relmio 0.2.9 → 0.2.11

package/CHANGELOG.md

@@ -7,6 +7,38 @@ checks the registry separately after publication.
 
 ## Unreleased
 
+## [0.2.11] - 2026-08-04
+
+### Fixed
+
+- Open the private Windows wizard URL through the documented default-browser
+  association instead of asking Explorer to treat the URL as a folder, while
+  retaining the printed URL and Enter-to-retry fallback.
+- Make the Command Prompt installer copy call the system Windows PowerShell
+  executable directly, avoiding ambiguous `powershell` command resolution.
+- Parse the supported `openai-oauth@2.0.0` login line across Windows terminal
+  control sequences and chunk boundaries, and report a sanitized, actionable
+  callback-port conflict instead of a generic missing-link error.
+
+### Security
+
+- Pin the hosted web tooling to `brace-expansion` 5.0.9, which includes the
+  upstream denial-of-service fix required by the release audit.
+
+## [0.2.10] - 2026-08-03
+
+### Fixed
+
+- Probe installed Windows Node.js runtimes with the literal `node --version`
+  output instead of a `node -p` expression, avoiding the PowerShell `[eval]:1`
+  quoting failure while still reusing Node.js 22 or newer.
+- Let interactive wizard terminals reopen the local browser page when the user
+  presses Enter, while retaining the printed private URL as the fallback for
+  noninteractive launches.
+- Navigate the preopened local OAuth tab before severing its opener access,
+  show an immediate preparing state, and close an unnavigated waiting tab if
+  sign-in setup fails.
+
 ## [0.2.9] - 2026-08-02
 
 ### Fixed

package/README.md

@@ -105,7 +105,7 @@ irm https://relmio.vercel.app/install.ps1 | iex
 ### Windows Command Prompt
 
 ```bat
-powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://relmio.vercel.app/install.ps1 | iex"
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "irm https://relmio.vercel.app/install.ps1 | iex"
 ```
 
 No Node.js or Git Bash installation is required first. The
@@ -128,6 +128,11 @@ Keep the active setup terminal open while using the wizard. If the page says
 the wizard link is incomplete, close that tab and open the full `Local wizard:`
 URL printed by the current terminal instead of refreshing the stripped page.
 
+If the browser does not open automatically, press Enter in an interactive
+terminal to open it again. The printed `Local wizard:` URL remains the fallback
+for a terminal that cannot accept input or when the launcher still cannot open
+a browser.
+
 ### Requirements
 
 - On macOS/Linux/WSL/Git Bash: `curl`, `awk`, `tar`, and either `sha256sum` or

package/docs/troubleshooting.md

@@ -49,7 +49,7 @@ irm https://relmio.vercel.app/install.ps1 | iex
 Windows Command Prompt:
 
 ```bat
-powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://relmio.vercel.app/install.ps1 | iex"
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "irm https://relmio.vercel.app/install.ps1 | iex"
 ```
 
