feat(cursor): first-class Cursor Plugin support with the process lock kept on

[Lykhoyda]

Intent

Captain (2026-09-14): independent review of #1040, then "you can also fix the findings."

The review is done. Packaging is clean (Standards 0). The change skips the process lock for Cursor and home roots. That is a lock-policy change, not a faithful fix of #1038 (Spec 8, worst S1). Do not merge. Keep the Cursor plugin launch contract and rewrite the lock skip. Live draft head at review time: 96a7bfc.

The review report's findings, in substance (the captain's ask by reference): S1 (wrong, lock-sensitive) skipping the process lock for every Cursor host and hard-coding --no-lock on the Cursor Plugin mcp.json spawn undoes live same-root exclusion from GH #672 / PR #681; remove the Cursor-wide skip, drop --no-lock from the Cursor mcp.json, do not skip acquire for isCursorHost. S2 (wrong) WORKSPACE_FOLDER_PATHS alone must not be treated as Cursor; no false-positive host skip. S3 (wrong) the lock must not be skipped because the resolved root is the user home; Claude at home must still acquire. S4 (wrong, source identity) seeding CLAUDE_USER_CWD from the first workspace folder without chdir does not establish intended-app identity; do not invent home-as-app, do not chdir to the plugin cache. S5 (missing) the lock-conflict message must be host-neutral and must drop kill / rm lock / --no-lock as recommended recovery; the troubleshooting docs must not tell Cursor users the plugin spawn skips the lock. S6 (missing) document a project-scoped exact-app Cursor setup, or an honest limitation if Cursor cannot supply an app root. S7 (optional) marketplace ingest proof is not required on this PR. S8 (optional, scope) the first-class Cursor Plugin manifests, marketplace pointer, ${CURSOR_PLUGIN_ROOT} spawn, and empty Cursor hooks may stay once the S1 skip is gone. Keep exit 11 on a same-root conflict. Regenerated host bundles must match source after the lock rewrite. Codex's pre-existing --no-lock launcher is not proof the same bypass is safe for Cursor. No new successful-authority path. Device QA is out of this PR.

What Changed

• Add first-class Cursor Plugin packaging on the Claude package: a root .cursor-plugin/marketplace.json pointing at packages/claude-plugin, a package-local .cursor-plugin/plugin.json with empty hooks, and an mcp.json that spawns the bundled supervisor via ${CURSOR_PLUGIN_ROOT} with no --no-lock flag and no cwd override. The version sync script and the package-sync checker now cover these manifests.
• Rewrite the lock-conflict message to be host-neutral: it names the owning session and says the lock is reclaimed automatically once that process exits, dropping the kill, rm <lock>, and --no-lock recovery advice. Exit 11 on a same-root conflict is unchanged, and the unit and GH bug: stale-authority adoption deadlock - adopt_stale rejects its own advertised handle after supervisor death #672 integration tests assert the new wording. Host bundles are regenerated to match.
• Document Cursor as a supported host across README, docs site, and shared skills, including the limitation that the Cursor Plugin spawn keys the lock on the home directory and cannot bind an exact app root, so project-scoped device work still uses claude or codex started in the app root.

Risk Assessment

✅ Low: The only runtime change is a host-neutral conflict-message string with the lock acquire path, exit 11, and both host bundles verified identical to source; the rest is additive Cursor manifests, version-sync plumbing, sync-check assertions, and documentation that all conform to the stated intent.

Testing

Built the core and ran the lockfile unit tests and the GH-672 same-root takeover integration test, then manually launched the committed Cursor host bundle twice from one root using the exact mcp.json spawn command, once as a Cursor-flavoured project spawn and once from a home-directory root; in both cases the first spawn acquired the lock and the second exited 11 with the host-neutral conflict message and no kill/rm/--no-lock advice, while the owner kept running. Manifest sync checks and a full host-bundle regeneration with a clean git porcelain confirmed the Cursor manifests and both host bundles match source. No screenshot was captured because the change is a CLI/MCP lock-policy change; the docs-site pages were reviewed as diffs rather than rendered.

