chore: bump sandbox opencode to 1.18.19 (message-ID rollover fix)

[wenxi-onyx]

Description

opencode encodes message IDs with a 48-bit timestamp prefix that wrapped on 2026-08-14 11:19:55 UTC. In opencode <= 1.18.14, the prompt loop picks the "latest" message by lexicographic ID comparison, so any session with pre-wrap history silently ignores new prompts: the user message persists, the loop logs step=0 -> exiting loop, and no assistant message is generated. We saw this live on managed_services tenant_dev (session 995a7fb3), whose sandbox pins 1.18.13.

Upstream fixed this in 1.18.15 (anomalyco/opencode#40990: order messages by time.created, gate loop exit on parentID). This bumps the sandbox image pin to 1.18.19, the latest release. Wedged sessions recover on their own once their sandbox re-provisions with the new image; the message data in sqlite is intact.

Also updates the matching snippet in docs/craft/sandbox/image-and-spinup.md.

How Has This Been Tested?

Root cause verified on the live tenant_dev sandbox: stored ID hex prefixes match the wrap math exactly (msg_ff7de04af001 pre-wrap vs msg_0207f26e7001 post-wrap), and v1.18.15+ no longer contains the vulnerable lastUser.id < lastAssistant.id exit check. Sandbox image build with the new pin is exercised by CI.

Additional Options

• [Optional] Please cherry-pick this PR to the latest release version.
• [Optional] Override Linear Check

---

Summary by cubic

Bumps sandbox opencode to 1.18.19 to fix the message-ID rollover that caused the prompt loop to exit early. Previously (<=1.18.14) sessions with pre-wrap history ignored new prompts and produced no assistant reply; 1.18.15+ orders messages by creation time and gates loop exit on parentID.

• Change: set OPENCODE_VERSION=1.18.19 in the sandbox Dockerfile and mirror the version in docs.
• Rollout: re-provision sandboxes to pick up the new image; wedged sessions resume automatically; no data migration required.

^{Written for commit 8f5a1f8. Summary will update on new commits.}

[greptile-apps]

Greptile Summary

Updates the Craft sandbox image from opencode 1.18.13 to 1.18.19 to incorporate the upstream message-ID rollover fix.

• Updates the reproducible opencode version pin used to build sandbox images.
• Keeps the sandbox image documentation snippet synchronized with the Dockerfile.

Confidence Score: 5/5

The PR appears safe to merge, with the runtime version pin and its documentation updated consistently.

The narrowly scoped dependency pin addresses the described upstream rollover defect, and the reviewed changes reveal no concrete build, runtime, security, or documentation failure.

Important Files Changed

Filename	Overview
backend/onyx/server/features/build/sandbox/image/Dockerfile	Updates the opencode build argument to 1.18.19; no concrete compatibility or build defect was identified.
docs/craft/sandbox/image-and-spinup.md	Updates the documented opencode pin to match the sandbox Dockerfile.

_{Reviews (1): Last reviewed commit: "chore(craft): bump sandbox opencode to 1..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[github-actions]

🖼️ Visual Regression Report

Project	Changed	Added	Removed	Unchanged	Report
admin	2	0	0	185	View Report
exclusive	0	0	0	10	✅ No changes