Phase 1.4.2: Session TTL and auto-expiry by richard-devbot · Pull Request #32 · CursorTouch/Operator-Use

richard-devbot · 2026-04-05T15:36:43Z

Summary

Closes #24.

Session in operator_use/session/views.py now tracks _last_activity via time.monotonic()
is_expired() returns True when idle time since last activity exceeds ttl (default: 3600s / 1h)
touch() refreshes the activity clock; add_message() calls touch() automatically
Configurable per-session TTL — set ttl=N at construction time
Exported DEFAULT_SESSION_TTL = 3600.0 constant for consistent use elsewhere

Test Plan

pytest tests/test_session_ttl.py -v — 10/10 tests pass
New session not expired, expiry after TTL, touch() resets clock, zero/negative TTL, burst-touch keep-alive verified

🤖 Generated with Claude Code

qodo-code-review · 2026-04-05T15:36:57Z

Review Summary by Qodo

Add session TTL and auto-expiry with activity tracking

✨ Enhancement 🧪 Tests

Walkthroughs

Description

• Add session TTL tracking with configurable auto-expiry mechanism
• Implement is_expired() method checking idle time against TTL
• Add touch() method to refresh activity clock and extend session lifetime
• Automatically call touch() in add_message() for activity tracking
• Export DEFAULT_SESSION_TTL constant (3600s) for consistent configuration
• Add comprehensive test suite with 10 tests covering expiry scenarios

Diagram

flowchart LR
  A["Session Creation"] -- "Initialize _last_activity" --> B["Session Active"]
  B -- "add_message() or touch()" --> C["Clock Reset"]
  C -- "Check is_expired()" --> D{Idle Time > TTL?}
  D -- "No" --> B
  D -- "Yes" --> E["Session Expired"]

File Changes

1. operator_use/session/views.py ✨ Enhancement +18/-4

Add TTL tracking and expiry logic to Session

• Import time module for monotonic clock tracking
• Add DEFAULT_SESSION_TTL constant set to 3600.0 seconds
• Add ttl field to Session dataclass with default value
• Add _last_activity field initialized via time.monotonic()
• Implement touch() method to refresh activity timestamp
• Implement is_expired() method comparing idle time against TTL
• Call touch() automatically in add_message() method
• Fix formatting: add spaces around = in field definitions

operator_use/session/views.py

2. tests/test_session_ttl.py 🧪 Tests +65/-0

Add comprehensive session TTL test coverage

• Create new test file with 10 comprehensive test cases
• Test new session is not expired on creation
• Test default TTL equals 3600.0 seconds
• Test custom TTL configuration at construction
• Test session expiry after TTL idle time elapses
• Test touch() method resets expiry clock
• Test edge cases: zero TTL, negative TTL, very large TTL
• Test multiple sequential touches keep session alive

tests/test_session_ttl.py

qodo-code-review · 2026-04-05T15:36:58Z

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📎 Requirement gaps (3) 🎨 UX Issues (0)

1. TTL not config-driven 📎 Requirement gap ⛨ Security

Description

Session TTL is hard-coded to 1 hour and not sourced from config.json, so the system cannot enforce
the required configurable TTL with a 24-hour default.

Code

operator_use/session/views.py[R10-23]

+DEFAULT_SESSION_TTL = 3600.0  # 1 hour
+

@dataclass
class Session:
    """Session data class."""

    id: str
-    messages: list[BaseMessage]=field(default_factory=list)
-    created_at: datetime=field(default_factory=datetime.now)
-    updated_at: datetime=field(default_factory=datetime.now)
+    messages: list[BaseMessage] = field(default_factory=list)
+    created_at: datetime = field(default_factory=datetime.now)
+    updated_at: datetime = field(default_factory=datetime.now)
    metadata: dict[str, Any] = field(default_factory=dict)
+    ttl: float = DEFAULT_SESSION_TTL
+    _last_activity: float = field(init=False, default_factory=time.monotonic)

Evidence
PR Compliance ID 1 requires a config.json option (default 24 hours) that is read/used by the
session system. The PR sets DEFAULT_SESSION_TTL = 3600.0 and uses it as the Session.ttl default,
while the root Config schema has no session block for ttl_hours.
Configurable session TTL in config.json (default 24 hours)
operator_use/session/views.py[10-23]
operator_use/config/service.py[289-307]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Session TTL is hard-coded (`DEFAULT_SESSION_TTL = 3600.0`) and not configurable via `config.json`, and the default is not the required 24 hours.

