relmio 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,190 @@
+# Changelog
+
+This project follows semantic versioning. Each completed release uses one
+version across `package.json`, `package-lock.json`, this file, the Git tag,
+and npm. Local checks validate the repository metadata; the publishing guide
+checks the registry separately after publication.
+
+## Unreleased
+
+No unreleased changes.
+
+## [0.2.0] - 2026-07-29
+
+### Added
+
+- Add a provider-neutral product roadmap with a gated SuperGrok/xAI OAuth
+  feasibility track, entitlement checks, and explicit security boundaries.
+- Add a trusted-publisher GitHub Actions workflow for short-lived npm
+  authentication after the first package publication.
+
+### Changed
+
+- Rename the public product and npm package to Relmio and `relmio` so the
+  project can grow beyond its initial n8n setup path.
+- Replace the generic plus icon with an original two-lane relay mark and add a
+  small brand guide with reusable SVG and source concept assets.
+- Publish a concise npm-specific README with absolute image and documentation
+  URLs while preserving the full GitHub README and its Mermaid diagrams.
+- Build and inspect a deterministic npm tarball so the registry receives the
+  npm-specific README instead of the repository README.
+- Keep the legacy `n8n-openai-oauth-setup` executable alias and every deployed
+  `n8n-openai-oauth` compatibility and safety identifier unchanged.
+
+## [0.1.8] - 2026-07-29
+
+### Changed
+
+- Restore the complete manual sidecar installation path to the README for
+  wizard failures, debugging, and contributor reproduction.
+- Add plain-English Mermaid diagrams that explain the private sidecar and help
+  readers choose between the browser wizard and manual setup.
+- Keep the README and standalone manual Docker templates synchronized with
+  automated documentation checks.
+
+## [0.1.7] - 2026-07-28
+
+### Changed
+
+- Add prominent workflow-backup reminders to the README, manual guide,
+  troubleshooting guide, and browser wizard before VPS access.
+
+## [0.1.6] - 2026-07-28
+
+### Added
+
+- Add a public npm quick-start guide with five sanitized setup screenshots,
+  Mermaid architecture diagrams, and a YouTube walkthrough outline.
+- Add individual Base URL/API-key copy controls and n8n recipes for OpenAI
+  Chat Model, AI Agent, Basic LLM Chain, and HTTP Request nodes.
+- Add a release metadata validator that keeps the package, lockfile, changelog,
+  and release tag on one version.
+- Add GitHub Actions checks with immutable action pins, no persisted checkout
+  credential, and the repository's pinned npm `10.9.8` runtime.
+
+### Changed
+
+- Expand troubleshooting for stale wizard sessions, npm versions, local OAuth
+  callbacks, SSH failures, Docker networks, real port mappings, and manual
+  sidecar collisions.
+- Use the wizard-only `~/.n8n-openai-oauth/auth.json` path consistently in the
+  manual and maintenance guides.
+- Replace pre-publication wording and add the local context file to the shared
+  ignore policy.
+- Disable npm lifecycle scripts explicitly in every documented and nested
+  `npx` invocation.
+- Add a prominent workflow-backup reminder before local setup and inside the
+  wizard because VPS access remains a real write boundary even with sidecar-only
+  commands.
+- Separate OpenAI credential fields from OpenAI Chat Model settings and explain
+  the Responses API compatibility behavior for Chat Model node version 1.3.
+- Polish the public README with a collapsible contents list, clickable project
+  links, experimental-use disclaimers, and a contributor guide.
+- Document Graphify as an optional local maintainer map while keeping raw graph
+  exports out of Git and npm.
+
+### Fixed
+
+- Prevent sanitized preview mode from generating or opening a live OpenAI
+  authorization URL.
+- Refuse to show the ready screen when the sidecar returns no usable model ID.
+- Tag the exact commit that passed CI and was published instead of relying on
+  the shell's current `HEAD`.
+- Make the sanitized preview follow the production OAuth service contract and
+  show the correct private n8n Base URL.
+- Fall back to a temporary selected text field when a browser denies the
+  modern Clipboard API, so the final credential copy buttons still work.
+- Always remove the fallback copy field and restore focus when legacy browser
+  clipboard access throws.
+- Stop and remove only the named wizard-managed sidecar service when its final
+  safety check detects an unexpected host-port publication; report an explicit
+  manual cleanup path if that removal cannot be confirmed.
+- Clean up the sidecar when publication inspection fails or returns malformed
+  metadata, rate-limit install attempts, close the VPS connection after every
+  install outcome, and show actionable browser recovery messages.
