refactor(sandbox): extract noSandboxResponse to its own file (SRP)

Per review feedback on PR #525 — pulls the inline `noSandboxResponse`
helper out of `getSandboxReconnectHandler.ts` into its own file so it
can be reused by future endpoints (e.g., `/snapshot` resume) and so
the handler file stops carrying response-shape construction logic.
The narrowed `ReconnectBody` type in the handler now only covers the
two outcomes the handler actually constructs locally (`connected` /
`expired`); the `no_sandbox` shape lives with its builder.
TDD red -> green: 3 unit tests for the extracted helper covering 200
status, hasSnapshot derivation, and lifecycle envelope projection.
Suite: 2526 -> 2529.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sweetmantech

lib/sandbox/__tests__/noSandboxResponse.test.ts

@@ -0,0 +1,53 @@
+import{describe,it,expect,vi}from"vitest";
+import{NextResponse}from"next/server";
+import{noSandboxResponse}from"@/lib/sandbox/noSandboxResponse";
+
+vi.mock("@/lib/networking/getCorsHeaders",()=>({
+getCorsHeaders: ()=>({"Access-Control-Allow-Origin": "*"}),
+}));
+
+constbaseRow={
+id: "sess-1",
+account_id: "acc-1",
+sandbox_state: null,
+lifecycle_state: null,
+lifecycle_version: 0,
+sandbox_expires_at: null,
+hibernate_after: null,
+last_activity_at: null,
+snapshot_url: null,
+};
+
+describe("noSandboxResponse",()=>{
+it("returns a 200 NextResponse with status='no_sandbox'",async()=>{
+constres=noSandboxResponse(baseRowasnever);
+
+expect(res).toBeInstanceOf(NextResponse);
+expect(res.status).toBe(200);
+constbody=awaitres.json();
+expect(body.status).toBe("no_sandbox");
+});
+
+it("derives hasSnapshot from snapshot_url presence",async()=>{
+constwithSnap=awaitnoSandboxResponse({
+ ...baseRow,
+snapshot_url: "snap://x",
+}asnever).json();
+constwithout=awaitnoSandboxResponse(baseRowasnever).json();
+
+expect(withSnap.hasSnapshot).toBe(true);
+expect(without.hasSnapshot).toBe(false);
+});
+
+it("includes the lifecycle envelope projected from the row",async()=>{
+constbody=awaitnoSandboxResponse(baseRowasnever).json();
+
+expect(body.lifecycle).toMatchObject({
+serverTime: expect.any(Number),
+state: null,
+lastActivityAt: null,
+hibernateAfter: null,
+sandboxExpiresAt: null,
+});
+});
+});

lib/sandbox/getSandboxReconnectHandler.ts

@@ -4,29 +4,20 @@ import { validateAuthContext } from "@/lib/auth/validateAuthContext";
 import{buildLifecycle}from"@/lib/sandbox/buildLifecycle";
 import{connectSandbox}from"@/lib/sandbox/factory";
 import{hasRuntimeSandboxState}from"@/lib/sandbox/hasRuntimeSandboxState";
+import{noSandboxResponse}from"@/lib/sandbox/noSandboxResponse";
 import{selectSessions}from"@/lib/supabase/sessions/selectSessions";
 import{updateSession}from"@/lib/supabase/sessions/updateSession";
 importtype{SandboxState}from"@/lib/sandbox/factory";
-importtype{Tables}from"@/types/database.types";
 
 constPROBE_TIMEOUT_MS=15_000;
 
 interfaceReconnectBody{
-status: "connected"|"expired"|"no_sandbox";
+status: "connected"|"expired";
 hasSnapshot: boolean;
 expiresAt?: number;
 lifecycle: ReturnType<typeofbuildLifecycle>;
 }
 
-functionnoSandboxResponse(row: Tables<"sessions">): NextResponse{
-constbody: ReconnectBody={
-status: "no_sandbox",
-hasSnapshot: !!row.snapshot_url,
-lifecycle: buildLifecycle(row),
-};
-returnNextResponse.json(body,{status: 200,headers: getCorsHeaders()});
-}
-
 /**
  * Handles `GET /api/sandbox/reconnect`. Live runtime probe — actually
  * runs a quick command inside the sandbox to verify it is reachable.

lib/sandbox/noSandboxResponse.ts

@@ -0,0 +1,24 @@
+import{NextResponse}from"next/server";
+import{getCorsHeaders}from"@/lib/networking/getCorsHeaders";
+import{buildLifecycle}from"@/lib/sandbox/buildLifecycle";
+importtype{Tables}from"@/types/database.types";
+
+/**
+ * Builds the `status: "no_sandbox"` response shared by sandbox lifecycle
+ * endpoints (currently `/reconnect`). Used when the session row lacks
+ * runtime metadata — there is no live sandbox to probe, so report that
+ * directly along with whether a snapshot exists for resume affordances.
+ *
+ * @param row - The `sessions` row.
+ * @returns A 200 NextResponse with `{status, hasSnapshot, lifecycle}`.
+ */
+exportfunctionnoSandboxResponse(row: Tables<"sessions">): NextResponse{
+returnNextResponse.json(
+{
+status: "no_sandbox"asconst,
+hasSnapshot: !!row.snapshot_url,
+lifecycle: buildLifecycle(row),
+},
+{status: 200,headers: getCorsHeaders()},
+);
+}