@adrrr/tarmac 0.5.0 → 0.6.0

package/README.md

@@ -6,14 +6,14 @@
 ![runtime dependencies](https://img.shields.io/badge/runtime_dependencies-0-brightgreen)
 ![license](https://img.shields.io/badge/license-MIT-blue)
 
-**Fleet observability for Claude Code.** One table for every session you have running —
+**Fleet observability for Claude Code.** One table for every session you have running:
 busy or idle, how full its context is, which model, what it has cost so far. It reads
 documented surfaces only, never an internal format.
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="docs/media/replay-dark.gif">
   <img src="docs/media/replay-light.gif" width="1100"
-       alt="The tarmac map, live and then replayed. It opens on the live fleet, whose nodes are grouped into a frame per working directory, each labelled with its project. As the scrubber is dragged the frames give way to the flat record — sessions drawn as dials, each arc a context window, background agents as strips of text — with the account's five-hour and seven-day gauges above them. Sessions appear and disappear, the arcs fill and reset, the five-hour window fills and rolls over, and a banner names the minute being replayed until Back to live is pressed and the frames come back.">
+       alt="The tarmac map, live and then replayed. It opens on the live fleet, whose nodes are grouped into a frame per working directory, each labelled with its project. As the scrubber is dragged the frames give way to the flat record: sessions drawn as dials, each arc a context window, background agents as strips of text, with the account's five-hour and seven-day gauges above them. Sessions appear and disappear, the arcs fill and reset, the five-hour window fills and rolls over, and a banner names the minute being replayed until Back to live is pressed and the frames come back.">
 </picture>
 
 [Quickstart](#quickstart) · [The map](#the-map) · [Install](#install) ·
@@ -42,127 +42,135 @@ atlas              idle   — fresh  8h !   Opus 5   high    $0.00   8h
 ! 3 reading(s) marked "!" are older than 10m (--stale-after)
 
 4 sessions · 2 busy · $109.35
+account  5h 17% resets in 2h 14m · 7d 42% resets in 3d 11h · as of 7m
 ```
 
-That is the table with the status line chained. Without it — nothing installed at all — the
-same command still lists every session, its state and its uptime, straight from
-`claude agents --json`; the context column reads `— absent`, model, effort and cost fall to
-`—`, and the line under the table counts how many sessions are covered.
+That is the table with the status line chained. The last line is the account's, not any
+session's: every row above spends from the same five-hour and seven-day
+[window](docs/MANUAL.md#the-accounts-two-windows), so it is printed once, dated like every
+other reading here, and `— no reading` rather than `0%` when no snapshot carried one.
 
-Node ≥ 20. **Zero runtime dependencies** — no framework, no bundler, nothing to audit.
-`--help` works everywhere, and an option handed to a command that does not read it is an
-**error**, not something quietly ignored. Every command, flag and route:
+With nothing installed, the same command still lists every session, its state and its uptime,
+straight from `claude agents --json`. The context column reads `— absent`, model, effort and
+cost fall to `—`, and the line under the table counts how many sessions are covered.
+
+Node ≥ 20. Zero runtime dependencies: no framework, no bundler, nothing to audit.
+`--help` works everywhere. An option handed to a command that does not read it is an error,
+not something quietly ignored. Every command, flag and route:
 [the manual](docs/MANUAL.md#commands-and-options).
 
 ## The map
 
-`tarmac serve` puts the same fleet in the browser — every session a row, ages that keep
+`tarmac serve` puts the same fleet in the browser: every session a row, ages that keep
 climbing, and a banner the moment a refresh fails instead of a table quietly going stale. It
-binds to loopback and refuses any request whose `Host` is not loopback, or that a browser marks
-as coming from another origin: your cwd paths and costs never leave the machine. A client that
-sends no such mark — curl, a script — is left alone. The listening rules:
-[the manual](docs/MANUAL.md#what-serve-listens-on).
+binds to loopback and refuses any request whose `Host` is not loopback, or that a browser
+marks as coming from another origin, so your cwd paths and costs never leave the machine. A
+client that sends no such mark, curl or a script, is left alone. Behind a reverse proxy, which
+presents a `Host` of its own, `--trust-host <name>` names the one to let through and says who
+that lets in: [the manual](docs/MANUAL.md#putting-it-behind-a-reverse-proxy). The listening
+rules: [the manual](docs/MANUAL.md#what-serve-listens-on).
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="docs/media/map-dark.png">
   <img src="docs/media/map-light.png" width="1100"
-       alt="The tarmac map, live. Four framed groups, one per working directory and labelled with its project: beacon, holding a session halted on a permission prompt; harbor, holding a session busy with its context arc at 90% and a background agent docked under the cards of that frame as a strip named after its prompt; quay, reporting a status tarmac does not know; and atlas, idle at 36%. A frame says only that its nodes were read in the same directory — nothing inside one claims that any node dispatched another. The account's five-hour and seven-day gauges sit above them, and one warning above the fleet names the unrecognised status rather than filing it as idle.">
+       alt="The tarmac map, live. Four framed groups, one per working directory and labelled with its project: beacon, holding a session halted on a permission prompt; harbor, holding a session busy with its context arc at 90% and a background agent docked under the cards of that frame as a strip named after its prompt; quay, reporting a status tarmac does not know; and atlas, idle at 36%. A frame says only that its nodes were read in the same directory. Nothing inside one claims that any node dispatched another. The account's five-hour and seven-day gauges sit above them, and one warning above the fleet names the unrecognised status rather than filing it as idle.">
 </picture>
 
-The tab in the header swaps the table for the same fleet as nodes — one per session, the arc
+The tab in the header swaps the table for the same fleet as nodes: one per session, the arc
 its context, the shape by the name its state. A background agent has no terminal behind it to
-draw a frame with, so it is a strip of text rather than a dial that could never fill. It is
-the same reading in the same fragment, so the two views can never disagree.
+draw a frame with, so it gets a strip of text rather than a dial that could never fill. Both
+views render the same reading into the same fragment, so they can never disagree.
 
-The nodes are grouped by **working directory**: a frame per directory, labelled with its
-project, the sessions inside it as cards and the agents docked underneath as strips. That is
-the whole of what the frame claims — these were read in the same directory. It is not a
-parentage: `claude agents --json` publishes nothing that ties an agent to whoever dispatched
-it, so no label, no position and no line inside a frame says one node asked for another. An
-agent whose directory matches no session gets a frame of its own rather than somebody else's.
+The nodes are grouped by working directory: a frame per directory, labelled with its project,
+the sessions inside it as cards and the agents docked underneath as strips. That is the whole
+of what the frame claims: these were read in the same directory. It is not a parentage.
+`claude agents --json` publishes nothing that ties an agent to whoever dispatched it, so no
+label, no position and no line inside a frame says one node asked for another. An agent whose
+directory matches no session gets a frame of its own rather than somebody else's.
 
 Above the fleet are the account's five-hour and seven-day
-[gauges](docs/MANUAL.md#the-accounts-two-windows); under it a **scrubber over the day this
-serve has seen** — drag it and the nodes render
-the fleet as it was at that minute, press play and the day walks past. Replayed, they are
-drawn flat and unframed: the record keeps a project name and never the directory it was read
-in, and a basename is not a directory — two checkouts of `atlas` answer to the same word, so a
-frame drawn on it would claim a shared directory nobody can check.
-
-The rules the table follows, the map follows: a reading past the freshness threshold is drawn
-thin, amber and dated, a percentage nobody measured is an empty dotted dial rather than a ring
-at zero, and where nothing was published at all — the strip of an agent the join found no
-snapshot for — nothing is drawn in its place, neither a dial nor a dash. A word
+[gauges](docs/MANUAL.md#the-accounts-two-windows); under it a scrubber over the day this
+serve has seen. Drag it and the nodes render the fleet as it was at that minute, press play
+and the day walks past. Replayed, they are drawn flat and unframed: the record keeps a project
+name and never the directory it was read in, and a basename is not a directory. Two checkouts
+of `atlas` answer to the same word, so a frame drawn on it would claim a shared directory
+nobody can check.
+
+The map follows the rules the table follows. A reading past the freshness threshold is drawn
+thin, amber and dated. A percentage nobody measured is an empty dotted dial rather than a ring
+at zero. Where nothing was published at all, such as the strip of an agent the join found no
+snapshot for, nothing is drawn in its place, neither a dial nor a dash. A word
 `claude agents --json` printed that tarmac has no boolean for is shown as it came rather than
-quietly filed as `idle` — and raises one warning above the fleet naming it. The page is JSON
+filed as `idle`, and raises one warning above the fleet naming it. The page is JSON
 underneath: `GET /api/fleet` and `GET /api/history` serve exactly what the map draws. Details
 in [the manual](docs/MANUAL.md#the-map).
 
 ## Install
 
 `install` changes the `statusLine` key of `~/.claude/settings.json`, and never on your
-say-so alone. It prints the whole plan first — including the exact command that undoes it —
-and waits for a **typed word** (`y` is not an answer; scripts pass `--yes`, deliberately).
+say-so alone. It prints the whole plan first, including the exact command that undoes it,
+then waits for a typed word. `y` is not an answer; scripts pass `--yes`, deliberately.
 
-A status line you already had is **wrapped, not replaced**: its display stays byte-identical,
-and `uninstall` names which of its four restore modes ran. Two files land under `~/.claude/` —
-the wrapper and the `backup.json` that undoes it — and neither changes at runtime: the
-snapshots go to `~/.local/state/tarmac/snapshots` (`$XDG_STATE_HOME` when set), because
-`~/.claude` is a directory people commit. The plan, the restore modes and the cleanup of the
-layout that kept snapshots inside `.claude`:
-[the manual](docs/MANUAL.md#installing-safely--the-full-contract).
