pluginCodePaths

Every loaded plugin's jar, off the plugin's CodeSource — JavaPlugin#getFile is protected and PluginDescriptionFile never carries the path.

Asking the plugin manager beats the inherited disk scan: it names the plugins that actually loaded, not every jar sitting in the directory. Their declared libraries and any jar-in-jar payload are NOT here — those hang off child loaders, which PluginJarCollector reads live off the loaders themselves so the compile classpath and PluginBridge's runtime lookup share one discovery.