## Issue Context
Compliance requires a configurable TTL stored in `config.json` under a `session` block (or equivalent) and actually used by the session system, with a default of 24 hours when unspecified.

## Fix Focus Areas
- operator_use/session/views.py[10-23]
- operator_use/config/service.py[289-307]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. Loaded sessions never expire 📎 Requirement gap ⛨ Security

Description

_last_activity is initialized with time.monotonic() on object creation and is not restored from
persisted timestamps, so sessions loaded from disk will appear “fresh” and won’t expire based on
real age/idle time.

Code

operator_use/session/views.py[R22-32]

+    ttl: float = DEFAULT_SESSION_TTL
+    _last_activity: float = field(init=False, default_factory=time.monotonic)

    def add_message(self, message: BaseMessage) -> None:
        """Add a message and update updated_at."""
        self.messages.append(message)
        self.updated_at = datetime.now()
+        self.touch()

    def get_history(self) -> list[BaseMessage]:
        """Return the message history."""

Evidence
PR Compliance ID 2 requires expiring sessions older than TTL on next access. The PR’s is_expired()
uses time.monotonic() - self._last_activity, but SessionStore.load() reconstructs Session
without setting _last_activity (or ttl), causing _last_activity to default to the load-time
monotonic value and preventing real “older than TTL” expiry on access.
Automatic expiry and cleanup of sessions older than TTL on next access
operator_use/session/views.py[22-46]
operator_use/session/service.py[29-58]
operator_use/session/service.py[74-84]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Sessions loaded from disk will not expire correctly because `_last_activity` is not persisted/restored and is initialized at load time.

## Issue Context
To expire sessions on next access, the expiry calculation must use a persisted timestamp (e.g., `updated_at` or a dedicated `last_activity` field stored in the JSONL metadata) and accessors like `get_or_create()` should invalidate/delete expired sessions.

## Fix Focus Areas
- operator_use/session/views.py[22-46]
- operator_use/session/service.py[29-58]
- operator_use/session/service.py[74-84]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. Tests miss cleanup/encryption 📎 Requirement gap ⚙ Maintainability

Description

The added tests cover only TTL expiry/touch behavior and do not include required assertions for
session cleanup or encryption round-trip.

Code

tests/test_session_ttl.py[R1-65]

+"""Tests for session TTL and auto-expiry.
+
+Validates that Session tracks last_activity, expires after its
+configurable TTL, and that touch() extends the session lifetime.
+"""
+
+from __future__ import annotations
+
+import time
+
+from operator_use.session.views import Session, DEFAULT_SESSION_TTL
+
+
+class TestSessionTTL:
+    def test_new_session_not_expired(self) -> None:
+        session = Session(id="test-1")
+        assert not session.is_expired()
+
+    def test_default_ttl_is_one_hour(self) -> None:
+        session = Session(id="test-2")
+        assert session.ttl == DEFAULT_SESSION_TTL
+        assert session.ttl == 3600.0
+
+    def test_custom_ttl(self) -> None:
+        session = Session(id="test-3", ttl=120.0)
+        assert session.ttl == 120.0
+
+    def test_session_expires_after_ttl(self) -> None:
+        session = Session(id="test-4", ttl=0.05)  # 50ms TTL
+        assert not session.is_expired()
+        time.sleep(0.1)
+        assert session.is_expired()
+
+    def test_touch_resets_expiry_clock(self) -> None:
+        session = Session(id="test-5", ttl=0.1)  # 100ms TTL
+        time.sleep(0.06)   # 60ms elapsed — not expired yet
+        session.touch()    # reset the clock
+        time.sleep(0.06)   # 60ms since touch — still within TTL
+        assert not session.is_expired()
+
+    def test_session_expires_after_touch_if_ttl_passes(self) -> None:
+        session = Session(id="test-6", ttl=0.05)
+        session.touch()
+        time.sleep(0.1)    # past TTL since last touch
+        assert session.is_expired()
+
+    def test_zero_ttl_immediately_expired(self) -> None:
+        session = Session(id="test-7", ttl=0.0)
+        time.sleep(0.001)  # any elapsed time exceeds 0s TTL
+        assert session.is_expired()
+
+    def test_negative_ttl_immediately_expired(self) -> None:
+        session = Session(id="test-8", ttl=-1.0)
+        assert session.is_expired()
+
+    def test_very_large_ttl_does_not_expire(self) -> None:
+        session = Session(id="test-9", ttl=1e9)
+        assert not session.is_expired()
+
+    def test_multiple_touches_keep_session_alive(self) -> None:
+        session = Session(id="test-10", ttl=0.05)
+        for _ in range(5):
+            time.sleep(0.02)
+            session.touch()
+            assert not session.is_expired()

