relmio 0.2.10 → 0.2.11

package/CHANGELOG.md

@@ -7,6 +7,24 @@ checks the registry separately after publication.
 
 ## Unreleased
 
+## [0.2.11] - 2026-08-04
+
+### Fixed
+
+- Open the private Windows wizard URL through the documented default-browser
+  association instead of asking Explorer to treat the URL as a folder, while
+  retaining the printed URL and Enter-to-retry fallback.
+- Make the Command Prompt installer copy call the system Windows PowerShell
+  executable directly, avoiding ambiguous `powershell` command resolution.
+- Parse the supported `openai-oauth@2.0.0` login line across Windows terminal
+  control sequences and chunk boundaries, and report a sanitized, actionable
+  callback-port conflict instead of a generic missing-link error.
+
+### Security
+
+- Pin the hosted web tooling to `brace-expansion` 5.0.9, which includes the
+  upstream denial-of-service fix required by the release audit.
+
 ## [0.2.10] - 2026-08-03
 
 ### Fixed

package/README.md

@@ -105,7 +105,7 @@ irm https://relmio.vercel.app/install.ps1 | iex
 ### Windows Command Prompt
 
 ```bat
-powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://relmio.vercel.app/install.ps1 | iex"
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "irm https://relmio.vercel.app/install.ps1 | iex"
 ```
 
 No Node.js or Git Bash installation is required first. The

package/docs/troubleshooting.md

@@ -49,7 +49,7 @@ irm https://relmio.vercel.app/install.ps1 | iex
 Windows Command Prompt:
 
 ```bat
-powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://relmio.vercel.app/install.ps1 | iex"
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "irm https://relmio.vercel.app/install.ps1 | iex"
 ```
 
 These commands do not require Node.js to be installed. The Windows options do
@@ -71,6 +71,11 @@ Enter to ask it to open the browser again. Otherwise, copy the newest printed
 `http://127.0.0.1:...` URL into the browser. That URL contains a temporary setup
 token: do not post it in an issue or screenshot.
 
+The local wizard may be displayed in a VS Code embedded browser. Its validated
+manual link, **Open fresh ChatGPT sign-in**, remains available if that embedded
+browser blocks the popup or no new tab opens. Use that link only from the active
+wizard attempt; it points to the fresh `auth.openai.com` authorization URL.
+
 You do not need to sign in to npm, configure npm 2FA, or own this package to
 run any public command. npm authentication is required only for the
 maintainer who publishes a release.
@@ -112,7 +117,7 @@ bypassed.
 | Symptom | Meaning | Fix |
 |---|---|---|
 | `node: command not found`, `node is not recognized`, or Node is older than 22 | The NPX fallback cannot use the local runtime. | Use the macOS/Linux curl command or the native Windows PowerShell/Command Prompt command above. Either can run with a verified temporary runtime. Do not install Node.js on the VPS for the wizard. |
-| `curl` or `sh` is not recognized on Windows | The macOS/Linux command was pasted into a native Windows terminal. | Use the PowerShell command in PowerShell, or the longer `powershell -NoProfile ...` command in Command Prompt. Git Bash is not required. |
+| `curl` or `sh` is not recognized on Windows | The macOS/Linux command was pasted into a native Windows terminal. | Use the PowerShell command in PowerShell, or the `"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile ...` command in Command Prompt. Git Bash is not required. |
 | A bootstrap reports a checksum mismatch | The Node.js download did not match the official SHA-256 manifest, so it was not executed. | Retry on a trusted connection. Do not bypass the check. If it repeats, use an existing Node.js 22+ installation and report the sanitized error. |
 | Windows PowerShell shows `[eval]:1` before the wizard starts | An older bootstrap passed a JavaScript expression through `node -p`; PowerShell native-argument handling can alter that expression. | Update to the latest `relmio@latest` and rerun the same PowerShell or Command Prompt command. The current bootstrap parses the literal `node --version` output and reuses Node.js 22 or newer. |
 | Windows reports `spawn EINVAL` when starting ChatGPT sign-in | An older wizard tried to execute `npx.cmd` directly; Windows requires the current Node runtime to launch npm's JavaScript CLI. | Update to the latest `relmio@latest` release and restart the setup command. The current wizard keeps the macOS/Linux/WSL/Git Bash `npx` path unchanged. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relmio",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "Turn a supported ChatGPT/Codex OAuth sign-in into a private OpenAI-compatible endpoint, starting with self-hosted n8n.",
   "keywords": [
     "relmio",

package/src/browser.js

@@ -5,15 +5,47 @@ export function browserCommand(url, platform = process.platform) {
     return { file: "open", args: [url] };
   }
   if (platform === "win32") {
-    return { file: "explorer.exe", args: [url] };
+    return {
+      file: "cmd.exe",
+      args: ["/d", "/c", "start", "Relmio local wizard", url],
+    };
   }
   return { file: "xdg-open", args: [url] };
 }
 
