fix(sms-bridge): target the v1 /session route prefix

[xnoto]

Summary

The live approved-source SMS test against image 6b48dde reached
inbound_queued/job_claimed and then failed
opencode-response-invalid. Root cause: PR #40 adopted the documented
v1 body and strict direct {info,parts} parsing but left the requests
on the legacy V2 /api surface — an exact prefix/API mismatch.

Authoritative upstream evidence at anomalyco/opencode v1.18.23 commit
ef2880f379129aa048be9e9353e30aa168d42c17:

• packages/opencode/src/server/routes/instance/httpapi/groups/session.ts:
  const root = "/session"; SessionPaths.create = "/session",
  SessionPaths.prompt = "/session/:sessionID/message".
• packages/opencode/src/server/routes/instance/httpapi/handlers/session.ts:
  create returns the direct Session.Info (empty body accepted);
  prompt streams the direct SessionV1.WithParts {info,parts} JSON —
  neither is data-wrapped.
• packages/opencode/test/server/httpapi-session.test.ts: proves the
  legacy V2 /api/session/:id/prompt admission response is data-wrapped,
  GET /api/session/:id/message is the V2 message listing, and
  /api/session/:id/wait is unavailable — /api and /session are
  distinct APIs, so the strict direct-shape parser correctly rejected
  the V2 response.

Changes, confined to opencode-sms-bridge/server.py and
opencode-sms-bridge/test_server.py:

• Session creation: POST /session (was POST /api/session) with the
  documented empty body; id still read from the direct Session.Info.
• Blocking send: POST /session/{id}/message (was
  /api/session/{id}/message) with message-level agent + single text
  part; response still parsed strictly as direct {info,parts}.
• PII-safe bounded static error-code taxonomy unchanged.
• Tests pin the exact /session prefix/method/body at the opener level
  with real request objects and reject every /api route, /prompt,
  /wait, and prompt_async.

Fixes #

None — owner-authorized evidence-based repair to the v1 route prefix;
no driving issue supplied.

Note: this repository has no pull-request template in .github/, the
root, or docs/; the makeitworkcloud/.github organization default
template is applied manually here.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — buildah run
  33975811487
  (jobs checks
  / detect
  / build & push)
  passed pre-commit (including Gitleaks), changed-image detection
  (opencode-sms-bridge), and the non-publishing bridge image build.
  The build's Containerfile step RUN python3 -m unittest discover -s /app -p "test_*.py" -v ran all 21 tests (Ran 21 tests in 0.100s — OK), including the exact /session route/method/body flow test, the
  documented-fields-only session-create test, the single blocking
  message-request test, the /api-route rejection assertions, and the
  strict {info,parts} extraction and invalid-shape rejection tests.
  Push to registry was correctly skipped in PR mode.
• Generated or centrally distributed files were regenerated by their
  owning automation, not hand-edited — none changed; only
  opencode-sms-bridge/server.py and opencode-sms-bridge/test_server.py
  were edited.

No local tests, container builds, OpenTofu, SOPS, state, or live-system
operations were run or claimed. CI is the validation authority.

Impact and rollout

Producer changed: makeitworkcloud/images/opencode-sms-bridge is the
canonical bridge-image source. An approved merge automatically publishes
a new immutable GHCR image tag; this PR neither publishes nor deploys
anything itself.

Consumer unchanged: kustomize-cluster continues to select its
currently pinned image; this PR makes no GitOps or image-selection
change. After an approved merge and publication, a separate reviewed
GitOps PR and explicit confirmation are required before image selection,
Argo reconciliation, health verification, and a new approved-source SMS
test.

Behavior boundary: a text job now issues POST /session with an
empty body and POST /session/{id}/message with the routing agent and a
text part, instead of the same documented bodies on the legacy V2
/api/session... prefix. Persisted detail codes are unchanged in
literal value (opencode-request-failed:<session-create|prompt>:<category>,
opencode-response-invalid, etc.). Direct V1 shapes parse as before;
legacy data-wrapped envelopes remain rejected.

Rollback: if a later selected image regresses, use the canonical
GitOps workflow to select a reviewed immutable image tag. Do not
overwrite image tags or alter live state manually.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files,
  kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations
  were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback
  notes.

AI-assisted change: an OpenCode agent materially produced this change;
reviewers should verify the cited v1.18.23 upstream evidence (the
/session root with create = /session and prompt = /session/:sessionID/message, direct Session.Info/SessionV1.WithParts
responses, and the distinct legacy V2 /api surface), the strict
response parsing and its invalid-shape rejection, the unchanged bounded
taxonomy, and CI results before merge.

[github-actions]

Image CI passed

Pre-commit validation passed. View the workflow run.