Run agents in E2B sandboxes with Agent Vault

// runInSandbox.ts
import { Sandbox } from "e2b";

const INFISICAL_URL = "https://app.infisical.com";
const ACCESS_BUNDLE = "<access-bundle-name>";
const PROXY_ID = "<proxy-id>";
const PROXY_ADDRESS = "<proxy-dns-name>:1080";
const TEMPLATE = "base";
const SANDBOX_TIMEOUT_MS = 15 * 60 * 1000;
const SANDBOX_ENV: Record<string, string> = {};

const CA_PATH = "/usr/local/share/ca-certificates/agent-vault-ca.crt";
// Points the tools that don't read the system trust store at the proxy's CA.
const CA_ENV = Object.fromEntries(
  ["SSL_CERT_FILE", "NODE_EXTRA_CA_CERTS", "REQUESTS_CA_BUNDLE", "CURL_CA_BUNDLE", "GIT_SSL_CAINFO", "DENO_CERT"].map(
    (name) => [name, CA_PATH],
  ),
);

async function infisical(
  path: string,
  { method = "POST", token, body }: { method?: string; token?: string; body?: unknown } = {},
) {
  const headers: Record<string, string> = {};
  if (token) headers.Authorization = `Bearer ${token}`;
  if (body !== undefined) headers["Content-Type"] = "application/json";
  const response = await fetch(`${INFISICAL_URL}${path}`, {
    method,
    headers,
    body: body === undefined ? undefined : JSON.stringify(body),
    signal: AbortSignal.timeout(30_000),
  });
  if (!response.ok) throw new Error(`Infisical returned ${response.status}: ${await response.text()}`);
  return response.json();
}

export async function runInSandbox(command: string): Promise<string> {
  // The machine identity's credentials stay here and never enter the sandbox.
  const { accessToken } = await infisical("/api/v1/auth/universal-auth/login", {
    body: {
      clientId: process.env.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID,
      clientSecret: process.env.INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET,
    },
  });

  // Fetched on every run, because the CA changes when you rotate the proxy's token.
  const { ca } = await infisical(`/api/v1/agent-vault/proxies/${PROXY_ID}/ca`, { method: "GET", token: accessToken });

  // One session per run. The ttl outlasts the sandbox's timeout, so the agent
  // can't lose access mid-run.
  const { session } = await infisical("/api/v1/agent-vault/sessions", {
    token: accessToken,
    body: { accessBundles: [ACCESS_BUNDLE], ttl: "20m" },
  });

  let sandbox: Sandbox | undefined;
  try {
    sandbox = await Sandbox.create(TEMPLATE, {
      timeoutMs: SANDBOX_TIMEOUT_MS,
      envs: { ...CA_ENV, ...SANDBOX_ENV },
      network: {
        // E2B sends hostnames to the proxy, instead of IP addresses, only for
        // traffic that a domain entry in allowOut lets through.
        allowOut: ["*"],
        denyOut: ["0.0.0.0/0"],
        egressProxy: {
          address: PROXY_ADDRESS,
          // The proxy ignores the username and reads the session token from the password.
          username: "x-agent-vault",
          password: session.token,
          tls: { caCert: ca.certificate },
        },
      },
    });
    await sandbox.files.write("/tmp/agent-vault-ca.pem", ca.certificate);
    await sandbox.commands.run(`install -m 644 /tmp/agent-vault-ca.pem ${CA_PATH} && update-ca-certificates`, {
      user: "root",
    });
    const result = await sandbox.commands.run(command, { timeoutMs: SANDBOX_TIMEOUT_MS - 60_000 });
    return result.stdout;
  } finally {
    // Revoke first, so the session ends even if killing the sandbox fails.
    try {
      await infisical(`/api/v1/agent-vault/sessions/${session.id}/revoke`, { token: accessToken });
    } finally {
      await sandbox?.kill();
    }
  }
}

# main.py
from run_in_sandbox import run_in_sandbox

print(run_in_sandbox("curl -s https://api.anthropic.com/v1/models -H 'anthropic-version: 2023-06-01'"))

// main.ts
import { runInSandbox } from "./runInSandbox.js";

console.log(await runInSandbox("curl -s https://api.anthropic.com/v1/models -H 'anthropic-version: 2023-06-01'"));