+function isPrivateWizardUrl(value) {
+  if (typeof value !== "string" || /[\u0000-\u001F\u007F]/u.test(value)) {
+    return false;
+  }
+
+  try {
+    const url = new URL(value);
+    const session = url.searchParams.get("session");
+    return (
+      url.protocol === "http:" &&
+      url.hostname === "127.0.0.1" &&
+      url.port !== "" &&
+      Number(url.port) > 0 &&
+      url.pathname === "/" &&
+      url.username === "" &&
+      url.password === "" &&
+      url.hash === "" &&
+      typeof session === "string" &&
+      /^[A-Za-z0-9_-]{43}$/u.test(session) &&
+      url.search === `?session=${session}`
+    );
+  } catch {
+    return false;
+  }
+}
+
 export function openBrowser(
   url,
   { platform = process.platform, spawnProcess = spawn } = {},
 ) {
+  if (!isPrivateWizardUrl(url)) {
+    return false;
+  }
   const command = browserCommand(url, platform);
   let child;
   try {

package/src/services/oauth.js

@@ -12,6 +12,11 @@ const PROCESS_TIMEOUT_MS = LOGIN_TIMEOUT_MS + 15_000;
 const CREDENTIAL_POLL_INTERVAL_MS = 100;
 const LOGIN_URL_PREFIX = "OpenAI OAuth login URL: ";
 const OPENAI_AUTH_ORIGIN = "https://auth.openai.com";
+const SUPPORTED_LOOPBACK_REDIRECT_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "[::1]",
+]);
 
 const wait = (milliseconds) =>
   new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
@@ -124,6 +129,10 @@ function validateAuthorizationUrl(value) {
 
   if (
     url.origin !== OPENAI_AUTH_ORIGIN ||
+    url.username !== "" ||
+    url.password !== "" ||
+    url.hash !== "" ||
+    url.href.includes("#") ||
     url.pathname !== "/oauth/authorize" ||
     url.searchParams.get("response_type") !== "code" ||
     !url.searchParams.get("state") ||
@@ -139,7 +148,14 @@ function validateAuthorizationUrl(value) {
     throw new Error("The sign-in command returned an invalid callback.");
   }
   if (
-    !["localhost", "127.0.0.1", "::1"].includes(redirect.hostname) ||
+    redirect.protocol !== "http:" ||
+    redirect.username !== "" ||
+    redirect.password !== "" ||
+    redirect.search !== "" ||
+    redirect.hash !== "" ||
+    redirect.href.includes("?") ||
+    redirect.href.includes("#") ||
+    !SUPPORTED_LOOPBACK_REDIRECT_HOSTNAMES.has(redirect.hostname) ||
     redirect.port !== "1455" ||
     redirect.pathname !== "/auth/callback"
   ) {
@@ -149,15 +165,38 @@ function validateAuthorizationUrl(value) {
   return url.toString();
 }
 
-function extractAuthorizationUrl(output) {
-  for (const line of output.split(/\r?\n/u)) {
-    if (line.startsWith(LOGIN_URL_PREFIX)) {
-      return validateAuthorizationUrl(line.slice(LOGIN_URL_PREFIX.length));
+function stripTerminalControlSequences(value) {
+  return value
+    .replace(/\u001B\][^\u0007]*(?:\u0007|\u001B\\)/gu, "")
+    .replace(/\u001B\[[0-?]*[ -/]*[@-~]/gu, "")
+    .replace(/[\u0000-\u0009\u000B-\u001F\u007F-\u009F]/gu, "");
+}
+
+function extractAuthorizationUrl(output, { includeFinalLine = false } = {}) {
+  const lines = stripTerminalControlSequences(output).split("\n");
+  const lineCount = includeFinalLine ? lines.length : lines.length - 1;
+  for (const line of lines.slice(0, lineCount)) {
+    const markerIndex = line.indexOf(LOGIN_URL_PREFIX);
+    if (markerIndex >= 0) {
+      return validateAuthorizationUrl(
+        line.slice(markerIndex + LOGIN_URL_PREFIX.length).trim(),
+      );
     }
   }
   return null;
 }
 
