docs/openai-source-check-2026-10-01.md
Rama main · réplica de lectura del repositorio original.
# Frontend sign-in and credential-disclosure source check
Review date: 2026-10-01
**Historical review:** this report describes the hosted and credential-copy
implementation inspected on 2026-10-01, before the current local SIWC flow.
Its implementation findings do not describe current runtime behavior. See the
[2026-10-04 source check](openai-source-check-2026-10-04.md).
This review covers the redesigned local wizard and dashboard, the hosted home and install pages, the hosted chat sign-in and request route, and their README, security, FAQ, and troubleshooting disclosures. It follows the [2026-09-29 check](openai-source-check-2026-09-29.md), but independently inspects the current application source and installed OAuth dependency code.
This is a read-only source review, not legal advice, release certification, or runtime acceptance. No files were changed, credentials accessed, sign-in completed, forms submitted, provider APIs called, or installs, builds, tests, SSH operations, or deployments run. Browser rendering and deployed Vercel bytes were not checked. References identify the worktree source inspected; concurrent edits can move line numbers. The comparison below uses the previous report as its historical baseline. A Git diff against `HEAD` was not available through this review's tools, so statements about changes mean changes from that report's recorded coverage and disclosures, not a independently verified commit-by-commit attribution.
Finding labels:
- **Confirmed:** supported by a fetched official OpenAI source.
- **Observed:** present in Relmio source or disclosure text; not a runtime claim.
- **Provisional:** based on installed third-party implementation or other non-OpenAI evidence; not provider approval or proof of deployed behavior.
- **Open:** the reviewed evidence does not resolve the question.
The main finding is that Relmio's hosted chat does **not** implement the currently documented OpenAI Sign in with ChatGPT identity or open-source plan-usage flow. It uses a third-party Codex-oriented OAuth flow, persists credentials in browser storage, and sends a reusable access token to a hosted server for inference through ChatGPT's `backend-api`. The newer official documentation supplies specific requirements against which this differs. Request-scoped server handling and encrypted browser storage are useful implementation facts, but neither establishes permission for this flow.
## Official sources checked
The [Sign in with ChatGPT article](https://help.openai.com/en/articles/20001410-sign-in-with-chatgpt) was fetched first. All sources below were retrieved on 2026-10-01. Relative update labels are reproduced as shown, not converted into asserted publication dates.
| OpenAI source | Displayed date |
| --- | --- |
| [Sign in with ChatGPT](https://help.openai.com/en/articles/20001410-sign-in-with-chatgpt) | Updated: 2 days ago |
| [Using your ChatGPT plan in other apps and sites](https://help.openai.com/en/articles/20001542-using-your-chatgpt-plan-in-other-apps-and-sites), reached through `https://help.openai.com/articles/20001542` | Updated: 4 hours ago |
| [Sign in with ChatGPT developer index](https://developers.openai.com/siwc) | No date shown |
| [On your website](https://developers.openai.com/siwc/website.md) | No date shown |
| [ChatGPT plan usage overview](https://developers.openai.com/siwc/token-sharing-open-source.md) | No date shown |
| [Registration and sign-in](https://developers.openai.com/siwc/token-sharing-open-source/sign-in.md) | No date shown |
| [Accounts and sessions](https://developers.openai.com/siwc/token-sharing-open-source/profiles-and-sessions.md) | No date shown |
| [Token reference](https://developers.openai.com/siwc/token-sharing-open-source/token-reference.md) | No date shown |
| [Models and inference](https://developers.openai.com/siwc/token-sharing-open-source/models-and-inference.md) | No date shown |
| [Preview limitations](https://developers.openai.com/siwc/token-sharing-open-source/preview-limitations.md) | No date shown |
| [Self-hosted VMs](https://developers.openai.com/siwc/token-sharing-open-source/self-hosted-vms.md) | No date shown |
| [UI/UX guidelines](https://developers.openai.com/siwc/ui-ux-guidelines.md) | No date shown |
