feat(desktop): add test-connection button for image generation providers

Resolves credentials for all three paths (inherited, custom encrypted,
ChatGPT OAuth) and probes GET /models on the image baseUrl. Includes
UI button with loading/success/error toasts, 5 unit tests, and i18n
strings for en/es/zh-CN.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: tiegebentley

apps/desktop/src/main/connection-ipc.ts

@@ -16,6 +16,7 @@ import {
 import { buildAuthHeaders, buildAuthHeadersForWire } from './auth-headers';
 import { getCodexTokenStore } from './codex-oauth-ipc';
 import { ipcMain } from './electron-runtime';
+import { resolveImageGenerationTestCredentials } from './image-generation-settings';
 import { getApiKeyForProvider, getCachedConfig, hasApiKeyForProvider } from './onboarding-ipc';
 import { isKeylessProviderAllowed } from './provider-settings';
 import { withTlsBypass } from './tls-override';
@@ -806,6 +807,10 @@ export function registerConnectionIpc(): void {
     handleConnectionV1TestProvider(raw),
   );
 
+  // Tests the currently configured image-generation provider using its own
+  // (possibly separate) key + baseUrl. No payload — resolved from settings.
+  ipcMain.handle('connection:v1:test-image-provider', () => handleConnectionV1TestImageProvider());
+
   // Fetch available models for a stored provider by ID — credentials resolved
   // from the encrypted config so the renderer never touches plaintext keys.
   ipcMain.handle('models:v1:list-for-provider', (_e, raw: unknown) =>
@@ -916,6 +921,36 @@ async function handleConnectionV1TestProvider(raw: unknown): Promise<ConnectionT
   return runProviderTest(creds);
 }
 
+// Image generation providers live in their own config slice (cfg.imageGeneration)
+// with independent baseUrl, credential mode, and (for custom mode) a separate
+// stored key. The probe still hits GET /models on the image baseUrl, so once we
+// resolve the credentials we hand off to the shared runProviderTest with a
+// synthesized ActiveProviderCredentials. chatgpt-codex stays on its OAuth path.
+async function handleConnectionV1TestImageProvider(): Promise<ConnectionTestResponse> {
+  const cfg = getCachedConfig();
+  const resolved = await resolveImageGenerationTestCredentials(cfg);
+  if (!resolved.ok) {
+    return {
+      ok: false,
+      code: 'IPC_BAD_INPUT',
+      message: resolved.message,
+      hint:
+        resolved.code === 'IMAGE_GEN_DISABLED'
+          ? 'Configure an image generation provider in Settings → Image generation first.'
+          : 'Add an API key for the image generation provider in Settings → Image generation, or sign in to ChatGPT.',
+    };
+  }
+  const wire: WireApi =
+    resolved.provider === 'chatgpt-codex' ? 'openai-codex-responses' : 'openai-chat';
+  return runProviderTest({
+    provider: resolved.provider,
+    wire,
+    apiKey: resolved.apiKey,
+    baseUrl: resolved.baseUrl,
+    builtin: true,
+  });
+}
+
 type ResolvedProviderForListing = { providerId: string; entry: ProviderEntry };
 
 function resolveProviderForListing(

apps/desktop/src/main/image-generation-settings.test.ts

@@ -13,6 +13,7 @@ import {
   isGenerateImageAssetEnabled,
   parseImageGenerationUpdate,
   resolveImageGenerationConfig,
+  resolveImageGenerationTestCredentials,
   updateImageGenerationSettings,
 } from './image-generation-settings';
 
