perf: scope remote sandbox database sessions

[aivong-openhands]

HUMAN:

• A human has tested these changes.

AGENT:

This draft PR was created by an AI agent (OpenHands) on behalf of the user.

---

Why

RemoteSandboxService kept a request-scoped database session open while awaiting runtime-api requests. In admin context, its shared select builder could also produce an unfiltered and unlimited query against v1_remote_sandbox.

Summary

• Replace the request-lifetime sandbox database session with short async_sessionmaker.begin() transactions around each read or write phase.
• Require every admin-context sandbox select to have a filter or limit, and bound search, ID, and session-key lookups.
• Release the deferred conversation finalizer's count transaction before remote sandbox deletion, with regression coverage for session lifetime and transaction ordering.

Issue Number

Closes #30

How to Test

poetry run pytest tests/unit/app_server/test_remote_sandbox_service.py tests/unit/app_server/test_app_conversation_router.py tests/unit/app_server/test_sandbox_service.py tests/unit/app_server/test_sandbox_secrets_router.py tests/unit/app_server/test_webhook_router_auth.py -q
poetry run pre-commit run --config ./dev_config/python/.pre-commit-config.yaml --show-diff-on-failure

Video/Screenshots

Not applicable; this is a backend database/session lifecycle change.

Type

• Bug fix
• Feature
• Refactor
• Breaking change
• Docs / chore

Notes

No schema or configuration changes are required.

@aivong-openhands can click here to continue refining the PR

---

Enterprise server image for this PR:

ghcr.io/openhands/enterprise-server:sha-0ccb567

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
openhands/app_server/app_conversation
app_conversation_router.py					983-989
openhands/app_server/sandbox
remote_sandbox_service.py					234, 237-247, 250-253, 258-265, 268-275, 278, 346-349, 358-367, 408-419, 447-457, 463-474, 502-505, 518-536, 605-613, 630-648, 673-682, 690-705, 880-887, 1184, 1205-1211
Project Total

This report was generated by python-coverage-comment-action