fix: block sending messages to child sessions

Child sessions (sessions with a parentID) are read-only views of
subagent progress. The OpenCode TUI does not allow messaging them
directly, but the plugin had no such guard.

Add a parentID check in messaging.send_message that returns false
early, matching the existing pattern for missing active sessions.

Add a test that verifies child session sends are blocked and
api_client.create_message is never called.

Author: hermandavid

lua/opencode/services/messaging.lua

@@ -17,6 +17,10 @@ M.send_message = Promise.async(function(prompt, opts)
     return false
   end
 
+  if state.active_session.parentID then
+    return false
+  end
+
   local mentioned_files = context.get_context().mentioned_files or {}
   local allowed, err_msg = util.check_prompt_allowed(config.prompt_guard, mentioned_files)
 

tests/unit/services_messaging_spec.lua

@@ -71,6 +71,23 @@ describe('opencode.services.messaging', function()
     state.api_client.create_message = orig
   end)
 
+  it('returns false when active session is a child session', function()
+    state.ui.set_windows({ mock = 'windows' })
+    state.session.set_active({ id = 'child1', parentID = 'parent1' })
+
+    local create_called = false
+    local orig = state.api_client.create_message
+    state.api_client.create_message = function(_, sid, params)
+      create_called = true
+      return Promise.new():resolve({ id = 'm1' })
+    end
+
+    local sent = messaging.send_message('hello world'):wait()
+    assert.is_false(sent)
+    assert.is_false(create_called)
+    state.api_client.create_message = orig
+  end)
+
   it('increments and decrements user_message_count correctly', function()
     state.ui.set_windows({ mock = 'windows' })
     state.session.set_active({ id = 'sess1' })