Pepper 1.4.0-pepper.1

Pepper is Ghostty 1.4.0 with one thing added: a program can play a video in a box of cells inside a tab, straight from the graphics chip, with no copies.

New: Ghostty 1.4.0. Pepper now follows Ghostty 1.4.0, with everything it brings (Ghostty's release notes). Video in a tab, holes for popups and Pepper's tab bar work as in 1.3.1-pepper.4. The 21 fixes Pepper took early from Ghostty's later code are all in 1.4.0, so Pepper carries none of its own now.

Fixed: "Pepper is damaged" after unzipping. Pepper.zip no longer holds hidden ._ files. On macOS 27.2, Finder's unzip can leave them inside the app, and macOS then calls it damaged, with no Open Anyway. If an earlier Pepper.zip did that for you, this one won't.

Security

What changed in the move onto 1.4.0 had a code review and a security review. The security review found nothing. The code review found one problem, fixed before release: running the app's binary for a command-line action (ghostty +edit-config) gave the editor it opened a Pepper port that went away with it. The README's Security section has the rest.

pepper-play (0.3.0) and pepper-agent (0.1.0) are the same as in 1.3.1-pepper.4.

Install

1. Download Pepper.zip below, unzip it, and drag Pepper.app to Applications (quit Pepper first, and replace the old one).
2. Open it. macOS refuses the first time, because Pepper is signed ad hoc and not notarized by Apple. Open System Settings → Privacy & Security, scroll down to the message about Pepper, and click Open Anyway.
3. To play video, install mpv (and yt-dlp, for web addresses): brew install mpv yt-dlp. Then, in a Pepper tab: pepper-play video.mp4.
4. For pepper-agent: brew install ffmpeg too, Google Chrome for web pages, and whisper.cpp to transcribe (brew install whisper.cpp).

It runs on Apple silicon Macs, and installs next to Ghostty, which keeps working as before. It reads your Ghostty config.

Pepper.zip SHA-256: e95625444f7159b61ed15d5ade1a356571ed10bb8e9b472e5c52254ee02218e0

Report a security problem privately, as SECURITY.md says.

Pepper is Ghostty, by Mitchell Hashimoto and Ghostty's contributors (MIT). Please report Pepper's problems here, not to Ghostty.

Pepper 1.3.1-pepper.4

Pepper is Ghostty 1.3.1 with one thing added: a program can play a video in a box of cells inside a tab, straight from the graphics chip, with no copies.

New: video that stays under popups. A program can now leave holes in its video box, so a popup or menu it draws over the video shows, and the video keeps playing around it, as images in the kitty graphics protocol are cut. It's still drawn by macOS with no copies. For app authors: a box takes up to 4 holes, and PEPPER_FEATURES lists holes in every Pepper shell. The escape sequence is in pepper-play's README.

New: a tab bar for macos-titlebar-style = hidden. Pepper draws its own tabs where the titlebar was. Each tab shows what goes on in it: video playing, a progress report (OSC 9;4), a bell, and with zsh integration the program running. Drag tabs to reorder them; right-click one to rename it, color it, close it or the others, or move it to a new window. It needs macOS 15 or later, and has only been tried on macOS 27 so far.

Security

The holes went through six code reviews and six security reviews of their own; the security reviews found nothing. Holes can only hide video, never show it anywhere new. A box still needs its random token, and a place with holes that don't read takes the box away rather than covering what they were for. The README's Security section has the rest. The tab bar was reviewed for code and security before it went in.

pepper-play (0.3.0) and pepper-agent (0.1.0) are the same as in 1.3.1-pepper.3.

Install

1. Download Pepper.zip below, unzip it, and drag Pepper.app to Applications (quit Pepper first, and replace the old one).
2. Open it. macOS refuses the first time, because Pepper is signed ad hoc and not notarized by Apple. Open System Settings → Privacy & Security, scroll down to the message about Pepper, and click Open Anyway.
3. To play video, install mpv (and yt-dlp, for web addresses): brew install mpv yt-dlp. Then, in a Pepper tab: pepper-play video.mp4.
4. For pepper-agent: brew install ffmpeg too, Google Chrome for web pages, and whisper.cpp to transcribe (brew install whisper.cpp).

