oira666_pi-image-generation 0.0.1 → 0.0.2

package/README.md

@@ -1 +1,45 @@
+# pi-image-generation
+
+```sh
 pi install npm:oira666_pi-image-generation
+```
+
+Generate and edit PNG images with the `image_gen` tool. Without settings, the extension uses the stored `openai-codex` subscription login, as before.
+
+## Credentials
+
+Create `~/.pi/agent/pi-image-generation-settings.json` to choose a different OpenAI provider registered in pi:
+
+```json
+{
+  "provider": "openai-dmitry"
+}
+```
+
+Pi resolves the selected provider's credentials and manages OAuth refresh. A Codex subscription alias uses the ChatGPT image backend. A provider resolving an OpenAI API key uses the OpenAI Images API.
+
+Alternatively, supply a literal OpenAI API key (billed to your OpenAI API account):
+
+```json
+{
+  "apiKey": "sk-your-openai-api-key"
+}
+```
+
+Use **exactly one** of `provider` or `apiKey`. Empty, malformed, unreadable, or ambiguous settings disable image generation with a warning; they never fall back to another account. API keys are literal strings, not shell commands or environment-variable expressions.
+
+### Project overrides
+
+In a trusted project, settings are checked in this order (first existing file wins):
+
+1. `.pi/agent/pi-image-generation-settings.json`
+2. `.pi/pi-image-generation-settings.json` (standard pi project config directory)
+3. `~/.pi/agent/pi-image-generation-settings.json`
+
+Project settings replace the whole global file, so a project provider does not inherit a global API key. Untrusted projects use only global settings. `PI_CODING_AGENT_DIR` overrides the global agent directory.
+
+Run `/reload` after changing settings or logging in to update tool and skill availability. Credentials are also checked again on each tool call. The active conversation model can use any provider.
+
+Only OpenAI credentials are supported: selected subscription providers must have a `https://chatgpt.com` base URL, and API-key providers a `https://api.openai.com` base URL. Other or unknown origins are rejected to avoid sending another service's credentials to OpenAI. Image requests use fixed OpenAI endpoints, not custom provider paths or headers. There is no automatic fallback between accounts or services.
+
+Keep API-key settings private (`chmod 600 <settings-file>`) and do not commit them to source control. Image prompts and supplied references are uploaded to the selected image service.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oira666_pi-image-generation",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Image generation and reference-image editing for pi.",
   "type": "module",
   "license": "MIT",

package/resources/imagegen/SKILL.md

@@ -5,7 +5,7 @@ description: Generate and edit raster images with image_gen, including photos, i
 
 # Image generation
 
-Use `image_gen` for new raster artwork, image edits, and variations. The tool is available to the current pi model regardless of its provider. It uses the configured Codex subscription for the image request; do not launch another Codex agent, request an API key, or fall back to a paid image API.
+Use `image_gen` for new raster artwork, image edits, and variations. The tool is available to the current pi model regardless of its provider. It uses the OpenAI provider or API key selected in `pi-image-generation-settings.json`, defaulting to the Codex subscription. Do not launch another Codex agent, request secrets in chat, or switch accounts or services as a fallback.
 
 ## Choose the right operation
 
@@ -110,6 +110,6 @@ Recent-image edit:
 
 ## Authentication and failures
 
-The tool and this skill load only when pi has an `openai-codex` OAuth subscription credential in its `auth.json`. Pi manages token refresh. After adding or removing that login, use `/reload` to update extension and skill registration. The active conversation model does not need to be OpenAI.
+By default, the tool and this skill load when pi has an `openai-codex` OAuth subscription login. `pi-image-generation-settings.json` in the global agent directory or trusted project `.pi` (also `.pi/agent`) directory can select another provider with `provider` or supply an OpenAI `apiKey`. Project settings override global settings. API-key requests use the paid OpenAI Images API, not the subscription backend. Pi manages provider credential resolution and OAuth refresh. After changing credentials or settings, use `/reload` to update registration. The active conversation model does not need to be OpenAI.
 
