fix(sandbox): judge session lease coverage from the request's own clock reading (#8665)

ensureSessionSandbox subtracted elapsed time from the lease using one Date.now()
read, and the handle's outlives() added it back using a second read. When the
millisecond ticked between the two and the reconnect granted the lease in the
same millisecond the call captured, coverage fell 1ms short and an unneeded E2B
setTimeout was issued. outlives() now takes the reference time, so acquisition
measures from requestedAtMs with no second read.

The session lease test froze nothing and slept on a real timer, so it only failed
when the tick landed between the two reads. It now controls Date.now() to put the
tick exactly there.

Author: waleedlatif1

apps/sim/lib/execution/remote-sandbox/e2b-session.test.ts

@@ -644,7 +644,7 @@ describe('E2B session lease', () => {
     const plane = controlPlane(5 * 60_000)
     const sandbox = await e2bProvider.findSessionSandbox?.('chat', { lifetimeMs: LEASE_MS })
     expect(plane.endAtMs).toBeGreaterThanOrEqual(Date.now() + LEASE_MS - 1000)
-    expect(sandbox?.outlives?.(IDLE_MS)).toBe(true)
+    expect(sandbox?.outlives?.(IDLE_MS, Date.now())).toBe(true)
     await sandbox?.extendLifetime?.(IDLE_MS)
     expect(plane.endAtMs).toBeGreaterThanOrEqual(Date.now() + IDLE_MS)
     expect(plane.requests).toBe(1)
@@ -656,7 +656,7 @@ describe('E2B session lease', () => {
       sessionKey: 'chat',
       lifetimeMs: LEASE_MS,
     })
-    expect(sandbox.outlives?.(IDLE_MS)).toBe(true)
+    expect(sandbox.outlives?.(IDLE_MS, Date.now())).toBe(true)
     await sandbox.extendLifetime?.(IDLE_MS)
     expect(plane.endAtMs).toBeGreaterThanOrEqual(Date.now() + LEASE_MS - 1000)
     expect(plane.requests).toBe(1)
@@ -673,7 +673,7 @@ describe('E2B session lease', () => {
   it('reads back and extends a lease it did not grant itself', async () => {
     const plane = controlPlane(5 * 60_000)
     const sandbox = await e2bProvider.findSessionSandbox?.('chat', {})
-    expect(sandbox?.outlives?.(IDLE_MS)).toBe(false)
+    expect(sandbox?.outlives?.(IDLE_MS, Date.now())).toBe(false)
     await sandbox?.extendLifetime?.(LEASE_MS)
     expect(plane.endAtMs).toBeGreaterThanOrEqual(Date.now() + LEASE_MS - 1000)
     expect(plane.requests).toBe(3)

apps/sim/lib/execution/remote-sandbox/e2b.ts

@@ -376,17 +376,17 @@ class E2BSandboxHandle implements SandboxHandle {
     return this.sandbox.sandboxId
   }
 
-  outlives(lifetimeMs: number): boolean {
+  outlives(lifetimeMs: number, fromMs: number): boolean {
     return (
       this.sessionDeadlineAtMs !== undefined &&
-      this.sessionDeadlineAtMs >= Date.now() + e2bTimeoutMs(lifetimeMs)
+      this.sessionDeadlineAtMs >= fromMs + e2bTimeoutMs(lifetimeMs)
     )
   }
 
   async extendLifetime(lifetimeMs: number): Promise<void> {
     const timeoutMs = e2bTimeoutMs(lifetimeMs)
     if (this.sessionKey !== undefined) {
-      if (this.outlives(lifetimeMs)) return
+      if (this.outlives(lifetimeMs, Date.now())) return
       /** Session callers serialize updates so a short job cannot shorten another job's lease. */
       const info = await this.sandbox.getInfo()
       if (info.endAt.getTime() >= Date.now() + timeoutMs) return

