feat(server): add session parameter to /event endpoint

[tt-a1i]

Summary

• Add optional session query parameter to the /event SSE endpoint
• Implement server-side filtering to only send events for the specified session
• Update OpenAPI spec and regenerate SDK (v2)

Details

The /event endpoint now accepts an optional session query parameter. When provided, only events related to that session are streamed to the client.

Filtering Logic

When session parameter is specified:

Event Type	Has sessionID?	Behavior
session.*, message.*, etc.	✅ matching	✅ Pass through
session.*, message.*, etc.	✅ non-matching	❌ Filtered out
server.connected, server.heartbeat	❌	✅ Pass through (connection-level)
ide.*, file.*, lsp.*, mcp.*, etc.	❌	❌ Filtered out

This prevents cross-session event leakage. Events without sessionID (except server.*) are filtered out to maintain strict session isolation.

Backward Compatibility

This change is fully backward compatible:

• Without session parameter: Behavior is unchanged - all events are streamed
• With session parameter: Only session-specific events + server.* events are streamed

SDK Support

• ✅ @opencode-ai/sdk/v2 - Fully supported
• ⚠️ @opencode-ai/sdk (v1) - Types not yet updated, will follow up separately

Fixes #6686

AI Assistance Disclosure

I used Codex to review the changes, sanity-check the implementation against existing patterns, and help spot potential edge cases.