feat: cleanup sandbox spaces on session end and increase cookie TTL

Delete sandbox HF Spaces when sessions end or get deleted.
Increase auth cookie TTL from 24h to 7 days.
Add token map entries for new models.

agent/core/session.py

@@ -19,12 +19,14 @@ logger = logging.getLogger(__name__)
 # on network calls for certain providers (known litellm issue).
 _MAX_TOKENS_MAP: dict[str, int] = {
     # Anthropic
+    "anthropic/claude-opus-4-6": 200_000,
     "anthropic/claude-opus-4-5-20251101": 200_000,
     "anthropic/claude-sonnet-4-5-20250929": 200_000,
     "anthropic/claude-sonnet-4-20250514": 200_000,
     "anthropic/claude-haiku-3-5-20241022": 200_000,
     "anthropic/claude-3-5-sonnet-20241022": 200_000,
     "anthropic/claude-3-opus-20240229": 200_000,
+    "huggingface/fireworks-ai/MiniMaxAI/MiniMax-M2.5": 200_000,
     "huggingface/novita/minimax/minimax-m2.1": 196_608,
     "huggingface/novita/moonshotai/kimi-k2.5": 262_144,
     "huggingface/novita/zai-org/glm-5": 200_000,

backend/routes/auth.py

@@ -142,7 +142,7 @@ async def oauth_callback(
         httponly=True,
         secure=is_production,  # Secure flag only in production (HTTPS)
         samesite="lax",
-        max_age=3600 * 24,  # 24 hours
+        max_age=3600 * 24 * 7,  # 7 days
         path="/",
     )
     return response

backend/session_manager.py

@@ -164,6 +164,17 @@ class SessionManager:
         logger.info(f"Created session {session_id} for user {user_id}")
         return session_id
 
+    @staticmethod
+    async def _cleanup_sandbox(session: Session) -> None:
+        """Delete the sandbox Space if one was created for this session."""
+        sandbox = getattr(session, "sandbox", None)
+        if sandbox and getattr(sandbox, "_owns_space", False):
+            try:
+                logger.info(f"Deleting sandbox {sandbox.space_id}...")
+                await asyncio.to_thread(sandbox.delete)
+            except Exception as e:
+                logger.warning(f"Failed to delete sandbox {sandbox.space_id}: {e}")
+
     async def _run_session(
         self,
         session_id: str,
@@ -218,6 +229,8 @@ class SessionManager:
             except asyncio.CancelledError:
                 pass
 
+            await self._cleanup_sandbox(session)
+
             async with self._lock:
                 if session_id in self.sessions:
                     self.sessions[session_id].is_active = False
@@ -307,6 +320,9 @@ class SessionManager:
         if not agent_session:
             return False
 
+        # Clean up sandbox Space before cancelling the task
+        await self._cleanup_sandbox(agent_session.session)
+
         # Cancel the task if running
         if agent_session.task and not agent_session.task.done():
             agent_session.task.cancel()