docs/openai-source-check-2026-09-29.md
Rama main · réplica de lectura del repositorio original.
# Wizard credential-consent source check
Review date: 2026-09-29
**Historical review:** this report describes the candidate and prior
credential-copy bridge inspected on 2026-09-29. Its source findings are not a
description of the current implementation. See the
[2026-10-04 source check](openai-source-check-2026-10-04.md).
This review concerns the VPS wizard's credential-upload disclosure and the existing private n8n ChatGPT/Codex bridge. OpenAI pages below were retrieved independently today; the supplied 2026-09-29 pre-fix source report and [earlier data-flow review](security.md#2026-09-28-private-candidate-openai-source-check) supply the implementation and installed-dependency findings. Selected candidate UI identity guards were also inspected. The supplied report inspected a pre-fix donor implementation; its mutable-status defect is historical context, not a description of this candidate. This is neither legal advice nor release certification. No live sign-in, credential access, provider request, SSH connection, deployment, or post-fix browser test was performed.
The current candidate's UI source validates the server-attested full-scope SSH identity from the local server's connection response and freezes it for review. Browser guards compare host, port, fingerprint, username, authentication method, privilege, login and effective UIDs, scope, and generation against the server-attested connection identity before guarded remote requests. They recheck after successful non-retiring operations; successful `/api/install` and `/api/assistant/install` requests retire the adopted identity instead. Unsuccessful HTTP responses do not invoke the after hook. A missing or changed identity clears review and approval. The source also prevents a superseded startup status response from replacing the adopted decision. These are source-level observations, not browser acceptance or proof of deployed bytes. Host-key confirmation, identity re-verification against the server's connection response, and separate final human confirmation before remote writes remain distinct safeguards; the browser performs these comparison guards.
## Official sources checked
The [Sign in with ChatGPT article](https://help.openai.com/en/articles/20001410-sign-in-with-chatgpt) was retrieved first. Its displayed date was “Updated: 2 days ago,” not an absolute publication date. The other pages were retrieved on 2026-09-29; dates below are displayed page dates, where present.
| OpenAI source | Displayed date |
| --- | --- |
| [Codex authentication](https://developers.openai.com/codex/auth/) (resolves to [Authentication](https://learn.chatgpt.com/docs/auth)) and [Codex models](https://developers.openai.com/codex/models/) (resolves to [Models](https://learn.chatgpt.com/docs/models)) | No date shown |
| [API authentication](https://developers.openai.com/api/reference/overview#authentication), [image generation](https://developers.openai.com/api/docs/guides/image-generation), and [text to speech](https://developers.openai.com/api/docs/guides/text-to-speech) | No date shown |
| [Videos API deprecation](https://developers.openai.com/api/docs/deprecations#2026-03-24-sora-2-video-generation-models-and-videos-api) | Shutdown 2026-09-24 |
| [Terms of Use](https://openai.com/policies/terms-of-use/) (canonical [ROW Terms](https://openai.com/policies/row-terms-of-use/)) | Published/effective 2026-01-01 |
| [Europe Terms of Use](https://openai.com/policies/eu-terms-of-use/) | Updated 2026-01-16 |
| [OpenAI Services Agreement](https://openai.com/policies/services-agreement/) | Updated 2025-12-01; effective 2026-01-01 |
| [Service Terms](https://openai.com/policies/service-terms/) | Updated 2026-09-21 |
| [Usage Policies](https://openai.com/policies/usage-policies/) | Effective 2025-10-29 |
| [Privacy Policy](https://openai.com/policies/privacy-policy/) (canonical [Services Communications Privacy Policy](https://openai.com/policies/services-communications-privacy-policy/)) | Updated 2026-07-30 |
| [Europe Privacy Policy](https://openai.com/policies/eu-privacy-policy/) | Updated 2026-08-24 |
| [API data controls](https://developers.openai.com/api/docs/guides/your-data) | No page-update date shown; 2023-03-01 is a training-policy date |
Provider evidence came only from official OpenAI sites. The dependency and deployment descriptions below are provisional local-source findings, not OpenAI documentation or attestation of a running deployment. Private correspondence and social posts were not used as permission evidence.
