opencode-codex-memory 0.6.0 → 0.6.2

package/README.md

@@ -52,7 +52,7 @@ If you want the mental model before the details, jump to
 
 ```json
 {
-  "plugin": ["opencode-codex-memory@0.6.0"]
+  "plugin": ["opencode-codex-memory@0.6.2"]
 }
 ```
 
@@ -254,7 +254,7 @@ To set options, turn the plugin entry into a `[name, options]` pair:
 ```json
 {
   "plugin": [
-    ["opencode-codex-memory@0.6.0", { "disable_on_external_context": true, "min_rollout_idle_hours": 2 }]
+    ["opencode-codex-memory@0.6.2", { "disable_on_external_context": true, "min_rollout_idle_hours": 2 }]
   ]
 }
 ```
@@ -316,7 +316,7 @@ Off by default; no changes to Codex's own config are required.
 {
   "plugin": [
     [
-      "opencode-codex-memory@0.6.0",
+      "opencode-codex-memory@0.6.2",
       { "codex_interop": { "import": true, "export": true } }
     ]
   ]
@@ -373,7 +373,7 @@ from the project memories Claude already keeps on your machine. **One-way only**
 ```json
 {
   "plugin": [
-    ["opencode-codex-memory@0.6.0", { "claude_import": { "enabled": true } }]
+    ["opencode-codex-memory@0.6.2", { "claude_import": { "enabled": true } }]
   ]
 }
 ```
@@ -400,7 +400,7 @@ Claude names each project with an opaque id (a folder under
 {
   "plugin": [
     [
-      "opencode-codex-memory@0.6.0",
+      "opencode-codex-memory@0.6.2",
       {
         "claude_import": {
           "enabled": true,
@@ -485,7 +485,8 @@ mirrors that decision rather than layering scoping back on top.
 When memory does not seem to build, ask the agent to run **`memory_inspect`**.
 It reports:
 
-- stage-1 job counts and recent extraction errors
+- stage-1 job counts, failure classes (`backoff` / `provider_capacity` / `other_exhausted`), and recent extraction errors
+- active provider/model quota backoffs and their retry times
 - phase-2 status / last error / cooldown
 - last session-discovery outcome
 - effective options (after clamping) and config warnings
@@ -500,6 +501,7 @@ Common causes:
 | Discovery failed | Host API/`experimental/session` unavailable; inspect shows the error. Retry after restarting OpenCode. |
 | Pin stuck on old version | OpenCode freezes bare package specs; pin an explicit version and bump it (see Install). |
 | Consolidation never runs | Check `phase2_status` and `phase2_last_error` in inspect; failed artifacts keep the workspace diff for the next run. |
+| `stage1_error` mentions usage/rate limit | Temporary provider quota. Inspect shows `provider_capacity` or `backoff`; those jobs retry after about an hour once quota returns. Permanent holes are `other_exhausted`. |
 
 Install target: this package runs **inside OpenCode** (Bun). You do not need to
 install it as a standalone Node app; OpenCode resolves the plugin into its own

