pi-codex-image-gen 0.1.13 → 0.1.14

package/CHANGELOG.md

@@ -6,6 +6,18 @@ This project follows the spirit of [Keep a Changelog](https://keepachangelog.com
 
 ## [Unreleased]
 
+## [0.1.14] - 2026-10-02
+
+### Added
+
+- Add package-owned ChatGPT image OAuth through `/login codex-images`, with Pi-managed credential storage and refresh. Keep chat on any provider, including `openai`, without installing Codex or importing Pi's legacy OAuth helpers.
+
+### Fixed
+
+- Keep image authentication separate from the unsupported `openai` plan-sharing image route. Preserve available legacy Pi `openai-codex` credentials as a fallback when package-owned image credentials are absent.
+- Keep OAuth refresh errors private and avoid switching accounts after a selected OAuth failure.
+- Keep manual-login guidance visible when the local callback port is occupied.
+
 ## [0.1.13] - 2026-09-11
 
 ### Added

package/CONTRIBUTING.md

@@ -22,7 +22,7 @@ pi install -l /path/to/pi-mono/packages/pi-codex-image-gen
 pi
 ```
 
-Then run `/login` for `openai-codex` and ask Pi to generate an image.
+With Pi 0.85.1 or later, run `/login codex-images`, complete the ChatGPT browser login, and ask Pi to generate an image. Chat can stay on `openai` OAuth. Neither the Codex app nor Pi's legacy OAuth helpers are required.
 
 For a one-off run without changing settings:
 
@@ -44,6 +44,14 @@ The vendored CLI changes for Images 2.5 cover documented quality and flexible si
 
 Optional live smoke test (requires explicit approval to use image quota): load this checkout with `pi -e`, generate one PNG, and edit it using `referencedImagePaths`. Verify inline display and saved bytes. Confirm that progress and the final summary do not invent an image model, and that `backendImageModel` is `"unknown"` unless the backend explicitly reports one. Verify `reportedImage` size/quality/background against the response, then inspect actual pixels for dimensions and alpha. A successful image does not prove which backend model ran. Never include credentials or raw image payloads in test reports.
 
+For auth compatibility, run the smoke test with `/login codex-images` while chat uses `openai` OAuth. Verify the provider appears in `/login`, not `/model`, and that Pi persists the image credential under its own ID. Check `details.provider: "codex-images"` and `details.transport: "codex-responses"`. If legacy Pi `openai-codex` is available, test it separately without owned image credentials; it should report `openai-codex` / `codex-responses`. With both logins, owned image OAuth wins. A selected auth failure must not switch accounts. With only chat OAuth or an API key, the tool must ask for `/login codex-images` before any image request.
+
+Test `/logout codex-images` without changing the chat login. On a remote/headless machine, test the full-redirect-URL fallback and callback-port conflicts. Never paste a callback into chat. Automated tests exercise actual provider registration, Pi login/storage/logout, PKCE/state, loopback/manual callbacks, cancellation, concurrent refresh, and image tool wiring using mocked token/image responses. They do not prove that a fresh live browser grant or a particular account supports the image endpoint.
+
+On October 2, 2026, the maintainer reported that the package-owned flow worked in a live smoke test. This is a user-confirmed result, not automated verification of every account or of the served image model.
+
+On October 2, 2026, live diagnostics with new `openai` plan-sharing OAuth rejected Responses image tools with `subscription_sharing_unsupported_capability`, and direct Images calls with `hardened_oauth_rule_missing`. OpenAI's [preview limitations](https://developers.openai.com/siwc/token-sharing-open-source/preview-limitations) list image generation as unsupported. The same chat grant could call a local image function; separate image-capable Codex OAuth produced verified PNGs through both native Images and Codex Responses endpoints. These probes established the grant distinction, not a live test of this package-owned browser login.
+
 ## Subscription capability check
 
 Checked on September 11, 2026, with a ChatGPT subscription token and no API-key billing. These observations are account- and date-specific, not a public API guarantee.
@@ -83,7 +91,7 @@ Before opening a pull request:
 - Treat save-mode names, config file keys, and auth flow as public interface; changes to defaults or precedence are breaking changes.
 - Do not modify `skills/imagegen/scripts/image_gen.py` without a documented reason; it is a vendored fallback.
 - The Codex Responses SSE contract is private and may change. If generation breaks, inspect sanitized event types, status codes, and allowlisted output metadata. Never log raw response bodies or auth headers.
-- Avoid requiring `OPENAI_API_KEY` for the normal Pi tool path; auth piggybacks on Pi's `openai-codex` login.
