Flue

Where it stands, 2026-10-13

On 12 October 2026, Flue 2.3.0 repaired execution faults, but the runtime package has no npm attestation linking it to its public source tag and publishing workflow. Deploy it only if your policy permits packages without npm provenance. For authorization, use the application-owned approval gate below.

For TypeScript agent services on Node or Cloudflare, install one exact Flue version. The older 2.2.2 cut is attested, with the execution faults described below.

npm install -E @flue/runtime@2.3.0 @flue/vite@2.3.0 @flue/cli@2.3.0

Match any SDK, React and telemetry packages to that version. Sandbox output streaming (onOutput) is preview-only: 2.2.0-next.1 lacks later stable repairs; stable 2.3.0 does not include it. The 2.2.0-next.1 GitHub prerelease was published on 25 September 2026. Use it only for a deliberate streaming trial in your command UI.

Run your own upgrade checks before deploying. Track the root changelog at each version tag; GitHub’s Latest release still names 2.2.2, although npm latest is 2.3.0. GitHub’s Latest badge alone leaves you on the older cut. Flue 2.3.0 deleted the public runtime, SDK and telemetry regression tests. Keep lockfile integrity hashes and test abort repair, timeouts, redaction and bounded history in your application.

Approve the stored action through a route you control. Flue’s documented gate stores exact arguments, ends the response with pending_approval and executes those arguments on authenticated approval. Use it for refunds, publishing and deletion; your application owns the route, expiry and idempotent effects. There is no built-in approval API.

A skill’s allowed-tools restricts nothing; use MCP annotations as hints to require approval, never skip it. The human can decide on a specific action without keeping a tool call waiting.

Stop the runaway reminder. On 2.2.x, a guarded finish hook could append the same reminder until the response hit its loop ceiling; 2.3.0 re-renders before the callback. On 2.3.0, test allowed and refused agents, a child process that ignores SIGTERM, and a guarded reminder that runs once. Fail closed when agent identity is missing. Run local() inside a trusted container or VM; it supplies no isolation.

Set a trace-content policy before exporting. Tracing captures prompts, instructions and tool payloads by default. Set content: false or a redacting transform. If you trusted the 2.1.0 README’s opposite advice, inspect backend access and retention before exporting more.

Integration checks

Pin Flue’s Pi dependencies, pi-ai and pi-agent-core, as well as Flue itself. 2.3.0 removed Flue’s Claude-ID rewrite, leaving one less patch to maintain. But pi-ai and pi-agent-core now admit ^1.1.0, so installs on this date could resolve to Pi 1.2.0 without another Flue release. Record both resolved versions; use 1.1.0 overrides if that is your tested baseline. For AI Gateway Claude, skip 2.2.0 and 2.2.1: their model-ID regressions were fixed in 2.2.2.

Budget for provider and latency changes when migrating. Azure users must rename provider keys and model-specifier prefixes from azure-openai-responses to azure. Keep API ID azure-openai-responses and AZURE_OPENAI_* variables unchanged. Mark 2.3.0 on your dashboards: tool durationMs now excludes Flue’s hooks and result storage. A lower number after upgrading is not evidence of faster execution.

Use SDK pagination for long chats. Since 2.2.0, history, historyBefore and observe support bounded windows; generation-bound cursors return 410 after reset. Handle resets and pass the now-required settlements to readSubmissionReply(). React still observes the whole conversation.

Choose a native PDF route before delegating document work. Since 2.2.0, Anthropic, OpenAI and Azure Responses, and Google APIs receive PDFs natively; other APIs receive a text placeholder.

Keep Cloudflare Sandbox on the blueprint’s dependency line. The 2.3.0 blueprint installs ^0.11.0. SDK 1.0.0 no longer exports Sandbox or getSandbox(), the API Flue’s adapter wraps. Block that major upgrade until a compatible adapter ships.

Pi has absorbed a provider workaround, and Flue’s approval pattern turns a live wait into a stored decision. Let application code handle the routine checks. Spend human review on the refund or release being authorized and on the upgrade trade.

What is unresolved

• Package origin and runtime regression coverage in a later stable. Require an npm attestation linking that release to its public tag and workflow, and public tests for the contracts your application uses.
• We did not test Flue 2.3.0 with Pi 1.2.0. Provider and tool contract tests would qualify your resolved pair for your application.
• Whether output streaming reaches stable or the preview resumes. A tagged stable onOutput implementation settles stable availability; a new next publication or removal of its dist-tag settles the preview’s status.
• Cloudflare Sandbox 1.x support through Flue. A matching tagged blueprint and adapter would establish an upgrade path. Validate it on your deployment.
• Conversation deletion remains a request in Discussion #855. A tagged deletion API with documented retention semantics would establish what Flue can erase.