Evidence: Cursor-hosted spawn from a project root: owner acquires lock, second spawn refused with exit 11

mcp.json: node ${CURSOR_PLUGIN_ROOT}/rn-dev-agent-core/dist/supervisor.js <no extra args> env: CURSOR_TRACE_ID=demo WORKSPACE_FOLDER_PATHS=.../my-rn-app lock file: .../tmp/rn-dev-agent-cdp-501-6755fcd5.lock (pid 31366, projectRoot .../my-rn-app) contender exit code: 11 | Another rn-dev-agent MCP already owns this project root. | PID: 31366 | Project: .../my-rn-app | To resolve: | 1. Use the session that already owns this project root, OR | 2. Quit that session's editor window or MCP client. The lock is released on exit | and reclaimed automatically once the owning process is gone. owner still alive after refusal: yes; lock still present: yes

scenario:   cursor-project
mcp.json:   node ${CURSOR_PLUGIN_ROOT}/rn-dev-agent-core/dist/supervisor.js <no extra args>
spawn cwd:  /var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.GdAvY5yMi0/my-rn-app
env:        CURSOR_TRACE_ID=demo WORKSPACE_FOLDER_PATHS=/var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.GdAvY5yMi0/my-rn-app HOME=~

== 1. owner: node supervisor.js (stdin held open, like an MCP client)
lock file:  /var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.GdAvY5yMi0/tmp/rn-dev-agent-cdp-501-6755fcd5.lock
lock body:  {
  "pid": 31366,
  "projectRoot": "/private/var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.GdAvY5yMi0/my-rn-app",
  "startedAt": 1789409054856,
  "lastHeartbeat": 1789409054856,
  "ppid": 31340,
  "identity": "~/.no-mistakes/worktrees/3df3fd656078/01M2GGKZ0MB856G0E3PEKZDESV/packages/claude-plugin/rn-dev-agent-core/dist/supervisor.js",
  "version": "1.0.8"
}
owner pid 31366 alive: yes

== 2. contender: same command, same cwd
contender exit code: 11
contender stderr:
  | Another rn-dev-agent MCP already owns this project root.
  |   PID:      31366
  |   Project:  /private/var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.GdAvY5yMi0/my-rn-app
  |   Started:  0s ago
  |   Lock:     /var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.GdAvY5yMi0/tmp/rn-dev-agent-cdp-501-6755fcd5.lock
  | 
  | To resolve:
  |   1. Use the session that already owns this project root, OR
  |   2. Quit that session's editor window or MCP client. The lock is released on exit
  |      and reclaimed automatically once the owning process is gone.
  | 
  | Running two MCPs in the same project causes missed events and state flicker.

== 3. owner still alive after refusal: yes; lock still present: yes

Evidence: Spawn from the user home root: lock still acquired and enforced (no home-root skip)

spawn cwd: .../home/anton HOME=.../home/anton lock file: .../tmp/rn-dev-agent-cdp-501-45f11c30.lock (pid 75159, projectRoot .../home/anton) contender exit code: 11 | Another rn-dev-agent MCP already owns this project root. | Project: .../home/anton owner still alive after refusal: yes; lock still present: yes

scenario:   home-root
mcp.json:   node ${CURSOR_PLUGIN_ROOT}/rn-dev-agent-core/dist/supervisor.js <no extra args>
spawn cwd:  /var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.ZqUDRk0KHM/home/anton
env:        CURSOR_TRACE_ID=unset WORKSPACE_FOLDER_PATHS=unset HOME=/var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.ZqUDRk0KHM/home/anton

== 1. owner: node supervisor.js (stdin held open, like an MCP client)
lock file:  /var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.ZqUDRk0KHM/tmp/rn-dev-agent-cdp-501-45f11c30.lock
lock body:  {
  "pid": 75159,
  "projectRoot": "/private/var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.ZqUDRk0KHM/home/anton",
  "startedAt": 1789409117299,
  "lastHeartbeat": 1789409117299,
  "ppid": 75140,
  "identity": "~/.no-mistakes/worktrees/3df3fd656078/01M2GGKZ0MB856G0E3PEKZDESV/packages/claude-plugin/rn-dev-agent-core/dist/supervisor.js",
  "version": "1.0.8"
}
owner pid 75159 alive: yes

== 2. contender: same command, same cwd
contender exit code: 11
contender stderr:
  | Another rn-dev-agent MCP already owns this project root.
  |   PID:      75159
  |   Project:  /private/var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.ZqUDRk0KHM/home/anton
  |   Started:  0s ago
  |   Lock:     /var/folders/wy/khrzvmhd0ss969ydn32ghccm0000gn/T/tmp.ZqUDRk0KHM/tmp/rn-dev-agent-cdp-501-45f11c30.lock
  | 
  | To resolve:
  |   1. Use the session that already owns this project root, OR
  |   2. Quit that session's editor window or MCP client. The lock is released on exit
  |      and reclaimed automatically once the owning process is gone.
  | 
  | Running two MCPs in the same project causes missed events and state flicker.

