What would you like to be added:
Clarify and align session expiration behavior across the Router, Workload Manager API, CRDs, and Python SDK.
A client may continue using x-agentcube-session-id after the corresponding sandbox has been reclaimed. The Router then returns HTTP 404, but the response does not provide a stable machine-readable error code. The Python SDK also propagates it as a generic HTTP exception without invalidating the stale session ID.
As a result, clients may repeatedly send an expired session ID and remain in a permanent 404 loop.
Session lifetime configuration is also inconsistent:
sessionTimeout controls idle expiration.maxSessionDuration controls the hard lifetime limit.- The Python SDK exposes
ttl, but the current create-session API does not apply it.
- SDK
timeout controls HTTP request timeout and is unrelated to session lifetime.
The expected behavior should be:
- Return a stable error such as
SESSION_NOT_FOUND when the Router cannot resolve a supplied session ID.
- Keep this distinguishable from a 404 returned by the application inside the sandbox.
- Let the Python SDK expose a specific session-not-found error and stop treating the stale session ID as valid.
- Define whether request-level
ttl is supported. If supported, enforce it under the CRD maximum lifetime policy; otherwise remove or reject it explicitly instead of silently ignoring it.
- Document that clients must discard an expired session ID and explicitly create a new session if their application wants to continue.
Why is this needed:
Session reuse is part of the public AgentCube API, but expiration behavior is not currently defined well enough for official or third-party SDKs.
A consistent error and lifetime contract prevents clients from repeatedly using stale session IDs and makes session behavior predictable.
What would you like to be added:
Clarify and align session expiration behavior across the Router, Workload Manager API, CRDs, and Python SDK.
A client may continue using
x-agentcube-session-idafter the corresponding sandbox has been reclaimed. The Router then returns HTTP 404, but the response does not provide a stable machine-readable error code. The Python SDK also propagates it as a generic HTTP exception without invalidating the stale session ID.As a result, clients may repeatedly send an expired session ID and remain in a permanent 404 loop.
Session lifetime configuration is also inconsistent:
sessionTimeoutcontrols idle expiration.maxSessionDurationcontrols the hard lifetime limit.ttl, but the current create-session API does not apply it.timeoutcontrols HTTP request timeout and is unrelated to session lifetime.The expected behavior should be:
SESSION_NOT_FOUNDwhen the Router cannot resolve a supplied session ID.ttlis supported. If supported, enforce it under the CRD maximum lifetime policy; otherwise remove or reject it explicitly instead of silently ignoring it.Why is this needed:
Session reuse is part of the public AgentCube API, but expiration behavior is not currently defined well enough for official or third-party SDKs.
A consistent error and lifetime contract prevents clients from repeatedly using stale session IDs and makes session behavior predictable.