+
+## [0.1.5] - 2026-07-28
+
+### Fixed
+
+- Detect a newly approved ChatGPT credential as soon as its complete file is
+  available instead of waiting for the OAuth helper process to close.
+- Poll the local sign-in state more frequently during the first ten seconds
+  so the wizard responds quickly after browser approval.
+- Show the local credential's update time and announce when a fresh sign-in
+  has been saved.
+
+## [0.1.4] - 2026-07-28
+
+### Fixed
+
+- Run ChatGPT login against a new wizard-only credential file so the bridge
+  CLI never needs an interactive terminal to confirm replacement.
+- Validate the completed credential before storing it at
+  `~/.n8n-openai-oauth/auth.json` with owner-only permissions.
+- Stop reusing or overwriting the Codex app credential at
+  `~/.codex/auth.json`.
+- Open the exact fresh authorization URL returned by the pinned bridge CLI
+  and report its completion separately, avoiding stale browser sign-in tabs.
+- Verify Docker Compose publisher metadata so an internal-only `10531/tcp`
+  declaration is not mistaken for a published VPS host port.
+- Explain that browser extensions which intercept the localhost OAuth callback
+  must be disabled temporarily during a fresh sign-in.
+
+## [0.1.3] - 2026-07-27
+
+### Fixed
+
+- Let the explicit **Refresh ChatGPT sign-in** action confirm replacement of
+  an existing local OAuth credential. Previously, the bridge CLI prompt had
+  no input stream, defaulted to “No,” and the wizard reported that sign-in did
+  not finish.
+- Clarify when the wizard will reuse an existing credential and when to
+  refresh it.
+
+## [0.1.2] - 2026-07-27
+
+### Fixed
+
+- Provide a writable `/home/node/.local` tmpfs so the non-root bridge can
+  start while the container root filesystem remains read-only.
+- Use the collision-resistant Docker hostname `n8n-openai-oauth` so an
+  existing manual `openai-oauth` sidecar cannot capture n8n requests.
+- Treat a wizard-managed deployment as an update, allowing a fresh local
+  ChatGPT sign-in to refresh its OAuth credential safely.
+
+## [0.1.1] - 2026-07-27
+
+### Fixed
+
+- Quote the generated Compose healthcheck command so Docker Compose validates
+  it as a string.
+
+## [0.1.0] - 2026-07-27
+
+### Added
+
+- Local browser wizard for installing the OpenAI OAuth sidecar beside a
+  self-hosted n8n Docker deployment.
+- Read-only n8n and Docker-network discovery.
+- Explicit review and confirmation before remote sidecar writes.
+- Safety checks that prevent changes to the existing n8n Compose project,
+  image, container, or host port mappings.
+- `npx`-friendly CLI entry point and beginner documentation.
+
+### Security
+
+- OAuth credentials stay on the local computer until the user approves an
+  SFTP upload to the installer-managed sidecar directory.
+- SSH host-key confirmation is required before password authentication.
+- The sidecar uses an internal-only Docker network endpoint and no published
+  VPS port.
+
+[0.1.7]: https://github.com/Demonbane18/n8n-openai-oauth-setup/compare/v0.1.6...v0.1.7
+[0.1.6]: https://github.com/Demonbane18/n8n-openai-oauth-setup/compare/v0.1.5...v0.1.6
+[0.1.5]: https://github.com/Demonbane18/n8n-openai-oauth-setup/compare/v0.1.4...v0.1.5
+[0.1.4]: https://github.com/Demonbane18/n8n-openai-oauth-setup/compare/v0.1.3...v0.1.4
+[0.1.3]: https://github.com/Demonbane18/n8n-openai-oauth-setup/compare/v0.1.2...v0.1.3
+[0.1.2]: https://github.com/Demonbane18/n8n-openai-oauth-setup/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/Demonbane18/n8n-openai-oauth-setup/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/Demonbane18/n8n-openai-oauth-setup/releases/tag/v0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Demonbane18
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,122 @@
+<div align="center">
+  <img src="https://raw.githubusercontent.com/Demonbane18/n8n-openai-oauth-setup/main/docs/images/brand/relmio-mark.svg" alt="Relmio logo" width="88">
+  <h1>Relmio</h1>
+  <p>Relay a supported ChatGPT/Codex sign-in to OpenAI-compatible clients, starting with self-hosted n8n.</p>
+  <p>
+    <a href="https://github.com/Demonbane18/n8n-openai-oauth-setup">Full guide</a>
+    &nbsp;·&nbsp;
+    <a href="https://github.com/Demonbane18/n8n-openai-oauth-setup/issues/new">Report an issue</a>
+    &nbsp;·&nbsp;
+    <a href="https://github.com/Demonbane18/n8n-openai-oauth-setup/blob/main/docs/roadmap.md">Roadmap</a>
+  </p>
+</div>
+
+Relmio is a local browser wizard that installs a private
+[openai-oauth](https://github.com/EvanZhouDev/openai-oauth) Docker sidecar
+beside an existing self-hosted n8n instance. It guides you through local
+ChatGPT/Codex sign-in, SSH host verification, read-only n8n discovery, an
+exact change plan, and the final n8n credential settings.
