make typecheck reports three errors on Windows and none on Linux #4477

Describe the bug

make typecheck reports three errors on Windows and none on Linux, on the same checkout. AGENTS.md asks contributors to run it before marking work ready, so a Windows contributor sees three failures they did not cause and cannot act on.

The typecheck job runs on ubuntu-latest, so CI never exercises the Windows result.

Debug information

• Agents SDK version: main at d40f5d9, clean tree
• Python version: 3.13.11
• Operating system: Windows 11
• Does it reproduce with the latest release? Yes, the three sites are unchanged.
• Consistently or intermittently? Consistently, it is platform-determined.

$ uv run mypy src
src\agents\sandbox\util\tar_utils.py:161: error: Incompatible return value type (got "_TemporaryFileWrapper[bytes]", expected "IOBase")  [return-value]
src\agents\sandbox\sandboxes\unix_local.py:339: error: Name "process" is used before definition  [used-before-def]
src\agents\sandbox\sandboxes\docker.py:1430: error: Argument "stream" to "_stream_into_exec" of "DockerSandboxSession" has incompatible type "_TemporaryFileWrapper[bytes]"; expected "IOBase"  [arg-type]
Found 3 errors in 3 files (checked 305 source files)

Repro steps

The platform flag is the whole difference. Same checkout, same mypy, same command otherwise:

$ uv run mypy src
Found 3 errors in 3 files (checked 305 source files)

$ uv run mypy --platform linux src
Success: no issues found in 305 source files

mypy analyses sys.platform branches and platform-specific typeshed definitions for the platform it is told about, defaulting to the host. tempfile.NamedTemporaryFile and the unix_local code paths differ between the two, which is why all three land in src/agents/sandbox/.

Expected behavior

make typecheck should give the same answer on any contributor machine, since it is gating contributions rather than describing the runtime.

Two shapes, and I do not have a preference:

Pin the platform so the command is reproducible, for example python_platform = "linux" under [tool.mypy] in pyproject.toml, or --platform linux in the Makefile target. This makes every contributor see exactly what CI enforces. The cost is that genuine Windows-only type problems stay invisible, which is the situation today anyway.

Or fix the three sites and add a Windows leg to the typecheck job. This is the stricter option and would have caught these three, but it is a real CI cost and the sandbox code may not be intended to typecheck on Windows at all.

Happy to send a PR for either. Filing rather than guessing because pinning the platform is a project convention decision.

Related: #4476 is a different Windows-contributor gap in the same setup flow.