| [Codex authentication](https://developers.openai.com/codex/auth/), resolving to [Authentication](https://learn.chatgpt.com/docs/auth) | No date shown |
| [Codex models](https://developers.openai.com/codex/models/), resolving to [Models](https://learn.chatgpt.com/docs/models) | No date shown; includes a GPT-5.5 retirement date of 2026-10-14 |
| [API authentication](https://developers.openai.com/api/reference/overview#authentication) | No date shown |
| [Image generation](https://developers.openai.com/api/docs/guides/image-generation) | No date shown |
| [Text to speech](https://developers.openai.com/api/docs/guides/text-to-speech) | No date shown |
| [Videos API deprecation](https://developers.openai.com/api/docs/deprecations#2026-03-24-sora-2-video-generation-models-and-videos-api) | Notice dated 2026-03-24; shutdown 2026-09-24; no replacement listed |
| [Terms of Use](https://openai.com/policies/terms-of-use/), canonical [ROW Terms](https://openai.com/policies/row-terms-of-use/) | Published/effective 2026-01-01 |
| [Europe Terms of Use](https://openai.com/policies/eu-terms-of-use/) | Updated 2026-01-16 |
| [OpenAI Services Agreement](https://openai.com/policies/services-agreement/) | Updated 2025-12-01; effective 2026-01-01 |
| [Service Terms](https://openai.com/policies/service-terms/) | Updated 2026-09-29 |
| [Sign in with ChatGPT Terms](https://openai.com/policies/sign-in-with-chatgpt-terms/) | Dated 2026-09-29 |
| [Usage Policies](https://openai.com/policies/usage-policies/) | Effective 2025-10-29 |
| [Privacy Policy](https://openai.com/policies/privacy-policy/), canonical [Services Communications Privacy Policy](https://openai.com/policies/services-communications-privacy-policy/) | Updated 2026-07-30 |
| [Europe Privacy Policy](https://openai.com/policies/eu-privacy-policy/) | Updated 2026-08-24 |
| [API data controls](https://developers.openai.com/api/docs/guides/your-data) | No page-update date shown; 2023-03-01 is the stated API training-policy date |
Provider conclusions use only official OpenAI sources. The EvanZhouDev package, its GitHub attribution, and the Chrome and Firefox extension links in Relmio are **Provisional** implementation/supply-chain references, not official OpenAI evidence. The store listings and installed extension binaries were not independently inspected. Package authorship does not establish that its author receives user data.
### What changed since the previous check
**Confirmed:** The previous report recorded Service Terms updated 2026-09-21. The fetched page now says 2026-09-29 and includes section 15, which incorporates separate Sign in with ChatGPT Terms. Those terms are dated 2026-09-29. They expressly address supported sign-in, application identity, storage, user-controlled runtimes, consent for background usage, connected-application-only use, and prohibited pooling or transfer.
**Confirmed:** Today's Help Center article expressly separates identity sign-in from a later request to use eligible ChatGPT plan usage. The linked plan-usage article describes Plus/Pro eligibility, app limits, separately enabled credit use, and disconnection through ChatGPT settings. These details and the developer plan-usage contract were not covered in the September 29 report. Because that report did not preserve full source snapshots, this review does not claim when each individual sentence was added.
**Confirmed:** Current developer documentation specifies registration using the application's own identity, an issued client ID, a stable host identifier, explicit plan-usage scopes, ID-token validation, and inference at `https://api.openai.com/v1/responses`. It explicitly says not to use ChatGPT `backend-api` endpoints for that flow. Accounts and sessions says to keep tokens out of browser storage and describes renewable-session revocation. This is more specific evidence than the earlier report's general policy uncertainty.
**Observed:** The previous review concentrated on the VPS credential-copy consent and SSH identity correction. The current frontend adds a materially different disclosure surface: hosted browser credential storage and request-time forwarding to the hosted chat server (`web/app/chat/page.tsx:30-33,42-70`; `web/app/components/ChatConsole.tsx:121-129,445-467`). That surface needs its own permission and privacy assessment; it cannot inherit the private-VPS review.
