[payne0420]

Summary

Two related fixes that together close the gap left when the original ChatGPT Web feature PR (#1593) was integrated via merge commit 50097b1f. After that merge, validation of chatgpt-web accounts silently fell back to the generic OpenAI validator (which 401s on /backend-api/conversation/models) and the registry only exposed a single placeholder model, so Plus users couldn't actually exercise their account against the catalog they pay for.

• Restore validateChatGptWebProvider in src/lib/providers/validation.ts, plus its chatgpt-web entry in SPECIALTY_VALIDATORS. The function was authored on feat/chatgpt-web-provider but lost when the merge resolved a conflict against an older validation.ts. The restored implementation accepts bare values, single key=value pairs, chunked tokens, and full DevTools cookie blobs; uses tlsFetchChatGpt for Cloudflare-bypassing TLS impersonation; and surfaces specific errors for cf-mitigated challenges, expired sessions, missing accessToken, and TLS-client unavailability instead of a generic 401.
• Expand the model catalog from 1 entry to the 13 chat models a Plus account actually has access to (verified live against /backend-api/models). Adds instant / thinking / mini variants for 5.2 / 5.3 / 5.4 / 5.5, plus gpt-5, gpt-5.1, gpt-5-mini, and o3. The MODEL_MAP translates dot-form OmniRoute IDs (e.g. gpt-5.4-thinking-mini) to ChatGPT's exact dash-form slugs (gpt-5-4-t-mini). The previous default gpt-5.3-instant mapping pointed at the auto-routing base gpt-5-3; it now points at the explicit gpt-5-3-instant slug, matching what the UI's last-model-config cookie shows. Excludes research and agent-mode — those are specialty surfaces, not regular chat models.

Files Changed

• src/lib/providers/validation.ts — restored validator + registration (109 LOC).
• open-sse/config/providerRegistry.ts — 13-model catalog.
• open-sse/executors/chatgpt-web.ts — MODEL_MAP for dot-to-dash translation, default repointed to gpt-5-3-instant.
• tests/unit/chatgpt-web.test.ts — extended to cover the new model translation.
• tests/unit/provider-validation-specialty.test.ts — 8 new cases covering the success path and each error branch (cf-mitigated, expired, missing accessToken, TLS unavailable, bare/chunked/blob cookie shapes).

Why this is needed (root cause)

The original chatgpt-web PR ships an executor that uses TLS impersonation and a 2-stage Sentinel handshake. The OAuth-style "OpenAI" validator fetches /v1/models with a plain Bearer token, which:

1. Doesn't impersonate Chrome's TLS fingerprint, so Cloudflare returns a managed challenge.
2. Hits the Bearer-key-API endpoint, not the cookie-authed backend-api namespace ChatGPT Plus actually uses.

Result: every Plus cookie the user pastes returns a misleading "invalid API key" error in the dashboard. Restoring the specialty validator routes through the same TLS-impersonating client the executor already uses and probes the right endpoint.

Test plan

• npm run test:unit -- tests/unit/chatgpt-web.test.ts tests/unit/provider-validation-specialty.test.ts (118/118 pass)
• Live validation against /api/providers/validate with a real Plus cookie
• Live /v1/chat/completions round-trip against the running container, confirming gpt-5-4-t-mini and gpt-5-3-instant both resolve and stream back

Notes for reviewers

• No public API changes; only restores behavior described in the original feature PR.
• The validator's error taxonomy is intentionally specific (cf-mitigated, expired, missing accessToken, TLS unavailable) so the dashboard surfaces actionable messages instead of a generic 401.
• MODEL_MAP is the only translation surface — adding new ChatGPT slugs is a one-line change there.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request expands the chatgpt-web provider by adding a comprehensive catalog of GPT-5.x and o3 models and updating the internal model mapping to use dash-separated slugs. It also introduces a new validateChatGptWebProvider function that utilizes a TLS-impersonating client to validate session cookies against ChatGPT's authentication endpoint, handling various error states and Cloudflare challenges. Corresponding unit tests were added to verify the model registry and the new validation logic. Feedback was provided to improve maintainability by extracting hardcoded strings into constants.

[gemini-code-assist]

For better maintainability and to avoid magic strings, it's a good practice to extract the hardcoded URLs and User-Agent string into constants. This is consistent with how these are handled in other parts of the codebase, for example in open-sse/executors/chatgpt-web.ts.

    // Use the TLS-impersonating client — Cloudflare on chatgpt.com pins
    // cf_clearance to JA3/JA4 + HTTP/2 SETTINGS, so plain Node fetch always
    // gets cf-mitigated: challenge regardless of cookies.
    const { tlsFetchChatGpt, TlsClientUnavailableError } =
      await import("@omniroute/open-sse/services/chatgptTlsClient.ts");

    const CHATGPT_BASE_URL = "https://chatgpt.com";
    const SESSION_URL = `${CHATGPT_BASE_URL}/api/auth/session`;
    const USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.0) Gecko/20100101 Firefox/150.0";

    let response;
    try {
      response = await tlsFetchChatGpt(SESSION_URL, {
        method: "GET",
        headers: applyCustomUserAgent(
          {
            Accept: "application/json",
            "Accept-Language": "en-US,en;q=0.9",
            "Cache-Control": "no-cache",
            Cookie: cookieHeader,
            Origin: CHATGPT_BASE_URL,
            Pragma: "no-cache",
            Referer: `${CHATGPT_BASE_URL}/`,
            "Sec-Fetch-Dest": "empty",
            "Sec-Fetch-Mode": "cors",
            "Sec-Fetch-Site": "same-origin",
            "User-Agent": USER_AGENT,
          },
          providerSpecificData
        ),
        timeoutMs: 30_000,
      });

[payne0420]

Thanks for the suggestion. The executor module legitimately uses these constants because it has many call sites. The validator function uses the URL once and the User-Agent once, so introducing module-scope constants for a single call site adds indirection without a real DRY benefit. If chatgpt.com changes its UA expectations, the executor's UA constant is the load-bearing one — the validator's UA only matters during account validation. Leaving as-is intentionally.

[diegosouzapw]

Thanks @payne0420 for this great contribution! 🎉 It's now officially merged into the release/v3.7.5 branch. It will be part of the next release. We appreciate your effort!