ToolsEnabled Fleet for OpenShell beta (Linux x64)

Superseded by beta 2 (1.4.1). Use beta 2 for new installs.

ToolsEnabled Fleet for OpenShell, beta, for an existing NVIDIA OpenShell sandbox on Linux x86_64. ToolsEnabled Fleet is agent fleet management and mediation from ToolsEnabled, Inc.

Fleet is a terminal MCP server for the Codex and Claude Code CLIs. It adds a shared work record, memory, coordinated file edits and an optional tree of worker agents. OpenShell does the filesystem and network confinement, the approvals and the credential custody. Every control is a terminal command.

Install

Your sandbox needs Node.js 22.19.0 or newer on PATH, Python 3 at /usr/bin/python3, and a Codex or Claude Code CLI that you install yourself. The install runs offline. It does not change your provider install, your credentials or your OpenShell policy.

1. Download toolsenabled-openshell-linux-x64.tar.gz and SHA256SUMS, then run sha256sum -c SHA256SUMS.
2. Follow the installation instructions.

The archive's manifest.json records version 1.4.0 and development commit 2d77e45. The public source for this release contains a byte-identical copy of all 1,220 ToolsEnabled files in the archive.

Changes since the preview

• Install, upgrade and uninstall are one lifecycle. Uninstall honours CLAUDE_CONFIG_DIR.
• Codex now waits for ToolsEnabled to start before it sends the first request.
• The MCP environment keeps XDG_DATA_HOME, so the full tool set is available again.
• ledger --all returns every record. Before, it stopped at 50.
• status works without the optional which helper.
• The continuous soak harness is included under adapters/openshell/soak.

Tested on this exact archive (sha256 edc9e4bc…6eed)

• Archive content audit, plus a file-by-file check against the source.
• The frozen 32-step hand test, run twice on a build of the same source. Each run: 42 checks passed, 0 failed. The one real-model check was run separately, see the next item.
• One real Codex turn and one real Claude Code turn through ToolsEnabled in an OpenShell sandbox.
• The Linux soak (nine scenarios, repeated) and a Windows WSL2 soak. Neither had a failure at the time of publishing.

Repeat hand test on the downloaded archive (updated 07:35 UTC, September 30)
We ran two pairs of runs on the archive exactly as published. In every run, the installed files matched the archive, Codex's startup fix held, and every tool count was correct. In each pair, one run passed all 42 checks and the other failed one check, HT-14b. In both failures, OpenShell's gateway replaced the agent's network-access request with its own draft for the same host, so the test's approval could not complete. Our rule is that a pair only counts when both runs agree, so neither pair qualifies. A hand-test change that handles this race is in review.

Windows soak (updated 08:50 UTC, September 30)
The 2-hour soak passed on Windows 10 22H2 with WSL 2, Docker Desktop 4.88.1 and OpenShell 0.1.2, using this exact archive. That was 58 full rounds of the nine scenarios, with no failures. Memory stayed flat, peaking at about 105 MB. The soak exercises ToolsEnabled Fleet under a scripted workload; it is not a real-provider test on Windows. Setup steps and the exact tested versions are in the Windows (WSL 2) guide. Windows qualification is still in progress.

8-hour Linux soak (completed 14:20 UTC, September 30)
The soak ran on this exact archive from 06:20 to 14:20 UTC: 276 full rounds of the nine scenarios, with no failures. Memory stayed flat at about 100 MB, with 22 open files and no leftover child processes.

Known limits

• When Codex runs against a custom Responses backend, the model sees no MCP tools. This is an upstream Codex issue (openai/codex#33263).
• If OpenShell drafts its own rule for the same host and port at the same moment, it can replace an agent's network-access request. In our tests, the agent's approval path then returned 404 and the network call stayed blocked.
• task.list with a status filter can list a task whose lease has expired under its old status. Unfiltered task.list and task.get report it correctly. A fix is in the next beta.
• Two setups have not been tested with real accounts yet: a second interactive Codex session in the same sandbox, and a signed-in nested worker tree.
• The work record, actor labels and the optional signed audit run as the same sandbox user as the agents. They are not tamper-proof against those agents.

ToolsEnabled is not affiliated with or endorsed by NVIDIA, OpenAI or Anthropic. NVIDIA and OpenShell are trademarks of NVIDIA Corporation.