feat: add Chinese UI, Responses models, and mirrored Windows setup

Localize the web console and persist custom model and capability settings.
Use OpenAI Responses exclusively and move runtime limits into environment configuration.
Bootstrap uv and the virtual environment on Windows, support optional China mirrors,
and package source distributions without environments, build output, or credentials.

Update regression tests and repository quality checks for the new behavior.

tests/unit/mcp/test_diagnose_tool.py

@@ -21,6 +21,7 @@ import shutil
 import tempfile
 import time
 from unittest.mock import AsyncMock, MagicMock, patch
+from pydantic import SecretStr
 
 import pytest
 
@@ -108,7 +109,7 @@ def _credentials_metadata() -> dict:
     return {
         "providers": [
             {
-                "provider": "google",
+                "provider": "openai",
                 "label": "Gemini",
                 "masked": "AIza...abcd",
                 "raw_key": "SECRET-GOOGLE",
@@ -140,7 +141,7 @@ def _healthy_probes() -> list[ProbeResult]:
         _probe("system_config", ProbeStatus.PASS),
         _probe("toolchain", ProbeStatus.PASS, blocker=False, category=ProbeCategory.TOOLCHAIN),
         _probe(
-            "gemini_api_key",
+            "openai_api_key",
             ProbeStatus.PASS,
             category=ProbeCategory.CREDENTIALS,
             metadata=_credentials_metadata(),
@@ -286,6 +287,15 @@ def _run(
 ):
     """Run the tool with every side-effecting collaborator stubbed."""
     with ExitStack() as stack:
+        stack.enter_context(
+            patch.object(
+                type(diagnose.settings),
+                "get_api_key",
+                side_effect=lambda p: SecretStr(
+                    {"openai": "SECRET-OPENAI", "ocr": "SECRET-OCR"}[p]
+                ),
+            )
+        )
         fake_helper = MagicMock()
         fake_helper.status = MagicMock(
             side_effect=lambda serial: dict(helper_status or _helper_healthy(serial))
@@ -462,7 +472,7 @@ def test_ready_environment_reports_ready_with_slim_shape(temp_trace_env):
         "python_runtime",
         "system_config",
         "integration_host",
-        "gemini_api_key",
+        "openai_api_key",
         "android_adb",
     ]
     assert result["device"] == {
@@ -508,10 +518,10 @@ def test_failing_checks_keep_scrubbed_facts_and_fix_list(temp_trace_env):
     probes[5].status = ProbeStatus.WARN
     result = _run(probes)
 
-    creds = next(c for c in result["checks"] if c["id"] == "gemini_api_key")
+    creds = next(c for c in result["checks"] if c["id"] == "openai_api_key")
     assert creds["category"] == "auth"
     assert creds["facts"]["providers"] == [
-        {"provider": "google", "label": "Gemini", "masked": "AIza...abcd"},
+        {"provider": "openai", "label": "Gemini", "masked": "AIza...abcd"},
         {"provider": "openai", "label": "ChatGPT", "masked": "sk-...wxyz"},
     ]
     assert "api_keys" not in creds["facts"]
@@ -635,7 +645,7 @@ def test_default_emulator_command_without_installed_avd_is_not_run(temp_trace_en
 def test_missing_credentials_point_to_env_file_not_chat(temp_trace_env):
     probes = _healthy_probes()
     probes[3] = _probe(
-        "gemini_api_key",
+        "openai_api_key",
         ProbeStatus.FAIL,
         category=ProbeCategory.CREDENTIALS,
         summary="Key Missing",
@@ -816,51 +826,19 @@ def test_verify_credentials_reports_every_provider_without_leaking_keys(temp_tra
 
     assert result["verdict"] == "ready"
     assert result["credentials"] == [
-        {"provider": "google", "label": "Gemini", "valid": True, "message": "verified"},
-        {"provider": "openai", "label": "ChatGPT", "valid": True, "message": "verified"},
+        {"provider": "openai", "label": "OpenAI Responses", "valid": True, "message": "verified"},
         {"provider": "ocr", "label": "Vision OCR", "valid": True, "message": "verified"},
     ]
     called = {call.args[0]: call.args[1] for call in validate.await_args_list}
-    assert called == {"google": "SECRET-GOOGLE", "openai": "SECRET-OPENAI", "ocr": "SECRET-OCR"}
+    assert called == {"openai": "SECRET-OPENAI", "ocr": "SECRET-OCR"}
     assert all(call.kwargs["timeout"] == 12.0 for call in validate.await_args_list)
     assert "SECRET" not in repr(result)
 