It runs on Apple silicon Macs, and installs next to Ghostty, which keeps working as before. It reads your Ghostty config.

Pepper.zip SHA-256: 91138b9b95ae76ce2bf9768a4688219b98f7d6fc67763c56729afad8aafbd74d

Report a security problem privately, as SECURITY.md says.

Pepper is Ghostty, by Mitchell Hashimoto and Ghostty's contributors (MIT). Please report Pepper's problems here, not to Ghostty.

Pepper 1.3.1-pepper.3

Pepper is Ghostty 1.3.1 with one thing added: a program can play a video in a box of cells inside a tab, straight from the graphics chip, with no copies.

New: Pepper for AI agents. An AI coding agent (Claude Code, Codex, your own) can show you video, a cut it's editing or the web app it's building in a Pepper pane, and hear back what you point out. Open a split next to the agent (⌘D) and run pepper-agent view; the agent learns how with pepper-agent guide. pepper-agent's README has the rest.

Security

Before this release, everything Pepper adds went through a code review and a third security audit. Fixed in Pepper and pepper-play (1.3.1-pepper.2 has both problems):

• A program could leave video streams in Pepper that nothing could end, until Pepper quit, and use up its 16. A stream now ends when the program that started it exits, and one program has at most 4.
• A player trusted any process at the pid in Pepper's port name. It now checks the app's bundle id and a hello the kernel vouches for, so a quit Pepper's name, or its pid taken by another program, never gets a frame.

pepper-agent ships for the first time; the audit's 24 findings in it are fixed in this, its first release. The README's Security section lists them all.

Fixes from Ghostty's later code

Ghostty has no 1.3.x release after 1.3.1, and its next one needs a newer Zig. Pepper takes 21 of its later fixes now, 17 for security and 4 for performance (the list, with each commit). Among them:

• Links in terminal output are checked before they open. A cmd+click on a link a program printed no longer goes straight to macOS: one that would open a .command, an .app or another file that runs code, or one hiding invisible characters, is blocked ("Pepper Blocked This Link"), and a link to another app's own scheme asks first.
• Memory bugs in tmux control mode, Kitty graphics (a placement that looped 4 billion times, payloads with no size limit), search, selections, ED 22, VS15 and a closed surface; paste protection letting a carriage return through; two crashes on macOS.
• The renderer no longer rebuilds everything every frame after about 12 minutes, nor for tabs you can't see.

Also new

• A memory fix in Ghostty's renderer: custom shaders' textures are kept once per split, not once per frame in flight (1.7 GB less with two cursor shaders and five splits on a 6K screen).
• The display: a box follows its window to a display of another scale or refresh rate.
• pepper-play: told when Pepper can't take its video, it offers it again a second later; it waits for Pepper if Pepper is busy as it starts.
• New pepper-play and pepper-agent builds need this Pepper (they say hello); older players still work in it.

Install

1. Download Pepper.zip below, unzip it, and drag Pepper.app to Applications (quit Pepper first, and replace the old one).
2. Open it. macOS refuses the first time, because Pepper is signed ad hoc and not notarized by Apple. Open System Settings → Privacy & Security, scroll down to the message about Pepper, and click Open Anyway.
3. To play video, install mpv (and yt-dlp, for web addresses): brew install mpv yt-dlp. Then, in a Pepper tab: pepper-play video.mp4.
4. For pepper-agent: brew install ffmpeg too, Google Chrome for web pages, and whisper.cpp to transcribe (brew install whisper.cpp).

It runs on Apple silicon Macs, and installs next to Ghostty, which keeps working as before. It reads your Ghostty config.

Pepper.zip SHA-256: dc257fcd5c5908f3203c25d0ba0c4174e8ce17a869447105481d63b25fbf7c02

Report a security problem privately, as SECURITY.md says.

Pepper is Ghostty, by Mitchell Hashimoto and Ghostty's contributors (MIT). Please report Pepper's problems here, not to Ghostty.

Pepper 1.3.1-pepper.2

Pepper is Ghostty 1.3.1 with one thing added: a program can play a video in a box of cells inside a tab, straight from the graphics chip, with no copies.