+- Keep the Pi tool subscription-only: prefer package-owned `codex-images` OAuth, preserve available legacy Pi `openai-codex` support, and never use the `openai` chat token, Codex app credentials, or `OPENAI_API_KEY` for tool requests.
 
 ## Code of conduct
 

package/README.md

@@ -2,14 +2,14 @@
 
 Create and edit images without leaving [Pi](https://pi.dev).
 
-`pi-codex-image-gen` turns natural-language requests and reference images into PNG, JPEG, or WebP assets through **Codex image generation**, using your existing ChatGPT Codex login instead of a separate API key.
+`pi-codex-image-gen` turns natural-language requests and reference images into PNG, JPEG, or WebP assets through **ChatGPT subscription image generation**. Sign in from Pi; no Codex app or separate API key is required.
 
 ## Features
 
 - **Generate images in conversation** — describe the asset you need and let Pi create it.
 - **Edit from references** — transform up to five local or recent conversation images.
 - **Save where work happens** — return images inline or organize them by project, session, or custom directory.
-- **No separate API setup** — reuse your existing ChatGPT Plus/Pro Codex authentication.
+- **Separate image login** — keep Pi chat on `openai` OAuth while the extension handles image authentication.
 
 ## Install
 
@@ -49,7 +49,7 @@ The tool reports generation stages and the backend's returned size, quality, bac
 
 ### Subscription reliability and limits
 
-- Requests identify this package with a Pi User-Agent. There is no Codex impersonation, browser-cookie import, or paid API fallback.
+- Requests identify this package with a Pi User-Agent. The image login uses the Codex-compatible public OAuth client; it does not launch the Codex app, read its credentials, import browser cookies, or fall back to paid API calls.
 - One five-minute network deadline covers the connection, retries, and stream. Escape cancels network work; the remote generation may still finish.
 - Prompts: 32,000 characters. References: five regular PNG/JPEG/WebP files or conversation images, at most 20 MiB each and 50 MiB combined.
 - Responses: 100 MiB total, with at most one 32 MiB decoded output image. Base64 and format signatures are checked; this is not a full image decoder. Backend text and revised prompts are limited to 4,000 characters; HTTP error bodies are read only up to 16 KiB and are not displayed.
@@ -69,13 +69,21 @@ In subscription tests on September 11, 2026, the direct endpoint accepted Flare,
 
 ## Authentication
 
-Uses your existing **openai-codex** login — no `OPENAI_API_KEY` required. If you haven't logged in yet:
+The extension owns an image-capable ChatGPT OAuth flow, registered as **Codex Images** (`codex-images`). Pi stores its credentials and handles refresh. Your chat provider can remain `openai`; image authentication is independent.
 
 ```
-> /login
+> /login codex-images
 ```
 
-Select **ChatGPT Plus/Pro (Codex)** and complete the OAuth flow.
+Complete the browser login with your ChatGPT account. You can also run `/login` and select **Codex Images (ChatGPT subscription)**. The browser redirects to `http://localhost:1455/auth/callback`. If the callback cannot reach Pi, paste the **full redirect URL** into Pi's login prompt, not into chat. Login expires after ten minutes.
+
+Use Pi 0.85.1 or later. Pi stores the `codex-images` credential in its agent auth store (normally `~/.pi/agent/auth.json`). `/logout codex-images` removes that credential without changing your chat login. No credential files are created by the extension itself.
+
+The package implements the Codex-compatible OAuth protocol itself. It neither imports Pi's `openai-codex` OAuth helpers nor requires the Codex app or its credential store. It still depends on OpenAI continuing to accept that public OAuth client and private image endpoint; this is not a new OAuth application registered with OpenAI.
+
+Existing Pi `openai-codex` credentials remain a compatibility fallback when `codex-images` credentials are absent and the legacy provider is available. With both image logins, `codex-images` wins. A selected login that fails to refresh or generate does not switch to another account.
+
+Both image logins use `https://chatgpt.com/backend-api/codex/responses`. Pi's new `openai` plan-sharing OAuth grant is different and [does not support image generation](https://developers.openai.com/siwc/token-sharing-open-source/preview-limitations). The extension never sends that chat token to the Codex backend. API keys do **not** enable this tool or API-key billing.
 
 ## Configuration
 
@@ -136,8 +144,8 @@ Project config overrides global config only when project trust is active. If pro
 
 ## How it works
 
-1. Resolves auth via Pi's `openai-codex` provider (ChatGPT session token).
-2. Sends a Codex Responses API request to the routing model (default `gpt-5.5`) with the `image_generation` tool enabled.
+1. Resolves package-owned `codex-images` OAuth via Pi, or falls back to available legacy Pi `openai-codex` OAuth.
