fix(issue-reporter): use session-scoped endpoint, drop agent_id requirement

[krrish-berri-2]

Summary

• report_issue now POSTs to /sessions/{session_id}/issues instead of /agents/{agent_id}/issues
• The platform looks up agent_id from the session row server-side — callers only need session_id
• Drops agent_id from the report_issue tool schema entirely
• On K8s pods: SESSION_ID is passed into the MCP subprocess env via gen-mcp-config.mjs (no tool arg needed)
• On the inline harness: model reads session_id from its system prompt and passes it as a tool arg (same as before, but one field instead of two)

Why

A session is 1:1 with an agent — there's no reason for the model to track and pass both. The agent-scoped endpoint required the caller to already know agent_id, which is redundant when session_id uniquely identifies the agent. The session-scoped POST /sessions/{session_id}/issues route writes to the same agentIssue table with the same agent_id field, so the agent issues UI is unaffected.

Files changed

• harnesses/opencode/report-issue-mcp.mjs — use session URL, drop agent_id from callReportIssue and tool schema
• harnesses/opencode/gen-mcp-config.mjs — pass SESSION_ID (not AGENT_ID) to issue reporter subprocess
• src/app/api/v1/managed_agents/agents/[agent_id]/session/route.ts — update system prompt to say "pass your session_id" instead of "pass session_id and agent_id"

Made with Cursor

[greptile-apps]

Greptile Summary

This PR simplifies the issue-reporter MCP by replacing the agent_id-based API surface with a session_id-based one. Because a session is 1:1 with an agent, the platform can resolve agent_id server-side from the session row, removing the need for callers to supply it.

• New GET and PATCH session-scoped route handlers are added alongside the existing POST; all three resolve agent_id from the session row and perform proper cross-tenant ownership checks.
• The MCP tool schema, subprocess env injection (gen-mcp-config.mjs), and system-prompt instructions are updated end-to-end to pass only session_id.
• Unrelated but bundled: Daytona sandbox gains an optional DAYTONA_MEMORY config knob, and the inline Dockerfile pins opencode to 1.14.41.

Confidence Score: 5/5

Safe to merge. The session-scoped routes follow the same auth and cross-tenant ownership patterns as the existing agent-scoped routes, and the MCP tool changes are consistent end-to-end.

The core change — resolving agent_id server-side from a session row — is well-contained, and the new route handlers correctly perform auth and cross-ownership checks before any write. The MCP tool, subprocess env, and system-prompt instruction are all updated in concert with no dangling references to the old agent_id flow.

The new GET handler in sessions/[session_id]/issues/route.ts has a minor limit-parsing edge case worth a look before shipping.

Important Files Changed

Filename	Overview
harnesses/opencode/report-issue-mcp.mjs	Migrated all three tool handlers (report_issue, list_issues, update_issue) to resolve session_id from env or tool arg and call session-scoped API endpoints; tool schemas updated accordingly.
harnesses/opencode/gen-mcp-config.mjs	Switched subprocess env injection from AGENT_ID to SESSION_ID, consistent with the updated tool implementation.
src/app/api/v1/managed_agents/sessions/[session_id]/issues/route.ts	Added a GET handler alongside the existing POST; the limit query parameter is not validated against NaN, so a non-numeric value will produce take: NaN in the Prisma query.
src/app/api/v1/managed_agents/sessions/[session_id]/issues/[issue_id]/route.ts	New PATCH route that resolves agent_id from the session and verifies issue ownership before update; auth and cross-tenant checks are correctly ordered.
src/app/api/v1/managed_agents/agents/[agent_id]/session/route.ts	System prompt updated to instruct the model to pass session_id only (agent_id is still shown for context but no longer required by the tool schema).
src/server/sandbox/daytona.ts	Added optional memoryGb parameter forwarded as resources.memory to Daytona sandbox create calls.
harnesses/opencode/Dockerfile.inline	Pins opencode install to version 1.14.41 instead of latest, improving build reproducibility.
tests/opencode-inline-local.spec.ts	New E2E smoke test for the inline harness; AGENT_ID is read from env with an empty-string default and will throw clearly if unset.
src/server/env.ts	Added DAYTONA_MEMORY as an optional positive integer env var, coerced by Zod.

_{Reviews (2): Last reviewed commit: "test(opencode-inline): drive AGENT_ID fr..." | Re-trigger Greptile}

[krrish-berri-2]

@greptile review