fix(conductor): let the fleet read surface run without prompting

[saucam]

The bug

conductor-design §3 specifies that the fleet read verbs run silently:

The fleet read surface (fleet_list / fleet_find / fleet_summary / fleet_recall / fleet_tasks / machine_map) runs silently.

They don't. isSafeTool knows the memory and blackboard mounts but not the fleet, so in guarded mode every one of them raises an approval prompt.

Found by driving a real conductor rather than reading code — asking it to resolve a session reference produced an approval request for fleet_find, which is a read. An assistant that asks permission to look something up is not an assistant, and it's the first friction anyone meets in the conductor pane from #325.

Worth noting the two layers disagreed: the daemon already puts these verbs in the provider's allowedTools (the SDK even warns it will auto-approve them), but codeoid's own gate is consulted independently and didn't recognise them.

The fix

Follows the established shape exactly — match the namespace prefix, then require the suffix to be a known read verb. Never a bare prefix match: an over-broad match here is a prompt bypass, which is why a look-alike segment (mcp__evil_codeoid_fleet__fleet_find) is asserted to gain nothing.

The read list is FLEET_READ_TOOLS from the shared protocol package (#323), so the send half cannot leak in by someone editing one of two copies.

Why this is safe

Send-class verbs are hard-gated before this function is ever consulted — isFleetSendTool in Session#shouldAutoApprove, checked ahead of any mode logic, as the R3 invariant. This change is defence in depth, not the fence.

Verified live, both directions

With the fix, on a real conductor:

mcp__codeoid_fleet__fleet_list:  executing
mcp__codeoid_fleet__fleet_find:  executing
mcp__codeoid_fleet__machine_map: executing

prompts raised: 0

And the half that must never regress — same daemon, asking it to spawn:

⚑ PROMPTED: mcp__codeoid_fleet__fleet_spawn
mcp__codeoid_fleet__fleet_spawn: waiting_confirmation

prompts raised: 1

Reads run silently; the owner still confirms every dispatch.

Also

Lists the bare (non-mcp__) namespacing alongside the in-process one, so a mounted fleet (#245) doesn't silently regress to prompting on every read.

Verification: 10 tool-safety tests (4 new, covering both namespacings, every send verb, an unknown verb, and look-alike prefixes), 2452 daemon tests, typecheck and lint clean.

🤖 Generated with Claude Code