Evidence

PR Compliance ID 5 requires automated tests validating TTL enforcement, cleanup removal of expired
sessions, and encryption/decryption round-trip. tests/test_session_ttl.py only tests
Session.is_expired() and touch() behavior and contains no cleanup or encryption coverage.

Automated tests cover TTL enforcement, cleanup, and encryption round-trip
tests/test_session_ttl.py[1-65]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Test coverage added in this PR validates only TTL expiry/touch, but compliance requires tests for cleanup and encryption round-trip as well.

## Issue Context
Add tests that (1) verify expired sessions are purged/invalidated by a cleanup API and/or on-access logic, and (2) verify encrypted-at-rest session persistence can be decrypted back to the original content when enabled.

## Fix Focus Areas
- tests/test_session_ttl.py[1-65]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

4. Clear skips TTL refresh 🐞 Bug ⚙ Maintainability

Description

Session.clear() updates updated_at but does not refresh _last_activity, so a just-cleared session
can still be considered idle/expired according to is_expired(), creating inconsistent “activity”
semantics within Session.

Code

operator_use/session/views.py[R36-42]

        """Clear all messages."""
        self.messages.clear()
        self.updated_at = datetime.now()
+
+    def touch(self) -> None:
+        """Refresh last_activity timestamp, extending the session TTL window."""
+        self._last_activity = time.monotonic()

Evidence

add_message() explicitly calls touch() (which updates _last_activity) but clear() does not, even
though both mutate the session and update updated_at. Because is_expired() ignores updated_at and
only consults _last_activity, clear() does not extend the TTL window.

operator_use/session/views.py[25-46]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`Session` has two clocks: `updated_at` (wall clock) and `_last_activity` (monotonic) used for TTL. Some mutating operations call `touch()` (add_message), while others (clear) do not, so session “activity” is inconsistent and may cause unexpected expiry results.

## Issue Context
`is_expired()` is based only on `_last_activity`, not `updated_at`.

## Fix Focus Areas
- operator_use/session/views.py[25-46]

## Fix suggestion
Decide which operations represent “activity” and ensure they call `touch()` consistently (e.g., add `self.touch()` to `clear()` if it should extend TTL). Alternatively, redefine `is_expired()` to be derived from `updated_at` so all updates are coherent.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

5. Timing-sensitive TTL tests 🐞 Bug ☼ Reliability

Description

Several TTL tests rely on small time.sleep() margins (20–60ms) relative to TTL values, which can
overshoot under CI load and intermittently fail assertions about expiry/non-expiry.

Code

tests/test_session_ttl.py[R28-65]

+    def test_session_expires_after_ttl(self) -> None:
+        session = Session(id="test-4", ttl=0.05)  # 50ms TTL
+        assert not session.is_expired()
+        time.sleep(0.1)
+        assert session.is_expired()
+
+    def test_touch_resets_expiry_clock(self) -> None:
+        session = Session(id="test-5", ttl=0.1)  # 100ms TTL
+        time.sleep(0.06)   # 60ms elapsed — not expired yet
+        session.touch()    # reset the clock
+        time.sleep(0.06)   # 60ms since touch — still within TTL
+        assert not session.is_expired()
+
+    def test_session_expires_after_touch_if_ttl_passes(self) -> None:
+        session = Session(id="test-6", ttl=0.05)
+        session.touch()
+        time.sleep(0.1)    # past TTL since last touch
+        assert session.is_expired()
+
+    def test_zero_ttl_immediately_expired(self) -> None:
+        session = Session(id="test-7", ttl=0.0)
+        time.sleep(0.001)  # any elapsed time exceeds 0s TTL
+        assert session.is_expired()
+
+    def test_negative_ttl_immediately_expired(self) -> None:
+        session = Session(id="test-8", ttl=-1.0)
+        assert session.is_expired()
+
+    def test_very_large_ttl_does_not_expire(self) -> None:
+        session = Session(id="test-9", ttl=1e9)
+        assert not session.is_expired()
+
+    def test_multiple_touches_keep_session_alive(self) -> None:
+        session = Session(id="test-10", ttl=0.05)
+        for _ in range(5):
+            time.sleep(0.02)
+            session.touch()
+            assert not session.is_expired()

