Previously, the Gemini per-event mapper shared by Zed-hosted models and
BYOK recorded `finishReason`, but did not emit
`LanguageModelCompletionEvent::Stop` for ordinary text completions such
as:
```json
{
"candidates": [
{
"index": 0,
"content": {
"role": "model",
"parts": [
{
"text": "What can I help you with today?"
}
]
},
"finishReason": "STOP"
}
]
}
```
The BYOK stream wrapper compensated by emitting the recorded stop reason
at EOF. The hosted path called the per-event mapper without that
wrapper, so completed text responses could reach consumers without a
`Stop` event.
This PR emits the stop event from the shared per-event mapper, after
processing the chunk’s content, while preserving tool-use and refusal
handling. It also removes the BYOK EOF-to-success fallback: a direct
stream ending without a completion signal now reports an unexpected-end
error instead of synthesizing successful completion.
Release Notes:
- N/A
## Summary
Replace the broken rescan-warning rate limiter, which repeatedly emitted
“not logging more” without advancing its counter.
- Keep the last 10 queued path occurrences per watcher backend,
preserving full paths.
- Build and write rescan reports in the existing background dispatch
task, keeping blocking log I/O off the native watcher reader.
- Emit one error line per dispatched rescan after coalescing duplicate
pathless rescans and before registration fan-out, containing the
backend-provided reason, affected paths, and preceding paths.
- Remove the redundant rescan warnings and rate-limit bookkeeping
without changing rescan scheduling.
- Add one focused test for the path history and report contents.
## Verification
- `corgi test -p fs --lib` — 23 tests passed.
- `corgi test -p fs --features test-support --test integration` — 24
tests passed.
- `corgi fmt -p fs -- --check`
- `git diff --check`
Release Notes:
- Improved filesystem watcher rescan diagnostics and removed repetitive
“not logging more” warnings.
## Summary
Move Windows file-open, file-save, and native message dialogs off the
foreground executor so time spent waiting for a user does not appear as
a long foreground task poll. Move Windows Credential Manager reads,
writes, and deletes to the background executor as well.
The caller-facing receiver/task APIs remain unchanged. No hang-journal
suppression or new public GPUI task-spawn API is introduced.
## Implementation
- Run synchronous native dialogs on dedicated threads with COM STA
initialization and cleanup on the same thread.
- Keep the native owner relationship when a window exists; support
ownerless file/save dialogs by passing a null owner HWND.
- Serialize dialogs per owner using one mutex, also used to wait for
active native work before destroying the owner HWND. Closing the GPUI
window sets a shared cancellation flag and hides the native window;
queued requests see that flag and cannot launch. No pending counter,
lifetime lease, cancellation registry, or idle-notification channels are
needed.
- Use a worker-thread timer to request native cancellation when the
caller drops its receiver or the owner closes.
- Preserve message prompts without a Cancel option by vetoing user
cancellation unless an internal cancellation was requested.
- Distinguish actual file-dialog failures from user cancellation.
Sleep/wake and frame-visibility telemetry are intentionally deferred.
## Validation
- `corgi fmt -p gpui_windows -- --check` and scoped `git diff --check`
passed.
- Minimal scratch Windows-target harnesses type-checked the dialog
module and native API wiring against real Windows 0.62 bindings. These
are not full integration builds.
- Six extracted native-independent state/policy tests passed, covering
owner shutdown, queued-request cancellation state, per-request
cancellation isolation, per-owner serialization, ownerless cancellation,
and 12 message-prompt cancellation-policy combinations. These do not
execute native dialogs or the complete coordinator/worker handoff.
- Before the shutdown simplification, Cameron built and launched Zed
successfully on Windows using a shorter `CARGO_TARGET_DIR`, and reported
running the manual prompt checks. The captured output contains no
foreground/action hang or saved task-trace messages, but exact
prompt-by-prompt coverage and timing have not been established.
- The committed Windows test suite has not yet been run natively.
## Open review items
This PR remains a draft. The dialog helper has been simplified to
approximately 245 production lines, retaining native ownership and using
the existing per-owner mutex for shutdown instead of separate lifetime
bookkeeping. Independent static review found no concrete lifetime
regression. Native cancellation still uses the existing worker-thread
timer/window-enumeration mechanism; Windows runtime validation of the
revised shutdown path is outstanding.
Before merging, verify ownerless prompts, focus/Alt+Tab behavior,
overlapping requests for the same owner, cancellation while
queued/shown, owner closure, and nested overwrite confirmations on
Windows. Absence of hang logs alone does not establish those behaviors.
The required review-confirmation marker in README.md must be removed
manually by the human author after review.
Release Notes:
- N/A
- [GPUI] Move window dialogs and credential I/O off foreground thread
This reverts commit bf2d51bcfd.
As discussed with @\ChristopherBiscardi , this has to be implemented
differently, making a first step towards that.
Release Notes:
- N/A
Closes ZED-73F
# Objective
Pasting in Helix mode while the cursor was inside an expanded deleted
diff hunk could create a selection past the buffer and crash.
## Solution
Track the inserted range with before/after anchors instead of deriving
it from the clipboard text length. If the edit is rejected for
non-editable diff text, both anchors resolve to an empty valid range.
## Testing
Added a regression test for pasting inside an expanded deleted hunk and
ran the Helix paste tests.
## Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed's UI standards
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
---
Release Notes:
- Fixed a crash when pasting in an expanded deleted diff hunk in Helix
mode
## Objective
The Threads Sidebar opens at a hard-coded 300px and can be resized only
by dragging. `agent.default_width` controls the Agent Panel rather than
the sidebar, leaving no way to configure the sidebar’s preferred width.
## Solution
Add `agent.threads_sidebar_default_width` for the width used when no
user-chosen sidebar width is stored. The value is clamped to the
existing 200–800px drag range. Existing, unresized sidebars follow
settings changes immediately. Double-clicking the divider resets the
sidebar to the configured width and resumes following subsequent
settings changes.
The sidebar previously saved its width whenever any sidebar state
changed, not only when the divider was dragged. `SerializedSidebar` now
records `width_set_by_user`, so settings-driven widths are no longer
persisted. Manually resized widths take precedence until the divider is
reset.
