E2B

import { Sandbox } from "e2b";
import { Mesa, repo } from "@mesadev/sdk";

const mesa = new Mesa({ privateKey: process.env.MESA_PRIVATE_KEY });

// --- Outside the sandbox: set up Mesa resources ---

// Create a repo (or use an existing one)
const created = await mesa.repos.create({ name: "agent-workspace" });

// Sign a scoped, self-expiring access token for the sandbox. Signed locally
// with your private key, no network call. The private key never enters
// the sandbox.
const workspace = mesa.fs({
  layout: { "/workspace": repo(created.name, { mode: "rw" }) },
  authors: [{ name: "Sandbox Agent", email: "agent@example.com" }],
  ttl: 60 * 60, // 1 hour, max 4 hours
});
const { token } = await workspace.token();

// --- Inside the sandbox: install and mount Mesa ---

const sandbox = await Sandbox.create();

// Install Mesa dependencies and the CLI.
// E2B exposes /dev/fuse as root-only by default, so we also fix permissions.
await sandbox.commands.run(
  [
    "apt-get update",
    "apt-get install -y --no-install-recommends ca-certificates curl fuse3 gpg",
    "sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf",
    "chmod 666 /dev/fuse",
    "curl -fsSL https://mesa.dev/install.sh | sh -s -- --version 0.46.0",
  ].join(" && "),
  { user: "root" }
);

// Start Mesa as a background daemon with the short-lived token. The private
// key never enters the sandbox.
await sandbox.commands.run("mesa mount --daemonize", {
  envs: {
    MESA_ACCESS_TOKEN: token,
  },
});

// --- Run your agent ---

await sandbox.commands.run(
  `cd ~/.local/share/mesa/mnt/${created.org}/${created.name} \
    && claude -p "Implement the feature described in TODO.md"`
);

import os
from e2b import Sandbox
from mesa_sdk import Mesa, repo

# --- Outside the sandbox: set up Mesa resources ---
mesa = Mesa(private_key=os.environ["MESA_PRIVATE_KEY"])

# Create a repo (or use an existing one)
created = await mesa.repos.create(name="agent-workspace")

# Sign a scoped, self-expiring access token for the sandbox. Signed locally
# with your private key, no network call. The private key never enters
# the sandbox.
workspace = mesa.fs(
    layout={"/workspace": repo(created.name, mode="rw")},
    authors=[{"name": "Sandbox Agent", "email": "agent@example.com"}],
    ttl=60 * 60,  # 1 hour, max 4 hours
)
minted = await workspace.token()

# --- Inside the sandbox: install and mount Mesa ---
sandbox = Sandbox()

# Install Mesa dependencies and the CLI.
# E2B exposes /dev/fuse as root-only by default, so we also fix permissions.
sandbox.commands.run(
    " && ".join([
        "apt-get update",
        "apt-get install -y --no-install-recommends ca-certificates curl fuse3 gpg",
        "sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf",
        "chmod 666 /dev/fuse",
        "curl -fsSL https://mesa.dev/install.sh | sh -s -- --version 0.46.0",
    ]),
    user="root",
)

# Start Mesa as a background daemon with the short-lived token. The private
# key never enters the sandbox.
sandbox.commands.run(
    "mesa mount --daemonize",
    envs={"MESA_ACCESS_TOKEN": minted.token},
)

# --- Run your agent ---
sandbox.commands.run(
    f'cd ~/.local/share/mesa/mnt/{created.org}/{created.name} && claude -p "Implement the feature described in TODO.md"'
)

# Install Mesa dependencies and the CLI. Run this block as root:
# E2B exposes /dev/fuse as root-only by default, so we also fix permissions.
apt-get update
apt-get install -y --no-install-recommends ca-certificates curl fuse3 gpg
sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf
chmod 666 /dev/fuse
curl -fsSL https://mesa.dev/install.sh | sh -s -- --version 0.46.0

# Start Mesa as a background daemon.
# Pass the short-lived token to the mount process.
MESA_ACCESS_TOKEN="$MESA_ACCESS_TOKEN" mesa mount --daemonize

# --- Run your agent ---
cd ~/.local/share/mesa/mnt/my-org/agent-workspace
claude -p "Implement the feature described in TODO.md"

const sandbox = await Sandbox.create({ template: "my-mesa-template" });

from e2b import Sandbox

sandbox = Sandbox(template="my-mesa-template")