docs/node24-luna-source-check-2026-09-14.md

Rama main · réplica de lectura del repositorio original.

# Node.js 24 and hosted Luna source check

Review date: 2026-09-14

**Historical hosted-chat review:** its Luna model and hosted-chat findings do
not describe current behavior. The website's `/api/chat` now returns `410 Gone`;
local open-source SIWC is a separate flow. See the
[2026-10-04 source check](openai-source-check-2026-10-04.md).

This review covers the browser wizard's Node.js runtime requirement and the
hosted web chat's default model. It records technical and policy boundaries; it
is not a legal opinion and does not establish account entitlement.

## Current official sources

- [GPT-5.6 Luna model](https://developers.openai.com/api/docs/models/gpt-5.6-luna)
- [Sign in with ChatGPT](https://help.openai.com/en/articles/20001410-sign-in-with-chatgpt)
- [Codex authentication](https://learn.chatgpt.com/docs/auth)
- [OpenAI API authentication](https://developers.openai.com/api/reference/overview#authentication)
- [OpenAI Terms of Use](https://openai.com/policies/row-terms-of-use/)
- [OpenAI Services Agreement](https://openai.com/policies/services-agreement/)
- [OpenAI Privacy Policy](https://openai.com/policies/privacy-policy/)
- [Node.js releases](https://nodejs.org/en/about/previous-releases)
- [Node.js v22 to v24 migration](https://nodejs.org/en/blog/migrations/v22-to-v24)
- [Node.js 24.21.0 release files](https://nodejs.org/download/release/v24.21.0/)
- [Node.js 24.21.0 checksums](https://nodejs.org/download/release/v24.21.0/SHASUMS256.txt)

## Findings

The official model page identifies `gpt-5.6-luna` as the exact model ID and
lists the Responses API, streaming, and text input/output as supported. The
hosted chat already sends a bounded text request to `/responses`, so this update
changes only that request's model value and the synchronized visible label. It
does not add audio, image generation, fine-tuning, tools, or another endpoint.

Node.js 24 is an LTS release line. The official release index identified
24.21.0 as the latest Node.js 24 LTS release during this review and publishes
the macOS, Linux, and Windows archives used by Relmio. The POSIX and PowerShell
launchers continue to select the matching current `latest-v24.x` archive from
the official checksum manifest. The native CMD launcher pins 24.21.0 because it
uses reviewed embedded digests rather than evaluating remote manifest text:

| Archive | Official SHA-256 |
| --- | --- |
| `node-v24.21.0-win-x64.zip` | `158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541` |
| `node-v24.21.0-win-arm64.zip` | `8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921` |

The Node.js migration guide notes that Node.js 24 binaries require macOS 13.5
or newer, use OpenSSL 3.5 with stronger minimum key sizes, and include stricter
runtime validation. Relmio therefore requires its complete tests on Node.js 24;
this source review alone is not compatibility proof for every host.

## Identity, permission, and capability boundaries

The Sign in with ChatGPT article describes identity sign-in for supported
external applications and says name, email address, and profile image are the
identity information shared. Additional access requires a separate permission
request. That identity-only description does not match or authorize Relmio's
third-party ChatGPT/Codex compatibility transport.

The Codex authentication documentation separates ChatGPT subscription sign-in
from API-key usage-based access and says the chosen method controls the
applicable workspace and data policies. The API reference separately documents
API keys and workload identity for OpenAI Platform requests. Relmio does not
convert the browser session into a Platform API key.

The model page proves that the model ID and Responses capability exist in the
OpenAI API catalog. It does not prove that a particular ChatGPT account, OAuth
grant, hosted network, or compatibility transport can use the model. Identity
sign-in, any additional permission grant, and model capability remain separate
checks.

## Relmio data flow for the changed web chat

- **Reads:** the browser component reads the user's current prompt and asks the
  pinned OAuth client for authorization headers. The server route reads the
  prompt, authorization session, and account context for that request.
- **Stores:** the UI keeps at most six prompt/answer exchanges in React state for
  the current tab. Project copy states that the browser OAuth client encrypts
  its stored session and that disconnecting removes it. The Relmio server does
  not keep a reusable OAuth session or conversation history.
- **Transmits:** the browser sends the prompt and OAuth request headers to the
  Relmio web route. The server sends the prompt, fixed system instructions,
  `gpt-5.6-luna`, low reasoning effort, and streaming request settings through
  the pinned OpenAI OAuth transport. The receiving parties are the Relmio web
  host and OpenAI's ChatGPT/Codex backend; network and platform subprocessors
  may apply under their respective terms.
- **Logs:** Relmio logs only a fixed failure category or upstream HTTP status
  category for failed chat requests. It does not deliberately log prompts,
  response bodies, authorization headers, account IDs, or OAuth tokens. OpenAI
  documents collection of content, account, usage, device, and log data;
  provider-side retention for this exact compatibility flow remains unknown.

The changed Node.js requirement does not add a credential, provider, or data
recipient. The local and VPS OAuth bridge flows, their default scopes, and n8n
configuration are unchanged by this update.

The later hosted-chat and browser-wizard Test AI Chat feedback refinement
reviewed these same official sources again on 2026-09-14. It changes only
browser presentation and accessibility state for existing streams: connecting,
waiting for first text, streaming, completion, interruption, and failure. It
does not change the hosted model, endpoint, request body, OAuth headers or
scopes, retention, logging, data recipients, or the unresolved permission and
entitlement boundaries recorded here. The local tester continues to relay the
existing authenticated Chat Adapter `POST /chat` SSE contract; external clients
such as n8n do not receive the new presentation lifecycle.

## Terms and unresolved questions

The individual Terms prohibit credential sharing, programmatic extraction, and
bypassing restrictions or protective measures. The Services Agreement permits
API integration for covered customers while separately restricting shared
credentials, extracted data, and circumvention. Neither document specifically
approves Relmio's third-party ChatGPT/Codex credential transport.

Unresolved items:

- Whether OpenAI permits this exact compatibility transport for the account and
  use case remains unresolved.
- The actual OAuth consent screen, granted scopes, and account entitlement were
  not inspected in this source-only update.
- A live hosted `gpt-5.6-luna` response was not requested, so account and hosting
  availability remain unverified.
- OpenAI-side retention and logging for this exact flow require confirmation
  from the account's applicable plan, workspace settings, and agreement.
- Native Windows launcher execution remains a separate CI/acceptance gate; the
  reviewed checksums establish archive identity, not successful execution on
  every Windows host.