+
+The existing n8n image, Compose file, container, and workflows stay untouched.
+
+## Quick start
+
+Run this on your own macOS, Windows, or Linux computer—not on the VPS:
+
+```bash
+npx --yes --ignore-scripts relmio@latest
+```
+
+Requirements:
+
+- Node.js 22 or newer
+- A browser and an eligible ChatGPT/Codex account
+- A self-hosted n8n Docker deployment on a VPS
+- Docker Compose v2, SSH access, and a Docker network shared with n8n
+
+Back up your n8n workflows before granting any tool VPS access.
+
+## What you get
+
+```text
+n8n AI node or HTTP Request
+  -> private Docker endpoint: http://n8n-openai-oauth:10531/v1
+    -> protected ChatGPT/Codex OAuth session
+      -> upstream OpenAI service
+```
+
+Relmio currently provides tested setup instructions for:
+
+- OpenAI Chat Model
+- AI Agent
+- Basic LLM Chain
+- HTTP Request
+
+The broader direction is to support local chatbots, custom applications,
+OpenAI-compatible clients, and provider adapters without tying the public
+product name to n8n. SuperGrok/xAI OAuth is a gated feasibility item on the
+[provider roadmap](https://github.com/Demonbane18/n8n-openai-oauth-setup/blob/main/docs/roadmap.md);
+it is not currently advertised as supported.
+
+## Visual walkthrough
+
+All images below are sanitized previews with reserved addresses, fake server
+data, and no real credential or session information.
+
+### 1. Confirm the local ChatGPT/Codex sign-in
+
+<img src="https://raw.githubusercontent.com/Demonbane18/n8n-openai-oauth-setup/main/docs/images/setup/01-local-sign-in-ready.png" alt="Sanitized local sign-in ready screen" width="720">
+
+### 2. Verify the VPS identity
+
+<img src="https://raw.githubusercontent.com/Demonbane18/n8n-openai-oauth-setup/main/docs/images/setup/02-vps-identity-confirmed.png" alt="Sanitized VPS fingerprint confirmation screen" width="720">
+
+### 3. Choose the detected n8n container and network
+
+<img src="https://raw.githubusercontent.com/Demonbane18/n8n-openai-oauth-setup/main/docs/images/setup/03-n8n-detected.png" alt="Sanitized n8n discovery screen" width="720">
+
+### 4. Review the exact sidecar-only plan
+
+<img src="https://raw.githubusercontent.com/Demonbane18/n8n-openai-oauth-setup/main/docs/images/setup/04-install-plan.png" alt="Sanitized installation plan screen" width="720">
+
+### 5. Copy the verified n8n settings
+
+<img src="https://raw.githubusercontent.com/Demonbane18/n8n-openai-oauth-setup/main/docs/images/setup/05-bridge-ready.png" alt="Sanitized verified bridge screen" width="720">
+
+Use these values in an n8n OpenAI credential:
+
+```text
+API Key: local-only
+Base URL: http://n8n-openai-oauth:10531/v1
+Organization ID: leave empty
+Add Custom Header: Off
+```
+
+The `local-only` value is a placeholder required by n8n. It is not an OpenAI
+Platform API key.
+
+## Important boundaries
+
+- Relmio does not create an OpenAI Platform API key.
+- The OAuth file is a password-equivalent secret; never commit or share it.
+- The sidecar endpoint stays inside the Docker network. Port `10531` must not
+  be published on the VPS host.
+- Relmio never edits, rebuilds, recreates, stops, or restarts the existing n8n
+  container.
+- This is an unofficial community project, not affiliated with or endorsed by
+  OpenAI, xAI, or n8n. Provider access, models, limits, and policies can change.
+- Use it only where your account, subscription, provider terms, and applicable
+  policies allow.
