[Medium] sandbox delete: last_sandbox never cleared, --all silently capped at 1000 with no confirmation, -f appended to positionals

[clcollins]

Severity: Medium (acts on the wrong sandbox after delete; surprising --all)

• last_sandbox is never cleared. The CLI passes a nil writer (internal/cli/sandbox_lifecycle.go:96, sandbox.Delete(…, nil, "", …)), so after delete, the next nameless exec/logs/connect targets a deleted sandbox — or a different sandbox re-created under the same name. Fix: pass the OS writer and clear the pointer when the deleted name matches.
• --all semantics. pkg/sandbox/delete.go:55 lists with a hard cap of 1000 and silently ignores the rest; there is no confirmation prompt or --yes. Fix: paginate or error when the cap is hit; require confirmation on a TTY unless --yes/-f is given. Check upstream first: the delete entry in hack/parity/sandbox_flags_v0.0.116.json and plan Appendix A.11 say which flags upstream has — if upstream has no --yes, add it as a documented openshellctl extension rather than silently diverging.
• -f + positional names are appended (sandbox_lifecycle.go:76-82), whereas every other command treats them as mutually exclusive. Pick one rule and apply it everywhere (item 1 fixes the ordering; this item picks the rule).
• waitForDeletion swallows non-NotFound errors (pkg/sandbox/delete.go:89-110 checks only NotFoundError): a gateway returning Unavailable or PermissionDenied is retried until the full timeout. Fix: return immediately on any non-NotFound, non-transient error (or after N consecutive failures).

Acceptance

• Mock-gateway test: delete NAME → last_sandbox file removed/cleared; delete other → untouched.
• --all with > cap sandboxes → error or full pagination, tested with a scripted list.
• delete -f x.yaml other → usage error, consistent with siblings.
• waitForDeletion with a scripted Get returning Unavailable → returns that error promptly, not after the timeout.

---

Generated by Claude Code