salambo.yaml describes deployment and runtime configuration. Agent instructions belong under agent/.

​
Managed deployment example

version: 1
name: my-agent
runtime: pi

image:
  mode: managed

agent:
  name: My Agent
  slug: my-agent
  description: General-purpose agent.
  icon: 🤖
  isActive: true

runtimeConfig:
  sandboxRegion: eu
  egressPolicyMode: restricted
  egressAllowlist:
    - api.openai.com
  workspaceUpgradePolicy: automatic

env:
  MODEL:
    value: gpt-5.2
    description: Default model.
    exposeTo:
      - runtime

secrets:
  OPENAI_API_KEY:
    fromEnv: OPENAI_API_KEY
    description: Provider key.
    exposeTo:
      - runtime

extensions:
  - path: agent/extensions/tools.mjs
    mode: auto

​
Configuration boundaries

SectionOwns
imageManaged sandbox image
agentDeployment identity and active state
runtimeConfigRegion, egress, telemetry overrides and workspace upgrades
envNon-secret runtime or sandbox configuration
secretsValues read from the deployer’s environment
extensionsHosted extension entrypoints and loading modes

​
Important rules

  • runtime is currently pi.
  • agent.slug is the stable deployment lookup key.
  • Use agent.isActive for runtime callability.
  • Do not place prompts or instructions under agent in YAML.
  • Do not store raw secret values.
  • Egress allowlists contain hosts only: no scheme, path or port.
  • Managed images reject Dockerfile, context, platform and build arguments.
  • workspaceUpgradePolicy is automatic or new-run-only.
Use the complete salambo.yaml reference for field-level behavior.