## Identity, consent, and permissions
The Help Center article describes identity sign-in for supported external applications. It says those applications receive name, email, and an optional profile picture. Access to other data or actions requires separate authorization; organization approval does not replace member authorization or existing permissions. Relmio's bridge is different: it invokes pinned `@openai/codex@0.154.0` using `codex -c cli_auth_credentials_store="file" login`, then reads and copies the complete credential JSON. It is not the article's identity-only release. [Codex authentication](https://learn.chatgpt.com/docs/auth) documents browser credentials returning to Codex, storage in `CODEX_HOME`, and copying a login cache to a trusted headless machine or container. It recommends API keys for programmatic workflows and documents permission-controlled Enterprise Codex access tokens for trusted non-interactive Codex work. It does not expressly approve this third-party n8n-compatible transport.
The wizard's checkbox authorizes deployment to the selected same-owner VPS, including uploading that complete file and installing or updating a private sidecar. It is deployment consent, not an OpenAI delegated grant. Credential-bearing VPS operations require an already-approved direct-root, UID 0 session; model-only `sudo -n` does not authorize them. Relmio supplies no explicit OAuth scope list to the host Codex login and does not inspect requested or granted scopes. Nonempty access, ID, and refresh-token fields are structural validation only. The dependency's default `openid profile email offline_access` list does not prove what the separate official Codex CLI requested or what OpenAI granted.
The applicable agreement depends on account and region, not just the VPS location. The individual [ROW](https://openai.com/policies/terms-of-use/) and [Europe](https://openai.com/policies/eu-terms-of-use/) Terms restrict credential sharing, programmatic extraction, and circumvention of limits or safeguards. The business [Services Agreement](https://openai.com/policies/services-agreement/) permits API integration under its terms while restricting shared individual credentials, unauthorized extraction, and avoiding usage limits; [Service Terms](https://openai.com/policies/service-terms/) require documented API use. Neither a successful login nor private deployment resolves whether this exact bridge is permitted. No blanket compliance or violation determination is made.
## Model, image, audio, and video boundaries
[Codex models](https://learn.chatgpt.com/docs/models) says availability depends on rollout, sign-in method, client, plan, and workspace permissions. Selection does not grant access. [Platform API authentication](https://developers.openai.com/api/reference/overview#authentication) uses API keys or workload-identity access tokens; a ChatGPT/Codex subscription credential is not thereby a general Platform API credential.
Relmio appends Flare and Sunburst IDs to successful model listings. A list does not prove generation or account entitlement. The supplied local dependency review found image generation/edit compatibility handlers; that is provisional capability evidence, not provider approval. The [official image guide](https://developers.openai.com/api/docs/guides/image-generation) describes Platform API capabilities and possible organization verification, not subscription-bridge entitlement. The current sidecar rejects `/v1/audio` with HTTP 501, including speech, transcription, and translation. Refreshing sign-in cannot add TTS. The [speech guide](https://developers.openai.com/api/docs/guides/text-to-speech) documents a separate Audio API and AI-generated-voice disclosure. [Service Terms](https://openai.com/policies/service-terms/) treat ChatGPT Voice Output separately. No model, image, audio, or TTS entitlement was tested.
The supplied 2026-09-29 official-source check also identified an existing backend disclosure mismatch: `src/gateway/openai-oauth-sidecar.mjs:44` returns HTTP 501 for `/v1/videos`, but its message recommends a separate OpenAI Platform video connection. The [official deprecation notice](https://developers.openai.com/api/docs/deprecations#2026-03-24-sora-2-video-generation-models-and-videos-api), fetched in that check, records the Videos API shutdown on 2026-09-24 with no replacement. The current wizard at `src/ui/index.html:270` correctly discloses the shutdown. This backend mismatch is outside the UI-only change and is neither introduced nor fixed by this release. This is a source finding, not runtime evidence or a claim of video capability.