-If authentication fails, tell the user to log in with `/login openai-codex`. For rate limits, wait rather than changing providers. After a timeout or connection failure, the image request may already have consumed allowance. Do not claim a file exists unless the tool returned a saved path.
+If authentication fails, ask the user to check their configured provider login or API-key settings; never ask them to paste secrets into chat. For rate limits, wait rather than changing providers. After a timeout or connection failure, the image request may already have consumed allowance or incurred API charges. Do not claim a file exists unless the tool returned a saved path.

package/src/auth.ts

@@ -1,20 +1,34 @@
 import { readStoredCredential, type ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ImageSettings } from "./settings.ts";
 
 export const PROVIDER = "openai-codex";
 export const OFF_WARNING = "image generation is off, no openai-codex provider configured.";
 
-export function hasSubscription(): boolean {
-  const credential = readStoredCredential(PROVIDER);
+export function hasSubscription(provider = PROVIDER): boolean {
+  const credential = readStoredCredential(provider);
   return credential?.type === "oauth" && typeof credential.access === "string" &&
     credential.access.length > 0 && typeof credential.refresh === "string" &&
     credential.refresh.length > 0;
 }
 
-export interface ImageAuth {
-  accessToken: string;
-  accountId: string;
+export function hasImageAuth(
+  settings: ImageSettings | undefined,
+  registry: Pick<ExtensionContext["modelRegistry"], "getProviderAuthStatus">,
+): boolean {
+  if (!settings) return hasSubscription();
+  if ("apiKey" in settings) return true;
+  if (readStoredCredential(settings.provider)?.type === "oauth") return hasSubscription(settings.provider);
+  return registry.getProviderAuthStatus(settings.provider).configured;
 }
 
+export function offWarning(settings?: ImageSettings): string {
+  return settings && "provider" in settings
+    ? `image generation is off, no ${settings.provider} provider configured.`
+    : OFF_WARNING;
+}
+
+export type ImageAuth = { accessToken: string; accountId: string } | { apiKey: string };
+
 // Only extracts routing metadata. The backend, not this decoder, verifies the JWT.
 export function accountIdFromToken(token: string): string | undefined {
   try {
@@ -27,25 +41,44 @@ export function accountIdFromToken(token: string): string | undefined {
 }
 
 export async function resolveImageAuth(
-  registry: Pick<ExtensionContext["modelRegistry"], "getProviderAuth">,
+  registry: Pick<ExtensionContext["modelRegistry"], "getProviderAuth"> &
+    Partial<Pick<ExtensionContext["modelRegistry"], "getProvider">>,
+  settings?: ImageSettings,
 ): Promise<ImageAuth> {
-  if (!hasSubscription()) throw new Error(OFF_WARNING + " Use /login openai-codex, then /reload.");
+  if (settings && "apiKey" in settings) return { apiKey: settings.apiKey };
+  const provider = settings?.provider ?? PROVIDER;
+  // With no settings, preserve the subscription-only default (no paid API fallback).
+  if (!settings && !hasSubscription()) throw new Error(OFF_WARNING + " Use /login openai-codex, then /reload.");
 
   // Pi owns token refresh, file locking and persistence. Never refresh or write auth.json here.
   let resolved;
   try {
-    resolved = await registry.getProviderAuth(PROVIDER);
+    resolved = await registry.getProviderAuth(provider);
   } catch {
-    throw new Error("Could not refresh the openai-codex login. Use /login openai-codex, then /reload.");
+    throw new Error(`Could not refresh or resolve the ${provider} login. Use /login ${provider}, then /reload.`);
   }
-  const credential = readStoredCredential(PROVIDER);
+  const credential = readStoredCredential(provider);
   const accessToken = resolved?.auth.apiKey;
-  // Reject environment/API-key fallbacks and provider overrides that changed the credential.
-  if (credential?.type !== "oauth" || !accessToken || accessToken !== credential.access) {
-    throw new Error("Image generation requires the stored openai-codex subscription login, not an API key or override.");
+  if (!accessToken) throw new Error(offWarning(settings) + ` Use /login ${provider}, then /reload.`);
+  if (settings) {
+    // A provider name is not proof that its secret belongs to OpenAI. Never send another
+    // service's credentials to our fixed endpoints, even if the user selects it by mistake.
+    const baseUrl = resolved?.auth.baseUrl ?? registry.getProvider?.(provider)?.baseUrl;
+    let origin: string | undefined;
+    try { origin = baseUrl ? new URL(baseUrl).origin : undefined; } catch { /* reject below */ }
+    const expectedOrigin = credential?.type === "oauth" ? "https://chatgpt.com" : "https://api.openai.com";
+    if (origin !== expectedOrigin) {
+      throw new Error(`The ${provider} provider is not configured for a supported OpenAI endpoint. Select an OpenAI provider or set apiKey explicitly.`);
+    }
+    if (credential?.type !== "oauth") return { apiKey: accessToken };
+  }
+
+  // Reject environment/API-key overrides of a subscription credential, including named aliases.
+  if (credential?.type !== "oauth" || accessToken !== credential.access) {
+    throw new Error(`Image generation requires the stored ${provider} subscription login, not an API key or override.`);
   }
   const accountId = accountIdFromToken(accessToken) ??
-    (typeof credential.accountId === "string" ? credential.accountId : undefined);
-  if (!accountId) throw new Error("The openai-codex login has no account ID. Please log in again.");
+    (typeof credential.accountId === "string" && credential.accountId.length > 0 ? credential.accountId : undefined);
+  if (!accountId) throw new Error(`The ${provider} login has no account ID. Please log in again.`);
   return { accessToken, accountId };
 }

