Flue: define a sandboxed headless agent and deploy it anywhere

The Stack

Steps

1. 1

   Author the agent manifest and validate it

   Write flue-agent.yaml: a name, a list of tools the agent can call, a sandbox block with a mode (virtual, local, or remote), and a deploy target. CI checks the required fields; the npm install and agent run are fenced.

   cat > flue-agent.yaml <<'YAML'
   name: code-reviewer
   tools:
     - read_file
     - run_tests
     - post_comment
   sandbox:
     mode: virtual
   deploy:
     target: cloudflare-workers
   YAML
   ruby -ryaml -e '
   c = YAML.safe_load(File.read("flue-agent.yaml")) || {}
   abort "BAD: name is required" if c["name"].to_s.empty?
   tools = c["tools"]
   abort "BAD: tools must be a non-empty list" unless tools.is_a?(Array) && !tools.empty?
   sandbox = c["sandbox"] || {}
   allowed = ["virtual", "local", "remote"]
   abort "BAD: sandbox.mode must be one of: " + allowed.join(", ") unless allowed.include?(sandbox["mode"].to_s)
   abort "BAD: deploy.target is required" if (c["deploy"] || {})["target"].to_s.empty?
   puts "manifest OK: agent " + c["name"].inspect + ", " + tools.length.to_s + " tool(s), sandbox mode " + sandbox["mode"].inspect + ", deploy -> " + c["deploy"]["target"].inspect
   '

2. 2

   Install, run, and deploy (fenced)

   Install the Flue packages (npm install @flue/runtime @flue/cli), implement the tools listed in the manifest, then deploy with the Flue CLI. Pin the version in package.json before building anything load-bearing. The install, sandbox execution, and deploy are fenced.