fix: isolate session waiters by sender

[icyaaaww]

Summary

• scope the default session waiter key to both the current chat and sender
• prevent one group member from triggering another member's active multi-turn handler
• add regression coverage for member and chat isolation

Problem

DefaultSessionFilter returned only event.unified_msg_origin. For group messages, that origin identifies the group rather than the sender, so any member's next message could be routed into another member's active session waiter. This also contradicted the documented sender-scoped default behavior.

Testing

• uv run pytest tests/unit/test_session_waiter.py tests/unit/test_event_bus.py tests/unit/test_astr_message_event.py -q (97 passed)
• uv run ruff check astrbot/core/utils/session_waiter.py tests/unit/test_session_waiter.py
• uv run ruff format --check astrbot/core/utils/session_waiter.py tests/unit/test_session_waiter.py

Full-suite note: uv run pytest -q reached 2153 passed and 1 skipped; 39 existing Windows-specific/environment failures remained around symlink privileges, PowerShell quoting, and path expectations. No session waiter tests failed.

Summary by Sourcery

Scope default session waiter identifiers to the originating chat and sender to prevent cross-user session routing.

Bug Fixes:

• Isolate default session waiters by both chat and sender so group members cannot trigger one another’s active multi-turn sessions.

Tests:

• Add regression tests covering group-member isolation, same-sender continuity within a chat, and isolation across chats.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/core/utils/session_waiter.py" line_range="101" />
<code_context>
-        """默认实现，返回统一消息来源字符串作为会话标识符"""
-        return event.unified_msg_origin
+        """Return a session identifier scoped to the current sender and chat."""
+        return f"{event.unified_msg_origin}:{event.get_sender_id()}"


</code_context>
<issue_to_address>
**issue (bug_risk):** The delimiter-based key `f"{event.unified_msg_origin}:{event.get_sender_id()}"` is not injective: a colon in the chat/session origin or sender ID produces the same key as a different origin/sender pair. Those distinct waiters overwrite or trigger one another in `USER_SESSIONS`.

**Triggers:** When a platform supplies a session origin or sender ID containing `:`.

**Suggested fix:** Encode the two components without ambiguity, for example by using a tuple key or length-prefixed/escaped serialization.
</issue_to_address>

Sourcery assessment

Approval pending. 1 finding to address first.

Blocking findings: astrbot/core/utils/session_waiter.py:101

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue (bug_risk): The delimiter-based key f"{event.unified_msg_origin}:{event.get_sender_id()}" is not injective: a colon in the chat/session origin or sender ID produces the same key as a different origin/sender pair. Those distinct waiters overwrite or trigger one another in USER_SESSIONS.

Triggers: When a platform supplies a session origin or sender ID containing :.

Suggested fix: Encode the two components without ambiguity, for example by using a tuple key or length-prefixed/escaped serialization.