Add codex-sandbox example

[opencolin]

OpenAI Codex running headless against a real Git checkout inside a disposable Tenki microVM — the counterpart to #20, deliberately using the same repo and the same task so the two read side by side.

Shape: createAndWait({ cloneRepoUrl }) → npm i -g @openai/codex → codex exec --dangerously-bypass-approvals-and-sandbox "<task>" with the model key passed through ExecOptions.env and the turn streamed via onOutput → git -C repo diff.

Verification

Ran node verify.mjs locally against the live API:

✓ codex-sandbox: create + clone → npm i -g @openai/codex → codex-cli 0.144.4 → edit → git diff → dispose

Exit code 0. Proves the Tenki-facing half with no model key, asserting real values rather than truthiness:

• the sandbox boots with the repo cloned, and repo/package.json really is yocto-queue
• npm i -g @openai/codex exits 0 (~7s)
• codex --version matches codex-cli \d+\.\d+\.\d+
• codex exec --help still lists --dangerously-bypass-approvals-and-sandbox and -C, --cd — npm installs whatever is latest at run time, so the flags run.mjs depends on are checked rather than assumed
• a diff round-trips on a file the script writes itself

Not exercised: the agent turn needs an OPENAI_API_KEY, which this environment does not have, so codex exec was not run to completion. Everything around it was measured live inside a sandbox — the CLI installs, starts, parses these exact flags as user tenki, and gets as far as 401 Unauthorized from wss://api.openai.com/v1/responses, which is precisely where a missing key should stop it.

The Codex-specific gotcha

Codex ships its own sandbox. Under the default --sandbox workspace-write it looks for bubblewrap and warns could not find bubblewrap on PATH ... Codex will use the bundled bubblewrap in the meantime, then nests its isolation inside the microVM's. With --dangerously-bypass-approvals-and-sandbox it reports sandbox: danger-full-access and skips the layer. Both modes measured live; the example bypasses and says why in Notes.

Also measured, so the README does not claim otherwise: codex exec runs fine outside a Git repo, so --skip-git-repo-check is not needed — the checkout is there to give the agent something to change, not to satisfy the CLI.

Scope

Adds one row to Developer tools, next to the Claude Code row. Touches nothing else outside examples/codex-sandbox/.

Stacked on examples/claude-agent-sdk (#21), which is itself on #20, since all three add a row to the root README table. GitHub will retarget this as the stack merges. Review order: #20 → #21 → this.

Note on the OpenAI Agents SDK

The other half of the original ask is already shipped: examples/openai-agents-sdk/ gives an Agents SDK agent a run_python tool backed by sandbox.exec, with verify.mjs driving the tool through tool.invoke(new RunContext(), ...) and no model key — the same shape as #21. Rather than duplicate it, nothing was added for it here.

---

Generated by Claude Code