package/dist/src/capture.js

@@ -1,22 +1,8 @@
 import { SCAN_LIMIT } from "./store.js";
 import { getPluginInput } from "./llm.js";
 import { recordDiscoveryStatus } from "./diagnostics.js";
-import { hostPartType, hostSessionMessages, pluginHttpGet } from "./host-client.js";
+import { hostListSessionsGlobal, hostPartType, hostSessionMessages, pluginHttpGet, withHostTimeout } from "./host-client.js";
 const API_TIMEOUT_MS = 60_000;
-async function withTimeout(promise, ms, label) {
-    let timer;
-    try {
-        return await Promise.race([
-            promise,
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
-            }),
-        ]);
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
 /**
  * Global session discovery through the official API:
  * `GET /experimental/session?roots=true` (Session.listGlobal) — one call across
@@ -41,22 +27,14 @@ export async function listRecentSessions(limit = SCAN_LIMIT) {
         now - discoveryCache.at < DISCOVERY_CACHE_MS) {
         return discoveryCache.rows.slice(0, limit);
     }
-    const get = pluginHttpGet(getPluginInput()?.client);
-    if (!get) {
+    const client = getPluginInput()?.client;
+    if (!pluginHttpGet(client)) {
         recordDiscoveryStatus({ ok: false, count: 0, error: "plugin HTTP client unavailable" });
         return [];
     }
     try {
-        // Opencode's SDK client injects `directory` from x-opencode-directory on
-        // every GET (sdk client rewrite). The experimental session handler treats
-        // any present directory query as "filter to this instance's project",
-        // which would hide every other project's idle sessions — memory is global.
-        // Pass an empty directory so rewrite does not re-inject, and the handler
-        // sees a falsy value → listGlobal without a directory filter.
-        const res = await withTimeout(get({
-            url: "/experimental/session",
-            query: { roots: true, limit, directory: "" },
-        }), API_TIMEOUT_MS, "experimental.session.list");
+        const controller = new AbortController();
+        const res = await withHostTimeout(hostListSessionsGlobal(client, { limit, signal: controller.signal }), API_TIMEOUT_MS, "experimental.session.list", controller);
         if (!res || res.error || !Array.isArray(res.data)) {
             throw new Error(`experimental.session.list failed: ${JSON.stringify(res?.error ?? {})}`);
         }
@@ -89,7 +67,8 @@ export async function listRecentSessions(limit = SCAN_LIMIT) {
 }
 /** Official transcript surface: GET /session/{id}/message via the plugin's authenticated client. */
 async function fetchMessagesViaApi(sessionId) {
-    const res = await withTimeout(hostSessionMessages(getPluginInput()?.client, sessionId), API_TIMEOUT_MS, "session.messages");
+    const controller = new AbortController();
+    const res = await withHostTimeout(hostSessionMessages(getPluginInput()?.client, sessionId, controller.signal), API_TIMEOUT_MS, "session.messages", controller);
     if (!res || res.error || !Array.isArray(res.data)) {
         throw new Error(`session.messages failed: ${JSON.stringify(res?.error ?? {})}`);
     }

package/dist/src/host-client.d.ts

@@ -6,7 +6,7 @@
  *
  * Current gaps (as of @opencode-ai/plugin ~1.18.10):
  * - session.create body: metadata + title typing
- * - session.prompt body: `format` (json_schema) omitted from PromptInput
+ * - session.prompt body: `format` (json_schema) and `variant` omitted from PromptInput
  * - AssistantMessage.info.structured: structured extraction result
  * - client._client.get: experimental routes (no experimental.* namespace on V1)
  * - mcp.status: present on host client, weakly typed in plugin package
@@ -22,6 +22,25 @@ export type HostHttpGet = (opts: {
 }>;
 /** Hey-api transport on PluginInput.client for routes the V1 surface lags on. */
 export declare function pluginHttpGet(client: PluginInput["client"] | null | undefined): HostHttpGet | null;
+/**
+ * Host-wide session list. The SDK injects `directory` from
+ * x-opencode-directory on every GET; a truthy value makes the experimental
+ * handler filter to that instance's project. Pass `directory:""` so rewrite
+ * does not re-inject and the handler sees a falsy value → listGlobal.
+ * Used by discovery and helper-session cleanup (memory is global).
+ */
+export declare function hostListSessionsGlobal(client: PluginInput["client"] | null | undefined, opts: {
+    limit: number;
+    cursor?: number;
+    search?: string;
+    signal?: AbortSignal;
+}): Promise<{
+    error?: unknown;
+    data?: unknown;
+}>;
+/** Attach a no-op catch so a raced-away promise cannot become unhandled. */
+export declare function ignoreLateRejection(promise: Promise<unknown>): void;
+export declare function withHostTimeout<T>(promise: Promise<T>, ms: number, label: string, abort?: AbortController): Promise<T>;
 export interface SessionCreateBody {
     title?: string;
     metadata?: Record<string, unknown>;
@@ -30,6 +49,7 @@ export interface SessionCreateBody {
 export declare function hostSessionCreate(client: PluginInput["client"], opts: {
     directory: string;
     body: SessionCreateBody;
+    signal?: AbortSignal;
 }): Promise<{
     error?: unknown;
     data?: {
@@ -44,6 +64,7 @@ export interface HostPromptBody {
         modelID: string;
     };
     format?: Record<string, unknown>;
+    variant?: string;
     parts: {
         type: "text";
         text: string;
@@ -64,9 +85,12 @@ export declare function hostMcpStatus(client: PluginInput["client"] | null, sign
     data?: unknown;
 } | null>;
 /** session.messages — weakly typed parts; centralize the cast. */
-export declare function hostSessionMessages(client: PluginInput["client"] | null | undefined, sessionId: string): Promise<{
+export declare function hostSessionMessages(client: PluginInput["client"] | null | undefined, sessionId: string, signal?: AbortSignal): Promise<{
     error?: unknown;
     data?: unknown;
 }>;
 export declare function hostPartType(part: unknown): string;
+export type SessionLiveness = "live" | "gone" | "unknown";
+/** Codex re-checks the live threads table; 404 = gone, anything else stays. */
+export declare function hostSessionLiveness(client: PluginInput["client"] | null | undefined, id: string, timeoutMs?: number): Promise<SessionLiveness>;
 export declare function hostSessionDeletionConfirmed(client: PluginInput["client"], id: string, timeoutMs: number): Promise<boolean>;