+2. Sends a request to the Codex Responses endpoint and routing model (default `gpt-5.5`) with the `image_generation` tool enabled.
 3. For edits, attaches the selected local or conversation images to the request.
 4. The backend selects an image model to generate or edit the image.
 5. Parses the SSE stream and strictly validates the returned base64 and image format.
@@ -148,8 +156,8 @@ Project config overrides global config only when project trust is active. If pro
 
 | Symptom | Cause | Fix |
 | --- | --- | --- |
-| "Missing openai-codex credentials" | Not logged in | Run `/login` and select **ChatGPT Plus/Pro (Codex)** |
-| 401 / 403 response | Token expired | Re-run `/login` for openai-codex |
+| "Missing image OAuth credentials" | No image-capable subscription login; chat OAuth and API keys are not sufficient | Run `/login codex-images` |
+| 401 / 403 response | Image login rejected or token expired | Re-run `/login codex-images` |
 | 429 response | Rate limited | Wait and retry; the extension retries automatically with backoff |
 | "Codex did not return an image" | Backend refused the prompt | Rephrase the prompt and try again |
 | "save=custom requires saveDir" | Missing config | Set `saveDir` in config or `PI_CODEX_IMAGE_SAVE_DIR` env var |

package/SECURITY.md

@@ -21,9 +21,11 @@ The maintainer will acknowledge reports as soon as practical and coordinate disc
 
 `pi-codex-image-gen` is a Pi package. Pi extensions execute with the same permissions as the local user running Pi. Users should review installed Pi packages and only install packages from sources they trust.
 
-The extension uses Pi's existing `openai-codex` login to obtain a short-lived JWT. The token is used only for requests to the Codex Responses API and is never written to disk or logged. Do not commit API keys, tokens, or decoded JWT payloads.
+The extension implements image-capable ChatGPT OAuth under the provider ID `codex-images`, using the Codex-compatible public OAuth client ID (not a client secret). Pi stores access/refresh tokens in its agent credential store, normally `~/.pi/agent/auth.json`, and coordinates refresh. This is local credential persistence, not encrypted secret storage; protect the agent directory and do not commit it. The extension does not write its own credential files or access the Codex app's credential store. `/logout codex-images` removes only the image login. Existing legacy Pi `openai-codex` OAuth remains a fallback when package-owned credentials are absent; refresh or request failure does not switch accounts.
 
-Subscription requests use the fixed HTTPS `chatgpt.com/backend-api/codex/responses` endpoint with normal TLS validation, an honest package User-Agent, and redirects disabled. The extension does not import browser cookies, change authentication, or switch to API-key billing. Only backend-reported image metadata and allowlisted numeric usage counters are retained; raw HTTP error bodies are not shown. Known request credentials are redacted from backend text.
+Browser login uses random OAuth state and S256 PKCE. Its callback listener binds only to `127.0.0.1:1455`; the registered redirect URI is `http://localhost:1455/auth/callback`. Loopback HTTP is limited to this local callback. Automatic and pasted callbacks must have the expected origin, path, and state. Pasted input must be the full redirect URL, never a bare authorization code. Invalid callbacks cannot finish login. Listener cleanup runs on success, failure, and cancellation. Login has a ten-minute limit; token requests have a 30-second limit and 64 KiB response bound, with no retries or redirects. Do not paste login URLs into chat or log them.
+
+Authorization/token exchange uses fixed `auth.openai.com` HTTPS endpoints with normal TLS validation. Image requests use only `https://chatgpt.com/backend-api/codex/responses`, an honest package User-Agent, and disabled redirects. JWT account claims supply a validated routing header only; OpenAI authenticates the token. The extension does not import browser cookies, use the `openai` plan-sharing chat grant, or switch to API-key billing. Only backend-reported image metadata and allowlisted numeric usage counters are retained; token response bodies, HTTP error bodies, and raw auth-resolution errors are not shown. Known image request credentials are redacted from backend text.
 
 Network work has a five-minute deadline and a 100 MiB response bound. Output images are limited to 32 MiB; input images must be regular files and are limited to 20 MiB each and 50 MiB in total. Image checks validate base64 and format signatures, not all image internals. Treat images as untrusted content when opening them in other software.
 

package/extensions/index.ts

@@ -1,8 +1,8 @@
 /**
  * Project-local Codex image generation extension.
  *
- * Registers `codex_generate_image`, a tool that uses Pi's existing
- * openai-codex ChatGPT/Codex auth to call the Codex Responses backend with the
+ * Registers `codex_generate_image`, a tool that uses package-owned
+ * ChatGPT image OAuth or legacy Pi auth to call the Codex Responses backend with the
  * native `image_generation` tool. The backend selects the image model.
