diff --git a/CHANGELOG.md b/CHANGELOG.md index f5dec29..fdd5cd1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,25 @@ checks the registry separately after publication. ## Unreleased +## [0.3.1] - 2026-08-10 + +### Changed + +- Make the browser wizard beginner-friendly with a modern fixed-viewport + layout: all five active steps fit without document scrolling on common + 1280x720 laptops, while progress and safety context stay persistent beside + the active task. +- Keep narrow-phone documents fixed to the viewport and contain unavoidable + long-form overflow within the active task panel instead of the page. +- Expand the GitHub and npm walkthroughs with a hosted-install selector and + packaged, sanitized screenshots that document the current n8n workflow. + +### Security + +- Restore a clean hosted-web dependency audit by pinning patched `js-yaml` + and `nanoid` releases and using the compatible `vinext` release that does + not include the currently vulnerable `image-size` parser. + ## [0.3.0] - 2026-08-05 ### Added diff --git a/README.md b/README.md index 1a4c17d..bd6e396 100644 --- a/README.md +++ b/README.md @@ -324,10 +324,11 @@ current self-hosted n8n and Hostinger VPS setup path. The hosted site and local wizard keep the original Relmio relay layout while adding a compact **System / Light / Dark** appearance control. System follows the computer's preference; Light and Dark are remembered on that browser only. -The local wizard keeps its horizontal five-step Signal Spine at the top of the -flow, and the hosted site keeps the live GitHub star/version control visible. -Both surfaces collapse their controls for narrow phone screens without -turning the setup flow into a side rail or requiring a separate mobile app. +On desktop, the local wizard keeps progress and sidecar-only safety notes in a +persistent rail beside the active task; its compact fixed-screen shell avoids +document scrolling on common laptop screens. On narrow phones, it switches to +a horizontal progress strip and keeps task scrolling inside the active panel. +The hosted site keeps the live GitHub star/version control visible. ## Choose a setup path @@ -466,10 +467,11 @@ npm view relmio version ``` > [!NOTE] -> These current product screenshots omit or redact sensitive values. In -> particular, the VPS identity screen redacts the address and SSH fingerprint; -> none of the screenshots includes an OAuth token, password, private key, or -> live wizard session URL. +> These current product screenshots use sanitized sample values wherever a +> setup field could identify an environment. In particular, the VPS identity +> screen uses a reserved sample address and sample SSH fingerprint; none of the +> screenshots includes an OAuth token, password, private key, or live wizard +> session URL. ### 2. Complete or reuse the local ChatGPT sign-in @@ -484,10 +486,12 @@ credential already exists, **Continue to VPS** reuses it. Use **Refresh ChatGPT sign-in** when it is expired, belongs to another account, or you want a new session. -After a fresh login, the browser confirmation states that the ChatGPT -credentials were saved locally; return to the terminal to continue. +After a real fresh login, the browser confirmation states that the ChatGPT +credentials were saved locally; return to the terminal to continue. The +following image is a sanitized preview-mode sample credential state, not a +confirmation that a real saved login exists. -![Step 2: local ChatGPT sign-in completion confirmation](docs/images/setup/01-local-sign-in-ready.png) +![Step 2: sanitized preview-mode sample credential state, not a real saved-login confirmation](docs/images/setup/01-local-sign-in-ready.png) If a browser extension named **Sign in with ChatGPT** or **OpenAI OAuth** captures the callback, temporarily disable that extension and start the @@ -500,11 +504,11 @@ Enter the VPS address exactly as your provider shows it. Select **Check server identity**, compare the SHA-256 fingerprint with the intended server, and confirm it before the password field unlocks. -![Step 3: VPS identity confirmation with the address and SSH fingerprint redacted](docs/images/setup/02-vps-identity-confirmed.png) +![Step 3: VPS identity confirmation with a sanitized sample address and SSH fingerprint](docs/images/setup/02-vps-identity-confirmed.png) -The screenshot redacts the VPS address and SSH fingerprint and obscures the -password field. Never publish a real password, private key, session URL, or -OAuth file. +The screenshot uses the reserved sample host `vps.example.test`, a sample +SSH fingerprint, and a blank password field. Never publish a real password, +private key, session URL, or OAuth file. ### 4. Choose the detected n8n container and shared network diff --git a/docs/images/setup/01-local-sign-in-ready.png b/docs/images/setup/01-local-sign-in-ready.png index 2a9b145..c183938 100644 Binary files a/docs/images/setup/01-local-sign-in-ready.png