+
+## Documentation
+
+- [Complete GitHub README and manual fallback](https://github.com/Demonbane18/n8n-openai-oauth-setup#readme)
+- [Configure n8n AI and HTTP nodes](https://github.com/Demonbane18/n8n-openai-oauth-setup/blob/main/docs/n8n-configuration.md)
+- [Troubleshooting](https://github.com/Demonbane18/n8n-openai-oauth-setup/blob/main/docs/troubleshooting.md)
+- [Security and limitations](https://github.com/Demonbane18/n8n-openai-oauth-setup/blob/main/docs/security.md)
+- [Refresh, upgrade, rollback, and uninstall](https://github.com/Demonbane18/n8n-openai-oauth-setup/blob/main/docs/maintenance.md)
+- [Changelog](https://github.com/Demonbane18/n8n-openai-oauth-setup/blob/main/CHANGELOG.md)
+
+## License
+
+[MIT](https://github.com/Demonbane18/n8n-openai-oauth-setup/blob/main/LICENSE)

package/SPEC.md

@@ -0,0 +1,140 @@
+# Spec: Relmio n8n Setup
+
+## Objective
+
+Build the first Relmio setup path: a beginner-friendly local wizard and a correct manual guide for connecting a self-hosted n8n Docker deployment to the unofficial `openai-oauth` bridge.
+
+The primary user is a non-technical Hostinger VPS owner. Success means they can sign in locally, install a separate Docker sidecar, verify it, and configure n8n without editing, rebuilding, recreating, stopping, or restarting their existing n8n deployment.
+
+The project is personal and experimental. It must explain that ChatGPT and OpenAI API billing are separate, that this bridge is unofficial, and that OAuth credentials must be protected like passwords.
+
+## Tech stack
+
+- Node.js `>=22`
+- npm `10.9.8`
+- ECMAScript modules
+- Node built-in HTTP server, test runner, crypto, child process, and file APIs
+- `ssh2` `1.17.0`
+- `openai-oauth` `2.0.0` inside the generated sidecar image
+- Docker Compose v2 on the target VPS
+
+The first release is an `npx`-ready local browser wizard. A signed native desktop wrapper is intentionally deferred until the workflow is stable.
+
+## Commands
+
+- Install: `npm ci --ignore-scripts`
+- Run wizard: `npm start`
+- Run tests: `npm test`
+- Check JavaScript syntax: `npm run lint`
+- Audit dependencies: `npm audit --audit-level=high`
+- Preview published files: `npm pack --dry-run`
+
+## Project structure
+
+```text
+src/
+  cli.js                 Local entry point and browser launcher
+  domain/                Pure validation and deployment-plan logic
+  infrastructure/        SSH/SFTP and local process boundaries
+  services/              OAuth, discovery, installation orchestration
+  web/                   Localhost HTTP server
+  ui/                    Static browser wizard
+test/                    Node test-runner unit and integration tests
+docs/                    Manual guide, troubleshooting, security, architecture
+tasks/                   Implementation plan and task checklist
+scripts/                 Cross-platform project checks
+```
+
+## Code style
+
+Use small named functions, explicit return objects, and dependency injection at side-effect boundaries:
+
+```js
+export function createDeploymentPlan({ networkName }) {
+  const safeNetwork = validateDockerName(networkName);
+
+  return {
+    projectName: "n8n-openai-oauth",
+    networkName: safeNetwork,
+    mutatesN8n: false,
+  };
+}
+```
+
+## Testing strategy
+
+- Write failing unit tests first for validation, generated Docker files, and the forbidden-command safety boundary.
+- Use fake SSH transports for discovery and installation orchestration.
+- Use localhost-only integration tests for the HTTP server.
+- Do not connect tests to the user's VPS or ChatGPT account.
+- Treat a real Hostinger/n8n run as a separately confirmed manual acceptance test.
+
+## Threat model
+
+### Assets
+
+- ChatGPT OAuth credential file
+- VPS root password or SSH agent session
+- SSH host identity
+- Existing n8n deployment and workflows
+
+### Trust boundaries
+
+- Browser to localhost wizard server
+- Wizard process to target SSH server
+- Local auth file to SFTP upload
+- n8n Docker network to sidecar
+
+### Required controls
+
+- Bind only to `127.0.0.1` and require an unguessable session token.
+- Enforce same-origin requests and small request bodies.
+- Hold SSH passwords only in request memory and never log them.
+- Confirm the SSH host fingerprint before authentication.
