feat(opencode): per-conversation session via first-user-message fingerprint

Follow-on to the session-stability fix. "Per source" already made the
prefix cache hit, but it puts every conversation into one upstream session.

Using the client's own session id is not possible: capturing real agent
traffic (tcpdump on 127.0.0.1:8081) shows generic OpenAI clients send NO
session identifier at all — no user / session_id / conversation_id /
metadata in the body, and no session header (only X-Stainless-* plus
User-Agent: pi). The x-opencode-session the Go endpoint asks for is an
OpenCode native-client concept that a generic client cannot forward.

Since history is replayed every turn, the FIRST user message is invariant
for the life of a conversation, so it is used as the conversation
fingerprint. The session becomes stable within a conversation and distinct
across conversations; requests with no user message fall back to per-source
stability.

Measured through the gateway (same 5.7k-token prompt): 2nd call
cached_tokens=5504, and an unrelated conversation gets its own session.

Test: TestOpenCodeSessionIsStableForCache covers same-conversation
stability, cross-conversation separation, per-request request ids and the
sessionless fallback.

internal/lua/adapters/opencodego.lua

@@ -29,6 +29,39 @@ local function rand_id(prefix, seed)
     return prefix .. string.sub(sha256_hex(seed), 1, 24)
 end
 
+-- 会话指纹：取历史里**第一条 user 消息**。
+--
+-- 为什么不直接用客户端的会话 id：实测抓包（tcpdump 抓 127.0.0.1:8081 的真实
+-- agent 请求）确认通用 OpenAI 客户端**根本不发**任何会话标识 —— body 里没有
+-- user / session_id / conversation_id / metadata，请求头也只有 X-Stainless-*
+-- （OpenAI JS SDK）与 User-Agent。opencode 原生客户端那套 x-opencode-session
+-- 是它自己的概念，通用客户端无从转发。
+--
+-- 退而求其次但要够用：历史被逐轮重放，**第一条 user 消息在整个会话里恒定**，
+-- 用它做指纹即可得到"每会话一个 session"，而不是"每源一个 session"。
+-- 拿不到时（无 user 消息）返回空串，调用方回退到按源稳定。
+local function conversation_fingerprint(body)
+    if type(body) ~= "string" or body == "" then return "" end
+    local ok, req = pcall(json.decode, body)
+    if not ok or type(req) ~= "table" then return "" end
+    for _, m in ipairs(req.messages or {}) do
+        if type(m) == "table" and m.role == "user" then
+            local c = m.content
+            if type(c) == "string" then
+                if c ~= "" then return c end
+            elseif type(c) == "table" then
+                for _, part in ipairs(c) do
+                    if type(part) == "table" and part.type == "text" and part.text then
+                        return part.text
+                    end
+                end
+            end
+            return ""
+        end
+    end
+    return ""
+end
+
 function adapter.build_headers(meta)
     local ts = tostring(meta.timestamp or "")
     local src = (meta.source and meta.source.name) or ""
@@ -43,7 +76,7 @@ function adapter.build_headers(meta)
         --   每请求换 session -> 永远 0 命中
         -- 原先用 meta.timestamp 派生，等于每请求都是新会话，缓存永远无效，
         -- 上游也无法做会话亲和路由。
-        ["x-opencode-session"] = rand_id("ses_", "session|llmsproxy|" .. src),
+        ["x-opencode-session"] = rand_id("ses_", "session|llmsproxy|" .. src .. "|" .. conversation_fingerprint(meta.body)),
         -- request id 仍每请求唯一（它只是请求标识，不参与缓存键）
         ["x-opencode-request"] = rand_id("msg_", "request|" .. ts .. "|" .. tostring(meta.body or "")),
     }

internal/lua/adapters/opencodezen.lua

@@ -30,6 +30,39 @@ local function rand_id(prefix, seed)
     return prefix .. string.sub(sha256_hex(seed), 1, 24)
 end
 
+-- 会话指纹：取历史里**第一条 user 消息**。
+--
+-- 为什么不直接用客户端的会话 id：实测抓包（tcpdump 抓 127.0.0.1:8081 的真实
+-- agent 请求）确认通用 OpenAI 客户端**根本不发**任何会话标识 —— body 里没有
+-- user / session_id / conversation_id / metadata，请求头也只有 X-Stainless-*
+-- （OpenAI JS SDK）与 User-Agent。opencode 原生客户端那套 x-opencode-session
+-- 是它自己的概念，通用客户端无从转发。
+--
+-- 退而求其次但要够用：历史被逐轮重放，**第一条 user 消息在整个会话里恒定**，
+-- 用它做指纹即可得到"每会话一个 session"，而不是"每源一个 session"。
+-- 拿不到时（无 user 消息）返回空串，调用方回退到按源稳定。
+local function conversation_fingerprint(body)
+    if type(body) ~= "string" or body == "" then return "" end
+    local ok, req = pcall(json.decode, body)
+    if not ok or type(req) ~= "table" then return "" end
+    for _, m in ipairs(req.messages or {}) do
+        if type(m) == "table" and m.role == "user" then
+            local c = m.content
+            if type(c) == "string" then
+                if c ~= "" then return c end
+            elseif type(c) == "table" then
+                for _, part in ipairs(c) do
+                    if type(part) == "table" and part.type == "text" and part.text then
+                        return part.text
+                    end
+                end
+            end
+            return ""
+        end
+    end
+    return ""
+end
+
 function adapter.build_headers(meta)
     local ts = tostring(meta.timestamp or "")
     local src = (meta.source and meta.source.name) or ""
@@ -44,7 +77,7 @@ function adapter.build_headers(meta)
         --   每请求换 session -> 永远 0 命中
         -- 原先用 meta.timestamp 派生，等于每请求都是新会话，缓存永远无效，
         -- 上游也无法做会话亲和路由。
-        ["x-opencode-session"] = rand_id("ses_", "session|llmsproxy|" .. src),
+        ["x-opencode-session"] = rand_id("ses_", "session|llmsproxy|" .. src .. "|" .. conversation_fingerprint(meta.body)),
         -- request id 仍每请求唯一（它只是请求标识，不参与缓存键）
         ["x-opencode-request"] = rand_id("msg_", "request|" .. ts .. "|" .. tostring(meta.body or "")),
     }