relmio 0.8.1 → 0.9.0

package/CHANGELOG.md

@@ -7,6 +7,33 @@ checks the registry separately after publication.
 
 ## Unreleased
 
+## [0.9.0] - 2026-08-28
+
+### Added
+
+- Add `relmio assistant`, a dedicated local wizard and isolated companion
+  Compose plan for n8n AI Assistant's self-hosted sandbox and optional SearXNG
+  web search.
+
+### Changed
+
+- Add sourced OpenAI policy context to the GitHub README, npm README, and
+  canonical security guide, including the maintainer's Codex for Open Source
+  acceptance, while preserving the distinction between supported Codex/ChatGPT
+  sign-in patterns and unsupported subscription-to-API conversion, resale,
+  account sharing, or safeguard bypass.
+
+### Security
+
+- Keep the privileged Docker-in-Docker runner separate from the selected n8n
+  network, publish no companion host ports, generate and redact independent
+  sandbox secrets, attest ownership-bound random Compose identities and network
+  aliases, serialize VPS-sidecar and assistant mutations under one single-use
+  plan lock, and retain the strict no-n8n-mutation boundary.
+- Pin every generated AI Assistant companion production image to its reviewed
+  immutable tag and OCI index digest, with regression coverage that rejects
+  floating or digestless references, including the nested sandbox image.
+
 ## [0.8.1] - 2026-08-26
 
 ### Changed
@@ -614,6 +641,7 @@ checks the registry separately after publication.
 - The sidecar uses an internal-only Docker network endpoint and no published
   VPS port.
 
+[0.9.0]: https://github.com/Demonbane18/relmio/compare/v0.8.1...v0.9.0
 [0.1.7]: https://github.com/Demonbane18/relmio/compare/v0.1.6...v0.1.7
 [0.1.6]: https://github.com/Demonbane18/relmio/compare/v0.1.5...v0.1.6
 [0.1.5]: https://github.com/Demonbane18/relmio/compare/v0.1.4...v0.1.5

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://cdn.jsdelivr.net/npm/relmio@latest/docs/images/brand/relmio-logo.png" alt="Relmio gateway android logo" width="180">
+  <img src="https://cdn.jsdelivr.net/npm/relmio@latest/docs/images/brand/relmio-logo-rounded.svg" alt="Relmio gateway android logo" width="180" height="180">
 </p>
 
 # Relmio
@@ -24,16 +24,61 @@ final confirmation before it writes files or deploys a VPS sidecar.
 | Codex App Server | Experimental JSON-RPC/WebSocket | ChatGPT sign-in and a high-trust local capability |
 | Codex Chat Adapter | Experimental `POST /chat` (JSON or opt-in SSE) | ChatGPT sign-in and a bearer for trusted local backends |
 | n8n sidecar | Private Docker-network `/v1` bridge | A local ChatGPT sign-in file, never a host port |
+| n8n AI Assistant companion | Private sandbox; opt-in SearXNG web search | OpenAI Platform API key entered directly in n8n |
 
 ChatGPT sign-in does not become an OpenAI Platform API key. Codex transports
 are not generic `/v1` services and should never be exposed on a LAN or public
 network.
 
+## n8n AI Assistant companion
+
+Run `relmio assistant` for the separate sandbox and optional SearXNG companion.
+Web search is off by default and is bound as an exact boolean to the reviewed
+plan and confirmation; Relmio does not add it silently.
+It uses verified SSH, read-only n8n discovery, and an existing Docker network;
+it never reads ChatGPT/Codex OAuth or changes the existing n8n project.
+ChatGPT/Codex subscription sign-in is not an OpenAI Platform API key. AI
+Assistant is Preview, so review generated workflows before use.
+
+This self-hosted path has a privileged Docker-in-Docker runner for
+advanced/local testing and publishes no host ports; n8n recommends Daytona for
+production. In n8n, enter your own Platform API key directly and keep your
+current supported model selection, including `openai/gpt-5.6-sol` while n8n
+continues to accept it. A separately deployed, Platform-key-backed Relmio endpoint
+may be used through n8n's optional custom endpoint form; its private Relmio
+client credential is not an OpenAI-issued API key. The OAuth sidecar remains
+experimental/private/policy-uncertain and is never auto-selected.
+
 The experimental Chat Adapter's SSE stream succeeds only after its
 `terminal: completed` event. Its local tester stays behind the setup-token-
 protected wizard and uses a short-lived encrypted credential handoff, never a
 direct browser-to-adapter request.
 
