Add ty-sandbox extension for cloud sandbox agents

[bborn]

Summary

• Ports rivet-dev/sandbox-agent concept to Go as a TaskYou extension (extensions/ty-sandbox)
• Provides HTTP/SSE API for controlling coding agents (Claude Code, Codex, etc.) in isolated cloud sandbox environments
• Follows the same extension pattern as ty-email — standalone Go binary that integrates with TaskYou via the ty CLI

What's included

HTTP API (v1 endpoints):

• GET /v1/health — health check
• GET /v1/agents — list available agents
• POST /v1/agents/{agent}/install — install an agent CLI
• POST /v1/sessions/{session_id} — create agent session
• POST /v1/sessions/{session_id}/messages — send message to session
• GET /v1/sessions/{session_id}/events — poll events
• GET /v1/sessions/{session_id}/events/sse — stream events via SSE
• POST /v1/sessions/{session_id}/terminate — stop session
• HITL: question reply/reject, permission reply

Universal event schema matching sandbox-agent:

• Session lifecycle (started/ended)
• Turn tracking (started/ended)
• Item streaming (started/delta/completed) for messages and tool calls
• Question and permission events for human-in-the-loop workflows

Agent adapters:

• Claude Code — manages claude CLI subprocess with --output-format stream-json
• Mock — synthetic events for testing

Infrastructure:

• Bearer token auth middleware
• CORS support
• TaskYou bridge (auto-creates/updates tasks via ty CLI)
• Dockerfile for cloud deployment

Test plan

• go build ./... passes
• go vet ./... passes
• All server tests pass (go test ./...)
• Manual test: start server, create mock session, verify SSE events
• Manual test: deploy in Docker, run Claude Code session

🤖 Generated with Claude Code