fix: guard non-tty join picker; refuse whitespace PARTY_SOCKET_DIR

party

@@ -387,6 +387,15 @@ apply_party_perms_file() {
 # directory.
 validate_socket_dir_parent() {
     p="$PARTY_SOCKET_DIR"
+    # Whitespace in the parent breaks every `for rec in $(roster_list)`
+    # walker and the unquoted paths embedded in tmux hook/status-right
+    # strings. Refuse at host time, where the dir is chosen, instead of
+    # corrupting quietly later.
+    case "$p" in
+        *[[:space:]]*)
+            echo "party: PARTY_SOCKET_DIR must not contain whitespace: $p" >&2
+            return 1 ;;
+    esac
     if [ ! -d "$p" ]; then
         echo "party: PARTY_SOCKET_DIR $p does not exist" >&2
         return 1
@@ -530,6 +539,12 @@ pick_live_party() {
         0) echo "party: no parties found on this host." >&2; return 1 ;;
         1) roster_read "$1"; return 0 ;;
     esac
+    # 2+ parties need the interactive picker; without a tty read would
+    # EOF and set -e would kill us with no message.
+    if [ ! -t 0 ]; then
+        echo "party: multiple parties running; pass a name (see 'party list')." >&2
+        return 1
+    fi
     i=0
     for r in "$@"; do
         i=$((i+1))