The Bombadil Terminal Experiment

Links
1

A TUI fuzzer.

7 Likes
2

That’s amazing, I love it! Stress testing my TUIs now.

I left it running hledger add for a few minutes and it succeeded in adding many entries, such as:

2026-04-30 XY
    7                 1s`
    86u-:            -1s`

2026-04-30
    *                   5
    86u-:              -5
    o                   9
    yvf4              -9T
    _                  -9
    O                  9T

2026-04-30 *
    -M                I2
    fqG6             I-2
    g                 >2
    tQ               >-2
    1g                M0

2026-04-30
    5={             5%wdk
    86u-:         -5%wdk_
    o                  v0
    yvf4           -5%wdk
    _             5%wdk_u
    O              5%wdk_
    Krq          -5%wdk_u
    H`                  8
    $                  -8
    +e                  6
    )&                 -6

It even managed to add one with a transacted cost (@@):

2026-04-30
    5                   5
    86u-:              -5
    o                 9)\
    yvf4              XY4
    liM              -9)\
    {qO5P       9i @@ 9iC
    %                   9
    ^K'Rw            -9]Y
    "Q7A               -9
    g+V.v            XY-4
    %F                9]Y
    Q                -9iC

I imagine this is already very good at finding bugs (and vulnerabilities), and if coupled with a bit of AI would be much more so.

bombadil-terminal test ghcup tui is fun (and finds no problems..)

Though.. ha ha.. what have I done to my system…

3 Likes
3

bombadil-terminal test ghcup tui Wouldn’t this trigger downloads that would take a while, halting testing?

4

It didn’t for me, for whatever UI reason, though I had it running for a while; also it didn’t end up changing any of my toolchain. I got lucky!

TUIs need a sort of safe mode for this kind of testing.

5

You can set GHCUP_INSTALL_BASE_PREFIX to some temporary directory.

I’ll give this a shot in a bit.

1 Like
6

I think what’s happening here is that when you install a tool, then the TUI is suspended and you get dropped to the terminal, then ghcup executes that action and at the end drops back to the TUI… while that happens it seems that bombadil is spamming the terminal with escape codes and maybe that somehow aborts the process. I could only see the fuzzer reach the raw terminal once, but it didn’t last long. It seems to mostly get “stuck” in the advanced install and compile menus, because they have lots of inputs.

1 Like
7

Very cool to see you using it on hledger, @simonmic ! Happy to hear more about your experiences. This was a quick hack and I’m planning on making many improvements to it, including something like the specification language used on the browser version of Bombadil.

2 Likes