+A status line you already had is wrapped, not replaced: its display stays byte-identical, and
+`uninstall` names which of its four restore modes ran. Two files land under `~/.claude/`, the
+wrapper and the `backup.json` that undoes it, and neither changes at runtime. The snapshots go
+to `~/.local/state/tarmac/snapshots` (`$XDG_STATE_HOME` when set), because `~/.claude` is a
+directory people commit. The plan, the restore modes and the cleanup of the layout that kept
+snapshots inside `.claude`:
+[the manual](docs/MANUAL.md#installing-safely-the-full-contract).
 
 ## Why it does not break
 
 The usual ways to watch a Claude Code fleet read something Claude Code never promised would
-stay put: transcript files, terminal panes, undocumented paths. Those break on an update,
-and — worse — they break *quietly*, reporting a calm empty fleet.
+stay put: transcript files, terminal panes, undocumented paths. Those break on an update, and
+worse, they break *quietly*, reporting a calm empty fleet.
 
 tarmac reads two things instead:
 
 | Source | What it gives | How solid |
 |---|---|---|
 | `claude agents --json` | which sessions exist, busy, idle or waiting on you, cwd, uptime | a documented CLI surface (`--help`: *"Print active sessions … as a JSON array … for scripting"*) |
-| the status line payload | context %, model, effort, cost | the JSON Claude Code hands to your own `statusLine.command` on every frame — **observed, not published as a schema** |
+| the status line payload | context %, model, effort, cost | the JSON Claude Code hands to your own `statusLine.command` on every frame. Observed, not published as a schema |
 
-That second line is the honest caveat, and it is the reason the real defence is not
-immunity, it is **visible degradation**. A missing measurement is never a confident `0`: it
-is an em dash that names which kind of missing it is — `absent` for a session no status line
-ever wrote for, `fresh` for one that has taken no turn yet, `drift` for a release that moved
-the payload out from under us. A stale reading keeps its value and gets **dated** with a `!`.
-A Claude Code build no fixture covers gets its version named *before* anything breaks, and
-tarmac keeps reporting. The full state-by-state table is in
-[the manual](docs/MANUAL.md#degradation-state-by-state).
+That second line is the honest caveat. The real defence is not immunity, it is visible
+degradation. A missing measurement is never a confident `0`. It is an em dash that names which
+kind of missing it is: `absent` for a session no status line ever wrote for, `fresh` for one
+that has taken no turn yet, `drift` for a release that moved the payload out from under us. A
+stale reading keeps its value and gets dated with a `!`. A Claude Code build no fixture covers
+gets its version named *before* anything breaks, and tarmac keeps reporting. The full
+state-by-state table is in [the manual](docs/MANUAL.md#degradation-state-by-state).
 
 ## Configuration
 
-Three numbers are opinions, not truths, so all three are yours; everything else is
-deliberately not configurable, and all of it works with no configuration at all.
+Three numbers are opinions rather than truths, so all three are yours, and behind a reverse
+proxy the hosts `serve` answers to are yours as well. Everything else is deliberately not
+configurable, and all of it works with no configuration at all.
 
 | Setting | Flag | Default |
 |---|---|---|
 | freshness threshold | `--stale-after 90s` \| `15m` \| `2h` | `10m` |
 | port | `--port 8080` | `4477` |
 | snapshots dir (read side) | `--snapshots-dir DIR` | the wrapper's frozen path when installed, else the XDG state directory |
+| trusted hosts | `--trust-host HOST`, once per host | none — loopback only |
 
 Each also has an environment variable and a key in `<home>/.claude/tarmac/config.json`.
-**Flag beats environment beats config file beats default**, settled per setting; `serve`
-opens by printing each effective value and where it came from. Nothing is silently dropped
-or silently corrected — a value that will not parse stops the run and says what it got,
-where it came from, and what would have worked. Spellings, edge cases and the two health
-fields `tarmac list --json` reports: [the manual](docs/MANUAL.md#configuration).
+Flag beats environment beats config file beats default, settled per setting; `serve` opens by
+printing each effective value and where it came from. Nothing is silently dropped or silently
+corrected. A value that will not parse stops the run and says what it got, where it came from,
+and what would have worked. Spellings, edge cases and the two health fields
+`tarmac list --json` reports: [the manual](docs/MANUAL.md#configuration).
 
 ## What it deliberately does not do
 
-- **No inferred "waiting for you".** `agents --json` reports `waiting` with a reason —
-  a permission prompt, an open dialog — and tarmac draws exactly that, on both surfaces.
-  What it will not do is guess at the rest: a session that asked you a question in prose
+- **No inferred "waiting for you".** `agents --json` reports `waiting` with a reason, such as
+  a permission prompt or an open dialog, and tarmac draws exactly that, in the table and on
+  the map. What it will not do is guess at the rest: a session that asked you a question in prose
   still reports `idle`, and the only way to know better is to read a transcript, which is
-  the one thing this tool will not do. The signal is as good as the surface, and no better.
+  the one thing this tool will not do. The signal is as good as its source, and no better.
 - **No history on disk.** `tarmac list` is a snapshot in time. A running `serve` holds the
-  last 24 hours of the readings it took itself, in memory, so the page can replay them — a
-  record that reaches no further back than the serve that took it, and goes when it goes.
-  None of it is written down.
+  last 24 hours of the readings it took itself, in memory, so the page can replay them. That
+  record reaches no further back than the serve that took it, and goes when it goes. None of
+  it is written down.
 - **No Windows.** The generated wrapper is POSIX `sh`.
 - **No remote fleets.** It watches the machine it runs on.
 

package/dist/args.js

@@ -3,7 +3,7 @@
 //
 // Unknown options and unknown commands are ERRORS. A typo silently ignored is how someone
 // ends up believing they pointed tarmac at a directory it never read.
-import { parsePort } from './config.js';
+import { parsePort, parseTrustHost } from './config.js';
 const COMMANDS = new Set(['list', 'serve', 'install', 'uninstall', 'help']);
 // `| undefined` is load-bearing, not decoration: without it the compiler types the lookup
 // below as always-present and the `if (!key) throw` guard reads as dead code — which is how
@@ -12,6 +12,7 @@ const OPTIONS = {
     '--port': 'port',
     '--stale-after': 'staleAfter',
     '--snapshots-dir': 'snapshotsDir',
+    '--trust-host': 'trustHost',
     '--home': 'home',
     '--claude-bin': 'claudeBin',
     '--json': 'json',
@@ -20,6 +21,8 @@ const OPTIONS = {
     '--help': 'help',
 };
 const FLAGS = new Set(['json', 'watch', 'yes', 'help']);
+/** Options that ACCUMULATE rather than overwrite — passed twice, both values are kept. */
+const LISTS = new Set(['trustHost']);
 /**
  * Which options each command really reads. The doc-comment above refuses a flag nobody
  * implements; this refuses a flag THIS command does not implement, which is the same defect
@@ -30,7 +33,7 @@ const FLAGS = new Set(['json', 'watch', 'yes', 'help']);
  */
 const ACCEPTS = {
     list: new Set(['staleAfter', 'snapshotsDir', 'home', 'claudeBin', 'json', 'watch', 'help']),
-    serve: new Set(['port', 'staleAfter', 'snapshotsDir', 'home', 'claudeBin', 'help']),
+    serve: new Set(['port', 'staleAfter', 'snapshotsDir', 'trustHost', 'home', 'claudeBin', 'help']),
     install: new Set(['home', 'yes', 'help']),
     uninstall: new Set(['home', 'yes', 'help']),
     help: new Set(['help']),
@@ -51,7 +54,7 @@ export function accepts(command, flag) {
     return key !== undefined && ACCEPTS[command].has(key);
 }
 export function parseArgs(argv) {
-    const out = { command: 'list', port: null, staleAfter: null, snapshotsDir: null, home: null, claudeBin: 'claude', json: false, watch: false, yes: false, help: false };
+    const out = { command: 'list', port: null, staleAfter: null, snapshotsDir: null, trustHost: [], home: null, claudeBin: 'claude', json: false, watch: false, yes: false, help: false };
     let i = 0;
     if (argv[0] && !argv[0].startsWith('-')) {
         if (!COMMANDS.has(argv[0]))
@@ -81,6 +84,11 @@ export function parseArgs(argv) {
             // in the same words wherever it was set.
             out.port = parsePort(value, '--port');
         }
+        else if (LISTS.has(key)) {
+            // Same rule, for the same reason — and the value is kept as the guard will compare it,
+            // so what `serve` prints on startup is what it will actually match against.
+            out[key].push(parseTrustHost(value, flag));
+        }
         else {
             out[key] = value;
         }

package/dist/cli.js

@@ -24,7 +24,7 @@ const USAGE = `tarmac — fleet observability for Claude Code
                     [--claude-bin PATH] [--json] [--watch]
         one-shot fleet table — with --watch, redrawn every 5s until ^C
   tarmac serve      [--home DIR] [--port N] [--stale-after D] [--snapshots-dir DIR]
-                    [--claude-bin PATH]
+                    [--claude-bin PATH] [--trust-host HOST]
         local dashboard
   tarmac install    [--home DIR] [--yes]
         chain the statusline
@@ -42,11 +42,15 @@ const USAGE = `tarmac — fleet observability for Claude Code
                    (default: $XDG_STATE_HOME/tarmac/snapshots, or
                    <home>/.local/state/tarmac/snapshots)
   --claude-bin     path to the claude CLI (default: claude)
+  --trust-host     a Host the dashboard also answers to, besides loopback — repeat it
+                   once per host (default: none). For a reverse proxy: give the name
+                   your browser shows, without the port, and remember that whoever can
+                   reach that name can read this fleet
 
-  Those three settings can also be set, in decreasing order of precedence, by the
-  environment (TARMAC_STALE_AFTER, TARMAC_PORT, TARMAC_SNAPSHOTS_DIR) and by
-  <home>/.claude/tarmac/config.json ({"staleAfterMs": …, "port": …, "snapshotsDir": …}).