Evidence

The tests use real sleeping with tight thresholds (e.g., ttl=0.1 with sleep(0.06) expecting not
expired; ttl=0.05 with repeated sleep(0.02) expecting not expired). On slow/loaded machines, sleep
jitter can exceed TTL and cause flakes.

tests/test_session_ttl.py[28-45]
tests/test_session_ttl.py[60-65]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
TTL tests are wall-clock timing sensitive due to `time.sleep()` with small margins, which can be flaky in CI.

## Issue Context
Production uses `time.monotonic()`, which is mockable in tests.

## Fix Focus Areas
- tests/test_session_ttl.py[28-45]
- tests/test_session_ttl.py[60-65]

## Fix suggestion
Use `pytest`’s `monkeypatch` to replace `operator_use.session.views.time.monotonic` with a deterministic counter you control (advance it manually between assertions). This removes sleeps and makes the suite fast and stable.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

ⓘ The new review experience is currently in Beta. Learn more

richard-devbot · 2026-04-05T15:38:55Z

Ready for review & merge ✅

Hey @Jeomon, PR #32 is ready to land. This closes Issue #24 (session TTL and auto-expiry).

What's in here:

Session in operator_use/session/views.py now tracks _last_activity via time.monotonic()
is_expired() — returns True when idle time exceeds ttl (default: 3600s / 1h)
touch() — refreshes the activity clock; called automatically by add_message()
Exported DEFAULT_SESSION_TTL = 3600.0 constant
10 unit tests, all passing — covers expiry, touch resets, zero/negative TTL, burst-touch keep-alive

Known limitation (flagged transparently): _last_activity is not serialized to .jsonl, so TTL resets on session reload from disk. Sessions loaded from persistent storage always start with a fresh clock.

This PR is independent and can merge at any time. No conflicts with main.

qodo-code-review · 2026-04-05T15:39:40Z

operator_use/session/views.py

+DEFAULT_SESSION_TTL = 3600.0  # 1 hour
+

 @dataclass
 class Session:
    """Session data class."""

    id: str
-    messages: list[BaseMessage]=field(default_factory=list)
-    created_at: datetime=field(default_factory=datetime.now)
-    updated_at: datetime=field(default_factory=datetime.now)
+    messages: list[BaseMessage] = field(default_factory=list)
+    created_at: datetime = field(default_factory=datetime.now)
+    updated_at: datetime = field(default_factory=datetime.now)
    metadata: dict[str, Any] = field(default_factory=dict)
+    ttl: float = DEFAULT_SESSION_TTL
+    _last_activity: float = field(init=False, default_factory=time.monotonic)


1. Ttl not config-driven 📎 Requirement gap ⛨ Security

Session TTL is hard-coded to 1 hour and not sourced from config.json, so the system cannot enforce the required configurable TTL with a 24-hour default.

Agent Prompt

## Issue description Session TTL is hard-coded (`DEFAULT_SESSION_TTL = 3600.0`) and not configurable via `config.json`, and the default is not the required 24 hours. ## Issue Context Compliance requires a configurable TTL stored in `config.json` under a `session` block (or equivalent) and actually used by the session system, with a default of 24 hours when unspecified. ## Fix Focus Areas - operator_use/session/views.py[10-23] - operator_use/config/service.py[289-307]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-code-review · 2026-04-05T15:39:40Z

operator_use/session/views.py

+    ttl: float = DEFAULT_SESSION_TTL
+    _last_activity: float = field(init=False, default_factory=time.monotonic)

    def add_message(self, message: BaseMessage) -> None:
        """Add a message and update updated_at."""
        self.messages.append(message)
        self.updated_at = datetime.now()
+        self.touch()

    def get_history(self) -> list[BaseMessage]:
        """Return the message history."""