package/dist/src/host-client.js

@@ -6,7 +6,7 @@
  *
  * Current gaps (as of @opencode-ai/plugin ~1.18.10):
  * - session.create body: metadata + title typing
- * - session.prompt body: `format` (json_schema) omitted from PromptInput
+ * - session.prompt body: `format` (json_schema) and `variant` omitted from PromptInput
  * - AssistantMessage.info.structured: structured extraction result
  * - client._client.get: experimental routes (no experimental.* namespace on V1)
  * - mcp.status: present on host client, weakly typed in plugin package
@@ -18,11 +18,58 @@ export function pluginHttpGet(client) {
         return null;
     return http.get.bind(http);
 }
+/**
+ * Host-wide session list. The SDK injects `directory` from
+ * x-opencode-directory on every GET; a truthy value makes the experimental
+ * handler filter to that instance's project. Pass `directory:""` so rewrite
+ * does not re-inject and the handler sees a falsy value → listGlobal.
+ * Used by discovery and helper-session cleanup (memory is global).
+ */
+export async function hostListSessionsGlobal(client, opts) {
+    const get = pluginHttpGet(client);
+    if (!get)
+        throw new Error("plugin HTTP client unavailable");
+    return get({
+        url: "/experimental/session",
+        query: {
+            roots: true,
+            limit: opts.limit,
+            directory: "",
+            ...(opts.cursor !== undefined ? { cursor: opts.cursor } : {}),
+            ...(opts.search !== undefined ? { search: opts.search } : {}),
+        },
+        signal: opts.signal,
+    });
+}
+/** Attach a no-op catch so a raced-away promise cannot become unhandled. */
+export function ignoreLateRejection(promise) {
+    void promise.catch(() => { });
+}
+export async function withHostTimeout(promise, ms, label, abort) {
+    ignoreLateRejection(promise);
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => {
+                    abort?.abort();
+                    reject(new Error(`${label} timed out after ${ms}ms`));
+                }, ms);
+                timer.unref?.();
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /** session.create with metadata (SDK body type is incomplete). */
 export async function hostSessionCreate(client, opts) {
     return client.session.create({
         query: { directory: opts.directory },
         body: opts.body,
+        ...(opts.signal ? { signal: opts.signal } : {}),
     });
 }
 /** session.prompt including `format` for json_schema structured output. */
@@ -34,6 +81,7 @@ export async function hostSessionPrompt(client, opts) {
             ...(opts.body.system ? { system: opts.body.system } : {}),
             ...(opts.body.model ? { model: opts.body.model } : {}),
             ...(opts.body.format ? { format: opts.body.format } : {}),
+            ...(opts.body.variant ? { variant: opts.body.variant } : {}),
             parts: opts.body.parts,
         },
     });
@@ -55,15 +103,50 @@ export async function hostMcpStatus(client, signal) {
     return (await mcp.status({ signal }));
 }
 /** session.messages — weakly typed parts; centralize the cast. */
-export async function hostSessionMessages(client, sessionId) {
+export async function hostSessionMessages(client, sessionId, signal) {
     if (!client || typeof client.session?.messages !== "function") {
         throw new Error("plugin client unavailable; cannot load transcript");
     }
-    return client.session.messages({ path: { id: sessionId } });
+    return client.session.messages({
+        path: { id: sessionId },
+        ...(signal ? { signal } : {}),
+    });
 }
 export function hostPartType(part) {
     return typeof part?.type === "string" ? part.type : "unknown";
 }
+function isNotFoundStatus(res) {
+    if (res?.response?.status === 404)
+        return true;
+    const err = res?.error;
+    if (err && typeof err === "object") {
+        const rec = err;
+        if (rec.status === 404)
+            return true;
+        if (typeof rec.name === "string" && rec.name.toLowerCase().includes("notfound"))
+            return true;
+    }
+    return false;
+}
+const SESSION_LIVE_TIMEOUT_MS = 1_000;
+/** Codex re-checks the live threads table; 404 = gone, anything else stays. */
+export async function hostSessionLiveness(client, id, timeoutMs = SESSION_LIVE_TIMEOUT_MS) {
+    const session = client?.session;
+    if (typeof session?.get !== "function")
+        return "unknown";
+    const controller = new AbortController();
+    try {
+        const res = await withHostTimeout(session.get({ path: { id }, signal: controller.signal }), timeoutMs, "session.get", controller);
+        if (isNotFoundStatus(res))
+            return "gone";
+        if (res?.error)
+            return "unknown";
+        return "live";
+    }
+    catch {
+        return "unknown";
+    }
+}
 export async function hostSessionDeletionConfirmed(client, id, timeoutMs) {
     const session = client.session;
     if (typeof session?.get !== "function")

