feat(chatgpt): add subscription sign-in and Ask Glance

[benvinegar]

What changed

Users can now sign in with ChatGPT and Ask Glance to edit or explain a screenshot using their plan. The AI toolbar button / ⌘K (Ctrl+K on Linux) opens a single compact control row with prompt, model, Run/Stop, and close. Requests such as “pixelate the emails and highlight the error” can inspect the image, crop/resize it, and add or refine editable annotations and backdrops. Completed edits apply together with one Undo; cancellation, failed/incomplete requests, and stale document/account results discard the draft.

This builds on #11 and targets codex/copy-as-ocr. Local Copy as OCR remains the initial OCR choice; signing in or typing a prompt sends no screenshot. Run explicitly sends the annotated image, metadata, and prompt to OpenAI. ChatGPT OCR is a separate opt-in setting.

• Native Rust agent loop uses namespaced local tools with the same published MCP schemas, validation, revision-scoped IDs, and document actions. It retains finalized streamed output items when the terminal response output is empty, replays completed tool results and encrypted reasoning, inspects updated previews, and bounds rounds, calls, image sizes, context, and runtime. Rendering, encoding, inference, and draft edits stay off the UI thread. The tool allowlist excludes uploads, exports, clipboard, imports, and shell commands.
• Compact contrasting controls: account/model dropdowns, reconnect/sign-out icons, two-column OCR source switch, and an account icon grouped with AI at the far right of the toolbar, separated from export and zoom controls. Ask Glance’s model selector opens only the model list above the prompt, with account settings kept separate; it also works while OCR stays on device. Prompt input supports IME, Unicode, selection, clipboard, and its own undo history; a spinner, elapsed time, and the latest tool/round status show while running. Only the latest reply appears below the prompt, without an extra copy button. Repeated plan/upload disclosures and Done/Undo banners are omitted from the UI; image transmission is described in usage documentation.
• Public desktop OAuth registration with stable host identity, ephemeral loopback callback, PKCE, state/nonce checks, signed OIDC verification, renewal/reconnect, account-specific model discovery, first-use connection confirmation, sign-out/revocation, and usage controls. Credentials stay in private local files outside Git, with atomic writes and serialized renewal.
• Shared Ask Glance/account actions, published MCP schema and safe state read-back, plus usage, architecture, QA, and Unreleased changelog updates.

Integration contract: ChatGPT plan usage in open-source apps, including supported tool and state requirements.

Validation

• cargo fmt --check
• cargo clippy --all-targets --locked -- -D warnings
• cargo test --locked: 192 passed, 19 opt-in tests skipped. New synthetic tests cover multi-turn tool execution, reasoning/history replay, revision-scoped IDs, atomic undo/redo, cancel-and-restart worker dispatch, stale operation/account results, partial streams, tool allowlisting, bounds, Unicode prompt input, MCP state, model controls with local OCR, standalone model dropdown placement and Escape dismissal, running activity UI and elapsed state read-back, and minimum-width toolbar layout.
• Isolated GLANCE_CODESIGN_IDENTITY=- ./scripts/bundle.sh debug; installed app untouched.
• Earlier compact native account UI verified on the synthetic practice canvas; account dropdown, accessibility labels, Escape, and toolbar toggle checked. Private account previews stay local. The rebuilt native app also confirms the Ask Glance dropdown opens above the prompt with only model choices.
• Native Ask Glance desktop and eligible-account inference smoke test on the synthetic practice canvas: the requested red box and arrow were applied as editable annotations, with a final answer. A separate temporary live synthetic probe reproduced the empty terminal output bug, then verified a successful tool-result round trip after the fix. No user captures were uploaded; the temporary probe was removed. Automated agent tests remain offline.
• Regression fixtures cover completed streamed items with empty/missing terminal output, reasoning replay, multi-round edits and atomic undo/redo, item ordering, conflicts/duplicates, and failed/interrupted/canceled streams.

Signed synthetic JWT tests cover signature, issuer, audience, expiry, nonce, and malformed/future not-before claims. Callback, token rotation, private storage, stream completion/limits, shared dispatch, stale account jobs, and sign-out clipboard races are covered. Fixtures contain fictional identities and public verification material; temporary private signing material was discarded.

The OAuth implementation uses patched jsonwebtoken 10.4.0 after reviewing GHSA-h395-gr6q-cpjc. Earlier OSV checks on 2026-10-06 found no matching advisories for the selected jsonwebtoken, aws-lc-rs, aws-lc-sys, and fs2 versions. Ask Glance adds no dependencies. OpenAI preview availability and models depend on the selected account.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	fs2@​0.4.3
	jsonwebtoken@​10.4.0

View full report