Fix copy-on-select: override to clipboard and update ghostty fork

Override copy-on-select = clipboard so that selecting text in the
terminal copies to the system clipboard (NSPasteboard.general),
matching macOS user expectations. Ghostty's default of .true writes
to a private named pasteboard that is not accessible via Cmd+V.

Update the ghostty submodule to include the fix for the
use-after-free in the mouse release copy-on-select path
(manaflow-ai/ghostty#36).

Update docs/ghostty-fork.md with section 8 documenting the fork
change.

Fixes manaflow-ai#2664

Author: palootcenas-outreach

Sources/GhosttyTerminalView.swift

@@ -1708,6 +1708,17 @@ class GhosttyApp {
         ghostty_config_load_recursive_files(config)
         loadCmuxAppSupportGhosttyConfigIfNeeded(config)
         loadCJKFontFallbackIfNeeded(config)
+        // Ghostty's default copy-on-select = true writes to a private
+        // named pasteboard (com.mitchellh.ghostty.selection) that is not
+        // the system clipboard. Override to "clipboard" so that selecting
+        // text copies to NSPasteboard.general and Cmd+V works as macOS
+        // users expect.
+        loadInlineGhosttyConfig(
+            "copy-on-select = clipboard",
+            into: config,
+            prefix: "cmux-copy-on-select",
+            logLabel: "copy-on-select override"
+        )
         let useHostLayerBackground = !hasConfiguredBackgroundImage(config)
         usesHostLayerBackground = useHostLayerBackground
         if !useHostLayerBackground {

docs/ghostty-fork.md

@@ -13,7 +13,7 @@ When we change the fork, update this document and the parent submodule SHA.
 ## Current fork changes
 
 Fork rebased onto upstream `main` at `3509ccf78` (`v1.3.1-457-g3509ccf78`) on March 30, 2026.
-Current cmux pinned fork head: `ae3cc5d29` (`v1.3.1-473-gae3cc5d29`).
+Current cmux pinned fork head: `75ec7bf89` (`fix-copy-on-select-uaf`).
 Fork `main` keeps this pin reachable via merge commit `5c781d710`
 (`Retain layer-background pin ancestry on main`).
 
@@ -112,7 +112,17 @@ tend to conflict together during rebases.
   - Allows the host app to provide the terminal background via `CALayer.backgroundColor` for instant coverage during view resizes, avoiding alpha double-stacking.
   - Replays the layer-background restore on top of the refreshed Ghostty base so cmux keeps the resize-coverage fix after the upstream sync.
 
-The fork branch HEAD is now the section 7 layer-background restore commit.
+The fork branch HEAD is now the section 8 copy-on-select fix commit.
+
+### 8) Fix use-after-free in copy-on-select mouse release path
+
+- Commit: `75ec7bf89` (Fix use-after-free in copy-on-select mouse release path)
+- Files:
+  - `src/Surface.zig`
+- Summary:
+  - Fixes a use-after-free in `mouseButtonCallback` when the left mouse button is released after a drag selection.
+  - The old code called `setSelection()` which freed tracked pins via `Screen.select()` then compared the new selection against the freed `prev` pointer via `eql()`. Since freed memory usually retains old values, `eql()` returned true and `copySelectionToClipboards` was silently skipped.
+  - The fix reads the existing tracked selection directly and calls `copySelectionToClipboards` without going through `setSelection()`, since the mouse release path does not need to change the selection.
 
 ## Upstreamed fork changes