package/dist/src/llm.d.ts

@@ -6,7 +6,15 @@ export interface ExtractionResult {
 }
 export declare function setPluginInput(input: PluginInput): void;
 export declare function getPluginInput(): PluginInput | null;
+/** Test seam. */
+export declare function setSubSessionCreateTimeoutForTest(ms?: number): void;
+/** Test seam. */
+export declare function setConfigGetTimeoutForTest(ms?: number): void;
+/** Test seam. */
+export declare function setStaleDeleteBatchTimeoutForTest(ms?: number): void;
 export declare function isMemorySubSession(sessionId: string): boolean;
+export declare function resolveExtractionModel(configured?: string): Promise<string | undefined>;
+export declare function resolveConsolidationModel(configured?: string): Promise<string | undefined>;
 /**
  * Thrown when a sub-agent prompt exceeds its budget. A distinct type (rather
  * than matching on the message text) is what tells the catch below that the

package/dist/src/llm.js

@@ -1,12 +1,17 @@
 import fs from "fs";
 import path from "path";
 import { memoryRoot } from "./paths.js";
-import { hostSessionCreate, hostSessionDeletionConfirmed, hostSessionPrompt, hostStructuredOutput, } from "./host-client.js";
-import { pluginShutdownSignal } from "./lifecycle.js";
+import { hostListSessionsGlobal, hostSessionCreate, hostSessionDeletionConfirmed, hostSessionPrompt, hostStructuredOutput, ignoreLateRejection, pluginHttpGet, withHostTimeout, } from "./host-client.js";
+import { isPluginShuttingDown, pluginShutdownSignal } from "./lifecycle.js";
+import { SCAN_LIMIT } from "./store.js";
+import { isProviderCapacityError, ProviderCapacityError } from "./ratelimit.js";
 let inputRef = null;
+let inputGeneration = 0;
 export function setPluginInput(input) {
     inputRef = input;
+    inputGeneration++;
     configModels = null;
+    configModelsInFlight = null;
 }
 export function getPluginInput() {
     return inputRef;
@@ -20,6 +25,25 @@ const SUBSESSION_LIST_TIMEOUT_MS = 5_000;
 const SUBSESSION_ABORT_TIMEOUT_MS = 1_000;
 const SUBSESSION_CONFIRM_TIMEOUT_MS = 1_000;
 const SUBSESSION_DELETE_TIMEOUT_MS = 10_000;
+const SUBSESSION_CREATE_TIMEOUT_MS = 10_000;
+const CONFIG_GET_TIMEOUT_MS = 5_000;
+const SUBSESSION_DELETE_CONCURRENCY = 8;
+const SUBSESSION_DELETE_BATCH_TIMEOUT_MS = 30_000;
+let createTimeoutMs = SUBSESSION_CREATE_TIMEOUT_MS;
+let configGetTimeoutMs = CONFIG_GET_TIMEOUT_MS;
+let staleDeleteBatchTimeoutMs = SUBSESSION_DELETE_BATCH_TIMEOUT_MS;
+/** Test seam. */
+export function setSubSessionCreateTimeoutForTest(ms) {
+    createTimeoutMs = ms ?? SUBSESSION_CREATE_TIMEOUT_MS;
+}
+/** Test seam. */
+export function setConfigGetTimeoutForTest(ms) {
+    configGetTimeoutMs = ms ?? CONFIG_GET_TIMEOUT_MS;
+}
+/** Test seam. */
+export function setStaleDeleteBatchTimeoutForTest(ms) {
+    staleDeleteBatchTimeoutMs = ms ?? SUBSESSION_DELETE_BATCH_TIMEOUT_MS;
+}
 export function isMemorySubSession(sessionId) {
     return activeSubSessions.has(sessionId);
 }
@@ -39,16 +63,20 @@ async function createSession(agent, title) {
     const input = getPluginInput();
     if (!input)
         throw new Error("plugin input not initialized");
+    if (isPluginShuttingDown())
+        throw new SubagentCancelledError();
     const directory = resolveSubSessionDirectory();
     // directory is a query param (not body); without it the client inherits
     // PluginInput.directory, which may be a deleted project path.
-    const res = await hostSessionCreate(input.client, {
+    const controller = new AbortController();
+    const res = await withHostTimeout(hostSessionCreate(input.client, {
         directory,
         body: {
             title: title ?? `codex-memory-${agent}`,
             metadata: { [SUBSESSION_METADATA_KEY]: true },
         },
-    });
+        signal: controller.signal,
+    }), createTimeoutMs, "session.create", controller);
     if (!res.data)
         throw new Error(`session create failed: ${JSON.stringify(res.error ?? {})}`);
     const body = res.data;
@@ -66,23 +94,46 @@ async function createSession(agent, title) {
  * plugin instance — opencode reloads plugins on config change.
  */
 let configModels = null;
+let configModelsInFlight = null;
