Skip to main content

​
What it is

A tool gives a fleet one named action. The fleet author declares allowed tools in the fleet’s Definition. exec_command starts a process the fleet drives across calls, and write_stdin sends that process input. apply_patch applies a patch to the workspace. update_plan records the fleet’s plan steps, which the thread shows.

​
Why it exists

The allowlist limits what the fleet can do. The fleet’s instructions do not grant access by themselves.

​
How it behaves

The runtime owns the built-in tools. A fleet receives only names listed in tools under config["x-agentsfleet"].
http_request, web_fetch, and pushover follow the fleet’s network host list. An entry may be a host name or a URL. Only its host counts, so https://api.github.com:443/repos allows these tools to reach api.github.com on any port. Sandbox traffic also follows the runner operator’s network policy. The fleet’s list alone does not describe every destination a sandbox can reach. Secret references are filled by the credential firewall during an approved outbound request. The runner refuses a run that names an unknown or unavailable tool. Check spelling against the list above and keep the runner updated. It does not silently remove that tool and continue.

​
Schedule tools

A fleet can plan its own follow-up runs. agentsfleet keeps every schedule and fires it; the runner keeps no timer. A schedule the fleet creates appears beside your own on the fleet’s schedules list, with source fleet. You can change or delete it there like any other schedule. agentsfleet replaces any value from the fleet’s secrets with «secret:NAME» in a schedule’s message before it saves the schedule. If the fleet is paused when a schedule follow-up is due, or agentsfleet could not register the follow-up before its moment, the follow-up is removed without running.

​
Message tool

message posts one line to the Slack thread that started the run, before the run answers. Use it for progress, such as “fix pushed, re-checking at 09:00”. agentsfleet posts the line with the workspace’s Slack connection. The fleet never holds the Slack token. agentsfleet replaces any value from the fleet’s secrets with «secret:NAME» before it posts. Apart from those replaced secrets, the line appears as plain text, as the fleet wrote it. A <!channel>, <!here>, or user mention in it shows as text and notifies nobody.

​
Child agents

A child agent is a second agent inside the same run, working on one task. It shares the run’s sandbox, files, memory, and budget. It starts from its task alone and does not see the conversation. A child holds the tools named in the call’s tools list, and its parent must hold each one. Without tools, the child holds every tool its parent holds. Naming a tool the parent lacks answers child_tool_not_held. A child’s status is running, done, failed, or interrupted. A child_id this run never issued answers child_not_found.

​
Limits

http_request accepts only hosts allowed by the fleet policy. Responses allow up to 1 MiB. Hosted runners have no display. browser_open and screenshot can fail there; use them only with a suitable self-managed runner. web_fetch requires an allowed public secure HTTP (HTTPS) destination. Private or unsafe destinations are refused. Child agents nest two levels deep. A child can start children of its own. Those grandchildren are offered none of the six child-agent tools. A run has at most 4 children working at once and starts at most 16 in all. Past either cap, delegate and spawn answer child_cap_reached. When the run ends, every child still working ends interrupted. Remove a tool name from the Definition in an improvement chat to revoke it. Applying the reviewed change gives later runs the new list. A fleet can hold 32 schedules in total, including up to 16 it creates itself. A 17th fleet-created schedule fails with UZ-SCHED-009. Changing or deleting a schedule a person created fails with UZ-SCHED-010. cron_run fails with UZ-SCHED-011 for a paused schedule, a schedule being removed, or a run that a schedule started. It fails with UZ-AGT-012 while the fleet is paused. message posts at most 8 lines per run, each at most 4,096 bytes. The 9th line fails with UZ-RUN-020. A run started from the API, a webhook, or a schedule has no thread, so message fails with UZ-RUN-019. If Slack refuses a line, or has not taken it within 12 seconds, message reports the line as not delivered. The run continues, and its answer still reaches the thread.