+## OpenAI policy evidence and limits
+
+Relmio's maintainer was accepted into OpenAI's [Codex for Open Source
+program](https://learn.chatgpt.com/docs/codex-for-oss-terms) for this project
+in August 2026 and received its limited-duration ChatGPT Pro benefit.
+OpenAI's [advanced Codex configuration](https://learn.chatgpt.com/docs/config-file/config-advanced#oss-mode-local-providers)
+documents custom model providers and OSS mode with Ollama or LM Studio.
+OpenAI Codex Lead Thibault “Tibo” Sottiaux has publicly distinguished supported
+**Sign in with ChatGPT** clients from unsupported subscription-to-API
+conversion, resale, or multi-user sharing ([statement](https://x.com/thsottiaux/status/2090675027670978569)),
+and [confirmed Codex can use open-source models](https://x.com/thsottiaux/status/2067399435009622521).
+OpenAI CEO Sam Altman also [announced ChatGPT-account sign-in for
+OpenClaw](https://x.com/sama/status/2050357911915028689).
+
+These sources support specific documented patterns; they are not blanket
+approval, protocol certification, a contractual amendment, or legal advice.
+Program acceptance supports the maintainer and open-source work; it does not
+approve every integration. Relmio never presents ChatGPT credentials as a
+generic `/v1` API key, and its n8n AI Assistant path requires a user-owned
+OpenAI Platform API key. Relmio prohibits account pooling or sharing,
+credential forwarding, subscription-to-API conversion or resale, and
+rate-limit or safeguard bypass. The legacy OAuth sidecar remains
+experimental/private/policy-uncertain. Read the full
+[policy evidence and scope](https://relmio.vercel.app/docs/security#policy-evidence-and-scope).
+
 ## ChatGPT sign-in lifetime
 
 ChatGPT/Codex sign-in tokens expire, but the official Codex client refreshes
@@ -61,6 +106,7 @@ Full guides use absolute HTTPS links:
 - https://relmio.vercel.app/docs/getting-started
 - https://relmio.vercel.app/docs/local-endpoints
 - https://relmio.vercel.app/docs/vps-and-n8n
+- https://relmio.vercel.app/docs/ai-assistant
 - https://relmio.vercel.app/docs/troubleshooting#local-image-build-failed
 - https://relmio.vercel.app/docs/security
 - https://relmio.vercel.app/docs/reference

