[ShotaroKataoka]

What changed

Agent and remote MCP sessions in Cloud mode are now bound to the user who owns them.

• Owner-prefixed session ids. New Cloud session ids start with an owner prefix derived from the signed-in user: the first 16 hex characters of SHA-256 over the token's sub. The derivation is defined once in shared/session_owner.py and mirrored in web-ui/src/lib/sessionId.ts.
• Agent entry (agent/session_guard.py, called from basic_agent.agent_stream before the cancel registry): an owner-prefixed id is admitted only for its owner. Each runtime process serves the first user it admits. Refusals are returned as error events with the codes auth, bad_input (header and payload ids differ), session_reload_required, or service_unavailable, without further detail.
• Earlier-format ids. A session id in the earlier format is judged by its recorded owner: it is admitted when AgentCore Memory holds this user's events for it. This is one ListEvents call with maxResults=1, and positive results are cached per process.
• Agent → MCP. Mcp-Session-Id always carries the owner prefix. Earlier ids get it prepended, and composer groups (<id>-gN) keep it.
• Remote MCP server (_CaptureHeadersMiddleware): an owner-prefixed Mcp-Session-Id or runtime session header that belongs to a different user gets a 403, and each process serves one user. Requests without authorization (health checks) pass through unchanged. The session check runs before the cancel registry and the write fence.
• Web UI. New chats, and decks without a linked chat, get owner-prefixed ids. A new error code session_reload_required has en/ja messages. @aws-crypto/sha256-js is now a direct dependency; it was already in the lockfile at 5.2.0 through aws-amplify.
• agent/Dockerfile copies shared/session_owner.py. CHANGELOG.md and docs/en/security.md describe the binding.

Compatibility

Existing decks keep their chat. A chat id from before this change is kept while it has history and is admitted when AgentCore Memory holds that user's history for it; a deck without history continues under the user's own owner-prefixed id. A chat tab opened before the update may be asked to reload the page once (session_reload_required).

Deploy order: Web UI first, then SdpmRuntime, then SdpmAgent.

Local mode

Unchanged. Local mode has no auth and keeps its current session ids.

Checks run

On the main change (face6403, including the package.json change from d28354f7):

• make lint: pass (ruff)
• make test: pass (2146 passed, 18 skipped)
• uv run pytest tests/test_remote_session_gate.py tests/test_remote_warmup_preload.py -q: pass (23 passed)
• i18n en/ja key parity: OK
• cd web-ui && npx eslint src/ --quiet, npx tsc --noEmit, npm test (75 files, 639 tests), npm run build:cloud: pass
• ash scan --mode local --fail-on-findings: exit 0

On the lockfile (d28354f7):

• npx -y npm@10.8.2 install --package-lock-only and npx -y npm@10.8.2 ci --dry-run: pass

After merging current main (#505 write fence, df51fab3):

• make lint: pass
• make test: 2177 passed, 18 skipped
• uv run pytest tests/test_remote_session_gate.py tests/test_remote_write_fence.py -q: 31 passed
• ash scan --mode local --fail-on-findings: exit 0 (bandit, checkov, detect-secrets, npm-audit, semgrep passed; cdk-nag, cfn-nag, grype, opengrep, syft not available locally)
• web-ui: no changes from main in the merge, checks not re-run