 These commands do not require Node.js to be installed. The Windows options do
@@ -66,9 +66,15 @@ npm view relmio version
 npx --yes --ignore-scripts relmio@latest
 ```
 
-Keep the terminal open. If the browser does not open automatically, copy the
-newest printed `http://127.0.0.1:...` URL into the browser. That URL contains a
-temporary setup token: do not post it in an issue or screenshot.
+Keep the terminal open. If the running wizard accepts terminal input, press
+Enter to ask it to open the browser again. Otherwise, copy the newest printed
+`http://127.0.0.1:...` URL into the browser. That URL contains a temporary setup
+token: do not post it in an issue or screenshot.
+
+The local wizard may be displayed in a VS Code embedded browser. Its validated
+manual link, **Open fresh ChatGPT sign-in**, remains available if that embedded
+browser blocks the popup or no new tab opens. Use that link only from the active
+wizard attempt; it points to the fresh `auth.openai.com` authorization URL.
 
 You do not need to sign in to npm, configure npm 2FA, or own this package to
 run any public command. npm authentication is required only for the
@@ -111,13 +117,15 @@ bypassed.
 | Symptom | Meaning | Fix |
 |---|---|---|
 | `node: command not found`, `node is not recognized`, or Node is older than 22 | The NPX fallback cannot use the local runtime. | Use the macOS/Linux curl command or the native Windows PowerShell/Command Prompt command above. Either can run with a verified temporary runtime. Do not install Node.js on the VPS for the wizard. |
-| `curl` or `sh` is not recognized on Windows | The macOS/Linux command was pasted into a native Windows terminal. | Use the PowerShell command in PowerShell, or the longer `powershell -NoProfile ...` command in Command Prompt. Git Bash is not required. |
+| `curl` or `sh` is not recognized on Windows | The macOS/Linux command was pasted into a native Windows terminal. | Use the PowerShell command in PowerShell, or the `"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile ...` command in Command Prompt. Git Bash is not required. |
 | A bootstrap reports a checksum mismatch | The Node.js download did not match the official SHA-256 manifest, so it was not executed. | Retry on a trusted connection. Do not bypass the check. If it repeats, use an existing Node.js 22+ installation and report the sanitized error. |
+| Windows PowerShell shows `[eval]:1` before the wizard starts | An older bootstrap passed a JavaScript expression through `node -p`; PowerShell native-argument handling can alter that expression. | Update to the latest `relmio@latest` and rerun the same PowerShell or Command Prompt command. The current bootstrap parses the literal `node --version` output and reuses Node.js 22 or newer. |
 | Windows reports `spawn EINVAL` when starting ChatGPT sign-in | An older wizard tried to execute `npx.cmd` directly; Windows requires the current Node runtime to launch npm's JavaScript CLI. | Update to the latest `relmio@latest` release and restart the setup command. The current wizard keeps the macOS/Linux/WSL/Git Bash `npx` path unchanged. |
-| The browser did not open | The automatic browser launch failed, but the local server may still be running. | Keep the newest terminal open and copy its newest `127.0.0.1` setup URL into the browser. Do not reuse a URL from a closed terminal. |
+| The browser did not open | The automatic browser launch failed, but the local server may still be running. | Keep the newest terminal open and press Enter to ask an interactive wizard terminal to open it again. If the terminal is noninteractive or the launcher still fails, copy its newest `127.0.0.1` setup URL into the browser. Do not reuse a URL from a closed terminal. |
 | The wizard says `This wizard link is incomplete` | The page was refreshed or opened without the private `?session=...` token; the token is removed from the address bar after startup. | Close the tab and open the complete `Local wizard:` URL printed by the active setup terminal. Do not reuse a URL from a closed terminal. |
