinct targets (moving it to its own job is a workflow redesign); `codesign --verify` without a requirement only proves a consistent signature (releases are ad hoc signed); a Linux update drops a setuid `chrome-sandbox`; redirects of signed downloads are not host-checked (the signature covers them). | — |
 
@@ -104,6 +104,8 @@ class App {
 
   async start() {
     await store.init();
+    // A layout change in the last 200 ms before closing would miss the save on close otherwise.
+    store.beforeSave(() => store.set("layout", { ...this.L, v: LAYOUT_VERSION }));
     const saved = store.get<Partial<Layout> & { v?: number }>("layout", {});
     // Older layouts carried pre-panel font sizes; let the new defaults apply.
     if (saved.v !== LAYOUT_VERSION) {
@@ -688,7 +690,7 @@ class App {
     this.lastStatus = s;
     // The text sits in its own span so a long path gets an ellipsis (flex items don't ellipsize bare text).
     const item = (text: string, title = "") => h("span", { class: "st-item", title }, h("span", { class: "st-text" }, text));
-    const left: HTMLElement[] = [h("span", { class: "st-item st-root", title: this.info.root }, h("span", { class: "st-dot live" }), showHidden(this.info.name))];
+    const left: HTMLElement[] = [h("span", { class: "st-item st-root", title: showHidden(this.info.root) }, h("span", { class: "st-dot live" }), showHidden(this.info.name))];
     const g = this.git.status;
     if (g.repo) {
       const name = g.branch ?? (g.oid ? g.oid.slice(0, 7) : "no commits");
@@ -698,7 +700,7 @@ class App {
         g.head ? `last commit: ${g.head.subject} (${g.head.author}, ${relativeTime(g.head.time)})` : "",
       ].filter(Boolean).join("\n");
       const dirty = this.git.counts.changed + this.git.counts.untracked + this.git.counts.conflicts > 0;
-      const branch = h("button", { class: "st-item st-git", title: tip, onclick: () => this.showChanges() });
+      const branch = h("button", { class: "st-item st-git", title: tip.split("\n").map(showHidden).join("\n"), onclick: () => this.showChanges() });
       branch.innerHTML = `${icons.branch}<span>${esc(showHidden(name))}${dirty ? "*" : ""}</span>`;
       if (g.behind || g.ahead) {
         branch.insertAdjacentHTML("beforeend", `<span class="st-ab">${g.behind ? `↓${g.behind}` : ""}${g.ahead ? `↑${g.ahead}` : ""}</span>`);
@@ -782,7 +784,7 @@ class App {
         else if (mod && e.shiftKey && k === "e") {
           if (!this.L.sidebar) this.toggleSidebar(true);
           this.tree.focus();
-        } else if (mod && k === "b" && !inTerm) this.toggleSidebar();
+        } else if (mod && k === "b" && appKey) this.toggleSidebar();
         else if (mod && !e.shiftKey && k === "f" && !inTerm) this.editor.openFind();
         else if (e.ctrlKey && k === "g" && !inTerm) this.palette.open(":");
         else if (mod && k === "w" && !inTerm) this.editor.close();
@@ -807,7 +809,7 @@ class App {
         else if (mod && (k === "=" || k === "+") && appKey) this.zoom(1);
         else if (mod && k === "-" && appKey) this.zoom(-1);
         else if (mod && k === "0" && appKey) this.zoom(0);
-        else if (mod && k === "j" && !inTerm) this.togglePanel();
+        else if (mod && k === "j" && appKey) this.togglePanel();
         else if (helpKey(e, { isMac: IS_MAC }) && appKey) this.help.open();
         else if (e.key === "Escape" && this.help.isOpen) this.help.close();
         else if (e.key === "Escape" && this.palette.isOpen) this.palette.close();
@@ -827,7 +829,16 @@ class App {
       const ws = new WebSocket(wsUrl("/ws/events"));
       ws.onopen = () => {
         retry = 500;
-        if (document.body.classList.contains("offline")) this.notify("Reconnected to codeviewer");
+        if (document.body.classList.contains("offline")) {
+          this.notify("Reconnected to codeviewer");
+          // Events sent while disconnected are gone: refresh everything they would have touched.
+          void api.gitStatus().then((s) => this.git.set(s), () => {});
+          this.palette.invalidate();
+          this.search.markStale([], true);
+          void this.tree.reloadAll();
+          this.editor.onChanged(this.editor.tabs.map((t) => t.path));
+          this.changes.onGitChanged();
+        }
         document.body.classList.remove("offline");
       };
       ws.onmessage = (ev) => {
@@ -837,6 +848,9 @@ class App {
         if (msg.t === "changed" && msg.paths) {
           if (msg.structural) this.palette.invalidate();
           this.search.markStale(msg.paths, msg.many);
+          // A second edit to an already modified file changes no status, so no git event follows:
+          // the Changes counts would stay stale (it debounces its own refresh).
+          this.changes.onGitChanged();
           if (msg.many) {
             void this.tree.reloadAll();
             this.editor.onChanged(this.editor.tabs.map((t) => t.path));
 