package/docs/ai-assistant.md

@@ -0,0 +1,230 @@
+# n8n AI Assistant companion
+
+`relmio assistant` opens a dedicated local wizard for n8n's self-hosted AI
+Assistant sandbox plus an explicit, optional SearXNG web-search service. It is deliberately separate
+from Relmio's existing OAuth sidecar and never reads a ChatGPT/Codex sign-in.
+
+> **Preview:** AI Assistant is Preview. Review every generated workflow before
+> activating it, and use n8n's recommended Daytona sandbox for production.
+
+## What the wizard changes
+
+After SSH host-key confirmation, read-only n8n discovery, a selected existing
+Docker network, and final confirmation exactly set to true, Relmio may first
+create `/docker/n8n-openai-oauth` and write its shared mode-0600 Relmio root
+marker. It then creates only the `assistant-sandbox` child there. It uses the
+independent Compose project identity recorded in its strict, mode-0600 assistant
+marker and does not write existing n8n project files.
+
+The required sandbox companion has three services:
+
+- `relmio-sandbox-certs` bootstraps mTLS certificates once.
+- `relmio-sandbox-api` provides the n8n Sandbox Service API.
+- `relmio-sandbox-runner-1` is a privileged Docker-in-Docker runner on a
+  dedicated, non-published Compose bridge. Treat it as equivalent to root on
+  the host. The bridge retains egress so the runner can pull n8n's sandbox
+  image on first use.
+- `relmio-searxng` provides optional JSON web search only when you opt in during
+  the reviewed plan. Web search is **off by default**; Relmio never adds it
+  silently.
+
+Compose assigns the companion's containers short deterministic names derived
+from the first 16 hexadecimal characters of its recorded installation ID, such
+as `relmio-ai-<generated-id>-api`. The full 128-bit ID remains in ownership
+labels and the managed marker. Existing markers remain valid without migration;
+a later separately confirmed companion update may recreate only its own
+containers to adopt these names. It never renames, recreates, restarts, stops,
+or executes inside n8n.
+
+The sandbox API joins the selected existing n8n Docker network. When enabled,
+SearXNG joins it with a separately generated collision-resistant,
+Docker-internal alias. The selection and aliases are stored in the strict,
+versioned managed assistant marker and reused for updates. The result view
+always shows the sandbox URL and shows this additional stable URL only when web
+search is enabled:
+
+```text
+http://relmio-ai-sandbox-<generated-id>:8080
+http://relmio-ai-searxng-<generated-id>:8080  (when enabled)
+```
+
+There are no `ports:` mappings, reverse-proxy routes, or changes to the
+existing n8n Compose file, image, container, or workflows. Relmio never stops,
+restarts, recreates, rebuilds, or executes inside n8n.
+
+## Prerequisites Relmio will not change
+
+Before making a plan, Relmio read-only inspects the selected n8n container and
+returns only an allowlisted prerequisite status: whether its
+`N8N_ENABLED_MODULES` setting is missing, configured without `instance-ai`, or
+enabled with `instance-ai`. It never returns the container environment or the
+raw setting value. The wizard refuses installation unless `instance-ai` is
+enabled.
+
+Apply the prerequisite through the existing n8n deployment workflow. When the
+variable is missing, use this exact form in the existing n8n service:
+
+```text
+N8N_ENABLED_MODULES=instance-ai
+```
+
+When the variable already contains module entries but lacks `instance-ai`, append
+`instance-ai` as a distinct comma-delimited token while preserving existing
+module entries. Do not replace unknown existing values. For example:
+
+```text
+# Existing service configuration
+N8N_ENABLED_MODULES=module-a,module-b
+
+# Preserve existing entries and append the required token
+N8N_ENABLED_MODULES=module-a,module-b,instance-ai
+```
+
+Use your existing Hostinger/deployment workflow; Relmio does not claim a
+provider-specific UI path. Apply the change to the existing n8n service, then
+redeploy or restart n8n, verify that n8n is healthy, reconnect to Relmio, and
+run discovery again before reviewing a new plan.
+
+Relmio will not edit the existing n8n Compose file, image, or environment;
+restart or recreate n8n; or exec into n8n to make this prerequisite change.
+It reports only the allowlisted status, never the raw environment value. Plan
+for at least **4 GB RAM** and **2 vCPU** for the n8n and companion workload;
+capacity needs can be higher for real workflows.
+
+## Enter the result values in n8n
+
+Relmio generates four separate local 256-bit secrets: the sandbox API key,
+runner registration token, runner API key, and SearXNG secret. It uploads the
+secrets only in the managed mode-0600 `.env` file. The registration, runner,
+and SearXNG secrets are never returned or logged. The sandbox API key is shown
+once in the local result view. Even with web search disabled, the private
+SearXNG secret remains in that `.env`: this lets a later reviewed opt-in start
+only the new SearXNG service without overwriting the running sandbox/runner
+credentials. No SearXNG service, settings file, alias probe, URL, or host port
+is created while it is disabled.
+
+In n8n's AI Assistant settings, enter:
+
+| Dialog | Value |
+| --- | --- |
+| Sandbox Service URL | The stable generated result URL |
+| Sandbox API key | The one-time result value |
+| SearXNG Instance URL | The stable generated result URL, only when web search was enabled |
+
+URLs are stable generated result values; only the sandbox API key is
+one-time-displayed. SearXNG has no user-facing key. When enabled, its generated
+settings explicitly enable the JSON response format n8n needs.
+
+The `includeSearxng` choice is an exact boolean in the reviewed plan and final
+confirmation request; missing, string, or otherwise ambiguous values are
+rejected. A managed disabled installation can later enable SearXNG only after
+Relmio re-attests the existing sandbox resources and the missing SearXNG
+resource name, then starts only SearXNG. Disabling an already managed SearXNG
+service would stop or remove it, so Relmio rejects that change and requires a