## Testing
- `test_threads_sidebar_default_width` in
`crates/agent_settings/src/agent_settings.rs` covers the default, a user
override, fallback for `null` and an unset field, and preservation of
the Agent Panel width and sidebar position.
- Five width-focused tests in `crates/sidebar/src/sidebar_tests.rs`
cover reset behavior, live settings updates, clamping, legacy-width
restoration, and persistence. They also check that manually resized
widths resist settings changes and that resetting resumes following the
setting.
- To check by hand: set `"agent": { "threads_sidebar_default_width": 360
}`, reset the divider, and confirm the sidebar is 360px wide. Change the
setting and confirm the width updates immediately. Drag it wider,
restart, and confirm the dragged width is kept. Double-click the divider
and confirm it returns to the configured width. Set the value to `5000`
and confirm the untouched sidebar clamps to 800px.
## Self-Review Checklist:
- [x] I’ve reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed’s UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
---
Release Notes:
- Added `agent.threads_sidebar_default_width` for setting the width of
the Threads Sidebar.
## Stack
Part 2 of the split. #64047 is merged, and this PR now targets `main`.
Current main was merged into this branch without rewriting history. The
diff contains only counting/consent work and the required README review
acknowledgment (8 files, +837/-80). The Copilot metadata sibling #64195
does not depend on this PR.
## Summary
Add optional provider-backed input counting for direct Anthropic, direct
OpenAI Responses, and hosted Anthropic/OpenAI models. Preserve
structured input and reuse provider conversion, authentication refresh,
and client request limiting. Unsupported providers return `None`;
provider and malformed-response errors remain visible.
Keep the existing hosted data-retention consent rule common to counting,
native compaction, and generation. Counting never sends input before
consent. The matched Cloud endpoint support is merged; its deployment
remains a prerequisite for downstream callers.
This PR does not change Copilot prompt/context metadata, compaction
thresholds, or tooltips. No chunking or paid tests are introduced.
## Validation
- After resolving the main merge: 226 tests passed across anthropic,
open_ai, language_models, and language_models_cloud. Main’s consolidated
output-limit tests and renamed serialization test are preserved.
- Scoped script/clippy passed for anthropic, open_ai, language_models,
and language_models_cloud.
- Formatting and whitespace checks passed.
- Coverage includes images, structured request fields, authenticated
hosted requests, unsupported providers, error propagation, and consent
rejection before HTTP.
- No live provider calls were made.
Release Notes:
- Fixed data-retention consent checks for hosted counting and compaction
requests.
## Summary
Move `check_postgres_and_protobuf_migrations` from the existing 16-vCPU
/ 32-GiB Linux runner to the existing 8-vCPU / 16-GiB runner. The job
handles Git history and Buf compatibility, lint, and formatting checks;
its commands, triggers, and coverage remain unchanged.
This reduces its concurrent CPU and memory allocation by half. Namespace
observations from September 11–14 covered 224 runs, with a typical job
duration of 37 seconds and maximum observed RAM around 1.5 GiB. The p95
of per-run peak CPU usage was about 7.7 cores, so CI runtime on the
smaller profile should be checked rather than assuming identical
performance.
Updated the Rust workflow generator and regenerated the YAML. No other
jobs are changed.
## Validation
- `cargo xtask workflows`
- `cargo fmt -p xtask -- --check`
- `git diff --check`
- Full diff reviewed: two files, only the runner selection changed.
- Actual migration check on the smaller runner awaits CI.
Release Notes:
- N/A
Release notes are the sole information users have about what could
either have improved or have been broken for them. Omitting release
notes is one thing, but not writing any or having empty ones helps
nobody - users get no context on what could cause issues they were
seeing nor do they know about potential improvements, triagers cannot
easily find the PR that could have introduced the bug either.
Thus, this PR now makes it so that danger actually requires one to write
release notes. Empty release notes or the placeholder will no longer be
accepted.
Release Notes:
- N/A
Right now there is some margin that uses `editor background` above the
output of the terminal that carries `terminal_background`. If the editor
uses a light background and the terminal is dark you'll end up with a
light area of margin above the dark terminal. The terminal background
also clips the rounded border of the box. This patch switches this to
match the terminal background and makes sure the background never clips
the rounded border.
Before:
<img width="720" height="212" alt="Screenshot 000044 in Zed@2x"
src="https://github.com/user-attachments/assets/333a0e17-2869-4cc9-b696-f24eec8630aa"
/>
After:
<img width="646" height="228" alt="Screenshot 000050 in zed@2x"
src="https://github.com/user-attachments/assets/54293de1-bc64-450f-b354-e64ba0e3d5e9"
/>
Release Notes:
- Fixed terminal tool output in the Agent Panel to consistently use the
theme’s `terminal.background` color.
---------
Co-authored-by: dino <dinojoaocosta@gmail.com>
## Objective
`agent.default_width` is described as the Agent Panel’s default width,
but panels docked to the left or right use proportional sizing while
`agent.flexible` is enabled. Because flexible sizing is enabled by
default, double-clicking the outer resize handle restores the default
proportion rather than the configured pixel width. This can make
`agent.default_width` appear to be ignored.
## Solution
Clarify that `agent.default_width` controls the fixed width used when
`agent.flexible` is disabled, while resetting a flexibly sized Agent
Panel restores its default proportion.
Update the default settings comments, settings documentation, Settings
UI description, and visual customization guide. Add `agent.flexible` to
the Agent Panel configuration example and explain how it affects reset
behavior. No sizing behavior changes.
## Testing
- `cargo fmt --all -- --check`
- No runtime testing—the change only updates settings descriptions and
documentation.
## Self-Review Checklist:
- [x] I’ve reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed’s UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- N/A
# Objective
Fixes#63806
Diff stats use general `success` and `error` colors for added and
deleted line counts.
## Solution
Using `version_control.added` and `version_control.deleted` instead to
match the version control icons color palette.
## Testing
- Did you test these changes? If so, how?
built and ran locally.
- Are there any parts that need more testing?
no
- How can other people (reviewers) test your changes? Is there anything
specific they need to know?
no
- If relevant, what platforms did you test these changes on, and are
there any important ones you can't test?
## Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed's UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
## Showcase
<details>
<summary>Click to view showcase</summary>
<img width="2394" height="776" alt="zed_diff_stat_colors"
src="https://github.com/user-attachments/assets/5c3f89fd-4a07-4fc8-83f9-5f6e133dfe86"
/>
Left Zed - unchanged
Right Zed - fixed
</details>
---
Release Notes:
- Fixed diff statistics to use the theme’s version-control colors for
added and deleted line counts.
## Objective
Let projects add read-only file patterns without repeating the patterns
inherited from user settings.
## Solution
Extend the `"..."` behavior introduced in #62769 to `read_only_files`. A
`"..."` entry includes the inherited patterns. Omitting it replaces the
list, and `[]` clears it.
## Testing
Tested on macOS with settings merge, VS Code import, and project
integration tests. The project test verifies that user and project
patterns both apply while unrelated files remain editable.
To check manually, configure different user and project patterns,
include `"..."` in the project list, and open matching files. Repeat
without `"..."` after restarting Zed to verify replacement.
Linux, Windows, and manual app testing were not performed.
## Self-Review Checklist:
- [x] I’ve reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed’s UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
---
Release Notes:
- Added support for `"..."` in `read_only_files` so project settings can
extend inherited read-only patterns.
---------
Co-authored-by: Kirill Bulatov <kirill@zed.dev>
# Objective
Follow-up to #64196, which corrected documented default *values*. This
one covers documented *settings* — four entries in the reference name
settings that have been renamed, moved, or removed outright, so a reader
who copies them gets a key Zed either ignores or silently rewrites on
load.
Each claim below links to the code that makes it true:
| Documented as | Reality | Evidence |
| --- | --- | --- |
| `features` | Gone |
[`m_2026_02_02/settings.rs#L19-L27`](https://github.com/zed-industries/zed/blob/977458038b62d8a989903aeb0f0c67cd12e8eb00/crates/migrator/src/migrations/m_2026_02_02/settings.rs#L19-L27)
moves the provider out and deletes `features` once empty; no `pub
features` exists in
[`crates/settings_content/`](https://github.com/zed-industries/zed/tree/977458038b62d8a989903aeb0f0c67cd12e8eb00/crates/settings_content/src)
|
| `edit_prediction_provider` | `edit_predictions.provider` | same
migration, plus
[`default.json`](https://github.com/zed-industries/zed/blob/977458038b62d8a989903aeb0f0c67cd12e8eb00/assets/settings/default.json)
ships `"edit_predictions": { "provider": "zed" }` |
| `agent_font_size` | `agent_ui_font_size` |
[`m_2025_10_03/settings.rs#L10-L11`](https://github.com/zed-industries/zed/blob/977458038b62d8a989903aeb0f0c67cd12e8eb00/crates/migrator/src/migrations/m_2025_10_03/settings.rs#L10-L11)
— "Renames the setting `agent_font_size` to `agent_ui_font_size`" |
| `projects_online_by_default` | Gone | no match in `crates/` or
`assets/` |
## Solution
`## Features` is deleted. Its only child, [Edit Prediction
Provider](https://zed.dev/docs/reference/all-settings#edit-prediction-provider),
moves under [Edit
Predictions](https://zed.dev/docs/reference/all-settings#edit-predictions)
to sit with the other `edit_predictions` settings, and its `Setting:`
line becomes `provider`. Nothing else had to change in that subsection —
its JSON examples already used the `edit_predictions.provider` shape,
which is what made the stale wrapper easy to miss.
`agent_font_size` is renamed in place, heading included.
`projects_online_by_default` is removed.
The Edit Predictions example also listed seven `disabled_globs` where
`default.json` ships ten. #64196 corrected that number on the [Disabled
Globs](https://zed.dev/docs/reference/all-settings#disabled-globs) entry
immediately below it, so the two were contradicting each other on the
same page; the example is now synced.
## Testing
`cd docs && npx prettier --check src/` passes, per
[`docs/AGENTS.md`](https://github.com/zed-industries/zed/blob/main/docs/AGENTS.md).
Code fences stay balanced, the moved heading is unique on the page, and
no page links to `#features`, `#agent-font-size`,
`#projects-online-by-default`, or `#edit-prediction-provider`, so the
restructure breaks no anchors. No `{#action}` or `{#kb}` references are
added, so this does not depend on the action metadata `check_docs`
generates.
Found by extracting every ``Setting:`` name on the page and checking it
against the keys `assets/settings/default.json` actually contains, then
confirming each miss against `crates/settings_content/` and
`crates/migrator/`.
## Notes for review
- The same sweep says 24 scalar settings that `default.json` ships have
no entry on this page at all, including `hide_mouse`,
`word_diff_enabled`, `minimum_contrast_for_highlights`,
`modeline_lines`, `lsp_results_location` and `zoomed_padding`. That is
#53323 territory and a much larger piece of writing, so it is not here —
happy to take it on if you want it.
- `auto_update_extensions` and `terminal.font_features` are documented
but absent from `default.json`. Both are real settings
([`extension.rs`](https://github.com/zed-industries/zed/blob/977458038b62d8a989903aeb0f0c67cd12e8eb00/crates/settings_content/src/extension.rs),
[`terminal.rs`](https://github.com/zed-industries/zed/blob/977458038b62d8a989903aeb0f0c67cd12e8eb00/crates/settings_content/src/terminal.rs))
that simply have no shipped default, so I left them alone.
- Still outstanding from #64196's review notes:
`crates/settings_content/src/language.rs` and `editor.rs` carry `///
Default:` comments that feed the settings.json schema tooltips and still
disagree with the site, and `docs/src/diagnostics.md` and
`docs/src/visual-customization.md` still show the old
`diagnostics_max_severity` and `cursor_shape` defaults.
## Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed's UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- N/A
# Objective
Fixes#56544
The settings reference documents `format_on_save` as defaulting to `on`,
but `assets/settings/default.json` ships `"format_on_save": "off"`. The
reporter in #56544 hit exactly that: a fresh config, a C file, save, and
nothing happens.
The reason the documented default looks right to many people is that Zed
enables it per language for twelve languages (Astro, Dart, EEx, Elixir,
Elm, Go, GraphQL, HEEx, Kotlin, Rust, Starlark, Zig). Save formats a
Rust buffer and not a C one, and neither the reference nor the
reporter's mental model had anywhere to hang that difference.
Checking that one entry made me wonder how many others were stale, so I
compared every `Setting:`/`Default:` pair on the page against the
corresponding path in `default.json`. Six more were wrong.