 | An old wizard page reports an invalid or expired setup session | The local server was closed or a newer wizard run created a different one-time session token. | Close the old page and use only the URL printed by the currently running terminal. |
 | `npx` appears to run an older wizard | An old terminal or tab is still active, or the package was run without an explicit tag. | Close old runs, check `npm view relmio version`, then run `npx --yes --ignore-scripts relmio@latest`. |
+| A white `about:blank` tab remains after selecting **Sign in with ChatGPT** | An older local wizard cleared the preopened tab's `opener` before navigating it to the validated sign-in URL. | Update to the latest `relmio@latest`, close the stranded tab, and start one fresh sign-in. The current wizard shows a preparing state, navigates the preopened tab, then clears its opener before the remote page loads. Use **Open fresh ChatGPT sign-in** only when the current wizard shows that validated manual link. |
 | `This sign-in request expired` | The OAuth tab is old or the five-minute callback window ended. | Close the old tab and select **Refresh ChatGPT sign-in** from the newest active wizard. |
 | An **OpenAI OAuth** extension page says the sign-in request expired | A browser extension intercepted the `localhost:1455` callback that belongs to the wizard's fresh login. | Temporarily disable the **Sign in with ChatGPT** or **OpenAI OAuth** extension, then select **Refresh ChatGPT sign-in** in the wizard. Re-enable the extension afterward if you still use it elsewhere. |
 | `ChatGPT sign-in did not finish` appears immediately when refreshing an existing credential | Wizard versions through `0.1.3` attempted to reuse `~/.codex/auth.json`, but the bridge CLI requires an interactive terminal before replacing that file. | Update to `0.1.4` or newer. The wizard signs in through its own new credential file and leaves the Codex app credential untouched. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relmio",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "Turn a supported ChatGPT/Codex OAuth sign-in into a private OpenAI-compatible endpoint, starting with self-hosted n8n.",
   "keywords": [
     "relmio",

package/src/browser.js

@@ -0,0 +1,92 @@
+import { spawn } from "node:child_process";
+
+export function browserCommand(url, platform = process.platform) {
+  if (platform === "darwin") {
+    return { file: "open", args: [url] };
+  }
+  if (platform === "win32") {
+    return {
+      file: "cmd.exe",
+      args: ["/d", "/c", "start", "Relmio local wizard", url],
+    };
+  }
+  return { file: "xdg-open", args: [url] };
+}
+
+function isPrivateWizardUrl(value) {
+  if (typeof value !== "string" || /[\u0000-\u001F\u007F]/u.test(value)) {
+    return false;
+  }
+
+  try {
+    const url = new URL(value);
+    const session = url.searchParams.get("session");
+    return (
+      url.protocol === "http:" &&
+      url.hostname === "127.0.0.1" &&
+      url.port !== "" &&
+      Number(url.port) > 0 &&
+      url.pathname === "/" &&
+      url.username === "" &&
+      url.password === "" &&
+      url.hash === "" &&
+      typeof session === "string" &&
+      /^[A-Za-z0-9_-]{43}$/u.test(session) &&
+      url.search === `?session=${session}`
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function openBrowser(
+  url,
+  { platform = process.platform, spawnProcess = spawn } = {},
+) {
+  if (!isPrivateWizardUrl(url)) {
+    return false;
+  }
+  const command = browserCommand(url, platform);
+  let child;
+  try {
+    child = spawnProcess(command.file, command.args, {
+      detached: true,
+      stdio: "ignore",
+      shell: false,
+    });
+  } catch {
+    return false;
+  }
+  child.once("error", () => {
+    // The URL is also printed, so users can open it manually.
+  });
+  child.unref();
+  return true;
+}
+
+export function attachBrowserReopenOnEnter({
+  input = process.stdin,
+  url,
+  open = openBrowser,
+  write = console.log,
+}) {
+  if (!input.isTTY) {
+    return () => {};
+  }
+
+  const onData = (data) => {
+    if (/\r|\n/u.test(String(data))) {
+      open(url);
+    }
+  };
+
+  input.setEncoding?.("utf8");
+  input.resume?.();
