fix(lifecycle): apply explicit resume and connect timeouts

CubeAPI/src/cubemaster/mod.rs

@@ -1397,7 +1397,8 @@ pub struct SandboxUpdateRequest {
     /// "pause" | "resume"
     #[serde(rename = "action")]
     pub action: String,
-    /// TTL in seconds (for resume; 0 = keep original). Optional for pause.
+    /// Idle timeout in seconds for resume (-1 = never, 0 = immediate).
+    /// Omitted for pause or when the caller keeps the current timeout.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub timeout: Option<i32>,
 }

CubeAPI/src/handlers/sandboxes.rs

@@ -300,6 +300,7 @@ pub async fn pause_sandbox(
     request_body = ResumedSandbox,
     responses(
         (status = 201, description = "Sandbox resumed", body = Sandbox),
+        (status = 400, description = "Invalid timeout value", body = ApiError),
         (status = 404, description = "Sandbox not found", body = ApiError),
         (status = 409, description = "Sandbox is already running", body = ApiError),
         (status = 500, description = "Unexpected backend error", body = ApiError)
@@ -310,6 +311,9 @@ pub async fn resume_sandbox(
     Path(sandbox_id): Path<String>,
     Json(body): Json<ResumedSandbox>,
 ) -> AppResult<impl IntoResponse> {
+    body.validate()
+        .map_err(|e| AppError::BadRequest(e.to_string()))?;
+
     state
         .logger
         .log(
@@ -346,6 +350,7 @@ pub async fn resume_sandbox(
     request_body = ConnectSandbox,
     responses(
         (status = 200, description = "Sandbox connection info", body = Sandbox),
+        (status = 400, description = "Invalid timeout value", body = ApiError),
         (status = 404, description = "Sandbox not found", body = ApiError),
         (status = 500, description = "Unexpected backend error", body = ApiError)
     )
@@ -355,6 +360,9 @@ pub async fn connect_sandbox(
     Path(sandbox_id): Path<String>,
     Json(body): Json<ConnectSandbox>,
 ) -> AppResult<impl IntoResponse> {
+    body.validate()
+        .map_err(|e| AppError::BadRequest(e.to_string()))?;
+
     state
         .logger
         .log(

CubeAPI/src/models/mod.rs

@@ -359,11 +359,12 @@ pub struct SandboxDetail {
 // ─── Sandbox — pause/resume/connect/snapshot ──────────────────────────────
 
 /// Request body for POST /sandboxes/{id}/resume (deprecated).
-#[derive(Debug, Deserialize, ToSchema)]
+#[derive(Debug, Deserialize, Validate, ToSchema)]
 #[allow(dead_code)]
 pub struct ResumedSandbox {
     /// Idle timeout in seconds; None when the client did not send one.
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_timeout_value"))]
     pub timeout: Option<i32>,
     #[serde(rename = "autoPause", default)]
     pub auto_pause: bool,
@@ -374,6 +375,7 @@ pub struct ResumedSandbox {
 pub struct ConnectSandbox {
     /// Idle timeout in seconds; None when the client did not send one.
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_timeout_value"))]
     pub timeout: Option<i32>,
 }
 
@@ -576,8 +578,8 @@ fn default_page_limit() -> i32 {
 #[cfg(test)]
 mod tests {
     use super::{
-        CreateTemplateRequest, NewSandbox, SandboxNetworkConfig, SetTimeoutRequest,
-        TemplateAliasLookupResponse,
+        ConnectSandbox, CreateTemplateRequest, NewSandbox, ResumedSandbox, SandboxNetworkConfig,
+        SetTimeoutRequest, TemplateAliasLookupResponse,
     };
     use validator::Validate;
 
@@ -609,6 +611,29 @@ mod tests {
         }
     }
 
+    #[test]
+    fn resume_and_connect_use_timeout_value_semantics() {
+        for timeout in [None, Some(-1), Some(0), Some(60)] {
+            ConnectSandbox { timeout }
+                .validate()
+                .unwrap_or_else(|e| panic!("connect timeout={timeout:?} should be valid: {e}"));
+            ResumedSandbox {
+                timeout,
+                auto_pause: false,
+            }
+            .validate()
+            .unwrap_or_else(|e| panic!("resume timeout={timeout:?} should be valid: {e}"));
+        }
+
+        assert!(ConnectSandbox { timeout: Some(-2) }.validate().is_err());
+        assert!(ResumedSandbox {
+            timeout: Some(-2),
+            auto_pause: false,
+        }
+        .validate()
+        .is_err());
+    }
+
     #[test]
     fn sandbox_network_config_accepts_snake_case_policy_fields() {
         let cfg: SandboxNetworkConfig = serde_json::from_value(serde_json::json!({

