fix(code_interpreter): partition session cache by caller key instead of AWS identity

[yonib05]

Description

AgentCoreCodeInterpreter keeps a module-level _session_mapping cache so that a new instance in a long-running process can reconnect to an existing AWS code interpreter session instead of recreating it. The cache was keyed only on the user-facing session_name, which is process-global, so two instances using the same session_name would reconnect to the same cached session regardless of who the caller was.

This change partitions the cache by an explicit, caller-supplied partition_key. The cache is keyed on (partition_key, session_name), and partition_key is bound at construction from operator-controlled input and is never read from a tool action, so a model-supplied session_name cannot reach across partitions.

A service typically runs under a single IAM identity while serving many callers, so an AWS-credential-derived key would collapse those callers together. Keying on a caller-supplied partition instead lets one identity host many isolated sessions:

• partition_key defaults to a shared "default" partition, preserving the prior single-caller reconnect behavior.
• Multi-tenant callers pass a distinct partition_key per principal — the authenticated principal/tenant id, or the agent session id (e.g. context.session_id) when one identity runs several isolated sessions.

The in-process cache is a reconnect convenience, not the isolation boundary. The real boundary is AWS-side: a session is reachable only by holding its server-issued, unguessable sessionId, and every operation is authorized against the interpreter's IAM execution role. Within a single process, partition_key is what keeps callers apart.

The public tool contract is unchanged: the session_name action field and existing constructor arguments behave as before; partition_key is a new optional argument.

Changes

• Add an optional partition_key constructor argument and key _session_mapping on (partition_key, session_name) via the _scoped_key helper.
• Bind partition_key at construction (default "default"); it is never taken from a tool action.
• Remove the AWS-credential / STS GetCallerIdentity derived key (and its eager call at init); the cache key no longer depends on AWS credentials, so credential rotation cannot cause a reconnect miss.
• Reframe the docstring and module comment to state the real boundary (server-issued sessionId + IAM execution role) and describe the cache as a per-process reconnect convenience partitioned by partition_key.

Testing

• pytest tests/code_interpreter/ passes (59 tests).
• ruff format / ruff check clean.
• Regression tests:
  • default partition_key is the shared "default" partition,
  • different partitions produce distinct cache keys for the same session_name,
  • a session cached in one partition is not reachable from another partition via the same session_name (the multi-tenant case),
  • two instances sharing a partition_key reconnect to the same cached AWS session,
  • the cache key is independent of the boto session / credentials.

[jsamuel1]

This only works as an isolation key between AWS credentials. Services often run with service credentials and need isolation by the callers Session identifier. How can this be made generic, such that other partition keys can be used?

[jsamuel1]

Consider the way session_id is used in the SessionManager functionality.

[yonib05]

Reworked. The cache is now keyed on (partition_key, session_name), where partition_key is an explicit constructor arg bound from operator input and never read from a tool action — so a model-supplied session_name can't cross partitions.

Dropped the STS/credential-derived key: one IAM identity serves many callers, so keying on credentials collapsed them. Operators now pass the caller's session id as partition_key per request (like SessionManager gets session_id); defaults to "default" for single-caller back-compat.

Re: the warning — the map was never the boundary. Sessions are reachable only via the server-issued unguessable sessionId, authorized against the IAM execution role; partition_key just separates callers in-process. Docstring updated.