## Solution
| Setting | Documented | Ships as |
| --- | --- | --- |
| `format_on_save` | `on` | `off` |
| `auto_indent` | `true`, "`boolean` values" | `syntax_aware`, a
three-way enum |
| `diagnostics_max_severity` | `null` | `all` |
| `terminal.cursor_shape` | `null` (defaults to block) | `block` |
| `terminal.alternate_scroll` | `off` | `on` |
| `edit_predictions.disabled_globs` | 7 globs | 10 globs |
| `git.gutter_debounce` | `null` | `0` |
Two of these needed more than a value swap:
`auto_indent` stopped being a boolean when it became `AutoIndentMode`
(`crates/settings_content/src/language.rs:411`), so the options list now
covers `syntax_aware`, `preserve_indent` and `none`, and the description
no longer reads as a yes/no toggle.
`format_on_save` gets a sentence naming the twelve languages, so the
difference between saving a Rust buffer and a C one has somewhere to
hang.
`diagnostics_max_severity` and `terminal.cursor_shape` were
self-contradicting rather than merely stale: each section's own prose
already described the real default while the `Default:` line said
`null`.
## Testing
`cd docs && npx prettier --check src/` passes, as required by
`docs/AGENTS.md`. The change is prose and adds no `{#action}` or `{#kb}`
references, so it does not depend on the action metadata that
`check_docs` generates. The `[\`languages\`](#languages)` link resolves
to the single `## Languages` heading on the same page.
Every value in the table above was read out of
`assets/settings/default.json` on `main`, and I confirmed `default.json`
is authoritative for each by following the resolved-settings path (the
`user_content.<x>.unwrap()` style accessors) rather than trusting the
file alone.
## Notes for review
Found while auditing, deliberately left out of this PR — happy to take
any of them in a follow-up, or here if you would rather:
- Two Rust doc comments carry the same wrong defaults and feed the
settings.json schema tooltips, so the in-editor hover still disagrees
with the site: `crates/settings_content/src/language.rs` says `///
Default: on` for `format_on_save`, and
`crates/settings_content/src/editor.rs` says `/// Default: warning` for
`diagnostics_max_severity` while also saying "Shows all diagnostics if
not specified". Fixing those is a source change rather than a docs one.
- `docs/src/diagnostics.md` and `docs/src/visual-customization.md` still
present `diagnostics_max_severity: null`, and the latter also shows
`cursor_shape: null` for the editor where `default.json` ships `bar`.
Same defect class, different pages and a different presentation
(defaults listings rather than a reference), so I kept this PR to the
reference page.
- The reference's `diagnostics_max_severity` options omit `off`, which
is a live variant (`DiagnosticSeverityContent` in
`crates/settings_content/src/project.rs`). That is a missing option
rather than a wrong default, so it is not in scope here.
- Neither the Format On Save nor the Autosave section mentions that
`"autosave": {"after_delay": {...}}` disables format on save outright
(`crates/workspace/src/pane.rs`), even though `default.json` carries
that warning as a comment.
- The twelve-language list is a maintenance cost: it has to be edited
whenever a language gains or loses a default. `default.json` sets
per-language defaults for `tab_size`, `soft_wrap`, `allow_rewrap`,
`hard_tabs` and others too, and none of them are called out anywhere. A
single general statement about per-language defaults overriding
top-level ones would cover all of them and never go stale. I kept the
explicit list because it is what actually answers #56544, but I will
happily swap it for the general version if you prefer.
## Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed's UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- N/A
Dynamic font loading is useful on web, but locked a mutex on the main
thread. This PR removes that
---
Release Notes:
- N/A or Added/Fixed/Improved ...
Browser applications cannot rely on operating-system font discovery, but
embedding comprehensive emoji and CJK fonts makes the initial
WebAssembly payload prohibitively large. GPUI previously offered no
structured way to learn that fallback was exhausted, and adding a font
at runtime left descriptor and line-layout caches shaped against the old
font database.
This change lets WGPU text systems report unresolved grapheme clusters
through `App::on_missing_glyphs`. GPUI invokes one replaceable
application callback after shaping, carrying each complete grapheme and
whether its source run is proportional or monospace. Reports are
deduplicated and delivered through a bounded, nonblocking channel;
reporting remains disabled until the callback is installed, and queued
reports from an earlier font generation are discarded.
Successful font installation now advances a font generation. GPUI clears
descriptor and platform family resolution, reuses stable font IDs for
unchanged faces while refreshing their fallback chains, and invalidates
each window's current and previous line-layout caches when it observes
the new generation. This supplies the GPUI half of an on-demand web font
loader; fetching and selecting font assets remains application-owned.
Release Notes:
- N/A
---------
Co-authored-by: Max Brunsfeld <maxbrunsfeld@gmail.com>
#63145 exposed a bug in the the `snapshot_with_edits` and `fast_forward`
methods that we use to evolve the base text buffer for diffs: we
preserved the value of the `tree_sitter_data` field from the old
snapshot. That causes any diff whose base text has changed to have stale
bracket ranges and now stale syntax highlighting as well, which can
manifest as unhighlighted text in the deleted portion of an expanded
diff hunk.
This PR fixes the issue by clearing the `tree_sitter_data` field in
`snapshot_with_edits`.
Release Notes:
- N/A (problem exists in nightly only)
## Stack
- This PR: output-limit plumbing, based on `main`.
- #64194: provider input counting and consent, based on this branch.
- #64195: Copilot metadata and consumers, independently based on this
branch.
After this PR lands, rebase/retarget both children onto `main` as
needed, especially after a squash merge. At split time, a synthetic
merge of the two child heads exactly matched the saved pre-split source
tree. PR1 has since consolidated overlapping tests without changing
production code.
## Summary
Part 1 of a three-PR split: add optional per-request
`max_output_tokens`, forward it through provider payloads, and clamp it
against known output limits. Unset requests preserve existing defaults.
Unknown Copilot output metadata is not treated as a zero-token maximum
when forwarding a cap.
This PR also supplies the combined-window and native-capability
interfaces used by downstream budget calculations. It does not add
input-token counting, data-retention consent integration, or change
Copilot prompt/context metadata, compaction thresholds, or tooltips.
Those changes are split into two child PRs based on this branch.