  */
 
@@ -12,16 +12,16 @@ import { mkdir, open, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 import { StringEnum } from "@earendil-works/pi-ai";
-import { CONFIG_DIR_NAME, type ExtensionAPI, getAgentDir, withFileMutationQueue } from "@earendil-works/pi-coding-agent";
+import { CONFIG_DIR_NAME, type ExtensionAPI, type ExtensionContext, getAgentDir, withFileMutationQueue } from "@earendil-works/pi-coding-agent";
 import { type Static, Type } from "typebox";
 import { reportInstallTelemetry } from "../src/install-telemetry.js";
+import { extractImageAccountId, imageAuthProvider, IMAGE_AUTH_PROVIDER } from "../src/image-oauth.js";
 import { abortable, httpFailure, MAX_IMAGE_BYTES, parseCodexSse, withRequestDeadline, type ParsedCodexResponse } from "../src/codex-response.js";
 
 const PACKAGE_NAME = "pi-codex-image-gen";
-const PROVIDER = "openai-codex";
+const LEGACY_PROVIDER = "openai-codex";
 const DEFAULT_MODEL = "gpt-5.5";
 const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
-const JWT_CLAIM_PATH = "https://api.openai.com/auth";
 const DEFAULT_SAVE_MODE = "global";
 const OPENAI_BETA_HEADER = "responses=experimental";
 const MAX_RETRIES = 3;
@@ -135,31 +135,34 @@ interface InputImage {
 	mimeType: string;
 }
 
-// --- JWT helpers ---
+// --- Image credentials (independent of the active chat provider) ---
 
-function decodeJwtPayload(token: string): Record<string, unknown> {
-	const parts = token.split(".");
-	if (parts.length !== 3 || !parts[1]) {
-		throw new Error("OpenAI Codex auth token is not a JWT. Run /login for openai-codex again.");
-	}
-	try {
-		return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8")) as Record<string, unknown>;
-	} catch {
-		throw new Error("Failed to decode OpenAI Codex auth token. Run /login for openai-codex again.");
-	}
+interface ImageAuth {
+	provider: typeof IMAGE_AUTH_PROVIDER | typeof LEGACY_PROVIDER;
+	token: string;
+	accountId: string;
 }
 
-function extractChatGptAccountId(token: string): string {
-	const payload = decodeJwtPayload(token);
-	const authClaims = payload[JWT_CLAIM_PATH];
-	if (!authClaims || typeof authClaims !== "object") {
-		throw new Error("OpenAI Codex auth token does not contain ChatGPT auth claims. Run /login for openai-codex again.");
-	}
-	const accountId = (authClaims as Record<string, unknown>).chatgpt_account_id;
-	if (typeof accountId !== "string" || accountId.length === 0) {
-		throw new Error("OpenAI Codex auth token does not contain chatgpt_account_id. Run /login for openai-codex again.");
+async function resolveImageAuth(registry: ExtensionContext["modelRegistry"]): Promise<ImageAuth> {
+	for (const provider of [IMAGE_AUTH_PROVIDER, LEGACY_PROVIDER] as const) {
+		let token: string | undefined;
+		try {
+			if (typeof registry.getProviderAuth === "function") {
+				const resolved = await registry.getProviderAuth(provider);
+				if (resolved && resolved.source !== "OAuth") {
+					throw new Error("Image credentials must use OAuth.");
+				}
+				token = resolved?.auth.apiKey;
+				if (resolved && !token) throw new Error("Missing image access token.");
+			} else {
+				token = await registry.getApiKeyForProvider(provider);
+			}
+		} catch {
+			throw new Error(`Image authentication failed for ${provider}. Run /login ${IMAGE_AUTH_PROVIDER} again. No alternate account was used.`);
+		}
+		if (token) return { provider, token, accountId: extractImageAccountId(token) };
 	}
-	return accountId;
+	throw new Error(`Missing image OAuth credentials. Run /login ${IMAGE_AUTH_PROVIDER}. Pi's openai plan-sharing OAuth does not support images; API keys and Codex app credentials are not used.`);
 }
 
 // --- #10: try/catch readConfigFile replaces racy existsSync + readFileSync ---
@@ -407,8 +410,7 @@ export function buildRequestBody(
 
 async function requestImage(
 	params: ToolParams,
-	token: string,
-	accountId: string,
+	auth: ImageAuth,
 	model: string,
 	outputFormat: OutputFormat,
 	sessionId: string,
@@ -418,8 +420,8 @@ async function requestImage(
 ): Promise<ParsedCodexResponse> {
 	const body = JSON.stringify(buildRequestBody(params, model, outputFormat, sessionId, inputImages));
 	const headers: Record<string, string> = {
