ToolsEnabled Fleet for OpenShell beta 2 (Linux x64)

Superseded by beta 3 (version 1.4.2). Beta 3 upgrades a beta 2 install and keeps its setup and state.

ToolsEnabled Fleet for OpenShell, beta 2 (version 1.4.1), for an existing NVIDIA OpenShell sandbox on Linux x86_64, and on Windows through WSL 2 with Docker Desktop's Linux engine (the same Linux archive; there is no native Windows runtime). ToolsEnabled Fleet is agent fleet management and mediation from ToolsEnabled, Inc.

Fleet is a terminal MCP server for the Codex and Claude Code CLIs. It adds a shared work record, memory, coordinated file edits and an optional tree of worker agents. OpenShell provides filesystem and network confinement, access approvals and credential custody. Every control is a terminal command.

Install

Your sandbox needs Node.js 22.19.0 or newer on PATH, Python 3 at /usr/bin/python3, and a Codex or Claude Code CLI that you install yourself. The install runs offline. It does not change your provider installation, your credentials or your OpenShell policy.

1. Download toolsenabled-openshell-linux-x64.tar.gz and SHA256SUMS, then run sha256sum -c SHA256SUMS.
2. Follow the installation instructions. On Windows, follow the Windows (WSL 2) guide. The copy of this guide bundled in the archive shows an earlier status; the linked version is current.

Fleet installs the toolsenabled command. The archive's manifest.json records version 1.4.1 and development commit 3b7f5b1. The public source for this release contains a byte-identical copy of all 1,224 ToolsEnabled Fleet files in the archive.

Changes since beta 1

• The product is named ToolsEnabled Fleet in the version output, terminal pages, setup, uninstall and installer. Commands, paths and environment variables are unchanged.
• task.list filters by each task's current lease status before sorting and paging, and adds the expired status. Beta 1 could list an expired task under its old status.
• Uninstall no longer deletes state. It refuses to remove a runtime folder that contains provider settings, OpenShell configuration, your home folder or a mount point. It keeps the runtime when it cannot prove that a provider registration was removed.
• Engine diagnostics are created private (0700 folders, 0600 files) whatever the umask.
• Windows transport and test-harness parity, and a Windows (WSL 2) setup guide.
• The hand test now ties each network-approval check to the agent's exact proposal.

Tested on this exact archive (sha256 0fff7244…42b3)

• Archive content audit, plus a file-by-file check against the public source.
• The frozen hand test, run twice on the downloaded archive. Each run: 42 checks passed, 0 failed, and the two runs agree. The one real-model check is covered by the next item.
• One real Codex turn (Codex CLI 0.158.0, without Codex's bypass mode) and one real Claude Code turn (2.1.284) through Fleet in an OpenShell sandbox. Each made three Fleet tool calls, and all completed.
• Linux soak: 2 hours, 70 full rounds of the nine scenarios, no failures. Memory stayed flat at about 97 MB.
• Windows soak on Windows 10 Pro 22H2 with WSL 2, Docker Desktop 4.88.1 and OpenShell 0.1.2: 2 hours, 60 full rounds of the nine scenarios, no failures. It runs a scripted workload; it is not a real-provider test on Windows. A Windows-hosted hand-test pair and real-provider sessions on Windows are still in progress, and Windows 11 has not been tested.

Known limits

• When Codex runs against a custom Responses backend, the model sees no MCP tools. This is an upstream Codex issue (openai/codex#33263).
• If OpenShell drafts its own rule for the same host and port at the same moment, it can replace an agent's network-access request. If an approval does not take effect, ask the agent to request access again.
• Uninstall checks folder safety before it removes anything. It does not yet guard against a folder being swapped by another process while removal is running; that is planned for the next beta.
• Uninstall recognizes an already-removed Claude Code registration only for Claude Code 2.1.284. With other versions it keeps the runtime and prints claude mcp remove --scope user toolsenabled for you to run.
• Two setups have not been tested with real accounts: a second interactive Codex session in the same sandbox, and a signed-in nested worker tree.
• Installation still takes the manual steps in the guide. A two-command install is planned.
• The work record, actor labels and the optional signed audit run as the same sandbox user as the agents. They are not tamper-proof against those agents.

ToolsEnabled is not affiliated with or endorsed by NVIDIA, OpenAI or Anthropic. NVIDIA and OpenShell are trademarks of NVIDIA Corporation.