A name shows its own backslash as \\, and a terminal tag never carries a raw newline

With `\n` for a newline and `\xNN` for a bad byte, a name holding a
backslash and an n read back as one holding a newline. Names in /index,
the log and a terminal's tag now double their own backslashes; and a
terminal's directory with a newline no longer breaks its tag.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

4 files changed, 44 insertions, 13 deletions

diff --git a/docs/fs.md b/docs/fs.md
index c3c42d0d..72789182 100644
--- a/docs/fs.md
+++ b/docs/fs.md
@@ -100,7 +100,8 @@ Existing Plan9port/v9fs clients need a userspace bridge for QUIC.
 ```
 /README      this guide, also src/fs-help.txt
 /index       one line per pane: serial, kind (text|term|pdf|image), dirty flag, name, column serial
-             (the name as the log shows it: one line of UTF-8, a newline in it `\n`)
+             (the name as the log shows it: one line of UTF-8, a newline in it `\n`,
+             a backslash `\\`, a byte not UTF-8 `\xNN`)
 /status      pid, version and pane count
 /look        write a line: a right click on it at the active pane; read: the serials the last
              look, exec or ctl write touched (made, else acted at)
@@ -834,9 +835,10 @@ takes \`follow\` or \`follow new\``, `invalid write: this pane has no
 text`), never a bare `Invalid argument`.
 Control characters, DEL and C1 controls (U+0080-U+009F) in a record become
 spaces, and a byte that is not UTF-8 is written `\xNN`, so a record is one
-line of UTF-8; a pane's name, in a record and in `/index` alike, shows a
-newline in it as `\n` rather than a space, so a directory named with one
-reads back as what it is.
+line of UTF-8; a pane's name, in a record, in `/index` and in a terminal's
+tag alike, shows a newline in it as `\n` rather than a space and its own
+backslash as `\\`, so a directory named with a newline and one named
+with a backslash and an `n` read back differently, as what they are.
 (An `event` record is not: acme's `<origin><action><q0> <q1> <flag> <n>
 <text>\n`, whose text may hold newlines. The origin is `E` (a 9P write to body or tag), `F` (other
 files, the editor's own lines), `K` (the keyboard) or `M` (the mouse); the
diff --git a/src/ninep/ctl.zig b/src/ninep/ctl.zig
index 2958fc38..2b256b1e 100644
--- a/src/ninep/ctl.zig
+++ b/src/ninep/ctl.zig
@@ -1999,6 +1999,13 @@ test "/index shows a name as the log does: a newline in it is \\n, controls spac
     try testing.expect(std.mem.indexOf(u8, index, "/tmp/two\\nlines \\xff ") != null);
     try testing.expectEqual(@as(usize, 1), std.mem.count(u8, index, "\n"));
     try testing.expectEqual(@as(u64, index.len), call(p, .{ .tag = 1, .op = .getattr, .node = @intFromEnum(tree.TopFile.index) }).reply.attr.size);
+    // Its tag never carries the raw newline either.
+    const tag = rd(p, Node.of(serialOf(p), .tag), 0, 4096).bytes;
+    try testing.expect(std.mem.indexOf(u8, tag, "/tmp/two\\nlines") != null);
+    // A backslash of the name's own is doubled: `\n` written in a name
+    // reads back unlike a newline.
+    p.setCwd(term, "/tmp/back\\nslash");
+    try testing.expect(std.mem.indexOf(u8, rd(p, @intFromEnum(tree.TopFile.index), 0, 4096).bytes, "/tmp/back\\\\nslash") != null);
 }
 
 test "a served-tree pane spoils no Grep, and Look . from a gone directory is ENOENT, not /virtual/" {
diff --git a/src/ninep/events.zig b/src/ninep/events.zig
index 3da6f723..8b8f8637 100644
--- a/src/ninep/events.zig
+++ b/src/ninep/events.zig
@@ -358,10 +358,10 @@ fn sanitize(record: []const u8, out: []u8) []u8 {
 }
 
 /// `text` as one line of UTF-8 a reader can split and decode, as /log and
-/// /index show names: a newline is `\n` (a name with one stays readable as
-/// what it is, not run into the next), any other control character, DEL
-/// or C1 control (U+0080-U+009F) a space, and a byte that is not UTF-8
-/// `\xNN`. `out` of 4 bytes a byte of `text` holds it all.
+/// /index show names: a backslash is `\\`, a newline `\n` (a name with one
+/// stays readable as what it is, not run into the next), any other control
+/// character, DEL or C1 control (U+0080-U+009F) a space, and a byte that
