Flue — the harness as a framework

The agent is the function and the function returns the prompt. Because it re-renders every turn, instructions are rebuilt from current state instead of accumulating — a conditional branch in TypeScript is a conditional system prompt. Most of the substance still lives in markdown: skills, context, and the AGENTS.md read out of the sandbox working directory and folded in.

Attaching a sandbox is what hands the model material: read, write, edit, bash, grep, and glob arrive together, and with them the workspace context — working directory, directory listing, AGENTS.md contents — injected into the system prompt. Skills are advertised in the same breath as one catalog line each.

Threshold compaction fires when used tokens exceed the context window minus reserveTokens (model-aware, at most 20,000); keepRecentTokens (8,000 by default) survives verbatim while older history folds into a summary, and compaction.model can push that summarizing onto a cheaper model. Passing compaction: false disables only the automatic trigger — overflow recovery and explicit harness.compact() still fire when the conversation stops fitting. The numbers are worth noting against the other sheets: this is OpenCode's pair exactly.

defineTool with a top-level Valibot object schema, parsed before run executes, mounted by useTool. Three registers above the plain case: harness tools reach the sandbox and the model itself through harness.prompt(), durable tools get a step surface, and conditional tools appear and disappear with agent state — the runtime narrates the delta to the model. MCP is accepted rather than refused: useMcpConnection mounts a remote server's tools as mcp__<server>__<tool>. The inversion is exact, and it is built on pi's own loop.

The slot pi left deliberately empty is the one Flue puts in its own repository description. useSandbox() attaches at most one per agent, in three tiers: a virtual in-memory sandbox on just-bash where network access is opt-in per URL prefix; local(), which binds the host shell and whose docs refuse to overclaim — it is for development and CI, not an isolation boundary — passing through only a short allowlist of PATH, HOME, USER, LANG, TERM, TMPDIR and "never API keys, tokens, or cloud credentials"; and eleven remote providers behind adapters, from E2B and Daytona to Cloudflare's own. The model does not avoid the secrets. It never gets them.

The deepest mechanism on the sheet, and the reason the framework exists. Each agent instance owns one canonical Durable Stream — an append-only record of every prompt, model response, tool call and result, compaction, and recovery fact. A submission is recorded before any model work begins, and the contract is that it reaches exactly one terminal outcome, completed or failed or aborted, however many crashes intervene; the stated discipline is at-least-once execution over exactly-once recording. Defaults are 10 attempts and one hour. step.do(name, fn) records a step's return value so recovery replays it instead of re-running it, and usePersistentState writes land in the same stream. Storage is in-memory SQLite until a db.ts names Postgres, libSQL, MySQL, MongoDB, or Redis.

This is where the operator was removed. Agents are addressable: POST /:id over a Hono sub-app from createAgentRouter(), or dispatch() fire-and-forget with a receipt. Intake is the distinctive part — seventeen first-party channels (Slack, GitHub, Stripe, Linear, Teams, Twilio and the rest) verify each delivery's signature against the exact raw bytes and enforce replay windows before a handler ever runs. Work arrives from the systems where it already happens, not from a person typing.

A task tool is added to every agent; useSubagent and defineSubagent name the delegates. A delegate renders fresh in isolation and inherits the sandbox, model, and thinking level but not the parent's history, tools, skills, or state — only its final message returns, and a batch of task calls runs in parallel. Depth is capped at four. pi refused this slot on the grounds that hidden delegation cannot be watched; Flue's answer is not to argue but to make the child's every turn a typed runtime event.

The open Agent Skills format, with progressive disclosure enforced by the runtime: only name and description ride in the prompt until an activate_skill call loads the body. Three ways in — import a SKILL.md directly as a module, declare one inline with defineSkill(), or drop it in .agents/skills/ for auto-discovery. The deployment detail is the good one: supporting files travel in the application bundle and are served read-only at virtual paths, so a skill ships with the code instead of needing a filesystem prepared for it.

A runtime event stream runs alongside the conversation stream and carries what an operator would otherwise have watched: agent_start and agent_end, submission_settled, turn events with token usage and cost estimated from the model catalog's rates, tool and task events, structured logs. observe() subscribes; instrument() registers span producers. OpenTelemetry, Sentry, and Braintrust are first-party, Vitest Evals sits in the ecosystem, and on Cloudflare the spans land in Workers Logs and Traces unwired. Adapters capture content by default — content: false or a transform redacts it.

The harness does not learn; the repository accretes — and the mechanism assumes an agent is doing the accreting. flue add fetches "a blueprint implementation guide for a coding agent to follow" rather than installing a package, and flue docs bundles the documentation offline and searchable for the same reader. Skills, tools, and channels then live as TypeScript and markdown beside the code, versioned with it. Evolution is a commit, written by the thing being evolved.