+  input.on("data", onData);
+  write("If the wizard did not open automatically, press Enter to open it again.");
+
+  return () => {
+    input.off("data", onData);
+    input.pause?.();
+  };
+}

package/src/cli.js

@@ -1,29 +1,10 @@
 #!/usr/bin/env node
 
 import { randomBytes } from "node:crypto";
-import { spawn } from "node:child_process";
 
+import { attachBrowserReopenOnEnter, openBrowser } from "./browser.js";
 import { startWizardServer } from "./web/server.js";
 
-function openBrowser(url) {
-  const command =
-    process.platform === "darwin"
-      ? { file: "open", args: [url] }
-      : process.platform === "win32"
-        ? { file: "explorer.exe", args: [url] }
-        : { file: "xdg-open", args: [url] };
-
-  const child = spawn(command.file, command.args, {
-    detached: true,
-    stdio: "ignore",
-    shell: false,
-  });
-  child.once("error", () => {
-    // The URL is also printed, so users can open it manually.
-  });
-  child.unref();
-}
-
 const sessionToken = randomBytes(32).toString("base64url");
 const wizard = await startWizardServer({ sessionToken });
 const url = `${wizard.origin}/?session=${sessionToken}`;
@@ -39,6 +20,7 @@ console.log("Press Control+C to stop.");
 console.log("");
 
 openBrowser(url);
+const detachBrowserReopen = attachBrowserReopenOnEnter({ url });
 
 let closing = false;
 async function close() {
@@ -46,6 +28,7 @@ async function close() {
     return;
   }
   closing = true;
+  detachBrowserReopen();
   await wizard.close();
 }
 

package/src/services/oauth.js

@@ -12,6 +12,11 @@ const PROCESS_TIMEOUT_MS = LOGIN_TIMEOUT_MS + 15_000;
 const CREDENTIAL_POLL_INTERVAL_MS = 100;
 const LOGIN_URL_PREFIX = "OpenAI OAuth login URL: ";
 const OPENAI_AUTH_ORIGIN = "https://auth.openai.com";
+const SUPPORTED_LOOPBACK_REDIRECT_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "[::1]",
+]);
 
 const wait = (milliseconds) =>
   new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
@@ -124,6 +129,10 @@ function validateAuthorizationUrl(value) {
 
   if (
     url.origin !== OPENAI_AUTH_ORIGIN ||
+    url.username !== "" ||
+    url.password !== "" ||
+    url.hash !== "" ||
+    url.href.includes("#") ||
     url.pathname !== "/oauth/authorize" ||
     url.searchParams.get("response_type") !== "code" ||
     !url.searchParams.get("state") ||
@@ -139,7 +148,14 @@ function validateAuthorizationUrl(value) {
     throw new Error("The sign-in command returned an invalid callback.");
   }
   if (
-    !["localhost", "127.0.0.1", "::1"].includes(redirect.hostname) ||
+    redirect.protocol !== "http:" ||
+    redirect.username !== "" ||
+    redirect.password !== "" ||
+    redirect.search !== "" ||
+    redirect.hash !== "" ||
+    redirect.href.includes("?") ||
+    redirect.href.includes("#") ||
+    !SUPPORTED_LOOPBACK_REDIRECT_HOSTNAMES.has(redirect.hostname) ||
     redirect.port !== "1455" ||
     redirect.pathname !== "/auth/callback"
   ) {
@@ -149,15 +165,38 @@ function validateAuthorizationUrl(value) {
   return url.toString();
 }
 
-function extractAuthorizationUrl(output) {
-  for (const line of output.split(/\r?\n/u)) {
-    if (line.startsWith(LOGIN_URL_PREFIX)) {
-      return validateAuthorizationUrl(line.slice(LOGIN_URL_PREFIX.length));
+function stripTerminalControlSequences(value) {
+  return value
+    .replace(/\u001B\][^\u0007]*(?:\u0007|\u001B\\)/gu, "")
+    .replace(/\u001B\[[0-?]*[ -/]*[@-~]/gu, "")
+    .replace(/[\u0000-\u0009\u000B-\u001F\u007F-\u009F]/gu, "");
+}
+
+function extractAuthorizationUrl(output, { includeFinalLine = false } = {}) {
+  const lines = stripTerminalControlSequences(output).split("\n");
+  const lineCount = includeFinalLine ? lines.length : lines.length - 1;
+  for (const line of lines.slice(0, lineCount)) {
+    const markerIndex = line.indexOf(LOGIN_URL_PREFIX);
+    if (markerIndex >= 0) {
+      return validateAuthorizationUrl(
+        line.slice(markerIndex + LOGIN_URL_PREFIX.length).trim(),
+      );
     }
   }
   return null;
 }
 
+function loginStartupError(stderr) {
+  const callbackPortConflict =
+    "OpenAI OAuth login needs http://localhost:1455/auth/callback, but port 1455 is already in use.";