and b/docs/images/setup/01-local-sign-in-ready.png differ diff --git a/docs/images/setup/02-vps-identity-confirmed.png b/docs/images/setup/02-vps-identity-confirmed.png index 19d1147..4f8d4f8 100644 Binary files a/docs/images/setup/02-vps-identity-confirmed.png and b/docs/images/setup/02-vps-identity-confirmed.png differ diff --git a/docs/images/setup/03-n8n-detected.png b/docs/images/setup/03-n8n-detected.png index 90c4897..8f27221 100644 Binary files a/docs/images/setup/03-n8n-detected.png and b/docs/images/setup/03-n8n-detected.png differ diff --git a/docs/images/setup/04-install-plan.png b/docs/images/setup/04-install-plan.png index 101bae9..72507ab 100644 Binary files a/docs/images/setup/04-install-plan.png and b/docs/images/setup/04-install-plan.png differ diff --git a/docs/images/setup/05-bridge-ready.png b/docs/images/setup/05-bridge-ready.png index e44932e..b51163d 100644 Binary files a/docs/images/setup/05-bridge-ready.png and b/docs/images/setup/05-bridge-ready.png differ diff --git a/npm/README.md b/npm/README.md index 33d8911..ba7bfb9 100644 --- a/npm/README.md +++ b/npm/README.md @@ -88,10 +88,11 @@ tailored to the current self-hosted n8n and Hostinger VPS setup path. The hosted site and local wizard keep the original Relmio relay layout while adding a compact **System / Light / Dark** appearance control. System follows the computer's preference; Light and Dark are remembered on that browser only. -The local wizard keeps its horizontal five-step Signal Spine at the top of the -flow, and the hosted site keeps the live GitHub star/version control visible. -Both surfaces collapse their controls for narrow phone screens without -turning the setup flow into a side rail or requiring a separate mobile app. +On desktop, the local wizard keeps progress and sidecar-only safety notes in a +persistent rail beside the active task; its compact fixed-screen shell avoids +document scrolling on common laptop screens. On narrow phones, it switches to +a horizontal progress strip and keeps task scrolling inside the active panel. +The hosted site keeps the live GitHub star/version control visible. ## Quick start @@ -192,9 +193,10 @@ it is not currently advertised as supported. ## Visual walkthrough -These current product screenshots omit or redact sensitive values. The VPS -identity screen redacts the address and SSH fingerprint; none of the images -includes an OAuth token, password, private key, or live wizard session URL. +These current product screenshots use sanitized sample values wherever a setup +field might otherwise identify an environment. The VPS identity screen shows a +reserved sample address and sample SSH fingerprint; none of the images includes +an OAuth token, password, private key, or live wizard session URL. ### 1. Choose a hosted installation method @@ -205,16 +207,19 @@ command locally, not on the VPS. ### 2. Complete the local ChatGPT/Codex sign-in -OpenAI OAuth browser page confirming that local ChatGPT credentials were saved +Sanitized preview-mode sample credential state, not a real saved-login confirmation -The browser confirmation states that the ChatGPT credentials were saved locally. +This image shows a sanitized preview-mode sample credential state; it does not +confirm that a real local ChatGPT login was saved. During a real fresh login, +the browser confirmation states that the credentials were saved locally. ### 3. Verify the VPS identity -VPS identity confirmation with the address and SSH fingerprint redacted +VPS identity confirmation with a sanitized sample address and SSH fingerprint -Confirm the SSH host fingerprint before authentication. The screenshot redacts -the address and fingerprint and obscures the password field. +Confirm the SSH host fingerprint before authentication. The screenshot uses the +reserved sample host `vps.example.test`, a sample fingerprint, and a blank +password field. ### 4. Choose the detected n8n container and network diff --git a/package-lock.json b/package-lock.json index b3f5f0e..9021a34 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "relmio", - "version": "0.3.0", + "version": "0.3.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "relmio", - "version": "0.3.0", + "version": "0.3.1", "license": "Apache-2.0", "dependencies": { "ssh2": "1.17.0" diff --git a/package.json b/package.json index d31a755..9849b3a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "relmio", - "version": "0.3.0", + "version": "0.3.1", "description": "Turn a supported ChatGPT/Codex OAuth sign-in into a private OpenAI-compatible endpoint, starting with self-hosted n8n.", "keywords": [ "relmio", diff --git a/src/ui/index.html b/src/ui/index.html index c985dc4..9816f75 100644 --- a/src/ui/index.html +++ b/src/ui/index.html @@ -55,108 +55,108 @@ -
- - - +
+
+
- Step 1 of 5

Use your local ChatGPT sign-in

The OAuth credential stays on this computer until you approve its @@ -198,7 +198,6 @@

Use your local ChatGPT sign-in