fix: guard non-tty join picker; refuse whitespace PARTY_SOCKET_DIR

tests/20-helpers.bats

@@ -109,3 +109,30 @@ setup() {
   # to also confirm a foreign-uid PID is not preventing the result.
   ! is_party_alive 1 "$PARTY_TMP/no-such-sock"
 }
+
+@test "validate_socket_dir_parent refuses whitespace in PARTY_SOCKET_DIR" {
+  spaced="$PARTY_TMP/with space"
+  mkdir -p "$spaced"
+  chmod 0700 "$spaced"
+  PARTY_SOCKET_DIR="$spaced" run validate_socket_dir_parent
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"whitespace"* ]]
+}
+
+@test "pick_live_party without a tty fails with guidance, not a silent death" {
+  # Two live-looking parties force the numbered picker; stdin is not a
+  # tty under bats, so the guard must fire before read.
+  stub="$PARTY_TMP/tmux-ok"
+  printf '#!/bin/sh\nexit 0\n' > "$stub"
+  chmod +x "$stub"
+  export PARTY_TMUX="$stub"
+  ensure_party_dir "$USER" one
+  ensure_party_dir "$USER" two
+  for n in one two; do
+    d="$PARTY_SOCKET_DIR/party-$USER:$n.d"
+    printf 'SERVER_PID=1\nGROUP=%s\n' "$(id -gn)" > "$d/roster"
+  done
+  run pick_live_party
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"pass a name"* ]]
+}