0.146.0 hides image_generation for Pro accounts until re-login refreshes stale Free plan cache

What version of Codex CLI is running?

codex-cli 0.146.0 installed via npm.

What subscription do you have?

ChatGPT Pro.

Which model were you using?

gpt-5.6-sol

What platform is your computer?

macOS on Apple Silicon (arm64).

What issue are you seeing?

After upgrading from Codex CLI 0.145.0 to 0.146.0, the bundled imagegen skill remained installed and codex features list reported:

image_generation stable true

However, new 0.146.0 sessions did not expose the built-in image_generation tool. The model could discover and read the skill, but correctly reported that the built-in tool was unavailable.

The same ChatGPT account and model had successfully produced built-in image_generation_end events in 0.145.0 sessions through the previous day.

The account state was internally inconsistent before re-login:

• Current session rate-limit metadata repeatedly reported plan_type=pro.
• The cached ChatGPT authentication claim reported chatgpt_plan_type=free.
• The cached subscription check timestamp was stale (2026-05-08).
• codex login status reported normal ChatGPT authentication.
• No API key or custom model provider was involved.

This appears to interact with the new gate added in #34850, which skips registering image_generation when auth_cached().account_plan_type() is Some(PlanType::Free). In this case the cached value was stale and contradicted the current server-side plan metadata, so a Pro account silently lost the tool.

What steps can reproduce the bug?

1. Use a ChatGPT Pro account whose locally cached auth token still carries a stale chatgpt_plan_type=free claim.
2. Upgrade Codex CLI from 0.145.0 to 0.146.0.
3. Confirm image_generation is enabled with codex features list.
4. Start a new CLI session.
5. Invoke $imagegen or request a built-in image generation.
6. Observe that the skill is present but the built-in image tool is not exposed.

Re-login result

A normal browser OAuth refresh with:

codex login

updated the cached claim from free to pro and refreshed the subscription check timestamp.

Immediately afterward, a brand-new Codex CLI 0.146.0 session successfully invoked built-in image generation and saved the generated PNG. This confirms that re-login is an effective workaround and that the missing tool was caused by the stale cached plan gate, not by the feature flag, selected model, provider capability, or image backend.

Device-code login was not available for this account, but normal browser OAuth completed successfully.

What is the expected behavior?

Codex should not silently hide a paid-plan hosted tool solely because a stale cached token says Free while current server metadata identifies the account as Pro.

Possible fixes:

• Refresh or reconcile the cached subscription plan before suppressing the tool.
• Prefer current authoritative account/rate-limit plan state.
• Treat stale or contradictory cached plan state as unknown rather than confirmed Free.
• Surface a diagnostic telling the user to re-authenticate instead of making the tool disappear.

Additional information

• Same visible symptom as #28102, but this report isolates a 0.146.0-specific trigger and verifies the re-login workaround.
• Likely related change: #34850.
• No tokens, account identifiers, or private paths are included in this report.

codex login