Release Relmio 0.3.1

CHANGELOG.md

@@ -7,6 +7,25 @@ checks the registry separately after publication.
 
 ## Unreleased
 
+## [0.3.1] - 2026-08-10
+
+### Changed
+
+- Make the browser wizard beginner-friendly with a modern fixed-viewport
+  layout: all five active steps fit without document scrolling on common
+  1280x720 laptops, while progress and safety context stay persistent beside
+  the active task.
+- Keep narrow-phone documents fixed to the viewport and contain unavoidable
+  long-form overflow within the active task panel instead of the page.
+- Expand the GitHub and npm walkthroughs with a hosted-install selector and
+  packaged, sanitized screenshots that document the current n8n workflow.
+
+### Security
+
+- Restore a clean hosted-web dependency audit by pinning patched `js-yaml`
+  and `nanoid` releases and using the compatible `vinext` release that does
+  not include the currently vulnerable `image-size` parser.
+
 ## [0.3.0] - 2026-08-05
 
 ### Added

README.md

@@ -324,10 +324,11 @@ current self-hosted n8n and Hostinger VPS setup path.
 The hosted site and local wizard keep the original Relmio relay layout while
 adding a compact **System / Light / Dark** appearance control. System follows
 the computer's preference; Light and Dark are remembered on that browser only.
-The local wizard keeps its horizontal five-step Signal Spine at the top of the
-flow, and the hosted site keeps the live GitHub star/version control visible.
-Both surfaces collapse their controls for narrow phone screens without
-turning the setup flow into a side rail or requiring a separate mobile app.
+On desktop, the local wizard keeps progress and sidecar-only safety notes in a
+persistent rail beside the active task; its compact fixed-screen shell avoids
+document scrolling on common laptop screens. On narrow phones, it switches to
+a horizontal progress strip and keeps task scrolling inside the active panel.
+The hosted site keeps the live GitHub star/version control visible.
 
