The 1-KiB Tax: Ghostty 1.4 Found the Kernel Limit Throttling Your macOS Terminal — and Rewrote the Engine Around It

Published: October 28, 2026 | Reading Time: ~11 minutes | Channel: techminute

---

Yesterday, while the tech internet was arguing about Apple's touchscreen MacBook, the number one story on Hacker News was a terminal emulator. Not an AI model, not a funding round — a terminal emulator. Ghostty 1.4 sat at the top of the front page with 1,152 points and 366 comments as of this morning, comfortably ahead of Google DeepMind's Genie 4 world-simulation model.

That sounds absurd until you look at what's inside the release. The headline number: cat-ing a 150 MB text file on macOS went from 1.5 seconds to 566 milliseconds. The reason is genuinely novel engineering: the Ghostty team discovered that the macOS kernel silently caps every read from a pseudo-terminal at roughly 1 KiB, no matter how big your read buffer is — and no other terminal project had ever published a workaround. Then there are the ten security advisories, several of which read like a threat model written specifically for the age when AI agents live inside your shell.

This is a deep dive into a release that most coverage will summarize as "terminal gets faster." The reality is more interesting: it's the first major terminal release engineered around the fact that, in 2026, the busiest writer in your terminal is probably not a human.

---

The Context: What Led to This

Ghostty is the terminal emulator built by Mitchell Hashimoto — co-founder of HashiCorp — as a non-profit, MIT-licensed project written in Zig. It first launched to the public in late 2024 and has since become one of the most-starred terminal projects on GitHub: 62,816 stars, 3,752 forks, and 255 open issues per the GitHub API this morning, with the last push to main landing just hours before this article. Its pitch has always been a little contrarian: GPU acceleration everywhere, but native UI on every platform — Swift and AppKit on macOS, GTK on Linux — rather than one lowest-common-denominator cross-platform shell.

The project's deeper bet is libghostty: the idea that terminal emulation should be a reusable, embeddable library rather than something every IDE, web console, and SSH client reinvents badly. Hashimoto himself has framed the Ghostty app almost as a demonstration of the library. On Hacker News this week, the top comment threads spent as much time discussing libghostty as the release itself — one popular comment argued the "pure reusable terminal state machine" is the project's real contribution, with IDEs and web consoles as the eventual beneficiaries.

The 1.4 release represents seven months of work from 172 contributors across 2,889 commits. The maintainers note, with visible pride, that the release notes were hand-crafted by humans and took a combined 16+ hours to write — a nice, quiet contrast with the AI-generated changelogs flooding other ecosystems.

And the timing is not accidental relevance. Over the past year, the terminal has quietly become the primary display device for coding agents. Ask a Claude Code or OpenCode user where their agent lives, and the answer is a terminal pane spewing thousands of lines of diffs, logs, and tool output per minute. One Hacker News commenter this week described the exact failure mode that drove them to switch: macOS Terminal would fall behind rendering their coding agent's output, sometimes stalling entirely mid-response, and Ghostty "has been flawless" in the nine months since the switch. (Another commenter notes a Ghostty memory leak that could cause similar symptoms was since found and fixed — community-sourced anecdotes, but the pattern is telling.)

Terminals in the agentic era are high-throughput, adversarial display devices. Ghostty 1.4 is the first big release designed explicitly for that reality — in its performance budget, its graphics protocol support, and especially its security advisories.

---

The 1-KiB Discovery: Where the Speed Came From

The biggest performance win in Ghostty 1.4 started as a bug report that turned into a discovery. From the release notes, verbatim:

"on macOS, the kernel caps every read from a pty at about 1 KiB no matter how large the read buffer is. Previously, Ghostty processed each read as it arrived, so per-read overhead was paid every kilobyte, and the program writing output sat blocked while we parsed."

Read that again: for however long macOS has existed, every terminal emulator on the platform has been paying syscall-and-parse overhead per kilobyte, because the kernel delivers pty data in tiny slices — and every terminal treated each slice as a unit of work. The writing process blocks while the terminal parses; the terminal parses while the writing process waits. A decade of micro-optimizations in renderers and font rasterization, and the whole pipeline was bottlenecked on a kernel read granularity nobody had bothered to publicize.