-		Authorization: `Bearer ${token}`,
-		"chatgpt-account-id": accountId,
+		Authorization: `Bearer ${auth.token}`,
+		"chatgpt-account-id": auth.accountId,
 		originator: "pi",
 		"User-Agent": PACKAGE_NAME,
 		"OpenAI-Beta": OPENAI_BETA_HEADER,
@@ -450,7 +452,7 @@ async function requestImage(
 				throw new Error(failure.message);
 			}
 
-			return parseCodexSse(response, signal, [token, accountId], onProgress);
+			return parseCodexSse(response, signal, [auth.token, auth.accountId], onProgress);
 		}
 		throw new Error("Codex image generation request failed after all retries.");
 	});
@@ -460,12 +462,13 @@ async function requestImage(
 
 export default function codexImageGen(pi: ExtensionAPI) {
 	reportInstallTelemetry();
+	pi.registerProvider(imageAuthProvider);
 
 	pi.registerTool({
 		name: "codex_generate_image",
 		label: "Codex Image",
 		description:
-			"Generate or edit an image with the OpenAI Codex ChatGPT backend built-in image_generation tool. The backend selects the image model. Accepts up to five local or recent conversation images (20 MiB each, 50 MiB total). Uses the existing openai-codex login; does not require OPENAI_API_KEY. Network deadline: 5 minutes; output image limit: 32 MiB; backend text is limited to 4,000 characters.",
+			"Generate or edit an image with the OpenAI Codex ChatGPT backend built-in image_generation tool. The backend selects the image model. Accepts up to five local or recent conversation images (20 MiB each, 50 MiB total). Requires /login codex-images or existing legacy Pi OAuth credentials; works with openai OAuth chat and does not require the Codex app or an API key. Network deadline: 5 minutes; output image limit: 32 MiB; backend text is limited to 4,000 characters.",
 		promptSnippet: "Generate or edit bitmap images via the OpenAI Codex ChatGPT backend image_generation tool.",
 		promptGuidelines: [
 			"Use codex_generate_image when the user asks to generate or edit a raster image with OpenAI/Codex image generation.",
@@ -491,14 +494,11 @@ export default function codexImageGen(pi: ExtensionAPI) {
 			if (requestedModel.startsWith("gpt-image-")) {
 				throw new Error("The model parameter selects a Codex routing model, not an image model. Subscription image-model selection is not verified.");
 			}
-			const model = ctx.modelRegistry.find(PROVIDER, requestedModel)?.id || requestedModel; // #6: removed dead FALLBACK_MODEL
 			const sessionId = ctx.sessionManager.getSessionId();
 			const saveConfig = resolveSaveConfig(params, ctx.cwd, sessionId, config);
-			const token = await ctx.modelRegistry.getApiKeyForProvider(PROVIDER);
-			if (!token) {
-				throw new Error(`Missing ${PROVIDER} credentials. Run /login and select ChatGPT Plus/Pro (Codex).`);
-			}
-			const accountId = extractChatGptAccountId(token);
+			const auth = await resolveImageAuth(ctx.modelRegistry);
+			const provider = auth.provider;
+			const model = ctx.modelRegistry.find(provider, requestedModel)?.id || requestedModel;
 			const messages: unknown[] = [];
 			for (const entry of ctx.sessionManager.getBranch()) {
 				if (entry.type === "message") messages.push(entry.message);
@@ -507,15 +507,15 @@ export default function codexImageGen(pi: ExtensionAPI) {
 			const inputImages = await resolveInputImages(params, ctx.cwd, messages);
 
 			onUpdate?.({
-				content: [{ type: "text", text: `Requesting image ${inputImages.length > 0 ? "edit" : "generation"} through ${PROVIDER}/${model}...` }],
-				details: { provider: PROVIDER, model, outputFormat, inputImageCount: inputImages.length },
+				content: [{ type: "text", text: `Requesting image ${inputImages.length > 0 ? "edit" : "generation"} through ${provider}/${model}...` }],
+				details: { provider, model, outputFormat, inputImageCount: inputImages.length },
 			});
 
 			const started = Date.now();
-			const parsed = await requestImage(params, token, accountId, model, outputFormat, sessionId, inputImages, signal, (stage) => {
+			const parsed = await requestImage(params, auth, model, outputFormat, sessionId, inputImages, signal, (stage) => {
 				onUpdate?.({
 					content: [{ type: "text", text: `Codex image stage: ${stage}.` }],
-					details: { provider: PROVIDER, model, stage },
