Default session listings to owned sessions

[dbczumar]

Description

Session-list requests that omit visibility currently fetch every accessible active session, including sessions shared by other users. New or external clients can accidentally choose this broad scope. Make ownership the default and require an explicit visibility=all to include shared sessions.

Current behavior / code evidence

At 1d2eae203 (0.15.0.dev0), the GET /v1/sessions route and Python SDK client.sessions.list() both default to all. The server's mine branch also forces archive inclusion off, so changing only the defaults would silently break include_archived=true for owned sessions.

On an authenticated server with one owned session and one session shared by another user, an unfiltered list currently returns both. After this change it should return only the owned session; visibility=all should continue returning both.

Requested behavior

• Default the server route and Python SDK to mine.
• Honor include_archived=true within the owned scope for mine.
• Preserve explicit all, shared, and archived behavior and unauthenticated local listings.
• Document this breaking default change and the explicit all migration path, including archive behavior on older servers.

Follow-up to #7949 and #7954. The explicit-visibility lint rule should remain in force.

Environment

Source audit on Linux; affects authenticated multi-user server deployments and the Python SDK, independent of harness.

[github-actions]

🤖 Automated triage

• Bot assessment: Medium impact
• Priority: P2-medium
• Why: This improves the session-retrieval journey for authenticated multi-user deployments by preventing accidental broad listings, while explicit visibility options provide a straightforward workaround and the workflow is not blocked.

This automated assessment uses the issue content and repository signals. Maintainers can override the priority label.

[github-actions]

Thanks for reporting this. #7948 may be related, and has already been fixed — so the fix may have shipped after the build you're on.

Could you check whether you're on a version that includes it? If you are and this still happens, say so here — that makes it a regression rather than a duplicate, and we'll keep this open.