**Observed:** The wizard still visibly labels the bridge unofficial and policy-uncertain, distinguishes saved credentials from identity-only sign-in, and says upload consent is not an OpenAI permission (`src/ui/index.html:204-225`). The local n8n flow now states the private-volume copy explicitly in review and confirmation (`src/ui/local.js:3103-3104,3199,3230-3232`). These preserve the earlier report's core warning. The hosted homepage instead makes a broad no-token-logging claim (`web/app/page.tsx:20-22`), and the hosted chat does not carry an equivalent unofficial/policy-uncertain warning beside connection.
The other retrieved policy dates listed in the previous report match today's displayed dates. Matching dates do not prove identical page bodies. The Videos API shutdown remains confirmed. Historical source-check sections should remain historical rather than be silently rewritten as current approval.
## Identity, consent, and permissions
### Check 1: identity sign-in
**Confirmed:** The Help Center identity contract releases name, email, and an optional profile picture to supported external applications. Identity sign-in can finish without approving plan usage. Identity sign-in alone does not authorize access to conversations, memory, files, or other product capabilities. The website guide describes an application-specific registered client, state/PKCE/nonce, verified ID-token claims, and an application session. It says an identity-only client must not require OpenAI access or refresh tokens.
**Observed / Provisional:** Hosted Relmio supplies no client ID, scope, issuer, or redirect override to `SignInWithChatGPT` (`web/app/components/ChatConsole.tsx:446-461`). Installed `@openai-oauth/react` is third-party version 2.0.0 (`web/node_modules/@openai-oauth/react/package.json:1-3,49-67`). Its defaults use a fixed client ID, `openid profile email offline_access`, `https://auth.openai.com/oauth/authorize`, `codex_cli_simplified_flow=true`, and a `http://localhost:1455/auth/callback` extension handoff (`web/node_modules/@openai-oauth/core/dist/runtime.js:6-10,179-205`; `web/node_modules/@openai-oauth/web/dist/index.js:8-16,459-504`). The session requires an access token and account ID and can retain ID and refresh tokens. That is not identity-only sign-in.
**Provisional:** The dependency validates callback state, but its JWT helper decodes claims without verifying the signature. The inspected flow does not perform the documented issuer/audience/nonce/signature checks or retain and check granted plan-usage scopes (`web/node_modules/@openai-oauth/core/dist/runtime.js:60-137`; `web/node_modules/@openai-oauth/web/dist/index.js:323-347,505-549`). The nonce embedded in the extension's encoded state is not an OIDC nonce validated against an ID token.
**Observed:** The local n8n wizard starts official Codex CLI login and later reads/copies its complete credential JSON (`src/services/oauth.js:19,258-292,172-198`). Its disclosure correctly says it is not identity-only. The separate managed Codex dashboard uses an App Server `account/login/start` request with `type: chatgptDeviceCode`, not the hosted extension (`src/services/codex-login.js:158-168,203-234`; `src/ui/local.js:5277-5294`).
**Open:** No evidence establishes that Relmio's hosted application is an approved participating identity client, that this fixed-client extension flow is authorized for Relmio, or that the displayed account claims were provider-validated. A stored-session `Connected` badge is not that evidence: it is driven by dependency state, including reading a saved session (`web/app/components/ChatConsole.tsx:403-408`; `web/node_modules/@openai-oauth/react/dist/useSignInWithChatGPT.js:63-73`).
### Check 2: separately approved permissions and ChatGPT plan usage
**Confirmed:** The official open-source flow requests identity scopes `openid profile email` separately from plan-usage scopes `offline_access resource.invoke chatgpt.tokens.use.direct`. Before inference it checks the returned grant for `chatgpt.tokens.use.direct`. Initial registration uses `dynamic_agent_client`, the app's actual name, and `ext_agent_host_id`, then saves the issued client ID. OAuth registration and a deployment checkbox serve different purposes.