+separately authorized cleanup path instead.
+
+## Immutable companion image pins
+
+Every generated production image reference is the reviewed full
+`tag@sha256:<OCI-index-digest>` value. The API/certificate service, privileged
+runner, and nested sandbox are reviewed as one compatible n8n Sandbox Service
+unit; optional SearXNG is pinned independently. Generated Compose never uses
+`latest`, `stable`, a tag-only reference, a digest-only reference, environment
+interpolation, or user input for these images.
+
+The upstream review sources are the [n8n Sandbox Service repository](https://github.com/n8n-io/n8n-sandbox-service), its [API](https://github.com/n8n-io/n8n-sandbox-service/pkgs/container/n8n-sandbox-service-api), [runner](https://github.com/n8n-io/n8n-sandbox-service/pkgs/container/n8n-sandbox-service-runner-dind), and [nested sandbox](https://github.com/n8n-io/n8n-sandbox-service/pkgs/container/n8n-sandbox-service-sandbox) GHCR package pages; and the [SearXNG repository](https://github.com/searxng/searxng) and [GHCR package page](https://github.com/searxng/searxng/pkgs/container/searxng). The n8n setup documentation remains authoritative for product configuration.
+
+For a managed companion, an image change is never automatic: update Relmio
+locally, reconnect for host-key confirmation and read-only discovery, review the
+exact companion-only plan, preserve the recorded SearXNG choice unless you
+deliberately change it, and provide final confirmation. Then verify that only
+managed companion resources changed, no host ports were published, and n8n is
+healthy. Roll back only with the full previously reviewed immutable pin set
+through that same separately confirmed managed update; never pull a moving tag
+or mutate n8n directly. The maintainer procedure is in
+[maintenance.md](maintenance.md#updating-or-rolling-back-ai-assistant-companion-images).
+
+## Model routes
+
+### Direct OpenAI provider
+
+Choose **OpenAI** in n8n and keep the current supported model selection. If your
+n8n instance continues to accept this selection, preserve it:
+
+```text
+openai/gpt-5.6-sol
+```
+
+Enter your own OpenAI Platform API key directly in n8n. Relmio does not request,
+read, transmit, retain, or configure this model credential.
+
+An example model shown in n8n documentation is not a migration requirement.
+Change models only if n8n rejects the current selection or you deliberately
+choose another supported model.
+
+ChatGPT/Codex subscription sign-in is not an OpenAI Platform API key. Relmio
+does not offer it as a compliant model provider for AI Assistant.
+
+### Optional: custom OpenAI-compatible endpoint
+
+n8n's custom/self-hosted OpenAI-compatible dialog defaults to an Ollama-style
+route with **Base URL**, **API key**, and **Model ID** fields. Use it only if you
+already run a separate, n8n-reachable Relmio OpenAI-compatible endpoint backed
+by a user-owned OpenAI Platform API key.
+
+- **Base URL:** that endpoint's `/v1` address.
+- **API key:** that endpoint's private Relmio client credential. It is not an
+  OpenAI-issued API key.
+- **Model ID:** a model ID exposed by the Platform-key-backed endpoint.
+
+The assistant wizard does not deploy a new remote Platform gateway. Relmio's
+existing ChatGPT/Codex OAuth VPS sidecar may be technically compatible, but is
+experimental/private/policy-uncertain. It is not auto-selected, enabled, or
+described as policy-approved for this configuration.
+
+## Platform account guardrails
+
+No setup can guarantee an account is never flagged. For the direct OpenAI
+provider route, use a dedicated OpenAI Platform project/key, keep the key in
+n8n's server-side credential storage, and set project rate/spend limits and
+alerts. Enable usage monitoring, grant least user access, plan rotation/revocation,
+require human review for generated workflows, and keep the provider path free of
+public exposure.
+
+Relmio cannot inject per-user safety identifiers or moderation into n8n's
+direct provider path. Configure any controls available in your Platform project
+and n8n instance; this companion cannot make claims about provider enforcement.
+
+## Verification and failure behavior
+
+Before start, the companion Compose configuration is validated. After start,
+Relmio verifies sandbox API health, the expected running services for the
+selected web-search option, and
+the absence of every host-published port. Immediately before any companion
+write, it reruns the selected container's read-only network and prerequisite
+discovery. The selected network must still exist and the allowlisted
+`instance-ai` status must still be enabled and match the reviewed plan; a
+changed result consumes that plan without installing.
+
+For a new companion or a normal managed update, a post-start safety failure
+stops and removes only the companion project. When adding SearXNG to an
+existing managed sandbox, post-start cleanup removes only the optional SearXNG
+service: the existing sandbox remains and must not be used until an
+administrator verifies its state. If cleanup cannot be confirmed, treat the
+installation as unsafe and do not use the companion until an administrator
+verifies the relevant managed state.
+
+The bounded command allowlist refuses an unmanaged assistant directory, symlinked
+assistant paths, and a symlinked or non-directory `/docker/n8n-openai-oauth`
+parent. It accepts Docker names only after validation. Before any update, start,
+or cleanup, Relmio attests that matching project containers, networks, and
+volumes carry the recorded install identity; it never cleans up an unattested
+project. It also checks every predictable generated companion container name,
+the explicit internal network, and the TLS volume regardless of Compose project
+labels: a new install refuses any match, while an update requires the recorded
+identity labels on every match.
+
+## Reference
+
+- [n8n: Set up AI Assistant](https://docs.n8n.io/deploy/host-n8n/configure-n8n/set-up-ai-assistant)
+- [n8n: Docker Compose installation](https://docs.n8n.io/deploy/host-n8n/install-options/install-using-docker-compose)