-  \`serve\` prints which one won.
+  Those four settings can also be set, in decreasing order of precedence, by the
+  environment (TARMAC_STALE_AFTER, TARMAC_PORT, TARMAC_SNAPSHOTS_DIR, TARMAC_TRUST_HOST)
+  and by <home>/.claude/tarmac/config.json ({"staleAfterMs": …, "port": …,
+  "snapshotsDir": …, "trustHosts": […]}). \`serve\` prints which one won.
 `;
 try {
     // Parsing is inside the try so that a refusal — a typo'd flag, a duration nobody can read,
@@ -101,7 +105,7 @@ try {
         if (frozen === null && wrapperIsOurs(p))
             console.error(`tarmac: ${p.wrapper} is ours but does not say where it writes — falling back to ${p.snapshots}`);
         const config = resolveConfig({
-            flags: { staleAfter: args.staleAfter, port: args.port, snapshotsDir: args.snapshotsDir },
+            flags: { staleAfter: args.staleAfter, port: args.port, snapshotsDir: args.snapshotsDir, trustHosts: args.trustHost },
             env: process.env,
             file: readConfigFile(p.config),
             // The installed wrapper's own path, when there is one: the default is where the
@@ -124,6 +128,7 @@ try {
                 console.error(`tarmac: could not remove ${failed} orphaned temp file(s) under ${snapshotsDir}`);
             const server = createFleetServer({
                 collect: () => collectFleet({ claudeBin: args.claudeBin, snapshotsDir, staleAfterMs, snapshotsDirSource: config.snapshotsDir.source, installed: frozen !== null }),
+                trustedHosts: config.trustHosts.value,
             });
             // A port nobody chose is not worth failing over: this walks past a busy 4477 and says
             // where it landed. A port that WAS chosen refuses instead, and the refusal leaves

package/dist/config.js

@@ -65,7 +65,40 @@ function checkPort(n, label, shown = n) {
     }
     return n;
 }
-const KNOWN_KEYS = ['staleAfterMs', 'port', 'snapshotsDir'];
+/**
+ * The name out of a `Host` header, or out of a setting that has to match one: the port
+ * dropped, the brackets of an IPv6 literal dropped with it.
+ *
+ * Shared with the server's guard so that BOTH sides of that comparison are cut the same way.
+ * A normaliser written twice is a guard with two definitions of the same name.
+ */
+export const hostName = (host) => host.replace(/:\d+$/, '').replace(/^\[|\]$/g, '');
+/**
+ * A host `serve` will answer to besides loopback. Refuses everything that is not a name a
+ * `Host` header can carry — a scheme, a path, a wildcard, an IPv6 literal, an empty string —
+ * because each of those is accepted at the command line, printed on startup, and then matches
+ * nothing at all: a setting the tool appears to have taken and silently never applies.
+ *
+ * The port is DROPPED rather than refused, and the drop is visible in what `serve` prints. A
+ * proxy presents `name:8443` on one setup and a bare `name` on 443, and a list that matched
+ * the port would refuse half the setups it was typed for. It costs nothing: the port in a
+ * `Host` header is chosen by whoever sends it, so it never barred anybody.
+ *
+ * @param label how the source spells this setting, so the refusal names the knob to turn
+ */
+export function parseTrustHost(text, label) {
+    // Lowered because host names are case-insensitive and browsers send them lowered — a 403
+    // over a capital would be a setting typed, accepted, and never matched. It gives nothing
+    // away: the name still has to be the one the reader wrote down, character for character.
+    const name = hostName(text.trim()).toLowerCase();
+    if (!HOST_NAME.test(name)) {
+        throw new Error(`${label} must be a host name like example.ts.net — no scheme, no path, no wildcard, got: ${format(text)}`);
+    }
+    return name;
+}
+/** Letters, digits, dots and dashes, starting and ending on one that is not a dash or a dot. */
+const HOST_NAME = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/;
+const KNOWN_KEYS = ['staleAfterMs', 'port', 'snapshotsDir', 'trustHosts'];
 /**
  * `~/.claude/tarmac/config.json`, if there is one.
  *
@@ -118,6 +151,20 @@ export function readConfigFile(file) {
         }
         out.snapshotsDir = v;
     }
+    if ('trustHosts' in body) {
+        const v = body.trustHosts;
+        if (!Array.isArray(v)) {
+            throw new Error(`${where('trustHosts')} must be an array of host names, got: ${format(v)}`);
+        }
+        out.trustHosts = v.map((h) => {
+            if (typeof h !== 'string') {
+                throw new Error(`${where('trustHosts')} must be an array of host names, got: ${format(h)}`);
+            }
+            // The same parser the flag and the environment go through: a host is refused, and kept,
+            // in the same words wherever it was written down.
+            return parseTrustHost(h, where('trustHosts'));
+        });
+    }
     return out;
 }
 /**
@@ -147,6 +194,9 @@ export function resolveConfig({ flags, env, file, defaultSnapshotsDir }) {
     const staleAfterEnv = parseIfSet(env.TARMAC_STALE_AFTER, (v) => parseDuration(v, 'TARMAC_STALE_AFTER'));
     const portEnv = parseIfSet(env.TARMAC_PORT, (v) => parsePort(v, 'TARMAC_PORT'));
     const dirEnv = read(env.TARMAC_SNAPSHOTS_DIR);
+    // Comma-separated, which a host name cannot contain — so the list needs no quoting rule of
+    // its own, and an empty item between two commas is refused rather than skipped.
+    const trustEnv = parseIfSet(env.TARMAC_TRUST_HOST, (v) => v.split(',').map((h) => parseTrustHost(h, 'TARMAC_TRUST_HOST')));
     return {
         staleAfterMs: flags.staleAfter !== null
             ? { value: parseDuration(flags.staleAfter, '--stale-after'), source: 'flag' }
@@ -169,6 +219,16 @@ export function resolveConfig({ flags, env, file, defaultSnapshotsDir }) {
                 : file.snapshotsDir !== undefined
                     ? { value: file.snapshotsDir, source: 'file' }
                     : { value: defaultSnapshotsDir, source: 'default' },
+        // The winning rung is the WHOLE list, like every other setting here. Adding the four
+        // together would leave nobody able to narrow, for one run, a list a config file widened —
+        // and this is the one setting where widening is the whole of the risk.
+        trustHosts: flags.trustHosts.length > 0
+            ? { value: flags.trustHosts, source: 'flag' }
+            : trustEnv !== null
+                ? { value: trustEnv, source: 'env' }
+                : file.trustHosts !== undefined
+                    ? { value: file.trustHosts, source: 'file' }
+                    : { value: [], source: 'default' },
     };
 }
 /**

package/dist/fleet.js

@@ -12,6 +12,7 @@
 // whose clock floats dies quietly the day it crosses a threshold.
 import path from 'node:path';
 import { DEFAULT_STALE_AFTER_MS } from './config.js';
+import { measured, windowsApart } from './limits.js';
 import { guardVersions } from './schema.js';
 import { isWaiting } from './sessions.js';
 import { SID_NAME } from './wrapper.js';
@@ -156,9 +157,15 @@ export function busyOnStaleFleet(rows) {
  * The account's rate limits, as this fleet's sessions report them.
  *
  * They belong to the ACCOUNT and not to any one session, but they arrive per snapshot — so the
- * rows do not carry contradicting numbers, they carry the same number at different ages, and
- * the youngest is the one still true. Same rule as everything else in this module: the freshest
- * reading wins.
+ * rows normally do not carry contradicting numbers, they carry the same number at different
+ * ages, and the youngest is the one still true. Same rule as everything else in this module:
+ * the freshest reading wins.
+ *
+ * "Normally", because one thing can make that rule wrong, and it is why the count travels with
+ * the winner: readings that name different resets are not one allowance seen twice (see
+ * `windowsApart`). The freshest is still what gets drawn — there is nothing better to draw —
+ * but how many readings it speaks for, and how many describe some other window, go out with it
+ * so that no surface can present a picked winner as the fleet's one account.
  *
  * A snapshot dated AFTER the clock that read it is refused rather than believed, which is the
  * verdict `map.ts` reaches on the same value: an NTP correction or a mount whose time runs
@@ -169,17 +176,69 @@ export function busyOnStaleFleet(rows) {
  * header draws it, and two copies of "which session's word counts" is two answers about one
  * account the day either one is touched.
  */
-export function accountLimits(rows) {
-    let freshest = null;
-    for (const r of rows) {
-        if (r.rateLimits === null || r.snapshotAgeMs === null || r.snapshotAgeMs < 0)
+export function accountLimits(rows, now) {
+    // Dated readings only, and the same two exclusions on both sides of the question: a reading
+    // nothing can date cannot win on freshness, so it does not get to disagree either — it would
+    // put a number in the denominator that no surface is allowed to show.