**Observed / Provisional:** Hosted Relmio uses only the dependency's default `openid profile email offline_access` request. It does not supply `resource.invoke`, `chatgpt.tokens.use.direct`, the documented resource, an application registration, or a host ID, and does not check the returned plan-usage grant before forwarding requests (`web/app/components/ChatConsole.tsx:446-461`; `web/node_modules/@openai-oauth/core/dist/runtime.js:179-235`; `web/app/api/chat/route.ts:169-191`).
**Observed:** The host Codex invocation passes no explicit OAuth scope argument. Relmio's validation checks JSON shape, `auth_mode`, and nonempty access, ID, and refresh-token fields, not their issuer, granted scopes, or authorization for a separate bridge (`src/services/oauth.js:172-198,263-272`). Its actual CLI-requested/granted scopes remain **Open**; the third-party browser default must not be substituted for them.
**Confirmed / Observed:** The SIWC plan-usage documentation requires the public Responses endpoint and expressly excludes `backend-api`. The hosted route's dependency defaults to `https://chatgpt.com/backend-api/codex`; the n8n sidecar uses the same package family and backend (`web/node_modules/@openai-oauth/core/dist/runtime.js:6,246-266,573-585`; `node_modules/@openai-oauth/core/dist/runtime.js:6,246`; `src/gateway/openai-oauth-sidecar.mjs:183-184`). Neither flow matches that documented transport.
**Confirmed / Observed:** SIWC Terms require requests from a local runtime or a remote runtime controlled only by the user. They require supported sign-in, prohibit general-purpose access for unrelated tools, and require a privacy notice before processing. Accounts and sessions explicitly says to keep tokens out of browser storage. Hosted Relmio persists tokens in IndexedDB and runs provider requests from its hosted Node route. Request-scoped credentials do not resolve these runtime, browser-storage, registration, or grant mismatches.
**Observed:** VPS approval names the adopted SSH recipient and authorizes a credential upload plus sidecar changes. Local approval authorizes the private-volume copy. The code preserves the distinction from provider consent (`src/ui/app.js:1124-1134,1163-1169,1189-1193`; `src/ui/local.js:3230-3232`; `src/ui/ssh-form.js:37-93`). This is useful deployment consent, not a ChatGPT plan-usage grant.
**Open:** The exact applicable agreement depends on the account, region, and any separate written agreement. The SIWC Terms' persistent-storage wording says local/user-controlled, not remote or managed; the developer sessions and self-hosted-VM guides also describe protected self-hosted storage and credential transfer. That tension needs clarification for a proposed compliant VM implementation. It does not establish approval for copying a Codex credential into a general-purpose n8n-compatible bridge. Likewise, the Terms' connected-application-only restriction needs assessment for Relmio's advertised use across other tools.
The ROW and European consumer Terms, Services Agreement, Service Terms, and Usage Policies remain relevant. Their credential-sharing, unauthorized extraction, and anti-circumvention restrictions cannot be waived by a Relmio checkbox or successful login. This report identifies concrete differences from the published flow without issuing a blanket legal compliance or violation determination.
## Model, image, audio, and video boundaries
### Check 3: capability is independent of identity and permission
**Observed:** Hosted chat sends the current trimmed prompt, fixed instructions, model `gpt-5.6-luna`, low reasoning effort, and streaming text options. It supplies no tools and implements no tool execution, file access, command execution, or browsing handler (`web/app/api/chat/route.ts:13-14,169-191`). The browser retains up to twelve turns for display, but sends only the new prompt; previous exchanges are not model context (`web/app/components/ChatConsole.tsx:39,121-129,251-268`).
**Confirmed:** Current Codex model documentation says GPT-5.6 Luna remains available during rollout, while availability still depends on sign-in method, client, plan, rollout, and workspace controls. Naming it in a request or showing a badge does not establish entitlement. The official SIWC guide calls for an account-specific model catalog and completed inference. Hosted Relmio's fixed model and a stored-session badge prove neither.