package/docs/images/brand/relmio-logo-rounded.svg

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" role="img" aria-labelledby="title">
+  <title id="title">Relmio</title>
+  <defs>
+    <clipPath id="rounded-square">
+      <rect width="512" height="512" rx="112" />
+    </clipPath>
+    <linearGradient id="sage" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#b0c0a6" />
+      <stop offset="1" stop-color="#879f87" />
+    </linearGradient>
+    <linearGradient id="teal" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#12938f" />
+      <stop offset="1" stop-color="#047c79" />
+    </linearGradient>
+  </defs>
+  <g clip-path="url(#rounded-square)">
+    <rect width="512" height="512" fill="url(#sage)" />
+    <rect x="126" y="70" width="430" height="560" rx="215" fill="#f6f0e9" />
+    <rect x="190" y="218" width="194" height="390" rx="97" fill="url(#teal)" />
+    <rect x="190" y="315" width="194" height="293" fill="url(#teal)" />
+    <circle cx="242" cy="292" r="20" fill="#f6f0e9" />
+    <circle cx="332" cy="292" r="20" fill="#f6f0e9" />
+  </g>
+</svg>

package/docs/maintenance.md

@@ -111,6 +111,67 @@ Do not change `openai-oauth@2.0.0` casually. An upgrade requires:
 
 Keep the old Docker image until the new one passes.
 
