Freestyle

import { Freestyle } from "freestyle";
import { Mesa, repo } from "@mesadev/sdk";

const mesa = new Mesa({ privateKey: process.env.MESA_PRIVATE_KEY });
const freestyle = new Freestyle({ apiKey: process.env.FREESTYLE_API_KEY });

// --- Outside the sandbox: set up Mesa resources ---

// Create a repo (or use an existing one)
const created = await mesa.repos.create({ name: "agent-workspace" });

// Sign a scoped, self-expiring access token for the sandbox. Signed locally
// from your private key with no network call — your private key never enters the sandbox.
const workspace = mesa.fs({
  layout: { "/workspace": repo("agent-workspace", { mode: "rw" }) },
  authors: [{ name: "Sandbox Agent", email: "agent@example.com" }],
  ttl: 60 * 60, // 1 hour; max 4 hours
});
const { token } = await workspace.token();

// --- Inside the sandbox: install and mount Mesa ---

const { vm } = await freestyle.vms.create();

// Mesa's installer will install all its dependencies through your system's package manager.
await vm.exec("curl -fsSL https://mesa.dev/install.sh | sh -s -- --version 0.46.0");

// Enable non-root access to the FUSE mount and fix /dev/fuse permissions.
await vm.exec(
  [
    "sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf",
    "chmod 666 /dev/fuse",
  ].join(" && ")
);

// Start Mesa as a background daemon. We pass the short-lived token as
// MESA_ACCESS_TOKEN, so the private key never enters the sandbox.
await vm.exec(`MESA_ACCESS_TOKEN=${token} mesa mount --daemonize`);

// --- Run your agent ---

await vm.exec(
  'cd ~/.local/share/mesa/mnt/my-org/agent-workspace \
    && claude -p "Implement the feature described in TODO.md"'
);

import os
from mesa_sdk import Mesa, repo

# --- Outside the sandbox: set up Mesa resources ---
mesa = Mesa(private_key=os.environ["MESA_PRIVATE_KEY"])

# Create a repo (or use an existing one)
created = await mesa.repos.create(name="agent-workspace")

# Sign a scoped, self-expiring access token for the sandbox. Signed locally
# from your private key with no network call — your private key never enters the sandbox.
workspace = mesa.fs(
    layout={"/workspace": repo("agent-workspace", mode="rw")},
    authors=[{"name": "Sandbox Agent", "email": "agent@example.com"}],
    ttl=60 * 60,  # 1 hour; max 4 hours
)
minted = await workspace.token()

# --- Inside the sandbox: run these with Freestyle's Python command runner ---
# Mesa's installer will install all its dependencies through your system's package manager.
install_cmd = "curl -fsSL https://mesa.dev/install.sh | sh -s -- --version 0.46.0"

# Enable non-root access to the FUSE mount and fix /dev/fuse permissions.
fuse_cmd = "sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf && chmod 666 /dev/fuse"

# Start Mesa as a background daemon. We pass the short-lived token as
# MESA_ACCESS_TOKEN, so the private key never enters the sandbox.
mount_cmd = f"MESA_ACCESS_TOKEN={minted.token} mesa mount --daemonize"

# --- Run your agent ---
agent_cmd = 'cd ~/.local/share/mesa/mnt/my-org/agent-workspace && claude -p "Implement the feature described in TODO.md"'

# Mesa's installer will install all its dependencies through your system's package manager.
curl -fsSL https://mesa.dev/install.sh | sh -s -- --version 0.46.0

# Enable non-root access to the FUSE mount and fix /dev/fuse permissions.
sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf
chmod 666 /dev/fuse

# Start Mesa as a background daemon.
MESA_ACCESS_TOKEN="$MESA_ACCESS_TOKEN" mesa mount --daemonize

# --- Run your agent ---
cd ~/.local/share/mesa/mnt/my-org/agent-workspace
claude -p "Implement the feature described in TODO.md"