[xxwtiancai]

Link to Issue or Description of Change

No existing issue found; bug report included below as permitted by CONTRIBUTING.md.

Problem: InMemorySessionService.create_session(state=...) stores nested
values from the input by reference, even with the default deep-copy setting.
Changing or reusing that input after creation silently changes the saved session
and the state its next Runner invocation reads, without an event or state delta.
This affects session, user:, and app: initial state, including the synchronous
creation entry point.

Reproduction / environment: On main at facd7dd (ADK 2.12.0), macOS arm64,
Python 3.11.14; no model, credentials, or network needed:

import asyncio
from google.adk.sessions import InMemorySessionService

async def main():
    service = InMemorySessionService()
    initial = {"cart": {"items": ["coffee"]}}
    session = await service.create_session(
        app_name="app", user_id="u", state=initial
    )
    initial["cart"]["items"].append("tea")
    saved = await service.get_session(
        app_name="app", user_id="u", session_id=session.id
    )
    print(saved.state["cart"])

asyncio.run(main())

Expected: {'items': ['coffee']}. Before this fix: {'items': ['coffee', 'tea']}.
Reproduces every run.

Solution: Copy each extracted state scope using the existing _copy_state
helper before storage. The opt-in IN_MEMORY_SESSION_SERVICE_LIGHT_COPY mode
keeps its shallow-copy behavior. Temporary state is excluded before copying; the regression includes a discarded
temp: value that cannot be deep-copied.
This concerns initial input ownership; #7105 already fixed the separate path
that copies scoped state into returned sessions. No public API changes.

Testing Plan

Unit tests and checks:

• New regression on unmodified main: 2 failed, 2 passed. Both default-mode
  entry points fail; the light-copy controls pass.

• Full sessions suite after the fix: 657 passed.

• Changed-file pre-commit hooks passed; source mypy passed.

• Independent Astra xhigh review: no actionable findings; 12 focused tests
  passed, plus public-interface probes for scoped propagation and temporary
  values that cannot be deep-copied.

• Required full tox matrix completed on macOS arm64. It is not fully green:

  Python	Passed	Failed	Skipped	Xfailed	Xpassed
  3.11	20,812	27	95	18	2
  3.12	20,803	27	96	18	2
  3.13	20,803	27	96	18	2
  3.14	20,817	14	95	18	2

  Re-ran every failing node on pristine base facd7dd and the patch with
  the corresponding tox interpreter, installed dependencies and host permissions.
  Both checkouts reproduced exactly the same failing nodes and counts for each
  version. The failures are:

  • 13 HTTP/proxy tests: host system proxy settings affect mocked request routing;
    all 13 pass for both checkouts when run in the local sandbox, which does not
    expose those system proxy settings.
  • 13 Git script tests on 3.11–3.13: the system Git launcher exits 69 because of
    the local Xcode setup. Selecting the already installed Command Line Tools
    Git makes the full 66-test script module pass. The 3.14 run used that Git.
  • test_reading_directory_raises: the fake sandbox runs the host's base64,
    which returns success for directory input on this macOS installation.

  The full matrix ran against the final production change. Afterwards the new
  regression's discarded temp: value was strengthened to a non-copyable lock;
  all four regression cases passed again on each Python version, and the
  full sessions suite passed again (657 tests). The strengthened test still
  produces exactly 2 failures / 2 passes against the original source.
  No unrelated source or test behavior was changed to hide these failures.

Manual E2E: Ran a public Runner with a FunctionNode that returns cart,
user:profile, and app:config from context. After creating the session, changed
the retained input dictionary before invoking the Runner. No LLM was involved.

Before: cart=['coffee', 'tea'], user:profile.name='Bob',   app:config.theme='dark'
After:  cart=['coffee'],        user:profile.name='Alice', app:config.theme='light'

uv build produced the sdist and wheel. Installed the wheel into a clean
Python 3.11 environment and ran the same reproduction with python -I; it
returned the original state.

Runner setup and executable reproduction

Save as repro.py; run python repro.py in the checkout environment, or
python -I repro.py with the installed wheel.

"""Keyless Runner reproduction: retained initial state must not change a run."""

import asyncio
import json

from google.adk.runners import Runner
from google.adk.sessions import InMemorySessionService
from google.adk.workflow import FunctionNode
from google.genai import types


def read_state(ctx, node_input):
    del node_input
    return {key: ctx.state[key] for key in ("cart", "user:profile", "app:config")}


async def main():
    initial = {
        "cart": {"items": ["coffee"]},
        "user:profile": {"name": "Alice"},
        "app:config": {"theme": "light"},
    }
    service = InMemorySessionService()
    session = await service.create_session(
        app_name="isolation_repro", user_id="u1", state=initial
    )
    initial["cart"]["items"].append("tea")
    initial["user:profile"]["name"] = "Bob"
    initial["app:config"]["theme"] = "dark"

    async with Runner(
        app_name="isolation_repro",
        node=FunctionNode(func=read_state, name="read_state"),
        session_service=service,
    ) as runner:
        async for event in runner.run_async(
            user_id="u1",
            session_id=session.id,
            new_message=types.UserContent("read the saved initial state"),
        ):
            if event.output is not None:
                print(json.dumps(event.output, sort_keys=True))


asyncio.run(main())

AI assistance disclosure

OpenAI Codex assisted with investigation, implementation, tests, and this
description. A separate Astra xhigh agent reviewed the final diff.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[BichengWang]

Reviewed 110262ad33f2c82b6eaa47faca9d6931e0566782. No blocking findings in the initial-state snapshot change.

The copy happens after scope extraction and before any stored scope is updated, so discarded temp: values are not deep-copied. Both creation entry points use this path, and the existing helper preserves the opt-in light-copy behavior.

Validation on Python 3.13.16, offline:

• pytest tests/unittests/sessions/test_session_service.py -q: 436 passed.
• Replaced only _create_session_impl with current upstream's implementation in an isolated test process: the two default-copy regression cases failed; both light-copy controls passed.
• Ran a real Runner with a FunctionNode reading session, user, and app state after mutating the retained initial input: all three scopes kept their original values.

Checked the existing discussion and reviews before testing. The full repository suite and multi-version tox were not run for this review.