+function loginStartupError(stderr) {
+  const callbackPortConflict =
+    "OpenAI OAuth login needs http://localhost:1455/auth/callback, but port 1455 is already in use.";
+  if (stripTerminalControlSequences(stderr).includes(callbackPortConflict)) {
+    return new Error(
+      `${callbackPortConflict} Stop the process using that port and try again.`,
+    );
+  }
+  return new Error("The sign-in command did not return an authorization URL.");
+}
+
 export async function startOAuthLogin({
   fileSystem = defaultFileSystem,
   env = process.env,
@@ -205,9 +244,8 @@ export async function startOAuthLogin({
       { cause: error },
     );
   }
-  child.stderr?.resume();
-
-  let loginOutput = "";
+  const loginOutput = { stdout: "", stderr: "" };
+  let loginOutputBytes = 0;
   let resolveAuthorizationUrl;
   let rejectAuthorizationUrl;
   let authorizationUrlSettled = false;
@@ -227,20 +265,25 @@ export async function startOAuthLogin({
     }
   };
 
-  child.stdout?.on("data", (chunk) => {
+  const captureLoginOutput = (stream, chunk) => {
     if (authorizationUrlSettled) {
       return;
     }
-    loginOutput += Buffer.from(chunk).toString("utf8");
-    if (Buffer.byteLength(loginOutput) > MAX_LOGIN_OUTPUT_BYTES) {
+    const output = Buffer.from(chunk).toString("utf8");
+    loginOutputBytes += Buffer.byteLength(output);
+    if (loginOutputBytes > MAX_LOGIN_OUTPUT_BYTES) {
       settleAuthorizationUrl(
         new Error("The sign-in command returned too much output."),
       );
       child.kill?.("SIGTERM");
       return;
     }
+    loginOutput[stream] += output;
+    if (stream !== "stdout") {
+      return;
+    }
     try {
-      const authorizationUrl = extractAuthorizationUrl(loginOutput);
+      const authorizationUrl = extractAuthorizationUrl(loginOutput.stdout);
       if (authorizationUrl) {
         settleAuthorizationUrl(null, authorizationUrl);
       }
@@ -248,24 +291,27 @@ export async function startOAuthLogin({
       settleAuthorizationUrl(error);
       child.kill?.("SIGTERM");
     }
-  });
+  };
 
-  let resolveExit;
-  let rejectExit;
-  let exitSettled = false;
-  const exitPromise = new Promise((resolvePromise, rejectPromise) => {
-    resolveExit = resolvePromise;
-    rejectExit = rejectPromise;
+  child.stdout?.on?.("data", (chunk) => captureLoginOutput("stdout", chunk));
+  child.stderr?.on?.("data", (chunk) => captureLoginOutput("stderr", chunk));
+
+  let resolveProcessClose;
+  let rejectProcessClose;
+  let processCloseSettled = false;
+  const processClosePromise = new Promise((resolvePromise, rejectPromise) => {
+    resolveProcessClose = resolvePromise;
+    rejectProcessClose = rejectPromise;
   });
-  const settleExit = (error, code) => {
-    if (exitSettled) {
+  const settleProcessClose = (error, code) => {
+    if (processCloseSettled) {
       return;
     }
-    exitSettled = true;
+    processCloseSettled = true;
     if (error) {
-      rejectExit(error);
+      rejectProcessClose(error);
     } else {
-      resolveExit(code);
+      resolveProcessClose(code);
     }
   };
 
@@ -274,15 +320,24 @@ export async function startOAuthLogin({
       "The local sign-in command could not start. Install Node.js 22 and try again.",
     );
     settleAuthorizationUrl(error);
-    settleExit(error);
+    settleProcessClose(error);
   });
-  child.once("exit", (code) => {
+  child.once("close", (code) => {
     if (!authorizationUrlSettled) {
-      settleAuthorizationUrl(
-        new Error("The sign-in command did not return an authorization URL."),
-      );
+      try {
+        const authorizationUrl = extractAuthorizationUrl(loginOutput.stdout, {
+          includeFinalLine: true,
+        });
+        if (authorizationUrl) {
+          settleAuthorizationUrl(null, authorizationUrl);
+        } else {
+          settleAuthorizationUrl(loginStartupError(loginOutput.stderr));
+        }
+      } catch (error) {
+        settleAuthorizationUrl(error);
+      }
     }
-    settleExit(null, code);
+    settleProcessClose(null, code);
   });
 
   const loginUrlTimeout = setTimeout(() => {
@@ -326,7 +381,7 @@ export async function startOAuthLogin({
     try {
       return await Promise.race([
         pendingCredentialPromise,
-        exitPromise.then(async (code) => {
+        processClosePromise.then(async (code) => {
           if (code !== 0) {
             throw new Error(
               "ChatGPT sign-in did not finish. Start a fresh login.",
@@ -348,7 +403,7 @@ export async function startOAuthLogin({
       keepPollingForCredential = false;
       clearTimeout(processTimeout);
       clearTimeout(loginUrlTimeout);
-      if (!exitSettled) {
+      if (!processCloseSettled) {
         child.kill?.("SIGTERM");
       }
       try {