diff --git a/CHANGELOG.md b/CHANGELOG.md
index f5dec29..fdd5cd1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,25 @@ checks the registry separately after publication.
## Unreleased
+## [0.3.1] - 2026-08-10
+
+### Changed
+
+- Make the browser wizard beginner-friendly with a modern fixed-viewport
+ layout: all five active steps fit without document scrolling on common
+ 1280x720 laptops, while progress and safety context stay persistent beside
+ the active task.
+- Keep narrow-phone documents fixed to the viewport and contain unavoidable
+ long-form overflow within the active task panel instead of the page.
+- Expand the GitHub and npm walkthroughs with a hosted-install selector and
+ packaged, sanitized screenshots that document the current n8n workflow.
+
+### Security
+
+- Restore a clean hosted-web dependency audit by pinning patched `js-yaml`
+ and `nanoid` releases and using the compatible `vinext` release that does
+ not include the currently vulnerable `image-size` parser.
+
## [0.3.0] - 2026-08-05
### Added
diff --git a/README.md b/README.md
index 1a4c17d..bd6e396 100644
--- a/README.md
+++ b/README.md
@@ -324,10 +324,11 @@ current self-hosted n8n and Hostinger VPS setup path.
The hosted site and local wizard keep the original Relmio relay layout while
adding a compact **System / Light / Dark** appearance control. System follows
the computer's preference; Light and Dark are remembered on that browser only.
-The local wizard keeps its horizontal five-step Signal Spine at the top of the
-flow, and the hosted site keeps the live GitHub star/version control visible.
-Both surfaces collapse their controls for narrow phone screens without
-turning the setup flow into a side rail or requiring a separate mobile app.
+On desktop, the local wizard keeps progress and sidecar-only safety notes in a
+persistent rail beside the active task; its compact fixed-screen shell avoids
+document scrolling on common laptop screens. On narrow phones, it switches to
+a horizontal progress strip and keeps task scrolling inside the active panel.
+The hosted site keeps the live GitHub star/version control visible.
## Choose a setup path
@@ -466,10 +467,11 @@ npm view relmio version
```
> [!NOTE]
-> These current product screenshots omit or redact sensitive values. In
-> particular, the VPS identity screen redacts the address and SSH fingerprint;
-> none of the screenshots includes an OAuth token, password, private key, or
-> live wizard session URL.
+> These current product screenshots use sanitized sample values wherever a
+> setup field could identify an environment. In particular, the VPS identity
+> screen uses a reserved sample address and sample SSH fingerprint; none of the
+> screenshots includes an OAuth token, password, private key, or live wizard
+> session URL.
### 2. Complete or reuse the local ChatGPT sign-in
@@ -484,10 +486,12 @@ credential already exists, **Continue to VPS** reuses it. Use **Refresh
ChatGPT sign-in** when it is expired, belongs to another account, or you want
a new session.
-After a fresh login, the browser confirmation states that the ChatGPT
-credentials were saved locally; return to the terminal to continue.
+After a real fresh login, the browser confirmation states that the ChatGPT
+credentials were saved locally; return to the terminal to continue. The
+following image is a sanitized preview-mode sample credential state, not a
+confirmation that a real saved login exists.
-
+
If a browser extension named **Sign in with ChatGPT** or **OpenAI OAuth**
captures the callback, temporarily disable that extension and start the
@@ -500,11 +504,11 @@ Enter the VPS address exactly as your provider shows it. Select **Check server
identity**, compare the SHA-256 fingerprint with the intended server, and
confirm it before the password field unlocks.
-
+
-The screenshot redacts the VPS address and SSH fingerprint and obscures the
-password field. Never publish a real password, private key, session URL, or
-OAuth file.
+The screenshot uses the reserved sample host `vps.example.test`, a sample
+SSH fingerprint, and a blank password field. Never publish a real password,
+private key, session URL, or OAuth file.
### 4. Choose the detected n8n container and shared network
diff --git a/docs/images/setup/01-local-sign-in-ready.png b/docs/images/setup/01-local-sign-in-ready.png
index 2a9b145..c183938 100644
Binary files a/docs/images/setup/01-local-sign-in-ready.png and b/docs/images/setup/01-local-sign-in-ready.png differ
diff --git a/docs/images/setup/02-vps-identity-confirmed.png b/docs/images/setup/02-vps-identity-confirmed.png
index 19d1147..4f8d4f8 100644
Binary files a/docs/images/setup/02-vps-identity-confirmed.png and b/docs/images/setup/02-vps-identity-confirmed.png differ
diff --git a/docs/images/setup/03-n8n-detected.png b/docs/images/setup/03-n8n-detected.png
index 90c4897..8f27221 100644
Binary files a/docs/images/setup/03-n8n-detected.png and b/docs/images/setup/03-n8n-detected.png differ
diff --git a/docs/images/setup/04-install-plan.png b/docs/images/setup/04-install-plan.png
index 101bae9..72507ab 100644
Binary files a/docs/images/setup/04-install-plan.png and b/docs/images/setup/04-install-plan.png differ
diff --git a/docs/images/setup/05-bridge-ready.png b/docs/images/setup/05-bridge-ready.png
index e44932e..b51163d 100644
Binary files a/docs/images/setup/05-bridge-ready.png and b/docs/images/setup/05-bridge-ready.png differ
diff --git a/npm/README.md b/npm/README.md
index 33d8911..ba7bfb9 100644
--- a/npm/README.md
+++ b/npm/README.md
@@ -88,10 +88,11 @@ tailored to the current self-hosted n8n and Hostinger VPS setup path.
