Add ComputeSDK provider example

Run code on Tenki through ComputeSDK's unified sandbox interface, using
the official @computesdk/tenki provider (computesdk/computesdk#584):
runCommand via sh -lc, the native filesystem API, and destroy. verify.mjs
proves create -> runCommand (42) -> filesystem round-trip -> destroy
against the live API.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: opencolin

README.md

@@ -61,6 +61,7 @@ Give an agent a sandboxed place to run the code it writes.
 | [MCP server](examples/mcp-tenki-sandbox/) | Sandbox tools for Claude, Cursor, or any MCP client |
 | [Composio](examples/composio-tenki/) | Tenki tools in a Composio agent |
 | [Covalent](examples/covalent-tenki/) | Each workflow task in its own microVM |
+| [ComputeSDK](examples/computesdk-tenki/) | Tenki as a provider for the unified sandbox interface |
 
 ### Migrating from another provider
 
@@ -106,7 +107,7 @@ These open-source projects ship a Tenki provider or backend out of the box:
 | [RAGFlow](https://github.com/infiniflow/ragflow) | Sandbox provider for the RAG engine's code executor |
 | [DeerFlow](https://github.com/bytedance/deer-flow) | Sandbox provider for ByteDance's SuperAgent harness |
 | [AgentBox](https://github.com/madarco/agentbox) | Provider for running parallel agents in sandboxed VMs |
-| [ComputeSDK](https://github.com/computesdk/computesdk) | Tenki provider for the multi-provider compute toolkit |
+| [ComputeSDK](https://github.com/computesdk/computesdk) | Tenki provider for the multi-provider compute toolkit — [example](examples/computesdk-tenki/) |
 | [OpenHermit](https://github.com/HCF-STUDIOS/openhermit) | Sandboxed exec backend for AI agent fleets |
 
 ## Contributing

examples/computesdk-tenki/README.md

@@ -0,0 +1,53 @@
+# Tenki as a ComputeSDK provider
+
+Run code on [Tenki](https://tenki.cloud) through [ComputeSDK](https://github.com/computesdk/computesdk) — one `compute.sandbox` interface, swappable backends. The official [`@computesdk/tenki`](https://www.npmjs.com/package/@computesdk/tenki) provider maps that interface onto Tenki microVMs: shell commands, a native filesystem API, and public preview URLs, with no code changes if you later switch providers.
+
+## The code (`run.mjs`)
+
+```js
+import { compute } from "computesdk";
+import { tenki } from "@computesdk/tenki";
+
+compute.setConfig({ provider: tenki({ apiKey: process.env.TENKI_API_KEY }) });
+
+const sandbox = await compute.sandbox.create();
+try {
+  const hello = await sandbox.runCommand('echo "Hello from $(uname -sr)"');
+  console.log(hello.stdout.trim());
+
+  await sandbox.filesystem.writeFile("/home/tenki/app.py", 'print(6 * 7)\n');
+  const result = await sandbox.runCommand("python3 /home/tenki/app.py");
+  console.log(result.stdout.trim()); // 42
+} finally {
+  await sandbox.destroy();
+}
+```
+
+## Run it
+
+```bash
+npm install
+export TENKI_API_KEY=tk_...      # or TENKI_AUTH_TOKEN; from your Tenki workspace settings
+node run.mjs                     # Hello from Linux ... / 42
+```
+
+Workspace API keys infer their workspace server-side; set `TENKI_WORKSPACE_ID` only for trusted service credentials that need explicit scope.
+
+## Beyond commands and files
+
+```js
+// Serve something, then expose the port at a public https://<slug>.sb.tenki.sh URL
+await sandbox.runCommand("python3 -m http.server 3000", { background: true });
+const url = await sandbox.getUrl({ port: 3000 });
+
+// Escape hatch: the underlying @tenkicloud/sandbox Session for SSH, volumes, snapshots
+const session = await sandbox.getInstance();
+```
+
+## Notes
+
+- **`runCommand` wraps commands in `sh -lc`** (Tenki's raw exec is argv-only, no shell), so pipes, globs, and env expansion behave as expected.
+- **The filesystem API is native** — `writeFile`/`readFile`/`mkdir`/`readdir`/`exists`/`remove` ride Tenki's data plane, not shell commands, so any path or content works without escaping hazards.
+- **Long-running processes:** use `{ background: true }` rather than a trailing `&` — a bare `&` holds the exec output stream open.
+- Requires Node 20+ (the Tenki SDK's gRPC transport depends on it).
+- Provider source: [`packages/tenki`](https://github.com/computesdk/computesdk/tree/main/packages/tenki) in the ComputeSDK repo, added in [computesdk#584](https://github.com/computesdk/computesdk/pull/584).