@@ -36,7 +36,6 @@ export function markRanges(n: number, ranges: readonly MarkRange[]): Uint8Array
   return out;
 }
 
-/** New scrollLeft that brings 0-based column `col` into view, or `scrollLeft` when it already is. */
 /**
  * Trojan Source: each bidi override/isolate is wrapped in a zero-width inline-block (`.bidi`, drawn
  * as a bar, the code point in its title). An atomic inline reorders nothing around it, so the line
@@ -47,6 +46,7 @@ export function markBidi(html: string): string {
   return html.replace(/[\u202a-\u202e\u2066-\u2069]/g, (c) => `<span class="bidi" title="U+${c.charCodeAt(0).toString(16).toUpperCase()}">${c}</span>`);
 }
 
+/** New scrollLeft that brings 0-based column `col` into view, or `scrollLeft` when it already is. */
 export function revealCol(scrollLeft: number, clientWidth: number, gutterW: number, charW: number, col: number): number {
   const x = gutterW + Math.min(col, MAX_RENDER_COLS) * charW;
   if (x < scrollLeft + gutterW || x > scrollLeft + clientWidth - 40) return Math.max(0, x - clientWidth / 2);
@@ -149,6 +149,7 @@ export class CodeView {
     new ResizeObserver(() => this.schedule()).observe(this.scroller);
     this.findInput.addEventListener("input", () => this.runFind());
     this.findInput.addEventListener("keydown", (e) => {
+      if (e.isComposing || e.keyCode === 229) return; // the IME's own Enter / Escape
       if (e.key === "Enter") {
         e.preventDefault();
         this.nextMatch(e.shiftKey ? -1 : 1);
 
@@ -133,18 +133,21 @@ export class Editor {
         const i = this.active ? this.tabs.indexOf(this.active) + 1 : this.tabs.length;
         this.tabs.splice(i, 0, tab);
       }
+      // load() applies the line. Set before the await: a second open() of the same file while this
+      // one loads (another search result) replaces it, and must not be undone when this resumes.
+      if (opts.line) tab.goto = { line: opts.line, col: opts.col, len: opts.len };
       this.activate(tab);
       await this.load(tab);
     } else {
       if (opts.pin) tab.pinned = true;
       this.activate(tab);
       if (opts.line && tab.md) await this.toSource(tab);
+      if (opts.line && tab.code) {
+        if (opts.col !== undefined && opts.len) tab.code.showRange(opts.line - 1, opts.col, opts.col + opts.len);
+        else tab.code.revealLine(opts.line - 1);
+      } else if (opts.line && !tab.md && !tab.image) tab.goto = { line: opts.line, col: opts.col, len: opts.len }; // still loading
     }
-    if (opts.line && tab.code) {
-      if (opts.col !== undefined && opts.len) tab.code.showRange(opts.line - 1, opts.col, opts.col + opts.len);
-      else tab.code.revealLine(opts.line - 1);
-    } else if (opts.line && !tab.md && !tab.image) tab.goto = { line: opts.line, col: opts.col, len: opts.len }; // still loading
-    if (opts.focus !== false) tab.code?.focus();
+    if (opts.focus !== false && this.active === tab) tab.code?.focus();
     this.render();
   }
 