**Observed / Provisional:** The hosted route disables response-state caching; the dependency normalizes requests to `store:false`, streams them, and may fetch model metadata before inference (`web/app/api/chat/route.ts:177`; `web/node_modules/@openai-oauth/core/dist/runtime.js:389-445,573-580`). The route distinguishes `response.completed` from failure/interruption and requires some text before reporting completion (`web/app/api/chat/route.ts:225-250`). These are source-level controls, not evidence of a successful request.
**Observed / Provisional:** The n8n sidecar exposes image compatibility handlers and appends Flare/Sunburst IDs to successful model lists (`src/gateway/openai-oauth-sidecar.mjs:6-11,80-87`; `node_modules/openai-oauth/dist/chunk-INHW7GRB.js:804-815`). This is implementation support, not OpenAI entitlement or permission. The official Platform image guide documents image generation/editing under its own API conditions. The current SIWC preview limitations explicitly mark image-generation tools unsupported. The wizard's statement that the bridge supports GPT Image must therefore remain clearly qualified as unofficial compatibility, not support through the documented SIWC plan-usage contract (`src/ui/index.html:224`).
**Observed / Confirmed:** The sidecar rejects audio routes with HTTP 501, including speech, transcription, and translation (`src/gateway/openai-oauth-sidecar.mjs:20-25,109-116`). Hosted chat has no TTS route. The official speech guide describes the separate Audio API and requires AI-voice disclosure. ChatGPT Voice Output also has separate Service Terms. Identity sign-in, plan-usage consent, a text response, or reconnecting cannot establish TTS availability.
**Observed / Confirmed:** The previous video mismatch remains: the backend recommends a separate Platform video connection (`src/gateway/openai-oauth-sidecar.mjs:41-45`), while the official deprecation notice records shutdown on 2026-09-24 with no replacement. The current wizard correctly discloses that shutdown (`src/ui/index.html:224`). This is an existing discrepancy, not a new capability.
**Open:** No account-specific text/image entitlement, completed hosted inference, n8n workflow, TTS, or deployed dependency behavior was tested.
## Data flow and recipients
The tables distinguish application-source observations from provisional dependency behavior. They describe configured paths and potential access boundaries, not observed network traffic or actual retention.
### Hosted chat
| Stage | Reads, stores, transmits, logs, and receiving parties |
| --- | --- |
| Connection request and scopes | **Observed / Provisional:** Relmio renders the third-party component without OAuth overrides (`web/app/components/ChatConsole.tsx:446-461`). The dependency requests `openid profile email offline_access` from `auth.openai.com`, with a fixed client ID, PKCE, state, organization claims, and Codex simplified flow (`web/node_modules/@openai-oauth/core/dist/runtime.js:6-10,179-205`). OpenAI authentication receives the authorization data and ordinary request/device information described in its Help Center article. Actual grants are unverified. |
| Browser extension and callback | **Provisional:** The dependency checks a Chrome extension marker or Firefox localhost marker, encodes the hosted callback URL in state, and uses `http://localhost:1455/auth/callback` as the OAuth redirect (`web/node_modules/@openai-oauth/web/dist/index.js:8-17,35-51,448-504`). The extension participates in the handoff; the hosted page expects `code` and `state` in its URL and later removes them (`web/node_modules/@openai-oauth/web/dist/index.js:505-549`). The extension therefore belongs in the trust boundary. **Open:** Its actual permissions, onward transmissions, and retention were not inspected. A hosted callback navigation can also expose code/state to hosting access logs before client-side cleanup; that is **[INFERENCE]**, not observed logging. |
| Temporary browser state | **Provisional:** `sessionStorage` stores pending state, PKCE verifier, redirect URI, and return URL; this pending record is not the AES-encrypted session record (`web/node_modules/@openai-oauth/web/dist/index.js:419-434,487-492`). The browser and same-origin application code process it. |
| Persistent browser credentials | **Provisional:** IndexedDB database `openai-oauth`, object store `sessions`, stores the encrypted session and a non-extractable AES-GCM-256 CryptoKey. Session fields include access token, account ID, ID token, refresh token, expiry, last refresh, and a FedRAMP flag (`web/node_modules/@openai-oauth/web/dist/index.js:2-7,226-294,323-347`). The key and ciphertext remain usable by same-origin code. This is encryption of browser storage, not protection from a compromised origin/browser/extension and not compliance with the official instruction to keep tokens out of browser storage. |