+## Updating or rolling back AI Assistant companion images
+
+The AI Assistant companion has no automatic remote image upgrade. Relmio never
+edits the existing n8n Compose file, image, or environment, and never directly
+mutates n8n as part of a companion update or rollback.
+
+Maintainers must treat the Sandbox Service API, privileged runner, and nested
+sandbox image as one compatibility unit. Before changing
+`ASSISTANT_COMPANION_IMAGES` in `src/domain/assistant-templates.js`:
+
+1. Review the official [n8n Sandbox Service release notes and source](https://github.com/n8n-io/n8n-sandbox-service), its [API](https://github.com/n8n-io/n8n-sandbox-service/pkgs/container/n8n-sandbox-service-api), [runner](https://github.com/n8n-io/n8n-sandbox-service/pkgs/container/n8n-sandbox-service-runner-dind), and [nested sandbox](https://github.com/n8n-io/n8n-sandbox-service/pkgs/container/n8n-sandbox-service-sandbox) package registries, plus the [SearXNG source](https://github.com/searxng/searxng) and [SearXNG package registry](https://github.com/searxng/searxng/pkgs/container/searxng).
+2. For every candidate, verify the reviewed tag resolves to the intended OCI
+   **index** digest and the required Linux platforms. Record a full immutable
+   `tag@sha256:<digest>` reference; never substitute `latest`, `stable`, a
+   tag-only reference, or a digest-only reference.
+   Inspect each numbered or source-revision tag with the same command pattern:
+
+   ```bash
+   docker buildx imagetools inspect \
+     ghcr.io/UPSTREAM/IMAGE:REVIEWED_VERSION_TAG
+   ```
+
+   Record the top-level `Digest` and required Linux platform entries from that
+   output. Then repeat the inspection with the proposed full
+   `tag@sha256:<digest>` reference and require the same top-level digest. This
+   is maintainer evidence gathering only; it does not authorize an update to a
+   running companion.
+3. Update only the exact source constants, add or update a generated-Compose
+   regression, and run these local release gates from the repository root:
+
+   ```bash
+   node --test \
+     --test-name-pattern="immutable|floating|pinned" \
+     test/assistant.test.js
+   npm run check
+   npm audit --audit-level=high
+   npm pack --dry-run
+   npm --prefix web run lint
+   npm --prefix web run typecheck
+   npm --prefix web run build:vercel
+   npm --prefix web test
+   npm --prefix web audit --audit-level=high
+   ```
+
+   Obtain a fresh security review of the exact change set after every fix.
+   Release only after all gates pass.
+
+For an already managed companion, the administrator updates Relmio locally,
+reconnects and completes host-key confirmation plus read-only discovery, then
+reviews the exact companion-only plan. Keep the recorded SearXNG selection
+unless intentionally changing it, provide the separate final confirmation, and
+then verify that only ownership-labeled companion resources changed, there are
+no host-published ports, and n8n remains healthy. Do not treat a local Relmio
+update as remote-upgrade authorization.
+
+To roll back, restore the previously reviewed complete `tag@sha256` set through
+the same locally updated Relmio build and separately confirmed managed update.
+Repeat read-only discovery, exact-plan review, final confirmation, and the
+post-update checks above. Never roll back by pulling a moving tag or by editing,
+restarting, recreating, or otherwise mutating n8n.
+
 ## If n8n is upgraded
 
 This project does not alter the n8n image. A normal n8n image update can still

package/docs/security.md

@@ -122,6 +122,21 @@ shared, or production service.
   resource limits; and uses root plus only `CHOWN` long enough to atomically
   make the stdin-seeded volume entry readable by the non-root gateway.
 