+- Validate Docker names and container names with allowlists.
+- Upload files through SFTP; do not interpolate file contents into shell commands.
+- Show a dry-run plan and require confirmation before remote writes.
+- Generate a sidecar with no `ports`, no Traefik labels, dropped capabilities, and `no-new-privileges`.
+
+## Boundaries
+
+### Always
+
+- Discover n8n through read-only Docker commands.
+- Create a separate Compose project under `/docker/n8n-openai-oauth`.
+- Attach only the sidecar to an existing n8n network.
+- Run tests and secret scans before commits.
+- Preserve a documented uninstall and rollback path.
+
+### Ask first
+
+- Overwriting an existing installer-managed directory.
+- Selecting among multiple n8n containers or networks.
+- Performing any remote write.
+- Publishing the npm package or making the repository public.
+
+### Never
+
+- Edit the existing n8n Compose file.
+- Build or modify the n8n image.
+- Restart, stop, recreate, or remove n8n.
+- Publish the bridge port on the VPS.
+- Store or log passwords, tokens, or private keys.
+- Share, pool, or redistribute ChatGPT credentials.
+
+## Success criteria
+
+- The wizard starts through one command and opens a local browser.
+- It detects a local OAuth credential or starts a fresh local login.
+- It confirms the SSH host key and connects using a password or SSH agent.
+- It detects the running n8n container and its Docker networks using read-only commands.
+- It displays an exact deployment plan before any write.
+- It deploys only the separate sidecar and validates `/health` plus `/v1/models`.
+- It shows `http://n8n-openai-oauth:10531/v1` and a placeholder API key for
+  n8n.
+- Automated tests prove no generated install command can modify or restart n8n.
+- Documentation covers the successful path, security limits, uninstall, and observed troubleshooting cases.
+
+## Open questions
+
+- npm publication is planned as the primary non-technical distribution path; native desktop packaging remains deferred.

package/docs/architecture.md

@@ -0,0 +1,127 @@
+# Architecture and n8n safety boundary
+
+## Design
+
+The wizard runs on the user's computer. It authenticates locally, opens one
+verified SSH connection, performs read-only discovery, shows a plan, and then
+creates a separate sidecar project on approval.
+
+```mermaid
+flowchart LR
+  B["Local browser<br>127.0.0.1"] --> W["Local Node wizard"]
+  W --> O["ChatGPT/Codex OAuth login<br>local callback"]
+  W -->|verified SSH + SFTP| V["VPS"]
+  V --> N["Existing n8n container<br>unchanged"]
+  V --> S["New openai-oauth sidecar"]
+  N -->|Docker DNS<br>n8n-openai-oauth:10531| S
+  S --> C["OpenAI service used by<br>the upstream helper"]
+```
+
+## Why this integration is possible
+
+The design combines four existing interfaces rather than changing n8n:
+
+1. The n8n OpenAI credential accepts a custom Base URL.
+2. The pinned bridge implements OpenAI-compatible model, Responses, and chat
+   completions routes.
+3. Docker Compose can attach a separate project to an existing external
+   network.
+4. Docker DNS resolves the private sidecar hostname from the n8n container.
+
+n8n therefore talks to the private sidecar with its normal OpenAI request
+shape. The sidecar handles upstream OAuth authentication with its mounted
+credential. No OpenAI Platform API key is created.
+
+## The mutation boundary
+
+The installer can write only:
+
+```text
+/docker/n8n-openai-oauth/
+├── .managed-by-n8n-openai-oauth
+├── Dockerfile
+├── docker-compose.yml
+└── auth/
+    └── auth.json
+```
+
+Its deployment commands always include:
+
+```text
+--project-name n8n-openai-oauth
+--file /docker/n8n-openai-oauth/docker-compose.yml
+```
+
+The only service passed to `build` or `up` is `openai-oauth`, and `up` includes
+`--no-deps`.
+
+## Existing n8n operations
+
+| Operation | Wizard behavior |
+|---|---|
+| Read running container list | Allowed |
+| Read n8n network names | Allowed |
+| Run a command inside n8n | Not used during installation |
+| Edit n8n Compose | Forbidden |
+| Build n8n image | Forbidden |
+| Restart or stop n8n | Forbidden |
+| Recreate or remove n8n | Forbidden |
+| Publish a new VPS port | Forbidden |
+| Add a Traefik route | Forbidden |
+
+## Why the Base URL uses a service name
+
+Docker Compose can attach a separate project to an existing external network.
