Fleet Guard

A Paseo plugin that keeps long-running Claude jobs moving when a session limit gets in the way. Windows, macOS and Linux.

Fleet Supervisor 4 beta · Getting started · How it works

Beta software: Fleet Guard is useful today, but it is still young. Keep an eye on important work and report anything surprising.

Fleet Guard watches a root Claude Code task inside Paseo. When Claude reports a real session or quota limit, Fleet Supervisor hands the same workspace and task context to the exact provider and model you chose—including another Claude model or a model running locally on your PC. It can nudge an unfinished agent, check a premature completion claim, cycle through fallbacks, and return the work to the original Claude task after a cooldown.

Version 4 also adds multi-model review to Paseo itself. Skeptic Review sends the latest task context to every configured reviewer; they run independently and in parallel, and the original task receives their conclusions and writes one digest. It runs on stock, released Paseo — no patched build, no forked app.

It does not bypass limits or share accounts. Every fallback uses its own official CLI, login, permissions, subscription, and quota.

Settings inside Paseo, not a config file

Fleet Supervisor's settings are a Paseo surface, opened from Paseo's sidebar. It asks Paseo for each provider's current model catalog and lets you choose an exact model, priority, model-specific role, review lens, and continuation policy — every key the guard reads. Changes save straight to disk and the running guard picks them up, so nothing has to be reinstalled to change a setting. Model fields remain editable when a CLI cannot publish a catalog.

What it can do

• Continue a quota-blocked Claude task with OpenAI Codex, a local model, Google Antigravity, Cursor Agent, or GitHub Copilot CLI.
• Route Fable's separate weekly allowance to another selected Claude model before leaving Anthropic, or skip that step and move directly to another provider/model.
• Select exact models instead of only choosing a provider family.
• Give every automatic-handoff model a built-in role—progress reporting, bug checking, QA, or skepticism—or a custom highest-priority system prompt.
• Configure an independent Skeptic Review roster and review lens for each exact model; review prompts never inherit automatic-handoff instructions.
• Review the latest task context with Skeptic Review, from the Fleet Supervisor panel in any agent or from the command center.
• Turn automatic handoff on and off from the Fleet Supervisor button, which shows its own state: green while watching, red and muted when off.
• Hand the current task to the fleet yourself with the Hand off button, without waiting for a quota limit.
• Edit every setting inside Paseo — general switches, continuation policy, fallback order, reviewers, and the local model — on the Fleet Supervisor plugin surface.
• Keep Codex, local-model, Cursor, and Copilot handoffs visible as child tasks in the same Paseo workspace.
• Prioritize providers in any order.
• Nudge the same unfinished child agent instead of constantly creating replacements.
• Challenge a completion claim once by checking the workspace, diff, and tests.
• Reuse child sessions on later cycles so their conversational context survives.
• Return to the original Claude task after a configurable cooldown.
• Resume a recent interrupted continuation chain after Paseo is reopened.
• Start automatically with Paseo. The plugin launches the guard, so there is no separate launcher, shortcut, or console command to run.
• Exit completely when Paseo's daemon is gone. There is no Windows-login service or permanent watchdog.

Getting started

Paseo has no plugin store — a plugin is a directory on your machine that Paseo is pointed at. So installing is: download, unpack, run setup once.

1. Download fleet-supervisor-<version>.zip from the latest release and unpack it somewhere permanent. Paseo loads the plugin from where it sits, so pick a real home for it — not Downloads or a temp folder — and re-run setup if you ever move it.

2. Install its dependencies and register it:

   npm ci
   node setup.mjs

   Setup registers the plugin through Paseo's own CLI when it can find it, which applies immediately — no restart. Otherwise it writes the registration to ~/.paseo/config.json and tells you to restart Paseo. It is safe to re-run: installing again reloads the plugin, and moving the folder re-points it.

3. Finish any provider CLI sign-ins you have not done (Claude, Codex, Cursor, Copilot, agy).

4. Open Fleet Supervisor in Paseo's sidebar and set your fallback order, reviewers, and continuation policy.

Setup turns on Paseo's plugin system (pluginsEnabled) if it is off, and says so when it does. Paseo plugins are trusted, unsandboxed code: the guard runs on your machine with your permissions, and the UI runs inside Paseo. The source is here to read.

