[vincentkoc]

Summary

Stream/protocol consumers currently install Ghostty even when they keep another renderer. Make ghostty-web@0.4.0 an optional peer, expose the existing attachTerminalStream through /stream, and retain its /browser export.

Add an executable xterm example and Chromium test, strict TypeScript and Vite checks of an installed renderer-free consumer, and per-entry gzip measurements. Runtime TypeScript grows by seven lines; the attachment implementation is moved, not duplicated.

Compatibility And Security

Ghostty renderer and Node asset-serving consumers must explicitly install ghostty-web@0.4.0. The synchronous /worker-assets export stays self-contained to preserve its existing contract; extracting it remains a coordinated breaking-release decision. No protocol, event ordering, cancellation or authorization change. No new required runtime dependency.

Validation

Final head d22e3c5b737c058af56097635eb81cbffae2a2ec, rebased onto c6d0be15c66e5c76c013ee87eb81a0b5198a1e6b. Preserves the current main cancellation, reconnect, protocol, Worker, stdio and fanout fixes.

• pnpm check passed on Node 22/24 across Linux, macOS and Windows, plus Node 26 on Linux.
• pnpm test:browser passed all 11 Chromium checks, including xterm ANSI/UTF-8 output, cancellation/disposal and existing Node/Worker Ghostty assets.
• Installed-package checks passed: an empty consumer installs neither Ghostty nor node-pty; strict declarations compile without either peer; renderer-free Vite entry graphs stay below the 12 KB gzip budget.
• Workflow lint, CodeQL and Socket checks passed.
• Fresh independent P0–P3 review passed with no actionable findings; a separate source review confirmed preservation of current main behavior.

The production TypeScript delta remains +50/-43 (net +7); test TypeScript is +43/-1. Runtime growth is the structural renderer target and the existing attachment export, not a second implementation.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​xterm/​xterm@​6.0.0

View full report