CubeAPI/src/routes.rs

@@ -350,6 +350,23 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn resume_and_connect_reject_invalid_timeout_before_cubemaster() {
+        let server = test_server().await;
+
+        for path in ["/sandboxes/sb-1/resume", "/sandboxes/sb-1/connect"] {
+            let response = server
+                .post(path)
+                .json(&serde_json::json!({ "timeout": -2 }))
+                .await;
+            assert_eq!(
+                response.status_code(),
+                StatusCode::BAD_REQUEST,
+                "path={path}"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn template_alias_route_is_mounted_before_template_id_route() {
         let server = test_server().await;

CubeAPI/src/services/sandboxes.rs

@@ -381,6 +381,13 @@ impl SandboxService {
             )?;
 
             d = self.fetch_sandbox_detail(sandbox_id).await?;
+        } else if d.status == SandboxStatus::Running {
+            // E2B connect semantics reset an already-running sandbox's
+            // timeout too. Paused sandboxes apply the same value atomically
+            // with the successful resume in CubeMaster.
+            if let Some(timeout) = timeout {
+                self.set_timeout(sandbox_id, timeout).await?;
+            }
         }
 
         let envd_version = envd_version_from_annotations(&d.annotations);
@@ -1131,12 +1138,152 @@ mod tests {
         extract::State,
         http::{header::RETRY_AFTER, StatusCode},
         response::IntoResponse,
-        routing::{delete, post},
+        routing::{delete, get, post},
         Json, Router,
     };
     use serde_json::Value;
     use tokio::sync::Mutex;
 
+    #[tokio::test]
+    async fn connect_running_sandbox_applies_explicit_timeout() {
+        #[derive(Clone, Default)]
+        struct Capture {
+            timeout_body: Arc<Mutex<Option<Value>>>,
+        }
+
+        async fn info_handler() -> Json<Value> {
+            Json(serde_json::json!({
+                "requestID": "req-info",
+                "ret": { "ret_code": 0, "ret_msg": "ok" },
+                "data": [{
+                    "sandbox_id": "sb-running",
+                    "host_id": "host-1",
+                    "template_id": "tpl-1",
+                    "status": 1,
+                    "annotations": {}
+                }]
+            }))
+        }
+
+        async fn timeout_handler(
+            State(capture): State<Capture>,
+            Json(body): Json<Value>,
+        ) -> Json<Value> {
+            *capture.timeout_body.lock().await = Some(body);
+            Json(serde_json::json!({
+                "requestID": "req-timeout",
+                "sandboxID": "sb-running",
+                "ret": { "ret_code": 0, "ret_msg": "ok" }
+            }))
+        }
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener should bind");
+        let address = listener.local_addr().expect("listener address");
+        let capture = Capture::default();
+        let app = Router::new()
+            .route("/cube/sandbox/info", get(info_handler))
+            .route("/cube/sandbox/timeout", post(timeout_handler))
+            .with_state(capture.clone());
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.expect("server should run");
+        });
+
+        let service = SandboxService::new(
+            CubeMasterClient::new(format!("http://{address}"), reqwest::Client::new()),
+            "cubebox".to_string(),
+            "cube.app".to_string(),
+        );
+
+        service
+            .connect_sandbox("sb-running", Some(120))
+            .await
+            .expect("connect should succeed");
+
+        let body = capture
+            .timeout_body
+            .lock()
+            .await
+            .clone()
+            .expect("running connect should reset the explicit timeout");
+        assert_eq!(body["sandboxID"], "sb-running");
+        assert_eq!(body["timeout"], 120);
+    }
+
+    #[tokio::test]
+    async fn connect_paused_sandbox_applies_timeout_with_resume_only() {
+        #[derive(Clone, Default)]
+        struct Capture {
+            update_bodies: Arc<Mutex<Vec<Value>>>,
+            timeout_calls: Arc<Mutex<usize>>,
+        }
+
+        async fn info_handler() -> Json<Value> {
+            Json(serde_json::json!({
+                "requestID": "req-info",
+                "ret": { "ret_code": 0, "ret_msg": "ok" },
+                "data": [{
+                    "sandbox_id": "sb-paused",
+                    "host_id": "host-1",
+                    "template_id": "tpl-1",
+                    "status": 5,
+                    "annotations": {}
+                }]
+            }))
+        }
+
+        async fn update_handler(
+            State(capture): State<Capture>,
+            Json(body): Json<Value>,
+        ) -> Json<Value> {
+            capture.update_bodies.lock().await.push(body);
+            Json(serde_json::json!({
+                "ret": { "ret_code": 0, "ret_msg": "ok" }
+            }))
+        }
+
+        async fn timeout_handler(State(capture): State<Capture>) -> Json<Value> {
+            *capture.timeout_calls.lock().await += 1;
+            Json(serde_json::json!({
+                "requestID": "req-timeout",
+                "sandboxID": "sb-paused",
+                "ret": { "ret_code": 0, "ret_msg": "ok" }
+            }))
+        }
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener should bind");
+        let address = listener.local_addr().expect("listener address");
+        let capture = Capture::default();
+        let app = Router::new()
+            .route("/cube/sandbox/info", get(info_handler))
+            .route("/cube/sandbox/update", post(update_handler))
+            .route("/cube/sandbox/timeout", post(timeout_handler))
+            .with_state(capture.clone());
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.expect("server should run");
+        });
+
+        let service = SandboxService::new(
+            CubeMasterClient::new(format!("http://{address}"), reqwest::Client::new()),
+            "cubebox".to_string(),
+            "cube.app".to_string(),
+        );
+
+        service
+            .connect_sandbox("sb-paused", Some(120))
+            .await
+            .expect("connect should succeed");
+
+        let update_bodies = capture.update_bodies.lock().await;
+        assert_eq!(update_bodies.len(), 1);
+        assert_eq!(update_bodies[0]["action"], "resume");
+        assert_eq!(update_bodies[0]["timeout"], 120);
+        assert_eq!(*capture.timeout_calls.lock().await, 0);
+    }
+
     #[test]
     fn map_volume_mounts_returns_none_for_empty_input() {
         assert!(map_volume_mounts(&[]).is_none());

