Harden coding session lifecycle

[jacobbeck-totango]

Summary

• make asynchronous startup failure cleanup durable and stop failures actionable
• fence Workshop MCP authority to the current sandbox generation while preserving rolling-deploy compatibility
• harden terminal attachment, reconnect races, cursor handling, and transitional-session polling

Verification

• pnpm lint
• pnpm test
• pnpm build
• independent code, security, and verification reviews approved

[jarvis-totango]

ODI PR Review

Status: completed
Run: prr-7cfeed6b75555fcc86a771aa
Head SHA: 0fdf0494360d8e7d493f9bd414112bd443c29818
Mode: standard

Walkthrough

• PR: Harden coding session lifecycle #48
• Inline findings: 0
• Summary-only findings: 0
• Held back: 0

Change impact

At a glance: 12 files changed (+710/-43): 6 non-test, 6 test, 0 migration, and 0 configuration files.

Likely reach

• Shared contracts: Changes to shared types or contracts may affect their producers and consumers.
• User experience: Frontend state, navigation, feature guards, accessibility, or user workflows may change.

Changed files and evidence

Evidence for head 0fdf0494360d8e7d493f9bd414112bd443c29818, refreshed 2026-08-22T01:57:28Z.

• packages/gatekeeper-sessions/__tests__/sessions-attach.test.ts: added (+117/-0)
• packages/gatekeeper-sessions/__tests__/sessions-expiry.test.ts: modified (+1/-0)
• packages/gatekeeper-sessions/__tests__/sessions-startup.test.ts: modified (+174/-1)
• packages/gatekeeper-sessions/src/sessions.ts: modified (+85/-15)
• packages/workshop-backend/__tests__/coding-session-generation.test.ts: added (+41/-0)
• packages/workshop-backend/src/server.ts: modified (+6/-6)
• packages/workshop-backend/src/user.ts: modified (+26/-12)
• packages/workshop-frontend/src/components/sessions/SessionTerminal.test.tsx: modified (+179/-0)
• Additional files: 4 additional changed files are included in the frozen evidence pack.

Findings summary

• No publishable findings for this evidence pack.

Commands: @jarvis review, @jarvis review full, @jarvis review security, @jarvis review tests, @jarvis review performance, @jarvis review paths <path>, @jarvis review gate, @jarvis review pause|resume|ignore.

[jarvis-totango]

ODI PR review findings

Summary-only findings:

• high: Restarted sessions retain the previous sandbox generation
• high: Update sandboxId when a session restarts with a new sandbox generation