@@ -406,3 +407,89 @@ describe('image generation enablement', () => {
     });
   });
 });
+
+describe('resolveImageGenerationTestCredentials', () => {
+  afterEach(() => {
+    mocks.cachedConfig = null;
+    getApiKeyForProviderMock.mockReset();
+    mocks.codexGetValidAccessToken.mockReset();
+  });
+
+  it('returns IMAGE_GEN_DISABLED when no imageGeneration config exists', async () => {
+    const result = await resolveImageGenerationTestCredentials(null);
+    expect(result).toMatchObject({ ok: false, code: 'IMAGE_GEN_DISABLED' });
+  });
+
+  it('resolves inherited credentials even when image generation is disabled', async () => {
+    getApiKeyForProviderMock.mockReturnValue('sk-openai');
+    const cfg = makeConfig(false);
+    const result = await resolveImageGenerationTestCredentials(cfg);
+    expect(result).toMatchObject({
+      ok: true,
+      provider: 'openai',
+      apiKey: 'sk-openai',
+      baseUrl: 'https://api.openai.com/v1',
+    });
+  });
+
+  it('returns PROVIDER_KEY_MISSING when inherited credential cannot be read', async () => {
+    getApiKeyForProviderMock.mockImplementation(() => {
+      throw new CodesignError('missing key', ERROR_CODES.PROVIDER_KEY_MISSING);
+    });
+    const cfg = makeConfig(true);
+    const result = await resolveImageGenerationTestCredentials(cfg);
+    expect(result).toMatchObject({ ok: false, code: 'PROVIDER_KEY_MISSING' });
+  });
+
+  it('decrypts custom-mode key when one is stored', async () => {
+    const baseCfg = makeConfig(true);
+    const cfg = hydrateConfig({
+      version: 3,
+      activeProvider: baseCfg.activeProvider,
+      activeModel: baseCfg.activeModel,
+      providers: baseCfg.providers,
+      secrets: baseCfg.secrets,
+      imageGeneration: {
+        schemaVersion: IMAGE_GENERATION_SCHEMA_VERSION,
+        enabled: true,
+        provider: 'openai',
+        credentialMode: 'custom',
+        model: 'gpt-image-2',
+        quality: 'high',
+        size: '1536x1024',
+        outputFormat: 'png',
+        apiKey: { ciphertext: 'sk-custom-image', mask: 'sk-…age' },
+      },
+    });
+    const result = await resolveImageGenerationTestCredentials(cfg);
+    expect(result).toMatchObject({ ok: true, provider: 'openai', apiKey: 'sk-custom-image' });
+  });
+
+  it('uses ChatGPT OAuth access token for chatgpt-codex provider', async () => {
+    mocks.codexGetValidAccessToken.mockResolvedValue('codex-token-abc');
+    const baseCfg = makeConfig(true);
+    const cfg = hydrateConfig({
+      version: 3,
+      activeProvider: baseCfg.activeProvider,
+      activeModel: baseCfg.activeModel,
+      providers: baseCfg.providers,
+      secrets: baseCfg.secrets,
+      imageGeneration: {
+        schemaVersion: IMAGE_GENERATION_SCHEMA_VERSION,
+        enabled: true,
+        provider: 'chatgpt-codex',
+        credentialMode: 'inherit',
+        model: 'gpt-5.5',
+        quality: 'high',
+        size: '1536x1024',
+        outputFormat: 'png',
+      },
+    });
+    const result = await resolveImageGenerationTestCredentials(cfg);
+    expect(result).toMatchObject({
+      ok: true,
+      provider: 'chatgpt-codex',
+      apiKey: 'codex-token-abc',
+    });
+  });
+});

apps/desktop/src/main/image-generation-settings.ts

@@ -246,6 +246,71 @@ export async function resolveImageGenerationConfig(
   };
 }
 
+export type ResolvedImageGenerationTestCredentials =
+  | {
+      ok: true;
+      provider: ImageGenerationProvider;
+      apiKey: string;
+      baseUrl: string;
+    }
+  | { ok: false; code: 'IMAGE_GEN_DISABLED' | 'PROVIDER_KEY_MISSING'; message: string };
+
+export async function resolveImageGenerationTestCredentials(
+  cfg: Config | null,
+): Promise<ResolvedImageGenerationTestCredentials> {
+  if (cfg === null || cfg.imageGeneration === undefined) {
+    return {
+      ok: false,
+      code: 'IMAGE_GEN_DISABLED',
+      message: 'Image generation is not configured.',
+    };
+  }
+  const parsed = ImageGenerationSettingsSchema.parse(cfg.imageGeneration);
+  const baseUrl = parsed.baseUrl ?? defaultImageBaseUrl(parsed.provider);
+
+  if (parsed.provider === CHATGPT_CODEX_PROVIDER_ID) {
+    let apiKey: string;
+    try {
+      apiKey = await getCodexTokenStore().getValidAccessToken();
+    } catch (err) {
+      return {
+        ok: false,
+        code: 'PROVIDER_KEY_MISSING',
+        message: err instanceof Error ? err.message : String(err),
+      };
+    }
+    return { ok: true, provider: parsed.provider, apiKey, baseUrl };
+  }
+
+  if (parsed.credentialMode === 'custom') {
+    if (parsed.apiKey === undefined) {
+      return {
+        ok: false,
+        code: 'PROVIDER_KEY_MISSING',
+        message: `No custom image API key stored for "${parsed.provider}".`,
+      };
+    }
+    return {
+      ok: true,
+      provider: parsed.provider,
+      apiKey: decryptSecret(parsed.apiKey.ciphertext),
+      baseUrl,
+    };
+  }
+
+  let apiKey: string;
+  try {
+    apiKey = getApiKeyForProvider(parsed.provider);
+  } catch (err) {
+    return {
+      ok: false,
+      code: 'PROVIDER_KEY_MISSING',
+      message: err instanceof Error ? err.message : String(err),
+    };
+  }
+  return { ok: true, provider: parsed.provider, apiKey, baseUrl };
+}
+
 export async function isGenerateImageAssetEnabled(cfg: Config): Promise<boolean> {
   return (await resolveImageGenerationConfig(cfg)) !== null;
 }

apps/desktop/src/preload/index.ts

@@ -618,6 +618,10 @@ const api = {
       ipcRenderer.invoke('connection:v1:test-provider', providerId) as Promise<
         ConnectionTestResult | ConnectionTestError
       >,
+    testImageProvider: () =>
+      ipcRenderer.invoke('connection:v1:test-image-provider') as Promise<
+        ConnectionTestResult | ConnectionTestError
+      >,
   },
   models: {
     list: (input: { provider: SupportedOnboardingProvider; apiKey: string; baseUrl: string }) =>

