fix: isolate companion state from sibling plugins

[weivwang]

Closes #609.
Closes #631.

Problem

CLAUDE_PLUGIN_DATA is plugin-scoped while a SessionStart hook is running, but this plugin re-exported that generic name into the shared Claude session env file. A sibling plugin doing the same thing wins by hook order. Later Codex broker and companion processes then resolve state inside the sibling's data directory.

That makes independent plugins perform read-modify-write updates against the same state.json. It also turns the normal 50-job pruning path into cross-plugin data loss: one plugin can delete the other plugin's job JSON and log files.

Fix

• Capture the hook-scoped host value under a Codex-owned CODEX_COMPANION_PLUGIN_DATA variable instead of re-exporting the generic name.
• Prefer that Codex-owned value for all later state resolution.
• Keep CLAUDE_PLUGIN_DATA as a fallback for direct and pre-upgrade callers.

The on-disk layout under the correct Codex plugin data directory is unchanged, so existing correctly placed history stays available without migration. State that was already mixed into a sibling directory is intentionally not imported because its ownership cannot be determined reliably.

Regression coverage

• The SessionStart hook exports only the Codex-owned plugin data variable.
• State resolution remains pinned to the Codex data root after a sibling overwrites the host-scoped value.
• An integration-level state test seeds a sibling job record, JSON file, and log, then saves Codex state under the collision condition. The sibling artifacts must remain byte-for-byte intact. This test deletes those artifacts on unpatched main.

Verification

• node --test tests/state.test.mjs: 5 passed
• targeted SessionStart hook test: 1 passed
• npm test: 93 passed
• npm run build
• npm run check-version
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8f33a7e883

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[weivwang]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 02ae34ee19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".