examples/computesdk-tenki/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "computesdk-tenki",
+  "private": true,
+  "type": "module",
+  "description": "Cookbook example — run code on Tenki through ComputeSDK's unified provider interface.",
+  "dependencies": {
+    "@computesdk/tenki": "^0.1.3",
+    "computesdk": "^4.1.4"
+  }
+}

examples/computesdk-tenki/run.mjs

@@ -0,0 +1,21 @@
+// Run code on Tenki through ComputeSDK — one provider interface, swappable backends.
+// The official @computesdk/tenki provider drives Tenki microVMs under the hood.
+import { compute } from "computesdk";
+import { tenki } from "@computesdk/tenki";
+
+// The provider also reads TENKI_API_KEY / TENKI_AUTH_TOKEN from the environment.
+compute.setConfig({ provider: tenki({ apiKey: process.env.TENKI_API_KEY }) });
+
+const sandbox = await compute.sandbox.create();
+try {
+	// runCommand wraps the command in `sh -lc`, so pipes, globs, and env expansion work.
+	const hello = await sandbox.runCommand('echo "Hello from $(uname -sr)"');
+	console.log(hello.stdout.trim());
+
+	// Native filesystem API — files move over Tenki's data plane, not through shell quoting.
+	await sandbox.filesystem.writeFile("/home/tenki/app.py", 'print(6 * 7)\n');
+	const result = await sandbox.runCommand("python3 /home/tenki/app.py");
+	console.log(result.stdout.trim()); // 42
+} finally {
+	await sandbox.destroy();
+}

examples/computesdk-tenki/verify.mjs

@@ -0,0 +1,61 @@
+/**
+ * Proves the ComputeSDK Tenki provider works against live Tenki: create a
+ * sandbox through `compute`, run a command (assert 42), round-trip a file
+ * through the native filesystem API, then destroy the sandbox.
+ * Token/workspace from env (CI) or ~/.config/tenki/config.yaml (local `tenki login`).
+ * Exits non-zero on any failure.
+ */
+import { compute } from "computesdk";
+import { tenki } from "@computesdk/tenki";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+
+const cfg = (key) => {
+	try {
+		const c = readFileSync(`${homedir()}/.config/tenki/config.yaml`, "utf8");
+		return (c.match(new RegExp(`^${key}:\\s*(.+)$`, "m"))?.[1] ?? "").trim();
+	} catch {
+		return "";
+	}
+};
+
+const apiKey = process.env.TENKI_AUTH_TOKEN || process.env.TENKI_API_KEY || cfg("auth_token");
+const workspaceId = process.env.TENKI_WORKSPACE_ID || cfg("current_workspace_id") || undefined;
+if (!apiKey) {
+	console.error("No token. Set TENKI_AUTH_TOKEN, or run `tenki login`.");
+	process.exit(1);
+}
+
+compute.setConfig({ provider: tenki({ apiKey, ...(workspaceId ? { workspaceId } : {}) }) });
+
+let sandbox;
+try {
+	sandbox = await compute.sandbox.create();
+
+	// 1) runCommand (goes through `sh -lc`) → assert stdout
+	const r = await sandbox.runCommand("python3 -c 'print(6 * 7)'");
+	if (!(r.exitCode === 0 && r.stdout.trim() === "42")) {
+		throw new Error(`runCommand: exit ${r.exitCode}, stdout ${JSON.stringify(r.stdout)}, stderr ${JSON.stringify(r.stderr)}`);
+	}
+
+	// 2) native filesystem API → write, assert exists, read back
+	const path = "/home/tenki/verify-note.txt";
+	const content = "written via the ComputeSDK filesystem API\n";
+	await sandbox.filesystem.writeFile(path, content);
+	if (!(await sandbox.filesystem.exists(path))) throw new Error("exists() false after writeFile");
+	const back = await sandbox.filesystem.readFile(path);
+	if (back !== content) throw new Error(`file round-trip mismatch: ${JSON.stringify(back)}`);
+
+	console.log("✓ computesdk-tenki: compute.sandbox.create → runCommand (42) → filesystem round-trip → destroy");
+} catch (e) {
+	console.error("✗ " + (e?.message ?? e));
+	process.exitCode = 1;
+} finally {
+	if (sandbox) {
+		try {
+			await sandbox.destroy();
+		} catch {
+			/* self-reaps via idle/lifetime caps */
+		}
+	}
+}