| Token exchange and renewal | **Provisional:** Browser code sends the authorization code and PKCE verifier to `https://auth.openai.com/oauth/token`; later refresh sends the refresh token there. Refreshed credentials replace the browser session (`web/node_modules/@openai-oauth/web/dist/index.js:348-391`; `web/node_modules/@openai-oauth/core/dist/runtime.js:114,139-154,212-235`). OpenAI receives those credentials. The inspected chat-request headers do not send ID or refresh tokens to Relmio's server. |
| Browser to hosted Relmio | **Observed / Provisional:** `POST /api/chat` sends `{prompt}` plus `Authorization: Bearer <access token>`, `chatgpt-account-id`, and optional `X-OpenAI-Fedramp` (`web/app/components/ChatConsole.tsx:121-129`; `web/node_modules/@openai-oauth/web/dist/index.js:393-409`). The receiving party is Relmio's hosted application runtime and its hosting infrastructure, Vercel for the named deployment. This is a reusable provider access token, not a one-use Relmio credential. |
| Hosted server to OpenAI | **Observed / Provisional:** The server reads request headers into a request-local session and forwards the prompt, fixed instructions, model/options, bearer, and account ID through the transport (`web/app/api/chat/route.ts:169-191`; `web/node_modules/@openai-oauth/web/dist/server.js:1-30`). The destination is `https://chatgpt.com/backend-api/codex/responses`; metadata lookup goes to the same backend's models route (`web/node_modules/@openai-oauth/core/dist/runtime.js:6,246-266,492-538,573-637`). OpenAI receives the requests; replies return through the hosted server to the browser. A FedRAMP header is not evidence of compliant residency or infrastructure. |
| Additional registry recipient | **Provisional:** Inference normalization can resolve model metadata, which first resolves a Codex client version using `https://registry.npmjs.org/@openai/codex/latest`. That lookup sends an Accept header, not an added OpenAI bearer (`web/node_modules/@openai-oauth/core/dist/runtime.js:428-434,573-580`; `web/node_modules/@openai-oauth/core/dist/models.js:4,61-107`). npm infrastructure receives the version request and ordinary network metadata, not the prompt/token in the inspected lookup. Registry/CDN retention is unknown. |
| Transcript and server state | **Observed:** The browser keeps up to six exchanges in React state. Only the current prompt is submitted. The route has no credential database/file write, no reusable application session store, and no response-history cache; it sets `Cache-Control: no-store` (`web/app/components/ChatConsole.tsx:39,121-143,251-268`; `web/app/api/chat/route.ts:169-191,283-291`). Request objects, headers, prompts, and responses exist in process memory. Source inspection does not prove memory erasure, absence of platform capture, or provider zero retention. |
| Logs and errors | **Observed:** The route's explicit logs contain a fixed message plus a status/category, not prompt, token, account ID, upstream body, or raw exception (`web/app/api/chat/route.ts:100-102,193-203,266-273`). **Provisional:** OAuth dependency errors can include provider error text, and Relmio displays the component's error message (`web/node_modules/@openai-oauth/core/dist/runtime.js:155-175`; `web/app/components/ChatConsole.tsx:453-457`). **Open:** Vercel/framework/access logs, extension diagnostics, operator access, backups, and provider logs were not inspected. |
| Disconnect | **Provisional / Observed:** The button clears the stored browser session and pending login; it does not call a provider revocation endpoint, and the CryptoKey record remains (`web/node_modules/@openai-oauth/react/dist/useSignInWithChatGPT.js:211-214`; `web/node_modules/@openai-oauth/web/dist/index.js:292-294,551-557`). Relmio's auth-state callback does not clear transcript state or abort an active request; explicit Stop and component unmount do abort (`web/app/components/ChatConsole.tsx:207-211,353-361,453-461`). This is local sign-out, not confirmed disconnection of a ChatGPT grant or deletion of previously transmitted data. |
The extension stores linked at `web/app/chat/page.tsx:13-15,42-55`, GitHub attribution at `web/app/chat/page.tsx:74-86`, and npm link at `web/app/page.tsx:90-99` are additional destinations when followed. They are not evidence that those sites receive prompts or OAuth tokens. Ordinary store/link request metadata and any extension telemetry remain separate, unverified boundaries.