Ghostty 1.4's fix is architectural rather than heroic: drain the pty on one thread, parse on another. The writing process keeps writing; parsing keeps up in parallel. The result on an M4 Max with plain and Unicode text: end-to-end I/O throughput up 25% to 55% over Ghostty 1.3.x.

On top of that, the VT parser itself got substantially faster:

Metric	Ghostty 1.3.x	Ghostty 1.4	Change
Plain ASCII parse throughput	128 MB/s	725 MB/s	5.7x
CJK text parsing	—	—	3.4x faster
Real-world corpus (2.6 GB of asciinema recordings)	—	—	~25% faster
cat 150 MB file on macOS	1.5 s	566 ms	2.65x end-to-end
Resize with 10,000-line scrollback	—	—	~6x faster
Terminal lock held per frame (rendering)	—	—	2.7x–11x less
Copy/search formatting	—	—	1.5x–8x faster
Launch → first rendered frame (macOS)	—	—	27% faster
OSC 52 clipboard payload parsing	—	—	~30x faster

(The release notes' Highlights section says the asciinema corpus is "about 25% faster"; the changelog entry says ~24%. Same page, tiny discrepancy — the kind of honesty you get when humans write changelogs.)

One honesty note before anyone screenshots this table into a flame war: every number above is Ghostty 1.4 versus Ghostty 1.3.x, self-reported by the project. The release contains no head-to-head benchmarks against Kitty, Alacritty, WezTerm, or iTerm2. "5.7x faster parser" is a claim about the release, not a claim that Ghostty is the fastest terminal — the HN comment section duly contains users who still prefer Alacritty or Ptyxis for their own reasons.

---

Memory: The Other Half of the Story

Speed is only half the release. The other half is that Ghostty 1.4 got dramatically cheaper to run, via a mechanism that's overdue in terminal design: scrollback compression.

The mechanics, from the release notes: scrollback pages that aren't currently visible are transparently compressed while the terminal is idle, and decompressed on demand when you scroll back or search. For typical text-heavy history, physical memory for scrollback drops 70% to 90%. Compression is only active on macOS and 64-bit Linux, and the notes are refreshingly precise about what it does and doesn't do: it lowers resident memory, not virtual memory, and it doesn't touch I/O throughput.

The payoff: the default scrollback limit has been raised from 10 MB to 50 MB per terminal, and a full 50 MB of compressed scrollback generally uses less physical memory than the old 10 MB uncompressed limit did. Five times the history, for less RAM.

The rest of the memory ledger:

• A brand-new, empty terminal now uses about 16 KiB of terminal page memory on macOS, down from 128 KiB in 1.3.1.
• Memory freed by clearing or trimming scrollback is now returned to the OS immediately, instead of being hoarded until the terminal closes.
• Hidden tabs release their GPU resources: the project's own measurement with one visible tab and 20 hidden tabs shows GPU memory dropping from about 385 MiB to 18 MiB, with rebuilds taking under a millisecond when you switch back.

That last one will resonate with anyone who runs the agentic workflow this release seems aimed at: a dozen project tabs, each holding an agent session, all open all day. Pre-1.4, every hidden tab kept its GPU allocations warm. Post-1.4, twenty hidden tabs cost you less GPU memory than one.

---

Kitty Graphics: First to 100% Outside Kitty

The flashiest feature for terminal nerds: Ghostty 1.4 is now the first terminal outside Kitty itself to implement 100% of the published Kitty graphics protocol specification, including the two big features it previously lacked — animation and relative placements.

In practice: animated GIFs displayed via kitten icat now actually animate inside Ghostty instead of freezing on a single still frame, animations pause when the terminal isn't visible, and a child image can be positioned relative to another image's placement so composites move together. The team also ran a full conformance pass against the spec and Kitty itself, fixing dozens of behavioral differences — images now scroll correctly inside scroll regions, retransmitting an image ID replaces the old image, and invalid image data gets an error response instead of silence that could hang clients.

