Add five new Tenki Sandbox integration examples

[opencolin]

This PR adds five comprehensive cookbook examples demonstrating how to integrate Tenki Sandbox microVMs with various AI coding agents and frameworks:

Summary

These examples show practical patterns for running AI agents in isolated, disposable microVMs instead of on the host machine, with each example focusing on a different agent framework or use case.

Examples Added

1. Claude Agent SDK (examples/claude-agent-sdk/)

   • Integrates Anthropic's Claude Agent SDK with Tenki as the execution backend
   • Re-implements the SDK's built-in bash, read_file, and write_file tools to run in a sandbox instead of locally
   • Disables all built-in tools (tools: []) to ensure the agent's entire execution surface is the microVM
   • Includes agent.mjs (full agent loop) and verify.mjs (backend verification without model key)

2. Claude Code Sandbox (examples/claude-code-sandbox/)

   • Runs Claude Code headless against a real Git repository in a disposable microVM
   • Clones a repo, installs the CLI, lets the agent edit the checkout, and reads back the diff
   • Demonstrates how to pass through model configuration (ANTHROPIC_API_KEY, etc.) to the sandbox

3. OpenAI Codex Sandbox (examples/codex-sandbox/)

   • Similar pattern to Claude Code but for OpenAI's Codex agent
   • Shows how to bypass Codex's built-in bubblewrap sandbox when running inside a microVM (redundant nesting)
   • Includes verification that the agent's edits can be read back via git diff

4. OpenCode Sandbox (examples/opencode-sandbox/)

   • Boots a headless OpenCode server in a microVM with a repo pre-cloned
   • Exposes the server on a public HTTPS URL via exposePort()
   • Demonstrates password-protected access and JSON API interaction
   • Shows how to use enableOpenCode: true to bake the CLI into the guest

5. orca-tenki (examples/orca-tenki/)

   • Implements an orca ephemeral-VM recipe backed by Tenki microVMs
   • One disposable machine per agent instead of git worktrees on the host
   • Includes recipe.mjs (lifecycle management: create/suspend/resume/destroy) and ssh-proxy.mjs (WebSocket-to-stdio bridge for SSH)
   • Demonstrates SSH certificate issuance, host key pinning, and session lifecycle management

Key Implementation Details

• All examples use top-level await using (requires Node 24+) for automatic resource cleanup
• Each includes a verify.mjs script that tests the Tenki backend without requiring a model API key (suitable for CI)
• Examples demonstrate proper environment variable handling, timeout configuration, and output streaming
• The Claude Agent SDK example shows how to use in-process MCP servers to register custom tools
• The orca example illustrates the full lifecycle of ephemeral VM management with SSH access
• All examples include comprehensive README documentation with setup instructions and security notes

Files Added

• 5 example directories with run.mjs, verify.mjs, README.md, and package.json
• Additional implementation files: tenki-tools.mjs (Claude Agent SDK), ssh-proxy.mjs (orca), recipe.mjs (orca)
• Updated main README.md to reference the new examples

https://claude.ai/code/session_01Uz85xGA4zWSge1BtiDNnSN

[tenki-reviewer]

Review complete. No blocking issues — approved ✅; 1 nitpick below.

🧹 Nitpicks (1) — 🟢 1 low

• 🟢 orca recipe ignores the workspace the README requires (recipe.mjs:34) — The orca-tenki README (examples/orca-tenki/README.md:83) tells users to export TENKI_WORKSPACE_ID=... before running, but recipe.mjs never reads that variable and its createAndWait call (examples/orca-tenki/recipe.mjs:34) omits workspaceId, so the sandbox is created in whatever workspace the token resolves to and the exported value is silently ignored.

---

This PR introduces five new example directories showing how to run coding agents (Claude Agent SDK, Claude Code, Codex, OpenCode, and Orca) inside disposable Tenki microVMs. Each includes a run.mjs launcher, a verify.mjs harness, a package.json, and a README. The Orca recipe adds an ssh-proxy.mjs WebSocket SSH bridge and a recipe.mjs that provisions ephemeral VMs and issues short-lived user certificates.

Files	Change
claude-agent-sdk/*	Adds an Agent SDK integration with a tenki-tools.mjs tool bridge and verify harness.
claude-code-sandbox/*, codex-sandbox/*, opencode-sandbox/*	Add headless agent sandbox launchers and matching verify scripts.
orca-tenki/*	Adds an ephemeral-VM recipe with a WebSocket SSH proxy and user-certificate issuance.
README.md + per-example READMEs	Documents the recipes and their usage.

Note: the high-recall sweep pass did not publish its findings, so its candidates were not independently adjudicated; the issues it surfaced overlap with the verified set.

_{Reviewed commit: c6af8e2}