fix(session): restore sandbox-fs after agent-run quiesce

Agent runs quiesced stdio MCP extensions including sandbox-fs, but reconcile
skipped re-adding missing stdio extensions and treated absent listings as OK.
Preserve sandbox-fs across quiesce and re-add other required stdio extensions
on the next reconcile so generate_image and write_file stay available.

Co-authored-by: Cursor <cursoragent@cursor.com>

session-reconcile.test.mjs

@@ -122,22 +122,24 @@ test('extensionsNeedingRefresh adds missing extensions', () => {
   assert.equal(toAdd[0].name, 'summon');
 });
 
-test('extensionsNeedingRefresh does not hot-add missing stdio extensions', () => {
+test('extensionsNeedingRefresh re-adds missing stdio extensions after quiesce', () => {
+  const desiredSandbox = {
+    type: 'stdio',
+    name: 'sandbox-fs',
+    cmd: '/usr/local/bin/node',
+    args: ['/opt/portal/mindspace-sandbox-mcp.mjs', '/tmp/user-1'],
+    available_tools: ['read_file', 'generate_image'],
+  };
   const { toRemove, toAdd } = extensionsNeedingRefresh(
     [{ name: 'developer', available_tools: ['read_image'] }],
     [
       { name: 'developer', available_tools: ['read_image'] },
-      {
-        type: 'stdio',
-        name: 'sandbox-fs',
-        cmd: '/usr/local/bin/node',
-        args: ['/opt/portal/mindspace-sandbox-mcp.mjs', '/tmp/user-1'],
-        available_tools: ['read_file'],
-      },
+      desiredSandbox,
     ],
   );
   assert.deepEqual(toRemove, []);
-  assert.deepEqual(toAdd, []);
+  assert.equal(toAdd.length, 1);
+  assert.equal(toAdd[0].name, 'sandbox-fs');
 });
 
 test('extensionPolicyViolations reports unexpected, duplicate, and mismatched extensions', () => {
@@ -161,7 +163,7 @@ test('extensionPolicyViolations reports unexpected, duplicate, and mismatched ex
   );
 });
 
-test('extensionPolicyViolations ignores stdio extensions omitted from goosed listing', () => {
+test('extensionPolicyViolations flags stdio extensions missing from goosed listing', () => {
   assert.deepEqual(
     extensionPolicyViolations(
       [{ name: 'developer', available_tools: ['read_image'] }],
@@ -186,7 +188,7 @@ test('extensionPolicyViolations ignores stdio extensions omitted from goosed lis
     {
       unexpected: [],
       duplicate: [],
-      missingOrMismatched: [],
+      missingOrMismatched: ['sandbox-fs', 'tkmind-search'],
     },
   );
 });
@@ -334,6 +336,72 @@ test('reconcileAgentSession restarts after adding missing extensions', async ()
   ]);
 });
 
+test('reconcileAgentSession restarts after re-adding quiesced stdio extensions', async () => {
+  const calls = [];
+  let extensionReads = 0;
+  const desiredSandbox = {
+    type: 'stdio',
+    name: 'sandbox-fs',
+    cmd: '/usr/local/bin/node',
+    args: ['/opt/portal/mindspace-sandbox-mcp.mjs', '/tmp/user-1'],
+    available_tools: ['write_file', 'generate_image'],
+  };
+  const apiFetch = async (pathname) => {
+    calls.push(pathname);
+    if (pathname === '/sessions/session-1') {
+      return {
+        ok: true,
+        text: async () => JSON.stringify({ working_dir: '/valid/workspace' }),
+      };
+    }
+    if (pathname === '/sessions/session-1/extensions') {
+      extensionReads += 1;
+      return {
+        ok: true,
+        text: async () =>
+          JSON.stringify({
+            extensions:
+              extensionReads === 1
+                ? [{ name: 'developer', available_tools: ['read_image'] }]
+                : [desiredSandbox, { name: 'developer', available_tools: ['read_image'] }],
+          }),
+      };
+    }
+    if (
+      pathname === '/agent/add_extension'
+      || pathname === '/agent/restart'
+    ) {
+      return {
+        ok: true,
+        text: async () => JSON.stringify({ ok: true }),
+      };
+    }
+    const harness = harnessMemoryResponse(pathname);
+    if (harness) return harness;
+    throw new Error(`unexpected path: ${pathname}`);
+  };
+
+  await reconcileAgentSession(apiFetch, 'session-1', {
+    workingDir: '/valid/workspace',
+    sessionPolicy: {
+      extensionOverrides: [
+        { name: 'developer', available_tools: ['read_image'] },
+        desiredSandbox,
+      ],
+    },
+  });
+
+  assert.deepEqual(calls, [
+    '/sessions/session-1',
+    '/sessions/session-1/extensions',
+    '/agent/add_extension',
+    '/agent/restart',
+    '/sessions/session-1/extensions',
+    '/agent/harness_remember',
+    '/agent/harness_bootstrap',
+  ]);
+});
+
 test('reconcileAgentSession fails closed when restart does not apply the requested policy', async () => {
   const apiFetch = async (pathname) => {
     if (pathname === '/sessions/session-1') {