+					details: { provider, model, stage },
 				});
 			});
 			if (!parsed.image) {
@@ -534,7 +534,7 @@ export default function codexImageGen(pi: ExtensionAPI) {
 					savedPath = await saveImage(imageBytes, outputFormat, saveConfig.outputDir, parsed.image.id || toolCallId);
 					onUpdate?.({
 						content: [{ type: "text", text: `Image saved to ${savedPath}.` }],
-						details: { provider: PROVIDER, model, savedPath, byteCount: imageBytes.length },
+						details: { provider, model, savedPath, byteCount: imageBytes.length },
 					});
 				} catch (error) {
 					saveWarning = `Image generation succeeded, but the image could not be saved to disk: ${error instanceof Error ? error.message : String(error)}`;
@@ -542,7 +542,7 @@ export default function codexImageGen(pi: ExtensionAPI) {
 			}
 
 			const summary = [
-				`Generated image via ${PROVIDER}/${model} using the backend-selected image model.`,
+				`Generated image via ${provider}/${model} using the backend-selected image model.`,
 				`Status: ${parsed.image.status}.`,
 				reportedImage.size ? `Backend-reported size: ${reportedImage.size}.` : undefined,
 				reportedImage.quality ? `Backend-reported quality: ${reportedImage.quality}.` : undefined,
@@ -560,7 +560,7 @@ export default function codexImageGen(pi: ExtensionAPI) {
 					{ type: "image", data: parsed.image.result, mimeType: mimeForFormat(outputFormat) },
 				],
 				details: {
-					provider: PROVIDER,
+					provider,
 					model,
 					backendImageModel: reportedImage.model ?? "unknown",
 					reportedImage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-codex-image-gen",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Image generation and editing for Pi using your ChatGPT Codex login.",
   "type": "module",
   "license": "Apache-2.0",

package/skills/imagegen/SKILL.md

@@ -26,6 +26,7 @@ Within CLI fallback, the CLI exposes three subcommands:
 
 Rules:
 - Use the Pi `codex_generate_image` tool by default for new image generation requests.
+- Image login is separate from chat: use `/login codex-images` and complete the ChatGPT OAuth flow in Pi. The Codex app is not required. Existing legacy Pi `openai-codex` OAuth can be a fallback; new `openai` plan-sharing chat OAuth cannot generate images. Never ask the user to paste login URLs or tokens into chat.
 - The tool's `model` parameter selects a Codex routing model, not Flare or Sunburst. Do not claim a specific served image model unless the response reports it. Read `details.reportedImage` for backend-reported output settings, then inspect the actual image; prompt requests for quality, dimensions, or transparency are not guarantees.
 - Do not automatically repeat quota, connection, timeout, or incomplete-stream failures. The remote generation may already have consumed quota.
 - Use `referencedImagePaths` for edits when every target has a local path. Use `numLastImagesToInclude` only when a target is available solely in recent conversation history. Never provide both selectors. Masks and advanced CLI-only controls still require confirmed CLI fallback.

package/src/codex-response.ts

@@ -152,7 +152,7 @@ export async function httpFailure(response: Response, signal: AbortSignal): Prom
 	const terminal = isQuota(error)
 		|| error.code === "moderation_blocked" || error.type === "image_generation_user_error";
 	const hint = response.status === 401
-		? "Codex login was rejected. Run /login for openai-codex again."
+		? "Image login was rejected. Run /login codex-images again."
 		: response.status === 403
 			? "Codex access was denied. This can be a connection or account restriction; it does not identify the image model."
 			: errorHint(error);

package/src/image-oauth.ts

@@ -0,0 +1,223 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer, type Server } from "node:http";
+import type { OAuthAuth, OAuthCredential, Provider, ProviderAuthInteraction } from "@earendil-works/pi-ai";
+import { abortable } from "./codex-response.js";
+
+export const IMAGE_AUTH_PROVIDER = "codex-images";
+// Public OAuth client used by the image-capable ChatGPT/Codex flow.
+// This is a client identifier, not a secret. No Codex app or Pi legacy helper is used.
