Skill disable UI is path-scoped but appears name-scoped; duplicate global/project skills remain active

Summary

The Codex Desktop skill disable UI appears to disable one specific skill source/path, but the UI presents the action as if the skill itself is disabled. If another copy of the same skill exists in a different discovery root, that other copy remains active and the skill still appears usable in unrelated projects.

This is confusing for users with both project-local and globally installed skills. It makes the GUI look like it disabled a skill when Codex can still load the same skill by name from another source.

Concrete example

Current active workspace:

C:\Users\georg\Codex_Projects\Codex-Skill-Manager

The user disabled the wiki skills in the Codex GUI. The disabled entries were written to C:\Users\georg\.codex\config.toml as path-scoped project skill entries:

[[skills.config]]
path = 'C:\Users\georg\Codex_Projects\codex_Karpathy_LLM_wiki_skills\.codex\skills\wiki-ingest\SKILL.md'
enabled = false

[[skills.config]]
path = 'C:\Users\georg\Codex_Projects\codex_Karpathy_LLM_wiki_skills\.codex\skills\wiki-init\SKILL.md'
enabled = false

[[skills.config]]
path = 'C:\Users\georg\Codex_Projects\codex_Karpathy_LLM_wiki_skills\.codex\skills\wiki-lint\SKILL.md'
enabled = false

[[skills.config]]
path = 'C:\Users\georg\Codex_Projects\codex_Karpathy_LLM_wiki_skills\.codex\skills\wiki-query\SKILL.md'
enabled = false

[[skills.config]]
path = 'C:\Users\georg\Codex_Projects\codex_Karpathy_LLM_wiki_skills\.codex\skills\wiki-update\SKILL.md'
enabled = false

However, the same skill names also exist in the global user skill directory:

C:\Users\georg\.codex\skills\wiki-ingest
C:\Users\georg\.codex\skills\wiki-init
C:\Users\georg\.codex\skills\wiki-lint
C:\Users\georg\.codex\skills\wiki-query
C:\Users\georg\.codex\skills\wiki-update

Those global copies remain physically present and are still discoverable/active in sessions unrelated to the wiki project.

Why this matters

From the user perspective, disabling wiki-query in the GUI means wiki-query should be disabled. In practice, the UI disabled only one source path for wiki-query, while another source path remained active.

This creates two confusing outcomes:

1. A skill can look disabled in the GUI but still be active because another copy exists elsewhere.
2. A project-local skill path can be registered in global config and appear outside that project, making project-local scope unclear.

This is especially noticeable for users with many projects and many skills installed. The active skills catalog becomes hard to reason about, and disabling skills no longer reliably reduces the active/default skill surface.

Expected behavior

At least one of the following should happen:

• Disable by skill identity/name across all discovered sources, with a warning that multiple sources were affected.
• Keep path-scoped disabling, but make the UI explicit: show every source for a skill and mark which source is enabled/disabled.
• Warn when a disabled skill is shadowed by an enabled duplicate from another root.
• In the skills list, group duplicates by name and show source paths, for example:

wiki-query
  disabled project copy: C:\...\codex_Karpathy_LLM_wiki_skills\.codex\skills\wiki-query
  active global copy:    C:\Users\georg\.codex\skills\wiki-query

Related concern

This overlaps with the broader per-session skill metadata issue in #21425, but the specific bug here is the mismatch between GUI semantics and actual path/source-scoped disable behavior.

Environment

• Platform: Windows
• App: Codex Desktop
• User has many saved workspace roots/projects
• CODEX_HOME is unset in the shell checked during investigation
• Current installer tooling still defaults to ~/.codex/skills

Requested outcome

Please clarify the skill discovery and disable rules in the GUI/docs, and consider adding duplicate-source visibility so users can accurately understand which skills are active and why.