refine settings, fix text input hotkeys, reload plugins on change

Author: foxnne

assets/macos/info.plist

@@ -222,6 +222,8 @@
 				<string>xml</string>
 				<string>yaml</string>
 				<string>yml</string>
+				<string>zig</string>
+				<string>zon</string>
 				<string>zlogin</string>
 				<string>zlogout</string>
 				<string>zprofile</string>

docs/PLUGINS.md

@@ -369,6 +369,18 @@ id inside the shell's own `{config}/settings.zon`:
 }
 ```
 
+**String fields own their memory.** A `[]const u8` setting's bytes belong to the schema —
+allocated with the host allocator by `applyZon` (loading, or an external hand-edit) and by the
+settings pane's text entry through `Access.setString` — *unless* the slice is still exactly the
+default you declared, which lives in your plugin image's constant data. `Schema(T)` tests that by
+pointer identity, so it never hands a string literal to the allocator, and a persisted value that
+happens to equal the default is still schema-owned (comparisons for persistence are by content,
+so it still drops out of `settings.zon`). What this means for you: **if your settings struct has a
+string field, call `MySettings.deinit(&settings)` when you tear that value down** (plugin
+`deinit`). It resets the value to your declared defaults and is a no-op for a struct of only
+scalars/enums. Don't free a string field yourself, and don't assign one directly if you want it
+persisted — go through the settings pane or `applyZon`, or you'll leak the schema's copy.
+
 Author fields live under `.settings` so they can never collide with the shell-reserved
 `.enabled`. Only fields that differ from `T`'s own declared defaults are written; an all-default
 value removes that plugin's `.settings` (and if also disabled, the whole `.plugins.<id>` entry).

docs/PLUGIN_MANIFEST_PLAN.md

@@ -390,7 +390,13 @@ const DevInstall = struct {
         const src = self.lib.getEmittedBin().getPath2(b, step);
         const dest = try std.fs.path.join(b.allocator, &.{ dir, self.file_name });
         const data = try std.Io.Dir.cwd().readFileAlloc(io, src, b.allocator, .limited(512 * 1024 * 1024));
-        try std.Io.Dir.cwd().writeFile(io, .{ .sub_path = dest, .data = data });
+        // Sibling temp file + rename, not a truncating write onto `dest`: a running fizzy may be
+        // reading `dest` right now (`PluginLoader.stableLoadCopyPath` copies from it), and on
+        // Windows a plain overwrite of a file the editor still has open fails outright. The rename
+        // also means a crash mid-write never leaves a half-written dylib at the load path.
+        const tmp = try std.fmt.allocPrint(b.allocator, "{s}.part", .{dest});
+        try std.Io.Dir.cwd().writeFile(io, .{ .sub_path = tmp, .data = data });
+        try std.Io.Dir.renameAbsolute(tmp, dest, io);
         std.log.info("fizzy: installed plugin → {s}", .{dest});
     }
 };

sdk/plugin_sdk.zig

@@ -67,8 +67,8 @@ pub const open_with_only_extensions = [_][]const u8{
     ".ts",   ".tsx",           ".txt",          ".vb",       ".vue",
     ".wxi",  ".wxl",           ".wxs",          ".xaml",     ".xcodeproj",
     ".xcworkspace", ".xhtml",  ".xml",          ".yaml",     ".yml",
-    ".zlogin", ".zlogout",     ".zprofile",     ".zsh",      ".zshenv",
-    ".zshrc",
+    ".zig",  ".zon",           ".zlogin",       ".zlogout",  ".zprofile",
+    ".zsh",  ".zshenv",        ".zshrc",
 };
 
 pub const ExtAssoc = struct {

src/backend/file_assoc.zig

@@ -9,16 +9,19 @@
 //!      thing the child touches that needs it crashes or hangs. `posix_spawn` doesn't
 //!      duplicate the caller's address space or thread state at all, so this hazard class
 //!      doesn't apply regardless of which thread calls it.
-//!   2. Every `std.process.spawn`/`.run` call unconditionally walks the process's raw
-//!      `environ` array (`Io.Threaded.scanEnviron`, "for PATH" — even when argv[0] is already
-//!      an absolute path and doesn't need PATH resolution at all), and that array is
-//!      apparently malformed specifically when fizzy is launched via Velopack's installer
-//!      auto-open right after install (a spurious NULL entry before the array's declared
-//!      end) — crashing with an unwrap-null panic. There is no public option on
-//!      `std.process.spawn`/`.run` to skip that scan. This implementation never reads the
-//!      live `environ` array at all — the child's environment is built from individual
-//!      `getenv()` lookups for a known set of keys, which degrade gracefully (stop at
-//!      whatever they find) rather than crash on the same malformed data.