== 3. owner still alive after refusal: yes; lock still present: yes

Evidence: GH-672 same-root lock takeover integration test output

✔ GH#672: a second same-root supervisor refuses without stealing the lock or killing the owner (2524.700167ms)
✔ GH#672/L4: a kill -9 owner is released by automatic startup cleanup on restart (1398.033084ms)
ℹ tests 2
ℹ suites 0
ℹ pass 2
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 21279.12525

Evidence: Demo script that derives the spawn command from packages/claude-plugin/mcp.json

#!/usr/bin/env bash
# Spawns the committed Cursor host bundle twice from the same root, using the
# exact command Cursor derives from packages/claude-plugin/mcp.json.
set -u
REPO="$1"; SCENARIO="$2"
PKG="$REPO/packages/claude-plugin"
CMD="$(jq -r '.mcpServers.cdp.command' "$PKG/mcp.json")"
ARG0="$(jq -r '.mcpServers.cdp.args[0]' "$PKG/mcp.json")"
EXTRA="$(jq -r '.mcpServers.cdp.args[1:] | join(" ")' "$PKG/mcp.json")"
SUPERVISOR="${ARG0//\$\{CURSOR_PLUGIN_ROOT\}/$PKG}"
SCRATCH="$(mktemp -d)"; export TMPDIR="$SCRATCH/tmp"; export XDG_STATE_HOME="$SCRATCH/state"; mkdir -p "$TMPDIR" "$XDG_STATE_HOME"
case "$SCENARIO" in
  cursor-project) ROOT="$SCRATCH/my-rn-app"; mkdir -p "$ROOT"; export CURSOR_TRACE_ID=demo WORKSPACE_FOLDER_PATHS="$ROOT" ;;
  home-root)      ROOT="$SCRATCH/home/anton"; mkdir -p "$ROOT"; export HOME="$ROOT" ;;
esac
unset CLAUDE_USER_CWD; export RN_AGENT_OBSERVE_AUTOSTART=0
echo "scenario:   $SCENARIO"
echo "mcp.json:   $CMD $ARG0 ${EXTRA:-<no extra args>}"
echo "spawn cwd:  $ROOT"
echo "env:        CURSOR_TRACE_ID=${CURSOR_TRACE_ID:-unset} WORKSPACE_FOLDER_PATHS=${WORKSPACE_FOLDER_PATHS:-unset} HOME=$HOME"
echo
echo "== 1. owner: $CMD supervisor.js (stdin held open, like an MCP client)"
( cd "$ROOT" && exec "$CMD" "$SUPERVISOR" $EXTRA < <(sleep 60) > "$SCRATCH/owner.stdout" 2> "$SCRATCH/owner.stderr" ) &
OWNER=$!
for i in $(seq 1 50); do ls "$TMPDIR"/rn-dev-agent-cdp-*.lock >/dev/null 2>&1 && break; sleep 0.2; done
LOCK="$(ls "$TMPDIR"/rn-dev-agent-cdp-*.lock 2>/dev/null | head -1)"
echo "lock file:  ${LOCK:-NONE (lock was skipped!)}"
[ -n "$LOCK" ] && echo "lock body:  $(cat "$LOCK")"
echo "owner pid $OWNER alive: $(kill -0 $OWNER 2>/dev/null && echo yes || echo no)"
echo
echo "== 2. contender: same command, same cwd"
( cd "$ROOT" && "$CMD" "$SUPERVISOR" $EXTRA < <(sleep 30) > "$SCRATCH/c.stdout" 2> "$SCRATCH/c.stderr" ); CODE=$?
echo "contender exit code: $CODE"
echo "contender stderr:"; sed 's/^/  | /' "$SCRATCH/c.stderr"
echo
echo "== 3. owner still alive after refusal: $(kill -0 $OWNER 2>/dev/null && echo yes || echo no); lock still present: $([ -f "$LOCK" ] && echo yes || echo no)"
kill $OWNER 2>/dev/null; wait $OWNER 2>/dev/null
pkill -f "$SUPERVISOR" 2>/dev/null; rm -rf "$SCRATCH"

