Skip to content

fix(sessions): deduplicate events in InMemorySessionService.append_event#5815

Open
devteamaegis wants to merge 2 commits into
google:mainfrom
devteamaegis:fix/in-memory-session-duplicate-event-dedup
Open

fix(sessions): deduplicate events in InMemorySessionService.append_event#5815
devteamaegis wants to merge 2 commits into
google:mainfrom
devteamaegis:fix/in-memory-session-duplicate-event-dedup

Conversation

@devteamaegis
Copy link
Copy Markdown

Problem

When an orchestrator broadcasts a shared-state delta to several concurrent session references, append_event can be called more than once with the same event object (same event.id). The current implementation has no guard against this, so:

  1. The event is appended to storage_session.events multiple times.
  2. state_delta is applied multiple times, corrupting session/user/app state.

This is reproducible by holding two references to the same session (e.g. session_a = get_session(...) then session_b = get_session(...)) and calling await service.append_event(session_a, event) followed by await service.append_event(session_b, event).

Closes #5723.

Fix

Fetch storage_session before calling super().append_event() and short-circuit early if the event ID is already present:

storage_session = self.sessions[app_name][user_id].get(session_id)
if any(e.id == event.id for e in storage_session.events):
    return event

This is a pure in-memory lookup (O(n) over events, negligible for typical session sizes) and has no effect on the happy path.

Tests

Two regression tests added to tests/unittests/sessions/test_session_service.py:

  • test_append_event_is_idempotent_for_same_event_id — appends the same event twice via two different session references; asserts exactly one event is stored and state_delta is applied only once.
  • test_append_different_events_not_deduplicated — appends two events with distinct IDs; asserts both are stored (confirms the guard doesn't over-suppress).

@adk-bot adk-bot added the services [Component] This issue is related to runtime services, e.g. sessions, memory, artifacts, etc label May 22, 2026
@adk-bot
Copy link
Copy Markdown
Collaborator

adk-bot commented May 22, 2026

Response from ADK Triaging Agent

Hello @devteamaegis, thank you for creating this PR!

This PR looks great and has been labeled with services as it addresses the session service.

To help speed up the review process, could you please update your PR description to include:

  • A summary of the passed pytest results showing that your new regression tests (and the rest of the suite) run and pass successfully.
  • Any relevant logs or output demonstrating the fix/tests.

For more details on these requirements, you can check our contribution guidelines.

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

services [Component] This issue is related to runtime services, e.g. sessions, memory, artifacts, etc

Projects

None yet

Development

Successfully merging this pull request may close these issues.

InMemorySessionService allows duplicate events to be appended during concurrent state broadcasts

2 participants