Ghosttea 0.13.2

Ghosttea is a native Ghostty-powered terminal runtime and desktop experience for Electron applications.

This release publishes 10 npm packages and 7 Rust crates under one shared version.

Fixed

• The prebuilt ghosttead daemons build against ctutils 0.4.5, which fixes
  RUSTSEC-2026-0385 (non-constant-time mask generation and u128
  comparisons) in the digest crates under the Truffle mesh transport, sha2 and
  hmac.
• They also build against tokio 1.53.3, which fixes RUSTSEC-2026-0386: tokio's
  safe AsyncFd constructors accept a file descriptor the caller does not own.
  Neither Ghosttea nor truffle-core calls them. Crates.io consumers resolve
  their own versions.

Validation

• The lifecycle soak's Windows handle bound divides the growth since its
  baseline by every session churned since then, not by one round's sessions.
  The weekly schedule read the documented one retained handle per session as
  2.00 at its second round and failed against the 1.25 allowance every week.
  It now reads 1.00 at every round, and a regression past the known handle
  still fails. This changes the witness, not runtime behavior.

Packages

npm:

• @vibecook/ghosttea
• @vibecook/ghosttea-client
• @vibecook/ghosttea-electron
• @vibecook/ghosttea-frame
• @vibecook/ghosttea-native-tabs
• @vibecook/ghosttea-protocol
• @vibecook/ghosttea-react
• @vibecook/ghosttead
• @vibecook/ghosttead-darwin-arm64
• @vibecook/ghosttead-win32-x64

crates.io:

• ghosttea
• ghosttea-config
• ghosttea-core
• ghosttea-text
• ghosttea-truffle
• ghosttea-vt
• ghosttea-vt-sys

Publish order is a dependency order rather than this one; it is recorded in PUBLISHING.md.

Requirements

Node 22+ and Rust 1.88+. Native Ghostty VT artifacts are published for aarch64-apple-darwin and x86_64-pc-windows-msvc.