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 1 info

• ⚠️ packages/rn-dev-agent-core/src/lifecycle/lockfile.ts:457 - Simplification: the home-keyed hint block in formatLockConflictMessage (the homeKeyed check plus the injected home parameter and the three extra message lines) is not required by the intent. S5 only requires a host-neutral message without kill / rm lock / --no-lock advice, and S6 asks for the limitation to be documented, which the Getting Started and Troubleshooting pages already do. The block adds a second definition of the home-root explanation that must be kept in sync with the docs. Recommend removing the home parameter and the conditional lines, keeping the message uniform for every root. Leaving it is defensible since it is host-neutral and never suggests bypassing the lock, so this is the author's call.
• ℹ️ packages/rn-dev-agent-core/src/lifecycle/lockfile.ts:446 - The first two commits on the branch (2627372, 96a7bfc) introduce the Cursor-wide and home-root lock skip that the intent forbids, and the third commit (756247e) removes it. The reviewed end state is clean, but a non-squash merge would keep two bisectable commits where the same-root exclusion from GH bug: stale-authority adoption deadlock - adopt_stale rejects its own advertised handle after supervisor death #672 is off. Squash-merge or rebase so the forbidden behavior never lands on main as a reachable commit.

🔧 Fix: drop home-keyed hint from lock conflict message
1 info still open:

• ℹ️ AGENTS.md:303 - The new process-lock bullet opens with "every host spawn acquires it" and then names the Codex launcher's --no-lock as the documented exception. packages/codex-plugin/bin/cdp-supervisor.js:50 does pass --no-lock, so the Codex spawn does not acquire the lock and the opening clause is false as written. Reword to "the Claude and Cursor spawns acquire it" (or "every host spawn except the Codex launcher") so the bullet does not contradict itself.

✅ **Test** - passed

✅ No issues found.

• corepack yarn build in packages/rn-dev-agent-core, then node --test test/unit/lockfile.test.js (18 pass, includes the rewritten conflict-message assertions)
• node --test test/integration/gh-672-same-root-lock-takeover.test.ts (2 pass: live-owner refusal with exit 11 and new message; kill -9 owner reclaimed on restart)
• Manual: cursor-spawn-lock-demo.sh cursor-project spawns the committed packages/claude-plugin bundle twice via the mcp.json command with CURSOR_TRACE_ID and WORKSPACE_FOLDER_PATHS set; owner writes the lock, contender exits 11 with the host-neutral message, owner and lock survive
• Manual: cursor-spawn-lock-demo.sh home-root with HOME and cwd set to a fake home; lock is still acquired (Project = home) and the second spawn still exits 11
• bash scripts/test/check-agent-package-sync.test.sh (ALL PASS) and bash scripts/check-agent-package-sync.sh (in sync): Cursor mcp.json must spawn the package-local supervisor with the lock on and no cwd override, plugin.json pins ./mcp.json and empty hooks, Cursor marketplace points at packages/claude-plugin
• corepack yarn workspace rn-dev-agent-core build:web + node scripts/build-host-runtimes.ts then git status --porcelain (empty): Claude and Codex host bundles match source; both bundles carry the new message and neither carries the --no-lock advice
• grep of packages/rn-dev-agent-core/src for isCursorHost / WORKSPACE_FOLDER / homedir lock keying: none present

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

Greptile Summary

This PR adds Cursor Plugin packaging to the Claude host package, synchronizes its manifests through release tooling, documents Cursor’s home-keyed lock limitation, and replaces the lock-conflict text with host-neutral recovery guidance.

• Adds root and package-local Cursor manifests using ${CURSOR_PLUGIN_ROOT} without bypassing the process lock.
• Extends version synchronization and package-consistency checks to cover Cursor artifacts.
• Regenerates both packaged host runtimes after changing the lock-conflict message.
• One documentation statement incorrectly presents the lock as universal even though Codex intentionally bypasses it.

Confidence Score: 4/5

The PR appears safe to merge after correcting the non-blocking documentation claim that Codex uses the same process lock as Claude and Cursor.

The Cursor manifests keep locking enabled, release tooling covers the new artifacts, and the runtime change only updates conflict wording; the remaining issue is inaccurate host-wide lock documentation because Codex intentionally launches with --no-lock.

Files Needing Attention: apps/docs-site/src/content/docs/troubleshooting.mdx, AGENTS.md