+/// is not UTF-8 `\xNN`. `out` of 4 bytes a byte of `text` holds it all.
 pub fn shown(text: []const u8, out: []u8) []u8 {
     return shownAs(text, out, true);
 }
@@ -372,6 +372,14 @@ fn shownAs(text: []const u8, out: []u8, escape_newline: bool) []u8 {
     const body = text;
     while (i < body.len and w + 4 <= out.len) {
         const c = body[i];
+        // A name's own backslash is `\\`, so `\n` and `\xNN` read back as
+        // the escapes they are, never as a name that held them.
+        if (c == '\\' and escape_newline) {
+            @memcpy(out[w..][0..2], "\\\\");
+            w += 2;
+            i += 1;
+            continue;
+        }
         if (c == '\n' and escape_newline) {
             @memcpy(out[w..][0..2], "\\n");
             w += 2;
@@ -1312,6 +1320,9 @@ test "a record is one line of UTF-8: DEL and C1 are spaces, bytes not UTF-8 are
     var out: [64]u8 = undefined;
     var name: [64]u8 = undefined;
     try testing.expectEqualStrings("/tmp/two\\nlines", shown("/tmp/two\nlines", &name));
+    // A backslash of the name's own is doubled: `\n` in a name differs from
+    // a newline in one.
+    try testing.expectEqualStrings("/tmp/a\\\\nb", shown("/tmp/a\\nb", &name));
     try testing.expectEqualStrings("msg - a b c \\xff d\n", sanitize("msg - a\x7fb\xc2\x85c \xff d\n", &out));
     try testing.expectEqualStrings("msg - caf\xc3\xa9\n", sanitize("msg - caf\xc3\xa9\n", &out));
 }
diff --git a/src/tagline.zig b/src/tagline.zig
index d024be4e..5f95b2a0 100644
--- a/src/tagline.zig
+++ b/src/tagline.zig
@@ -112,6 +112,17 @@ pub fn revealHeader(p: *Pardes) void {
     }
 }
 
+/// A terminal's directory as its tag shows it: one line, as /index shows
+/// it (a newline `\n`), never a raw newline breaking the tag.
+fn shownDir(arena: std.mem.Allocator, pane: *Pane) ![]const u8 {
+    const dir = pane.cwdSlice();
+    if (std.mem.indexOfAny(u8, dir, "\n\\\x7f") == null and for (dir) |c| {
+        if (c < ' ') break false;
+    } else true) return dir;
+    const out = try arena.alloc(u8, dir.len * 4 + 4);
+    return pardes.ctlfs.events.shown(dir, out);
+}
+
 /// The computed start of a pane's tag -- its path and dirty marker, a
 /// PDF's page, a terminal's directory -- without the space that parts it
 /// from the tag's own text. It is never stored, and never edited.
@@ -133,19 +144,19 @@ pub fn pathPrefix(arena: std.mem.Allocator, pane: *Pane) ![]const u8 {
         var idbuf: [48]u8 = undefined;
         const id = exec.replId(&idbuf, pane);
         const gap = if (id.len > 0) " " else "";
-        if (!pane.command_done) return std.fmt.allocPrint(arena, "{s} ({s}{s}) running{s}{s}", .{ pane.cwdSlice(), shown, more, gap, id });
-        if (pane.command_status) |n| return std.fmt.allocPrint(arena, "{s} ({s}{s}) exit {d}{s}{s}", .{ pane.cwdSlice(), shown, more, n, gap, id });
-        return std.fmt.allocPrint(arena, "{s} ({s}{s}) exit ?{s}{s}", .{ pane.cwdSlice(), shown, more, gap, id });
+        if (!pane.command_done) return std.fmt.allocPrint(arena, "{s} ({s}{s}) running{s}{s}", .{ (try shownDir(arena, pane)), shown, more, gap, id });
+        if (pane.command_status) |n| return std.fmt.allocPrint(arena, "{s} ({s}{s}) exit {d}{s}{s}", .{ (try shownDir(arena, pane)), shown, more, n, gap, id });
+        return std.fmt.allocPrint(arena, "{s} ({s}{s}) exit ?{s}{s}", .{ (try shownDir(arena, pane)), shown, more, gap, id });
     }
     // A bound REPL says what it is bound as, beside its Tty word.
     if (pane.repl != null) {
         var idbuf: [48]u8 = undefined;
-        return std.fmt.allocPrint(arena, "{s} {s}", .{ pane.cwdSlice(), exec.replId(&idbuf, pane) });
+        return std.fmt.allocPrint(arena, "{s} {s}", .{ (try shownDir(arena, pane)), exec.replId(&idbuf, pane) });
     }
     // Unsaved text shows on the grip, as acme's modbutton does, not as a
     // mark in the text: the prefix is the name alone.
     if (pane.file) |f| return if (pane.prompt == .name) pane.input.own orelse f.path else f.path;
-    return pane.cwdSlice();
+    return (try shownDir(arena, pane));
 }
 
 pub fn tagPrefix(p: *Pardes, pane: *Pane) ![]u8 {