+Containers on that network can use Docker DNS to reach a service by name.
+That is why n8n uses:
+
+```text
+http://n8n-openai-oauth:10531/v1
+```
+
+It must not use `127.0.0.1`, and the VPS does not need a public port. See
+[Docker's external-network documentation](https://docs.docker.com/compose/how-tos/networking/#use-an-existing-network).
+
+## Request paths
+
+The n8n OpenAI credential validates with:
+
+```text
+GET /v1/models
+```
+
+The OpenAI Chat Model can use:
+
+```text
+POST /v1/responses
+```
+
+The compatibility path is:
+
+```text
+POST /v1/chat/completions
+```
+
+The placeholder API key satisfies n8n's required credential field. The
+sidecar authenticates upstream with the mounted OAuth file.
+
+## Technical sources
+
+- [`openai-oauth` v2.0.0 server routes](https://github.com/EvanZhouDev/openai-oauth/blob/v2.0.0/packages/openai-oauth/src/server.ts)
+- [`openai-oauth` v2.0.0 login flow](https://github.com/EvanZhouDev/openai-oauth/blob/v2.0.0/packages/openai-oauth/src/login.ts)
+- [n8n OpenAI credential documentation](https://docs.n8n.io/integrations/builtin/credentials/openai/)
+- [n8n OpenAI credential source](https://github.com/n8n-io/n8n/blob/master/packages/nodes-base/credentials/OpenAiApi.credentials.ts)
+- [Docker Compose networking](https://docs.docker.com/compose/how-tos/networking/)
+- [Docker Compose `expose`](https://docs.docker.com/reference/compose-file/services/#expose)
+- [Docker port publishing](https://docs.docker.com/engine/network/port-publishing/)
+
+## Failure behavior
+
+- Invalid host, port, username, container, or network names are rejected.
+- A changed SSH fingerprint blocks authentication.
+- An existing unmanaged install directory is not overwritten.
+- Invalid OAuth JSON is rejected before Docker changes.
+- A failed Compose validation stops before build.
+- A failed build or start does not trigger an n8n action.
+- An unexpected host-port mapping causes verification to fail.
+- The SSH connection closes after installation or when the wizard stops.

package/docs/brand.md

@@ -0,0 +1,43 @@
+# Relmio brand
+
+Relmio is the public name for the project formerly described as n8n OpenAI
+OAuth Setup.
+
+The name is intentionally client-agnostic. The current wizard configures a
+private OpenAI-compatible OAuth sidecar for self-hosted n8n, while the product
+direction can grow to support other OpenAI-compatible clients and SDK-based
+applications.
+
+## Mark
+
+![Relmio mark](images/brand/relmio-mark.svg)
+
+Two independent lanes converge around a right-facing negative-space arrow. The
+shape represents an authenticated upstream connection being relayed through a
+single compatible interface.
+
+The mark was developed from the checked-in generated concept source at
+[`images/brand/relmio-concept-source.png`](images/brand/relmio-concept-source.png)
+and redrawn as compact SVG geometry for reliable rendering at small sizes.
+
+## Colors
+
+| Token | Hex | Use |
+|---|---|---|
+| Relay teal | `#137c74` | Primary lane, actions, active states |
+| Midnight ink | `#12211f` | Secondary lane, text, high-contrast surfaces |
+| Signal tint | `#e7f3f0` | Quiet selected and informational surfaces |
+| Canvas | `#f4f2ed` | Warm application background |
+
+Use the two-color mark on light backgrounds. On a dark surface, place the
+unchanged mark on a white or canvas-colored tile with enough padding. Do not
+rotate, stretch, outline, add gradients, or recreate the mark with provider
+brand colors.
+
+## Compatibility names
+
+The public product and npm package use **Relmio** and `relmio`.
+
+Existing remote paths, Docker project/service names, marker files, and local
+credential paths keep their `n8n-openai-oauth` identifiers. Those values are
+operational compatibility and safety boundaries, not the public brand.

package/docs/images/brand/relmio-mark.svg

@@ -0,0 +1,16 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  viewBox="0 0 64 64"
+  role="img"
+  aria-labelledby="relmio-mark-title"
+>
+  <title id="relmio-mark-title">Relmio mark</title>
+  <path
+    fill="#137c74"
+    d="M7 8h19l31 24H41L26 20v10L7 17Z"
+  />
+  <path
+    fill="#12211f"
+    d="M7 47l19-13v10l15-12h16L26 56H7Z"
+  />
+</svg>