fix: audit fixes and per-tab colors

.github/workflows/build-ghosttykit.yml

@@ -32,6 +32,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build-ghosttykit:
     runs-on: macos-15

.github/workflows/ci-macos-compat.yml

@@ -21,6 +21,9 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   change-detection:
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -68,6 +68,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   change-detection:
     runs-on: ubuntu-latest

.github/workflows/test-depot.yml

@@ -26,6 +26,9 @@ on:
         required: false
         default: "120"
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: macos-15

.github/workflows/test-e2e.yml

@@ -29,6 +29,9 @@ on:
           - macos-15
           - macos-14
 
+permissions:
+  contents: read
+
 jobs:
   e2e:
     runs-on: ${{ inputs.runner || 'macos-15' }}

CLAUDE.md

@@ -159,7 +159,7 @@ The app has a **Debug** menu in the macOS menu bar (only in DEBUG builds). Use i
 - **Typing-latency-sensitive paths** (read carefully before touching these areas):
   - `WindowTerminalHostView.hitTest()` in `Sources/WindowTerminalHostView.swift`: called on every event including keyboard. Keyboard events (`.keyDown`/`.keyUp`/`.flagsChanged`) take an early `switch currentEvent?.type` fast path; everything else — all pointer events, and an ambiguous/nil `currentEvent` — must fall through to the full divider/sidebar/drag routing below it. Do not add work to that keyboard fast path.
   - `NSWindow.programa_sendEvent` in `Sources/WindowSwizzles.swift`: runs for every event. The hit-view context it caches is only ever read for pointer-down events, so it is computed only for those — do not restore an unconditional hit-test here (#183).
-  - `TabItemView` in `ContentView.swift`: uses `Equatable` conformance + `.equatable()` to skip body re-evaluation during typing. Do not add `@EnvironmentObject`, `@ObservedObject` (besides `tab`), or `@Binding` properties without updating the `==` function. Do not remove `.equatable()` from the ForEach call site. Do not read `tabManager` or `notificationStore` in the body; use the precomputed `let` parameters instead.
+  - `TabItemView` in `Sources/TabItemView.swift`: uses `Equatable` conformance + `.equatable()` to skip body re-evaluation during typing. Do not add `@EnvironmentObject`, `@ObservedObject` (besides `tab`), or `@Binding` properties without updating the `==` function. Do not remove `.equatable()` from the ForEach call site. Do not read `tabManager` or `notificationStore` in the body; use the precomputed `let` parameters instead.
   - `TerminalSurface.forceRefresh()` in `GhosttyTerminalView.swift`: called on every keystroke. Do not add allocations, file I/O, or formatting here.
 - **Terminal find layering contract:** `SurfaceSearchOverlay` must be mounted from `GhosttySurfaceScrollView` in `Sources/GhosttyTerminalView.swift` (AppKit portal layer), not from SwiftUI panel containers such as `Sources/Panels/TerminalPanelView.swift`. Portal-hosted terminal views can sit above SwiftUI during split/workspace churn.
 - **Submodule safety:** When modifying a submodule (ghostty), always push the submodule commit to its remote `main` branch BEFORE committing the updated pointer in the parent repo. Never commit on a detached HEAD or temporary branch — the commit will be orphaned and lost. Verify with: `cd <submodule> && git merge-base --is-ancestor HEAD origin/main`. Note: `vendor/bonsplit` is NOT a submodule — it is vendored in-tree (MIT, from the manaflow-ai fork); edit and commit it like any other source directory.

CLI-MCP/MCPSocketBridge.swift

@@ -113,7 +113,7 @@ struct MCPSocketBridge {
 
         if let socketPassword {
             _ = try Self.sendRequest(
-                method: "auth.login",
+                method: V2MethodNames.authLogin,
                 params: ["password": socketPassword],
                 socketFD: socketFD
             )
@@ -169,11 +169,11 @@ struct MCPSocketBridge {
     static func responseTimeout(method: String, params: [String: Any]) -> TimeInterval {
         let timeoutMs: Int
         switch method {
-        case "surface.wait":
+        case V2MethodNames.surfaceWait:
             timeoutMs = timeoutInteger(params["timeout_ms"]) ?? timeoutInteger(params["timeout"]) ?? 30_000
-        case "browser.wait":
+        case V2MethodNames.browserWait:
             timeoutMs = timeoutInteger(params["timeout_ms"]) ?? 5_000
-        case "browser.download.wait":
+        case V2MethodNames.browserDownloadWait:
             timeoutMs = timeoutInteger(params["timeout_ms"]) ?? timeoutInteger(params["timeout"]) ?? 10_000
         default:
             return defaultResponseTimeoutSeconds

CLI-MCP/Resources/SurfaceTextResource.swift

@@ -30,7 +30,7 @@ enum SurfaceTextResource {
 
         let bridge = MCPSocketBridge()
         do {
-            let result = try bridge.send(method: "surface.read_text", params: params)
+            let result = try bridge.send(method: V2MethodNames.surfaceReadText, params: params)
             let text = (result["text"] as? String) ?? ""
             return [.text(text, uri: "programa://surface/\(surfaceId)/text", mimeType: "text/plain")]
         } catch {

CLI-MCP/Resources/TreeResource.swift

@@ -30,7 +30,7 @@ enum TreeResource {
 
         let bridge = MCPSocketBridge()
         do {
-            let result = try bridge.send(method: "system.tree", params: params)
+            let result = try bridge.send(method: V2MethodNames.systemTree, params: params)
             return [try ResourceCatalog.jsonContent(for: result, uri: uri)]
         } catch {
             throw MCPErrorMapping.mcpError(for: error)