E2B

import { Sandbox } from "e2b";
import { Mesa } from "@mesadev/sdk";

const mesa = new Mesa({ apiKey: process.env.MESA_API_KEY });

// --- Outside the sandbox: set up Mesa resources ---

// Create a repo (or use an existing one)
const repo = await mesa.repos.create({ name: "agent-workspace" });

// Sign a scoped, self-expiring access token for the sandbox. Signed locally
// from your API key with no network call — your API key never enters the sandbox.
const { token } = await mesa.tokens.create({
  scopes: ["read", "write"],
  repos: ["my-org/agent-workspace"],
  ttl_seconds: 3600, // 1 hour
});

// --- Inside the sandbox: install and mount Mesa ---

const sandbox = await Sandbox.create();

// Install Mesa dependencies and the CLI.
// E2B exposes /dev/fuse as root-only by default, so we also fix permissions.
await sandbox.commands.run(
  [
    "apt-get update",
    "apt-get install -y --no-install-recommends ca-certificates curl fuse3 gpg",
    "sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf",
    "chmod 666 /dev/fuse",
    "curl -fsSL https://mesa.dev/install.sh | sh -s -- --yes",
  ].join(" && "),
  { user: "root" }
);

// Start Mesa as a background daemon. MESA_ORG configures the org; MESA_API_KEY
// accepts an API key OR an access token — we pass the short-lived token minted
// above, so the raw API key never enters the sandbox.
await sandbox.commands.run("mesa mount -d -y", {
  envs: {
    MESA_ORG: "my-org",
    MESA_API_KEY: token,
  },
});

// --- Run your agent ---

await sandbox.commands.run(
  'cd ~/.local/share/mesa/mnt/my-org/agent-workspace \
    && claude "Implement the feature described in TODO.md"'
);

import os
from e2b import Sandbox
from mesa_sdk import Mesa

# --- Outside the sandbox: set up Mesa resources ---
mesa = Mesa(api_key=os.environ["MESA_API_KEY"])

# Create a repo (or use an existing one)
repo = await mesa.repos.create(name="agent-workspace")

# Sign a scoped, self-expiring access token for the sandbox. Signed locally
# from your API key with no network call — your API key never enters the sandbox.
minted = await mesa.tokens.create(
    scopes=["read", "write"],
    repos=["my-org/agent-workspace"],
    ttl_seconds=3600,  # 1 hour
)

# --- Inside the sandbox: install and mount Mesa ---
sandbox = Sandbox()

# Install Mesa dependencies and the CLI.
# E2B exposes /dev/fuse as root-only by default, so we also fix permissions.
sandbox.commands.run(
    " && ".join([
        "apt-get update",
        "apt-get install -y --no-install-recommends ca-certificates curl fuse3 gpg",
        "sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf",
        "chmod 666 /dev/fuse",
        "curl -fsSL https://mesa.dev/install.sh | sh -s -- --yes",
    ]),
    user="root",
)

# Start Mesa as a background daemon. MESA_ORG configures the org; MESA_API_KEY
# accepts an API key OR an access token — we pass the short-lived token minted
# above, so the raw API key never enters the sandbox.
sandbox.commands.run(
    "mesa mount -d -y",
    envs={"MESA_ORG": "my-org", "MESA_API_KEY": minted.token},
)

# --- Run your agent ---
sandbox.commands.run(
    'cd ~/.local/share/mesa/mnt/my-org/agent-workspace && claude "Implement the feature described in TODO.md"'
)

# Install Mesa dependencies and the CLI.
# E2B exposes /dev/fuse as root-only by default, so we also fix permissions.
apt-get update
apt-get install -y --no-install-recommends ca-certificates curl fuse3 gpg
sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf
chmod 666 /dev/fuse
curl -fsSL https://mesa.dev/install.sh | sh -s -- --yes

# Start Mesa as a background daemon.
# MESA_ORG configures the org; MESA_API_KEY supplies credentials for this process.
MESA_ORG="my-org" MESA_API_KEY="$MESA_API_KEY" mesa mount -d -y

# --- Run your agent ---
cd ~/.local/share/mesa/mnt/my-org/agent-workspace
claude "Implement the feature described in TODO.md"

const sandbox = await Sandbox.create({ template: "my-mesa-template" });

from e2b import Sandbox

sandbox = Sandbox(template="my-mesa-template")