relmio 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -7,6 +7,33 @@ checks the registry separately after publication.
 
 ## Unreleased
 
+## [0.5.0] - 2026-08-15
+
+### Added
+
+- Add a **Rotate client credential** action for installed local endpoints that
+  shows the replacement capability before activation and preserves the upstream
+  Platform key or Codex credential/workspace volumes.
+
+### Changed
+
+- Keep System, Light, and Dark appearance controls plus Ko-fi, GitHub stars, and
+  the current package version available throughout the local install wizard.
+
+### Fixed
+
+- Install operating-system CA certificates in the isolated Codex image so the
+  official ChatGPT device-code sign-in can establish its trusted TLS connection.
+- Wrap local safety and error notifications instead of clipping longer text.
+
+### Security
+
+- Verify the generated Codex capability with a strict authenticated WebSocket
+  upgrade before reporting installation or rotation success.
+- Serialize installation, sign-in, restart, and credential rotation across
+  Relmio processes, with attested stale-lock recovery and fail-closed rollback
+  that restores the prior verifier and re-attests endpoint readiness.
+
 ## [0.4.1] - 2026-08-14
 
 ### Changed

package/README.md

@@ -101,7 +101,8 @@ On desktop, the local wizard keeps progress and sidecar-only safety notes in a
 persistent rail beside the active task; its compact fixed-screen shell avoids
 document scrolling on common laptop screens. On narrow phones, it switches to
 a horizontal progress strip and keeps task scrolling inside the active panel.
-The hosted site keeps the live GitHub star/version control visible.
+Both the hosted site and local wizard keep Ko-fi support, GitHub stars, and the
+current Relmio version visible beside the appearance control.
 
 ## Local Docker endpoints
 
@@ -122,7 +123,15 @@ The OpenAI-compatible `/v1` endpoint is powered only by a Platform API key,
 which the wizard seeds over stdin into a private, labeled Docker volume; it
 does not create a host key file. Your app uses a
 separate Relmio capability that the wizard displays once.
-The bearer remains valid until it is rotated. Browser requests
+The bearer remains valid until it is rotated. After installation, use
+**Rotate client credential** on the Ready screen to replace only that local
+capability. Relmio shows the new one-time credential before activation, verifies
+the replacement endpoint, and preserves the upstream Platform API key or Codex
+credential/workspace volumes. If replacement cannot be verified, Relmio attempts
+to restore the previous verifier and re-attest service readiness. It does not
+retain the previous raw client credential to replay it during rollback. If
+rollback cannot be confirmed, it targets only the exact managed service for
+shutdown and reports whether that stopped state could be verified. Browser requests
 must come from an exact origin entered during setup; wildcards are not allowed,
 and the capability must never be embedded in a public frontend bundle. Platform
 requests use that API project's billing, credits, limits, and permissions, not

package/docs/local-endpoints.md

@@ -77,19 +77,28 @@ Engine.
 
 ## Safe updates and credential rotation
 
-Rerun the browser wizard, select the same target and port, and review the plan
-again. Relmio verifies the existing marker and Docker resource ownership,
-reuses that installation's unique Compose identity, replaces only that managed
-service, and generates a new local client capability. Copy the new capability
-from the one-time result and update the client; the previous capability no
-longer authenticates.
-
-For `openai-api`, every update requires the current Platform API key again. To
-rotate both credentials, supply the replacement Platform key during the update;
-Relmio atomically reseeds its private named volume and independently rotates the
-local client capability. For `codex-chatgpt`, an update retains the private
-Codex home and workspace volumes unless you explicitly delete them, but still
-rotates the local capability.
+To replace only the credential used by your local client, select **Rotate client
+credential** on the installed endpoint's Ready screen. Relmio first stages and
+shows the new one-time capability while the previous capability remains active.
+It then updates and validates the managed Compose configuration, recreates only
+the attested service, and verifies the new bearer against `/v1/models` or the
+authenticated Codex WebSocket handshake before reporting success.
+
+This client-only rotation preserves the upstream Platform API key in its private
+named volume and preserves the Codex home and workspace volumes. If activation
+or verification fails, Relmio restores the previous verifier and re-attests its
+health and loopback publication. Relmio does not retain the previous raw client
+credential, so rollback does not replay an authenticated request with it. If
+that rollback cannot be confirmed, Relmio attempts to stop only the exact
+managed service and reports whether the stopped state could be verified.
+
+Rerun the browser wizard with the same target and port when you need a complete
+managed update. Relmio verifies the marker and Docker resource ownership and
+reuses the installation's unique Compose identity. For `openai-api`, provide the
+current or replacement Platform API key during that full update; Relmio reseeds
+its private named volume independently from the local client capability. A full
+`codex-chatgpt` update retains the private Codex home and workspace volumes unless
+you explicitly delete them.
 
 Do not hand-edit the marker, Compose file, credential volume, or verifier. If
 the marker or resource labels do not attest as one Relmio installation, the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relmio",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Install private local OpenAI API and Codex endpoints with explicit provider credential boundaries, plus the existing isolated n8n sidecar.",
   "keywords": [
     "relmio",

package/src/domain/local-endpoints.js

@@ -359,7 +359,10 @@ tool_suggest = false
 export function createCodexDockerfile() {
   return `FROM node:22-bookworm-slim
 
-RUN npm install --global --ignore-scripts @openai/codex@${CODEX_CLI_VERSION} \\
+RUN apt-get update \\
+    && apt-get install --no-install-recommends -y ca-certificates \\
+    && rm -rf /var/lib/apt/lists/* \\
+    && npm install --global --ignore-scripts @openai/codex@${CODEX_CLI_VERSION} \\
     && npm cache clean --force \\
     && mkdir -p /etc/codex /home/node/.codex /workspace \\
     && chown -R node:node /home/node/.codex /workspace