macOS Desktop skill picker shows installed plugin skills twice from source and cache

What version of the Codex App are you using (From “About Codex” dialog)?

26.820.60940 (7119)

What subscription do you have?

Pro

What platform is your computer?

Darwin 25.6.0 arm64 arm

What issue are you seeing?

The $ skill picker in Codex Desktop for macOS shows two entries for the same bundled plugin skill. The entries have the same name and description, but one points to the generated bundled-marketplace source and the other points to the installed plugin cache.

For Visualize, the two entries resolve to:

~/.codex/.tmp/bundled-marketplaces/openai-bundled/plugins/visualize/skills/visualize/SKILL.md
~/.codex/plugins/cache/openai-bundled/visualize/1.0.22/skills/visualize/SKILL.md

The same duplication affects other enabled plugin skills, including Browser, Chrome, Computer Use, PDF, Spreadsheets, and skills from a local Prose plugin.

What steps can reproduce the bug?

1. Enable visualize@openai-bundled in Codex Desktop on macOS.
2. Start a new task.
3. Type $visualize in the composer.
4. Observe two visualize:visualize suggestions with the same description.
5. Select each suggestion and inspect the path attached to the mention. One path is below ~/.codex/.tmp/bundled-marketplaces/, and the other is below ~/.codex/plugins/cache/.

The duplication is consistently visible for several enabled plugin skills in the same app session.

What is the expected behavior?

The picker should show one entry for a logical skill contributed by one installed plugin. Codex should treat the marketplace source and installed cache as two representations of the same (plugin ID, skill) and bind the picker entry to the active installed copy.

Skills with the same name from genuinely different plugins or scopes may remain separate, but the picker should identify their sources.

Additional information

The local configuration contains one openai-bundled marketplace registration and one enabled visualize@openai-bundled plugin entry. codex plugin list --json also reports one installed and enabled Visualize plugin.

The two Visualize SKILL.md files are separate regular files but are byte-identical. Both have this SHA-256 digest:

5227ba50d3b8f19abd4222557b50a1fabdd1704e82efb89c2b9767c6c7919f32

The App's plugin/read response identifies the generated marketplace-source path, whereas skills/list identifies only the installed-cache path. This suggests that the macOS picker combines two catalogue views without collapsing entries that have the same plugin and skill identity.

Related issue #32795 reports the same source/cache pairing when Remote Control on iOS shows duplicates, but it explicitly reports that macOS showed one entry. This report covers the regression in the macOS Desktop picker without Remote Control.

Issue #21425 separately discusses duplicate skill metadata and context use.