apps/desktop/src/renderer/src/components/settings/ImageGenerationTab.tsx

@@ -20,8 +20,10 @@ function defaultImageBaseUrlFor(provider: ImageGenerationSettingsView['provider'
 function ImageGenerationPanel() {
   const t = useT();
   const pushToast = useCodesignStore((s) => s.pushToast);
+  const reportableErrorToast = useCodesignStore((s) => s.reportableErrorToast);
   const [settings, setSettings] = useState<ImageGenerationSettingsView | null>(null);
   const [saving, setSaving] = useState(false);
+  const [testing, setTesting] = useState(false);
   const [apiKey, setApiKey] = useState('');
   const [model, setModel] = useState('');
   const [baseUrl, setBaseUrl] = useState('');
@@ -46,6 +48,42 @@ function ImageGenerationPanel() {
       });
   }, [pushToast, t]);
 
+  async function handleTestConnection() {
+    if (!window.codesign?.connection) return;
+    setTesting(true);
+    try {
+      const res = await window.codesign.connection.testImageProvider();
+      if (res.ok) {
+        pushToast({
+          variant: 'success',
+          title: t('settings.imageGen.toast.connectionOk', {
+            defaultValue: 'Image provider connection OK',
+          }),
+        });
+      } else {
+        reportableErrorToast({
+          code: 'CONNECTION_TEST_FAILED',
+          scope: 'settings',
+          title: t('settings.imageGen.toast.connectionFailed', {
+            defaultValue: 'Image provider connection failed',
+          }),
+          description: res.hint || res.message,
+        });
+      }
+    } catch (err) {
+      reportableErrorToast({
+        code: 'CONNECTION_TEST_FAILED',
+        scope: 'settings',
+        title: t('settings.imageGen.toast.connectionFailed', {
+          defaultValue: 'Image provider connection failed',
+        }),
+        description: err instanceof Error ? err.message : t('settings.common.unknownError'),
+      });
+    } finally {
+      setTesting(false);
+    }
+  }
+
   async function save(patch: Partial<ImageGenerationSettingsView> & { apiKey?: string }) {
     if (!window.codesign?.imageGeneration) return;
     setSaving(true);
@@ -252,7 +290,17 @@ function ImageGenerationPanel() {
         </Row>
       </div>
 
-      <div className="flex justify-end pt-[var(--space-1)] border-t border-[var(--color-border-muted)]">
+      <div className="flex justify-end gap-[var(--space-2)] pt-[var(--space-1)] border-t border-[var(--color-border-muted)]">
+        <button
+          type="button"
+          disabled={saving || testing || !keyAvailable}
+          onClick={() => void handleTestConnection()}
+          className="h-8 px-3 rounded-[var(--radius-md)] border border-[var(--color-border)] text-[var(--text-sm)] text-[var(--color-text-secondary)] hover:bg-[var(--color-surface-hover)] transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+        >
+          {testing
+            ? t('settings.imageGen.testing', { defaultValue: 'Testing…' })
+            : t('settings.imageGen.testConnection', { defaultValue: 'Test connection' })}
+        </button>
         <button
           type="button"
           disabled={

packages/i18n/src/locales/en.json

@@ -342,10 +342,14 @@
         "needsChatgptLogin": "Needs ChatGPT sign-in",
         "disabled": "Disabled"
       },
+      "testConnection": "Test connection",
+      "testing": "Testing…",
       "toast": {
         "loadFailed": "Failed to load image generation settings",
         "saved": "Image generation settings saved",
-        "saveFailed": "Failed to save image generation settings"
+        "saveFailed": "Failed to save image generation settings",
+        "connectionOk": "Image provider connection OK",
+        "connectionFailed": "Image provider connection failed"
       }
     },
     "memory": {

packages/i18n/src/locales/es.json

@@ -313,10 +313,14 @@
         "needsChatgptLogin": "Necesita iniciar sesión en ChatGPT",
         "disabled": "Deshabilitado"
       },
+      "testConnection": "Probar conexión",
+      "testing": "Probando…",
       "toast": {
         "loadFailed": "Error al cargar la configuración de generación de imágenes",
         "saved": "Configuración de generación de imágenes guardada",
-        "saveFailed": "Error al guardar la configuración de generación de imágenes"
+        "saveFailed": "Error al guardar la configuración de generación de imágenes",
+        "connectionOk": "Conexión con el proveedor de imágenes OK",
+        "connectionFailed": "Falló la conexión con el proveedor de imágenes"
       }
     },
     "shell": {

packages/i18n/src/locales/zh-CN.json

@@ -342,10 +342,14 @@
         "needsChatgptLogin": "需要登录 ChatGPT",
         "disabled": "未启用"
       },
+      "testConnection": "测试连接",
+      "testing": "测试中…",
       "toast": {
         "loadFailed": "加载图像生成设置失败",
         "saved": "图像生成设置已保存",
-        "saveFailed": "保存图像生成设置失败"
+        "saveFailed": "保存图像生成设置失败",
+        "connectionOk": "图像服务连接正常",
+        "connectionFailed": "图像服务连接失败"
       }
     },
     "memory": {