 async function getConfigModels() {
     if (configModels)
         return configModels;
+    if (configModelsInFlight)
+        return configModelsInFlight;
     const input = getPluginInput();
     if (!input)
         return {};
+    const generation = inputGeneration;
+    const request = (async () => {
+        const controller = new AbortController();
+        try {
+            const res = await withHostTimeout(input.client.config.get({ signal: controller.signal }), configGetTimeoutMs, "config.get", controller);
+            if (res.error || !res.data || generation !== inputGeneration)
+                return {};
+            const resolved = { model: res.data.model, smallModel: res.data.small_model };
+            configModels = resolved;
+            return resolved;
+        }
+        catch {
+            // Config endpoint unavailable: leave models unset so the sub-agent runs
+            // on the session default. Do not cache failures: the next call can recover.
+            return {};
+        }
+    })();
+    configModelsInFlight = request;
     try {
-        const res = await input.client.config.get();
-        const cfg = res?.data;
-        configModels = { model: cfg?.model, smallModel: cfg?.small_model };
+        return await request;
     }
-    catch {
-        // Config endpoint unavailable: leave models unset so the sub-agent runs
-        // on the session default, the previous behavior.
-        configModels = {};
+    finally {
+        if (configModelsInFlight === request)
+            configModelsInFlight = null;
     }
-    return configModels;
+}
+export async function resolveExtractionModel(configured) {
+    return configured ?? (await getConfigModels()).smallModel;
+}
+export async function resolveConsolidationModel(configured) {
+    return configured ?? (await getConfigModels()).model;
 }
 // extract_model / consolidation model strings are "providerID/modelID".
 function parseModelRef(ref) {
@@ -163,9 +214,11 @@ async function runPrompt(sessionId, prompt, agent, opts = {}) {
             ...(opts.system ? { system: opts.system } : {}),
             ...(model ? { model } : {}),
             ...(opts.format ? { format: opts.format } : {}),
+            ...(opts.variant ? { variant: opts.variant } : {}),
             parts: [{ type: "text", text: prompt }],
         },
     });
+    ignoreLateRejection(promptPromise);
     let timer;
     let onAbort;
     try {
@@ -187,12 +240,21 @@ async function runPrompt(sessionId, prompt, agent, opts = {}) {
                 timer = setTimeout(() => reject(new SubagentTimeoutError(timeoutMs)), timeoutMs);
             }),
         ]);
-        if (!res.data)
-            throw new Error(`prompt failed: ${JSON.stringify(res.error ?? {})}`);
+        if (!res.data) {
+            const message = `prompt failed: ${JSON.stringify(res.error ?? {})}`;
+            if (isProviderCapacityError(res.error))
+                throw new ProviderCapacityError(message);
+            throw new Error(message);
+        }
         const promptError = res.data.info?.error;
         if (promptError) {
             const detail = promptError.data?.message;
-            throw new Error(`sub-agent prompt failed${promptError.name ? ` (${promptError.name})` : ""}${detail ? `: ${detail}` : ""}`);
+            const status = promptError.data?.statusCode;
+            const message = `sub-agent prompt failed${promptError.name ? ` (${promptError.name})` : ""}` +
+                `${detail ? `: ${detail}` : ""}${status !== undefined ? ` (HTTP ${status})` : ""}`;
+            if (isProviderCapacityError(promptError))
+                throw new ProviderCapacityError(message, status);
+            throw new Error(message);
         }
         return res.data;
     }
@@ -263,7 +325,7 @@ export async function extractViaSubagent(sessionId, transcript, opts = {}) {
     try {
         const prompt = buildExtractionInput(sessionId, opts.cwd ?? "unknown", transcript);
         // extract_model option > opencode small_model > session default.
-        const model = opts.model ?? (await getConfigModels()).smallModel;
+        const model = await resolveExtractionModel(opts.model);