 ## Choose a setup path
 
@@ -466,10 +467,11 @@ npm view relmio version
 ```
 
 > [!NOTE]
-> These current product screenshots omit or redact sensitive values. In
-> particular, the VPS identity screen redacts the address and SSH fingerprint;
-> none of the screenshots includes an OAuth token, password, private key, or
-> live wizard session URL.
+> These current product screenshots use sanitized sample values wherever a
+> setup field could identify an environment. In particular, the VPS identity
+> screen uses a reserved sample address and sample SSH fingerprint; none of the
+> screenshots includes an OAuth token, password, private key, or live wizard
+> session URL.
 
 ### 2. Complete or reuse the local ChatGPT sign-in
 
@@ -484,10 +486,12 @@ credential already exists, **Continue to VPS** reuses it. Use **Refresh
 ChatGPT sign-in** when it is expired, belongs to another account, or you want
 a new session.
 
-After a fresh login, the browser confirmation states that the ChatGPT
-credentials were saved locally; return to the terminal to continue.
+After a real fresh login, the browser confirmation states that the ChatGPT
+credentials were saved locally; return to the terminal to continue. The
+following image is a sanitized preview-mode sample credential state, not a
+confirmation that a real saved login exists.
 
-![Step 2: local ChatGPT sign-in completion confirmation](docs/images/setup/01-local-sign-in-ready.png)
+![Step 2: sanitized preview-mode sample credential state, not a real saved-login confirmation](docs/images/setup/01-local-sign-in-ready.png)
 
 If a browser extension named **Sign in with ChatGPT** or **OpenAI OAuth**
 captures the callback, temporarily disable that extension and start the
@@ -500,11 +504,11 @@ Enter the VPS address exactly as your provider shows it. Select **Check server
 identity**, compare the SHA-256 fingerprint with the intended server, and
 confirm it before the password field unlocks.
 
-![Step 3: VPS identity confirmation with the address and SSH fingerprint redacted](docs/images/setup/02-vps-identity-confirmed.png)
+![Step 3: VPS identity confirmation with a sanitized sample address and SSH fingerprint](docs/images/setup/02-vps-identity-confirmed.png)
 
-The screenshot redacts the VPS address and SSH fingerprint and obscures the
-password field. Never publish a real password, private key, session URL, or
-OAuth file.
+The screenshot uses the reserved sample host `vps.example.test`, a sample
+SSH fingerprint, and a blank password field. Never publish a real password,
+private key, session URL, or OAuth file.
 
 ### 4. Choose the detected n8n container and shared network
 

npm/README.md

@@ -88,10 +88,11 @@ tailored to the current self-hosted n8n and Hostinger VPS setup path.
 The hosted site and local wizard keep the original Relmio relay layout while
 adding a compact **System / Light / Dark** appearance control. System follows
 the computer's preference; Light and Dark are remembered on that browser only.
-The local wizard keeps its horizontal five-step Signal Spine at the top of the
-flow, and the hosted site keeps the live GitHub star/version control visible.
-Both surfaces collapse their controls for narrow phone screens without
-turning the setup flow into a side rail or requiring a separate mobile app.
+On desktop, the local wizard keeps progress and sidecar-only safety notes in a
+persistent rail beside the active task; its compact fixed-screen shell avoids
+document scrolling on common laptop screens. On narrow phones, it switches to
+a horizontal progress strip and keeps task scrolling inside the active panel.
+The hosted site keeps the live GitHub star/version control visible.
 
 ## Quick start
 
@@ -192,9 +193,10 @@ it is not currently advertised as supported.
 
 ## Visual walkthrough
 
-These current product screenshots omit or redact sensitive values. The VPS
-identity screen redacts the address and SSH fingerprint; none of the images
-includes an OAuth token, password, private key, or live wizard session URL.
+These current product screenshots use sanitized sample values wherever a setup
+field might otherwise identify an environment. The VPS identity screen shows a
+reserved sample address and sample SSH fingerprint; none of the images includes
+an OAuth token, password, private key, or live wizard session URL.
 
 ### 1. Choose a hosted installation method
 
@@ -205,16 +207,19 @@ command locally, not on the VPS.
 
 ### 2. Complete the local ChatGPT/Codex sign-in
 
-<img src="https://cdn.jsdelivr.net/npm/relmio@latest/docs/images/setup/01-local-sign-in-ready.png" alt="OpenAI OAuth browser page confirming that local ChatGPT credentials were saved" width="626">
+<img src="https://cdn.jsdelivr.net/npm/relmio@latest/docs/images/setup/01-local-sign-in-ready.png" alt="Sanitized preview-mode sample credential state, not a real saved-login confirmation" width="626">
 
-The browser confirmation states that the ChatGPT credentials were saved locally.
+This image shows a sanitized preview-mode sample credential state; it does not
+confirm that a real local ChatGPT login was saved. During a real fresh login,
+the browser confirmation states that the credentials were saved locally.
 
 ### 3. Verify the VPS identity
 
-<img src="https://cdn.jsdelivr.net/npm/relmio@latest/docs/images/setup/02-vps-identity-confirmed.png" alt="VPS identity confirmation with the address and SSH fingerprint redacted" width="720">
+<img src="https://cdn.jsdelivr.net/npm/relmio@latest/docs/images/setup/02-vps-identity-confirmed.png" alt="VPS identity confirmation with a sanitized sample address and SSH fingerprint" width="720">
 
-Confirm the SSH host fingerprint before authentication. The screenshot redacts
-the address and fingerprint and obscures the password field.
+Confirm the SSH host fingerprint before authentication. The screenshot uses the
+reserved sample host `vps.example.test`, a sample fingerprint, and a blank
+password field.
 
 ### 4. Choose the detected n8n container and network
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "relmio",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Turn a supported ChatGPT/Codex OAuth sign-in into a private OpenAI-compatible endpoint, starting with self-hosted n8n.",
   "keywords": [
     "relmio",