## Data flow and recipients
The paths below come from the supplied pre-fix implementation/dependency report, with the consent-state correction separately checked in the candidate UI source. They describe source behavior, not observed live traffic or retention.
| Stage | Reads, stores, transmissions, and processing parties |
| --- | --- |
| SSH authentication | The browser sends host, port, username, approved fingerprint, privilege choice, and password or agent choice to the local Relmio server. The page clears password input after building the request. Relmio configures `ssh2` for the selected method, verifies the host key, and disables agent forwarding. The local agent participates in agent authentication; the SSH server receives authentication traffic. This browser flow does not upload private-key contents. |
| Consent identity | The local server attests the SSH connection identity; the browser freezes and compares it before review, approval, and remote operations. An independent startup status response must not overwrite the adopted decision. In the supplied pre-fix report, consent text instead read mutable `#ssh-session` status text. Identity metadata and the deployment checkbox are not OAuth grants. |
| Host credential | Codex writes into an attempt-specific `CODEX_HOME` under Relmio's protected credential directory. Relmio validates and reads the complete JSON, including access, ID, and refresh tokens and account metadata. Protected directories use mode `0700` and staged/promoted files mode `0600` (with platform protections on Windows). The default final file is `~/.n8n-openai-oauth/auth.json`, overridable through `N8N_OPENAI_OAUTH_HOME`. Pending cleanup is best-effort. |
| VPS recipient | Relmio sends the complete credential by SFTP to `/docker/n8n-openai-oauth/auth/auth.json` with mode `0600`. The SSH server, host storage, Docker runtime, and private sidecar process it. The auth directory is mounted at `/home/node/.codex`, where the third-party handler reads the file. The reviewed response returns status and models to the browser, not credential bytes. Trusted peer containers on the selected network can reach the sidecar despite no published host port. |
| Local bridge recipient | For local Docker, the daemon receives the credential over subprocess stdin. A network-disabled, logging-disabled seed helper writes the private `oauth-auth` volume mounted in the sidecar at `/home/node/.codex`; the host source file remains separate. Refresh may retain quiesce or rollback snapshots. |
| Provider and registry recipients | Provisional `openai-oauth` 2.0.0 source reads token/account claims and refresh metadata, refreshes and rewrites its auth-file copy, and sends supported n8n prompts, messages, tool data, inline inputs, and image-edit inputs to `https://chatgpt.com/backend-api/codex` with access-token bearer and account-ID headers. Refresh tokens go to `https://auth.openai.com/oauth/token`; responses return through the sidecar to n8n/client. Host login invokes npx for pinned Codex; bridge builds obtain a Node image and pinned package via npm. Model discovery requests `https://registry.npmjs.org/@openai/codex/latest` without an added OpenAI bearer. Registry mirrors, CDNs, image bytes, and deployed package bytes were not inspected. A FedRAMP-related claim may add a header, not proof of compliant residency. |
| Logs and further access | Relmio captures bounded host-login stdout/stderr in memory and maps failures to fixed messages; SSH command output is bounded. The local seed helper disables Docker logs; the main sidecar sets no explicit Docker log driver. The dependency has optional request logging (`CODEX_OPENAI_SERVER_LOG_REQUESTS=1`) that Relmio does not enable; dependency errors may return upstream text to clients. Current Codex documentation mentions `codex-login.log`, but pinned-binary behavior and retention were not inspected. n8n execution history, Docker logs, SSH audit systems, backups, privileged host/platform administrators, provider processing, and workflow-selected external tools are additional possible access/retention boundaries. Source inspection does not establish that a package author or any particular administrator received credentials or prompts. |
The [ROW privacy policy](https://openai.com/policies/privacy-policy/) and [Europe privacy policy](https://openai.com/policies/eu-privacy-policy/) describe account, content, device, usage and log data, international processing, and recipient categories such as vendors, affiliates, administrators, and required disclosures. They do not identify actual recipients or retention for this deployment. The [Platform API data controls](https://developers.openai.com/api/docs/guides/your-data), including no-training defaults and approved retention controls, do not automatically apply to this subscription bridge.
## Unverified
Actual Codex requested/granted scopes, account and workspace permissions, applicable agreement, permission for this transport, model/image entitlement, deployed bytes, provider-side retention/training settings, onward recipients, and native credential-store policy enforcement remain unknown. File presence and structural validation do not prove credential validity. The supplied pre-fix source report was fetched today by the release coordinator; this document independently retrieved the official pages and inspected selected current UI guards, but did not independently reproduce its entire dependency or data-flow audit. Final candidate verification still needs to exercise the adopted-identity consent, stale-status suppression, review invalidation, and regression paths. No post-fix acceptance, screenshot archival, or release availability is asserted.