2. Loaded sessions never expire 📎 Requirement gap ⛨ Security

_last_activity is initialized with time.monotonic() on object creation and is not restored from persisted timestamps, so sessions loaded from disk will appear “fresh” and won’t expire based on real age/idle time.

Agent Prompt

## Issue description Sessions loaded from disk will not expire correctly because `_last_activity` is not persisted/restored and is initialized at load time. ## Issue Context To expire sessions on next access, the expiry calculation must use a persisted timestamp (e.g., `updated_at` or a dedicated `last_activity` field stored in the JSONL metadata) and accessors like `get_or_create()` should invalidate/delete expired sessions. ## Fix Focus Areas - operator_use/session/views.py[22-46] - operator_use/session/service.py[29-58] - operator_use/session/service.py[74-84]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-code-review · 2026-04-05T15:39:40Z

tests/test_session_ttl.py

+"""Tests for session TTL and auto-expiry.
+
+Validates that Session tracks last_activity, expires after its
+configurable TTL, and that touch() extends the session lifetime.
+"""
+
+from __future__ import annotations
+
+import time
+
+from operator_use.session.views import Session, DEFAULT_SESSION_TTL
+
+
+class TestSessionTTL:
+    def test_new_session_not_expired(self) -> None:
+        session = Session(id="test-1")
+        assert not session.is_expired()
+
+    def test_default_ttl_is_one_hour(self) -> None:
+        session = Session(id="test-2")
+        assert session.ttl == DEFAULT_SESSION_TTL
+        assert session.ttl == 3600.0
+
+    def test_custom_ttl(self) -> None:
+        session = Session(id="test-3", ttl=120.0)
+        assert session.ttl == 120.0
+
+    def test_session_expires_after_ttl(self) -> None:
+        session = Session(id="test-4", ttl=0.05)  # 50ms TTL
+        assert not session.is_expired()
+        time.sleep(0.1)
+        assert session.is_expired()
+
+    def test_touch_resets_expiry_clock(self) -> None:
+        session = Session(id="test-5", ttl=0.1)  # 100ms TTL
+        time.sleep(0.06)   # 60ms elapsed — not expired yet
+        session.touch()    # reset the clock
+        time.sleep(0.06)   # 60ms since touch — still within TTL
+        assert not session.is_expired()
+
+    def test_session_expires_after_touch_if_ttl_passes(self) -> None:
+        session = Session(id="test-6", ttl=0.05)
+        session.touch()
+        time.sleep(0.1)    # past TTL since last touch
+        assert session.is_expired()
+
+    def test_zero_ttl_immediately_expired(self) -> None:
+        session = Session(id="test-7", ttl=0.0)
+        time.sleep(0.001)  # any elapsed time exceeds 0s TTL
+        assert session.is_expired()
+
+    def test_negative_ttl_immediately_expired(self) -> None:
+        session = Session(id="test-8", ttl=-1.0)
+        assert session.is_expired()
+
+    def test_very_large_ttl_does_not_expire(self) -> None:
+        session = Session(id="test-9", ttl=1e9)
+        assert not session.is_expired()
+
+    def test_multiple_touches_keep_session_alive(self) -> None:
+        session = Session(id="test-10", ttl=0.05)
+        for _ in range(5):
+            time.sleep(0.02)
+            session.touch()
+            assert not session.is_expired()


3. Tests miss cleanup/encryption 📎 Requirement gap ⚙ Maintainability

The added tests cover only TTL expiry/touch behavior and do not include required assertions for session cleanup or encryption round-trip.

Agent Prompt

## Issue description Test coverage added in this PR validates only TTL expiry/touch, but compliance requires tests for cleanup and encryption round-trip as well. ## Issue Context Add tests that (1) verify expired sessions are purged/invalidated by a cleanup API and/or on-access logic, and (2) verify encrypted-at-rest session persistence can be decrypted back to the original content when enabled. ## Fix Focus Areas - tests/test_session_ttl.py[1-65]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Session now tracks last_activity via time.monotonic(). is_expired() returns True when idle time since last activity exceeds the configurable TTL (default 1h). touch() refreshes the clock; add_message() calls touch() automatically. 10 tests covering expiry, touch, and edge cases.

