fix: treat exact-expiry and unparsable timestamps as invalid snapshots

Use <= instead of < so snapshots expiring exactly now are treated as
expired. Add NaN check so unparsable expires_at values don't slip
through as valid.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sweetmantech

lib/sandbox/__tests__/getValidSnapshotId.test.ts

@@ -53,6 +53,27 @@ describe("getValidSnapshotId", () => {
     expect(result).toBeUndefined();
   });
 
+  it("returns undefined when expires_at equals now", async () => {
+    const now = new Date().toISOString();
+    mockSelectAccountSnapshots.mockResolvedValue([
+      { snapshot_id: "snap_edge", account_id: "acc_1", expires_at: now },
+    ]);
+
+    const result = await getValidSnapshotId("acc_1");
+
+    expect(result).toBeUndefined();
+  });
+
+  it("returns undefined when expires_at is unparsable", async () => {
+    mockSelectAccountSnapshots.mockResolvedValue([
+      { snapshot_id: "snap_bad", account_id: "acc_1", expires_at: "not-a-date" },
+    ]);
+
+    const result = await getValidSnapshotId("acc_1");
+
+    expect(result).toBeUndefined();
+  });
+
   it("returns undefined when snapshot has no snapshot_id", async () => {
     mockSelectAccountSnapshots.mockResolvedValue([
       { snapshot_id: null, account_id: "acc_1", expires_at: null },

lib/sandbox/getValidSnapshotId.ts

@@ -11,8 +11,11 @@ export async function getValidSnapshotId(accountId: string): Promise<string | un
   const snapshot = accountSnapshots[0];
   if (!snapshot?.snapshot_id) return undefined;
 
-  if (snapshot.expires_at && new Date(snapshot.expires_at) < new Date()) {
-    return undefined;
+  if (snapshot.expires_at) {
+    const expiresAt = new Date(snapshot.expires_at).getTime();
+    if (Number.isNaN(expiresAt) || expiresAt <= Date.now()) {
+      return undefined;
+    }
   }
 
   return snapshot.snapshot_id;