+    const dated = rows
+        .filter((r) => r.rateLimits !== null && r.snapshotAgeMs !== null && r.snapshotAgeMs >= 0)
+        .map((r) => ({
+        rateLimits: r.rateLimits,
+        ageMs: r.snapshotAgeMs,
+        sessionId: r.sessionId,
+        measured: measured(r.rateLimits, now),
+    }));
+    if (dated.length === 0)
+        return null;
+    // Freshest AND measured, in that order. A session that has just started is guaranteed to be
+    // the youngest snapshot on the machine and is the likeliest to carry a window whose number
+    // has not been taken yet — freshest alone let it blank an account three other sessions were
+    // reporting. When nothing measured anything, the freshest still comes back, so the surfaces
+    // say "no reading" about a reading that exists rather than about no reading at all.
+    const readings = dated.filter((r) => r.measured);
+    const freshest = youngest(readings.length > 0 ? readings : dated);
+    // Every reading that measured something, the shown one included: it is compared with itself,
+    // which is the one comparison that can never come back apart. Skipping it explicitly was a
+    // line no test could ever have killed.
+    const apartWindows = new Set();
+    let apart = 0;
+    for (const r of readings) {
+        const windows = windowsApart(freshest.rateLimits, r.rateLimits, now);
+        if (windows.length === 0)
             continue;
-        if (freshest === null || r.snapshotAgeMs < freshest.ageMs) {
-            freshest = { rateLimits: r.rateLimits, ageMs: r.snapshotAgeMs };
-        }
+        apart += 1;
+        for (const w of windows)
+            apartWindows.add(w);
+    }
+    return {
+        rateLimits: freshest.rateLimits,
+        ageMs: freshest.ageMs,
+        readings: readings.length,
+        apart,
+        apartWindows: [...apartWindows],
+    };
+}
+/**
+ * The youngest reading, with a tie settled by session id rather than by the order the sources
+ * printed — the rule `preferred()` already applies to two snapshot files of the same age, for
+ * the same reason. `rows` is sorted on a key that is not total, so equal-aged readings keep
+ * whatever order `claude agents --json` emitted them in: without this, the number drawn AND the
+ * count published beside it move between two machines reading the same fleet. Which one it
+ * picks matters far less than that it picks the same one every time.
+ *
+ * An id nothing reported sorts last: it is the one value that cannot tell two readings apart.
+ */
+function youngest(readings) {
+    let best = readings[0];
+    for (const r of readings) {
+        if (r.ageMs < best.ageMs)
+            best = r;
+        else if (r.ageMs === best.ageMs && sortKey(r.sessionId) < sortKey(best.sessionId))
+            best = r;
     }
-    return freshest;
+    return best;
 }
+const sortKey = (sessionId) => (sessionId === null ? '￿' : sessionId);
 // Blocked on a human first, then busy, then unknown (it might be busy), then idle.
 //
 // Waiting leads because it is the only rank that is work for the reader: everything below it

package/dist/history.js

@@ -83,6 +83,6 @@ function sampleOf({ rows, health }) {
             costUsd: r.costUsd,
         })),
         // The reading, without its age: the ring keeps each reading and never how old it was.
-        rateLimits: accountLimits(rows)?.rateLimits ?? null,
+        rateLimits: accountLimits(rows, health.generatedAt)?.rateLimits ?? null,
     };
 }

package/dist/limits.js

@@ -37,18 +37,15 @@ export const LIMIT_WINDOWS = [
 export const RESET_HORIZON_MS = 8 * 24 * 3600 * 1000;
 /** Both windows, always — a window that could not be read is a gauge that says so. */
 export function readLimits(rateLimits, now) {
-    // `rate_limits: []` and `rate_limits: "none"` are legal JSON and not a pair of windows.
-    // Neither may reach the lookup below as something to index.
-    const ok = rateLimits !== null && typeof rateLimits === 'object' && !Array.isArray(rateLimits);
     return LIMIT_WINDOWS.map(({ key, label, said }) => {
-        const w = ok ? rateLimits[key] : undefined;
-        const has = w !== null && typeof w === 'object' && !Array.isArray(w) && 'used_percentage' in w;
-        const v = has ? w.used_percentage : undefined;
+        const w = windowAt(rateLimits, key);
+        const has = w !== undefined && 'used_percentage' in w;
+        const v = w?.used_percentage;
         // Present and null: a window whose number has not been taken yet. Absent, or holding
         // something that is not a percentage: the shape moved. The discriminant is the key.
         const pct = has && typeof v === 'number' && Number.isFinite(v) && v >= 0 && v <= 100 ? Math.floor(v) : null;
         const why = pct !== null ? null : rateLimits == null || (has && v === null) ? 'absent' : 'drift';
-        const at = has && typeof w.resets_at === 'number' && Number.isFinite(w.resets_at) ? w.resets_at : null;
+        const at = has ? resetOf(w) : null;
         const resetsInMs = at === null ? null : at * 1000 - now;
         return {
             key,
@@ -60,3 +57,76 @@ export function readLimits(rateLimits, now) {
         };
     });
 }
+/**
+ * The windows two readings of the account describe DIFFERENTLY, by key, in the order above —
+ * meaning two windows that are BOTH still open at `now` and are not the same window.
+ *
+ * A fleet holds one reading per session and only one of them can be drawn, so the question is
+ * what the others were. It is settled on the reset and not the percentage: `resets_at` is where
+ * a window ENDS, so two readings naming the same one are two ages of a single allowance — the
+ * freshest is the one still true, and the age beside it says the rest. Percentages that differ
+ * under one reset are that same number caught at two frames, the normal state of a fleet, and
+ * warning about it would be a warning on every poll.
+ *
+ * The openness test is the other half, and without it this cries wolf every five hours. A
+ * session that idles keeps the frame it last drew, and the five-hour window rolls over four or
+ * five times a day: an overnight snapshot names the window it was taken in, which has since
+ * ended. That is not two accounts, it is one reading being old — a fact the fleet already
+ * prints, as that row's age and as the `!` beside it — so a window whose boundary is behind
+ * `now` is left out of the comparison rather than raised as a disagreement.
+ *
+ * What survives both rules is the thing nothing else on either surface can say: two windows
+ * open AT THE SAME TIME, which one allowance cannot have. Whether that is two accounts signed
+ * in at once or something stranger is published nowhere tarmac reads, so this reports that the
+ * readings are apart and never why.
+ *
+ * A reading that dates no window is not a reading that dates one differently: an absent
+ * boundary is compared with nothing, exactly as an absent percentage is drawn as nothing. And
+ * a boundary further out than `RESET_HORIZON_MS` is refused here as it is refused a countdown —
+ * a reset fifty thousand years away is not a window this account is in.
+ *
+ * Known blind spot, and the reason it is left open: two accounts whose windows happen to end at
+ * the same second read as one here, and their percentages then differ in silence. The only
+ * thing that would catch it is treating a percentage as evidence — and the shape that takes is
+ * "the fresher reading is lower than the older one", which cannot be true of one allowance and
+ * would be a false alarm the day a number is ever revised downward. A missed collision costs a
+ * warning nobody sees; the other rule costs a warning nobody can act on, on a fleet where
+ * nothing is wrong.
+ */
+export function windowsApart(a, b, now) {
+    const apart = [];
+    for (const { key } of LIMIT_WINDOWS) {
+        const at = openBoundary(windowAt(a, key), now);
+        const bt = openBoundary(windowAt(b, key), now);
+        if (at !== null && bt !== null && at !== bt)
+            apart.push(key);
+    }
+    return apart;
+}
+/** Whether this reading yielded a number for either window — a reading that measured something. */
+export const measured = (rateLimits, now) => readLimits(rateLimits, now).some((g) => g.pct !== null);
+/**
+ * The epoch a window rolls over at, when that window is still OPEN at `now` — and `null` for
+ * one that has already rolled over, one nothing dates, and one dated beyond the horizon.
+ */
+function openBoundary(w, now) {
+    const at = resetOf(w);
+    if (at === null)
+        return null;
+    const inMs = at * 1000 - now;
+    return inMs > 0 && inMs <= RESET_HORIZON_MS ? at : null;
+}
+/**
+ * The window filed under `key`, or `undefined` when the payload carries nothing usable there.
+ *
+ * `rate_limits: []` and `rate_limits: "none"` are legal JSON and not a pair of windows, and
+ * neither may reach an index or a property read as something to look inside.
+ */
+function windowAt(rateLimits, key) {
+    if (rateLimits === null || rateLimits === undefined || typeof rateLimits !== 'object' || Array.isArray(rateLimits))
+        return undefined;
+    const w = rateLimits[key];
+    return w !== null && typeof w === 'object' && !Array.isArray(w) ? w : undefined;
+}
+/** The epoch a window rolls over at, or `null` when this reading does not name one. */
+const resetOf = (w) => w !== undefined && typeof w.resets_at === 'number' && Number.isFinite(w.resets_at) ? w.resets_at : null;

package/dist/render.js

@@ -137,6 +137,12 @@ export function renderSettings(config, configFile) {
         ['port', String(config.port.value), config.port.source],
         ['snapshots', config.snapshotsDir.value, config.snapshotsDir.source],
     ];
+    // Only when there are any. An empty list is what every other run has, chosen by nobody —
+    // a `(default)` line saying "none" on every serve is noise, and this line has to read as
+    // what it is: the one setting that widened who may read this port.
+    if (config.trustHosts.value.length > 0) {
+        rows.push(['trusted', config.trustHosts.value.join(', '), config.trustHosts.source]);
+    }
     // Only the LABEL column is padded. Padding the values aligned the sources against the
     // snapshots path, which is absolute — pushing the one word that says where a value came
     // from past the edge of an 80-column terminal.