BrowserPlugin and ComputerPlugin no longer register hooks to the main agent — subagents manage their own state injection. Test assertions updated accordingly: - Remove stale XML-tag assertions from SYSTEM_PROMPT tests - Fix browser tool name: 'browser' -> 'browser_task' - Update hook tests: register_hooks() is now a no-op for main agent, so assertions verify hooks are NOT wired (not that they are)

…ing]

…on [CursorTouch#24] Replaces timing-sensitive time.sleep() tests with deterministic monkeypatch clock (Bug 5). Adds test classes covering: - Config-driven TTL (Req Gap 1) - Loaded-session expiry from updated_at (Req Gap 2) - Cleanup method (Req Gap 3) - Encryption round-trip (Req Gap 3) - clear() calling touch() (Bug 4) All 25 tests are currently failing; implementation follows. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

- Change DEFAULT_SESSION_TTL from 3600.0 (1h) to 86400.0 (24h) - Use __post_init__ for _last_activity so monkeypatch can override time.monotonic before Session() is constructed (fixes timing-sensitive tests) - Add touch() call to clear() so session clears refresh the TTL window (Bug 4) - Add from_config() classmethod to source TTL from Config.session.ttl_hours - Add _from_persisted() classmethod that back-dates _last_activity from updated_at so loaded sessions expire based on real idle time (Req Gap 2) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

…ouch#24] - Add SessionConfig(Base) to operator_use/config/service.py with ttl_hours (float, default 24.0) and encrypt (bool, default False) fields - Add session: SessionConfig field to root Config class - Export SessionConfig from operator_use/config/__init__.py This satisfies Req Gap 1: session TTL is now configurable via config.json under the "session" block, with a 24-hour default. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

…up and encryption [CursorTouch#24] - load() now calls Session._from_persisted() so _last_activity is anchored to real idle time (updated_at), not load time (Req Gap 2) - get_or_create() deletes expired sessions on access instead of serving them - Add cleanup(ttl) method that purges all disk sessions older than ttl - Add encryption_key param to __init__; save/load use Fernet (AES-256) when set — plaintext content never written to disk in encrypted mode (Req Gap 3) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

richard-devbot · 2026-04-13T05:02:59Z

Response to Qodo Review — PR #32

All 5 qodo findings resolved. TDD approach: tests written first (all failing), then implementations to make them pass. Full suite: 531 passed, 0 failures.

Req Gap 1 — TTL not config-driven ✅ Fixed

Added SessionConfig(Base) to operator_use/config/service.py with ttl_hours: float = 24.0 and encrypt: bool = False
Added session: SessionConfig field to root Config class
Session.from_config(id, config) sources TTL from config.session.ttl_hours * 3600
DEFAULT_SESSION_TTL updated from 3600.0 (1h) → 86400.0 (24h)
Exported SessionConfig from operator_use/config/__init__.py

Req Gap 2 — Loaded sessions never expire ✅ Fixed

Added Session._from_persisted() classmethod: computes idle_seconds = (now - updated_at).total_seconds() and sets _last_activity = time.monotonic() - idle_seconds
SessionStore.load() now calls _from_persisted() instead of Session(...), so loaded sessions expire based on real idle time
SessionStore.get_or_create() now deletes expired sessions on access and returns a fresh session instead

Req Gap 3 — Tests miss cleanup/encryption ✅ Fixed

Added SessionStore.cleanup(ttl) method: scans all .jsonl files, deletes those whose updated_at is older than ttl, returns list of removed IDs
Added encryption_key param to SessionStore.__init__(): when set, save() writes Fernet-encrypted blobs and load() decrypts them — plaintext never touches disk
Test classes TestSessionCleanup (2 tests) and TestSessionEncryption (4 tests) cover both features

Bug 4 — clear() skips TTL refresh ✅ Fixed

Session.clear() now calls self.touch() after clearing messages, consistent with add_message()

