PUP-583: Gate codex-imagegen skill on Codex OAuth, add namespace tags

[thomwebb]

Jira: PUP-583

What

Two related fixes to the built-in codex-imagegen skill (chatgpt_oauth plugin):

1. Proactively hide the skill when Codex OAuth isn't authenticated, instead of only gating the tool it depends on.
2. Add namespace tags to its frontmatter, which it previously had none of.

Why

codex_imagegen (the tool) was already gated on auth via _advertise_imagegen_tool:

def _advertise_imagegen_tool(agent_name: str | None = None) -> list[str]:
    del agent_name
    if not _is_codex_oauth_authenticated():
        return []
    return ["codex_imagegen"]

But codex-imagegen (the skill) was registered unconditionally via _register_imagegen_skill, with no equivalent check. An unauthenticated user could still see the skill in /skills list and the namespace directory, activate_skill it, and get instructions telling the model to call codex_imagegen(...) -- a tool that isn't actually wired into any agent for them. The skill's own content already anticipates this ("If authentication is missing, tell the user to run /codex-auth"), but that's a reactive fallback that only works if the model correctly diagnoses the failed tool call, not a proactive fix.

Separately: the skill had no tags: field at all. Under namespace_skill_search (#713), an untagged skill falls into the generic General namespace alongside every other untagged skill -- exactly the crowded/unhelpful bucket the authoring guide (also from #713/#714) tells skill authors to avoid landing in.

How it works

1. _register_imagegen_skill() now checks _is_codex_oauth_authenticated() before returning the skill registration, mirroring _advertise_imagegen_tool exactly. Logged out -> skill doesn't register at all.
2. refresh_skill_cache() is called from both the login and logout paths so this takes effect immediately instead of requiring a process restart:
   • After /codex-auth / /chatgpt-auth succeeds (alongside the existing set_model_and_reload_agent call).
   • After /codex-logout / /chatgpt-logout, alongside the existing _reload_active_agent() call that already does the equivalent job for tool unbinding.
3. Added tags to IMAGEGEN_SKILL.md: image-generation (first tag -> namespace), codex, gpt-image, artwork.

Testing

• Updated test_imagegen_skill_and_tool_registration to authenticate before asserting the skill registers (previously asserted unconditionally).
• Added test_imagegen_skill_is_not_registered_when_logged_out (mirrors the existing tool-side test of the same name pattern).
• Added test_logout_reloads_agent_to_unbind_imagegen assertion that refresh_skill_cache() is now also called, plus a new test_logout_does_not_refresh_skills_when_already_logged_out to confirm no-op behavior when there was nothing to unbind.
• Added test_auth_command_refreshes_skill_cache for the login path.
• 33/33 tests pass in code_puppy/plugins/chatgpt_oauth/test_plugin.py.
• Broader regression sweep: 235 tests pass across test_plugin_meta.py, test_builtin_plugin_lock.py, test_agent_skills*.py, and test_namespace_skill_search_plugin.py -- no interaction effects with the namespace/skills work in PUP-582: Add namespace_skill_search plugin: model-agnostic namespace + on-demand skill search #713/PUP-581: Split code-puppy-agent skill into topic reference docs, add namespace_skill_search coverage #714.
• ruff check / ruff format --check clean.

Related

Builds on the tag-order guidance from #713's docs/AGENT_SKILLS.md update and #714's code-puppy-agent skill work -- this is Code Puppy's own built-in skill following the advice both of those PRs give to everyone else.