package/src/backend.ts

@@ -4,6 +4,7 @@ import type { ImageAuth } from "./auth.ts";
 
 export const IMAGE_MODEL = "gpt-image-2";
 const BASE_URL = "https://chatgpt.com/backend-api/codex";
+const API_BASE_URL = "https://api.openai.com/v1";
 export const MAX_IMAGE_BYTES = 32 * 1024 * 1024;
 const MAX_RESPONSE_BYTES = 48 * 1024 * 1024;
 
@@ -70,6 +71,23 @@ export function decodePng(base64: unknown): Buffer {
   return bytes;
 }
 
+function editForm(fields: Record<string, string>, images: string[]): FormData {
+  const form = new FormData();
+  for (const [name, value] of Object.entries(fields)) form.append(name, value);
+  for (const [index, image] of images.entries()) {
+    // loadReferences supplies bounded data URLs; never fetch a reference URL with credentials.
+    const match = /^data:(image\/(png|jpeg|webp));base64,([A-Za-z0-9+/]+={0,2})$/.exec(image);
+    if (!match || match[3].length % 4 !== 0 || match[3].length > Math.ceil(MAX_IMAGE_BYTES / 3) * 4) {
+      throw new Error("Reference images must be bounded PNG, JPEG, or WebP data URLs.");
+    }
+    const bytes = Buffer.from(match[3], "base64");
+    if (bytes.length > MAX_IMAGE_BYTES) throw new Error("Reference image exceeds the size limit.");
+    const extension = match[2] === "jpeg" ? "jpg" : match[2];
+    form.append("image[]", new Blob([new Uint8Array(bytes)], { type: match[1] }), `reference-${index + 1}.${extension}`);
+  }
+  return form;
+}
+
 export async function requestImage(
   auth: ImageAuth,
   request: ImageRequest,
@@ -78,28 +96,43 @@ export async function requestImage(
 ): Promise<GeneratedImage> {
   signal.throwIfAborted();
   const editing = !!request.images?.length;
+  const apiKeyAuth = "apiKey" in auth;
+  const fields = {
+    model: IMAGE_MODEL,
+    prompt: request.prompt,
+    background: "auto",
+    quality: "auto",
+    size: "auto",
+    ...(apiKeyAuth ? { output_format: "png" } : {}),
+  };
+  const headers: Record<string, string> = apiKeyAuth ? {
+    Authorization: `Bearer ${auth.apiKey}`,
+  } : {
+    Authorization: `Bearer ${auth.accessToken}`,
+    "ChatGPT-Account-ID": auth.accountId,
+    originator: "pi-image-generation",
+    "x-codex-image-turn-id": randomUUID(),
+  };
+  let requestBody: string | FormData;
+  if (apiKeyAuth && editing) {
+    requestBody = editForm(fields, request.images!);
+    // fetch supplies the multipart boundary; do not set Content-Type here.
+  } else {
+    headers["Content-Type"] = "application/json";
+    requestBody = JSON.stringify({
+      ...fields,
+      ...(editing ? { images: request.images!.map(image_url => ({ image_url })) } : {}),
+    });
+  }
   let response: Response;
   try {
-    response = await fetcher(`${BASE_URL}/images/${editing ? "edits" : "generations"}`, {
+    response = await fetcher(`${apiKeyAuth ? API_BASE_URL : BASE_URL}/images/${editing ? "edits" : "generations"}`, {
       method: "POST",
-      // Never follow a redirect with a subscription credential.
+      // Never follow a redirect with either kind of credential.
       redirect: "error",
       signal,
-      headers: {
-        Authorization: `Bearer ${auth.accessToken}`,
-        "ChatGPT-Account-ID": auth.accountId,
-        "Content-Type": "application/json",
-        originator: "pi-image-generation",
-        "x-codex-image-turn-id": randomUUID(),
-      },
-      body: JSON.stringify({
-        model: IMAGE_MODEL,
-        prompt: request.prompt,
-        background: "auto",
-        quality: "auto",
-        size: "auto",
-        ...(editing ? { images: request.images!.map(image_url => ({ image_url })) } : {}),
-      }),
+      headers,
+      body: requestBody,
     });
   } catch {
     signal.throwIfAborted();
@@ -108,12 +141,12 @@ export async function requestImage(
 
