Built-in image_gen succeeds but never writes the PNG to disk in the CLI (regression in 0.140.0, works in 0.139.0)

What happened

When I use the built-in image_gen tool from the Codex CLI (codex / codex exec), the image is generated successfully — the base64 PNG is present in the session rollout — but no file is ever written to disk:

• Nothing is saved to ~/.codex/generated_images/<session-id>/
• Nothing is saved to the current working directory (CWD) either, despite the CWD-saving behavior added in #13607

The generated image only exists as the result base64 blob inside the rollout JSONL at
~/.codex/sessions/<date>/rollout-*.jsonl.

The same prompt run through the VSCode / IDE extension does save the file to
~/.codex/generated_images/<session-id>/ig_<image-id>.png, so this is specific to the CLI code path.

Because the file is never written, the agent sometimes "compensates" by hand-drawing a fake placeholder image with PIL and reporting that as the result, which is misleading.

Environment

• codex-cli 0.140.0 (current latest stable, released 2026-06-15)
• Platform: Linux x86_64 (musl binary)
• Auth: ChatGPT sign-in (no OPENAI_API_KEY); built-in image_gen tool, not the CLI fallback scripts/image_gen.py
• CODEX_HOME = default ~/.codex

Steps to reproduce

mkdir -p /tmp/cxtest && cd /tmp/cxtest
codex exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check -C /tmp/cxtest \
  "Use only the built-in image_gen tool to generate a picture of a red apple. Do not draw it with PIL. Just generate and stop."

# Result:
ls /tmp/cxtest                                   # empty — nothing saved to CWD
ls ~/.codex/generated_images/<this-session-id>/  # no such directory — nothing saved there

# But the image IS in the rollout:
grep -o '"type":"image_generation_call".\{0,80\}' \
  ~/.codex/sessions/$(date +%Y/%m/%d)/rollout-*<session-id>*.jsonl
# -> "type":"image_generation_call",...,"result":"iVBORw0KGgoAAAANSUhEU..."  (valid PNG base64)

Expected

The CLI should persist the generated image to disk (to ~/.codex/generated_images/<session-id>/ and/or CWD per #13607), matching the IDE extension's behavior, and report the real saved path.

Actual

Image generated, base64 present in rollout, but no file written anywhere. Only the IDE extension writes the file.

Notes

• Regression bisected to 0.140.0. I verified by installing the previous stable in isolation:
• 0.139.0 (2026-06-09): built-in image_gen from the CLI does write the PNG to ~/.codex/generated_images/<session-id>/ig_<id>.png (tested with the notify hook disabled via -c 'notify=[]', so this is genuine native behavior, not a workaround).
• 0.140.0 (2026-06-15): same prompt, same flags — nothing is written to disk anywhere.
• Confirmed across multiple prompts (apple, cat, turtle, duck): every time, the base64 is in the rollout but no file lands on disk in 0.140.0.
• Workaround I'm using: a notify hook that parses the rollout after each turn and extracts the image_generation_call base64 into ~/.codex/generated_images/<session-id>/ig_<id>.png. This works reliably, which confirms the data is present and only the disk-write step is missing in the CLI.