+//!   2. Every `std.process.spawn`/`.run` call walks the `environ` array *as captured at
+//!      startup* — `std.start` records `envp` plus its length once, and `Environ`'s block
+//!      builders then index that slice up to the recorded length. But libc's `unsetenv`
+//!      shrinks the live array **in place**: entries shift down and the array gets a NULL
+//!      one slot earlier, while the captured length stays put. So a single `unsetenv`
+//!      anywhere in the process — SDL, a plugin dylib, a system framework — leaves the
+//!      captured slice with a NULL before its end, and the *next* spawn from anywhere
+//!      unwraps it and segfaults the whole app. (Reproduced standalone: capture at startup,
+//!      `unsetenv` one inherited variable, `std.process.run` → SIGSEGV in
+//!      `Environ.createPosixBlock`.) There is no public option on `std.process.spawn`/`.run`
+//!      to skip that walk. This implementation never reads the `environ` array at all — the
+//!      child's environment is built from individual `getenv()` lookups for a known set of
+//!      keys, which is unaffected by the in-place shuffle.
 //!
 //! Returns a normal `std.process.Child` — its `wait`/`kill` are plain POSIX
 //! `waitpid`/`kill` calls with no dependency on how the child was spawned, so callers use it

src/core/darwin_spawn.zig

@@ -12,9 +12,14 @@
 //! already order correctly.
 //!
 //! Matching is case-insensitive until the query itself contains an uppercase character
-//! ("smart case"), the convention every interactive fuzzy finder uses: `readme` finds `README`,
-//! but `README` no longer finds `readme.txt`. zf's own default is case-sensitive, which is the
-//! wrong default for a filter box.
+//! ("smart case"), the convention every interactive fuzzy finder uses: `readme` finds `README`.
+//! zf's own default is case-sensitive, which is the wrong default for a filter box.
+//!
+//! Smart case here *prefers* an exact-case match rather than requiring one: a candidate that only
+//! matches case-insensitively still matches, it just ranks behind every exact-case hit (see
+//! `case_fallback_penalty`). Strict smart case makes a mixed-case query silently return nothing —
+//! `Cl` would not find `CLAUDE.md`, because the `l` is upper there — which reads as a broken
+//! filter box rather than a precision feature.
 const std = @import("std");
 const zf = @import("zf");
 
@@ -67,15 +72,22 @@ pub const Options = struct {
     plain: bool = true,
 };
 
+/// Added to the score of a candidate that only matched once case was ignored, so exact-case hits
+/// always sort ahead of them. Far larger than any rank zf produces for a realistic label or path
+/// (those are single or double digits), so the two form clean bands rather than interleaving.
+pub const case_fallback_penalty: f64 = 1000;
+
 /// Score `haystack` against `query`. Null means "no match" — the candidate should be dropped,
 /// not merely sorted last. **Lower is better**; an empty query scores everything 0.
 pub fn score(haystack: []const u8, query: *const Query, opts: Options) ?f64 {
     if (query.isEmpty()) return 0;
     if (haystack.len == 0) return null;
-    return zf.rank(haystack, query.tokens(), .{
-        .case_sensitive = query.case_sensitive,
-        .plain = opts.plain,
-    });
+    if (query.case_sensitive) {
+        if (zf.rank(haystack, query.tokens(), .{ .case_sensitive = true, .plain = opts.plain })) |s| return s;
+        const relaxed = zf.rank(haystack, query.tokens(), .{ .case_sensitive = false, .plain = opts.plain }) orelse return null;
+        return relaxed + case_fallback_penalty;
+    }
+    return zf.rank(haystack, query.tokens(), .{ .case_sensitive = false, .plain = opts.plain });
 }
 
 /// Best (lowest) score across several fields of one candidate — a store row matching on any of
@@ -99,8 +111,12 @@ pub fn matches(haystack: []const u8, query: *const Query, opts: Options) bool {
 /// `highlight_buf_len` unless you know better. Returns empty for an empty query.
 pub fn highlight(haystack: []const u8, query: *const Query, buf: []usize, opts: Options) []const usize {
     if (query.isEmpty() or haystack.len == 0) return &.{};
+    // Mirror `score`'s smart-case fallback, or a candidate that only matched with case ignored
+    // would come back with no (or partial) highlights.
+    const case_sensitive = query.case_sensitive and
+        zf.rank(haystack, query.tokens(), .{ .case_sensitive = true, .plain = opts.plain }) != null;
     return zf.highlight(haystack, query.tokens(), buf, .{
-        .case_sensitive = query.case_sensitive,
+        .case_sensitive = case_sensitive,
         .plain = opts.plain,
