feat(web): render conductor fleet calls as action cards

[saucam]

Second slice of P5.1 (conductor-frontends-design.md §5). Follows #320.

Why

The conductor drives the whole fleet through mcp__codeoid_fleet__* tools, and they render like any other tool — a long prefixed name and a collapsed blob of raw JSON:

mcp__codeoid_fleet__fleet_spawn   [completed]
  ▸ input  {"workdir":"/home/me/Workspace/codeoid","task":"Read README…","shape":"scout",…}

That's the right default for an arbitrary tool and the wrong one here. These few verbs are the conductor's vocabulary — "which session did it pick, what did it send, where did it spawn" is what you open the transcript to find out.

Now:

Spawn scout in codeoid   [act]  [completed]        fleet_spawn · a1b2c3
  shape    scout
  workdir  /home/me/Workspace/codeoid
  backend  claude · opus
  task     Read README.md and report

Shape

Split so the part worth testing needs no reactive root — same as lib/fleet.ts. lib/fleet-cards.ts is pure classification and field extraction; MessageRow renders the result. Ordinary tools are untouched: the classifier returns null and the existing path runs unchanged.

Three decisions that carry the value

Unknown verbs fail safe. The read/send split is security-relevant and enforced daemon-side (FLEET_SEND_TOOL_NAMES — send-class can never be auto-approved). The web can't import daemon code, so the vocabulary is duplicated here and can drift. An unrecognised verb is therefore classified unknown, never observe — so a send-class verb added daemon-side can never render here as a harmless read. Pinned by a test.

input is model-generated and typed unknown. Every field is narrowed, not cast. A wrong-typed or hallucinated field is omitted rather than rendered — an invalid shape produces no shape claim at all. Asserted against missing / null / string / number / array inputs.

The input is read off the STATE while awaiting approval. A call at waiting_confirmation carries its complete input on state.input, not tool.input — and that is exactly the card that must be readable, since it's the approval prompt where you decide whether a dispatch runs. Reading only tool.input would have blanked it.

streaming is deliberately not consulted: partialInput is a half-generated fragment, and a card built from it would show a workdir the model hasn't finished writing.

A guess I caught

Field names are taken from the daemon's own zod schemas, not assumed. My first draft had fleet_panel as targets/prompt; it's actually sessions/message, and fleet_send uses session, not name. Near-miss aliases are still tolerated for single-target verbs, because a blank target on an approval prompt is worse than a tolerated alias.

Verification

• 17 new tests, 180 web tests total — including a hostile/malformed-input block
• tsc -b, eslint, and production vite build clean
• The two remaining MessageRow lint warnings are pre-existing on main (verified by linting the stashed baseline)

Component rendering itself still isn't locally testable (the Node <20.19 jsdom gap from #321), but CI runs those suites — as #320 demonstrated.

Next

The Conductor ⇄ Sessions toggle (§3.A) completes P5.1, then P5.2's docked conductor surface with state/fleet.ts over the fleet.subscribe contract.

🤖 Generated with Claude Code

[highflame-oracle]

🔮 Oracle Review

🎯 Start Here

web/src/components/transcript/MessageRow.tsx (~15 min) — Logic changes in MessageRow.tsx

---

📋 PR Summary

What this PR does: Renders conductor fleet tool calls (mcp__codeoid_fleet__*) as structured action cards in the web transcript instead of collapsed raw JSON, via a new pure classification module (lib/fleet-cards.ts) consumed by MessageRow. Ordinary tools are untouched — the classifier returns null for non-fleet tools and the existing render path runs unchanged.

Key changes:

• New pure classification/extraction module web/src/lib/fleet-cards.ts that maps fleet tool calls to card data (verb, title, fields) with no reactive dependencies, mirroring the lib/fleet.ts split
• MessageRow renders fleet calls as action cards showing shape, workdir, backend, task, and tool/session identifiers
• Fail-safe verb classification: unrecognized verbs are classified 'unknown', never 'observe', so a send-class verb added daemon-side can never render as a harmless read
• All model-generated input fields are narrowed rather than cast; wrongly-typed or hallucinated fields are omitted rather than rendered
• Input resolution reads state.input while a call is at waiting_confirmation, ensuring approval prompts display the complete dispatch input
• Field names sourced from the daemon's zod schemas, with near-miss aliases tolerated for single-target verbs to avoid blank approval prompts

Areas affected: web transcript rendering (MessageRow), fleet tool call presentation layer, conductor frontend (P5.1)

Testing notes: 17 new tests (180 web tests total) including a hostile/malformed-input block covering missing, null, string, number, and array inputs; tsc, eslint, and production vite build clean. Component rendering remains untestable locally due to the Node <20.19 jsdom gap from #321, but CI runs those suites; the two remaining MessageRow lint warnings were verified as pre-existing on main.

---

🔍 Code Review

This is a carefully engineered slice with unusually thoughtful security reasoning — fail-safe classification of unknown verbs, strict narrowing of model-generated input, and reading input from state during approval all demonstrate a clear understanding of where these cards matter most. The pure-module split makes the security-critical logic testable without a reactive root, and verification discipline (schema-sourced field names, baseline lint comparison) is evident throughout. The remaining inline comments are hardening opportunities rather than corrections.

What's good:

• ✨ Fail-safe classification of unknown verbs as 'unknown' rather than defaulting to 'observe' — correctly treating the daemon/web vocabulary duplication as a drift risk on a security-relevant boundary and pinning it with a test
• ✨ Narrowing every model-generated field instead of casting, so hallucinated or wrongly-typed input is omitted rather than rendered as fact
• ✨ Reading input from state.input during waiting_confirmation, recognizing that the approval prompt is exactly where card readability matters most
• ✨ Deliberately excluding partialInput while streaming to avoid rendering half-generated fields as if they were decisions the model made
• ✨ Pure-module split (no reactive root) enabling the valuable logic to be tested directly, consistent with the lib/fleet.ts pattern
• ✨ Sourcing field names from the daemon's zod schemas rather than assuming them, and transparently documenting the near-miss that was caught

Review Stats:

---

Generated by Oracle - Highflame's AI Code Reviewer