@adrrr/tarmac 0.8.1 → 0.10.0

package/dist/schema.js

@@ -63,10 +63,19 @@ export function guardVersions(seen) {
     const state = noVersion > 0 ? 'no-version' : unchecked.length > 0 ? 'unchecked' : 'ok';
     return { state, versions, noVersion, unchecked };
 }
-/** What a human should be told, or `null` when there is nothing worth saying. */
+/** What a human should be told, in the halves a page shows it in. `null` when there is nothing. */
+export function schemaNoteParts(guard) {
+    const said = schemaSaid(guard);
+    return said.length === 0 ? null : { key: 'schema', lead: said[0], rest: said.slice(1).join(' ') };
+}
+/** The same notice, whole. What every caller outside the page still asks for. */
 export function schemaNotice(guard) {
+    const parts = schemaNoteParts(guard);
+    return parts === null ? null : `${parts.lead} ${parts.rest}`.trim();
+}
+function schemaSaid(guard) {
     if (guard.state === 'ok' || guard.state === 'nothing')
-        return null;
+        return [];
     const said = [];
     if (guard.noVersion > 0) {
         const total = guard.noVersion + guard.versions.length;
@@ -83,5 +92,5 @@ export function schemaNotice(guard) {
     // and has no scripts/ directory. Capturing a fixture is a maintainer's move, documented
     // in the README, not something to send a user looking for.
     said.push(`Nothing is blocked and no reading is hidden; if a column starts coming up empty, update tarmac or report it at ${ISSUES_URL}.`);
-    return said.join(' ');
+    return said;
 }

package/dist/server.js

@@ -6,7 +6,7 @@ import http from 'node:http';
 import { reason, renderLive, renderPage } from './render.js';
 import { hostName, SOURCE_PHRASE } from './config.js';
 import { createHistory, HISTORY_CADENCE_MS } from './history.js';
-import { HISTORY_RANGES, readRange } from './history-range.js';
+import { HISTORY_RANGES } from './history-range.js';
 /**
  * On every answer, including the refusals and the 500s. The page swaps what this port returns
  * into `innerHTML`, and loopback proves where an answer came from, never who wrote it: a
@@ -16,13 +16,21 @@ import { HISTORY_RANGES, readRange } from './history-range.js';
  * failures carry it too: their text is what it quotes as the reason.
  */
 const IDENTITY = { 'x-tarmac': '1' };
+/**
+ * A range read that never came back, kept apart from a range read that failed: one is a journal
+ * that answered with a broken file, the other a directory nothing came out of at all. The
+ * handler answers 500 for the first and 504 for the second, and a reader is sent to two
+ * different places by them.
+ */
+class JournalTimeout extends Error {
+}
 /** The addresses that serve the shell, and which view each one opens on. */
 const PAGES = new Map([
     ['/', 'table'],
     ['/map', 'map'],
     ['/history', 'history'],
 ]);
-export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS, trustedHosts = [], store = null, rangeCacheMs = 60_000, report = (line) => console.error(line), }) {
+export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS, trustedHosts = [], store = null, rangeCacheMs = 60_000, readJournal = (s, range, now) => s.read(range, now), rangeDeadlineMs = 30_000, report = (line) => console.error(line), history = createHistory({ since: Date.now(), cadence: sampleEveryMs }), demo = false, }) {
     // Normalised HERE rather than trusted to arrive that way. This is the last thing between a
     // foreign origin and the fleet, so it owns both sides of its own comparison — the config
     // parser cuts a name the same way, and neither leans on the other having done it.
@@ -33,17 +41,23 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
     // reachable from a flag, a variable or a file gets here empty; that is the parser's promise,
     // and this is the guard not resting on it.
     const trusted = new Set(trustedHosts.map((h) => hostName(h.trim()).toLowerCase()).filter((h) => h !== ''));
+    // The page wears a badge; this is the same fact for machines. The HTML shell is one of four
+    // surfaces this port answers, and the other three are JSON and a fragment a consumer may
+    // archive or forward — where an invented fleet with nothing on it saying so becomes a real
+    // one the moment the response body travels alone. On every answer for the same reason
+    // IDENTITY is: the refusals and the 500s of a demo serve are the demo's too.
+    const identity = demo ? { ...IDENTITY, 'x-tarmac-demo': '1' } : IDENTITY;
     // Which rule refused, decided once. With hosts named, "loopback hosts only" would read as a
     // flag that never took; with none, this is the sentence it has always been, to the byte. The
     // Host itself is never quoted back: it is the one string on the request the caller wrote.
     const refusal = trusted.size === 0
         ? 'tarmac serves loopback hosts only\n'
         : 'tarmac serves loopback and trusted hosts only\n';
-    // What this serve has already read, kept for a day and never written down. `since` is the
-    // moment this server was made, not the first sample that landed: the span it covers is how
-    // long the process has been up, and an hour of it with nothing in it is a fact worth
-    // showing rather than an empty record pretending to be a young one.
-    const history = createHistory({ since: Date.now(), cadence: sampleEveryMs });
+    // What this serve has already read, kept for a day and never written down, is the ring above
+    // — its `since` is the moment it was made, not the first sample that landed, so the span it
+    // covers is how long the process has been up and an hour of it with nothing in it is a fact
+    // worth showing rather than an empty record pretending to be a young one.
+    //
     // One at a time. `claude agents --json` has a 15s deadline of its own, and a fleet slower
     // than a slot would otherwise be answered with a queue of processes instead of one missed
     // minute — the tick that finds a read still running counts the slot and stands down.
@@ -89,10 +103,15 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
         if (held !== undefined && (held.at === null || now - held.at < rangeCacheMs))
             return held.reading;
         const entry = { at: null, reading: undefined };
-        // Read once per range per minute rather than per request: `stats()` walks the directory, and
-        // a journal that stopped at its cap stays stopped for hours, so a minute-old answer to that
-        // question is the same answer.
-        entry.reading = readRange({ dir: store.dir, range, now, capped: store.stats().capped }).then((answer) => {
+        // Asked of the STORE, which owns both ends of its own journal: this route never learns where
+        // the days come from, so the invented week `serve --demo` carries arrives here as an ordinary
+        // range read and the demo gets no rendering path of its own (#156). Seeded past the store
+        // only by the suite, whose stuck read no real directory can produce (#136).
+        //
+        // Read once per range per minute rather than per request: the store walks its directory to
+        // answer, and a journal that stopped at its cap stays stopped for hours, so a minute-old
+        // answer to that question is the same answer.
+        entry.reading = readJournal(store, range, now).then((answer) => {
             entry.at = Date.now();
             return answer;
         }, (e) => {
@@ -106,6 +125,36 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
         ranges.set(range, entry);
         return entry.reading;
     };
+    /**
+     * The same read, with a deadline on the REQUEST rather than on the read.
+     *
+     * A read that does not come back is not a read that can be taken back: nothing cancels a
+     * blocked `open`, and the thread it holds is held until the kernel hands it over. So the entry
+     * stays in the cache, and every request that arrives while it is out gives up on its own clock
+     * instead of starting a second read of a directory that is already not answering. If it ever
+     * does land, it is served — to whoever is asking then. The price is written down rather than
+     * hidden: an entry that never settles is never dated, so that range answers 504 for the life
+     * of the process, and a restart is what reads it again.
+     *
+     * What this bounds is the WAIT. `rangeOf` measures the directory synchronously before the read
+     * begins (`readdirSync`, then a `statSync` a file), so a volume that has stopped answering
+     * stops the event loop this timer would have to fire on. A deadline cannot save a thread that
+     * is not running; only asynchronous work is bounded here, and that is the whole of the claim.
+     */
+    const answerRange = (store, range) => new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new JournalTimeout(`nothing came back from ${store.dir} in ${rangeDeadlineMs}ms`)), rangeDeadlineMs);
+        // The nominal path pays one timer and no latency: the answer clears it on the way past.
+        // The unref is the belt, and a narrow one worth naming rather than overselling: while the
+        // request is out its own socket holds the loop, so the only window this covers is a
+        // deadline still counting after the socket has gone. `bounded.ts` carries the same line
+        // for a case that IS reachable in a test, and has one; this one has no test of its own.