     });
 }
@@ -158,7 +174,29 @@ test "smart case" {
     var upper = Query.init("README");
     try testing.expect(upper.case_sensitive);
     try testing.expect(matches("README", &upper, .{}));
-    try testing.expect(!matches("readme.txt", &upper, .{}));
+    // Case still only ranks — a wrong-case candidate matches, behind every exact-case one.
+    try testing.expect(matches("readme.txt", &upper, .{}));
+    try testing.expect(score("README", &upper, .{}).? < score("readme.txt", &upper, .{}).?);
+}
+
+test "a mixed-case query still finds an all-caps candidate" {
+    var q = Query.init("Cl");
+    try testing.expect(q.case_sensitive);
+    try testing.expect(matches("CLAUDE.md", &q, .{ .plain = false }));
+
+    // ...and it is highlighted, not left blank by the case-sensitive pass.
+    var buf: [highlight_buf_len]usize = undefined;
+    const hits = highlight("CLAUDE.md", &q, &buf, .{ .plain = false });
+    try testing.expectEqualSlices(usize, &.{ 0, 1 }, hits);
+}
+
+test "exact-case hits band ahead of case-folded ones" {
+    var q = Query.init("Cl");
+    const exact = score("src/Client.zig", &q, .{ .plain = false }).?;
+    const folded = score("CLAUDE.md", &q, .{ .plain = false }).?;
+    try testing.expect(exact < case_fallback_penalty);
+    try testing.expect(folded >= case_fallback_penalty);
+    try testing.expect(exact < folded);
 }
 
 test "scattered characters match, missing ones do not" {

src/core/fuzzy.zig

@@ -1,10 +1,11 @@
 //! Watches open on-disk documents for external changes while fizzy is running.
 //!
 //! Thin adapter over [`neurocyte/nightwatch`](https://github.com/neurocyte/nightwatch): each
-//! tracked path gets its own `watch(path)`. Nightwatch owns the background thread; this layer
-//! only implements its `Handler` (atomic flag + `backend.refresh()`, never file content /
-//! `dvui.io` / a shared allocator from the callback) and a ~200ms coalesce on the main thread
-//! via `tick`.
+//! tracked path gets its own `watch(path)` on a `doc_variant` watcher (see that decl — the
+//! variant choice is load-bearing for single-file watches). Nightwatch owns the background
+//! thread; this layer only implements its `Handler` (atomic flag + `backend.refresh()`, never
+//! file content / `dvui.io` / a shared allocator from the callback) and a ~200ms coalesce on
+//! the main thread via `tick`.
 //!
 //! On a real external change (content hash differs from the baseline captured at open / after
 //! our own save):
@@ -54,12 +55,27 @@ by_id: std.AutoHashMapUnmanaged(u64, Entry) = .empty,
 /// normalized path → doc id (event matching). Path keys are borrowed from `Entry.path`.
 by_path: std.StringHashMapUnmanaged(u64) = .empty,
 
+/// The nightwatch variant to drive open-document watching.
+///
+/// **Not `Default`.** We watch individual *files*, and on the BSD/macOS `.kqueue` variant a
+/// regular-file path silently lands in the directory watch map: its `NOTE_WRITE` is routed to
+/// `scan_dir`, which no-ops on a non-directory, so the write is dropped and no handler event
+/// ever fires. `.kqueuedir` `fstat`s the path at `add_watch` time and emits real-time
+/// `.modified` for regular files — the case nightwatch's README calls out as the supported way
+/// to watch single files. Its directory-tree trade-off (mtime-diff scans miss pure content
+/// writes) doesn't apply to us: we only ever pass file paths.
+const doc_variant: if (have_impl) @import("nightwatch").Variant else void = switch (builtin.os.tag) {
+    .macos, .freebsd, .openbsd, .netbsd, .dragonfly => .kqueuedir,
+    else => if (have_impl) @import("nightwatch").default_variant else {},
+};
+
 const Impl = if (have_impl) struct {
     const nightwatch = @import("nightwatch");
-    const Handler = nightwatch.Default.Handler;
+    const Watcher = nightwatch.Create(doc_variant);
+    const Handler = Watcher.Handler;
 
     handler: Handler = .{ .vtable = &vtable },
-    nw: ?nightwatch.Default = null,
+    nw: ?Watcher = null,
     raw_dirty: ?*std.atomic.Value(bool) = null,
 
     const vtable = Handler.VTable{
@@ -97,9 +113,8 @@ pub fn init(gpa: Allocator) DocumentWatcher {
 /// as `SettingsWatcher.start` — nightwatch retains `&self.impl.handler`).
 pub fn start(self: *DocumentWatcher) !void {
     if (comptime !have_impl) return error.Unsupported;
-    const nightwatch = @import("nightwatch");
     self.impl.raw_dirty = &self.raw_dirty;
-    var nw = try nightwatch.Default.init(dvui.io, self.gpa, &self.impl.handler);
+    var nw = try Impl.Watcher.init(dvui.io, self.gpa, &self.impl.handler);
     errdefer nw.deinit();
     self.impl.nw = nw;
 }