@@ -352,6 +355,7 @@ export class Editor {
         tab.md = undefined;
       }
       if (!plan.code) this.dropCode(tab);
+      if (f.kind !== "image") this.dropImage(tab); // an image reload keeps its view (and zoom)
       if (f.kind === "text") {
         tab.eol = /\r\n/.test(f.text.slice(0, 10000)) ? "CRLF" : "LF";
         if (plan.view === "md") {
@@ -400,6 +404,7 @@ export class Editor {
         if (tab.image && reload) tab.image.reload(tab.mtime);
         else {
           this.dropCode(tab);
+          this.dropImage(tab);
           tab.image = new ImageView(tab.path, tab.mtime, f.size, () => this.status());
           tab.el.replaceChildren(tab.image.el);
           if (tab.path.toLowerCase().endsWith(".svg")) tab.el.prepend(this.viewToggle(tab, "View source", icons.code));
@@ -447,7 +452,7 @@ export class Editor {
       tab.forcePreview = next.forcePreview; // an explicit request overrides the size gate
     } else tab.asSource = !tab.asSource; // SVG: image or source
     this.dropCode(tab);
-    tab.image = undefined;
+    this.dropImage(tab);
     tab.md?.dispose();
     tab.md = undefined;
     void this.load(tab);
@@ -523,9 +528,16 @@ export class Editor {
     tab.code = undefined;
   }
 
+  /** Releases an image view (its blob: URL holds the file's bytes until revoked). */
+  private dropImage(tab: Tab) {
+    tab.image?.dispose();
+    tab.image = undefined;
+  }
+
   private disposeTab(tab: Tab) {
     tab.gen++; // a load still in flight must not build a view for a closed tab
     tab.code?.dispose();
+    tab.image?.dispose();
     tab.diff?.dispose();
     tab.md?.dispose();
     tab.el.remove();
@@ -570,7 +582,12 @@ export class Editor {
     else if (g?.xy[0] === "A") code.setGit("", false); // staged new file: HEAD has nothing
     else {
       const base = await api.gitBase(tab.path);
-      if (gen !== tab.gen || tab.code !== code) return;
+      if (gen !== tab.gen || tab.code !== code) {
+        // Discarded (a reload overtook it): forget the key, or the reload's own refresh skips
+        // and the gutter keeps the old HEAD base.
+        if (tab.gitKey === key) tab.gitKey = "";
+        return;
+      }
       code.setGit(base, false);
     }
     if (tab === this.active) this.status();
@@ -708,9 +725,9 @@ export class Editor {
       const g = t.isDiff && t.file ? { letter: letterOf(t.file.status), label: labelOf(t.file) } : this.git?.repo ? this.git.file(t.path) : null;
       if (g) cls.push(`git-${g.letter}`);
       t.tabEl.className = cls.join(" ");
-      t.tabEl.title = t.commit
+      t.tabEl.title = showHidden(t.commit
         ? `${t.path} · ${t.commit.oid.slice(0, 7)} ${t.commit.subject} (${t.commit.author}, ${relativeTime(t.commit.time)})`
-        : g ? `${t.path} · ${g.label}${t.isDiff ? ` · diff ${this.diffContext.vs}` : ""}` : t.path;
+        : g ? `${t.path} · ${g.label}${t.isDiff ? ` · diff ${this.diffContext.vs}` : ""}` : t.path);
       t.tabEl.setAttribute("aria-selected", String(t === this.active));
       t.tabEl.innerHTML = `${fileIcon(t.path)}<span class="tab-name">${esc(showHidden(basename(t.path)))}</span>${hint(t.path) ? `<span class="tab-dir">${esc(showHidden(hint(t.path)))}</span>` : ""}${t.commit ? `<span class="tab-kind oid">${t.commit.oid.slice(0, 7)}</span>` : t.isDiff ? '<span class="tab-kind">diff</span>' : ""}<button class="tab-close" title="Close (${MOD}W)">${icons.close}</button>`;
       t.tabEl.querySelector(".tab-close")!.addEventListener("click", (e) => {
@@ -786,10 +803,22 @@ class ImageView {
       },
       { passive: false },
     );
-    new ResizeObserver(() => this.mode === "fit" && this.apply()).observe(this.stage);
+    this.ro = new ResizeObserver(() => this.mode === "fit" && this.apply());
+    this.ro.observe(this.stage);
     this.reload(mtime);
   }
 
