fix(core): isolate active tool groups per session

[logicwu0]

Summary

• keep tool-group activation on a per-call Toolkit initialized from the session AgentState
• persist runtime tool-group changes from the matching call scope instead of shared mutable state
• resolve structured-output tool availability from the current session
• add a deterministic concurrent-session regression test that verifies distinct active groups remain isolated

Testing

• mvn -pl agentscope-core -Dtest=ReActAgentPerSessionStateTest test
• relevant ReActAgent, structured-output, middleware, HITL, Toolkit, and meta-tool tests
• mvn -pl agentscope-core -DskipTests package
• mvn spotless:apply

Fixes #2439

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[codecov]

Codecov Report

❌ Patch coverage is 76.00000% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...e/src/main/java/io/agentscope/core/ReActAgent.java	76.00%	5 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[oss-maintainer]

Code Review — Approved ✅

Overall: Excellent fix for the concurrent tool group cross-session interference bug (#2439). The approach is architecturally sound and well-tested.

Key Change: Each CallExecution now gets its own copy of the agent's Toolkit instead of sharing a single mutable instance. This ensures that active tool groups are isolated per-call, preventing concurrent sessions from overwriting each other's state.

Analysis:

1. Root Cause Fix: The previous design had toolkit.setActiveGroups(...) modifying a shared instance in activateSlotForContext, which caused race conditions when multiple sessions used the same agent singleton. By copying the toolkit per-call (ReActAgent.this.toolkit.copy()), each execution context now has its own isolated toolkit state.

2. Clean Refactoring:

   • syncToolkitToState now takes CallExecution instead of AgentState, correctly syncing from the call-scoped toolkit
   • doStructuredCall uses scope.toolkit.getToolSchemas(scope.state.getToolContext().getActivatedGroups()) instead of the shared toolkit
   • Removed the problematic toolkit.setActiveGroups(...) from activateSlotForContext

3. Test Coverage: Added ReActAgentPerSessionStateTest with comprehensive scenarios for per-session state isolation, including tool group isolation verification.

4. Thread Safety: The final Toolkit toolkit field in CallExecution ensures immutability of the reference within a call scope.

CI Status: ✅ All checks passed (Check License, Check Module Sync, build on ubuntu-latest, build on windows-latest, license/cla)

Minor Observations:

• The toolkit.copy() approach assumes Toolkit.copy() is a deep copy. If it's a shallow copy, there could still be shared mutable state in the tool implementations themselves. Worth verifying in the Toolkit class.
• The performance impact of copying the toolkit per-call should be negligible for most use cases, but worth monitoring in high-throughput scenarios.

Verdict: This is a well-designed fix that correctly addresses the concurrency issue. The test coverage is thorough, and the refactoring is clean.