CubeMaster/pkg/lifecycle/store_test.go

@@ -11,6 +11,7 @@ import (
 	"reflect"
 	"sync"
 	"testing"
+	"time"
 )
 
 // recordedCall captures one Do invocation for later assertion.
@@ -22,6 +23,7 @@ type recordedCall struct {
 type fakeRedis struct {
 	mu    sync.Mutex
 	calls []recordedCall
+	hget  interface{}
 	// errOn maps command name -> error to return on the Nth call (counter-based).
 	failHSET bool
 	failHDEL bool
@@ -33,6 +35,11 @@ func (f *fakeRedis) Do(cmd string, args ...interface{}) (interface{}, error) {
 	defer f.mu.Unlock()
 	f.calls = append(f.calls, recordedCall{cmd: cmd, args: args})
 	switch cmd {
+	case "HGET":
+		if f.hget != nil {
+			return f.hget, nil
+		}
+		return nil, nil
 	case "HSET":
 		if f.failHSET {
 			return nil, errors.New("HSET boom")
@@ -49,6 +56,52 @@ func (f *fakeRedis) Do(cmd string, args ...interface{}) (interface{}, error) {
 	return "OK", nil
 }
 
+func TestStoreTimeoutProviderRefreshesOnlyMutableTimeoutFields(t *testing.T) {
+	timeout := 60
+	createdAt := int64(1700000000000)
+	meta := SandboxLifecycleMeta{
+		SandboxID:      "sbx-refresh",
+		TemplateID:     "tpl-1",
+		HostID:         "host-1",
+		HostIP:         "10.0.0.1",
+		InstanceType:   "cubebox",
+		TimeoutSeconds: &timeout,
+		AutoPause:      true,
+		AutoResume:     true,
+		CreatedAt:      createdAt,
+	}
+	raw, err := json.Marshal(meta)
+	if err != nil {
+		t.Fatalf("marshal seed meta: %v", err)
+	}
+	r := &fakeRedis{hget: raw}
+	provider := &storeTimeoutProvider{store: NewStore(r)}
+
+	endAt, err := provider.RefreshTimeout(context.Background(), meta.SandboxID, 120)
+	if err != nil {
+		t.Fatalf("refresh timeout: %v", err)
+	}
+	if endAt <= time.Now().UnixMilli() || endAt > time.Now().Add(121*time.Second).UnixMilli() {
+		t.Fatalf("endAt=%d is not a fresh 120-second deadline", endAt)
+	}
+
+	calls := r.snapshot()
+	if len(calls) != 3 || calls[0].cmd != "HGET" || calls[1].cmd != "HSET" || calls[2].cmd != "XADD" {
+		t.Fatalf("unexpected refresh calls: %+v", calls)
+	}
+	updated, ok := calls[1].args[2].([]byte)
+	if !ok {
+		t.Fatalf("updated meta payload type=%T", calls[1].args[2])
+	}
+	var got SandboxLifecycleMeta
+	if err := json.Unmarshal(updated, &got); err != nil {
+		t.Fatalf("unmarshal updated meta: %v", err)
+	}
+	if got.TimeoutSeconds == nil || *got.TimeoutSeconds != 120 || !got.AutoPause || !got.AutoResume || got.TemplateID != meta.TemplateID {
+		t.Fatalf("refresh did not preserve policy/identity fields: %+v", got)
+	}
+}
+
 func (f *fakeRedis) snapshot() []recordedCall {
 	f.mu.Lock()
 	defer f.mu.Unlock()