Freestyle

import { Freestyle } from "freestyle";
import { Mesa } from "@mesadev/sdk";

const mesa = new Mesa({ apiKey: process.env.MESA_API_KEY });
const freestyle = new Freestyle({ apiKey: process.env.FREESTYLE_API_KEY });

// --- Outside the sandbox: set up Mesa resources ---

// Create a repo (or use an existing one)
const repo = await mesa.repos.create({ name: "agent-workspace" });

// Sign a scoped, self-expiring access token for the sandbox. Signed locally
// from your API key with no network call — your API key never enters the sandbox.
const { token } = await mesa.tokens.create({
  scopes: ["read", "write"],
  repos: ["my-org/agent-workspace"],
  ttl_seconds: 3600, // 1 hour
});

// --- Inside the sandbox: install and mount Mesa ---

const { vm } = await freestyle.vms.create();

// Mesa's installer will install all its dependencies through your system's package manager.
await vm.exec("curl -fsSL https://mesa.dev/install.sh | sh");

// Enable non-root access to the FUSE mount and fix /dev/fuse permissions.
await vm.exec(
  [
    "sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf",
    "chmod 666 /dev/fuse",
  ].join(" && ")
);

// Start Mesa as a background daemon. We pass the short-lived token as
// MESA_API_KEY, so the raw API key never enters the sandbox.
await vm.exec(`MESA_ORG=my-org MESA_API_KEY=${token} mesa mount -d -y`);

// --- Run your agent ---

await vm.exec(
  'cd ~/.local/share/mesa/mnt/my-org/agent-workspace \
    && claude "Implement the feature described in TODO.md"'
);

import os
from mesa_sdk import Mesa

# --- Outside the sandbox: set up Mesa resources ---
mesa = Mesa(api_key=os.environ["MESA_API_KEY"])

# Create a repo (or use an existing one)
repo = await mesa.repos.create(name="agent-workspace")

# Sign a scoped, self-expiring access token for the sandbox. Signed locally
# from your API key with no network call — your API key never enters the sandbox.
minted = await mesa.tokens.create(
    scopes=["read", "write"],
    repos=["my-org/agent-workspace"],
    ttl_seconds=3600,  # 1 hour
)

# --- Inside the sandbox: run these with Freestyle's Python command runner ---
# Mesa's installer will install all its dependencies through your system's package manager.
install_cmd = "curl -fsSL https://mesa.dev/install.sh | sh"

# Enable non-root access to the FUSE mount and fix /dev/fuse permissions.
fuse_cmd = "sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf && chmod 666 /dev/fuse"

# Start Mesa as a background daemon. We pass the short-lived token as
# MESA_API_KEY, so the raw API key never enters the sandbox.
mount_cmd = f"MESA_ORG=my-org MESA_API_KEY={minted.token} mesa mount -d -y"

# --- Run your agent ---
agent_cmd = 'cd ~/.local/share/mesa/mnt/my-org/agent-workspace && claude "Implement the feature described in TODO.md"'

# Mesa's installer will install all its dependencies through your system's package manager.
curl -fsSL https://mesa.dev/install.sh | sh

# Enable non-root access to the FUSE mount and fix /dev/fuse permissions.
sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf
chmod 666 /dev/fuse

# Start Mesa as a background daemon.
MESA_ORG="my-org" MESA_API_KEY="$MESA_API_KEY" mesa mount -d -y

# --- Run your agent ---
cd ~/.local/share/mesa/mnt/my-org/agent-workspace
claude "Implement the feature described in TODO.md"