[kfstorm]

Summary

Translate with an eligible ChatGPT subscription using PySubtrans's official OpenAI provider. Create an OpenAI Model Profile with use_chatgpt_plan enabled after authenticating; model discovery and Jobs then use the plan's allowance through the public Responses API. API key authentication remains the default, including when the server inherits OPENAI_USE_CHATGPT_PLAN.

• Pin the published PyPI release PySubtrans 1.7.4, the first release with this integration, and update the lockfile and required CA bundle.
• Identify the application as CueWeaver and isolate PySubtrans configuration under the persistent Work root.
• Add cueweaver-chatgpt administration commands for initialization, local browser sign-in, credential import, local status, and sign-out/revocation.
• Keep OAuth credentials in pysubtrans/chatgpt-auth.json with 0600 permissions inside a 0700 directory. Profiles, Job records, checkpoints, and ordinary API responses contain no OAuth credentials.
• Reuse the existing dynamic Model Profile editor, excluding upstream desktop authentication actions from persisted settings. Missing sessions and unavailable model lists produce actionable errors.

Authentication and Docker

OpenAI's OSS registration flow requires an HTTP callback on 127.0.0.1. In a remote Docker deployment, the browser's loopback address belongs to the browser computer. A normal Web redirect to the container would not implement that flow correctly.

This PR follows OpenAI's self-hosted VM procedure: initialize the server's host identity, sign in locally using CueWeaver, securely transfer the protected credential file over SSH, and import it while preserving the server's own host ID. The server then owns refresh-token rotation. Management commands acquire the server's Work-root lease and require it to be stopped, preventing concurrent credential writes and refreshes.

CueWeaver has no built-in user authentication, so OAuth management stays in the administrator CLI. The Web API exposes read-only credential presence; it cannot start OAuth, import credentials, refresh or revoke tokens, sign out, or replace the account. The README includes local and remote setup commands, Model Profile configuration, volume persistence, sign-out/reset, and plan restrictions.

Web authentication UX

• Add Settings → ChatGPT, next to Model Profiles, with local CLI instructions, a copyable command, Docker/SSH import guidance, recovery steps, and a README link. All new interface text is available in the nine supported locales.
• Add GET /api/chatgpt-auth/status, returning only credentials_present, not_configured, or unavailable with Cache-Control: no-store. It reads the deployment's credential file while the server runs, without taking another lease, writing files, refreshing tokens, or using the network. Missing, malformed, unreadable, and partially written files are handled without exposing credentials or account identifiers.
• Clearly label status as local credential presence. It does not verify remote authorization, account eligibility, or remaining allowance. Users can refresh it independently of the application.
• Make setup discoverable from the Model Profile list and before enabling OpenAI's use_chatgpt_plan. Preserve explicit plan selection when discovery fails. Recognized OAuth and inference HTTP 401 failures direct administrators to ChatGPT setup; unrelated provider failures retain their own feedback. If upstream model discovery hides the underlying exception type, show connectivity and account-access guidance without claiming that authorization has expired.
• Keep dynamic plan feedback below the provider controls so enabling the option does not move the focused control behind mobile navigation.

Upgrade compatibility

• Preserve strict subtitle validation with warnings_as_errors=True, since upstream now separates warnings from errors.
• Update progress/resume tests for upstream's error-aware completion properties. Partially translated batches and batches with saved validation errors are retried; completed checkpoints resume without another inference request.
• Cover the expanded provider registry and retain the Mistral SDK v1 constraint.
• Verify API key inference still uses its own credentials and does not access ChatGPT authentication.
• Document upstream's Gemini option changes: existing profiles should be reviewed and saved to remove obsolete thinking_budget and temperature settings.

Verification

• scripts/test-backend.sh: 491 passed, including credential persistence, host-preserving import, invalid/revoked sessions, read-only status during application operation, transient file failures, profile mode switching, inference authentication feedback, token refresh after restart, a mocked streamed Responses translation with checkpoint/resume, and a Job completing through the ChatGPT-plan path.
• scripts/test-frontend.sh: 200 passed, including status/loading/error states, manual refresh, command copying, setup discovery, explicit plan preservation, API-key profile regressions, and localization invariants.
• scripts/lint-backend.sh --check: passed, including Ruff, mypy, Vulture, dependency boundaries, and Markdown lint.
• scripts/lint-frontend.sh --check: passed, including formatting, ESLint, TypeScript, and production build. Vite reports the existing bundle-size advisory.
• scripts/test-e2e.sh: production Docker image built successfully; 55 passed in the normal phase, then 1 passed in the restart-recovery phase. Includes the real read-only status endpoint and ChatGPT Settings in desktop/mobile route and accessibility checks. The restart-only case is intentionally skipped in the normal phase.
• Agent Browser layout matrix: 442 checks passed, including ChatGPT Settings and plan-mode feedback, Chinese/German, light/dark, responsive widths, and resource states. Manually inspected 1280×800, 390×844, and intermediate-width screenshots, control geometry, keyboard focus, and unavailable/error states; focused controls remain visible after enabling plan mode.
• Container smoke test: the installed cueweaver-chatgpt init command succeeds with a writable Work root.
• Repository-configured jscpd scan: 0 clones, 0% duplication.

OAuth network operations and inference are mocked in the new automated tests. No real ChatGPT credentials or subscription usage were used.

Limitations

• One shared ChatGPT account per trusted deployment; everyone with deployment access can use its allowance. Administration requires stopping the server.
• PySubtrans captures an access token when creating each translation client. An attempt exceeding its token lifetime may need a retry to refresh the token and resume its checkpoint.
• Plan access remains an OpenAI preview, subject to account/workspace eligibility and shared usage limits. It does not cover transcription or unlimited API usage.
• Transferred sessions currently lack host-specific usage attribution and revocation, as documented by OpenAI.