The net diff is 24 files, +438/-55. Forward narrowing commits preserve
the original review history; there was no force-push.
## Test consolidation
Eight overlapping standalone tests have been folded into existing
conversion tests, preserving coverage of unset limits, explicit limits,
clamping, and serialized payloads. Four distinct tests remain separate:
request serialization compatibility, Copilot wire formats, DeepSeek
conversion (no existing conversion suite), and hosted OpenAI
normal-completion HTTP behavior. This cleanup changes no production Rust
code.
## Validation
- Latest run: 269 tests passed across anthropic, google_ai, open_ai,
language_models, copilot_chat, and language_models_cloud.
- Five extended existing tests failed when cap selection was temporarily
broken and passed after restoration. No mutations remain.
- Latest scoped script/clippy, formatting, and whitespace checks passed.
Earlier split validation:
- 229 tests passed across language_model_core, anthropic, open_ai,
copilot_chat, and language_models_cloud.
- Scoped script/clippy passed for copilot_chat, language_models_cloud,
language_models, agent, and agent_ui.
- Formatting and whitespace checks passed.
- Permanent tests cover payload propagation, absent/explicit limits,
unknown output metadata, direct and hosted native-compaction caps, and
hosted OpenAI clamping.
- No live provider requests were made for the split.
## Review notes
The separately identified fixed/non-interleaved thinking-budget versus
smaller output-cap concern remains open in this PR; it must not be
hidden in the counting or metadata PRs. The README acknowledgment is
retained for human review.
Downstream applications using input counting must consume the counting
child PR as well, not repin to this branch alone.
Release Notes:
- N/A
## Summary
- Replace the outdated Trunk URL in the GPUI examples README with
https://trunk-rs.github.io/trunk/.
## Verification
- Confirmed the replacement URL returns HTTP 200.
- Ran `git diff --check` successfully.
- No code tests needed for this documentation-only link change.
Release Notes:
- N/A
Surface tool-call names without adding a permanent subtitle or badge to
every call.
- Keep nonblank titles as the primary label. Blank or whitespace-only
titles fall back to the exact programmatic tool name, then to "Tool
call" if no usable name is available.
- Preserve real titles on name-only updates, and let later title updates
replace a fallback. Fallback names render literally and remain
searchable; exports escape them at the Markdown boundary.
- Show `Tool: <name>` on existing non-terminal tool icons. Keep the
terminal command layout unchanged, and preserve the existing Go to File,
Interrupted Edit, and Copy Command interactions.
- Apply the same behavior to native and external agents, without an
ACP-beta gate.
Release Notes:
- N/A
Closes#45783
`Menu` key or `Shift + F10` shortcut wasn't supported in project panel
for opening the context menu, this PR fixes it.
Release Notes:
- Added an action and default keyboard shortcuts to open the context
menu in the project panel. You can now bind
`project_panel::OpenContextMenu` to deploy the context menu at the
currently selected entry in the panel.
---------
Co-authored-by: MrSubidubi <finn@zed.dev>
Add support for ACP context-compaction updates and streamed summaries.
The ACP beta flag gates only the capability advertised to external ACP
agents. Native Zed-agent compaction (manual and automatic), including
the shared rendering, search, and export behavior, remains available
regardless of that flag.
- Apply updates by compaction ID without moving their timeline entries,
preserving omitted/null/replacement semantics for summaries and errors.
- Retain rich summary content and show explicit placeholders for
unsupported content instead of silently dropping it.
- Render progress, completion, failure, cancellation, and unknown
statuses. Expanded summaries and literal error details participate in
thread search, and Markdown exports preserve status and details.
- Keep native compaction compatible: failed retry attempts become
terminal, and cancellation is delivered before the stop event even when
the bridge has not yet applied the queued start event. Preserve native
streaming and save/reload behavior.
Release Notes:
- N/A
Use the native tool call's scoped ID for elicitation requests instead of
constructing an ID from the raw provider-issued tool-use ID. This keeps
`ask_user` forms associated with the correct conversation entry,
including when providers reuse raw IDs.
Release Notes:
- N/A
Follow up on #64077 by using first-class ACP tool-call names while
continuing to accept legacy `_meta.tool_name` from older agents.
- Prefer the first-class name when creating a tool call. Explicit name
updates replace the stored name; legacy metadata only fills an absent
name and cannot overwrite a canonical name.
- Emit first-class names from the native agent, including replay when a
tool implementation is unavailable.
Release Notes:
- N/A
# Objective
- Enable users to cut, copy, and paste commit-message text through a
right-click menu in the Git sidebar and expanded commit modal.
## Solution
- Add a context menu to the shared commit-message editor using Zed’s
existing clipboard actions
- Disable Cut and Copy when no text is selected, and route actions to
the editor’s focus handle.
## Testing
- Added a regression test covering clipboard behaviour in both editor
modes.
- Reviewer can test by using right-click context menu in the git commit
message panel to cut/copy/paste
- Tested on Mac OS with `cargo run`
## Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [ ] ~~Unsafe blocks (if any) have justifying comments~~
- [x] The content adheres to Zed's UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
## Showcase
<img width="800" height="451" alt="commit-menu"
src="https://github.com/user-attachments/assets/1ba281d7-7651-4408-8c10-ee456cde2e1d"
/>
---
Release Notes:
- Added Cut, Copy, and Paste context menu actions to the commit message
editor.
In the current Python Tree-sitter `highlight.scm`, the `@` used for
decorators (`@punctuation.special` rule) is incorrectly overridden by
the `@` used for matrix multiplication (`@operator` rule).
This PR updates the matrix multiplication highlight query so it only
applies in binary operator contexts, and it also removes a duplicate
`@punctuation.special` for the `@` decorator.
| Before | After |
|
:---------------------------------------------------------------------------------------------------------------------------------:
|
:--------------------------------------------------------------------------------------------------------------------------------:
|
| <img width="338" height="1056" alt="image"
src="https://github.com/user-attachments/assets/cdce1556-6f7d-4542-abca-bcb3e11b6629"
/>| <img width="380" height="1057" alt="image"
src="https://github.com/user-attachments/assets/f948413c-ad8a-4ccc-89c1-bbffbe2affda"
/>|
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- Fix Python at sign decorator highlighting conflict with matrix
multiplication at sign operator
---------
Co-authored-by: Finn Evers <finn@zed.dev>
## Summary
Add browser-font fallback to GPUI on the web, so applications can render
emoji using the user’s local fonts without bundling an emoji font.
GPUI continues to shape text with Cosmic Text using application-provided
fonts. When those fonts cannot supply an eligible grapheme or its
requested emoji presentation, the web backend measures and rasterizes
the complete grapheme using Canvas 2D, then caches and paints the result
through GPUI’s existing glyph atlas.
### Configurable fallback
- **Emoji-only by default**, including supported variation-selector,
skin-tone, flag, keycap, and ZWJ sequences.
- Applications can opt into **CJK fallback** for a conservative subset
of horizontal Han, kana, and modern Hangul text.
- Applications can disable Canvas fallback entirely.
CJK fallback renders graphemes independently. It prioritizes readable
text over full fidelity to contextual spacing and font features. Browser
font coverage and appearance depend on the user’s environment.
### Web input and application lifecycle
- Fix text insertion that arrives without a corresponding keyboard
event, allowing emoji input through the browser’s text-input path.
- Keep the GPUI application alive after `Application::run` returns on
WebAssembly. Browser startup is asynchronous; releasing the application
after the startup callback previously caused the window to disappear.
### Browser example gallery
Make the existing GPUI examples available from a single development
server, with separate routes for hello world, styled text, text layout,
wrapping, input, and the prime sieve demo.
The gallery supports direct links and reloads, loads only the selected
example, and provides a simple way to exercise font fallback and text
input.
## Validation
- Native unit tests cover fallback eligibility and presentation, policy
defaults, glyph-cache reuse, and in-place glyph-run replacement.
- All six gallery binaries pass WASM compilation checks.
- Browser smoke coverage exercises emoji insertion, whole-grapheme
Canvas rendering, cache reuse, and deletion.
- Manually exercised the gallery and fallback rendering in Chrome.
Release Notes:
- N/A
# Objective
In a branch diff — or any multi-buffer containing deleted files —
deleted files render as flat "external file" rows above the outline
panel's tree, instead of at the path they used to occupy. They lose all
directory context and appear as a bare list of filenames detached from
the tree, which is confusing precisely when you are trying to review
what a branch changed.
The cause is that `File::project_entry_id` returns `None` for
`DiskState::Deleted`, while the outline panel's tree is keyed end-to-end
by `ProjectEntryId` — depth map, collapse state, children counts. A
deleted buffer therefore falls through to the external-file path in
`update_fs_entries`, even though its `File` still carries a perfectly
good worktree and path.
## Solution
Synthesize the missing entries at the point of classification and let
the existing pipeline run unchanged.
- Entries are synthesized for the deleted file **and** for any ancestor
directories that no longer exist, so a wholly-deleted folder still
appears nested at its old location. An ancestor is only taken from the
worktree if it is a directory; a path that is a file now but was a
directory when the deleted file existed is synthesized too, and sorted
after the file so the nesting pass keeps the directory on its stack.
- Ids come from a per-panel registry that hands them out sequentially
downward from just below `ProjectEntryId::MAX`, keyed by path and kind.
Real ids count up from zero, so the ranges cannot meet; sequential
allocation means two entries can never share an id (the entry maps are
keyed by id alone, so a collision would drop a row); and the registry is
kept across updates, so collapse state on synthesized rows survives.
- Whether a buffer with no worktree entry is a deletion is decided by
its `DiskState`: `Deleted` always, `Present` never, `Historic` by its
own flag, and `New` only when git status reports a deletion or the
excerpt's diff has a base text. The last case is a file deleted in a
commit on the branch: it is absent from disk, the working-tree status
says nothing about it, and `GitStore::display_status` only reflects
branch-diff statuses when `git.diff_base` is `default_branch`. A
deletion has a base version; a path that never existed has none. A
scan-excluded file, which also has no entry, is `Present` and stays an
external row.
- Auto-fold stops where deletion state changes, so a surviving `parent/`
is never struck through together with its deleted child, and
`select_parent` treats a folded row as a valid parent of the folded row
beneath it.
- Auto-reveal resolves a deleted row's ancestors from the panel's own
`fs_entries` rather than re-querying the worktree, and only real
directories are ever passed to `Project::expand_entry` (a synthesized id
would go out as an `ExpandProjectEntry` a remote host rejects). Opening
a deleted row resolves its excerpt from the buffer id, since
`path_for_entry` cannot resolve a synthesized entry.
Deleted rows are struck through by a `line_through` on the row's label
wrapper. `HighlightedLabel` builds its text runs from
`window.text_style()`, so an ancestor's style reaches them even though
`LabelLike`'s own `strikethrough()` does not; nothing outside
`crates/outline_panel` changes. Colour is deliberately left to git
status, matching deleted editor tabs — a committed deletion leaves the
working tree clean, so strikethrough is the only signal in a branch
diff.
## Testing
Thirteen new tests, each asserting the rendered tree through
`display_entries`, which now prints external files and marks deleted
rows:
- deleted file nests under its surviving parent; deleted file inside a
wholly-deleted directory gets synthesized ancestors at the right depth
- a file absent from disk and from git status nests when its excerpt
carries a base text, while a buffer on a path that never existed stays
an external file, unmarked
- a modified, scan-excluded tracked file stays an external file,
unmarked
- same-path file + synthesized directory: nesting and auto-reveal both
pick the directory
- auto-fold stops at the deletion boundary; `select_parent` climbs from
a folded deleted chain to the folded parent above it
- opening a deleted row scrolls the editor to its excerpt
- auto-reveal expands the ancestors of a deleted file and ignores an
external file on a nonexistent path
- buffers with no `File` still become `ExternalFile`
- synthetic ids are distinct per path and kind, and stable
`./script/clippy`, `cargo fmt --all -- --check`, `cargo test -p
outline_panel` (33) are green. Tested manually on macOS against a
fixture branch with a committed file deletion, a wholly-deleted
directory under a surviving empty one, a directory replaced by a
same-path file, an uncommitted deletion, a scan-excluded modified file,
and a modified and an added file.
## Suggested .rules additions
- `GitStore::display_status` only reflects branch-diff statuses when
`git.diff_base` is `default_branch`; the branch diff view can be open
while the setting is `head`. Do not use it to detect committed deletions
— a commit-deleted file's buffer is `DiskState::New`; check the
excerpt's diff for a base text instead.