@@ -157,7 +163,7 @@ export function renderTable({ rows, health }) {
         r.effort ?? '—',
         r.costUsd === null ? '—' : `$${r.costUsd.toFixed(2)}`,
         r.uptimeMs === null ? '—' : `${Math.round(r.uptimeMs / 3600000)}h`,
-    ]);
+    ].map(clip));
     const w = head.map((h, i) => Math.max(h.length, ...body.map((r) => r[i].length)));
     const line = (cells) => cells.map((c, i) => c.padEnd(w[i])).join('  ').trimEnd();
     const warns = [];
@@ -192,6 +198,11 @@ export function renderTable({ rows, health }) {
         warns.push(`! ${skewed} reading(s) are dated in the future — ${SKEW}`);
     if (health.unknownStatus > 0)
         warns.push(`! ${health.unknownStatus} session(s) report an unknown status`);
+    const account = accountLimits(rows, health.generatedAt);
+    const gauges = readLimits(account === null ? null : account.rateLimits, health.generatedAt);
+    const split = accountSplit(account, gauges);
+    if (split)
+        warns.push(`! ${split}`);
     // Last, and never instead of anything above: this one is a heads-up, not a fault.
     const schema = schemaNotice(health.schemaGuard);
     if (schema)
@@ -200,7 +211,86 @@ export function renderTable({ rows, health }) {
     return ([line(head), ...body.map(line)].join('\n') +
         '\n' +
         (warns.length ? '\n' + warns.join('\n') + '\n' : '') +
-        `\n${health.sessions} sessions · ${health.busy} busy · ${total}\n`);
+        `\n${health.sessions} sessions · ${health.busy} busy · ${total}\n${accountLine(gauges, account, health)}\n`);
+}
+/**
+ * The account's two windows, under the fleet rather than in a column.
+ *
+ * They are the one pair of numbers in this table that is not about a session: every row above
+ * spends from the same five-hour and seven-day allowance, so a column of them would be the
+ * same two numbers printed once per session. Under the totals, where the other fleet-wide
+ * facts are.
+ *
+ * Dated like every reading here, and always: the AS OF column exists because a percentage is
+ * as old as the frame that wrote it, and this one has no column to be dated by. The `!` is the
+ * same mark, past the same threshold, explained by the same warning above.
+ */
+function accountLine(gauges, account, health) {
+    const windows = gauges
+        .map((g) => `${g.label} ${g.pct === null ? `— ${LIMIT_WHY[g.why]}` : `${g.pct}% ${resetWords(g.resetsInMs, '—')}`}`)
+        .join(' · ');
+    // A reading is dated; no reading is not. The two states read alike in the windows above —
+    // `— no reading` is what a payload with no rate limits and a fleet with no snapshot at all
+    // both come to — and the age is what tells them apart: a snapshot that said nothing carries
+    // the moment it said it, and a fleet nothing was read for has no such moment to print.
+    const as = account === null ? '' : ` · as of ${age(account.ageMs)}${account.ageMs > health.staleAfterMs ? ' !' : ''}`;
+    return `account  ${windows}${as}`;
+}
+/**
+ * What to say when the readings behind that line are not all about the same windows, and
+ * `null` on the ordinary fleet, where they are.
+ *
+ * One warning for both surfaces to be written from: the account is the ONE number here picked
+ * out of several that could have been it, and a picked winner presented as the fleet's account
+ * is exactly what a fleet signed into two logins at once would look like. The count is what the
+ * reader needs in order to go and look; WHY two windows were open at the same time is published
+ * nowhere tarmac reads, so it is not guessed.
+ *
+ * Only windows that are drawn as a number, because this sentence qualifies one: a window the
+ * surface prints as `— schema drift` has nothing for "the freshest is shown" to be true of, and
+ * a warning derived from a field the line under it has just called unreadable is a warning about
+ * the wrong thing. When that leaves nothing to name, there is nothing to say.
+ */
+function accountSplit(account, gauges) {
+    if (account === null || account.apart === 0)
+        return null;
+    const drawn = new Set(gauges.filter((g) => g.pct !== null).map((g) => g.key));
+    const labels = LIMIT_WINDOWS.filter((w) => account.apartWindows.includes(w.key) && drawn.has(w.key)).map((w) => w.label);
+    if (labels.length === 0)
+        return null;
+    const which = `the ${labels.join(' and ')} window${labels.length === 1 ? '' : 's'}`;
+    // Said the long way round on purpose: "1 of 4 readings names" and "2 of 4 readings name" are
+    // two sentences, and a count that has to agree with a verb is a count someone will get wrong.
+    return `${which} ${labels.length === 1 ? 'is' : 'are'} read differently by ${account.apart} of ${account.readings} readings — the freshest is shown`;
+}
+/**
+ * How wide a column may get, `null` for one nothing can stretch.
+ *
+ * Four of the eight carry a string this tool did not choose the length of — a directory
+ * basename, a status word tarmac does not know or the free text a `waiting` session gives, a
+ * model name, an effort — and one long value in any of them used to push every row of the
+ * table past 190 columns, on a terminal that wraps at 80. The caps are picked so that the
+ * worst fleet a source can hand this renderer stays within 120 CODE POINTS a row — display
+ * width is the wider, separate question (#80): a CJK glyph is one point and two columns, and
+ * the width math below counts `.length` like it always has. The page has CSS to wrap with, a
+ * terminal has nothing. The other four are a percentage, an age, a cost and an hour count;
+ * their own magnitude is what bounds them, and no cap here would ever bite.
+ */
+// STATE is the widest of the four because it is two facts on one line: the state, and the
+// reason a `waiting` session gives for being in it. `waiting · permission prompt` — the
+// reason the fleet's own suite is written around — is 27 of these 28 columns.
+const CAPS = [20, 28, null, null, 16, 8, null, null];
+/**
+ * One cell, cut to its column. The ellipsis is spent out of the cap rather than added past
+ * it — a cap a cut cell can exceed is not a cap — and the cut is by code point, because half
+ * a surrogate pair is not a shorter name, it is a broken one.
+ */
+function clip(cell, i) {
+    const cap = CAPS[i];
+    if (cap === null)
+        return cell;
+    const chars = Array.from(cell);
+    return chars.length <= cap ? cell : chars.slice(0, cap - 1).join('') + '…';
 }
 /**
  * The STATE column, out of the same verdict the page draws from.
@@ -330,7 +420,7 @@ export function renderLive(fleet) {
     </table></div></div>
 <div class="view view-map" role="group" aria-label="fleet map" aria-describedby="fleet-notes">${renderMap(fleet)}</div>`;
     return `<div id="limits-src" hidden>${renderLimits(fleet)}</div>
-<div class="meta">${health.sessions} session${health.sessions === 1 ? '' : 's'} · ${health.busy} busy · ${cost(health)} · ${esc(new Date(health.generatedAt).toISOString())}</div>
+<div class="meta">${health.sessions} session${health.sessions === 1 ? '' : 's'} · ${health.busy} busy · ${cost(health)}<span class="stamp"> · ${esc(new Date(health.generatedAt).toISOString())}</span></div>
 ${warnings.map((w) => `<div class="warn">${esc(w)}</div>`).join('')}
 ${body}
 <div id="fleet-notes">${notes.map((n) => `<div class="note">${esc(n)}</div>`).join('')}</div>`;
@@ -349,10 +439,9 @@ ${body}
  * alone would be as old as the tab.
  */
 export function renderLimits({ rows, health }) {
-    const account = accountLimits(rows);
-    const gauges = readLimits(account === null ? null : account.rateLimits, health.generatedAt)
-        .map(gauge)
-        .join('');
+    const account = accountLimits(rows, health.generatedAt);
+    const read = readLimits(account === null ? null : account.rateLimits, health.generatedAt);
+    const gauges = read.map(gauge).join('');
     // Dated when the snapshot behind it is past the threshold, exactly as the table dates a stale
     // context. It matters more here than anywhere else on the page: the percentage is as old as
     // that snapshot, while the countdown beside it is recomputed on every five-second re-render —
@@ -363,7 +452,15 @@ export function renderLimits({ rows, health }) {
     // fact said twice is noise. The replay has no equivalent — the ring keeps each reading and
     // never how old it was, which is why nothing replayed on this page is dated.
     const stale = account !== null && account.ageMs > health.staleAfterMs;
-    return gauges + (stale ? `<span class="stale">! ${esc(asOfAge(account.ageMs))} ago</span>` : '');
+    // The other thing that can be wrong with this pair, and the one the age cannot say: the
+    // number was picked out of several readings, and they were not all about the same window.
+    // Beside the number rather than in a box below the fleet, because what it qualifies is the
+    // number — and it says the whole sentence, since a mark whose reason is elsewhere is a mark
+    // the reader cannot argue with.
+    const split = accountSplit(account, read);
+    return (gauges +
+        (stale ? `<span class="stale">! ${esc(asOfAge(account.ageMs))} ago</span>` : '') +
+        (split === null ? '' : `<span class="mixed">! ${esc(split)}</span>`));
 }
 /**
  * One window. Four things in a line: which window it is, a bar for the glance, the number that
@@ -380,7 +477,7 @@ function gauge(g) {
         : `<span class="rail" aria-hidden="true"><i style="width:${g.pct}%"></i></span>`;
     return (`<div class="gauge"><span class="lbl" aria-hidden="true">${g.label}</span><span class="sr">${g.said}</span>` +
         `${rail}<span class="num">${g.pct === null ? dash() : `${g.pct}%`}</span>` +
-        `<span class="reset">${g.pct === null ? LIMIT_WHY[g.why] : resetWords(g.resetsInMs)}</span></div>`);
+        `<span class="reset">${g.pct === null ? LIMIT_WHY[g.why] : resetWords(g.resetsInMs, dash())}</span></div>`);
 }
 /** Which kind of missing a missing window is, in the two words both surfaces use. */
 const LIMIT_WHY = { absent: 'no reading', drift: 'schema drift' };
@@ -391,7 +488,7 @@ const LIMIT_WHY = { absent: 'no reading', drift: 'schema drift' };
  * after the reading that reported it, so the percentage beside these words belongs to a window
  * that no longer exists. Saying that is the whole point of showing a reset at all.
