Git worktrees + stash can cause projectID mismatch (sessions 404 across sandboxes) #12726

Description

Issue

In git worktree setups, OpenCode can resolve different projectIDs for the repo root vs a worktree sandbox when scoping requests via X-OpenCode-Directory. Sessions are stored under storage/session/<projectID>/..., so the mismatch causes 404s when calling session APIs from the “other” directory.
Trigger: worktree .git is a file (so .git/opencode cache can’t be read) + fallback id computation uses git rev-list --max-parents=0 --all (includes refs/stash, which can introduce extra root commits).

Proposed Fix

• Always read/write the cached project id in the common git dir:
  • Use git rev-parse --git-common-dir (resolve to absolute) and store cache at <gitCommonDir>/opencode so worktrees and repo root share the same projectID.
• If fallback id computation is still needed, exclude stash:
  • Avoid --all; use --branches --tags or explicitly exclude refs/stash.

Plugins

No response

OpenCode version

No response

Steps to reproduce

How to Reproduce

1. Have a repo with a worktree where .git is a file: gitdir: /path/repo/.git/worktrees/<name>.
2. Ensure git rev-list --max-parents=0 --all returns >1 root and one maps to stash (git name-rev --name-only <root> => stash^...).
3. Compare:

• GET /project/current with X-OpenCode-Directory: /path/repo => id = A
• GET /project/current with X-OpenCode-Directory: /path/repo/.../worktrees/<name> => id = B (B != A)

4. Create a session under A, then GET /session/<id> under B => 404.

How to Verify

• GET /project/current returns different id values for root vs worktree.
• Session API 404 includes attempted path storage/session/<projectID>/<sessionID>.json.
• git rev-list --max-parents=0 --all shows multiple roots; one is reachable from refs/stash.

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response