fix: allow ChatGPT OAuth for image generation

Allow image generation to use the signed-in ChatGPT OAuth path while keeping API-key based OpenAI/OpenRouter flows unchanged.

Author: Sun-sunshine06

.changeset/chatgpt-image-oauth.md

@@ -0,0 +1,13 @@
+---
+"@open-codesign/providers": patch
+"@open-codesign/desktop": patch
+"@open-codesign/shared": patch
+"@open-codesign/i18n": patch
+---
+
+Allow image generation to use the signed-in ChatGPT subscription OAuth path.
+
+The image asset provider list now includes ChatGPT subscription alongside
+OpenAI API and OpenRouter. When selected, `generate_image_asset` calls the
+ChatGPT Codex Responses backend with the stored OAuth bearer token instead of
+requiring an OpenAI API key.

apps/desktop/src/main/codex-oauth-ipc.ts

@@ -133,6 +133,7 @@ async function persistProviderMutation(
     secrets: cfg?.secrets ?? {},
     providers: nextProviders,
     ...(cfg?.designSystem !== undefined ? { designSystem: cfg.designSystem } : {}),
+    ...(cfg?.imageGeneration !== undefined ? { imageGeneration: cfg.imageGeneration } : {}),
   });
   await writeConfig(next);
   setCachedConfig(next);
@@ -155,6 +156,7 @@ async function claimActiveProviderIfUnset(): Promise<void> {
     secrets: cfg.secrets,
     providers: cfg.providers,
     ...(cfg.designSystem !== undefined ? { designSystem: cfg.designSystem } : {}),
+    ...(cfg.imageGeneration !== undefined ? { imageGeneration: cfg.imageGeneration } : {}),
   });
   await writeConfig(next);
   setCachedConfig(next);
@@ -268,6 +270,7 @@ async function runLogout(): Promise<CodexOAuthStatus> {
       secrets: cfg.secrets,
       providers: nextProviders,
       ...(cfg.designSystem !== undefined ? { designSystem: cfg.designSystem } : {}),
+      ...(cfg.imageGeneration !== undefined ? { imageGeneration: cfg.imageGeneration } : {}),
     });
     await writeConfig(next);
     setCachedConfig(next);
@@ -325,6 +328,7 @@ export async function migrateStaleCodexEntryIfNeeded(): Promise<void> {
     secrets: cfg.secrets,
     providers: nextProviders,
     ...(cfg.designSystem !== undefined ? { designSystem: cfg.designSystem } : {}),
+    ...(cfg.imageGeneration !== undefined ? { imageGeneration: cfg.imageGeneration } : {}),
   });
   await writeConfig(next);
   setCachedConfig(next);

apps/desktop/src/main/image-generation-settings.test.ts

@@ -19,6 +19,8 @@ import {
 const mocks = vi.hoisted(() => ({
   cachedConfig: null as Config | null,
   getApiKeyForProvider: vi.fn<(provider: string) => string>(),
+  codexRead: vi.fn<() => Promise<unknown>>(),
+  codexGetValidAccessToken: vi.fn<() => Promise<string>>(),
   setCachedConfig: vi.fn<(config: Config) => void>(),
   writeConfig: vi.fn<(config: Config) => Promise<void>>(),
 }));
@@ -38,6 +40,13 @@ vi.mock('./onboarding-ipc', () => ({
   },
 }));
 
+vi.mock('./codex-oauth-ipc', () => ({
+  getCodexTokenStore: () => ({
+    read: mocks.codexRead,
+    getValidAccessToken: mocks.codexGetValidAccessToken,
+  }),
+}));
+
 vi.mock('./keychain', () => ({
   buildSecretRef: (value: string) => ({ ciphertext: value, mask: '***' }),
   decryptSecret: (value: string) => value,
@@ -92,41 +101,53 @@ function expectThrowCode(fn: () => unknown, code: string): void {
   throw new Error(`Expected function to throw ${code}`);
 }
 
+async function expectRejectCode(promise: Promise<unknown>, code: string): Promise<void> {
+  try {
+    await promise;
+  } catch (err) {
+    expect(err).toMatchObject({ code });
+    return;
+  }
+  throw new Error(`Expected promise to reject ${code}`);
+}
+
 describe('image generation enablement', () => {
   afterEach(() => {
     mocks.cachedConfig = null;
     getApiKeyForProviderMock.mockReset();
+    mocks.codexRead.mockReset();
+    mocks.codexGetValidAccessToken.mockReset();
     mocks.setCachedConfig.mockReset();
     mocks.writeConfig.mockReset();
   });
 