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const REDIRECT_URI = "http://localhost:1455/auth/callback";
+const AUTH_CLAIM = "https://api.openai.com/auth";
+const LOGIN_TIMEOUT_MS = 10 * 60_000;
+const TOKEN_TIMEOUT_MS = 30_000;
+const MAX_TOKEN_RESPONSE_BYTES = 64 * 1024;
+const LOGIN_HINT = `Run /login ${IMAGE_AUTH_PROVIDER} again.`;
+
+class ImageOAuthDeniedError extends Error {
+	constructor() { super(`Image OAuth authorization was denied. ${LOGIN_HINT}`); }
+}
+
+export function extractImageAccountId(token: string): string {
+	try {
+		if (typeof token !== "string" || token.length > MAX_TOKEN_RESPONSE_BYTES
+			|| /[^a-zA-Z0-9_.-]/.test(token)) throw new Error();
+		const parts = token.split(".");
+		if (parts.length !== 3 || parts.some(part => !part)) throw new Error();
+		const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+		const accountId = payload?.[AUTH_CLAIM]?.chatgpt_account_id;
+		if (typeof accountId !== "string" || accountId.length === 0 || accountId.length > 128
+			|| /[^a-zA-Z0-9_-]/.test(accountId)) throw new Error();
+		// Routing hint only: OpenAI, not this client, authenticates the JWT.
+		return accountId;
+	} catch {
+		throw new Error(`Image OAuth token has no valid ChatGPT account ID. ${LOGIN_HINT}`);
+	}
+}
+
+export function parseImageOAuthCallback(input: string, state: string): string {
+	try {
+		if (input.length > 8192) throw new Error();
+		const url = new URL(input.trim());
+		const expected = new URL(REDIRECT_URI);
+		if (url.origin !== expected.origin || url.pathname !== expected.pathname || url.username || url.password || url.hash
+			|| url.searchParams.getAll("state").length !== 1 || url.searchParams.get("state") !== state) throw new Error();
+		if (url.searchParams.has("error")) throw new ImageOAuthDeniedError();
+		const codes = url.searchParams.getAll("code");
+		if (codes.length !== 1 || !codes[0] || codes[0].length > 4096) throw new Error();
+		return codes[0];
+	} catch (error) {
+		if (error instanceof ImageOAuthDeniedError) throw error;
+		throw new Error("Invalid image OAuth callback. Paste the full redirect URL from this login attempt.");
+	}
+}
+
+async function startCallback(state: string): Promise<{ server: Server; code: Promise<string> }> {
+	let settle!: (code: string) => void;
+	let reject!: (error: Error) => void;
+	const code = new Promise<string>((resolve, rejectCode) => { settle = resolve; reject = rejectCode; });
+	void code.catch(() => undefined);
+	let consumed = false;
+	const server = createServer((request, response) => {
+		if (request.method !== "GET" || consumed) {
+			response.writeHead(400).end("Invalid OAuth callback.");
+			return;
+		}
+		try {
+			const value = parseImageOAuthCallback(new URL(request.url ?? "/", REDIRECT_URI).href, state);
+			consumed = true;
+			response.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" })
+				.end("Image login completed. You can close this window.");
+			settle(value);
+		} catch (error) {
+			// Do not reflect a code, state, or arbitrary query text into the page.
+			response.writeHead(400).end("Invalid OAuth callback. Return to Pi and retry.");
+			if (error instanceof ImageOAuthDeniedError) {
+				consumed = true;
+				reject(error);
+			}
+		}
+	});
+	server.headersTimeout = 15_000;
+	server.requestTimeout = 15_000;
+	try {
+		await new Promise<void>((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(1455, "127.0.0.1", () => {
+				server.removeListener("error", reject);
+				resolve();
+			});
+		});
+		server.on("error", () => reject(new Error(`Image OAuth callback failed. ${LOGIN_HINT}`)));
+		return { server, code };
+	} catch {
+		server.close();
+		throw new Error("Image OAuth callback listener is unavailable.");
+	}
+}
+
+async function requestTokens(body: URLSearchParams, signal: AbortSignal): Promise<OAuthCredential> {
+	const deadline = AbortSignal.any([signal, AbortSignal.timeout(TOKEN_TIMEOUT_MS)]);
+	try {
+		const response = await abortable(fetch(TOKEN_URL, {
+			method: "POST", redirect: "error", signal: deadline,
+			headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+			body,
+		}), deadline);
+		if (!response.ok) {
+			void response.body?.cancel().catch(() => undefined);
+			throw new Error();
+		}
+		if (Number(response.headers.get("content-length")) > MAX_TOKEN_RESPONSE_BYTES || !response.body) {
+			void response.body?.cancel().catch(() => undefined);
+			throw new Error();
+		}
+		const reader = response.body.getReader();
+		const blocks: Uint8Array[] = [];
+		let length = 0;
+		try {
+			while (true) {
+				const { done, value } = await abortable(reader.read(), deadline);
+				if (done) break;
+				length += value.byteLength;
+				if (length > MAX_TOKEN_RESPONSE_BYTES) throw new Error();
+				blocks.push(value);
+			}
+		} finally {
+			void reader.cancel().catch(() => undefined);
+			reader.releaseLock();
+		}
+		const data = JSON.parse(Buffer.concat(blocks).toString("utf8"));
+		if (typeof data?.access_token !== "string" || !data.access_token
+			|| typeof data.refresh_token !== "string" || !data.refresh_token
+			|| typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0) throw new Error();
+		const expires = Date.now() + data.expires_in * 1000;
+		if (!Number.isSafeInteger(expires)) throw new Error();
+		const accountId = extractImageAccountId(data.access_token);
+		return { type: "oauth", access: data.access_token, refresh: data.refresh_token, expires, accountId };
+	} catch {
+		// Never expose token responses, refresh tokens, codes, or fetch exceptions.