Why does a graphics protocol matter for the agentic era? Because it's the plumbing that lets programs running in a terminal — including agents — render charts, diagrams, screenshots, and diffs-as-images without leaving the session. A terminal that speaks the full Kitty protocol is a terminal that can be a first-class graphical surface, not just a grid of glyphs.

Performance came along too: Kitty graphics payloads are now parsed in bulk with SIMD instead of byte-at-a-time, making large image transfers about 16x faster to parse in the project's benchmark (64 MiB of image data, x86_64 Linux).

Ghostty also implemented the Kitty clipboard protocol (OSC 5522) on macOS and GTK — programs can now read and write structured clipboard content like images and HTML, with permission prompts on reads (including a preview of what you're about to hand over) and a configurable 64 MiB write limit.

---

Security: Ten Advisories Written for the Agent Era

Here's the section that elevates this release from "nice update" to "important." Ghostty 1.4 ships with ten security advisories — four macOS-specific, six cross-platform. The project requested CVE numbers weeks ago; GitHub hasn't assigned them yet, so they're published as GHSA advisories. A few deserve highlighting, because they map almost one-to-one onto how people actually get pwned in 2026:

1. Paste protection bypass (GHSA-4hwh-wx3w-3fqg). Paste protection didn't treat carriage returns as line endings, so in programs that don't use bracketed paste, a crafted paste could execute a command without showing you the confirmation prompt. The classic "copy command from a website, paste into terminal" attack, minus the warning dialog.

2. Malicious terminal output can attack you (GHSA-mhff-mv4q-fp63). Malicious Kitty graphics commands — merely displayed, no interaction needed — could crash Ghostty, force huge allocations, or in limited cases read or delete files outside the allowed temporary directories. If your agent renders untrusted content in the terminal, the display surface is an attack surface.

3. The cloned-repo clipboard heist (GHSA-2r63-vmw6-3m3c). A crafted directory name could make Ghostty's zsh shell integration send arbitrary escape sequences when you cd into it — including silently replacing your clipboard via OSC 52. Bash was affected in a more limited way. Think about that threat model: you clone a repository from the internet, cd into it, and its directory name can rewrite your clipboard. That is a prompt-injection-adjacent attack delivered by a filename.

4. macOS hyperlink command execution (GHSA-cw69-wm67-5pv8 and companions). Cmd-clicking a crafted OSC 8 hyperlink could open unsafe local files or custom URL schemes, "leading to arbitrary command execution." Two more macOS advisories cover the link-detector path, drag-and-drop text skipping paste protection, and filenames containing control characters running a different command than the one shown in the confirmation dialog.

5. Remote panic (GHSA-hcr9-7hcr-mjm8). Malicious terminal output could crash Ghostty via tmux control mode — tmux doesn't even need to be installed — closing every window. All your panes, gone, from one hostile output stream.

Just as telling is what Ghostty didn't enable. Two newly supported sequences — the xterm window-resize request (CSI 8 t) and the DECRQCRA screen checksum report, which can be used to read screen contents — are disabled by default, with the release notes explicitly citing "untrusted programs, including ones running on a remote machine" as the reason. That sentence is the terminal-emulator equivalent of a sandbox policy. The threat model — code you didn't write, running where you can't see it, able to whisper escape sequences at your display layer — is precisely the agentic threat model this channel has covered from OpenAI's sandbox escapes to the resumé prompt-injection underground. Ghostty is building the terminal as if that threat model is the default. It is.

One more for the standards nerds: 1.4 parses the new OSC 7501 program status protocol — which lets programs report whether they're idle, working, done, blocked, or failed — a spec the release notes describe as "the first terminal specification pioneered by the Ghostty project." The GUI ignores it for now. When terminals start surfacing "your agent is blocked" in the tab bar, this is the seed it grows from.

---

ghostty +ssh: Terminfo for the Remote Agent Fleet

The feature with the quietest name and possibly the biggest practical payoff: ghostty +ssh, a drop-in wrapper around ssh (alias ssh='ghostty +ssh --' and every connection benefits).