-  it('disables generate_image_asset when image generation is turned off', () => {
+  it('disables generate_image_asset when image generation is turned off', async () => {
     const cfg = makeConfig(false);
-    expect(isGenerateImageAssetEnabled(cfg)).toBe(false);
-    expect(resolveImageGenerationConfig(cfg)).toBeNull();
+    await expect(isGenerateImageAssetEnabled(cfg)).resolves.toBe(false);
+    await expect(resolveImageGenerationConfig(cfg)).resolves.toBeNull();
   });
 
-  it('enables generate_image_asset when image generation is on and key is available', () => {
+  it('enables generate_image_asset when image generation is on and key is available', async () => {
     getApiKeyForProviderMock.mockReturnValue('sk-openai');
     const cfg = makeConfig(true);
-    expect(isGenerateImageAssetEnabled(cfg)).toBe(true);
-    expect(resolveImageGenerationConfig(cfg)).toMatchObject({
+    await expect(isGenerateImageAssetEnabled(cfg)).resolves.toBe(true);
+    await expect(resolveImageGenerationConfig(cfg)).resolves.toMatchObject({
       provider: 'openai',
       model: 'gpt-image-2',
       apiKey: 'sk-openai',
     });
   });
 
-  it('throws when image generation is on but inherited key is unavailable', () => {
+  it('throws when image generation is on but inherited key is unavailable', async () => {
     getApiKeyForProviderMock.mockImplementation(() => {
       throw new CodesignError('missing key', ERROR_CODES.PROVIDER_KEY_MISSING);
     });
     const cfg = makeConfig(true);
-    expect(() => isGenerateImageAssetEnabled(cfg)).toThrow(/missing key/);
-    expect(() => resolveImageGenerationConfig(cfg)).toThrow(/missing key/);
+    await expect(isGenerateImageAssetEnabled(cfg)).rejects.toThrow(/missing key/);
+    await expect(resolveImageGenerationConfig(cfg)).rejects.toThrow(/missing key/);
   });
 
-  it('throws PROVIDER_KEY_MISSING when custom credential mode has no custom key', () => {
+  it('throws PROVIDER_KEY_MISSING when custom credential mode has no custom key', async () => {
     const cfg = makeConfig(true);
     const parsed = hydrateConfig({
       version: 3,
@@ -146,38 +167,155 @@ describe('image generation enablement', () => {
       },
     });
 
-    expectThrowCode(() => resolveImageGenerationConfig(parsed), ERROR_CODES.PROVIDER_KEY_MISSING);
+    await expectRejectCode(resolveImageGenerationConfig(parsed), ERROR_CODES.PROVIDER_KEY_MISSING);
   });
 
-  it('reports inheritedKeyAvailable=false in the view when the provider key is missing', () => {
+  it('reports inheritedKeyAvailable=false in the view when the provider key is missing', async () => {
     getApiKeyForProviderMock.mockImplementation(() => {
       throw new CodesignError('missing key', ERROR_CODES.PROVIDER_KEY_MISSING);
     });
     const cfg = makeConfig(true);
-    const view = imageSettingsToView(cfg.imageGeneration);
+    const view = await imageSettingsToView(cfg.imageGeneration);
     expect(view.enabled).toBe(true);
     expect(view.credentialMode).toBe('inherit');
     expect(view.inheritedKeyAvailable).toBe(false);
     expect(view.hasCustomKey).toBe(false);
   });
 
-  it('reports inheritedKeyAvailable=true in the view when the provider key exists', () => {
+  it('reports inheritedKeyAvailable=true in the view when the provider key exists', async () => {
     getApiKeyForProviderMock.mockReturnValue('sk-openai');
     const cfg = makeConfig(true);
-    const view = imageSettingsToView(cfg.imageGeneration);
+    const view = await imageSettingsToView(cfg.imageGeneration);
     expect(view.inheritedKeyAvailable).toBe(true);
   });
 