The hosted site and local wizard keep the original Relmio relay layout while
adding a compact **System / Light / Dark** appearance control. System follows
the computer's preference; Light and Dark are remembered on that browser only.
-The local wizard keeps its horizontal five-step Signal Spine at the top of the
-flow, and the hosted site keeps the live GitHub star/version control visible.
-Both surfaces collapse their controls for narrow phone screens without
-turning the setup flow into a side rail or requiring a separate mobile app.
+On desktop, the local wizard keeps progress and sidecar-only safety notes in a
+persistent rail beside the active task; its compact fixed-screen shell avoids
+document scrolling on common laptop screens. On narrow phones, it switches to
+a horizontal progress strip and keeps task scrolling inside the active panel.
+The hosted site keeps the live GitHub star/version control visible.
## Quick start
@@ -192,9 +193,10 @@ it is not currently advertised as supported.
## Visual walkthrough
-These current product screenshots omit or redact sensitive values. The VPS
-identity screen redacts the address and SSH fingerprint; none of the images
-includes an OAuth token, password, private key, or live wizard session URL.
+These current product screenshots use sanitized sample values wherever a setup
+field might otherwise identify an environment. The VPS identity screen shows a
+reserved sample address and sample SSH fingerprint; none of the images includes
+an OAuth token, password, private key, or live wizard session URL.
### 1. Choose a hosted installation method
@@ -205,16 +207,19 @@ command locally, not on the VPS.
### 2. Complete the local ChatGPT/Codex sign-in
-
+
-The browser confirmation states that the ChatGPT credentials were saved locally.
+This image shows a sanitized preview-mode sample credential state; it does not
+confirm that a real local ChatGPT login was saved. During a real fresh login,
+the browser confirmation states that the credentials were saved locally.
### 3. Verify the VPS identity
-
+
-Confirm the SSH host fingerprint before authentication. The screenshot redacts
-the address and fingerprint and obscures the password field.
+Confirm the SSH host fingerprint before authentication. The screenshot uses the
+reserved sample host `vps.example.test`, a sample fingerprint, and a blank
+password field.
### 4. Choose the detected n8n container and network
diff --git a/package-lock.json b/package-lock.json
index b3f5f0e..9021a34 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
{
"name": "relmio",
- "version": "0.3.0",
+ "version": "0.3.1",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "relmio",
- "version": "0.3.0",
+ "version": "0.3.1",
"license": "Apache-2.0",
"dependencies": {
"ssh2": "1.17.0"
diff --git a/package.json b/package.json
index d31a755..9849b3a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "relmio",
- "version": "0.3.0",
+ "version": "0.3.1",
"description": "Turn a supported ChatGPT/Codex OAuth sign-in into a private OpenAI-compatible endpoint, starting with self-hosted n8n.",
"keywords": [
"relmio",
diff --git a/src/ui/index.html b/src/ui/index.html
index c985dc4..9816f75 100644
--- a/src/ui/index.html
+++ b/src/ui/index.html
@@ -55,108 +55,108 @@
-
-
-
-
+
+
+
- Step 1 of 5
Use your local ChatGPT sign-in
The OAuth credential stays on this computer until you approve its
@@ -198,7 +198,6 @@
Use your local ChatGPT sign-in
- Step 2 of 5
Connect to your VPS
Copy the address exactly from Hostinger. Your password is used only
@@ -294,7 +293,6 @@
Connect to your VPS
- Step 3 of 5
Choose the detected n8n
Discovery uses read-only Docker commands. It does not execute
@@ -332,7 +330,6 @@
Choose the detected n8n
- Step 4 of 5
Review before installing
No existing n8n files or containers will be changed.
@@ -381,14 +378,15 @@
The wizard will not
-
✓
-
- Step 5 of 5
-
The private bridge is ready
-
- Copy the OpenAI credential values first, then use one of the node
- recipes below.
-
+
+
✓
+
+
The private bridge is ready
+
+ Copy the OpenAI credential values first, then use one of the node
+ recipes below.
+