fix(api): POST /sandboxes/{id}/connect accepts non-positive timeout values causing immediate termination

Start in packages/api/internal/handlers/sandbox_connect.go and compare its timeout validation with sandbox_create.go, sandbox_resume.go, and sandbox_fork.go. Then run or extend packages/api/internal/handlers/sandbox_timeout_validation_test.go for zero and negative values. Done means POST /sandboxes/{id}/connect returns 400 with "Timeout must be greater than 0" before connection work begins.

Problem

In POST /sandboxes/{id}/connect (packages/api/internal/handlers/sandbox_connect.go), the request payload requires a timeout integer field (ConnectSandbox.timeout).

Unlike all other sandbox lifecycle endpoints—POST /sandboxes (sandbox_create.go:L156), POST /sandboxes/{id}/resume (sandbox_resume.go:L63), and POST /sandboxes/{id}/fork (sandbox_fork.go:L70)—which explicitly reject non-positive timeouts with 400 Bad Request ("Timeout must be greater than 0"), sandbox_connect.go only verifies the upper bound:

timeout := time.Duration(body.Timeout) * time.Second
if timeout > time.Duration(teamInfo.Limits.MaxLengthHours)*time.Hour {
    a.sendAPIStoreError(c, http.StatusBadRequest, fmt.Sprintf("Timeout cannot be greater than %d hours", teamInfo.Limits.MaxLengthHours))
    return
}

If a client sends {"timeout": 0} or a negative value like {"timeout": -60}, this check passes without error. timeout is then calculated as 0s or a negative duration. When startSandbox is subsequently invoked, it sets endTime = startTime.Add(timeout) in the past or immediately at now. When the orchestrator processes the sandbox lifecycle, it sees that the sandbox has already expired and immediately reaps it upon connection, resulting in sudden disconnections for clients without an informative error message.

Root Cause

sandbox_connect.go omitted the lower-bound validation check if body.Timeout <= 0:

Reproduction Steps

1. Send POST /sandboxes/{id}/connect with body {"timeout": 0} or {"timeout": -1}.
2. Observed: Request passes validation and attempts connection with zero/negative duration.
3. Expected: Handler returns 400 Bad Request with payload {"code": 400, "message": "Timeout must be greater than 0"} immediately before any database or orchestrator operations.

Technical Context

• File affected: packages/api/internal/handlers/sandbox_connect.go
• Subsystem: Control Plane API / Sandboxes / Input Validation
• Impact: Medium (Consistency across API endpoints and prevention of premature sandbox termination)

Proposed Changes