What it does, mechanically: before connecting, it installs Ghostty's terminfo on the remote host so the session can use the proper xterm-ghostty TERM value, and forwards COLORTERM, TERM_PROGRAM, and TERM_PROGRAM_VERSION. If the terminfo install fails — say, tic isn't available on the remote — it degrades gracefully to TERM=xterm-256color instead of leaving you with a broken-looking terminal. The terminfo cache is keyed per host and port (two machines behind one NAT no longer collide), reinstalls automatically when Ghostty updates change the terminfo, and no longer needs infocmp or Ghostty's terminfo present on your local machine. The shell-integration variants of this logic that had been duplicated across bash, zsh, fish, elvish, and Nushell now all funnel through the same +ssh action.

Why this belongs in the agent story: remote development — and increasingly, remote agents running on rented GPU boxes — is where terminal fidelity goes to die. Every SSH session that renders wrong colors or mangled keybindings is a terminfo mismatch. Making ssh itself carry the terminal's capabilities to the remote host, with sane fallback, is infrastructure work that only matters once you're juggling a fleet. Ghostty clearly expects its users to be.

---

The Linux Side: A New Renderer, and One Casualty

Linux users get the biggest architectural change: a completely rebuilt rendering pipeline. The GTK app no longer renders through GtkGLArea; instead, the renderer draws with EGL on its own thread, exports each frame as a DMABUF, and hands it to GTK for display. Rendering is triple-buffered, no OpenGL calls run on the main thread anymore, and — the user-visible payoff — text is crisp under fractional scaling (125%, 150%) for the second time; the long-standing blurriness bug (issue #1938) had been fixed once before and regressed via upstream GTK changes. On drivers that can't export DMABUFs, Ghostty falls back to CPU frame copies: slower, but functional.

There's also split drag-and-drop on GTK (matching macOS 1.3), background blur on Niri, and Wayland global keybinds now going through the vicinae-hotkey-v1 protocol on Hyprland 0.56+ and the desktop portal elsewhere.

The casualty: Ghostty 1.4 requires GTK 4.18 and libadwaita 1.7, up from 4.14/1.5 — and Ubuntu 24.04 LTS doesn't meet that bar, so native builds exit at startup on older libraries. It's FOSS confirmed the break and the workarounds: use an older Ghostty version or the Flatpak. Ubuntu 24.04 remains one of the most-deployed desktop/server Linux releases on the planet, so this is a real (if transitional) cost of the fast GTK treadmill — the maintainers are following their documented GTK version policy rather than pinning to LTS baselines. Packaging is split accordingly: official binaries for macOS only, with Arch, NixOS, Alpine, Gentoo, openSUSE, and Ubuntu 26.04 carrying native packages plus community DEB/AppImage/Snap builds.

And one roadmap item that barely made headlines: per It's FOSS, the project has dropped Windows GUI support from its roadmap, pointing Windows users downstream to libghostty and libghostty-vt — the embeddable core libraries, which are already built for Windows. Translation: no Ghostty app for Windows, but Windows tools can embed Ghostty's terminal engine. Given how many Windows terminals already embed other emulators' cores, that's a coherent strategy — the app was always the demo; the library is the product.

---

The Caveats Section, Because There Always Is One

1. All benchmarks are self-reported and version-relative. Every performance figure is 1.4 vs. 1.3.x, measured by the project itself. Impressive engineering, but treat "5.7x" as internal progress, not a market ranking.
2. Ubuntu 24.04 LTS is excluded from native builds — a meaningful chunk of the installed Linux base will need Flatpak or distro backports.
3. Breaking changes are real. On macOS, copy-on-select now defaults to none — selecting text no longer copies it anywhere, and middle-click paste of the selection stops working unless you opt back in. scrollback-limit is renamed scrollback-limit-bytes. GTK's ctrl+shift+page_up/down now move tabs instead of jumping prompts. Read the migration notes before upgrading a heavily customized config.
4. Ten security fixes means ten attack vectors that existed in 1.3.x, including two affecting only display of malicious output. If you run 1.3.x and paste things from the internet into your terminal, upgrade yesterday.
5. CVE numbers are still pending from GitHub — the GHSA links are live, the CVE IDs aren't.
6. The macOS 13 (Ventura) floor survives this release, but only just: the team had previously announced 1.4 would require macOS 14, reversed course, and explicitly plans to drop macOS 13 "in a future release." Apple ended security support for macOS 13 in fall 2025.