+        timer.unref();
+        // Attached, rather than raced with `Promise.race`: this is what marks the shared read's own
+        // failure handled when it arrives after the request that started it has already given up.
+        rangeOf(store, range)
+            .then(resolve, reject)
+            .finally(() => clearTimeout(timer));
+    });
     const sample = async () => {
         // First, and outside the try: the journal's lock says this process is alive, which is a
         // fact about the tick and not about the reading. A collector that has been throwing for
@@ -135,7 +184,7 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
         // reader trusted on top of that is a name, exactly: matched whole, never as a prefix, a
         // suffix or a pattern, so trusting one host can never be trusting a family of them.
         if (!isLoopbackHost(req.headers.host) && !isTrustedHost(req.headers.host, trusted)) {
-            res.writeHead(403, { ...IDENTITY, 'content-type': 'text/plain; charset=utf-8' });
+            res.writeHead(403, { ...identity, 'content-type': 'text/plain; charset=utf-8' });
             res.end(refusal);
             return;
         }
@@ -146,7 +195,7 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
         // spawned; a client that sends no label (curl, a script) is left alone.
         const site = req.headers['sec-fetch-site'];
         if (typeof site === 'string' && site !== 'same-origin' && site !== 'none') {
-            res.writeHead(403, { ...IDENTITY, 'content-type': 'text/plain; charset=utf-8' });
+            res.writeHead(403, { ...identity, 'content-type': 'text/plain; charset=utf-8' });
             res.end('tarmac serves same-origin requests only\n');
             return;
         }
@@ -163,7 +212,7 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
             url.pathname !== '/live' &&
             url.pathname !== '/api/fleet' &&
             url.pathname !== '/api/history') {
-            res.writeHead(404, { ...IDENTITY, 'content-type': 'text/plain; charset=utf-8' });
+            res.writeHead(404, { ...identity, 'content-type': 'text/plain; charset=utf-8' });
             res.end('not found\n');
             return;
         }
@@ -179,7 +228,7 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
                 if (!isRange(asked)) {
                     // The value is not quoted back, for the reason the refused Host is not: it is a string
                     // the caller wrote, and the page swaps a refusal's text into `innerHTML` as its reason.
-                    res.writeHead(400, { ...IDENTITY, 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' });
+                    res.writeHead(400, { ...identity, 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' });
                     res.end(`tarmac serves /api/history for 24h, ${HISTORY_RANGES.join(' and ')}; no range is the last 24h\n`);
                     return;
                 }
@@ -187,17 +236,22 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
                 // would draw a flat line over a month the fleet was busy for.
                 let body;
                 try {
-                    body = store === null ? { enabled: false, range: asked } : { enabled: true, ...(await rangeOf(store, asked)) };
+                    body = store === null ? { enabled: false, range: asked } : { enabled: true, ...(await answerRange(store, asked)) };
                 }
                 catch (e) {
                     // Nothing in `readRange` is allowed to throw, and this is the seam that keeps a day
                     // when something does from being a request that hangs instead of an answer.
-                    res.writeHead(500, { ...IDENTITY, 'content-type': 'text/plain; charset=utf-8' });
+                    //
+                    // A read that has not come back is the other failure, and it is not the same news: 500
+                    // is a read that came back with a failure, 504 is a read that did not come back at all
+                    // — the first sends a reader to the file, the second to the directory. The page prints
+                    // whichever sentence arrives as the reason the charts are empty.
+                    res.writeHead(e instanceof JournalTimeout ? 504 : 500, { ...identity, 'content-type': 'text/plain; charset=utf-8' });
                     res.end(`tarmac could not read the fleet journal:\n${reason(e)}\n`);
                     return;
                 }
                 res.writeHead(200, {
-                    ...IDENTITY,
+                    ...identity,
                     'content-type': 'application/json; charset=utf-8',
                     'cache-control': 'no-store',
                 });
@@ -207,7 +261,7 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
         }
         if (url.pathname === '/api/history') {
             res.writeHead(200, {
-                ...IDENTITY,
+                ...identity,
                 'content-type': 'application/json; charset=utf-8',
                 'cache-control': 'no-store',
             });
@@ -239,18 +293,18 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
                 body =
                     url.pathname === '/live'
                         ? renderLive(fleet)
-                        : renderPage(fleet, PAGES.get(url.pathname), { historyEnabled: store !== null });
+                        : renderPage(fleet, PAGES.get(url.pathname), { historyEnabled: store !== null, demo });
             }
         }
         catch (e) {
             // Say why. A dashboard that goes blank when its source breaks teaches nothing.