  */
-const resetWords = (ms) => ms === null ? `reset ${dash()}` : ms > 0 ? `resets in ${left(ms)}` : `reset was due ${left(-ms)} ago`;
+const resetWords = (ms, none) => ms === null ? `reset ${none}` : ms > 0 ? `resets in ${left(ms)}` : `reset was due ${left(-ms)} ago`;
 /**
  * How long, in the two units that matter at each scale. Deliberately finer than `duration()`
  * next door, which floors a session's uptime to whole hours: five hours is a window someone
@@ -494,7 +591,10 @@ export function renderPage(fleet, view = 'table') {
      reading, the payload shapes nobody has captured yet. It reads as chrome to someone
      scanning their sessions and as an answer to someone who came looking for it. */
   .note { color:var(--dim); font-size:.75rem; line-height:1.5; margin:.9rem 0 0; max-width:95ch; }
-  .stale { color:var(--warn); font-weight:600; }
+  /* Two marks, one weight: a reading that has gone cold, and a reading picked out of several
+     that were not about the same window. Both say the number beside them may not be what the
+     reader takes it for, so neither may end up quieter than the other. */
+  .stale, .mixed { color:var(--warn); font-weight:600; }
   .wrap { overflow-x:auto; }
   table { border-collapse:collapse; width:100%; min-width:44rem; }
   th { text-align:left; font-weight:600; font-size:.75rem; text-transform:uppercase; letter-spacing:.06em;
@@ -535,6 +635,28 @@ export function renderPage(fleet, view = 'table') {
   nav a { color:var(--dim); text-decoration:none; font-size:.8rem; font-weight:600; text-transform:uppercase;
           letter-spacing:.06em; padding:.15rem .55rem; border-radius:99px; border:1px solid transparent; }
   nav a[aria-current="page"] { color:var(--fg); border-color:var(--line); }
+  /* A finger is not a cursor. Every control on this page is a pill sized for a pointer that
+     lands on a single pixel — about 26px of box against the 44 a thumb is asked to hit — and
+     the fix cannot be more padding: that would redraw the page for everyone to solve a problem
+     only a touchscreen has. So the TAPPABLE box grows and the drawn one does not, through an
+     invisible overlay that exists only where the pointer is coarse.
+
+     Two rules rather than one: the inset is what is LEFT to reach 44 once the pill's own line
+     box and padding are counted, and the way out of a replay is set in smaller type than the
+     tabs. Sized as one number for all three, it came out at 41px. The border is NOT part of that
+     sum: the overlay's containing block is the control's padding box, so the border sits inside
+     the rectangle rather than adding to it. Counting it read 45.2px for a target Chrome laid out
+     at 43.2 — the whole feature short of the threshold it exists for, in both rules at once.
+
+     Vertical only. Every control here is already wider than 44px on its own text (the narrowest,
+     Map, is 50), so a horizontal inset buys nothing — and at .3rem against a .15rem gap between
+     the tabs it made their two overlays overlap by 7px, where a tap meant for Table landed on
+     Map because Map's pseudo paints later. */
+  nav a, .replay button, .replaying-note button { position:relative; }
+  @media (pointer: coarse) {
+    nav a::after, .replay button::after { content:''; position:absolute; inset:-.7rem 0; }
+    .replaying-note button::after { content:''; position:absolute; inset:-.85rem 0; }
+  }
   body[data-view="table"] .view-map { display:none; }
   body[data-view="map"] .view-table { display:none; }
 
@@ -585,6 +707,12 @@ export function renderPage(fleet, view = 'table') {
      beats it: unguarded, this page came up announcing a replay nobody had asked for. */
   .replay:not([hidden]) { display:flex; align-items:center; gap:.6rem; flex-wrap:wrap; margin-top:1rem;
             padding-top:.7rem; border-top:1px solid var(--line); }
+  /* The pair gets a name. A button reading "Play" and a slider under a map, with nothing
+     saying what they move, is a control nobody dares touch — which on a phone is most of what
+     is on screen. Its own line above them, because dropped into the row it would read as a
+     label for the button rather than for the pair, and take width from the slider to do it. */
+  .replay .replay-name { flex-basis:100%; font-size:.7rem; font-weight:700; letter-spacing:.07em;
+            text-transform:uppercase; color:var(--dim); }
   .replay button { font:inherit; font-size:.8rem; color:var(--fg); background:transparent;
             border:1px solid var(--line); border-radius:99px; padding:.15rem .8rem; cursor:pointer; }
   .replay input[type="range"] { flex:1; min-width:10rem; accent-color:var(--dim); }
@@ -687,7 +815,7 @@ export function renderPage(fleet, view = 'table') {
      it is the only thing on the strip that has no length limit. */
   .node .prompt { flex:1; min-width:0; color:var(--dim); font-size:.76rem;
           overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
-  /* Said, not shown: the three glyphs differ in silhouette, so a reader who cannot separate
+  /* Said, not shown: the four glyphs differ in silhouette, so a reader who cannot separate
      two hues still has the state — but a screen reader is handed a bullet and nothing else. */
   .sr { position:absolute; width:1px; height:1px; overflow:hidden; clip-path:inset(50%); white-space:nowrap; }
   .dial { position:relative; width:5.5rem; height:5.5rem; }
@@ -756,17 +884,75 @@ export function renderPage(fleet, view = 'table') {
   .asof.stale { color:var(--warn); font-weight:600; }
   @media (max-width: 30rem) { .map.flat { grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr)); } .map { gap:.6rem; } }
 
-  /* Below this the table stops being a table: one card per session, every value keeping the
-     name of the column it came from. Nothing is dropped — a phone that hides the context
-     column would be a phone that renders "not measured" as nothing at all. */
+  /* Below this the table stops being a table. What replaces it is the strip described down at
+     the tr rule: two lines per session rather than one card of eight labelled ones. Nothing is
+     dropped — a phone that hid the context column would be a phone that rendered "not measured"
+     as nothing at all — and the labels that go are the ones whose value says what it is on its
+     own, with the exceptions named where they are given a word back. */
   @media (max-width: 46rem) {
     body { padding:1.25rem .75rem; }
+    /* The summary's ISO stamp, spent. It is the widest thing on that line and the header two
+       lines above already says the same fact in the words a reader uses — "updated 3s ago",
+       counted by the shell whether or not a poll ever lands. Hidden rather than dropped: the
+       fragment still carries the exact second for anyone who goes looking for it. */
+    .meta .stamp { display:none; }
+    /* The handle, pinned under the thumb. The scrubber sits at the FOOT of the map and a map on
+       a phone is several screens tall: dragging it means the dials it moves are above the fold,
+       so the reader scrubs blind, lets go, scrolls up to see what changed and scrolls back. Held
+       at the bottom of the viewport, the hand and the thing it is changing are on screen at once.
+
+       Opaque and above what passes under it, or the dials scroll through the slider dragging
+       them. The negative margin gives it the page's own gutters back, so the bar reaches the
+       edges of the phone and the rule above it reads as an edge rather than a floating line.
+
+       The sentence under the handle stays. Hiding it for the length of a replay was the obvious
+       way to keep the bar short, and it silently undid a fix this file argues for forty lines
+       into coversText: two of its three parts are standing properties of the RECORD, not the
+       range — nothing replayed here is dated, and the past is drawn ungrouped — and they were
+       put in the reader's view precisely because they had lived "nowhere the reader can see it"
+       and an ungrouped map reads as a rendering that broke. A phone replaying is exactly when a
+       reader is staring at one. The bar is taller for it. */
+    body.replaying .replay:not([hidden]) { position:sticky; bottom:0; z-index:3;
+         background:var(--bg); border-top:1px solid var(--line);
+         padding:.55rem .75rem .8rem; margin:1rem -.75rem 0; }
     .wrap { overflow-x:visible; }
-    table, tbody, tr, td { display:block; }
+    table, tbody { display:block; }
     table { min-width:0; }
     thead { display:none; }
-    tr { border:1px solid var(--line); border-left-width:3px; border-radius:8px;
-         padding:.35rem .7rem; margin-bottom:.6rem; }
+    /* The card stops being eight labelled lines and becomes the strip the map already speaks.
+       Eight lines is 234px of phone: two and a half sessions fill the screen, and "is anything
+       waiting on me" costs four screens of scrolling. Two lines instead — who and in what
+       state, then the numbers, "ctx 65% · Opus 5 · medium · $20.79 · up 15h", which is the
+       line a docked agent has always printed on the map next door.
+
+       Nothing is dropped. The labels that go are the ones whose values wear their own name: a
+       "$", "%", a model, a state that is a word. The two that do not get one back below, in
+       the strip's own words rather than as a column heading.
+
+       The cell steps out of the layout entirely, with display:contents, so the row is the flex
+       container and every VALUE is one of its items. Anything else puts a box between the row
+       and the thing being placed, and the order below would have nothing to order. */
+    tr { display:flex; flex-wrap:wrap; align-items:baseline; column-gap:.4rem; row-gap:.05rem;
+         border:1px solid var(--line); border-left-width:3px; border-radius:8px;
+         padding:.5rem .75rem .55rem; margin-bottom:.55rem; }
+    /* white-space on the CELL, and not on the row: the desktop rule being undone is
+       td { white-space:nowrap }, and an explicit declaration on the cell beats anything the row
+       passes down — display:contents takes the cell out of the layout, not out of the cascade.
