From be3fb049d2954037e05b8ab3fa6b2044e4aa4cad Mon Sep 17 00:00:00 2001 From: veg Date: Sat, 11 Jul 2026 11:57:04 +0000 Subject: [PATCH] style: reword em-dashes; put colons inside bold run-in labels Punctuation sweep across README, ROADMAP, and the script's comments: em-dashes become colons, commas, or parentheses; bold list labels take the colon inside the bold with lowercase text after. Comments only in the script, no code changes. --- README.md | 2 +- ROADMAP.md | 30 +++++++++++++++--------------- party | 28 ++++++++++++++-------------- 3 files changed, 30 insertions(+), 30 deletions(-) diff --git a/README.md b/README.md index d9e8fd7..02ab8db 100644 --- a/README.md +++ b/README.md @@ -92,7 +92,7 @@ The mechanism is identical everywhere: group ownership and mode bits plus `tmux `party` assumes you already know and trust everyone you add to the group; it is not a public access-control system. Both gates above protect each party, and the **auth gate** (`tmux server-access`) is authoritative, with the filesystem gate as defense in depth. -The threat model is **accidents, not adversaries**. `party` runs where everyone already shares the box, so the ownership and symlink gates in front of destructive operations (`close`'s directory removal, moderation) are there so a stale roster, a typo, or two racing `party host` invocations can't remove or hijack the wrong thing — that the same checks would also stop a malicious group member is a side effect, not the design goal. New checks should earn their place by preventing a plausible *mistake*, not by closing a hypothetical attack from a friend. +The threat model is **accidents, not adversaries**. `party` runs where everyone already shares the box, so the ownership and symlink gates in front of destructive operations (`close`'s directory removal, moderation) are there so a stale roster, a typo, or two racing `party host` invocations can't remove or hijack the wrong thing: that the same checks would also stop a malicious group member is a side effect, not the design goal. New checks should earn their place by preventing a plausible *mistake*, not by closing a hypothetical attack from a friend. Three honest caveats, with the full detail in `man party`: diff --git a/ROADMAP.md b/ROADMAP.md index 9f8643a..1947f7b 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -3,49 +3,49 @@ Direction, not promises. Two rules govern everything below (README §Security has the long form): -- **Accidents, not adversaries.** New checks earn their place by - preventing a plausible mistake — stale state, a typo, a race — not by +- **Accidents, not adversaries:** new checks earn their place by + preventing a plausible mistake (stale state, a typo, a race), not by closing a hypothetical attack from a friend. -- **Social, not mechanical.** New features earn their place by +- **Social, not mechanical:** new features earn their place by encouraging people to work together in a terminal, not by adding machinery. -## Next — small, high value +## Next: small, high value -- **`party knock `** — an uninvited group member pings the host +- **`party knock `:** an uninvited group member pings the host via `write(1)`: "veg wants to join fiesta". `party list` already shows invite-only parties; knock completes that loop. The feature most likely to cause spontaneous pairing. -- **`party log`** — per-party transcript via `tmux pipe-pane` into the +- **`party log`:** per-party transcript via `tmux pipe-pane` into the per-party dir (group-readable so every attendee can grab a copy); `party log --stop` ends it. "What did we do last night?" for collectives, and the audit trail human+AI co-work needs. -- **`party clean`** — remove the caller's own crash leftovers (dirs +- **`party clean`:** remove the caller's own crash leftovers (dirs they own whose socket is dead), turning the manual `rm -rf` recovery in host's error message into a verb. ## Later -- **Group ergonomics** — the default `party` group needs root and a +- **Group ergonomics:** the default `party` group needs root and a relog before anyone's first party. On boxes where everyone already shares a group, `host` could offer (or default to) the caller's primary group when `party` doesn't exist. Fits the trust model; costs a little existence-confidentiality. -- **One liveness primitive** — fold `is_party_alive` into +- **One liveness primitive:** fold `is_party_alive` into `party_conn_state`; two concepts where one would do. -- **Matrix** — live validation on NetBSD and DragonFly; one +- **Matrix:** live validation on NetBSD and DragonFly; one interactive attach/role/switch pass per release (automated coverage is all non-interactive). -## Resist — by design, not by neglect +## Resist: by design, not by neglect -- **No network transport.** Same-host is the perimeter; beyond it lies +- **No network transport:** same-host is the perimeter; beyond it lies reinventing ssh. -- **No per-pane ACLs.