-            res.writeHead(500, { ...IDENTITY, 'content-type': 'text/plain; charset=utf-8' });
+            res.writeHead(500, { ...identity, 'content-type': 'text/plain; charset=utf-8' });
             res.end(`tarmac could not read the fleet:\n${reason(e)}\n`);
             return;
         }
         // A page whose entire claim is freshness must not be served from a cache: a restored tab
         // re-running the script over stale HTML would re-stamp it "updated just now".
-        res.writeHead(200, { ...IDENTITY, 'content-type': type, 'cache-control': 'no-store' });
+        res.writeHead(200, { ...identity, 'content-type': type, 'cache-control': 'no-store' });
         res.end(body);
     });
     // The sampler lives exactly as long as the serving does. Started at construction it kept
@@ -266,6 +320,13 @@ export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS,
     server.on('listening', () => {
         if (sampler !== null)
             return;
+        // A demo does not sample. Its collector answers one frozen minute, so every tick would
+        // record that same minute into the ring and push a minute of the invented day off the far
+        // end: one slot a minute, until a serve left up overnight is showing 1440 copies of one
+        // reading. That is the flat chart this whole feature exists to replace. The record it was
+        // handed is the record it keeps, and the live view stays honestly dated either way.
+        if (demo)
+            return;
         // The journal's retention, applied before the first line of this run is written and once a
         // local day after that (the store keeps that half itself). Here rather than in the CLI so
         // that the store `serve` prunes with is, provably, the store `serve` writes with: a `serve`

package/dist/sessions.js

@@ -36,6 +36,31 @@ const KNOWN_STATUS = new Map([
 const WAITING = 'waiting';
 /** Whether this reading is halted on a human. The one status the renderers treat as a state. */
 export const isWaiting = (s) => s.status === WAITING;
+/**
+ * The kind a terminal calls itself, and the anchor the two rules below reason from. A
+ * background entry has since been seen beside them — `kind: 'background'`, no `pid`, its word
+ * under `state` rather than `status` — so the two are no longer a reading of that CLI's help.
+ * It is still the anchor and never the list: one observed alternative is not the vocabulary,
+ * and the question asked is only whether anything on this machine still calls itself
+ * `interactive`.
+ */
+export const INTERACTIVE = 'interactive';
+/**
+ * Whether this fleet still speaks the kind we know. If NOTHING calls itself `interactive`, the
+ * word moved rather than every terminal on the machine going background at once — and the
+ * readers say so by treating them all as what they almost certainly still are. Same tolerance
+ * `buildFleet` already applies to telemetry: a signal true of every row is a change in the
+ * source.
+ */
+export const anchoredOnKind = (rows) => rows.some((r) => r.kind === INTERACTIVE);
+/**
+ * A background entry, under the anchor above. An ABSENT kind is not evidence of one: the same
+ * rule the status follows, where unrecognised means unknown, never "the quiet one". The two
+ * mistakes are not the same size — an agent read as a terminal is a row expecting a frame that
+ * will not come, while a terminal read as an agent is someone's open session dropped out of
+ * every count that is about them.
+ */
+export const isBackgroundAgent = (r, anchored) => anchored && r.kind !== null && r.kind !== INTERACTIVE;
 /** @param text raw stdout of `claude agents --json` */
 export function parseAgents(text) {
     let raw;
@@ -55,8 +80,14 @@ export function parseAgents(text) {
             health.noSessionId += 1;
             continue;
         }
-        const sessionId = typeof entry.sessionId === 'string' ? entry.sessionId : null;
-        if (!sessionId)
+        // The empty string is not an id, and it is a `string`, so the type check alone let it
+        // through: counted as missing here, then carried as `''` to every reader and written to
+        // the journal as `sid: ''`. Each reader neutralises that value its own way (#137) —
+        // normalising at the source says it once, and stops counting the same nameless entry
+        // both here and as unfilable downstream. Absent reads `null` like every field here;
+        // sessionId alone also folds `''` into absent, an empty id being no id at all.