apps/sim/lib/execution/remote-sandbox/index.ts

@@ -136,7 +136,7 @@ async function leaseSandbox(
         session: status,
         release: async () => {
           // A deadline that already covers the idle window needs no serialized update.
-          if (created.sandbox.outlives?.(SESSION_SANDBOX_IDLE_MS)) return
+          if (created.sandbox.outlives?.(SESSION_SANDBOX_IDLE_MS, Date.now())) return
           // Cleanup failure cannot relabel a completed mutation as a failed execution.
           try {
             await withSandboxSessionLock(session.key, AbortSignal.timeout(30_000), async () => {

apps/sim/lib/execution/remote-sandbox/session-sandbox.test.ts

@@ -772,26 +772,36 @@ describe('session sandbox lease', () => {
   })
 
   it('trusts a lease granted by a slow reconnect for the whole call, then refreshes nothing', async () => {
+    // The provider grants the lease in the same millisecond the call asked for it, then the
+    // clock advances on every read: coverage judged from two separate readings falls short.
+    let nowMs = Date.now()
+    let advancing = false
+    const clock = vi.spyOn(Date, 'now').mockImplementation(() => (advancing ? ++nowMs : nowMs))
     const { handle, calls } = fakeSandbox('sb-covered')
     let grantedUntilMs = 0
-    handle.outlives = (lifetimeMs) => grantedUntilMs >= Date.now() + lifetimeMs
+    handle.outlives = (lifetimeMs, fromMs) => grantedUntilMs >= fromMs + lifetimeMs
     mockFindSessionSandbox.mockImplementation(
       async (_key: string, options: { lifetimeMs?: number }) => {
         grantedUntilMs = Date.now() + (options.lifetimeMs ?? 0)
-        await sleep(20)
+        nowMs += 20
+        advancing = true
         return handle
       }
     )
 
-    const result = await executeInSandbox({
-      ...CODE_REQUEST,
-      sandboxKind: 'mothership',
-      session: { key: 'mothership-chat:c3' },
-    })
+    try {
+      const result = await executeInSandbox({
+        ...CODE_REQUEST,
+        sandboxKind: 'mothership',
+        session: { key: 'mothership-chat:c3' },
+      })
 
-    expect(result.sandboxSession).toBe('reused')
-    expect(grantedUntilMs).toBeGreaterThanOrEqual(Date.now() + 20 * 60_000)
-    expect(calls.extendLifetime).toHaveLength(0)
+      expect(result.sandboxSession).toBe('reused')
+      expect(grantedUntilMs).toBeGreaterThanOrEqual(Date.now() + 20 * 60_000)
+      expect(calls.extendLifetime).toHaveLength(0)
+    } finally {
+      clock.mockRestore()
+    }
   })
 
   it('does not rewrite an unchanged executable while earlier code can still use it', async () => {

apps/sim/lib/execution/remote-sandbox/session.ts

@@ -63,8 +63,8 @@ export async function ensureSessionSandbox(args: {
       providerId: provider.id,
       sandboxId: created.sandbox.sandboxId,
     })
-  // The budget is anchored before acquisition, so a lease granted by the lookup or create covers it.
-  if (!created.sandbox.outlives?.(Math.max(0, lifetimeMs - (Date.now() - requestedAtMs))))
+  // Measured from before acquisition: any lease the lookup or create granted starts no earlier.
+  if (!created.sandbox.outlives?.(lifetimeMs, requestedAtMs))
     await created.sandbox.extendLifetime?.(lifetimeMs)
   signal.throwIfAborted()
   if (session.cli) {

apps/sim/lib/execution/remote-sandbox/types.ts

@@ -280,9 +280,10 @@ export interface SandboxHandle {
   extendLifetime?(lifetimeMs: number): Promise<void>
   /**
    * True when a deadline this handle already established keeps the sandbox alive for
-   * `lifetimeMs` from now, so {@link extendLifetime} would make no provider request.
+   * `lifetimeMs` counted from `fromMs`, so {@link extendLifetime} would make no provider
+   * request. The caller supplies the clock reading the window is measured from.
    */
-  outlives?(lifetimeMs: number): boolean
+  outlives?(lifetimeMs: number, fromMs: number): boolean
   /** Reads provider metadata without materializing the file contents. */
   getFileSize(path: string): Promise<number>
   readFile(path: string): Promise<string>