driving fleet from an agent

The fleet plugin carries an MCP server as well as the status hooks, so an agent running inside Fleet can act on Fleet itself: open a session for a separate task, look at what the others are doing, file them into groups, launch a saved profile, change a setting. Claude Code, Codex and Antigravity all get it.

It arrives with the rest of the integration — see AI enhancements for setup. Nothing else to install.

The two switches

Both live under Settings (⌘,) → Claude Code integration, and both govern every agent rather than only Claude.

Switch	Default	What it allows
Let agents control Fleet	On	Everything below except typing
Let agents type into sessions	Off	send_input — keystrokes into another session

Typing is separate because it is one agent driving another: the session receives the keystrokes as if you had typed them, including a Return that answers a permission prompt. Turning the first switch off disables the second.

What a session can do

Tool	What it does
list_sessions	Every row, and what each one is doing
read_session	The scrollback of one session
new_session	Open one, optionally in a folder and with a starting prompt
focus_session	Bring one to the front
close_session	Close one — refused, by name, if something is running in it, unless forced
update_session	Rename, recolour, move between groups, mute
send_input	Type into a session
list_groups, manage_group	Read and change the sidebar’s groups
list_profiles, manage_profile, launch_profile	Read, edit and start launch profiles
get_settings, set_setting	Read and change settings
fleet_status	Version, session counts, update state, Claude Code integration health
check_for_updates	Ask the updater to look now

Fleet also installs a skill for each agent that says when to reach for any of this — so “open a session for this and get it started on the migration” works without naming a tool. Claude Code gets /new-session and /sessions as slash commands besides.

What it cannot do

set_setting takes an allowlist. Let agents control Fleet, Let agents type into sessions and the privacy setting are outside it. A tool that can widen its own permissions has none, and one that can switch off the reporting of what it did has less than that.

Closing goes through the same path as closing a session yourself, so a session with a command still running is refused rather than killed — and the refusal names what is running, since nobody is looking at a dialog. Only asking again with force closes it anyway.

How it connects

Fleet listens on a Unix domain socket at control.sock inside its own configuration directory, mode 0600. There is no port and no token: the directory is 0700, and file permissions are the whole of the access control. A loopback TCP port would raise the “accept incoming connections” dialog on every launch and would be reachable by anything else on the machine.

Every session Fleet starts gets FLEET_CONTROL_SOCKET in its environment, so a session drives the Fleet that started it rather than another copy.