+		if (signal.aborted) throw new Error("Image OAuth was cancelled.");
+		throw new Error(`Image OAuth token exchange failed. ${LOGIN_HINT}`);
+	}
+}
+
+async function login(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {
+	const deadline = AbortSignal.any([interaction.signal, AbortSignal.timeout(LOGIN_TIMEOUT_MS)]);
+	const manualAbort = new AbortController();
+	let callback: Awaited<ReturnType<typeof startCallback>> | undefined;
+	try {
+		deadline.throwIfAborted();
+		const state = randomBytes(32).toString("base64url");
+		const verifier = randomBytes(32).toString("base64url");
+		const challenge = createHash("sha256").update(verifier).digest("base64url");
+		try {
+			callback = await startCallback(state);
+		} catch {
+			interaction.notify({ type: "info", message: "The local callback port is unavailable. Paste the full redirect URL to finish image login." });
+		}
+		const url = new URL(AUTHORIZE_URL);
+		url.search = new URLSearchParams({
+			response_type: "code", client_id: CLIENT_ID, redirect_uri: REDIRECT_URI,
+			scope: "openid profile email offline_access", state,
+			code_challenge: challenge, code_challenge_method: "S256",
+			id_token_add_organizations: "true", codex_cli_simplified_flow: "true",
+			originator: "pi",
+		}).toString();
+		interaction.notify({
+			type: "auth_url", url: url.href,
+			instructions: "Sign in with ChatGPT for image generation. This is separate from Pi's OpenAI chat login."
+				+ (callback ? "" : " The local callback port is unavailable. Paste the full redirect URL into Pi to finish login."),
+		});
+		const manual = interaction.prompt({
+			type: "manual_code",
+			message: callback ? "Complete image login in your browser, or paste the full redirect URL:"
+				: "The local callback port is unavailable. Paste the full redirect URL:",
+			placeholder: REDIRECT_URI, signal: AbortSignal.any([deadline, manualAbort.signal]),
+		}).then(input => parseImageOAuthCallback(input, state));
+		const code = await abortable(callback ? Promise.race([callback.code, manual]) : manual, deadline);
+		manualAbort.abort();
+		return await requestTokens(new URLSearchParams({
+			grant_type: "authorization_code", client_id: CLIENT_ID, redirect_uri: REDIRECT_URI,
+			code, code_verifier: verifier,
+		}), deadline);
+	} catch (error) {
+		if (deadline.aborted) throw new Error("Image OAuth login was cancelled or timed out.");
+		throw error;
+	} finally {
+		manualAbort.abort();
+		callback?.server.close();
+		callback?.server.closeAllConnections();
+	}
+}
+
+export const imageOAuth: OAuthAuth = {
+	name: "Codex Images (ChatGPT subscription)",
+	isSubscription: true,
+	loginLabel: "Sign in with ChatGPT for images",
+	login,
+	async refresh(credential, signal) {
+		if (typeof credential.refresh !== "string" || !credential.refresh || credential.refresh.length > MAX_TOKEN_RESPONSE_BYTES) {
+			throw new Error(`Missing image OAuth refresh token. ${LOGIN_HINT}`);
+		}
+		return requestTokens(new URLSearchParams({
+			grant_type: "refresh_token", client_id: CLIENT_ID, refresh_token: credential.refresh,
+		}), signal);
+	},
+	async toAuth(credential) {
+		extractImageAccountId(credential.access);
+		return { apiKey: credential.access };
+	},
+};
+
+// Authentication-only provider: no chat models or model-picker entries.
+export const imageAuthProvider: Provider = {
+	id: IMAGE_AUTH_PROVIDER,
+	name: imageOAuth.name,
+	auth: { oauth: imageOAuth },
+	getModels: () => [],
+	stream() { throw new Error("Codex Images is an authentication-only provider. Use codex_generate_image."); },
+	streamSimple() { throw new Error("Codex Images is an authentication-only provider. Use codex_generate_image."); },
+};