Add Rust session store identity support

[gimenete]

Context

Persisted session history must be scoped to the authoritative GitHub account identity, not only to the local machine or runtime process. This PR provides the Rust SDK portion of a coordinated runtime-and-consumer rollout so hosts can establish that scope before accessing local session history and preserve it when creating or resuming a session.

The identity consists of:

• authority: the canonical HTTPS origin for GitHub.com or a GitHub Enterprise Server instance
• accountId: the positive decimal authoritative GitHub database ID

It intentionally does not use login names, tokens, local UUIDs, or environment variables as identity transport.

Summary

• add public, non-exhaustive SessionStoreIdentity with Rust fields authority and account_id
• support optional sessionStoreIdentity payloads on session create and resume for compatibility with runtimes that do not yet consume the field
• add Client::set_session_store_identity for the server-scoped sessionStore.setIdentity set/clear contract
• add Client::claim_legacy_session for an explicit, trusted-host-only migration of one selected quarantined legacy local session
• cover exact camelCase serialization, omission when absent, setter/clear requests, claim requests, and claim error propagation

Integration contract

Consumers should call Client::set_session_store_identity(Some(&identity)) after connecting and before local session-store operations such as list, metadata lookup, or resume. On an account switch, set the new identity before any subsequent session-store request; on logout, call Client::set_session_store_identity(None).

After explicit user confirmation for one selected legacy session, a trusted host may call Client::claim_legacy_session(&session_id). This invokes sessionStore.claimLegacySession with only { "sessionId": "..." }; the runtime atomically binds the claim to the identity already configured on that same client connection. A successful or idempotent same-owner claim returns {}. Missing identity, ineligible or missing sessions, conflicting ownership, validation failures, and storage failures are surfaced as JSON-RPC errors.

Claiming is deliberately separate from create/resume, listing, and model-facing RPC namespaces. There is no bulk or automatic claim path. Only after the explicit claim succeeds should the consumer resume the session with the same SessionStoreIdentity.

The same identity can be supplied through SessionConfig::with_session_store_identity and ResumeSessionConfig::with_session_store_identity so create and resume requests carry the account scope explicitly. The identity is create/resume and server-context configuration only; it is not a mutable session update option.

Related runtime and consumer changes are being coordinated in private repositories and are therefore not linked from this public PR.

Validation

• cargo +nightly-2026-04-14 fmt --check
• cargo test --lib session_store_identity
• cargo test --features test-support --test session_test set_session_store_identity
• cargo test --features test-support --test session_test claim_legacy_session
• cargo clippy --all-features --all-targets -- -D warnings
• GitHub Rust test, documentation, Clippy, bundled CLI, and CodeQL checks

[Copilot]

Copilot review overview

🟡 Changes recommended

The new public struct needs non-exhaustive construction to preserve future API compatibility.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	rust/​src/​types.rs — This new public struct can be constructed with a literal, so adding any protocol field later would…

What changed in this PR

Adds Rust SDK support for account-scoped session-store identities.

Changes:

• Adds the public identity type and create/resume configuration.
• Implements the set/clear JSON-RPC API.
• Tests serialization and wire requests.

File	Description
rust/​src/​types.rs	Defines identity and configuration support.
rust/​src/​wire.rs	Serializes identity into create/resume payloads.
rust/​src/​lib.rs	Adds the client identity setter.
rust/​tests/​session_test.rs	Verifies set and clear requests.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[SteveSandersonMS]

Thanks for the added context and the new claim_legacy_session support, @gimenete. I re-validated against the runtime we currently bundle (now 1.0.84-1) and it still returns "Unhandled method" for both sessionStore.setIdentity and sessionStore.claimLegacySession, and neither appears in that build's api.schema.json — consistent with your note that the runtime side is being coordinated separately in private repos.

The SessionConfig/ResumeSessionConfig additions are safe forward-compatible no-ops (I confirmed an unknown sessionStoreIdentity field on session.create is silently ignored by the current runtime), but set_session_store_identity and claim_legacy_session will error for any caller today since the runtime doesn't implement those methods yet.

I'm moving this PR to draft myself for tracking. Please mark it ready for review once the runtime contract has shipped and this can be verified end-to-end (and, since account-scoped session-store identity is language-neutral, once there's a plan for the other 5 SDKs to pick it up consistently via the shared schema/codegen).

[gimenete]

Acknowledged, thanks for validating this against the bundled runtime. I’ll keep the PR in draft until the runtime methods are present in the bundled contract and the language-neutral rollout plan covers the other SDKs; the create/resume fields can remain forward-compatible, but the explicit client methods should not be presented as ready before their runtime dependency ships.