fix: clean up the client scripts and tests

[Ho1yShif]

Summary

Clean up the Python and TypeScript clients and their tests. See testing.md for test steps.

 cleanup
-  loop 12 times: delete, sleep 3 s on 409
+  delete with SDK retries (max 5; the SDK retries 409 with backoff)
   404 counts as deleted

 run_task
+  exit "Set SANDBOX_ID first." before the stream opens (first run only)
+  make one idempotency key per run
-  maxRetries: 0, so the key never protected a retry
+  SDK default retries, each sending the same key

 create_session (Python)
+  fail if the environment is not self_hosted
-  write_text (mode follows umask)
+  os.open(O_EXCL, 0o600)

 wait_for_sandbox (Python)
+  exit "Set SANDBOX_ID first." in place of a KeyError
-  while ... else
+  ready flag

Decisions:

• create_session keeps max_retries=0, because session creation has no idempotency key and a retry could make a second session.
• TypeScript create_session now uses flag: "wx" to match the Python O_EXCL check.
• The TypeScript missing-ID error is still a thrown Error, so Node prints a stack trace. Python exits with only the message.
• The tests copy each client to tmp_path/<lang>/ and prompt.txt to tmp_path/, so no test writes to the shared parent directory.

I checked the retry behavior in the installed SDKs (Python openai 3.24.0, TypeScript openai 7.30.0). Both retry 409 with backoff from 0.5 s to 8 s. Both send the caller's Idempotency-Key again on each retry.

Evidence

• Before: 24 tests pass. Without SANDBOX_ID, Python fails with KeyError: 'SANDBOX_ID'.
• After: 28 tests pass. The new tests are:
  • test_missing_sandbox_id[run_task|wait_for_sandbox], for both languages: exits non-zero with Set SANDBOX_ID first., makes no API or CLI call, and Python prints no traceback.
  • test_create_and_no_overwrite: also checks that session.json has mode 600.
  • test_cleanup[conflict]: still sees two DELETE requests, now from SDK retries.
• npm run typecheck --prefix typescript passes.

Merge Danger

Door: two-way

Blast Radius: clients

The cleanup retry window is shorter than before, about 15 s in place of 36 s. A session that rejects deletion for longer keeps session.json, and you can run cleanup again.

🤖 Generated with Claude Code