         const data = await runPrompt(subId, prompt, agent, {
             // Mirrors the stage-1 job lease (1h): codex has no per-request timeout,
             // and a near-600k-char transcript on a slow model can easily exceed a
@@ -276,6 +338,9 @@ export async function extractViaSubagent(sessionId, transcript, opts = {}) {
             // call (toolChoice: required) — which is why memorize-extract must allow
             // that one otherwise-denied tool.
             format: { type: "json_schema", schema: EXTRACTION_SCHEMA },
+            // Codex extraction ReasoningEffort::Low. Host maps variant → reasoningEffort;
+            // missing variant on the model is a no-op.
+            variant: "low",
         });
         // The captured JSON lands on AssistantMessage.structured (schema
         // v1/session.ts; absent from the generated SDK type — see host-client.ts).
@@ -306,8 +371,14 @@ export async function consolidateViaSubagent(memoryRoot, diffFileName, model, si
     try {
         const prompt = buildConsolidationPrompt(memoryRoot, diffFileName);
         // consolidation_model option > opencode model (main) > session default.
-        const resolved = model ?? (await getConfigModels()).model;
-        await promptSession(subId, prompt, agent, { model: resolved, timeoutMs: CONSOLIDATION_TIMEOUT_MS, signal });
+        const resolved = await resolveConsolidationModel(model);
+        await promptSession(subId, prompt, agent, {
+            model: resolved,
+            timeoutMs: CONSOLIDATION_TIMEOUT_MS,
+            signal,
+            // Codex consolidation ReasoningEffort::Medium.
+            variant: "medium",
+        });
     }
     catch (err) {
         promptError = err;
@@ -331,46 +402,92 @@ export async function cleanupOldSubSessions(maxAgeMinutes = 90, timeoutMs = SUBS
     const input = getPluginInput();
     if (!input)
         return;
-    let timer;
+    if (!pluginHttpGet(input.client))
+        return;
+    const controller = new AbortController();
+    const staleSessionIds = [];
     try {
-        if (typeof input.client?.session?.list !== "function")
-            return;
-        const res = await Promise.race([
-            input.client.session.list(),
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error(`session.list timed out after ${timeoutMs}ms`)), timeoutMs);
-            }),
-        ]);
-        if (!res.data)
-            return;
-        const list = res.data;
         const cutoff = Date.now() - maxAgeMinutes * 60 * 1000;
-        for (const s of list) {
-            if (!s.id)
-                continue;
-            const pluginTitle = isPluginSubSessionTitle(s.title);
-            const owned = s.metadata?.[SUBSESSION_METADATA_KEY] === true && pluginTitle;
-            const legacy = s.metadata?.[SUBSESSION_METADATA_KEY] !== true && pluginTitle;
-            if (!owned && !legacy)
-                continue;
-            // Durable ownership requires marker + generated title; a legacy title
-            // alone can reseed the skip set but never authorizes deletion.
-            activeSubSessions.add(s.id);
-            if (!owned)
+        const deadline = Date.now() + timeoutMs;
+        const seen = new Set();
+        let cursor;
+        let pageLimit = SCAN_LIMIT;
+        while (true) {
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                return;
+            const res = await withHostTimeout(hostListSessionsGlobal(input.client, {
+                limit: pageLimit,
+                cursor,
+                search: "codex-memory-",
+                signal: controller.signal,
+            }), remaining, "experimental.session.list", controller);
+            if (res.error || !Array.isArray(res.data))
+                return;
+            const list = res.data;
+            let newSessionCount = 0;
+            for (const s of list) {
+                if (!s.id || seen.has(s.id))
+                    continue;
+                seen.add(s.id);
+                newSessionCount++;
+                const pluginTitle = isPluginSubSessionTitle(s.title);
+                const owned = s.metadata?.[SUBSESSION_METADATA_KEY] === true && pluginTitle;