### Wizard, local dashboard, and private n8n bridge
| Stage | Reads, stores, transmits, logs, and receiving parties |
| --- | --- |
| Start and status | **Observed:** The browser sends a local authenticated start request; the server returns launch mode and attempt ID, then status/error metadata, not credential bytes or an authorization URL (`src/ui/app.js:1379-1402`; `src/web/server.js:3173-3197,3474-3478`). The official CLI opens the system browser. Local dashboard n8n sign-in uses these same endpoints (`src/ui/local.js:4244-4263`). |
| Host login and storage | **Observed:** Relmio invokes `npx --yes --ignore-scripts --package=@openai/codex@0.154.0 -- codex -c cli_auth_credentials_store="file" login`, with an attempt-specific `CODEX_HOME`. It protects directories with mode `0700`, validates the complete credential JSON, stages it with mode `0600`, and promotes it to `~/.n8n-openai-oauth/auth.json`, or the `N8N_OPENAI_OAUTH_HOME` override (`src/services/oauth.js:19,123-133,172-198,247-292,381-407`). The local OS, Codex process, and Relmio process handle it. This file is permission-protected plaintext, not application-encrypted at rest. OpenAI handles authentication; actual pinned-binary scopes/endpoints/logging remain unverified. |
| Host login output | **Observed:** Relmio captures at most 32 KiB of combined CLI stdout/stderr in memory and maps failures to fixed messages (`src/services/oauth.js:10-12,209-222,305-322`). **Confirmed / Open:** Current Codex docs describe `codex-login.log`; whether this pinned binary writes it, its contents, and retention were not established. Bounded captured output is not a universal no-logging guarantee. |
| SSH authentication and consent identity | **Observed:** The browser sends host, port, username, expected fingerprint, privilege, and either password or agent choice to the local server, clearing the password field when constructing the request (`src/ui/ssh-form.js:141-153`). `ssh2` uses explicit authentication, verifies the host key, and disables agent forwarding; direct-root checks enforce UID 0 (`src/infrastructure/ssh.js:129-160,189-201`). The local agent participates when chosen; the selected VPS SSH service receives authentication traffic. The browser freezes/rechecks the server-attested identity for guarded requests (`src/ui/ssh-form.js:37-93`). These are not OAuth permissions. |
| VPS credential transfer | **Observed:** After reviewed-plan and credential-generation checks, Relmio reads the full host file and passes it to installation (`src/web/server.js:5053-5095`). SFTP writes it to `/docker/n8n-openai-oauth/auth/auth.json` with mode `0600` (`src/services/installer.js:272-295`; `src/infrastructure/ssh.js:286-337`). The VPS SSH service, host storage, Docker runtime, and sidecar process it. The directory is mounted at `/home/node/.codex`; the handler explicitly reads `/home/node/.codex/auth.json` (`src/domain/templates.js:22-35`; `src/gateway/openai-oauth-sidecar.mjs:183-184`). “Encrypted upload” describes SSH transport, not encryption of the destination file. |
| Local Docker credential copy | **Observed:** Relmio re-reads and compares the source credential before passing it over Docker subprocess stdin to the credential-seed helper (`src/services/local-n8n-sidecar-installer.js:2034-2077`). That helper has no network and uses Docker logging driver `none`; it writes owner-restricted JSON into the `oauth-auth` volume. The sidecar mounts that volume at `/home/node/.codex` (`src/domain/local-n8n-sidecar.js:137-143,177-216`). The local Docker daemon, helper, volume storage, and sidecar receive the credential. The host source file remains separate. Credential refresh can retain rollback/quiesce snapshots as disclosed at `docs/security.md:234-243`; this review did not inspect existing snapshots. |
