Phase 1.4.2: Session TTL and auto-expiry#32

Open

richard-devbot wants to merge 14 commits intoCursorTouch:mainfrom

richard-devbot:richardson/phase1-session-ttl

Commits on Apr 13, 2026

security: add session TTL and auto-expiry [#24]

Richardson Gunde
authored and
Richardson Gunde
committed
ci: fix ruff lint errors and upgrade aiohttp to 3.13.5

Richardson Gunde
authored and
Richardson Gunde
committed
test: update plugin tests to match refactored hook architecture

Richardson Gunde
authored and
Richardson Gunde
committed
fix: pass graceful_fn to _do_restart on restart [from security-hardening]

Richardson Gunde
authored and
Richardson Gunde
committed
test: expand session TTL tests — monkeypatch clock, cleanup, encryption [#24]

authored and
Richardson Gunde
committed
fix: make session TTL config-driven with 24h default [#24]

authored and
Richardson Gunde
committed
fix: add SessionConfig to Config with ttl_hours=24.0 default [#24]

authored and
Richardson Gunde
committed
fix: base _last_activity on updated_at for loaded sessions; add cleanup and encryption [#24]

authored and
Richardson Gunde
committed
fix: add cryptography dependency for session encryption [#24]

authored and
Richardson Gunde
committed
fix: remove dead SessionConfig.encrypt field [#24]

authored and
Richardson Gunde
committed
fix: raise clear ValueError when loading encrypted session without key [#24]

authored and
Richardson Gunde
committed
fix: narrow except clause to InvalidToken in _load_encrypted [#24]

authored and
Richardson Gunde
committed
fix: cleanup() evicts correct session ID from memory cache [#24]

authored and
Richardson Gunde
committed
fix: resolve ruff lint errors [ci]

Richardson Gunde
authored and
Richardson Gunde
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Phase 1.4.2: Session TTL and auto-expiry#32

Phase 1.4.2: Session TTL and auto-expiry#32
richard-devbot wants to merge 14 commits intoCursorTouch:mainfrom
richard-devbot:richardson/phase1-session-ttl

Commits on Apr 13, 2026

security: add session TTL and auto-expiry [#24]

ci: fix ruff lint errors and upgrade aiohttp to 3.13.5

test: update plugin tests to match refactored hook architecture

fix: pass graceful_fn to _do_restart on restart [from security-hardening]

test: expand session TTL tests — monkeypatch clock, cleanup, encryption [#24]

fix: make session TTL config-driven with 24h default [#24]

fix: add SessionConfig to Config with ttl_hours=24.0 default [#24]

fix: base _last_activity on updated_at for loaded sessions; add cleanup and encryption [#24]

fix: add cryptography dependency for session encryption [#24]

fix: remove dead SessionConfig.encrypt field [#24]

fix: raise clear ValueError when loading encrypted session without key [#24]

fix: narrow except clause to InvalidToken in _load_encrypted [#24]

fix: cleanup() evicts correct session ID from memory cache [#24]

fix: resolve ruff lint errors [ci]