$skill invocation resolves stale cached plugin skill from not-installed marketplace plugin

What issue are you seeing?

After hitting the outdated Superpowers issue described in issues #28846 / #29517, I installed the upstream Superpowers marketplace as superpowers-dev to use the newer version.

After that, Codex had:

• superpowers@superpowers-dev installed and enabled, version 6.1.1
• superpowers@openai-curated not installed
• a stale/openai-curated Superpowers copy still present in the local plugin cache, version 5.1.4

The surprising behavior was that explicit $superpowers invocation resolved to the stale cached openai-curated copy, while plain natural-language invocation of superpowers resolved to the correct enabled superpowers-dev plugin.

Observed:

• Prompt: invoca superpowers e dimmi la cartella da cui fai la discovery e la versione di superpowers. Non modificare alcun file
• resolved to: ~/.codex/plugins/cache/superpowers-dev/superpowers/6.1.1/skills
• version: 6.1.1

• Prompt: invoca $superpowers e dimmi la cartella da cui fai la discovery e la versione di superpowers. Non modificare alcun file
• resolved to the stale openai-curated cache path
• version: 5.1.4

After adding an explicit config entry disabling the not-installed curated plugin, $superpowers started resolving correctly to superpowers-dev 6.1.1.

This suggests that $skill resolution may still consider cached skills from a not-installed plugin when another plugin with the same skill name is installed/enabled.

What steps can reproduce the bug?

1. Have the old curated Superpowers plugin cache present locally, for example under:

~/.codex/plugins/cache/openai-curated-remote/superpowers/5.1.4/skills

1. Do not have the curated plugin installed/enabled. In my case, codex plugin list showed the curated Superpowers plugin as not installed.

1. Install and enable the upstream Superpowers marketplace as superpowers-dev.

1. Confirm config contains the enabled upstream plugin:

superpowers@superpowers-dev enabled = true

1. Start a new Codex session.

1. Use a natural-language invocation:

invoca superpowers e dimmi la cartella da cui fai la discovery e la versione di superpowers. Non modificare alcun file

Observed result:
Codex resolves Superpowers from:
~/.codex/plugins/cache/superpowers-dev/superpowers/6.1.1/skills

1. Start another fresh Codex session, or use the same environment.

1. Use explicit $skill invocation:

invoca $superpowers e dimmi la cartella da cui fai la discovery e la versione di superpowers. Non modificare alcun file

Observed result before workaround:
Codex resolves Superpowers from the stale openai-curated cache:
~/.codex/plugins/cache/openai-curated-remote/superpowers/5.1.4/skills

1. Add this explicit disable entry to ~/.codex/config.toml:

[plugins."superpowers@openai-curated"]
enabled = false

1. Restart Codex and repeat the $superpowers prompt.

Observed result after workaround:
$superpowers resolves correctly to:
~/.codex/plugins/cache/superpowers-dev/superpowers/6.1.1/skills

What is the expected behavior?

Explicit $skill invocation should only resolve skills from installed/enabled plugins, or should disambiguate duplicate skill names using the enabled plugin state.

A cached plugin that is not installed should not participate in $skill resolution.

In this case, $superpowers should have resolved to superpowers@superpowers-dev 6.1.1, the only installed/enabled Superpowers plugin, instead of resolving to the stale cached superpowers@openai-curated 5.1.4 copy.

Additional information

This appears related to, but distinct from, #28846 and #29517.

Those issues report that superpowers@openai-curated is outdated compared with upstream. This issue is about what happens after installing an updated upstream marketplace to work around that: the stale curated copy can still be selected by explicit $skill invocation unless it is explicitly disabled in config, even though it is not installed.

Workaround that fixed the issue locally:

[plugins."superpowers@openai-curated"]
enabled = false

After adding that entry and restarting Codex, $superpowers resolved to:

~/.codex/plugins/cache/superpowers-dev/superpowers/6.1.1/skills

Environment:

• macOS
• Codex CLI observed: 0.142.5
• Model: gpt-5.5
• Affected both Codex App and CLI-style sessions
• Upstream Superpowers marketplace source: https://github.com/obra/superpowers.git