   if (!response.ok) {
     // Do not echo upstream bodies, prompts, account IDs or auth headers into the session.
-    await response.body?.cancel();
+    await response.body?.cancel().catch(() => {});
     const hints: Record<number, string> = {
       400: "The backend rejected the image request. Check the prompt and reference images.",
-      401: "The subscription login was rejected. Use /login openai-codex, then /reload.",
+      401: "The image credential was rejected. Check your provider login or API-key settings, then /reload.",
       403: "Image generation is not permitted for this account or request.",
-      404: "The subscription image endpoint is unavailable.",
+      404: "The image endpoint is unavailable.",
       429: "The image allowance or rate limit was reached. Wait before trying again.",
     };
     throw new Error(`Image generation failed (HTTP ${response.status}). ${hints[response.status] ?? "No automatic retry was made; try again later."}`);

package/src/index.ts

@@ -1,7 +1,8 @@
 import { fileURLToPath } from "node:url";
 import { Type } from "typebox";
-import { resizeImage, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { hasSubscription, OFF_WARNING, resolveImageAuth } from "./auth.ts";
+import { resizeImage, type ExtensionAPI, type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
+import { hasImageAuth, offWarning, resolveImageAuth } from "./auth.ts";
+import { loadImageSettings } from "./settings.ts";
 import { IMAGE_MODEL, requestImage } from "./backend.ts";
 import { loadReferences, prepareOutput, saveImage } from "./images.ts";
 
@@ -34,23 +35,39 @@ async function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T
 }
 
 export default function imageGeneration(pi: ExtensionAPI): void {
-  if (!hasSubscription()) {
-    pi.on("session_start", (_event, ctx) => {
-      if (ctx.hasUI) ctx.ui.notify(OFF_WARNING, "warning");
-      else console.error(OFF_WARNING);
-    });
-    return;
-  }
+  const settingsFor = (ctx: ExtensionContext) => loadImageSettings(ctx.cwd, ctx.isProjectTrusted());
+  let registered = false;
+  // Wait for the session cwd, trust decision and custom provider registrations.
+  pi.on("session_start", async (_event, ctx) => {
+    try {
+      const settings = await settingsFor(ctx);
+      if (!hasImageAuth(settings, ctx.modelRegistry)) throw new Error(offWarning(settings));
+      if (!registered) {
+        pi.registerTool(tool);
+        registered = true;
+      }
+    } catch (error) {
+      const message = (error as Error).message;
+      if (ctx.hasUI) ctx.ui.notify(message, "warning");
+      else console.error(message);
+    }
+  });
 
-  // Not listed in the package's static skill manifest, so it cannot leak into unauthenticated sessions.
-  pi.on("resources_discover", () => ({
-    skillPaths: hasSubscription() ? [fileURLToPath(new URL("../resources/imagegen/SKILL.md", import.meta.url))] : [],
-  }));
+  // Not listed in the static manifest, so it cannot leak into unauthenticated sessions.
+  pi.on("resources_discover", async (_event, ctx) => {
+    try {
+      const settings = await settingsFor(ctx);
+      return { skillPaths: registered && hasImageAuth(settings, ctx.modelRegistry)
+        ? [fileURLToPath(new URL("../resources/imagegen/SKILL.md", import.meta.url))] : [] };
+    } catch {
+      return { skillPaths: [] };
+    }
+  });
 