Important Files Changed

Filename	Overview
packages/claude-plugin/mcp.json	Adds the package-local Cursor MCP registration and launches the bundled supervisor with locking enabled.
packages/claude-plugin/.cursor-plugin/plugin.json	Adds Cursor Plugin metadata, package-local MCP discovery, and an explicitly empty hook surface.
packages/rn-dev-agent-core/src/lifecycle/lockfile.ts	Rewords live-lock conflicts without changing lock acquisition, reclamation, or exit behavior.
scripts/sync-plugin-manifest.mjs	Synchronizes release versions into the new Cursor plugin and marketplace manifests.
scripts/check-agent-package-sync.sh	Adds filesystem, manifest-shape, launch-policy, source-map, and version checks for Cursor packaging.
apps/docs-site/src/content/docs/getting-started.mdx	Documents installation and explicitly describes the home-root identity and exact-app limitations of Cursor’s plugin spawn.
apps/docs-site/src/content/docs/troubleshooting.mdx	Adds safe lock-conflict recovery guidance but incorrectly claims the exclusion applies to Codex.
AGENTS.md	Records Cursor package boundaries but states a universal process-lock invariant that conflicts with its own Codex exception.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Cursor marketplace] --> B[packages/claude-plugin]
  B --> C[.cursor-plugin/plugin.json]
  C --> D[mcp.json]
  D --> E[Bundled supervisor.js]
  E --> F[Resolve CLAUDE_USER_CWD or process.cwd]
  F --> G[Acquire project-root process lock]
  G -->|Available| H[Start MCP worker]
  G -->|Live owner exists| I[Exit 11 with host-neutral conflict message]

Loading

_{Reviews (1): Last reviewed commit: "no-mistakes(document): docs: list Cursor..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T21:08:24.774861Z	203ffe7	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-14T21:06:34.757002Z	203ffe7	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Codex Lock Behavior Misstated

This section says the project-root lock provides the same exclusion on every host, but the Codex launcher explicitly starts the supervisor with --no-lock. Codex sessions therefore do not acquire this lock or produce this exit-11 conflict. Scope this guidance to Claude and Cursor, and correct the same universal claim in AGENTS.md; otherwise users and maintainers may diagnose Codex behavior using a lock that is intentionally disabled there.

[Lykhoyda]

Already fixed on HEAD before this thread was re-checked.

a73746701b99ac73054be2f27b3f0f6d2bde1d72 scoped the troubleshooting lock copy (and the matching AGENTS.md / changeset wording) to Claude and Cursor, and names the Codex launcher --no-lock as the exception. Current head is 9f18bcf21649e4f0c7793a551e34880df3dca52d.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 203ffe78db

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add Cursor manifests to the version-sync guard

The Cursor versions are updated here, but scripts/sync-versions.sh was not extended to read, compare, or repair either the Cursor plugin manifest or marketplace entry. If either file drifts—for example during a manually prepared or resumed release—the dedicated CI/release “Version sync check” exits successfully, and scripts/sync-versions.sh --fix can report everything synchronized while Cursor still advertises a stale version. Add both Cursor files to that script's mismatch and fix paths.

AGENTS.md reference: AGENTS.md:L437-L439

Useful? React with 👍 / 👎.

[Lykhoyda]

Already fixed on HEAD before this remaining-comments pass.

a73746701b99ac73054be2f27b3f0f6d2bde1d72 extended scripts/sync-versions.sh mismatch and --fix to include packages/claude-plugin/.cursor-plugin/plugin.json and .cursor-plugin/marketplace.json. The Version sync check already runs that script, so Cursor version drift now fails the same guard. Current head is 9f18bcf21649e4f0c7793a551e34880df3dca52d.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a73746701b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Adapt plugin-root paths before reusing Claude commands

When these workflows run in Cursor, the host supplies CURSOR_PLUGIN_ROOT (as this section and mcp.json assume), but the reused payload still executes package paths through CLAUDE_PLUGIN_ROOT only—for example, commands/setup.md:28 invokes the first onboarding helper that way, while commands/run-action.md:51 and several skills do the same. In a normal Cursor session where the Claude variable is unset, those paths resolve under /rn-dev-agent-core or /scripts, so setup and other advertised slash commands cannot find their bundled helpers. Add a host-neutral root fallback including CURSOR_PLUGIN_ROOT or ship Cursor-adapted command and skill copies before reusing these files.

AGENTS.md reference: AGENTS.md:L14-L18

Useful? React with 👍 / 👎.

[Lykhoyda]

Fixed in 9f18bcf21649e4f0c7793a551e34880df3dca52d.

Reused Claude commands/skills now resolve package helpers through the existing host-neutral fallback, with CURSOR_PLUGIN_ROOT as the second alternative after CLAUDE_PLUGIN_ROOT (then the Codex roots). That covers commands/setup.md, commands/run-action.md, and the other shared/Claude helper paths that previously expanded only CLAUDE_PLUGIN_ROOT. Recovery/pin copy and the session-doctor docs use the same expansion. Codex adapted workflows stay on <package-root> and do not gain CLAUDE_PLUGIN_ROOT. The process lock is unchanged.