 
-def test_verify_credentials_calls_endpoint_providers_by_url(temp_trace_env):
-    """A custom / Ollama / vLLM entry carries its base URL as the "key": the
-    check must hit that endpoint (no auth header) instead of validating the
-    URL as if it were an API key."""
-    validate = AsyncMock(return_value=(True, "verified"))
-    cred = _probe(
-        "gemini_api_key",
-        ProbeStatus.PASS,
-        category=ProbeCategory.CREDENTIALS,
-        metadata={
-            "providers": [
-                {
-                    "provider": "ollama",
-                    "label": "Local Ollama",
-                    "raw_key": "http://localhost:11434/v1",
-                },
-                {"provider": "google", "label": "Gemini", "raw_key": "SECRET-GOOGLE"},
-            ],
-            "api_keys": {},
-        },
-    )
-    probes = [p for p in _healthy_probes() if p.id != "gemini_api_key"] + [cred]
-    _run(probes, validate=validate, verify_credentials=True)
-
-    calls = {call.args[0]: call for call in validate.await_args_list}
-    assert calls["ollama"].args[1] == "EMPTY"
-    assert calls["ollama"].kwargs["base_url"] == "http://localhost:11434/v1"
-    assert calls["google"].args[1] == "SECRET-GOOGLE"
-    assert "base_url" not in calls["google"].kwargs
-
-
 def test_invalid_primary_credential_blocks_and_redacts_message(temp_trace_env):
     async def _validate(provider, api_key, timeout=12.0):
-        if provider == "google":
-            return False, f"Gemini API verification failed (400): key {api_key} invalid"
+        if provider == "openai":
+            return False, f"OpenAI Responses API verification failed (400): key {api_key} invalid"
         if provider == "ocr":
             raise RuntimeError("boom SECRET-OCR")
         return True, "ok"
@@ -874,29 +852,30 @@ def test_invalid_primary_credential_blocks_and_redacts_message(temp_trace_env):
 
     assert result["verdict"] == "blocked"
     assert "SECRET" not in repr(result)
-    google, openai, ocr = result["credentials"]
-    assert google["valid"] is False and "***" in google["message"]
-    assert openai["valid"] is True
+    openai, ocr = result["credentials"]
+    assert openai["valid"] is False and "***" in openai["message"]
     assert ocr["valid"] is False and ocr["message"].startswith("verification raised RuntimeError")
     steps = result["next_steps"]
-    required = next(s for s in steps if s.startswith("[REQUIRED] Gemini API key (google)"))
+    required = next(
+        s for s in steps if s.startswith("[REQUIRED] OpenAI Responses API key (openai)")
+    )
     assert "failed live verification" in required
     assert steps[steps.index(required) + 1].startswith("  Ask the user to add a provider key")
     assert any("/home/u/.env" in s for s in steps)
     assert any(s.startswith("[OPTIONAL] Vision OCR API key (ocr)") for s in steps)
     assert steps[-1].startswith("After changing the env file")
-    assert "Gemini key verification" in result["summary"]
+    assert "OpenAI Responses key verification" in result["summary"]
 
 
 def test_invalid_secondary_credential_only_degrades(temp_trace_env):
     async def _validate(provider, api_key, timeout=12.0):
-        return (provider != "openai", "ok" if provider != "openai" else "401 unauthorized")
+        return (provider != "ocr", "ok" if provider != "ocr" else "401 unauthorized")
 
     result = _run(
         _healthy_probes(), validate=AsyncMock(side_effect=_validate), verify_credentials=True
     )
     assert result["verdict"] == "degraded"
-    assert any(s.startswith("[OPTIONAL] ChatGPT API key (openai)") for s in result["next_steps"])
+    assert any(s.startswith("[OPTIONAL] Vision OCR API key (ocr)") for s in result["next_steps"])
 
 
 # --------------------------------------------------------------------------- #