+                const legacy = s.metadata?.[SUBSESSION_METADATA_KEY] !== true && pluginTitle;
+                if (!owned && !legacy)
+                    continue;
+                // Durable ownership requires marker + generated title; a legacy title
+                // alone can reseed the skip set but never authorizes deletion.
+                activeSubSessions.add(s.id);
+                if (!owned)
+                    continue;
+                const created = s.time?.created ?? 0;
+                if (created && created < cutoff) {
+                    staleSessionIds.push(s.id);
+                }
+            }
+            if (list.length < pageLimit)
+                return;
+            const updates = list.map((s) => s.time?.updated).filter((updated) => typeof updated === "number" && Number.isFinite(updated) && updated >= 0);
+            if (updates.length === 0)
+                return;
+            // listGlobal uses `updated < cursor`. Add one millisecond so sessions
+            // tied at the page boundary remain visible, then dedupe repeated rows.
+            const nextCursor = updates.reduce((min, updated) => Math.min(min, updated), Infinity) + 1;
+            if (cursor !== undefined && (nextCursor >= cursor || newSessionCount === 0)) {
+                // A full page can consist entirely of the same timestamp. Increase the
+                // page size until unseen tied rows appear or the overall deadline wins.
+                pageLimit += SCAN_LIMIT;
                 continue;
-            const created = s.time?.created ?? 0;
-            if (created && created < cutoff) {
-                void deleteSession(s.id);
             }
+            cursor = nextCursor;
+            pageLimit = SCAN_LIMIT;
         }
     }
     catch {
         // best effort only
     }
     finally {
-        clearTimeout(timer);
+        void deleteStaleSubSessions(staleSessionIds, input, staleDeleteBatchTimeoutMs);
     }
 }
+async function deleteStaleSubSessions(sessionIds, input, timeoutMs) {
+    let cursor = 0;
+    const deadline = Date.now() + timeoutMs;
+    const workers = Array.from({ length: Math.min(SUBSESSION_DELETE_CONCURRENCY, sessionIds.length) }, async () => {
+        while (cursor < sessionIds.length && Date.now() < deadline && !isPluginShuttingDown()) {
+            const id = sessionIds[cursor++];
+            try {
+                await deleteSession(id, input, Math.max(1, Math.min(SUBSESSION_DELETE_TIMEOUT_MS, deadline - Date.now())));
+            }
+            catch {
+                // deleteSession is best-effort; one unexpected failure must not stop
+                // the remaining stale-helper cleanup.
+            }
+        }
+    });
+    await Promise.all(workers);
+}
 function isPluginSubSessionTitle(title) {
     return title === "codex-memory-consolidate" || /^codex-memory-extract-ses_[A-Za-z0-9]+$/.test(title ?? "");
 }
@@ -383,20 +500,21 @@ function isPluginSubSessionTitle(title) {
  * really gone?) and only governs ownership tracking, never the shutdown result:
  * hosts without `session.get` would otherwise never report a clean shutdown.
  */
-async function deleteSession(id) {
-    const input = getPluginInput();
+async function deleteSession(id, input = getPluginInput(), timeoutMs = SUBSESSION_DELETE_TIMEOUT_MS) {
     if (!input)
         return false;
     const controller = new AbortController();
     let timer;
     try {
+        const deletePromise = input.client.session.delete({ path: { id }, signal: controller.signal });
+        ignoreLateRejection(deletePromise);
         const res = await Promise.race([
-            input.client.session.delete({ path: { id }, signal: controller.signal }),
+            deletePromise,
             new Promise((_, reject) => {
                 timer = setTimeout(() => {
                     controller.abort();
-                    reject(new Error(`session.delete timed out after ${SUBSESSION_DELETE_TIMEOUT_MS}ms`));
-                }, SUBSESSION_DELETE_TIMEOUT_MS);
+                    reject(new Error(`session.delete timed out after ${timeoutMs}ms`));
+                }, timeoutMs);
                 timer.unref?.();
             }),
         ]);