Assert run.mjs's CLI flags and document the empty-env gotcha

verify.mjs now checks `claude --help` still lists `-p, --print` and
`--dangerously-skip-permissions`, since npm installs whatever version is
latest at run time.

An ExecOptions.env value of undefined arrives in the guest as an empty
string rather than unset, which is why run.mjs filters the passthrough
list; measured, and now stated where it matters.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uz85xGA4zWSge1BtiDNnSN

Author: claude

examples/claude-code-sandbox/README.md

@@ -31,6 +31,8 @@ await sandbox.exec("claude", {
   args: ["-p", TASK, "--dangerously-skip-permissions"],
   cwd: "repo", // relative paths resolve under the workdir, /home/tenki
   timeoutMs: 10 * 60_000,
+  // An env value of undefined arrives as an empty string, not as unset — an empty
+  // ANTHROPIC_BASE_URL is worse than none, so filter to the vars you actually have.
   env: Object.fromEntries(PASSTHROUGH.filter((k) => process.env[k]).map((k) => [k, process.env[k]])),
   onOutput: ({ data }) => process.stdout.write(decoder.decode(data)), // data is a Uint8Array
 });
@@ -47,20 +49,22 @@ The last line is the point: a unified diff against a real upstream checkout, pro
 npm install
 export TENKI_AUTH_TOKEN=...      # from `tenki login` (~/.config/tenki/config.yaml)
 export TENKI_WORKSPACE_ID=...
-export ANTHROPIC_API_KEY=...     # the agent turn; ANTHROPIC_MODEL is optional
+export ANTHROPIC_API_KEY=...     # ANTHROPIC_BASE_URL and ANTHROPIC_MODEL pass through too, if set
 node run.mjs                     # streams the agent's turn, then prints the diff
 ```
 
+`run.mjs` uses top-level `await using`, which needs Node 24+.
+
 Verify the Tenki half without a model key — this is what CI runs:
 
 ```bash
-node verify.mjs   # create + clone → install the CLI → read its version → edit → git diff
+node verify.mjs   # create + clone → install the CLI → check its version and flags → edit → git diff
 ```
 
 ## Notes
 
 - **`sandbox.git.*` runs at the sandbox workdir (`/home/tenki`), but `cloneRepoUrl` checks out one level down into `./repo`** — so `sandbox.git.diff()` fails with "not a git repository". Read the checkout with `sandbox.exec("git", { args: ["-C", "repo", "diff"] })`, or clone at the workdir root if you want the helpers.
 - The default image already ships Node 24, npm 11, and git 2.43, and outbound network is on for a bare `create`. `npm i -g @anthropic-ai/claude-code` finishes in about five seconds — no `allowOutbound`, no custom image, no baked-in CLI.
 - `--dangerously-skip-permissions` refuses to run as root; the sandbox user is `tenki`, so it works as written. It is the right flag *here* precisely because the blast radius is one microVM.
-- `exec(command, { args })` runs a bare binary and its args with no shell splitting, so the whole task prompt goes through as a single argument. `ExecOptions.env` is scoped to that one process — the model key never lands in the repo or the image.
+- `exec(command, { args })` runs a bare binary and its args with no shell splitting, so the whole task prompt goes through as a single argument. `ExecOptions.env` is scoped to that one process — the model key never lands in the repo or the image. A key whose value is `undefined` arrives as an *empty string* rather than unset, which is why `run.mjs` filters before building the env.
 - Secrets in, diffs out: nothing else from your shell crosses into the VM, and `await using` terminates it when the scope ends (`Session` is an `AsyncDisposable`). Top-level `await using` needs **Node 24+** — Node 22 fails to parse it. `verify.mjs` uses `try`/`finally` instead, so CI runs fine on Node 20.

examples/claude-code-sandbox/run.mjs

@@ -26,6 +26,8 @@ await sandbox.exec("claude", {
 	args: ["-p", TASK, "--dangerously-skip-permissions"],
 	cwd: "repo", // relative paths resolve under the workdir, /home/tenki
 	timeoutMs: 10 * 60_000,
+	// An env value of undefined arrives as an empty string, not as unset — an empty
+	// ANTHROPIC_BASE_URL is worse than none, so filter to the vars you actually have.
 	env: Object.fromEntries(PASSTHROUGH.filter((k) => process.env[k]).map((k) => [k, process.env[k]])),
 	onOutput: ({ data }) => process.stdout.write(decoder.decode(data)), // data is a Uint8Array
 });

examples/claude-code-sandbox/verify.mjs

@@ -1,8 +1,8 @@
 /**
- * Proves the Tenki-facing half of this example without a model key: boot a sandbox
- * with the repo cloned, install the Claude Code CLI, read its version back, edit a
- * file in the checkout, and assert the diff round-trips. (run.mjs's agent turn needs
- * ANTHROPIC_API_KEY; CONTRIBUTING says CI verifies the backend, not the model.)
+ * Proves the Tenki-facing half of this example without a model key: boot a sandbox with
+ * the repo cloned, install the Claude Code CLI, check its version and run.mjs's flags,
+ * edit a file in the checkout, assert the diff round-trips. (The agent turn needs a
+ * model key; CONTRIBUTING says CI verifies the backend, not the model.)
  * Token/workspace from env (CI) or ~/.config/tenki/config.yaml (local `tenki login`).
  */
 import { TenkiSandbox, stdoutText } from "@tenkicloud/sandbox";
@@ -28,12 +28,8 @@ if (!authToken) {
 const tenki = new TenkiSandbox({ authToken });
 let sandbox;
 try {
-	sandbox = await tenki.createAndWait({
-		cpuCores: 2,
-		memoryMb: 4096,
-		cloneRepoUrl: "https://github.com/sindresorhus/yocto-queue",
-		workspaceId,
-	});
+	const cloneRepoUrl = "https://github.com/sindresorhus/yocto-queue";
+	sandbox = await tenki.createAndWait({ cpuCores: 2, memoryMb: 4096, cloneRepoUrl, workspaceId });
 
 	const pkg = JSON.parse(stdoutText(await sandbox.exec("cat", { args: ["repo/package.json"] })));
 	if (pkg.name !== "yocto-queue") throw new Error(`clone landed wrong: repo/package.json is ${pkg.name}`);
@@ -44,6 +40,11 @@ try {
 	const version = stdoutText(await sandbox.exec("claude", { args: ["--version"] })).trim();
 	if (!/^\d+\.\d+\.\d+ \(Claude Code\)$/.test(version)) throw new Error(`claude --version said ${JSON.stringify(version)}`);
 
+	// npm always installs the latest CLI, so check run.mjs's flags still exist in it.
+	const help = stdoutText(await sandbox.exec("claude", { args: ["--help"] }));
+	const missing = ["-p, --print", "--dangerously-skip-permissions"].filter((f) => !help.includes(f));
+	if (missing.length) throw new Error(`claude --help no longer lists ${missing.join(", ")}`);
+
 	// Stand in for the agent's edit, then read it back the way run.mjs reads the agent's.
 	await sandbox.exec("sh", { args: ["-c", "printf '\\nexport const verified = true;\\n' >> repo/index.js"] });
 	const diff = stdoutText(await sandbox.exec("git", { args: ["-C", "repo", "diff"] }));