Findings

• [Major] Hardcoded UI values in the new ChatGPT login badge violate the token-only UI constraint and will be hard to keep visually consistent across themes, evidence apps/desktop/src/renderer/src/components/ChatgptLoginCard.tsx:153.
  Suggested fix:

  <span className="inline-flex items-center gap-[var(--space-1)] px-[var(--space-1_5)] py-[var(--space-0_5)] rounded-full border border-[var(--color-accent)] text-[var(--color-accent)] bg-transparent text-[var(--font-size-badge)] font-medium leading-none">
    <Sparkles className="w-[var(--icon-xs)] h-[var(--icon-xs)]" />
  </span>

• [Major] New helper intentionally swallows non-codex credential read failures and returns an empty key, which is a silent fallback (policy says errors must surface or throw with context), evidence apps/desktop/src/main/resolve-api-key.ts:41 and lock-in test apps/desktop/src/main/resolve-api-key.test.ts:78.
  Suggested fix:

  try {
    return deps.getApiKeyForProvider(providerId);
  } catch (err) {
    throw new CodesignError(
      `Failed to read API key for provider "${providerId}"`,
      ERROR_CODES.PROVIDER_AUTH_MISSING,
      { cause: err },
    );
  }

Summary

• Review mode: initial
• 2 issues found (2 Major), both on added/modified lines.
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs in this checkout.

Testing

• Not run (automation)

open-codesign Bot

Findings

• [Major] Hardcoded UI values in the new ChatGPT login badge violate the token-only UI constraint and will drift from theme/system scales, evidence apps/desktop/src/renderer/src/components/ChatgptLoginCard.tsx:153.
  Suggested fix:

  <span className="inline-flex items-center gap-[var(--space-1)] px-[var(--space-1_5)] py-[var(--space-0_5)] rounded-full border border-[var(--color-accent)] text-[var(--color-accent)] bg-transparent text-[var(--font-size-badge)] font-medium leading-none">
    <Sparkles className="w-[var(--icon-xs)] h-[var(--icon-xs)]" />
    {t('settings.providers.chatgptLogin.loggedInBadge')}
  </span>

• [Major] resolveActiveApiKey silently swallows non-codex credential read failures and returns an empty key, which violates the no-silent-fallback constraint and hides keychain/config errors, evidence apps/desktop/src/main/resolve-api-key.ts:41.
  Suggested fix:

  try {
    return deps.getApiKeyForProvider(providerId);
  } catch (err) {
    throw new CodesignError(
      `Failed to read API key for provider "${providerId}"`,
      ERROR_CODES.PROVIDER_AUTH_MISSING,
      { cause: err },
    );
  }

Summary

• Review mode: follow-up after new commits
• 2 issues found (2 Major), both on added/modified lines in this head.
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.

Testing

• Not run (automation)

open-codesign Bot

Findings

• [Major] Keyless providers regress to hard failure because PROVIDER_KEY_MISSING is no longer swallowed in the new keyless path. resolveActiveApiKey now passes through existing CodesignErrors (including PROVIDER_KEY_MISSING from onboarding), but resolveApiKeyForActive only swallows PROVIDER_AUTH_MISSING; this breaks requiresApiKey: false providers on generate/apply/title despite allowKeyless=true, evidence apps/desktop/src/main/index.ts:187, apps/desktop/src/main/resolve-api-key.ts:49, apps/desktop/src/main/onboarding-ipc.ts:150.
  Suggested fix:

  // apps/desktop/src/main/index.ts
  if (
    allowKeyless &&
    providerId !== CHATGPT_CODEX_PROVIDER_ID &&
    err instanceof CodesignError &&
    (err.code === ERROR_CODES.PROVIDER_AUTH_MISSING ||
      err.code === ERROR_CODES.PROVIDER_KEY_MISSING)
  ) {
    return '';
  }

Summary

• Review mode: follow-up after new commits
• 1 issue found (1 Major).
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.
• Residual risk: no regression test currently asserts keyless providers still proceed when secret lookup throws PROVIDER_KEY_MISSING.

Testing

• Not run (automation)

open-codesign Bot

Findings

• [Major] Keyless providers still fail hard on missing stored secret — resolveActiveApiKey now preserves CodesignError(PROVIDER_KEY_MISSING), but keyless fallback in resolveApiKeyForActive only swallows PROVIDER_AUTH_MISSING; providers with requiresApiKey: false can regress from keyless flow to blocking error, evidence apps/desktop/src/main/index.ts:187, apps/desktop/src/main/resolve-api-key.ts:49, apps/desktop/src/main/onboarding-ipc.ts:148.
  Suggested fix:

  if (
    allowKeyless &&
    providerId !== CHATGPT_CODEX_PROVIDER_ID &&
    err instanceof CodesignError &&
    (err.code === ERROR_CODES.PROVIDER_AUTH_MISSING ||
      err.code === ERROR_CODES.PROVIDER_KEY_MISSING)
  ) {
    return '';
  }

Summary

• Review mode: follow-up after new commits
• 1 issue found (1 Major).
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.
• Residual risk/testing gap: no integration test in this PR asserts that requiresApiKey: false providers continue with empty bearer when secret lookup throws PROVIDER_KEY_MISSING.

Testing

• Not run (automation)

open-codesign Bot

Findings

• [Major] Silent fallback hides ChatGPT OAuth status failures — the status bootstrap catch path suppresses the error and renders a logged-out state, so auth/backend failures are not surfaced to users and violate the no-silent-fallback constraint, evidence apps/desktop/src/renderer/src/components/ChatgptLoginCard.tsx:105.
  Suggested fix:

  useEffect(() => {
    if (!window.codesign) return;
    void window.codesign.codexOAuth
      .status()
      .then((s) => {
        if (mountedRef.current) setStatus(s);
      })
      .catch((err) => {
        if (mountedRef.current) setStatus(null);
        pushToast({
          variant: 'error',
          title: t('settings.providers.chatgptLogin.statusFailedTitle'),
          description: err instanceof Error ? err.message : t('settings.providers.chatgptLogin.unknownError'),
        });
      });
  }, [pushToast, t]);

Summary

• Review mode: follow-up after new commits
• 1 issue found (1 Major).
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.

Testing

• Not run (automation). Suggested: add a ChatgptLoginCard unit test asserting a toast is emitted when codexOAuth.status() rejects.

open-codesign Bot

Findings

• [Major] Boot migration failure is silently downgraded to a log warning — this violates the “no silent fallbacks” constraint and can leave stale codex provider config unresolved without any user-visible signal, evidence apps/desktop/src/main/index.ts:1051.
  Suggested fix:

  // Prefer surfacing migration failure to the existing boot error dialog path.
  await migrateStaleCodexEntryIfNeeded();

Summary

• Review mode: follow-up after new commits
• 1 issue found (1 Major).
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.

Testing

• Not run (automation).

open-codesign Bot

Findings

• No issues found in added/modified lines that meet the reporting confidence bar.

Summary

• Review mode: follow-up after new commits
• No new blocker/major/minor issues identified in the latest head diff.
• Previously flagged silent-fallback risk is resolved: boot migration now bubbles failure into the existing boot-error dialog path (apps/desktop/src/main/index.ts:1055).
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.
• Residual risk/testing gap: this PR removes many unit tests in apps/desktop/src/renderer/src/components/Settings.test.ts while inlining banner-branch logic in Settings.tsx, so those branches now rely more on integration behavior than direct unit coverage.

Testing

• Not run (automation).

open-codesign Bot