Harden worker federation and operator UI

internal/herdr/activity.go

@@ -142,7 +142,7 @@ func ClaudeActivity(path string) ([]ToolCall, error) {
 //  2. Shell commands: Codex's actual tool surface is a single freeform
 //     `custom_tool_call` named "exec" whose `input` is a JS snippet calling
 //     `tools.exec_command({cmd:"...", ...})` — not a flat arguments object.
-//     codexExecCommand best-effort-extracts the first embedded cmd string.
+//     codexExecCommands extracts every embedded cmd string in source order.
 //     Success is read from the paired `custom_tool_call_output`'s text
 //     blocks: a failed script's output observably starts with "Script
 //     error:" on this machine's real transcripts (both a JS syntax error and
@@ -173,7 +173,7 @@ func CodexActivity(path string) ([]ToolCall, error) {
 		Payload payload `json:"payload"`
 	}
 
-	pending := map[string]ToolCall{}
+	pending := map[string][]ToolCall{}
 	var calls []ToolCall
 	s := bufio.NewScanner(f)
 	s.Buffer(make([]byte, 1<<20), 10<<20)
@@ -188,13 +188,20 @@ func CodexActivity(path string) ([]ToolCall, error) {
 				calls = append(calls, ToolCall{Name: "apply_patch", Kind: "file", Key: path, Success: e.Payload.Success})
 			}
 		case e.Type == "response_item" && e.Payload.Type == "custom_tool_call":
-			kind, key := "", ""
-			if cmd := codexExecCommand(e.Payload.Input); cmd != "" {
-				kind, key = "command", cmd
+			var pendingCalls []ToolCall
+			if e.Payload.Name == "exec" {
+				for _, cmd := range codexExecCommands(e.Payload.Input) {
+					pendingCalls = append(pendingCalls, ToolCall{Name: e.Payload.Name, Kind: "command", Key: cmd, IsTest: isTestCommand("command", cmd)})
+				}
 			}
-			pending[e.Payload.CallID] = ToolCall{Name: e.Payload.Name, Kind: kind, Key: key, IsTest: isTestCommand(kind, key)}
+			// Retain a resolved call without an extractable command as activity:
+			// it is useful for ordering, but deliberately carries no key.
+			if len(pendingCalls) == 0 {
+				pendingCalls = []ToolCall{{Name: e.Payload.Name}}
+			}
+			pending[e.Payload.CallID] = pendingCalls
 		case e.Type == "response_item" && e.Payload.Type == "custom_tool_call_output":
-			if tc, ok := pending[e.Payload.CallID]; ok {
+			if pendingCalls, ok := pending[e.Payload.CallID]; ok {
 				failed := false
 				for _, o := range e.Payload.Output {
 					if strings.HasPrefix(strings.TrimSpace(o.Text), "Script error:") {
@@ -202,8 +209,10 @@ func CodexActivity(path string) ([]ToolCall, error) {
 						break
 					}
 				}
-				tc.Success = !failed
-				calls = append(calls, tc)
+				for _, tc := range pendingCalls {
+					tc.Success = !failed
+					calls = append(calls, tc)
+				}
 				delete(pending, e.Payload.CallID)
 			}
 		}
@@ -211,18 +220,21 @@ func CodexActivity(path string) ([]ToolCall, error) {
 	return calls, s.Err()
 }
 
-// codexExecCmdRe extracts the first `cmd:"..."` argument out of an "exec"
-// custom-tool-call's JS-scripted input. Only the first embedded command in a
-// multi-call script is captured — a documented limitation, not an oversight.
+// codexExecCmdRe extracts `cmd:"..."` arguments out of an "exec"
+// custom-tool-call's JS-scripted input. A single script can invoke several
+// commands; their source order is the observable execution order.
 var codexExecCmdRe = regexp.MustCompile(`cmd\s*:\s*"((?:[^"\\]|\\.)*)"`)
 
-func codexExecCommand(input string) string {
-	m := codexExecCmdRe.FindStringSubmatch(input)
-	if m == nil {
-		return ""
+func codexExecCommands(input string) []string {
+	matches := codexExecCmdRe.FindAllStringSubmatch(input, -1)
+	commands := make([]string, 0, len(matches))
+	for _, m := range matches {
+		cmd := strings.TrimSpace(strings.NewReplacer(`\"`, `"`, `\n`, "\n", `\t`, "\t", `\\`, `\`).Replace(m[1]))
+		if cmd != "" {
+			commands = append(commands, cmd)
+		}
 	}
-	cmd := strings.NewReplacer(`\"`, `"`, `\n`, "\n", `\t`, "\t", `\\`, `\`).Replace(m[1])
-	return strings.TrimSpace(cmd)
+	return commands
 }
 
 // OpenCodeActivity has no verified source. OpenCodeUsage already only reads