- Outline panel: a directory with mixed children is marked unfolded
while `fs_entries` is built, so an auto-fold chain only forms through
single-subdirectory links. Tests for folding must use that shape.
- `HighlightedLabel` builds its runs from `window.text_style()` at
render time, so `LabelLike` modifiers such as `strikethrough()` and
`italic()` are no-ops on it; put the style on an ancestor element
instead.
## Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed's UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
## Showcase
The same branch diff, which deletes `src/utils/format.rs` (its directory
survives) and the whole of `src/legacy/` (including a nested
`internal/`), alongside a modified and an added file.
| Before | After |
| --- | --- |
| <img
src="https://github.com/user-attachments/assets/bf503759-77a7-4f31-80bb-a85936de0b8a"
width="300"> | <img
src="https://github.com/user-attachments/assets/c558b94b-4ca5-447f-a049-a3ab280c679a"
width="300"> |
| Deleted files sit above the project root as bare filenames, detached
from the tree | Each is nested at its original path, with `legacy/` and
`internal/` synthesized since they no longer exist on disk |
Note that `utils/` renders normally while `legacy/` and `internal/` are
struck through: the marking is per-entry, not applied to every ancestor
on a deleted file's path.
---
Release Notes:
- Fixed deleted files appearing outside the file tree in the outline
panel when viewing a diff
---------
Co-authored-by: Kirill Bulatov <kirill@zed.dev>
## Objective
Prevent canceled external file drags on Linux Wayland from becoming
active again after the native drag session has already left the Zed
window.
This is a rare timing-sensitive race. When it occurs, the stale external
drag remains active inside GPUI. Ordinary mouse movement then behaves
like drag movement throughout Zed, and a later unrelated click can drop
or copy the previously dragged file into the project panel.
The issue was observed on Fedora 44 with GNOME Wayland, with the drag
originating in GNOME Files.
## Cause
The Wayland destination path reads the drag's `text/uri-list` payload
asynchronously.
Before this change, `state.drag.window` and `state.drag.data_offer` were
installed only after that asynchronous read completed. If
`wl_data_device::Event::Leave` arrived first, it found no installed
destination and returned. The detached read could then complete and
dispatch a stale `FileDropEvent::Entered` after the native drag had
already ended.
Rapidly entering and leaving Zed could also create multiple overlapping
URI reads whose stale completions replaced one another.
With a temporary delay added to make the timing deterministic, the
failing sequence was:
```text
entered: offer=81
left: active_offer=None, had_window=false
paths ready: offer=81
installing destination: offer=81, previous_offer=None
```
Two overlapping stale completions produced:
```text
installing destination: offer=80,
previous_offer=Some(offer=81),
had_window=true
```
The temporary delay and diagnostics are not included in this PR.
## Solution
Associate each asynchronous drag URI read with a monotonically
increasing generation.
- A new `Enter` begins a new generation and invalidates an older pending
read.
- `Leave` invalidates the current pending read.
- `Drop` invalidates the current pending read.
- Before installing the destination and dispatching
`FileDropEvent::Entered`, the asynchronous task verifies that its
generation is still current.
- Stale completions destroy their data offer and return without creating
an active GPUI drag.
Normal drags whose URI reads complete before a terminal event continue
through the existing path unchanged.
## Testing
- Added a unit test covering:
- A newer drag invalidating an older URI read.
- A terminal drag event invalidating the current URI read.
- Reproduced the race deterministically with a temporary two-second
delay before destination installation.
- Verified that stale completions are discarded with the fix and no
longer cause ordinary mouse movement or clicks to act on the old file.
- Ran:
```text
cargo test -p gpui_linux invalidates_stale_drag_uri_reads
cargo check -p gpui_linux
cargo build -p zed
git diff --check
```
Release Notes:
- Fixed canceled external file drags on Linux Wayland sometimes
remaining active and causing later clicks to copy the dragged file.
# Objective
Fixes#58821. Follow-up to #58880: keep the modifier-click hint accurate
when the tooltip switches from breakpoint to bookmark.
## Solution
Build the hint from the configured secondary gutter action instead of
the currently active action.
## Self-Review Checklist
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed's UI standards
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
## Showcase
https://github.com/user-attachments/assets/c514d30e-9747-40a1-b359-54bc10086366
---
Release Notes:
- Fixed the gutter tooltip's modifier-click hint after holding Command.
# Objective
Avoid requiring local XKB keyboard-definition directories when using the
resolved keymap supplied by Wayland or X11. If libxkbcommon cannot find
any usable default include directory, context creation can fail even
though the client already has everything needed to use the server's
keyboard map. Wayland can then panic on missing keyboard state when a
modifier event arrives.
Closes DELTA-9B
## Solution
Create the shared XKB context with `XKB_CONTEXT_NO_DEFAULT_INCLUDES`.
The [libxkbcommon
documentation](https://xkbcommon.org/doc/current/group__context.html)
explicitly identifies clients retrieving their keymaps from Wayland or
X11 as a use case for this flag. [Qt's X11
backend](https://github.com/qt/qtbase/blob/6.8/src/plugins/platforms/xcb/qxcbkeyboard.cpp#L342-L358)
uses the same approach.
Keep default include paths in the X11 test fixtures, which compile named
layouts from local definitions instead of receiving resolved maps from a
server. No fallback layout, platform-error callback API, or changes to
other keymap failure handling are included.
## Testing
- Passed `corgi fmt --check -p gpui_linux` and `git diff
origin/main...HEAD --check`.
- Reviewed the complete diff: two source files. The author has removed
the README review marker.
- Linux build/test execution remains unverified. Earlier `corgi` and
`cargo` cross-build attempts on macOS were blocked by missing Linux
native dependencies/toolchain (`x86_64-linux-musl-gcc`); no Linux
runtime or running Docker daemon is available here.
- No subprocess/environment-manipulating regression test is included.
Manual verification is pending:
- On ordinary Linux, check typing, modifiers/shortcuts, layout
switching, and compose/dead keys under both Wayland and X11.
- Reproduce startup with inaccessible XKB configuration paths in the old
build, then verify keyboard input works in the patched build under the
same conditions, ideally on the affected NixOS setup.
