feat: display messages as terminal output

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

src/tamq/cli.py

@@ -27,12 +27,13 @@ from .control import ControlModeClient
 from .diagnostics import configure
 from .policy import load_profile
 from .registry import RegistryError, validate_targets
+from .terminal import format_comment
 
 
 SUBCOMMANDS = frozenset(
     "start attach serve stop status ping inbox history inspect ack send export replay purge completion db-version config tap".split()
 )
-START_OPTIONS = frozenset({"--command", "--cmd", "--tap", "--detach", "--no-service"})
+START_OPTIONS = frozenset({"--command", "--cmd", "--tap", "--detach", "--no-service", "--no-display"})
 GLOBAL_FLAGS = frozenset({"--orwell", "--verbose"})
 
 
@@ -99,15 +100,15 @@ def stop_service_process() -> int | None:
     return pid
 
 
-def ensure_manual_service() -> bool:
-    """Ensure the broker understands neutral endpoints before registration."""
+def ensure_service_capabilities(required: set[str]) -> bool:
+    """Restart an older broker once before registering a newer endpoint mode."""
     if not ensure_service():
         return False
     try:
         capabilities = asyncio.run(request({"op": "ping"})).get("capabilities", [])
     except (OSError, json.JSONDecodeError):
         return False
-    if "manual_delivery" in capabilities:
+    if required.issubset(capabilities):
         return True
     stop_service_process()
     if not ensure_service():
@@ -116,7 +117,15 @@ def ensure_manual_service() -> bool:
         capabilities = asyncio.run(request({"op": "ping"})).get("capabilities", [])
     except (OSError, json.JSONDecodeError):
         return False
-    return "manual_delivery" in capabilities
+    return required.issubset(capabilities)
+
+
+def ensure_manual_service() -> bool:
+    return ensure_service_capabilities({"manual_delivery"})
+
+
+def ensure_output_service() -> bool:
+    return ensure_service_capabilities({"manual_delivery", "terminal_output"})
 
 
 def preflight_runtime_paths() -> None:
@@ -133,24 +142,9 @@ def attach_session(session: str) -> int:
     return subprocess.run(command, check=False).returncode
 
 
-def _terminal_safe(text: str) -> str:
-    return "".join(
-        character
-        if character.isprintable()
-        else f"\\x{ord(character):02x}"
-        for character in text
-    )
-
-
 def format_comment_message(row: sqlite3.Row) -> str:
     """Render a durable message so every displayed line remains a shell comment."""
-    sender = _terminal_safe(str(row["sender_repo"]))
-    body = str(row["body"])
-    lines = body.splitlines() or [""]
-    rendered = [f"#{sender}: {_terminal_safe(lines[0])}"]
-    rendered.extend(f"# {_terminal_safe(line)}" for line in lines[1:])
-    rendered[-1] += f" [{_terminal_safe(str(row['message_id']))}]"
-    return "\n".join(rendered)
+    return format_comment(row["sender_repo"], row["body"], row["message_id"])
 
 
 def build_parser() -> argparse.ArgumentParser:
@@ -159,11 +153,12 @@ def build_parser() -> argparse.ArgumentParser:
         description="Repository-aware tmux sessions with durable local messaging.",
         formatter_class=argparse.RawDescriptionHelpFormatter,
         epilog="""session shorthand:
-  tamq [--detach] [--command COMMAND] REPO [REPO ...]
+  tamq [--detach] [--command COMMAND] [--no-display] REPO [REPO ...]
 
   With no --command, tamq opens ordinary repository shells. --command is an
-  explicit initial command for newly created windows; it does not opt in to
-  terminal observation or message injection.
+  explicit initial command for newly created windows. Messages appear as
+  sanitized terminal output by default; --no-display keeps them inbox-only.
+  Neither mode injects message bytes into pane input.
 
 manual messaging from a managed shell:
   @TARGET: MESSAGE...
@@ -180,6 +175,7 @@ manual messaging from a managed shell:
     start.add_argument("repos", nargs="*", help="gita-registered repository slugs")
     start.add_argument("--command", "--cmd", dest="initial_command", default=None, help="explicit initial command for newly created windows (default: ordinary shell)")
     start.add_argument("--tap", action="store_true", help="explicitly opt in to PTY input observation and pane message injection")
+    start.add_argument("--no-display", action="store_true", help="keep messages in the durable inbox without writing target terminal output")
     start.add_argument("--detach", action="store_true", help="detach after startup")
     start.add_argument("--no-service", action="store_true", help="open tmux windows without service registration or messaging")
     attach = subparsers.add_parser("attach", help="attach to the managed tmux session")
@@ -312,6 +308,9 @@ def main(argv: list[str] | None = None) -> int:
         if args.tap and args.no_service:
             print("tamq: --tap cannot be combined with --no-service", file=sys.stderr)
             return 2
+        if args.tap and args.no_display:
+            print("tamq: --tap cannot be combined with --no-display", file=sys.stderr)
+            return 2
         manager = TmuxManager()
         try:
             if not args.no_service:
@@ -320,8 +319,11 @@ def main(argv: list[str] | None = None) -> int:
         except (TmuxError, OSError) as exc:
             print(f"tamq: {exc}", file=sys.stderr)
             return 2
-        if not args.no_service and not ensure_manual_service():
-            print("tamq service failed to start with manual-delivery safety; use --no-service to open repos without messaging", file=sys.stderr)
+        service_ready = (
+            ensure_manual_service() if args.no_display else ensure_output_service()
+        ) if not args.no_service else True
+        if not service_ready:
+            print("tamq service failed to start with the required delivery capability; use --no-service to open repos without messaging", file=sys.stderr)
             return 1
         try:
             endpoint = manager.ensure_plan(launch_plan, tap=args.tap)
@@ -332,7 +334,7 @@ def main(argv: list[str] | None = None) -> int:
         registered = False
         if not args.no_service:
             try:
-                delivery_mode = "pane" if args.tap else "manual"
+                delivery_mode = "pane" if args.tap else ("manual" if args.no_display else "output")
                 registration = asyncio.run(request({"op": "register", "endpoint_id": endpoint.endpoint_id, "instance_id": endpoint.instance_key, "pid": endpoint.pid, "session": endpoint.session, "repos": endpoint.repos, "delivery_mode": delivery_mode}))
                 if not registration.get("ok"):
                     raise RuntimeError(f"endpoint registration failed: {registration.get('error', 'unknown error')}")
@@ -360,7 +362,7 @@ def main(argv: list[str] | None = None) -> int:
             "delivered": delivered,
             "service": not args.no_service,
             "messaging": registered,
-            "delivery_mode": "none" if args.no_service else ("pane" if args.tap else "manual"),
+            "delivery_mode": "none" if args.no_service else ("pane" if args.tap else ("manual" if args.no_display else "output")),
         }
         print(json.dumps(summary), flush=True)
         if args.detach: