fix(sessions): title app-created sessions from the first user message

App-created sessions (started by sending a message from cloudcli) were
titled with placeholder names — "Untitled Codex Session" from the disk
indexer and, briefly, "New session" from the empty canonical upsert —
before a later sync finally settled on the right text, causing the
sidebar title to flicker.

- Codex/OpenCode synchronizers now title app-created sessions (distinct
  app id mapped to a provider id) from the first user message, while
  sessions found purely by indexing keep their existing setup. Claude
  keeps its AI-generated titles; Cursor already used the first message.
- Decode OpenCode's JSON-string-literal prompts so titles no longer
  surface wrapped in quotes; hoist unwrapJsonStringLiteral into
  shared/utils since it's now used by both the reader and synchronizer.
- Guard the sidebar upsert merge so an empty summary can never blank out
  a title that is already set.
- Add codex/opencode synchronizer tests for the app-created vs indexed
  naming paths.

server/modules/providers/tests/opencode-sessions.test.ts

@@ -417,3 +417,106 @@ test('OpenCode sessions provider reads sqlite history and token usage', { concur
     await rm(tempRoot, { recursive: true, force: true });
   }
 });
+
+/**
+ * Seeds a single OpenCode session with a controllable stored title and first
+ * user message. Uses a minimal schema (only the columns the synchronizer reads)
+ * with a plain-text user part so the derived name is unambiguous.
+ */
+const seedOpenCodeSession = async (
+  homeDir: string,
+  workspacePath: string,
+  options: { sessionId: string; title: string | null; firstUserText: string },
+): Promise<void> => {
+  const dataDir = path.join(homeDir, '.local', 'share', 'opencode');
+  await mkdir(dataDir, { recursive: true });
+
+  const db = new Database(path.join(dataDir, 'opencode.db'));
+  try {
+    db.exec(`
+      CREATE TABLE project (id TEXT PRIMARY KEY, worktree TEXT);
+      CREATE TABLE session (
+        id TEXT PRIMARY KEY,
+        project_id TEXT,
+        directory TEXT,
+        title TEXT,
+        time_created INTEGER,
+        time_updated INTEGER,
+        time_archived INTEGER
+      );
+      CREATE TABLE message (id TEXT PRIMARY KEY, session_id TEXT, time_created INTEGER, data TEXT);
+      CREATE TABLE part (id TEXT PRIMARY KEY, message_id TEXT, session_id TEXT, time_created INTEGER, data TEXT);
+    `);
+
+    db.prepare('INSERT INTO project (id, worktree) VALUES (?, ?)').run('project-1', workspacePath);
+    db.prepare(`
+      INSERT INTO session (id, project_id, directory, title, time_created, time_updated, time_archived)
+      VALUES (?, ?, ?, ?, ?, ?, NULL)
+    `).run(options.sessionId, 'project-1', workspacePath, options.title, 1_700_000_000_000, 1_700_000_001_000);
+    db.prepare('INSERT INTO message (id, session_id, time_created, data) VALUES (?, ?, ?, ?)')
+      .run('message-user', options.sessionId, 1_700_000_001_000, JSON.stringify({ role: 'user' }));
+    db.prepare('INSERT INTO part (id, message_id, session_id, time_created, data) VALUES (?, ?, ?, ?, ?)')
+      .run(
+        'part-user',
+        'message-user',
+        options.sessionId,
+        1_700_000_001_000,
+        // OpenCode persists the prompt as a JSON string literal inside the text
+        // field, so double-encode it here to exercise the unwrap on read.
+        JSON.stringify({ type: 'text', text: JSON.stringify(options.firstUserText) }),
+      );
+  } finally {
+    db.close();
+  }
+};
+
+test('OpenCode synchronizer titles app-created sessions from the first user message', { concurrency: false }, async () => {
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'opencode-session-sync-app-'));
+  const workspacePath = path.join(tempRoot, 'workspace');
+  await mkdir(workspacePath, { recursive: true });
+  const restoreHomeDir = patchHomeDir(tempRoot);
+
+  try {
+    // Stored title differs from the first message so we can prove the first
+    // message wins for sessions started from cloudcli.
+    await seedOpenCodeSession(tempRoot, workspacePath, {
+      sessionId: 'oc-app-1',
+      title: 'OpenCode generated title',
+      firstUserText: 'Fix the checkout crash',
+    });
+    await withIsolatedDatabase(async () => {
+      sessionsDb.createAppSession('app-1', 'opencode', workspacePath);
+      sessionsDb.assignProviderSessionId('app-1', 'oc-app-1');
+
+      await new OpenCodeSessionSynchronizer().synchronize();
+
+      assert.equal(sessionsDb.getSessionById('app-1')?.custom_name, 'Fix the checkout crash');
+    });
+  } finally {
+    restoreHomeDir();
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});
+
+test('OpenCode synchronizer keeps the stored title for indexed sessions', { concurrency: false }, async () => {
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'opencode-session-sync-indexed-'));
+  const workspacePath = path.join(tempRoot, 'workspace');
+  await mkdir(workspacePath, { recursive: true });
+  const restoreHomeDir = patchHomeDir(tempRoot);
+
+  try {
+    await seedOpenCodeSession(tempRoot, workspacePath, {
+      sessionId: 'oc-indexed-1',
+      title: 'OpenCode generated title',
+      firstUserText: 'This prompt should be ignored',
+    });
+    await withIsolatedDatabase(async () => {
+      await new OpenCodeSessionSynchronizer().synchronize();
+
+      assert.equal(sessionsDb.getSessionById('oc-indexed-1')?.custom_name, 'OpenCode generated title');
+    });
+  } finally {
+    restoreHomeDir();
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});