Flue Zero to Expert, Part 4: Autonomous Agents

Series map

Part 1: Your First Flue Agent · Part 2: Typed Workflows · Part 3: Safe Tools · Part 4: Autonomous Agents · Part 5: Persistence and Durable Execution · Part 6: Production Routing and Deployment · Part 7: Operate Like an Expert

Part 4: Autonomous Agents

Continuing agents

A Flue agent can keep working within a continuing context.

Each instance has an id. Your application decides what that ID means. It might identify a ticket, repository, or customer.

Conversation history belongs to the agent instance. Durable business data still belongs in your application database.

Instructions define the agent’s role. Tools add bounded application functions. Skills add reusable guidance. Sandboxes provide files and commands.

Skills do not grant executable access. A skill can describe how to review code, but the sandbox or a tool must provide the actual capability.

Delegate focused work

Subagents are named agent profiles. They let a parent delegate research, classification, or review work.

Delegation creates a separate child session. The child receives the delegated request and its own context. It does not receive the parent’s conversation transcript.

The parent still owns the interaction. A subagent profile does not create a public agent route.

This complete workflow defines a coordinator agent and a typed review subagent:

import {
  defineAgent,
  defineAgentProfile,
  defineWorkflow,
} from '@flue/runtime';
import * as v from 'valibot';

const Review = v.object({
  summary: v.string(),
  risks: v.array(v.string()),
  approved: v.boolean(),
});

const reviewer = defineAgentProfile({
  name: 'reviewer',
  description: 'Reviews a proposed change for concrete correctness risks.',
  instructions: [
    'Review only the supplied change.',
    'Report specific correctness risks.',
    'Do not invent missing repository context.',
  ].join(' '),
});

const coordinator = defineAgent(() => ({
  model: 'anthropic/claude-sonnet-4-6',
  instructions: 'Delegate code review to reviewer and return its findings.',
  subagents: [reviewer],
  cwd: '/workspace',
}));

export default defineWorkflow({
  agent: coordinator,
  input: v.object({
    change: v.string(),
  }),
  output: Review,

  async run({ harness, input }) {
    const session = await harness.session();

    const response = await session.task(input.change, {
      agent: 'reviewer',
      result: Review,
    });

    return response.data;
  },
});

session.task(...) selects reviewer explicitly. The Review schema validates the returned data. Invalid output fails instead of entering the application unchecked.

An autonomous parent agent can also choose delegation itself. Configuring subagents gives it Flue’s built-in task capability.

Capability inheritance

A subagent profile owns its capabilities.

Parent instructions, tools, skills, and subagents never flow into the delegated session. If the profile omits one of these fields, the child has none.

Environment settings behave differently. model, thinkingLevel, and compaction fall back to the parent’s values. A value declared by the profile wins.

The child uses the same sandbox boundary as its parent. It does not escape into a broader workspace.

A subagent cannot declare durability. Its task runs inside the parent operation.

Calling task() without an agent name is different. It creates a fresh child context using the parent’s full configuration. It is not named subagent delegation.

Choose the sandbox

Flue uses a virtual sandbox by default. It is an in-memory workspace suited to staged files and lightweight commands.

The virtual sandbox starts without host files. Its files are not durable. Its command environment is not a full Linux system. It is also not a network isolation boundary.

Use local() only for trusted Node.js agents that need the host filesystem and installed shell commands. It provides direct host access, not isolation. Avoid broad host credentials. Prefer a narrow tool when one operation is enough.

Use a remote sandbox for untrusted, tenant-specific, or tool-heavy work. Remote providers can supply isolated Linux environments and managed lifecycles. Your application must still choose credentials, network access, workspace ownership, reuse, and expiry.

Sandbox persistence and conversation persistence are separate. A stored conversation does not preserve virtual files. A durable remote workspace does not preserve conversation history by itself.

Choose the narrowest environment that completes the task. Every added file, command, credential, and network destination expands what model-directed work can reach.

Sources

• Building agents
• Skills
• Subagents
• Sandboxes

Next, continue to Part 5: Persistence and Durable Execution to preserve state and recover safely.