feat(plugin): expose session history reads

[opencode-agent]

Summary

• expose paginated persisted session enumeration through ctx.session.list
• add ctx.session.children for direct child traversal and ctx.session.messages for retained message history
• support both Effect and Promise plugin entrypoints with the same bounded cursor behavior as the server APIs
• document the new plugin capabilities

Validation

• bun typecheck (packages/client)
• bun typecheck (packages/plugin)
• bun typecheck (packages/core)
• bun test test/plugin.test.ts test/plugin/promise.test.ts (packages/core)
• Prettier check for changed files

Requested by: @rekram1-node (Aiden via Slack)

[Enough1122]

AI code review — automated review for reference; please use your judgment.

1. packages/core/src/plugin/host.ts:509 — message cursors encode only {id, order, direction} with no sessionID binding, so a cursor issued while paging session A can be replayed against session B where it silently anchors to whatever row matches the embedded id — embed the sessionID (and validate it against input.sessionID on decode) so paginating one session can't be steered by another's cursor.

2. packages/core/src/plugin/host.ts:487 — cursors are plain base64url JSON of the entire query; any caller can edit workspace, search, order, or parentID inside a returned cursor and hand it back (sessionListQuery re-trusts decoded values) — acceptable for trusted local plugins, but worth an explicit comment documenting the trust model, or an HMAC over the payload if these ever cross a privilege boundary.

3. packages/core/src/plugin/host.ts:471 — both code paths fail with a bare new Error("Invalid cursor"), and sessionMessages also rejects cursor + order combinations with the same opaque message — plugin authors will have a hard time telling a corrupted cursor from a misuse error — differentiate messages ("cursor is not valid", "pass either cursor or order, not both").

4. packages/core/test/plugin.test.ts:28 — good happy-path coverage of pagination and protocol passthrough, but no negative tests: invalid base64/JSON, schema-invalid cursor payloads, the cursor+order guard, and (per item 1) a children cursor carrying a forged parentID — those are the branches most likely to rot.

5. Nit — packages/core/src/plugin/host.ts:458 — limit: input?.limit ?? 50 duplicates the default in two places (sessions and messages); hoist a shared constant so server/pagination defaults stay aligned if they change.

Overall: solid API addition — the cursor design mirrors the client, the effect/promise adapters stay in sync, and the docs table is updated. Item 1 is the only real correctness gap; the rest is hardening. Thanks!