Avoid duplicate Codex skill discovery when the universal skills store is already populated

Summary

The global installation mirror can expose the same skill twice to a Codex host that discovers both .agents/skills and .codex/skills. This report concerns the upstream mirror implementation and a synthetic reproduction; it contains no private installation inventory.

Verified source and reproduction

Current upstream packages/cli/src/utils/skillsMirror.ts declares UNIVERSAL_STORE_READERS = new Set(["pi"]); the generated agent table maps Codex to codexHome/skills. mirrorGlobalSkills skips universal readers but not Codex. After installing real copies into the Claude and universal stores, the CLI calls its mirror step, creating Codex symlinks into the Claude store. This matches the observed filesystem. No private machine data is needed to reproduce it.

In a disposable HOME, create Claude and universal copies of one published skill plus a Codex home; invoke mirrorGlobalSkills. Observe a redundant Codex link. The existing Pi exemption provides a reusable implementation pattern.

Files to change

• packages/cli/src/utils/skillsMirror.ts: skip redundant Codex mirrors after verifying supported Codex discovery, including custom CODEX_HOME.
• packages/cli/src/utils/skillsMirror.test.ts: add isolated-HOME regression cases and preservation controls. Run bun test packages/cli/src/utils/skillsMirror.test.ts from the repository root.

Acceptance criteria and verification

• Install/update does not create a second copy for Codex versions that discover the universal store.
• Repeated updates preserve Claude/universal bytes and produce no duplicate discovery.
• Preserve .codex/skills/.system, unrelated skills, divergent same-name entries and non-Codex mirrors.
• Any migration only unlinks positively identified installer-owned mirrors; it never deletes arbitrary real directories.
• Focused skillsMirror tests fail before the fix and pass afterward, including custom-home and existing alias-safety cases.

This is distinct from the previously fixed unrelated-skill deletion issue: the remaining defect is duplicate discovery. Confirm exact host/version support before broadening the universal-reader exemption.

Related prior work: heygen-com/hyperframes#3294 fixed the Pi case. This is a separate Codex follow-on building on that closed fix, not a request to duplicate or reopen Pi's implementation.