-  pi.registerTool({
+  const tool: ToolDefinition<typeof parameters> = {
     name: "image_gen",
     label: "Generate image",
-    description: "Generate or edit one raster image using the configured Codex subscription. Accepts up to five local or recent-conversation reference images for consistent edits and variants. Saves a new PNG and returns a preview when possible. No API-key fallback. Reference limits: 32 MiB each, 50 MiB combined; 4-minute request timeout. Load the imagegen skill first.",
+    description: "Generate or edit one raster image using the configured OpenAI provider or API key. Accepts up to five local or recent-conversation reference images for consistent edits and variants. Saves a new PNG and returns a preview when possible. Uses openai-codex by default; credentials can be overridden in pi-image-generation-settings.json. Reference limits: 32 MiB each, 50 MiB combined; 4-minute request timeout. Load the imagegen skill first.",
     promptSnippet: "Generate images or edit them using local or recent image references",
     promptGuidelines: [
       "Before using image_gen, read the imagegen skill. Reuse reference images and state what must remain unchanged for consistent edits.",
@@ -62,11 +79,12 @@ export default function imageGeneration(pi: ExtensionAPI): void {
       const requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
       requestSignal.throwIfAborted();
       if (!args.prompt.trim()) throw new Error("The image prompt must not be blank.");
-      if (!hasSubscription()) throw new Error(OFF_WARNING + " Use /login openai-codex, then /reload.");
+      const settings = await settingsFor(ctx);
+      if (!hasImageAuth(settings, ctx.modelRegistry)) throw new Error(offWarning(settings) + " Check your image generation settings and login, then /reload.");
       const path = await prepareOutput(ctx.cwd, args.output_path);
       const images = await loadReferences(args.referenced_image_paths, args.num_last_images_to_include,
         ctx.sessionManager.getBranch(), ctx.cwd, requestSignal);
-      const auth = await abortable(resolveImageAuth(ctx.modelRegistry), requestSignal);
+      const auth = await abortable(resolveImageAuth(ctx.modelRegistry, settings), requestSignal);
       onUpdate?.({ content: [{ type: "text", text: images.length ? "Editing image…" : "Generating image…" }], details: {} });
 
       let result;
@@ -109,5 +127,5 @@ export default function imageGeneration(pi: ExtensionAPI): void {
         },
       };
     },
-  });
+  };
 }

package/src/settings.ts

@@ -0,0 +1,42 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { CONFIG_DIR_NAME, getAgentDir } from "@earendil-works/pi-coding-agent";
+
+export const SETTINGS_FILE = "pi-image-generation-settings.json";
+export type ImageSettings = { provider: string } | { apiKey: string };
+
+// Select a whole file, not a field merge: a local provider must not inherit a global API key.
+export async function loadImageSettings(cwd: string, projectTrusted: boolean): Promise<ImageSettings | undefined> {
+  const paths = [
+    ...(projectTrusted ? [join(cwd, CONFIG_DIR_NAME, "agent", SETTINGS_FILE), join(cwd, CONFIG_DIR_NAME, SETTINGS_FILE)] : []),
+    join(getAgentDir(), SETTINGS_FILE),
+  ];
+  for (const path of paths) {
+    let text: string;
+    try {
+      text = await readFile(path, "utf8");
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
+      throw new Error(`Cannot read image generation settings: ${path}`);
+    }
+    let value: unknown;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      // JSON parser errors can contain the API key. Never include them in diagnostics.
+      throw new Error(`Invalid JSON in image generation settings: ${path}`);
+    }
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const entries = Object.entries(value);
+      if (entries.length === 1) {
+        const [key, raw] = entries[0];
+        if (typeof raw === "string" && raw.trim()) {
+          if (key === "provider") return { provider: raw.trim() };
+          if (key === "apiKey") return { apiKey: raw.trim() };
+        }
+      }
+    }
+    throw new Error(`Image generation settings must contain exactly one non-empty string: provider or apiKey (${path}).`);
+  }
+  return undefined;
+}