** tmux can't enforce them; faking it with hooks +- **No per-pane ACLs:** tmux can't enforce them; faking it with hooks would be a leaky abstraction. Document the limitation instead. -- **No config files, no plugin system, no ACL syscalls.** One POSIX +- **No config files, no plugin system, no ACL syscalls:** one POSIX file that runs on a 30-year spread of UNIXes is the identity; the 2026-04 simplification that removed per-OS ACL dispatch is not to be unwound. -- **Watch the file size.** Heavy why-comments are a feature; feature +- **Watch the file size:** heavy why-comments are a feature; feature growth that pushes the single file far past its current size is not. diff --git a/party b/party index 4389855..752ee6b 100755 --- a/party +++ b/party @@ -118,7 +118,7 @@ user_in_party_group() { # Soft assertion: caller is in TMUX_PARTY_GROUP. Fails loudly with # remediation instructions when not. Called by cmd_host before any -# filesystem work; the other subcommands don't need it — non-members +# filesystem work; the other subcommands don't need it: non-members # are stopped by the FS perimeter itself (EACCES at the per-party dir) # and get the friendlier group-gate message in cmd_join. require_caller_in_group() { @@ -245,7 +245,7 @@ roster_read() { [ -n "$RR_PARTY_NAME" ] || return 1 # Pattern parity with cmd_host. The basename glob (party-*:*.d) is - # permissive — names like 'a b' or 'my.party' match the glob but + # permissive: names like 'a b' or 'my.party' match the glob but # validate_party_name rejects them (dots are banned: tmux rewrites # them in session names). Run the canonical validator so the # invariant cmd_host enforces on write is also checked on read. @@ -342,12 +342,12 @@ is_party_alive() { # Classify the caller's relationship to a party socket. Prints exactly # one of: -# ok — live tmux server, the caller is authorized. -# unauthorized — live tmux server, but it refused us. CAUTION, the +# ok : live tmux server, the caller is authorized. +# unauthorized : live tmux server, but it refused us. CAUTION, the # reason this function exists: tmux answers a # non-allowlisted user with "access not allowed" on # stderr and EXIT STATUS 0 (verified live on 3.3a, -# 3.5a, and 3.6/SunOS), for every command — including +# 3.5a, and 3.6/SunOS), for every command, including # has-session, which then reports any target as # existing. Exit codes alone cannot distinguish # authorized from unauthorized. We deliberately do NOT @@ -357,8 +357,8 @@ is_party_alive() { # list-clients writes nothing to stderr, so rc 0 plus # ANY stderr output classifies as unauthorized. Should # tmux ever warn on an authorized call, that degrades -# to a hidden party — never to a false "ok". -# dead — nothing speaking the tmux protocol at that socket +# to a hidden party, never to a false "ok". +# dead : nothing speaking the tmux protocol at that socket # (stale roster, killed server, AF_UNIX impostor). party_conn_state() { _cs_err=$("$PARTY_TMUX" -S "$1" list-clients 2>&1 >/dev/null) \ @@ -480,8 +480,8 @@ compute_default_party_name() { # Absolute path to this script, for embedding in tmux server state that # outlives this invocation (the status-right #() widget runs with the # tmux server's PATH, which need not contain an installed `party`). -# $0 forms: absolute — take it; relative-with-slash — anchor to cwd; -# bare word — resolve via PATH, falling back to $0 verbatim. No `--` +# $0 forms: absolute, take it; relative-with-slash, anchor to cwd; +# bare word, resolve via PATH, falling back to $0 verbatim. No `--` # after command -v/dirname/basename: old illumos userland predates it, # and $0 here never starts with '-'. party_self_path() { @@ -510,11 +510,11 @@ tmux_party_setup_server() { # hosts at most one socket so a fixed name is safe. notify_script="${sock%/*}/.party-notify" # Two heredocs: the first (expanding) pins the tmux binary the party - # was hosted with — a bare `tmux` from the server's PATH may be a + # was hosted with: a bare `tmux` from the server's PATH may be a # different, older binary than $PARTY_TMUX, which is the whole reason # PARTY_TMUX exists. The second (quoted) is the static body. A # PARTY_TMUX containing a double quote, $, or backslash would break - # the pin; that's accepted — it's the host's own env var on their + # the pin; that's accepted: it's the host's own env var on their # own party. cat > "$notify_script" </dev/null \ | awk -v u="$USER" '$1 == u { print; exit }') @@ -1242,7 +1242,7 @@ cmd_list() { "$RR_HOST_USER" "$RR_PARTY_NAME" "$attendees" "$group_tag" else # Live server, connection refused: we can't count attendees - # (list-clients is behind the auth gate — its empty stdout + # (list-clients is behind the auth gate: its empty stdout # used to render here as a bogus "0 attendee(s)"), but the # party is real and the caller can ask for an invite. printf '%-12s %-30s invite-only (ask %s)%s\n' \