+        const sessionId = typeof entry.sessionId === 'string' && entry.sessionId !== '' ? entry.sessionId : null;
+        if (sessionId === null)
             health.noSessionId += 1;
         // A background agent carries no `status` at all — its word is under `state`. `status`
         // still wins where both are present: it comes from the agent's own process, and `state`

package/dist/snapshots.js

@@ -86,11 +86,13 @@ export function readSnapshots(dir, { now = Date.now() } = {}) {
             snapshots,
             dirError: code === 'ENOENT' ? null : `${code}: ${dir}`,
             unreadable: 0,
+            notFiles: 0,
             duplicates: 0,
             dirMissing: code === 'ENOENT',
         };
     }
     let unreadable = 0;
+    let notFiles = 0;
     let duplicates = 0;
     for (const name of entries) {
         if (!name.endsWith('.json') || name.startsWith('.'))
@@ -99,7 +101,27 @@ export function readSnapshots(dir, { now = Date.now() } = {}) {
         let payload;
         let mtimeMs;
         try {
-            mtimeMs = fs.statSync(file).mtimeMs;
+            // The kind is asked BEFORE the open, and only a regular file is opened. What wears a
+            // snapshot's name is not this reader's to assume: the directory belongs to whoever owns
+            // the machine and a wrapper can be pointed at any of them, while `readFileSync` on a FIFO
+            // waits for someone to write to the other end — a wait with nothing to end it, on the
+            // loop under every surface tarmac has (#160).
+            //
+            // `lstat`, not `stat`, and not for the pipe: `stat` refuses a link to one exactly as this
+            // does. The one shape the two disagree about is a link to an ordinary file, and refusing
+            // that is the choice — a snapshot is what the wrapper wrote, and a link is a name someone
+            // else put there, aimed at something nobody told this reader about. The journal reader
+            // decides the same way for the same reason (#159); this is the hotter path.
+            //
+            // A check before an open is a race, and it stays one: nothing stops the name being
+            // replaced between the two. What that costs is bounded — one blocked read, on a directory
+            // somebody is racing — where reading the kind off the open would cost every read.
+            const stat = fs.lstatSync(file);
+            if (!stat.isFile()) {
+                notFiles += 1;
+                continue;
+            }
+            mtimeMs = stat.mtimeMs;
             payload = JSON.parse(fs.readFileSync(file, 'utf8'));
         }
         catch (e) {
@@ -108,15 +130,9 @@ export function readSnapshots(dir, { now = Date.now() } = {}) {
             // and a race with our own housekeeping rather than a payload we failed to parse.
             // Counting it made tarmac drive its own format-drift warning (up to 2675 phantom
             // unreadable on one read of a 20k directory, and `list --watch` and `serve` redraw
-            // often enough to be inside that window).
-            //
-            // The cost, said out loud: `statSync` follows symlinks, so a DANGLING one named like a
-            // snapshot is ENOENT too, and it goes silent forever — a permanent state skipped as if
-            // it were a passing race. Deliberate. There is no payload behind a dead link either,
-            // and telling the two apart (an `lstat` first) buys a warning about a file `ls` already
-            // shows. Note it is the opposite call from `reap.ts:75`, which lstats PRECISELY so a
-            // dead link is not ENOENT: it deletes, and `unlink` takes a link away just fine. Reader
-            // and reaper ask different questions of the same shape.
+            // often enough to be inside that window). A dead link named like a snapshot used to land
+            // here too, `statSync` having followed it — a permanent state skipped as a passing race;
+            // the kind check above refuses it by name now, and counts it.
             //
             // ENOENT only. A file we were not ALLOWED to open still counts, and must.
             if (e.code !== 'ENOENT')
@@ -134,7 +150,7 @@ export function readSnapshots(dir, { now = Date.now() } = {}) {
             duplicates += 1;
         snapshots.set(t.sessionId, already ? preferred(already, snapshot) : snapshot);
     }
-    return { snapshots, dirError: null, unreadable, duplicates, dirMissing: false };
+    return { snapshots, dirError: null, unreadable, notFiles, duplicates, dirMissing: false };
 }
 /**
  * Which of two snapshots claiming one session a reader is shown.