---

What This Changes

Zoom out, and Ghostty 1.4 matters for three reasons beyond the changelog.

First, it documents a kernel behavior nobody else had. The ~1 KiB pty read cap and the drain-on-one-thread-parse-on-another architecture are now public knowledge, with benchmark receipts. Expect other emulators to quietly grow similar pipelines over the next year — that's how open source is supposed to work, and it's why the release notes being human-written and data-rich matters more than it sounds.

Second, it hardens the terminal for software you didn't write. Ten advisories covering pastes, filenames, hyperlinks, and display-only attacks — plus two escape sequences shipped disabled-by-default specifically because remote programs might abuse them — add up to a terminal that treats its input as hostile by default. In an era when the thing typing into your terminal is increasingly an agent following instructions it scraped from a web page, that's not paranoia. It's requirements.

Third, it keeps pushing libghostty as the reusable terminal core — the "boring infrastructure" bet that the HN thread spent hundreds of comments debating. If it pays off, the terminal emulation layer underneath your IDE, your web console, and your agent harness converges on one well-tested, fuzzed, conformance-checked implementation, the way everything eventually converges on one parser for everything else. The esctest conformance suite now running in Ghostty's CI is the kind of unglamorous investment that makes that convergence safe.

---

🎯 The Bottom Line

Ghostty 1.4 is the rare infrastructure release that's exciting for what it found — a kernel-level read cap that every macOS terminal has been paying for, unpublicized, since forever — and for what it refuses to do, like let a directory name rewrite your clipboard or let remote code resize your window by default. The terminal spent thirty years as the last dumb rectangle in computing; releases like this are what it looks like when someone engineers it, deliberately, for the era where the busiest thing in it isn't human.

Upgrade, alias your ssh, read the breaking changes — and if you're still pasting install scripts from the internet into a 1.3.x terminal, this release is your intervention.

---

📚 Sources

1. Ghostty 1.4.0 Official Release Notes — Primary source: release date, contributors/commits, all benchmarks, all ten security advisories (GHSA IDs), pty read-cap discovery, ghostty +ssh, GTK requirements, breaking changes. https://ghostty.org/docs/install/release-notes/1-4-0
2. GitHub API — ghostty-org/ghostty — 62,816 stars, 3,752 forks, MIT license, Zig, pushed 2026-10-28T03:42:07Z. https://api.github.com/repos/ghostty-org/ghostty
3. Mitchell Hashimoto on X — Creator's release announcement. https://x.com/mitchellh/status/2115124583170974193
4. Hacker News discussion (1,152 points / 366 comments at time of writing) — Community reception, libghostty debate, Claude Code rendering anecdotes (labeled community-sourced). https://news.ycombinator.com/item?id=50261998
5. It's FOSS — "Ghostty 1.4 Arrives After 7 Months of Development" — Ubuntu 24.04 native-build break, Windows GUI roadmap change, Wayland details, packaging landscape. https://itsfoss.com/news/ghostty-1-4-release/
6. Reddit r/linux release thread — Community reaction incl. tmux image-viewing fix (labeled community-sourced). https://www.reddit.com/r/linux/comments/1xh1bet/ghostty_140_released_after_7_months_of/

All claims verified against Gold-tier sources (official Ghostty release notes scraped in full twice, GitHub API pulled live) and Silver-tier coverage (It's FOSS, scraped in full). Community sentiment from Hacker News and Reddit is labeled as such. All performance figures are project-reported Ghostty 1.4 vs 1.3.x comparisons; no cross-terminal benchmark claims are made. Last verified: October 28, 2026.