Sprites

import { SpritesClient } from "@fly/sprites";
import { Mesa } from "@mesadev/sdk";

const mesa = new Mesa({ apiKey: process.env.MESA_API_KEY });
const client = new SpritesClient(process.env.SPRITES_TOKEN);

// --- Outside the sandbox: set up Mesa resources ---

// Create a repo (or use an existing one)
const repo = await mesa.repos.create({ name: "agent-workspace" });

// Sign a scoped, self-expiring access token for the sandbox. Signed locally
// from your API key with no network call — your API key never enters the sandbox.
const { token } = await mesa.tokens.create({
  scopes: ["read", "write"],
  repos: ["my-org/agent-workspace"],
  ttl_seconds: 3600, // 1 hour
});

// --- Inside the sandbox: install and mount Mesa ---

const sprite = await client.createSprite("mesa-sandbox");

// Install the Mesa CLI.
// Sprites exposes /dev/fuse as root-only by default, so we also fix permissions.
await sprite.execFile("sh", [
  "-c",
  [
    "curl -fsSL https://mesa.dev/install.sh | sh",
    "sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf",
    "chmod 666 /dev/fuse",
  ].join(" && "),
]);

// Start Mesa as a background daemon.
// MESA_ORG configures the org; MESA_API_KEY supplies the credential — here the
// short-lived token we signed above, so the raw API key never enters the sandbox.
await sprite.execFile("sh", [
  "-c",
  `MESA_ORG=my-org MESA_API_KEY=${token} mesa mount -d -y`,
]);

// --- Run your agent ---

await sprite.execFile("sh", [
  "-c",
  'cd ~/.local/share/mesa/mnt/my-org/agent-workspace \
    && claude "Implement the feature described in TODO.md"',
]);

// Clean up when done
await sprite.destroy();

import os
from mesa_sdk import Mesa

# --- Outside the sandbox: set up Mesa resources ---
mesa = Mesa(api_key=os.environ["MESA_API_KEY"])

# Create a repo (or use an existing one)
repo = await mesa.repos.create(name="agent-workspace")

# Sign a scoped, self-expiring access token for the sandbox. Signed locally
# from your API key with no network call — your API key never enters the sandbox.
minted = await mesa.tokens.create(
    scopes=["read", "write"],
    repos=["my-org/agent-workspace"],
    ttl_seconds=3600,  # 1 hour
)

# --- Inside the sandbox: run these with your Sprites command runner ---
# Install the Mesa CLI.
# Sprites exposes /dev/fuse as root-only by default, so we also fix permissions.
install_cmd = "curl -fsSL https://mesa.dev/install.sh | sh && sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf && chmod 666 /dev/fuse"

# Start Mesa as a background daemon.
# MESA_ORG configures the org; MESA_API_KEY supplies the credential — here the
# short-lived token we signed above, so the raw API key never enters the sandbox.
mount_cmd = f"MESA_ORG=my-org MESA_API_KEY={minted.token} mesa mount -d -y"

# --- Run your agent ---
agent_cmd = 'cd ~/.local/share/mesa/mnt/my-org/agent-workspace && claude "Implement the feature described in TODO.md"'

# Install the Mesa CLI.
# Sprites exposes /dev/fuse as root-only by default, so we also fix permissions.
curl -fsSL https://mesa.dev/install.sh | sh
sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf
chmod 666 /dev/fuse

# Start Mesa as a background daemon.
# MESA_ORG configures the org; MESA_API_KEY supplies credentials for this process.
MESA_ORG="my-org" MESA_API_KEY="$MESA_API_KEY" mesa mount -d -y

# --- Run your agent ---
cd ~/.local/share/mesa/mnt/my-org/agent-workspace
claude "Implement the feature described in TODO.md"