package/dist/wrapper.js

@@ -157,15 +157,20 @@ esac
 # --- drop the snapshot (best effort, atomic: temp file + rename in the same dir) ---
 if [ -n "$sid" ] && mkdir -p "$TARMAC_DIR" 2>/dev/null; then
   tmp="$TARMAC_DIR/${TEMP_PREFIX}$sid.$$.tmp"
-  # \`2>/dev/null\` comes FIRST, and the order is the whole point: redirections are applied
-  # left to right, so \`> "$tmp" 2>/dev/null\` opens the temp file while stderr is STILL the
-  # user's terminal — the shell prints its own \`cannot create …: Permission denied\` there,
-  # and the \`2>\` that was meant to swallow it only takes effect afterwards. On a snapshot
-  # directory that has become read-only that is one line of noise per FRAME, on the terminal
-  # of a script whose first rule is to be invisible. Exit code and display are untouched
-  # (\`printf\` is a regular built-in, so a failed redirection only fails the command), which
-  # is exactly why nothing but stderr itself catches this. RULE 1.
-  if printf '%s\\n' "$payload" 2>/dev/null > "$tmp"; then
+  # The \`2>/dev/null\` is on the GROUP, and that placement is the whole point: a redirection
+  # that cannot be performed is reported by the shell itself, not by \`printf\`, so it has to
+  # be silenced by something already in force when the failing redirection is attempted. On
+  # the simple command it is not — \`> "$tmp" 2>/dev/null\` opens the temp file while stderr is
+  # STILL the user's terminal, and even \`2>/dev/null > "$tmp"\`, which reads as the fix and
+  # was one under every POSIX sh, leaves zsh printing \`permission denied\` on the terminal.
+  # The group is entered first, so its stderr is /dev/null before the command inside it is
+  # attempted, and that holds under every shell here. On a snapshot directory that has become
+  # read-only the difference is one line of noise per FRAME, on the terminal of a script whose
+  # first rule is to be invisible. Exit code and display are untouched either way (\`printf\` is
+  # a regular built-in, so a failed redirection only fails the command, and a group carries
+  # the status of what it ran), which is exactly why nothing but stderr itself catches this.
+  # RULE 1.
+  if { printf '%s\\n' "$payload" > "$tmp"; } 2>/dev/null; then
     mv -f "$tmp" "$TARMAC_DIR/$sid.json" 2>/dev/null || rm -f "$tmp" 2>/dev/null
   else
     rm -f "$tmp" 2>/dev/null
@@ -293,7 +298,19 @@ else
       case "$rest" in
         *'"'*)
           rest=\${rest#*'"'}
-          printf '%s\\n' "\${rest%%'"'*}"
+          # Cut first, print second, and the two lines are not one on purpose. Spelled
+          # \`printf '%s\\n' "\${rest%%'"'*}"\` — a quoted pattern inside a quoted expansion —
+          # zsh reads the inner \`'\` as a literal character rather than as quoting, and the
+          # script ends on an unmatched \`"\`: a parse error, so nothing runs and the status
+          # line is blank. No POSIX sh does that, and no distribution ships zsh as
+          # \`/bin/sh\`, but linking it there is one command and this file's promise is that
+          # the wrapper runs wherever it is pointed. Dropping the outer quotes is the other
+          # way to make it parse, and it is wrong: unquoted, \`Fable 5\` reaches \`printf\` as
+          # two arguments and prints on two lines, and a \`*\` in a display name is expanded
+          # against the working directory. An assignment splits nothing and globs nothing,
+          # so the cut is safe unquoted and the value is quoted where it is used.
+          display=\${rest%%'"'*}
+          printf '%s\\n' "$display"
           ;;
       esac
       ;;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrrr/tarmac",
-  "version": "0.8.1",
+  "version": "0.10.0",
   "description": "Fleet observability for Claude Code — reads documented surfaces only, never an internal format",
   "keywords": [
     "claude",