+       Put on the row instead, it read correctly and left the project name 128px past the phone. */
+    td { display:contents; white-space:normal; }
+    /* The column names are gone from this width, and there is no pseudo-element hiding them for
+       a screen reader: both ways of trying were measured against Chrome's accessibility tree and
+       neither works. Out of flow (the .sr recipe) the eight labels are read as ONE block after
+       the whole table, detached from every value they name — worse than silence. In flow at zero
+       size they are pruned from the tree entirely, and they still move the strip. What a reader
+       hears is the strip itself: "beacon, beacon-8c, waiting · permission prompt, ctx 65%, Opus
+       5, medium, $20.79, up 15h" — named for five of the eight, and unnamed for the project, the
+       session and the model. The desktop table names all eight in its thead, and so does every
+       JSON surface. Naming them here needs markup, and markup is not what this change is. */
+    /* The line break, as an item: zero-height, full-width, wedged between the state and the
+       first number. Without it the strip is a paragraph that reflows per session, and a column
+       of cards whose second line starts somewhere different each time cannot be scanned. */
+    tr::after { content:''; order:4; flex-basis:100%; height:0; }
     tr[data-state="busy"] { border-left-color:var(--busy); }
     tr[data-state="waiting"] { border-left-color:var(--wait); }
     tr[data-state="unknown"] { border-left-color:var(--warn); }
@@ -788,11 +974,74 @@ export function renderPage(fleet, view = 'table') {
        away. It spans the row instead, like the cells below it. The berth docks its own strips
        full width at every size, so what this rule is left covering is the REPLAY's flat grid. */
     .node[data-role="agent"] { grid-column:1 / -1; }
-    td, td:first-child { border:0; padding:.2rem 0; white-space:normal;
-         display:flex; justify-content:space-between; align-items:baseline; gap:1rem; }
-    td::before { content:attr(data-label); color:var(--dim); font-size:.72rem; font-weight:600;
-         text-transform:uppercase; letter-spacing:.06em; flex:none; }
-    .v { text-align:right; }
+    /* Line one: who, and in what state. The project leads and carries the weight; the session
+       name travels beside it in the page's grey. That order is deliberate and it is a red line
+       — a background session is NAMED AFTER ITS PROMPT, and a prompt set as the heading of a
+       card is a dashboard announcing what its agents were told to do, in the largest type on
+       the page. It also has no length limit, so it is the one value here allowed to wrap: the
+       page is content-box at this width and .wrap has given up its overflow-x, so a line
+       that refuses to break takes the whole document sideways.
+
+       The cell above hands back the white-space the desktop table takes; these two need the
+       other half of it, because both can arrive as ONE long token — a project is a directory's
+       basename, a background session's name is a prompt — and normal has nowhere to break a
+       word. min-width:0 for the same reason the berths carry it: a flex item's automatic
+       minimum is its min-content width, which without this is the whole unbroken string. */
+    td[data-label="Project"] .v { order:1; font-weight:600; min-width:0; overflow-wrap:anywhere; }
+    td[data-label="Session"] .v { order:2; flex:1 1 0; min-width:0; color:var(--dim);
+         white-space:normal; overflow-wrap:anywhere; }
+    /* The third value that can arrive as one unbroken token, and the one the two rules above
+       missed: a waiting reason is FREE TEXT, so "permission prompt: /Users/…/foo.ts" is a path
+       with no space to break at. Wrapping inside the pill (below) breaks a sentence and does
+       nothing for a path — at 320px an 84-character token laid the document out at 483px, 455 of
+       them this cell, which is the scroll bar the fix beside it had just closed. */
+    td[data-label="State"] .v { order:3; min-width:0; overflow-wrap:anywhere; }
+    /* The reason a session is waiting is free text: "permission prompt" fits on a phone and a
+       sentence does not. Held nowrap, the pill is one unbreakable item on that first line,
+       which is the same scroll bar by the other road. It wraps inside its own border instead,
+       and the border stops being a capsule once it has three lines to go round: 99px on a box
+       that tall is an ellipse whose curve crosses the words. Under half a single line's height,
+       the radius is still clamped to a capsule on one line and merely rounded on three. */
+    .pill { white-space:normal; border-radius:.9rem; }
+    /* Line two: the numbers, each wearing a name of its own. "65%" alone under a line of prompt
+       reads as how much of the prompt is done, which is the mistake the map's strip already had
+       to fix; "$20.79" and "Opus 5" say what they are without help. */
+    td[data-label="Context"] .v, td[data-label="Model"] .v, td[data-label="Effort"] .v,
+    td[data-label="Cost"] .v, td[data-label="Uptime"] .v { font-size:.82rem; }
+    td[data-label="Context"] .v { order:5; font-variant-numeric:tabular-nums; font-weight:600; }
+    td[data-label="Context"] .v::before { content:'ctx '; color:var(--dim); font-weight:400; }
+    /* The weight above is for a percentage. A session with no reading renders this same cell as
+       "— not chained", and in the number's weight a missing measurement reads like a
+       measurement — heavier here than the same words are on the desktop table. */
+    td[data-label="Context"] .v .dim { font-weight:400; }
+    /* Same two rules again, and the same argument: a model and an effort are not tarmac's own
+       words. They are model.display_name and the effort out of a statusline payload, copied
+       through verbatim and capped nowhere — a 120-character model laid the document out at
+       814px. The three numbers below stay off this list, and NOT because of where they come
+       from: a cost is copied out of that same payload and guarded even less (1e999 is legal
+       JSON and reaches the cell as $Infinity, where a percentage that shape is refused). It is
+       what they are PRINTED through that bounds them — a percentage clamped to 0..100 and
+       floored, a duration, and a toFixed(2) that goes exponential long before it goes long.
+       None can be a token wider than a phone, and a guard for that is prose that lies. */
+    td[data-label="Model"] .v { order:6; min-width:0; overflow-wrap:anywhere; }
+    td[data-label="Effort"] .v { order:7; color:var(--dim); min-width:0; overflow-wrap:anywhere; }
+    td[data-label="Cost"] .v { order:8; font-variant-numeric:tabular-nums; }
+    td[data-label="Uptime"] .v { order:9; color:var(--dim); font-variant-numeric:tabular-nums; }
+    td[data-label="Model"] .v::before, td[data-label="Effort"] .v::before,
+    td[data-label="Cost"] .v::before { content:'· '; color:var(--dim); font-weight:400; }
+    td[data-label="Uptime"] .v::before { content:'· up '; color:var(--dim); font-weight:400; }
+    /* A dash is not a value that wears its own name, and a session with no snapshot behind it
+       has four of them at once: the percentage, the model, the effort and the cost all come out
+       of one statusline frame, so they go missing together. That is not the corner case — it is
+       every session until the status line has been chained and each one has drawn a frame, the
+       state the page prints a warning about. As a strip it read "ctx — not chained · — · — · —",
+       three anonymous dashes in a row, and the same happens one at a time for a session that
+       reports no cost. Those three get their column word back; the other two already have one.
+       The hook is the markup's own — a missing value is a .dim inside the cell's .v, and a
+       present one never puts one there. */
+    td[data-label="Model"] .v:has(.dim)::before { content:'· model '; }
+    td[data-label="Effort"] .v:has(.dim)::before { content:'· effort '; }
+    td[data-label="Cost"] .v:has(.dim)::before { content:'· cost '; }
     .bar { display:none; }
   }
 </style>
@@ -850,6 +1099,9 @@ export function renderPage(fleet, view = 'table') {
 <!-- A dead handle is worse than no handle: this is revealed once the record is in hand, and
      what it says it covers is whatever the record answered with. -->
 <div class="replay" id="replay" hidden>
+  <!-- "Replay", and nothing about how much of the day it holds: the range is the record's to
+       state, in the sentence below, which is built around never calling ten minutes a day. -->
+  <span class="replay-name">Replay</span>
   <button type="button" id="play">Play</button>
   <input type="range" id="scrub" min="0" max="0" step="1" value="0" disabled aria-label="Replay position">
   <div class="covers" id="covers"></div>
@@ -877,7 +1129,7 @@ export function renderPage(fleet, view = 'table') {
  * The replay below is the one exception, and it is one the issue asks for: scrubbing a day
  * has to be a lookup in samples the page already holds, or every pixel of a drag would be a
  * request and a `claude agents --json` behind it. So a second, smaller renderer lives in the
- * browser — fed the same three words, the same three glyphs and the same dial geometry as the
+ * browser — fed the same three words, the same four glyphs and the same dial geometry as the
  * server's, by interpolation rather than by copy, and executed by `test/replay-script`.
  */
 export const REFRESH_MS = 5000;
@@ -912,6 +1164,22 @@ function pageScript(view) {
   var off = document.getElementById('offline'), why = document.getElementById('why');
   var limits = document.getElementById('limits');
   var last = Date.now(), failing = false, inFlight = false, since = 0, gen = 0;
+  // How many polls in a row have come back with nothing usable, and when the last of them was.
+  // On a phone the page is read on a radio, and one dropped request is a tunnel rather than an
+  // outage — the banner frames the table off and says the fleet cannot be read, which is the
+  // wrong thing to shout five seconds before the next answer lands. It waits for the second
+  // consecutive miss; the age upstairs keeps counting meanwhile, so nothing on the page is
+  // claiming to be fresher than it is.