+### AI Assistant companion image integrity
+
+The generated AI Assistant companion uses reviewed, immutable
+`tag@sha256:<OCI-index-digest>` image references for its API/certificate image,
+privileged runner, nested sandbox image, and optional SearXNG service. The
+Compose format cannot enforce image provenance itself, so the source-level
+regression guard forbids floating or digestless production references,
+including the nested `SANDBOX_RUNNER_DOCKER_SANDBOX_IMAGE` value.
+
+There is no automatic remote upgrade. An upgrade or rollback is a separately
+confirmed managed companion update after read-only discovery and exact-plan
+review; it must preserve the no-n8n-mutation boundary, ownership attestation,
+and no-host-port verification. See the exact procedure in
+[maintenance.md](maintenance.md#updating-or-rolling-back-ai-assistant-companion-images).
+
 ### In-wizard Chat Adapter tester
 
 The Ready screen's Chat Adapter tester is a deliberately narrow convenience
@@ -222,6 +237,34 @@ The local capabilities have separate consequences:
   scope of another agreement. Review the current
   [program terms](https://learn.chatgpt.com/docs/codex-for-oss-terms).
 
+### Policy evidence and scope
+
+The following sources support the narrow provider and authentication patterns
+that Relmio documents. They are not a blanket approval of Relmio, a substitute
+for the current agreements governing an account, or legal advice.
+
+| Evidence | What it supports | What it does not establish |
+| --- | --- | --- |
+| Maintainer acceptance (private OpenAI email, August 2026) and the [Codex for Open Source Program Terms](https://learn.chatgpt.com/docs/codex-for-oss-terms) | Relmio's maintainer was accepted into the program for this project and received a limited-duration ChatGPT Pro benefit covering Codex access. The program is designed to support maintainers of important open-source software. | Program acceptance supports the maintainer and open-source work. It is not an OpenAI security review, product endorsement, or protocol-by-protocol compliance certification. The acceptance email is not published because it contains personal account information. |
+| OpenAI's [Advanced Configuration — OSS mode and local providers](https://learn.chatgpt.com/docs/config-file/config-advanced#oss-mode-local-providers) | Codex supports custom model-provider configuration and an OSS mode with local providers such as Ollama or LM Studio. | It does not authorize turning a ChatGPT subscription credential into a general API credential or bypassing provider restrictions. |
+| [Thibault “Tibo” Sottiaux](https://openai.com/index/openai-to-acquire-astral/), Codex Lead at OpenAI: [open-model statement](https://x.com/thsottiaux/status/2067399435009622521) | The Codex App, CLI, and SDK can run with open-source models rather than only OpenAI models. | Model-provider flexibility does not change authentication, billing, account, or usage-policy requirements. |
+| Tibo: [account-use statement](https://x.com/thsottiaux/status/2090675027670978569) | Using one's own subscription through **Sign in with ChatGPT**, including compatible open-source clients, was distinguished from unsupported conversion of subscription access into API traffic. | It does not approve resale, pooling, forwarding credentials, sharing across users, or subscription-to-API conversion. A social post is not a contractual amendment. |
+| OpenAI CEO Sam Altman: [OpenClaw statement](https://x.com/sama/status/2050357911915028689) | OpenClaw was publicly announced as supporting ChatGPT-account sign-in and subscription use. | Approval of one named integration does not automatically approve unrelated protocols, adapters, deployments, or credential handling. |
+
+Relmio applies these distinctions as engineering controls:
+
+- Native Codex uses the official Codex App Server lifecycle and preserves its
+  protocol instead of exporting a generic OpenAI `/v1` service.
+- The bounded Codex Chat Adapter remains an experimental Relmio-specific
+  interface for the same owner; it is not an OpenAI API replacement.
+- The n8n AI Assistant model route uses a user-owned OpenAI Platform project
+  and API key entered directly in n8n. Relmio never receives that key.
+- The legacy n8n OAuth sidecar remains explicitly
+  experimental/private/policy-uncertain and is not described as approved by
+  the sources above.
+- Relmio prohibits account sharing, pooling, resale, subscription-to-API
+  conversion, rate-limit or safeguard bypass, and credential forwarding.
+
 This repository does not claim that every possible use of the bridge is
 permitted. The account owner is responsible for reviewing the current
 [OpenAI Terms](https://openai.com/policies/terms-of-use/) and usage policies.

package/docs/vps-and-n8n.md

@@ -22,6 +22,9 @@ placeholder; it is not an OpenAI Platform API key.
 