This release fixes a security problem in pepper-play run from a shell: please update. tuitube, and other apps that drive pepper-play, were not affected.

Security fix

Run from a shell (pepper-play video.mkv), pepper-play let mpv print its status line under the video. When a file had no picture (a sound-only file, or a video that failed to decode), mpv's status line also carried the file's subtitles, printed with any escape sequences in them, with no key pressed. A crafted subtitle could change the tab's title or, with Ghostty's default clipboard-write = allow, set your clipboard. It was found by a security review of the changes since 1.3.1-pepper.1, and reproduced in a test instance.

Now, from a shell, mpv prints nothing to the terminal: pepper-play draws the status line itself, from numbers only, and subtitles and mpv's on-screen text are drawn inside the video's box (a sound-only file plays as a black box). If you can't update yet, avoid pepper-play on files or URLs you don't trust, or set clipboard-write = ask in your Ghostty config.

Also new

• Cheaper playback. pepper-play decodes on the graphics chip (--hwdec=auto-safe) and shows each frame at the display's refresh (--video-sync=display-resample), as mpv's own window can. A 1080p video at 30 fps costs about half the CPU and under half the memory of mpv playing it in its own window with the same settings; --hwdec=no and --video-sync=audio turn the defaults off. Numbers: Performance.
• Colours. Frames are tagged sRGB, so a wide-gamut display shows them as mpv's window does, no longer too saturated.
• Resizing. No new video surfaces at every size while a window is dragged; the picture never goes blank.
• Hardening in pepper-play and Pepper's video server from the same review: escaping of invisible format characters, bounds on surface memory, a kept frame that clears if a stream stalls, and more. The details are in the commits.

Install

1. Download Pepper.zip below, unzip it, and drag Pepper.app to Applications (quit Pepper first, and replace the old one).
2. Open it. macOS refuses the first time, because Pepper is signed ad hoc and not notarized by Apple. Open System Settings → Privacy & Security, scroll down to the message about Pepper, and click Open Anyway.
3. To play video, install mpv (and yt-dlp, for web addresses): brew install mpv yt-dlp. Then, in a Pepper tab: pepper-play video.mp4.

It runs on Apple silicon Macs, and installs next to Ghostty, which keeps working as before. It reads your Ghostty config.

Pepper.zip SHA-256: 2ef8f3142d1f7a880267d938fa89333fe9fc2eaa2c543f2a64387dc9258b990c

Security

Report a security problem privately, as SECURITY.md says. The README's Security section lists what the reviews found and fixed.

Pepper is Ghostty, by Mitchell Hashimoto and Ghostty's contributors (MIT). Please report Pepper's problems here, not to Ghostty.

Pepper 1.3.1-pepper.1

Pepper is Ghostty 1.3.1 with one thing added: a program can play a video in a box of cells inside a tab, straight from the graphics chip, with no copies. This is the first release.

Install

1. Download Pepper.zip below, unzip it, and drag Pepper.app to Applications.
2. Open it. macOS refuses the first time, because Pepper is signed ad hoc and not notarized by Apple. Open System Settings → Privacy & Security, scroll down to the message about Pepper, and click Open Anyway.
3. To play video, install mpv (and yt-dlp, for web addresses): brew install mpv yt-dlp. Then, in a Pepper tab: pepper-play video.mp4.

It runs on Apple silicon Macs, and installs next to Ghostty, which keeps working as before. It reads your Ghostty config.

Pepper.zip SHA-256: feba33a0f90a43eda1f35173ffe3964f87e2b2166369aa09ea4b9ac0dd1deda1

What it changes

Everything Pepper adds to Ghostty 1.3.1, and nothing else, is listed in the README: what it changes. Ghostty's updater is taken out, so Pepper doesn't update itself: new releases are here.

Security

What Pepper adds went through a strict security review before this release. It found no way for terminal output or another program to run a command, and the seven weaknesses it did find are fixed: see the README's Security section. Report a security problem privately, as SECURITY.md says.

Pepper is Ghostty, by Mitchell Hashimoto and Ghostty's contributors (MIT). Please report Pepper's problems here, not to Ghostty.