+  if (stripTerminalControlSequences(stderr).includes(callbackPortConflict)) {
+    return new Error(
+      `${callbackPortConflict} Stop the process using that port and try again.`,
+    );
+  }
+  return new Error("The sign-in command did not return an authorization URL.");
+}
+
 export async function startOAuthLogin({
   fileSystem = defaultFileSystem,
   env = process.env,
@@ -205,9 +244,8 @@ export async function startOAuthLogin({
       { cause: error },
     );
   }
-  child.stderr?.resume();
-
-  let loginOutput = "";
+  const loginOutput = { stdout: "", stderr: "" };
+  let loginOutputBytes = 0;
   let resolveAuthorizationUrl;
   let rejectAuthorizationUrl;
   let authorizationUrlSettled = false;
@@ -227,20 +265,25 @@ export async function startOAuthLogin({
     }
   };
 
-  child.stdout?.on("data", (chunk) => {
+  const captureLoginOutput = (stream, chunk) => {
     if (authorizationUrlSettled) {
       return;
     }
-    loginOutput += Buffer.from(chunk).toString("utf8");
-    if (Buffer.byteLength(loginOutput) > MAX_LOGIN_OUTPUT_BYTES) {
+    const output = Buffer.from(chunk).toString("utf8");
+    loginOutputBytes += Buffer.byteLength(output);
+    if (loginOutputBytes > MAX_LOGIN_OUTPUT_BYTES) {
       settleAuthorizationUrl(
         new Error("The sign-in command returned too much output."),
       );
       child.kill?.("SIGTERM");
       return;
     }
+    loginOutput[stream] += output;
+    if (stream !== "stdout") {
+      return;
+    }
     try {
-      const authorizationUrl = extractAuthorizationUrl(loginOutput);
+      const authorizationUrl = extractAuthorizationUrl(loginOutput.stdout);
       if (authorizationUrl) {
         settleAuthorizationUrl(null, authorizationUrl);
       }
@@ -248,24 +291,27 @@ export async function startOAuthLogin({
       settleAuthorizationUrl(error);
       child.kill?.("SIGTERM");
     }
-  });
+  };
 
-  let resolveExit;
-  let rejectExit;
-  let exitSettled = false;
-  const exitPromise = new Promise((resolvePromise, rejectPromise) => {
-    resolveExit = resolvePromise;
-    rejectExit = rejectPromise;
+  child.stdout?.on?.("data", (chunk) => captureLoginOutput("stdout", chunk));
+  child.stderr?.on?.("data", (chunk) => captureLoginOutput("stderr", chunk));
+
+  let resolveProcessClose;
+  let rejectProcessClose;
+  let processCloseSettled = false;
+  const processClosePromise = new Promise((resolvePromise, rejectPromise) => {
+    resolveProcessClose = resolvePromise;
+    rejectProcessClose = rejectPromise;
   });
-  const settleExit = (error, code) => {
-    if (exitSettled) {
+  const settleProcessClose = (error, code) => {
+    if (processCloseSettled) {
       return;
     }
-    exitSettled = true;
+    processCloseSettled = true;
     if (error) {
-      rejectExit(error);
+      rejectProcessClose(error);
     } else {
-      resolveExit(code);
+      resolveProcessClose(code);
     }
   };
 
@@ -274,15 +320,24 @@ export async function startOAuthLogin({
       "The local sign-in command could not start. Install Node.js 22 and try again.",
     );
     settleAuthorizationUrl(error);
-    settleExit(error);
+    settleProcessClose(error);
   });
-  child.once("exit", (code) => {
+  child.once("close", (code) => {
     if (!authorizationUrlSettled) {
-      settleAuthorizationUrl(
-        new Error("The sign-in command did not return an authorization URL."),
-      );
+      try {
+        const authorizationUrl = extractAuthorizationUrl(loginOutput.stdout, {
+          includeFinalLine: true,
+        });
+        if (authorizationUrl) {
+          settleAuthorizationUrl(null, authorizationUrl);
+        } else {
+          settleAuthorizationUrl(loginStartupError(loginOutput.stderr));
+        }
+      } catch (error) {
+        settleAuthorizationUrl(error);
+      }
     }
-    settleExit(null, code);
+    settleProcessClose(null, code);
   });
 
   const loginUrlTimeout = setTimeout(() => {
@@ -326,7 +381,7 @@ export async function startOAuthLogin({
     try {
       return await Promise.race([
         pendingCredentialPromise,
-        exitPromise.then(async (code) => {