-  it('throws credential corruption instead of reporting it as a missing inherited key', () => {
+  it('throws credential corruption instead of reporting it as a missing inherited key', async () => {
     getApiKeyForProviderMock.mockImplementation(() => {
       throw new CodesignError('decrypt failed', ERROR_CODES.KEYCHAIN_UNAVAILABLE);
     });
     const cfg = makeConfig(true);
-    expectThrowCode(
-      () => imageSettingsToView(cfg.imageGeneration),
+    await expectRejectCode(
+      imageSettingsToView(cfg.imageGeneration),
       ERROR_CODES.KEYCHAIN_UNAVAILABLE,
     );
-    expectThrowCode(() => imageGenerationKeyAvailable(cfg), ERROR_CODES.KEYCHAIN_UNAVAILABLE);
+    await expectRejectCode(imageGenerationKeyAvailable(cfg), ERROR_CODES.KEYCHAIN_UNAVAILABLE);
+  });
+
+  it('resolves ChatGPT subscription image generation through the OAuth token store', async () => {
+    mocks.codexGetValidAccessToken.mockResolvedValue('oauth-token');
+    const cfg = hydrateConfig({
+      version: 3,
+      activeProvider: 'chatgpt-codex',
+      activeModel: 'gpt-5.5',
+      providers: {
+        'chatgpt-codex': {
+          id: 'chatgpt-codex',
+          name: 'ChatGPT subscription',
+          builtin: false,
+          wire: 'openai-codex-responses',
+          baseUrl: 'https://chatgpt.com/backend-api',
+          defaultModel: 'gpt-5.5',
+          requiresApiKey: false,
+        },
+      },
+      secrets: {},
+      imageGeneration: {
+        schemaVersion: IMAGE_GENERATION_SCHEMA_VERSION,
+        enabled: true,
+        provider: 'chatgpt-codex',
+        credentialMode: 'inherit',
+        model: 'gpt-5.5',
+        quality: 'high',
+        size: '1536x1024',
+        outputFormat: 'png',
+      },
+    });
+
+    await expect(resolveImageGenerationConfig(cfg)).resolves.toMatchObject({
+      provider: 'chatgpt-codex',
+      model: 'gpt-5.5',
+      apiKey: 'oauth-token',
+      baseUrl: 'https://chatgpt.com/backend-api',
+    });
+    expect(getApiKeyForProviderMock).not.toHaveBeenCalled();
+  });
+
+  it('reports ChatGPT subscription inherited credential availability from OAuth status', async () => {
+    mocks.codexRead.mockResolvedValue({
+      schemaVersion: 1,
+      accessToken: 'token',
+      refreshToken: 'refresh',
+      idToken: 'id',
+      expiresAt: Date.now() + 1000,
+      accountId: 'acct',
+      email: 'person@example.com',
+      updatedAt: Date.now(),
+    });
+    const view = await imageSettingsToView({
+      schemaVersion: IMAGE_GENERATION_SCHEMA_VERSION,
+      enabled: true,
+      provider: 'chatgpt-codex',
+      credentialMode: 'inherit',
+      model: 'gpt-5.5',
+      quality: 'high',
+      size: '1536x1024',
+      outputFormat: 'png',
+    });
+
+    expect(view.inheritedKeyAvailable).toBe(true);
+  });
+
+  it('reports ChatGPT subscription key availability from imageGenerationKeyAvailable', async () => {
+    const cfg = hydrateConfig({
+      version: 3,
+      activeProvider: 'openai',
+      activeModel: 'gpt-5.4',
+      providers: {
+        openai: {
+          id: 'openai',
+          name: 'OpenAI',
+          builtin: true,
+          wire: 'openai-chat',
+          baseUrl: 'https://api.openai.com/v1',
+          defaultModel: 'gpt-5.4',
+        },
+        'chatgpt-codex': {
+          id: 'chatgpt-codex',
+          name: 'ChatGPT subscription',
+          builtin: false,
+          wire: 'openai-codex-responses',
+          baseUrl: 'https://chatgpt.com/backend-api',
+          defaultModel: 'gpt-5.5',
+          requiresApiKey: false,
+        },
+      },
+      secrets: {},
+      imageGeneration: {
+        schemaVersion: IMAGE_GENERATION_SCHEMA_VERSION,
+        enabled: true,
+        provider: 'chatgpt-codex',
+        credentialMode: 'inherit',
+        model: 'gpt-5.5',
+        quality: 'high',
+        size: '1536x1024',
+        outputFormat: 'png',
+      },
+    });
+
+    mocks.codexRead.mockResolvedValue({
+      schemaVersion: 1,
+      accessToken: 'token',
+      refreshToken: 'refresh',
+      idToken: 'id',
+      expiresAt: Date.now() + 1000,
+      accountId: 'acct',
+      email: 'person@example.com',
+      updatedAt: Date.now(),
+    });
+    await expect(imageGenerationKeyAvailable(cfg)).resolves.toBe(true);
+
+    mocks.codexRead.mockResolvedValue(null);
+    await expect(imageGenerationKeyAvailable(cfg)).resolves.toBe(false);
   });
 
   it('clears provider-scoped custom keys when the image provider changes', async () => {