feat(context): verify product session scope

tests/sessions/metadataStore.test.ts

@@ -3,7 +3,10 @@ import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { SessionMetadataStore } from "../../src/sessions/metadataStore.js";
+import {
+  SessionContextMismatchError,
+  SessionMetadataStore,
+} from "../../src/sessions/metadataStore.js";
 
 describe("SessionMetadataStore", () => {
   let tempDir: string;
@@ -15,6 +18,37 @@ describe("SessionMetadataStore", () => {
     await store.initialize();
   });
 
+  it("does not return or ensure a session owned by another context", async () => {
+    await store.ensure({
+      actorKey: "actor-1",
+      projectId: "project-1",
+      projectKey: "project-key-1",
+      sessionId: "shared-id",
+      userId: "user-1",
+    });
+
+    expect(
+      await store.get(
+        {
+          actorKey: "actor-2",
+          projectId: "project-2",
+          projectKey: "project-key-2",
+          userId: "user-2",
+        },
+        "shared-id",
+      ),
+    ).toBeNull();
+    expect(
+      store.ensure({
+        actorKey: "actor-2",
+        projectId: "project-2",
+        projectKey: "project-key-2",
+        sessionId: "shared-id",
+        userId: "user-2",
+      }),
+    ).rejects.toBeInstanceOf(SessionContextMismatchError);
+  });
+
   afterEach(async () => {
     await rm(tempDir, { force: true, recursive: true });
   });