refactor(sandbox): extract noSandboxResponse to its own file (SRP)

Per review feedback on PR #525 — pulls the inline `noSandboxResponse`
helper out of `getSandboxReconnectHandler.ts` into its own file so it
can be reused by future endpoints (e.g., `/snapshot` resume) and so
the handler file stops carrying response-shape construction logic.

The narrowed `ReconnectBody` type in the handler now only covers the
two outcomes the handler actually constructs locally (`connected` /
`expired`); the `no_sandbox` shape lives with its builder.

TDD red -> green: 3 unit tests for the extracted helper covering 200
status, hasSnapshot derivation, and lifecycle envelope projection.
Suite: 2526 -> 2529.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sweetmantech

lib/sandbox/__tests__/noSandboxResponse.test.ts

@@ -0,0 +1,53 @@
+import { describe, it, expect, vi } from "vitest";
+import { NextResponse } from "next/server";
+import { noSandboxResponse } from "@/lib/sandbox/noSandboxResponse";
+
+vi.mock("@/lib/networking/getCorsHeaders", () => ({
+  getCorsHeaders: () => ({ "Access-Control-Allow-Origin": "*" }),
+}));
+
+const baseRow = {
+  id: "sess-1",
+  account_id: "acc-1",
+  sandbox_state: null,
+  lifecycle_state: null,
+  lifecycle_version: 0,
+  sandbox_expires_at: null,
+  hibernate_after: null,
+  last_activity_at: null,
+  snapshot_url: null,
+};
+
+describe("noSandboxResponse", () => {
+  it("returns a 200 NextResponse with status='no_sandbox'", async () => {
+    const res = noSandboxResponse(baseRow as never);
+
+    expect(res).toBeInstanceOf(NextResponse);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.status).toBe("no_sandbox");
+  });
+
+  it("derives hasSnapshot from snapshot_url presence", async () => {
+    const withSnap = await noSandboxResponse({
+      ...baseRow,
+      snapshot_url: "snap://x",
+    } as never).json();
+    const without = await noSandboxResponse(baseRow as never).json();
+
+    expect(withSnap.hasSnapshot).toBe(true);
+    expect(without.hasSnapshot).toBe(false);
+  });
+
+  it("includes the lifecycle envelope projected from the row", async () => {
+    const body = await noSandboxResponse(baseRow as never).json();
+
+    expect(body.lifecycle).toMatchObject({
+      serverTime: expect.any(Number),
+      state: null,
+      lastActivityAt: null,
+      hibernateAfter: null,
+      sandboxExpiresAt: null,
+    });
+  });
+});

lib/sandbox/getSandboxReconnectHandler.ts

@@ -4,29 +4,20 @@ import { validateAuthContext } from "@/lib/auth/validateAuthContext";
 import { buildLifecycle } from "@/lib/sandbox/buildLifecycle";
 import { connectSandbox } from "@/lib/sandbox/factory";
 import { hasRuntimeSandboxState } from "@/lib/sandbox/hasRuntimeSandboxState";
+import { noSandboxResponse } from "@/lib/sandbox/noSandboxResponse";
 import { selectSessions } from "@/lib/supabase/sessions/selectSessions";
 import { updateSession } from "@/lib/supabase/sessions/updateSession";
 import type { SandboxState } from "@/lib/sandbox/factory";
-import type { Tables } from "@/types/database.types";
 
 const PROBE_TIMEOUT_MS = 15_000;
 
 interface ReconnectBody {
-  status: "connected" | "expired" | "no_sandbox";
+  status: "connected" | "expired";
   hasSnapshot: boolean;
   expiresAt?: number;
   lifecycle: ReturnType<typeof buildLifecycle>;
 }
 
-function noSandboxResponse(row: Tables<"sessions">): NextResponse {
-  const body: ReconnectBody = {
-    status: "no_sandbox",
-    hasSnapshot: !!row.snapshot_url,
-    lifecycle: buildLifecycle(row),
-  };
-  return NextResponse.json(body, { status: 200, headers: getCorsHeaders() });
-}
-
 /**
  * Handles `GET /api/sandbox/reconnect`. Live runtime probe — actually
  * runs a quick command inside the sandbox to verify it is reachable.

lib/sandbox/noSandboxResponse.ts

@@ -0,0 +1,24 @@
+import { NextResponse } from "next/server";
+import { getCorsHeaders } from "@/lib/networking/getCorsHeaders";
+import { buildLifecycle } from "@/lib/sandbox/buildLifecycle";
+import type { Tables } from "@/types/database.types";
+
+/**
+ * Builds the `status: "no_sandbox"` response shared by sandbox lifecycle
+ * endpoints (currently `/reconnect`). Used when the session row lacks
+ * runtime metadata — there is no live sandbox to probe, so report that
+ * directly along with whether a snapshot exists for resume affordances.
+ *
+ * @param row - The `sessions` row.
+ * @returns A 200 NextResponse with `{status, hasSnapshot, lifecycle}`.
+ */
+export function noSandboxResponse(row: Tables<"sessions">): NextResponse {
+  return NextResponse.json(
+    {
+      status: "no_sandbox" as const,
+      hasSnapshot: !!row.snapshot_url,
+      lifecycle: buildLifecycle(row),
+    },
+    { status: 200, headers: getCorsHeaders() },
+  );
+}