+  //
+  // Consecutive means in a row IN TIME, which is why the stamp is here. A count cleared only by
+  // a successful poll is not the same rule: a hidden tab issues no polls, so a miss from before
+  // the reader locked their phone sat there for an hour, and the wake-up poll — the likeliest
+  // miss of the session, fired while the radio is still reassociating — found it and raised the
+  // banner over one dropped request. A miss further back than a few poll intervals starts the
+  // count again. The window is bounded at both ends and neither end is arbitrary: below one
+  // poll interval two real misses in a row would never meet, and above five a locked phone
+  // comes back to a miss from minutes ago being called consecutive with this one.
+  var misses = 0, missAt = 0, MISSES_BEFORE_BANNER = 2, MISS_WINDOW_MS = 3 * ${REFRESH_MS};
 
   function ago(ms) {
     // A clock that steps backwards (an NTP correction, a laptop waking) must not produce
@@ -922,8 +1190,18 @@ function pageScript(view) {
     return m < 60 ? m + 'm' : Math.round(m / 60) + 'h';
   }
 
+  // Called for the one failure that is NOT a missed poll: a request the server accepted and
+  // never answered. Twenty seconds of silence from a live connection is not a dropped packet,
+  // so it says so at once, without the second miss the count is there to wait for. It does not
+  // touch the count: a miss cannot take this banner back down, because a miss never assigns the
+  // failing flag anything but true, and only an ANSWER puts it back to false.
   function fail(why_) {
     failing = true;
+    // Retired, not merely dropped. Clearing the in-flight flag without moving the generation
+    // left the abandoned request still ours, so the answer that arrived twenty seconds later was
+    // swapped in and stamped "updated 0s ago" — the freshest label on the page over a fleet read
+    // before the stall was declared. The manual has always said such an answer is discarded.
+    gen += 1;
     why.textContent = why_;
     off.hidden = false;
     document.body.classList.toggle('failing', true);
@@ -983,10 +1261,20 @@ function pageScript(view) {
         if (src) limits.innerHTML = src.innerHTML;
         last = Date.now();
         failing = false;
+        // Consecutive, not cumulative: two blips an hour apart are two blips, and a count that
+        // never went back to zero would turn the second one into a permanent banner.
+        misses = 0;
       });
     }).catch(function (e) {
       if (!mineStill()) return;
-      failing = true;
+      if (Date.now() - missAt > MISS_WINDOW_MS) misses = 0;
+      misses += 1;
+      missAt = Date.now();
+      // Raised here, never lowered here. Only an ANSWER says the server came back, so this
+      // assigns true or nothing at all — derived both ways, the window that starts a fresh count
+      // also cleared the alarm, and a reader who locked their phone for ten minutes while the
+      // server was down unlocked onto a green page over a fleet nobody could read.
+      if (misses >= MISSES_BEFORE_BANNER) failing = true;
       why.textContent = String((e && e.message) || e).slice(0, 200);
     }).then(function () {
       // Not ours to unlock: a request we were given up on must not clear a flag that a newer
@@ -1014,7 +1302,7 @@ function pageScript(view) {
   var record = null, recordAt = 0, at = -1, replaying = false, playing = null, hgen = 0;
 
   // The vocabulary and the geometry, handed over rather than written twice: three words for
-  // the three kinds of missing, three glyphs for the three states, one dial radius.
+  // the three kinds of missing, four glyphs for the four states, one dial radius.
   var WHY = ${JSON.stringify(CTX_WHY)}, SHAPE = ${JSON.stringify(SHAPE)};
   var INTERACTIVE = ${JSON.stringify(INTERACTIVE)};
   var ENT = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
@@ -1379,11 +1667,13 @@ function pageScript(view) {
 function renderRow(r) {
     const state = stateOf(r);
     const word = stateLabel(state, r);
-    // `data-label` is not decoration: below ~46rem the columns stack, the header row is gone,
-    // and a value whose column has no name is a bare "—" that could mean anything.
-    // Every cell holds exactly ONE element. Stacked on a phone the label sits left and the
-    // value right, and two sibling nodes in one cell get pushed to opposite ends of the card —
-    // which is how "63%" once ended up stranded in the middle of a row, under the wrong label.
+    // `data-label` is not decoration, and no longer only for the reason it was: the header row is
+    // gone below ~46rem, and what the attribute does there is CARRY THE STRIP. The per-column
+    // rules select `td[data-label="…"] .v` for their `order`, for their wrapping, and for the five
+    // `::before` prefixes that are the only column words left at that width — `ctx `, `· up `, and
+    // `· model `/`· effort `/`· cost ` for a value that is a bare dash. One element per cell, since
+    // `td` is `display:contents` there: the `.v` IS the row's flex item, and a second sibling in
+    // one cell would be a second item placed on an `order` of its own.
     return `<tr data-state="${state}">
     <td data-label="Project" class="project"><span class="v">${esc(r.project)}</span></td>
     <td data-label="Session" class="dim"><span class="v">${esc(r.name)}</span></td>

package/dist/server.js

@@ -4,7 +4,7 @@
 // so a read-only snapshot directory (the fleet's own, for the demo) is just a parameter.
 import http from 'node:http';
 import { reason, renderLive, renderPage } from './render.js';
-import { SOURCE_PHRASE } from './config.js';
+import { hostName, SOURCE_PHRASE } from './config.js';
 import { createHistory, HISTORY_CADENCE_MS } from './history.js';
 /**
  * On every answer, including the refusals and the 500s. The page swaps what this port returns
@@ -20,7 +20,23 @@ const PAGES = new Map([
     ['/', 'table'],
     ['/map', 'map'],
 ]);
-export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS }) {
+export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS, trustedHosts = [] }) {
+    // Normalised HERE rather than trusted to arrive that way. This is the last thing between a
+    // foreign origin and the fleet, so it owns both sides of its own comparison — the config
+    // parser cuts a name the same way, and neither leans on the other having done it.
+    //
+    // The empty one is dropped for the same reason, and it is not tidiness: a name that
+    // normalises to nothing is a name that every Host normalising to nothing matches — `:8443`,
+    // a lone bracket — which would be a guard standing open on a list that looks set. Nothing
+    // reachable from a flag, a variable or a file gets here empty; that is the parser's promise,
+    // and this is the guard not resting on it.
+    const trusted = new Set(trustedHosts.map((h) => hostName(h.trim()).toLowerCase()).filter((h) => h !== ''));
+    // Which rule refused, decided once. With hosts named, "loopback hosts only" would read as a
+    // flag that never took; with none, this is the sentence it has always been, to the byte. The
+    // Host itself is never quoted back: it is the one string on the request the caller wrote.
+    const refusal = trusted.size === 0
+        ? 'tarmac serves loopback hosts only\n'
+        : 'tarmac serves loopback and trusted hosts only\n';
     // What this serve has already read, kept for a day and never written down. `since` is the
     // moment this server was made, not the first sample that landed: the span it covers is how
     // long the process has been up, and an hour of it with nothing in it is a fact worth
@@ -51,10 +67,12 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS
     };
     const server = http.createServer(async (req, res) => {
         // Loopback binding alone does not stop a DNS-rebinding page in the user's own browser
-        // from reading /api/fleet — which carries cwd paths, session ids and costs.
-        if (!isLoopbackHost(req.headers.host)) {
+        // from reading /api/fleet — which carries cwd paths, session ids and costs. Whatever a
+        // reader trusted on top of that is a name, exactly: matched whole, never as a prefix, a
+        // suffix or a pattern, so trusting one host can never be trusting a family of them.
+        if (!isLoopbackHost(req.headers.host) && !isTrustedHost(req.headers.host, trusted)) {
             res.writeHead(403, { ...IDENTITY, 'content-type': 'text/plain; charset=utf-8' });
-            res.end('tarmac serves loopback hosts only\n');
+            res.end(refusal);
             return;
         }
         // The Host check stops another origin READING this port; it does not stop one poking it.
@@ -226,6 +244,30 @@ function attempt(server, port, host) {
 function isLoopbackHost(host) {
     if (!host)
         return false;
-    const name = host.replace(/:\d+$/, '').replace(/^\[|\]$/g, '');
+    const name = hostName(host);
     return name === 'localhost' || name === '127.0.0.1' || name === '::1';
 }
+/**
+ * One of the names the reader wrote down, matched whole — never as a prefix, a suffix or a
+ * pattern, and no wildcard is accepted into that list or honoured against a request.
+ *
+ * What is matched is the name `hostName` cuts out, and that cut is the loopback check's, kept
+ * shared rather than tightened: it drops the port, and it drops a leading `[` or a trailing
+ * `]` whether or not they pair. So `[name` and `name]` reach the comparison as `name`, exactly
+ * as `[localhost` has always reached it as `localhost`. Nothing is opened by it — `Host` is a
+ * forbidden header, a browser derives it from the URL, and a client free to type the header is
+ * free to type the name itself — and narrowing it here would change what the default answers.
+ *
+ * The port is not part of the name on either side: a proxy presents `name:8443` on one setup
+ * and a bare `name` on 443, and the port in a `Host` header is chosen by whoever sends it, so
+ * matching on it would have refused half the setups this exists for and barred nobody. Case is
+ * not part of it either — host names are case-insensitive, and the loopback names above are
+ * left exactly as strict as they have always been rather than loosened to match.
+ *
+ * `host` is whichever `Host` node reports; it reports the first when a request carries two.
+ */
+function isTrustedHost(host, trusted) {
+    if (!host || trusted.size === 0)
+        return false;
+    return trusted.has(hostName(host).toLowerCase());
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrrr/tarmac",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Fleet observability for Claude Code — reads documented surfaces only, never an internal format",
   "keywords": [
     "claude",