+        processClosePromise.then(async (code) => {
           if (code !== 0) {
             throw new Error(
               "ChatGPT sign-in did not finish. Start a fresh login.",
@@ -348,7 +403,7 @@ export async function startOAuthLogin({
       keepPollingForCredential = false;
       clearTimeout(processTimeout);
       clearTimeout(loginUrlTimeout);
-      if (!exitSettled) {
+      if (!processCloseSettled) {
         child.kill?.("SIGTERM");
       }
       try {

package/src/ui/app.js

@@ -1,4 +1,5 @@
 import { formatAuthUpdatedAt } from "./time.js";
+import { prepareOAuthPopup } from "./oauth-popup.js";
 
 const token = new URLSearchParams(window.location.search).get("session");
 window.history.replaceState(null, "", window.location.pathname);
@@ -309,15 +310,14 @@ element("login-button").addEventListener("click", async (event) => {
   const button = event.currentTarget;
   const loginLink = element("login-link");
   const loginWindow = window.open("about:blank", "_blank");
-  if (loginWindow) {
-    loginWindow.opener = null;
-  }
+  let loginWindowNavigated = false;
+  prepareOAuthPopup(loginWindow);
   clearError();
   loginLink.hidden = true;
   loginLink.removeAttribute("href");
   setBusy(button, true, "Waiting for browser sign-in…");
   setMessage(
-    "Creating one fresh OpenAI sign-in link. The existing local credential will be replaced only after sign-in succeeds.",
+    "Preparing a fresh ChatGPT sign-in. The existing local credential will be replaced only after sign-in succeeds.",
   );
   try {
     const result = await api("/api/oauth/login", {
@@ -329,6 +329,8 @@ element("login-button").addEventListener("click", async (event) => {
     loginLink.hidden = false;
     if (loginWindow) {
       loginWindow.location.replace(authorizationUrl);
+      loginWindowNavigated = true;
+      loginWindow.opener = null;
     }
     setMessage(
       "Complete the newly opened sign-in within five minutes. If no tab opened, use “Open fresh ChatGPT sign-in” below. If an OpenAI OAuth browser extension intercepts the callback, disable it temporarily and start again.",
@@ -338,7 +340,7 @@ element("login-button").addEventListener("click", async (event) => {
     loginLink.removeAttribute("href");
     await refreshAuthStatus({ fresh: true });
   } catch (error) {
-    if (loginWindow && loginWindow.location.href === "about:blank") {
+    if (loginWindow && !loginWindowNavigated) {
       loginWindow.close();
     }
     showError(error);

package/src/ui/oauth-popup.js

@@ -0,0 +1,18 @@
+export function prepareOAuthPopup(loginWindow) {
+  if (!loginWindow) {
+    return false;
+  }
+
+  try {
+    const popupDocument = loginWindow.document;
+    const heading = popupDocument.createElement("h1");
+    const detail = popupDocument.createElement("p");
+    heading.textContent = "Preparing ChatGPT sign-in…";
+    detail.textContent = "Relmio is creating a fresh sign-in link.";
+    popupDocument.title = "Preparing ChatGPT sign-in";
+    popupDocument.body.replaceChildren(heading, detail);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/web/server.js

@@ -179,6 +179,7 @@ async function loadDefaultUiFiles() {
   const files = await Promise.all([
     readFile(new URL("../ui/index.html", import.meta.url), "utf8"),
     readFile(new URL("../ui/app.js", import.meta.url), "utf8"),
+    readFile(new URL("../ui/oauth-popup.js", import.meta.url), "utf8"),
     readFile(new URL("../ui/theme.js", import.meta.url), "utf8"),
     readFile(new URL("../ui/time.js", import.meta.url), "utf8"),
     readFile(new URL("../ui/styles.css", import.meta.url), "utf8"),
@@ -190,12 +191,13 @@ async function loadDefaultUiFiles() {
   return {
     "/": files[0],
     "/app.js": files[1],
-    "/theme.js": files[2],
-    "/time.js": files[3],
-    "/styles.css": files[4],
-    "/icons/monitor.svg": files[5],
-    "/icons/sun.svg": files[6],
-    "/icons/moon.svg": files[7],
+    "/oauth-popup.js": files[2],
+    "/theme.js": files[3],
+    "/time.js": files[4],
+    "/styles.css": files[5],
+    "/icons/monitor.svg": files[6],
+    "/icons/sun.svg": files[7],
+    "/icons/moon.svg": files[8],
   };
 }