+  private ro: ResizeObserver;
+  private disposed = false;
+
+  /** Releases the image's bytes (the blob: URL holds them until revoked) and the observer. */
+  dispose() {
+    this.disposed = true;
+    this.ro.disconnect();
+    if (this.blobUrl) URL.revokeObjectURL(this.blobUrl);
+    this.blobUrl = "";
+  }
+
   private blobUrl = "";
   private failed = false;
 
@@ -804,6 +833,8 @@ class ImageView {
   reload(_mtime: number) {
     void api.rawBlobUrl(this.path).then(
       (u) => {
+        // Closed while it loaded: nothing will show it.
+        if (this.disposed) return URL.revokeObjectURL(u);
         if (this.blobUrl) URL.revokeObjectURL(this.blobUrl);
         this.blobUrl = u;
         this.img.src = u;
 
@@ -153,6 +153,8 @@ export class Palette {
     });
     this.input.addEventListener("input", () => this.update());
     this.input.addEventListener("keydown", (e) => {
+      // Enter or Escape that confirms or cancels an IME composition belongs to the IME.
+      if (e.isComposing || e.keyCode === 229) return;
       if (e.key === "ArrowDown" || (e.ctrlKey && e.key === "n")) this.move(1);
       else if (e.key === "ArrowUp" || (e.ctrlKey && e.key === "p")) this.move(-1);
       else if (e.key === "Enter") this.accept(this.sel);
 
@@ -204,15 +204,16 @@ const enum S {
 
 export const MAX_SCROLLBACK = 10_000;
 
-/**
- * Headless VT/xterm emulator: parser + screen model. Rendering lives in renderer.ts.
- * Coordinates are 0-based internally.
- */
 /** Most UTF-16 units one cell's cluster holds (the longest emoji ZWJ sequences are about 35). */
 const MAX_CLUSTER = 64;
 /** Longest OSC 8 target kept as a link. */
 const MAX_LINK_URI = 2048;
 
+/**
+ * Headless VT/xterm emulator: parser + screen model. Rendering lives in renderer.ts.
+ * Coordinates are 0-based internally.
+ */
+
 export class Terminal {
   cols: number;
   rows: number;
@@ -1158,7 +1159,12 @@ export class Terminal {
         const cp = this.lastChar.codePointAt(0)!;
         const ch = String.fromCodePoint(cp);
         this.lastChar = ch;
-        for (let i = Math.min(this.p(0, 1), 65535, this.cols * this.rows); i > 0; i--) this.print(cp, ch);
+        // Past a screenful the output repeats with the period of one row (half a row of wide
+        // characters): the remainder keeps the cursor where the full count would leave it.
+        const n = Math.min(this.p(0, 1), 65535);
+        const cap = this.cols * this.rows;
+        const period = charWidth(cp) === 2 ? Math.max(1, Math.floor(this.cols / 2)) : this.cols;
+        for (let i = n > cap ? cap + ((n - cap) % period) : n; i > 0; i--) this.print(cp, ch);
         return;
       }
       case "c":
 
@@ -266,7 +266,7 @@ export class TerminalPanel {
     for (const [i, s] of this.sessions.entries()) {
       s.tabEl.className = `term-tab${s === this.active ? " active" : ""}${s.exited ? " exited" : ""}`;
       s.tabEl.innerHTML = `<span class="term-dot"></span><span class="tab-name">${esc(showHidden(s.title || `Terminal ${i + 1}`))}</span><button class="tab-close" title="Kill terminal">${icons.close}</button>`;
-      s.tabEl.title = s.title;
+      s.tabEl.title = showHidden(s.title);
       s.tabEl.querySelector(".tab-close")!.addEventListener("click", (e) => {
         e.stopPropagation();
         this.close(s);