- Run the existing `gpui_linux` X11 keyboard tests on Linux to verify
the fixture adjustment.
Draft pending Linux validation.
Release Notes:
- Fixed a Linux startup crash when local XKB keyboard-definition files
are unavailable.
Adds a `WindowVisibility` API to GPUI: `Window::visibility()` /
`Window::is_visible()`, `Window::observe_window_visibility`, and
`Context::observe_window_visibility`, backed by one platform signal per
backend — `NSWindow.occlusionState` on macOS, `WS_VISIBLE` plus the
minimized state on Windows, the xdg-shell v6 `suspended` toplevel state
on Wayland, mapped state plus `VisibilityNotify` on X11, and the Page
Visibility API on web. Only transitions are reported, the initial value
is read from the platform when the window is created, and the two
`PlatformWindow` methods have no default so a backend cannot silently
opt out. The per-platform limits (Windows can't see a fully covered
window, pre-v6 Wayland compositors never report `Hidden`) are documented
on the type.
It also adds `Platform::on_system_sleep` / `App::on_system_sleep`,
mirroring the existing wake hook, on macOS
(`NSWorkspaceWillSleepNotification`), Windows (`PBT_APMSUSPEND`), and
Linux (logind `PrepareForSleep(true)`, which the listener previously
discarded). Nothing in Zed subscribes to either yet; the hang-telemetry
journal will use visibility to stop measuring frames that could not have
been presented, and the sleep/wake pair to bracket time the process was
not running.
Release Notes:
- N/A
## Objective
Make renderer benchmarks exercise GPUI's scheduled frame callback
instead of drawing synchronously whenever application effects are
flushed. Add finite rendering sessions for workloads that need to run
until explicit completion, with the goal of exposing expensive
foreground work and rendering stalls without artificial display waits.
## Changes
- Keep automatic drawing during effect flushing test-only. Benchmark
updates schedule frames, and the benchmark context scans existing
per-window scheduling state to deliver callbacks outside the App borrow.
- Deliver pending frames after foreground task polls and benchmark
input/workload callbacks. Nested actions and effects complete before
frame delivery.
- Add `bench_renderer_session` with fresh untimed setup, an input-turn
index, a stop flag, a deadline, and final presentation before successful
completion. Session-owned state is dropped outside measurement so it can
cancel unfinished work.
- Present setup's initial frame batch before tracing starts and activate
benchmark windows to avoid unintended inactive-window animation
throttling.
- Stop task benchmarks as soon as their result is ready, before
delivering an unrelated extra animation frame. Renderer sessions
separately retain their final-presentation guarantee.
## Scheduling and scope
This is an **unpaced work-and-render benchmark**, not a simulation of
display latency or an OS event loop. Renderer input turns service up to
the initial ready-task count, delivering frames between polls; rendering
after a poll does not inject another input. The report's FPS affects
reporting only, not execution. Individual task polls and frame callbacks
cannot be preempted, so an external process timeout is still needed for
work that never returns.
This is the second part of the benchmark split following #64099, which
has merged. Expanded timing/attribution reporting, intermediate-texture
reuse, and native event-loop integration are deferred.
## Validation
Passed after merging current `main`:
- `corgi fmt -p gpui -- --check`
- `corgi check -p gpui --features bench-support --lib`
- `corgi check -p gpui --lib`
- `git diff --check origin/main...HEAD`
This PR intentionally contains no added tests while the implementation
is being reviewed. Existing test modules are unchanged. Runtime tests
and downstream Delta smoke runs have not been performed for this
redesigned scheduling policy; checks from the earlier implementation are
not validation of this version.
Release Notes:
- N/A
## Summary
`PowerRequest::prevent_idle_sleep` passed `PowerCreateRequest` a reason
string whose UTF-16 buffer was dropped when the function returned.
`PowerCreateRequest` documents that the reason pointer must remain valid
for the lifetime of the handle, so the OS was left holding a pointer
into freed memory.
This is a use-after-free (CWE-416), a memory-safety vulnerability. The
reason string is a fixed literal rather than attacker-controlled input,
so the practical exploitability is limited; but it is a genuine
memory-safety defect and should be fixed.
Keep the UTF-16 buffer alive alongside the handle.
## The bug
The reason string is encoded into a local `Vec<u16>`, and a raw pointer
to its heap buffer is handed to `PowerCreateRequest`:
```rust
let mut reason = reason.encode_utf16().chain([0]).collect::<Vec<_>>();
let context = REASON_CONTEXT {
// ...
Reason: REASON_CONTEXT_0 {
SimpleReasonString: PWSTR(reason.as_mut_ptr()),
},
};
let handle = unsafe { PowerCreateRequest(&context) }?;
// ...
Ok(Self { handle }) // `reason` dropped here, freeing the buffer the handle points into
```
The pointer crosses an `unsafe` FFI boundary, so the borrow checker
cannot see that Windows retains it. When `prevent_idle_sleep` returns,
`reason` is dropped and its buffer freed while the handle still refers
to it.
## The fix
Move the UTF-16 buffer into the struct so it lives as long as the
handle:
```rust
struct PowerRequest {
handle: HANDLE,
_reason: Vec<u16>,
}
// ...
Ok(Self { handle, _reason: reason })
```
`Drop` closes the handle before fields are dropped, so the buffer is
freed only after the OS stops referencing it.
Release Notes:
- Fixed a use-after-free in Windows idle-sleep prevention that could
read freed memory.
# Objective
Heavy headless rendering benchmarks accumulated native temporary objects
across frames because they could run for a long time without an
autorelease pool draining.
This PR adds a scoped autorelease pool around each headless rendering
call so those temporary objects are released promptly. GPU submission
remains asynchronous, and image readback retains its existing completion
wait.
Release Notes:
- N/A
## Summary
Make GPUI's font suggestions reflect the platform text system's actual
font inventory, including fonts loaded by the application, rather than
appending hardcoded fallback candidates.
The appended names could be unavailable on the current platform.
The downside of this is that virtual aliases such as `.SystemUIFont`,
`.ZedMono`, and `.ZedSans` are no longer injected into suggestions;
existing settings using those aliases still resolve as before, they just
won't be shown in the settings UI anymore.
Release Notes:
- Fixed font suggestions listing unavailable fallback fonts and internal
font aliases.
Finn Evers