Where the buttons are

• Fleet Supervisor panel, inside any agent — Skeptic Review, the Fleet Supervisor on/off toggle, and Hand off.
• Command center (Ctrl+K / ⌘K) — the same three actions.
• Sidebar → Fleet Supervisor — all settings.

To manage it later, use Paseo's own CLI:

paseo plugin ls
paseo plugin reload fleet-supervisor
paseo plugin logs fleet-supervisor

Uninstall with node setup.mjs --uninstall, which also clears the plugin keys from Paseo's config so an older Paseo can still start.

Requires Paseo 0.5.0 or newer

Everything here is a plain Paseo plugin, so a normal installed Paseo from the official releases is all you need.

Paseo's plugin system shipped in v0.5.0. On an older Paseo the guard's automatic handoff still works — it talks to the daemon's normal API — but the buttons and the settings surface will not appear, because there is nothing to contribute them to. Worse, a pre-0.5.0 Paseo refuses to start if its config carries the plugins keys, since it rejects unknown config keys.

Earlier versions of Fleet Supervisor required a Paseo built from a patch, because 0.4.0 had no plugin system at all. That is no longer true and the patch is gone.

Requirements

• Paseo 0.5.0 or newer. Verified on 0.5.2 and 0.6.1.
• Windows, macOS or Linux. Nothing here is compiled, and the settings UI is a Paseo surface, so Paseo renders it wherever it runs.
• Node.js 22 or newer
• Claude Code, installed and signed in
• At least one fallback provider you can use

Use a model running on your PC

Fleet Supervisor can hand work to an Ollama, LM Studio, llama.cpp, or other OpenAI-compatible server running on the same computer.

1. Install OpenCode so the model has a real coding-agent harness.
2. Start the local model server. Ollama's default endpoint is http://127.0.0.1:11434/v1.
3. Open Fleet Supervisor in Paseo's sidebar and fill in the Local model section with that endpoint and the model name.
4. Add it to the fallback order at whatever priority you want.

Fleet Guard creates a separate OpenCode profile for local handoffs. It gives that profile read, edit, and shell tools in the shared workspace without changing the user's normal OpenCode configuration. The endpoint is restricted to the same PC, and Fleet Guard does not request or store a local API key.

Coding agents need reliable tool calling and a useful context window. If a model struggles to use tools, try a coding-oriented model and raise its context to roughly 16k–32k before judging the loop.

How it continues a job

With the recommended policy, the flow is:

Claude reaches a confirmed session limit
  → try providers in your chosen priority order
  → nudge unfinished agents and audit completion claims
  → wait for the configured cooldown
  → retry the original Claude task
  → if Claude is still limited, reuse the fallback sessions and repeat

A genuine request for human input remains a hard stop. A second, audited completion verdict also stops the chain—otherwise an automatic loop would never know when the work was actually done.

Fully quitting Paseo, including its daemon, stops Fleet Guard. Reopening Paseo starts it again and can resume a recent interrupted chain.

Exact models and model-specific roles

Each fallback card contains an editable model picker populated through Paseo's provider model API. A Use for switch can add one highest-priority instruction to every handoff created for that exact model. Built-in roles are deliberately narrow; a custom prompt is preserved verbatim and remains subordinate only to Fleet Supervisor's safety and completion contract.

When the watched source is Fable, the optional Next Claude model node can route a Fable allowance stop to another Anthropic model before the cross-provider list begins. For other Claude source models, setup explains that there is no separate Fable-style weekly allowance; normal account, session, and provider limits can still move the chain forward.

Skeptic Review inside Paseo

Reviewers are configured separately from fallback behavior, under Skeptic Review on the settings surface. Enabling a model as a reviewer reveals a review-only lens: strengths and weaknesses, bug checking, QA, progress audit, or a custom review prompt.