Bug 5 — Timing-sensitive TTL tests ✅ Fixed

All time.sleep() tests replaced with monkeypatch.setattr(views_module.time, 'monotonic', ...)
Tests use a deterministic fake clock advanced manually — no sleeps, no CI flakiness
Session.__post_init__ sets _last_activity = time.monotonic() so monkeypatching before Session() construction gives consistent t=0 baseline

Commits on this branch:

test: expand session TTL tests — monkeypatch clock, cleanup, encryption [#24]
fix: make session TTL config-driven with 24h default [#24]
fix: add SessionConfig to Config with ttl_hours=24.0 default [#24]
fix: base _last_activity on updated_at for loaded sessions; add cleanup and encryption [#24]

All changes pushed to fork/richardson/phase1-session-ttl.

cryptography.fernet is used by SessionStore for at-rest encryption but was never declared as a project dependency, causing ImportError at runtime. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

The encrypt field was never wired to SessionStore — setting it in config silently did nothing. Encryption is opt-in via the encryption_key constructor arg on SessionStore, not a config toggle. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

CursorTouch#24] Before this fix, loading a Fernet-encrypted file without a key would fall through to the JSONL parser and raise an opaque JSONDecodeError. Now detects the Fernet token prefix (gAAAAA) early and raises a descriptive ValueError. Also tightens the test assertion from pytest.raises(Exception) to pytest.raises(ValueError). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

…ouch#24] Catching bare Exception masked any unexpected error during decryption. Now only catches cryptography.fernet.InvalidToken (wrong key or corrupt data), letting genuine unexpected errors propagate normally. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

…ch#24] cleanup() was looking up the filesystem stem (colon replaced with underscore) in self._sessions, which is keyed by the original session ID. Sessions with ':' in their IDs were never evicted from memory even after their files were deleted. Now reverse-maps stems to original IDs before evicting. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

- E702: split semicolon-separated statements onto individual lines in macos desktop service - F401: remove unused `Any` import from zai/llm.py - F401: remove unused `os` and `time` imports from tests/test_session_ttl.py - Include uv.lock update for cryptography dependency (from prior branch commit)

qodo-code-review bot reviewed Apr 5, 2026

View reviewed changes

Richardson Gunde and others added 8 commits April 13, 2026 10:24

ci: fix ruff lint errors and upgrade aiohttp to 3.13.5

c5631b6

fix: pass graceful_fn to _do_restart on restart [from security-harden…

2040df5

…ing]

richard-devbot force-pushed the richardson/phase1-session-ttl branch from 177d1bc to 159f2a1 Compare April 13, 2026 05:02

Richardson Gunde and others added 6 commits April 13, 2026 10:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Phase 1.4.2: Session TTL and auto-expiry#32

Phase 1.4.2: Session TTL and auto-expiry#32
richard-devbot wants to merge 14 commits intoCursorTouch:mainfrom
richard-devbot:richardson/phase1-session-ttl

richard-devbot commented Apr 5, 2026

Uh oh!

qodo-code-review bot commented Apr 5, 2026

Uh oh!

qodo-code-review bot commented Apr 5, 2026 •

edited

Loading

Uh oh!

richard-devbot commented Apr 5, 2026

Uh oh!

qodo-code-review bot Apr 5, 2026

Uh oh!

qodo-code-review bot Apr 5, 2026

Uh oh!

qodo-code-review bot Apr 5, 2026

Uh oh!

richard-devbot commented Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

richard-devbot commented Apr 5, 2026

Summary

Test Plan

Uh oh!

qodo-code-review bot commented Apr 5, 2026

Review Summary by Qodo

Walkthroughs

File Changes

Uh oh!

qodo-code-review bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

richard-devbot commented Apr 5, 2026

Ready for review & merge ✅

Uh oh!

qodo-code-review bot Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

qodo-code-review bot Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

qodo-code-review bot Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

richard-devbot commented Apr 13, 2026

Response to Qodo Review — PR #32

Req Gap 1 — TTL not config-driven ✅ Fixed

Req Gap 2 — Loaded sessions never expire ✅ Fixed

Req Gap 3 — Tests miss cleanup/encryption ✅ Fixed

Bug 4 — clear() skips TTL refresh ✅ Fixed

Bug 5 — Timing-sensitive TTL tests ✅ Fixed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qodo-code-review bot commented Apr 5, 2026 •

edited

Loading