fix(sms-bridge): use documented v1.18.23 message contract

[xnoto]

Summary

OpenCode v1.18.23 — the deployed upstream, tag commit
ef2880f379129aa048be9e9353e30aa168d42c17 — does not document
POST /session/:id/prompt. The documented surface (verified in
packages/web/src/content/docs/server.mdx, the route group
packages/opencode/src/server/routes/instance/httpapi/groups/session.ts
where SessionPaths.prompt = "/session/:sessionID/message", and
PromptInput in packages/opencode/src/session/prompt.ts) is:

• POST /session/:id/message — blocking send; body
  { messageID?, model?, agent?, noReply?, system?, tools?, parts };
  returns { info: Message, parts: Part[] }
• POST /session/:id/prompt_async — async, returns 204 No Content
• POST /session — create; documented body { parentID?, title? }
  only; returns Session

Changes, confined to opencode-sms-bridge/server.py and
opencode-sms-bridge/test_server.py:

• Session creation now sends only documented fields: an empty body.
  The previously sent undocumented agent field is removed, and the
  session id is read from the directly returned Session object.
• The routing agent for the channel is passed on the blocking message
  request as the documented top-level agent body field.
• The message request body carries parts containing text — inbound
  text parts are joined into a single {"type": "text", "text": ...}
  part, preserving existing join semantics and the empty-text guard.
• The response is parsed strictly from the documented top-level
  { info, parts } shape: info must be an object, parts a list;
  only text parts contribute to the reply; any other shape (including
  legacy data-wrapped shapes) fails safely.
• The PII-safe bounded static error-code taxonomy is unchanged
  (ok, opencode-response-invalid, opencode-input-invalid,
  twilio-send-failed, opencode-request-failed:<operation>:<category>
  with operations session-create / prompt), and no raw response
  data, URLs, sessions, agents, or provider detail are logged or
  persisted.
• Tests prove: exact request method/path/body for both the
  session-create and blocking message requests (opener-level, real
  request objects); agent placement on the message request and its
  absence from session create; no /prompt, /wait, or prompt_async
  routes are ever requested; single-request blocking behavior; strict
  { info, parts } extraction with non-text parts ignored and invalid
  shapes (lists, strings, empty, data-wrapped, wrong types,
  text-less) rejected with opencode-response-invalid; and the
  unchanged bounded taxonomy (no wait, message-list,
  prompt-async, or message operation codes).

Fixes #

None — owner-authorized evidence-based repair to the documented v1
message contract; no driving issue supplied.

Note: this repository has no pull-request template in .github/, the
root, or docs/; the makeitworkcloud/.github organization default
template is applied manually here.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — buildah run
  33974511866
  (jobs
  checks
  /
  detect
  /
  build)
  passed pre-commit (including Gitleaks), changed-image detection
  (opencode-sms-bridge), and the non-publishing bridge image build. The
  build's Containerfile step RUN python3 -m unittest discover -s /app -p "test_*.py" -v ran all 21 tests (Ran 21 tests in 0.105s — OK),
  including the exact-route/method/body flow test, the
  documented-fields-only session-create test, the blocking-message
  request test, the strict {info,parts} extraction and
  invalid-shape rejection tests, and the bounded-taxonomy test.
  Push to registry was correctly skipped in PR mode.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none changed; only opencode-sms-bridge/server.py and opencode-sms-bridge/test_server.py were edited.

No local tests, container builds, OpenTofu, SOPS, state, or live-system
operations were run or claimed. CI is the validation authority.

Impact and rollout

Producer changed: makeitworkcloud/images/opencode-sms-bridge is
the canonical bridge-image source. An approved merge automatically
publishes a new immutable GHCR image tag. This PR neither publishes nor
deploys anything itself.

Consumer unchanged: kustomize-cluster continues to select its
currently pinned image; this PR makes no GitOps or image-selection
change. After an approved merge and publication, a separate reviewed
GitOps PR and explicit confirmation are required before image selection,
Argo reconciliation, health verification, and a new approved-source SMS
test.

Behavior boundary: a text job now issues POST /api/session with
an empty body on first contact (agent no longer sent there) and
POST /api/session/{id}/message with the routing agent and a text part,
instead of the undocumented POST /api/session/{id}/prompt with a
{"prompt": {"text": ...}} body. Persisted detail codes are unchanged
in literal value: request failures still compose as
opencode-request-failed:<session-create|prompt>:<category> and
unusable results still fail with opencode-response-invalid. Responses
wrapped in a legacy data envelope are now rejected instead of
tolerated.

Rollback: if a later selected image regresses, use the canonical
GitOps workflow to select a reviewed immutable image tag. Do not
overwrite image tags or alter live state manually.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: an OpenCode agent materially produced this change;
reviewers should verify the cited v1.18.23 upstream evidence (blocking
/session/:id/message body and { info, parts } response,
prompt_async as the only async variant, /prompt undocumented), the
strict response parsing and its invalid-shape rejection, agent
placement, the unchanged bounded taxonomy, and CI results before merge.

[github-actions]

Image CI passed

Pre-commit validation passed. View the workflow run.