Leaving the reviewer list empty does not mean "no reviewers." Fleet Supervisor then borrows the first three usable entries from your fallback order. The settings surface names them so this is visible, flags any provider Paseo does not have installed, and offers a one-click way to make the inherited list explicit and editable.

• Skeptic Review sends the latest projected task context to every selected reviewer. Run it from the Fleet Supervisor panel inside an agent, or from the command center (Ctrl+K / ⌘K).
• Reviewers are created as parallel child tasks with review-only instructions and a structured response contract.
• Results return to the original task, which reconciles agreement and disagreement into one user-facing digest.

The local bridge between the Paseo plugin and Fleet Supervisor listens only on 127.0.0.1, requires a random private bearer token, rejects requests over 2 MB, and never exposes provider credentials.

Antigravity (Gemini)

Paseo drives external agents over the Agent Client Protocol, and Antigravity's agy CLI has no ACP mode, so Paseo could not address it at all — an antigravity fallback entry was silently dead and offered no model list.

payload/src/antigravity-acp.mjs bridges that gap: it speaks ACP to Paseo and drives agy --print --output-format stream-json underneath, advertising the real Gemini catalogue so the model picker works.

Verified. A real Gemini turn round-trips through ACP, and the provider reports ready with 14 Gemini models inside Paseo. One limitation is the CLI's own: agy emits text only in its final result, so replies arrive in a single chunk rather than streaming.

Full detail: docs/antigravity-acp.md.

Privacy and permissions

Provider checks stay on the local computer. Fleet Guard does not read, copy, transmit, or store provider credentials. The optional Verify button sends one short, no-tools request to the selected provider and may use a small amount of its quota.

Fleet-created Cursor tasks use an unattended provider profile. Codex uses auto-review, Copilot uses allow-all, and Antigravity uses its non-interactive permission mode. Those settings apply only to fallback tasks created by Fleet Guard. Council reviewers are explicitly told not to continue the task or edit the workspace.

Status, settings, and removal

Everything is inside Paseo or its CLI — there are no shortcuts, tray icons or .cmd files any more.

• Settings: open Fleet Supervisor in Paseo's sidebar to change providers, priority, roles, reviewers, nudges, cooldown, or continuation behaviour.

• Status: the Fleet Supervisor panel inside an agent shows whether automatic handoff is watching. For the plugin's own output:

  paseo plugin ls
  paseo plugin logs fleet-supervisor

  The guard's log is ~/.paseo-fleet-guard/guard.log, and its settings are ~/.paseo-fleet-guard/config.json.

• Removal: node setup.mjs --uninstall. It unregisters the plugin and drops the plugins keys from Paseo's config, so an older Paseo can still start. Logs and configuration under ~/.paseo-fleet-guard are left for recovery.

Fleet Supervisor starts and exits with Paseo. Quitting Paseo, including its daemon, stops it; there is no background service or login item.

Build and test from source

The continuation engine and the ACP adapter use Node.js 22+. What ships is a plugin directory, a Node script, and a cross-platform setup script — there is no native compilation step, and the legacy C# launcher and setup app under desktop/ are no longer part of the install path.

npm ci --prefix payload
npm test --prefix payload
node payload/setup.mjs

Everything ships as a Paseo plugin, so there is nothing to compile and no patched Paseo to build. Install a normal Paseo 0.5.0+ and run the setup script.

Two checks worth running after a change:

node payload/tests/plugin-contributions.test.mjs   # what the client bundle registers
node payload/tests/antigravity-acp.turn.mjs        # a real Gemini turn via ACP

The first one matters more than it looks. paseo plugin ls only proves the server bundle loaded; the buttons live in the client bundle, which the daemon never evaluates. That test compiles the client bundle the way Paseo does, runs it against a mock host, and asserts on the contributions it registers — so a plugin cannot sit at running with a broken UI.

To iterate on the plugin itself:

paseo plugin reload fleet-supervisor
paseo plugin logs fleet-supervisor

Reload picks up source edits. Do not restart the daemon for that — it can kill a running agent.

License

Fleet Guard is available under the MIT License. It is an independent community utility and is not affiliated with Anthropic, OpenAI, Google, Cursor, GitHub, or Paseo.