- is_web_url sliced the string at byte 7/8, panicking (and killing every
session) when a remote host printed an OSC 8 or plain link with a
multi-byte character at that offset and the user hovered it. It now
compares bytes.
- Paste confirmation also triggers on control characters other than tab
(readline's C-o runs a line with no newline), and the preview shows
them escaped.
- Remote clipboard toasts escape control characters and state the line
count, so 'ls\ncurl … | sh' no longer reads as a harmless 'ls'.
- Inline images: dimensions are read from the header first and anything
over the 32 Mpx per-terminal budget is refused before decoding.
- Toasts: repeats extend the visible toast and at most 8 are kept, so
trigger or OSC 52 floods can't stall frames.
- The URL regex is compiled once.
- Enable eframe's 'links' feature: without it every 'open in browser'
(Cmd/Ctrl+click, GitHub repo links, the update link) was a silent
no-op. Adds webbrowser 1.2.4 to the lockfile.
Andy Dixon
d6f8f3306b