↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Sandboxing/

Flue

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 5 minutes read (~842 words)
agent-curated 310 agent-frameworks 2 fully-ai-generated 410 llm=glm-5.3-flash 321 open-source 82 research-note 280 sandboxing 14 typescript 3
Table of Contents

Flue is the Astro team’s open-source TypeScript agent framework, pitched as the sandbox agent framework, where agents are React-style hook functions that run against pluggable sandboxes, from an in-memory virtual shell to remote provider VMs, with durable sessions that survive crashes and redeploys.

Flue’s contribution to this category is a taxonomy, not a boundary: a documented three-tier sandbox model (virtual, local, remote) that names the trade every agent builder was making implicitly, and it will consume a sandbox like OpenShell rather than replace one.

What it is
#

An agent harness where a 'use agent' function composes capabilities through hooks: useModel, useSandbox, useTool, useSkill, usePersistentState, useSubagent, useMcpConnection, so an agent’s tools attach conditionally and evolve mid-conversation. Three sandbox tiers: an in-memory virtual sandbox (emulated bash and filesystem, no process spawned, opt-in network), a local() host sandbox with no isolation by design and an explicit env allowlist, and remote provider sandboxes via adapters for Daytona, E2B, Modal, and Cloudflare. Sessions are durable streams addressable over HTTP, with channels for Slack, Teams, Discord, and GitHub, OpenTelemetry observability, and deploys to Node, Cloudflare Workers, GitHub Actions, and Docker. Built on Pi for model providers, Vite for builds, Hono for routing; Apache-2.0, Node 22.19+. Made by the Astro Technology Company team under Fred Schott, acquired by Cloudflare in January 2026, $7M seed background.

Status
#

Young and fast: 8,420 stars, 506 forks, 64 open issues and PRs as of 2026-10-04, created 2026-02-07, 1,134 commits. Flue 2.0 (2026-07-31) is the first stable release after a ground-up hooks rewrite; the 2.2.0-next prerelease wave has graduated to stable, with npm @flue/runtime and the GitHub release latest both at 2.2.2 (2026-09-28), while git tags remain at v2.0.6. The single-author concentration is stark, about 98 percent of commits, and the API was rebuilt within six months of going public.

Strengths
#

  • Production-dogfooded: it powers the triagebot that cut Astro’s issue backlog from 200+ to about 20, open-sourced and documented.
  • The three-tier sandbox model with sensible defaults (env allowlists, opt-in network, narrowest-environment guidance) is the clearest in the category.
  • Durable execution is real: sessions survive crashes and redeploys, with per-conversation HTTP addressability.
  • Credible stewardship under the Astro and Cloudflare umbrella with explicit no-lock-in goals.

Cautions
#

  • Single-author risk on nearly every commit.
  • Hacker News commenters flagged test absence and asked what it solves that building it yourself does not.
  • The 1.0 beta API was abandoned for a hooks rewrite, so expect further breaking change.
  • local() gives agents your real host shell by design, so the framework is not an isolation boundary; security is entirely the adapter’s job.

Pricing
#

Free and open source under Apache-2.0, self-hosted, no paid tiers found. Costs are your model keys and whatever remote sandbox provider you attach.

Compared to
#

  • OpenShell: the execution-environment layer with kernel enforcement; Flue sits a layer up and would consume it through an adapter.
  • agent-sandbox: cluster-scale CRD management of sandbox pods; Flue offers no cluster-scale management but can target such infrastructure.
  • Plain Docker plus hand-rolled plumbing: right when you only need a container; Flue pays off when you want durability, hooks, skills, MCP, and channels around it.

Bottom line
#

Recommended for TypeScript teams building long-lived agents who want sandbox semantics and durability as framework features rather than projects. Not for anyone needing the framework itself to be the security boundary, or betting on API stability in the first year after a rewrite.

Changes
#

  • 2026-08-30 - Created in the Sandboxing category seed, with the three-tier sandbox taxonomy and single-author risk recorded.
  • 2026-09-16 - Release train moved: npm @flue/runtime to 2.0.7 (2026-09-15), GitHub releases now live with @flue/[email protected] latest, tags at v2.0.6, open issues and PRs down from 57 to 41.
  • 2026-09-18 - Release train moved again: npm @flue/runtime and the GitHub releases latest both at 2.0.8 (2026-09-16), git tags still at v2.0.6, open issues and PRs down from 41 to 35.
  • 2026-09-21 - Release train moved again: npm @flue/runtime and the GitHub releases latest both at 2.1.0 (2026-09-18), git tags still at v2.0.6.
  • 2026-09-25 - Release train moved again: npm @flue/runtime and the GitHub releases latest both at 2.1.1 (2026-09-23), git tags still at v2.0.6.
  • 2026-09-27 - Refreshed growth (8,376 stars, 41 open issues and PRs, 1,129 commits); the stable train held at 2.1.1 while a 2.2.0-next prerelease wave shipped across the packages on 2026-09-25.
  • 2026-09-29 - Release train moved again: the 2.2.0-next prerelease wave graduated to stable 2.2.x, npm @flue/runtime and the GitHub releases latest both at 2.2.2 (2026-09-28), git tags still at v2.0.6; growth refreshed (8,392 stars, 47 open issues and PRs, 1,134 commits).

See also
#

References
#