 ## Follow-on guides
 
+- [AI Assistant companion](./ai-assistant.md) covers the separate Preview
+  sandbox, Docker-in-Docker warning, optional SearXNG search, and the direct
+  OpenAI Platform-key model route.
 - [Configure n8n nodes](./n8n-configuration.md) has copy-ready AI Agent and
   HTTP Request recipes.
 - [Beginner manual installation](./manual-install.md) is the auditable fallback

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relmio",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Install private local OpenAI API and Codex endpoints with explicit provider credential boundaries, plus the existing isolated n8n sidecar.",
   "keywords": [
     "relmio",

package/src/browser.js

@@ -26,13 +26,14 @@ function isPrivateWizardUrl(value) {
       url.hostname === "127.0.0.1" &&
       url.port !== "" &&
       Number(url.port) > 0 &&
-      url.pathname === "/" &&
+      (url.pathname === "/" || url.pathname === "/assistant") &&
       url.username === "" &&
       url.password === "" &&
       url.hash === "" &&
       typeof session === "string" &&
       /^[A-Za-z0-9_-]{43}$/u.test(session) &&
-      url.search === `?session=${session}`
+      url.search === `?session=${session}` &&
+      value === `http://127.0.0.1:${url.port}${url.pathname}?session=${session}`
     );
   } catch {
     return false;

package/src/cli.js

@@ -23,9 +23,14 @@ export function isCliEntryPath(entryPath, realpath = realpathSync) {
 }
 
 export function cliMode(argumentsList) {
-  return argumentsList.length === 1 &&
+  if (
+    argumentsList.length === 1 &&
     (argumentsList[0] === "--version" || argumentsList[0] === "-v")
-    ? "version"
+  ) {
+    return "version";
+  }
+  return argumentsList.length === 1 && argumentsList[0] === "assistant"
+    ? "assistant"
     : "wizard";
 }
 
@@ -41,8 +46,12 @@ export async function runCli({
   log = console.log,
   readPackage = () => readFile(packageJsonUrl, "utf8"),
   isInteractive = hasInteractiveTerminal,
+  startServer = startWizardServer,
+  open = openBrowser,
+  attachReopen = attachBrowserReopenOnEnter,
 } = {}) {
-  if (cliMode(argumentsList) === "version") {
+  const mode = cliMode(argumentsList);
+  if (mode === "version") {
     const packageJson = JSON.parse(await readPackage());
     if (typeof packageJson.version !== "string" || packageJson.version === "") {
       throw new Error("Relmio package metadata does not contain a version.");
@@ -59,21 +68,25 @@ export async function runCli({
   }
 
   const sessionToken = randomBytes(32).toString("base64url");
-  const wizard = await startWizardServer({ sessionToken });
-  const url = `${wizard.origin}/?session=${sessionToken}`;
+  const wizard = await startServer({ sessionToken });
+  const url = `${wizard.origin}${mode === "assistant" ? "/assistant" : "/"}?session=${sessionToken}`;
 
   log("");
   log("Relmio");
   log("---------");
   log(`Local wizard: ${url}`);
   log("");
-  log("This creates a separate sidecar and never restarts n8n.");
+  log(
+    mode === "assistant"
+      ? "This creates only the separate AI Assistant companion and never restarts n8n."
+      : "This creates a separate sidecar and never restarts n8n.",
+  );
   log("Keep this Terminal window open while using the wizard.");
   log("Press Control+C to stop.");
   log("");
 
-  openBrowser(url);
-  const detachBrowserReopen = attachBrowserReopenOnEnter({ url });
+  open(url);
+  const detachBrowserReopen = attachReopen({ url });
 
   let closing = false;
   async function close() {