| Sidecar refresh and inference | **Provisional:** Installed `openai-oauth` 2.0.0 reads token/account metadata, refreshes through `auth.openai.com/oauth/token`, and rewrites its credential copy (`node_modules/openai-oauth/package.json:2-3,44-48`; `node_modules/@openai-oauth/local/dist/auth-file.js:101-140,207-270`; `node_modules/@openai-oauth/core/dist/runtime.js:114,225-235`). The handler forwards supported n8n message/input/image requests to the Codex backend with bearer and account-ID headers (`node_modules/openai-oauth/dist/chunk-INHW7GRB.js:804-838`; `node_modules/@openai-oauth/core/dist/runtime.js:6,492-506,620-637`). OpenAI receives those requests; n8n receives outputs. Selected workflow tools can receive further data, but their identities cannot be determined from this bridge alone. |
| Supply-chain and network peers | **Observed / Provisional:** Login obtains pinned Codex through npm; bridge images obtain `node:22-bookworm-slim` and `openai-oauth@2.0.0` (`src/services/oauth.js:263-272`; `src/domain/templates.js:5-15`; `src/domain/local-n8n-sidecar.js:94-108`). Model discovery performs the additional npm version lookup described above. No host port is published, but the sidecar listens on its Docker network, so trusted peer containers can reach it (`src/domain/templates.js:29-35`; `src/gateway/openai-oauth-sidecar.mjs:185-186`). Private network reachability does not establish that every caller is the account owner. Registry mirrors, deployed image bytes, host administrators, and backups remain unverified access boundaries. |
| Sidecar and SSH logs | **Observed / Provisional:** SSH output is bounded; the sidecar's own outer failures use fixed messages (`src/infrastructure/ssh.js:19,234-240`; `src/gateway/openai-oauth-sidecar.mjs:170-176,192-195`). The main sidecar template does not disable Docker logs. Third-party request logging is opt-in through `CODEX_OPENAI_SERVER_LOG_REQUESTS=1`; Relmio's sidecar invocation does not enable it. Dependency handler errors may return upstream text (`node_modules/openai-oauth/dist/chunk-INHW7GRB.js:343-360,788-800,838-845`). Docker/SSH audits, n8n execution history, provider logs, and administrator retention cannot be established from these defaults. |
| Separate managed Codex dashboard flow | **Observed:** App Server device login runs inside the selected owned Docker service. Relmio handles a validated OpenAI verification URL, user code, login ID, completion status, and bounded protocol output, rather than importing that runtime's OAuth file (`src/services/codex-login.js:99-140,158-168,203-234,475-507,573-628`; `src/web/server.js:4532-4586`). `cli_auth_credentials_store="file"` and `codex-home:/home/node/.codex` keep provider credentials in that runtime's volume (`src/domain/local-endpoints.js:258-265,447-450,531-534`). The browser displays the device code and link (`src/ui/local.js:5277-5290`). This is distinct from both host-file copying and hosted IndexedDB storage. |
The [ROW](https://openai.com/policies/privacy-policy/) and [European](https://openai.com/policies/eu-privacy-policy/) privacy policies describe OpenAI's account/content/device/usage/log processing and recipient categories including service providers, affiliates, administrators, and legally required disclosures. They do not identify actual downstream recipients or retention for this deployment. Platform API no-training defaults, approved retention controls, `store:false`, and Relmio's no-store response header must not be presented as zero retention for the Codex bridge, browser extension, hosting platform, or n8n.
## Disclosure mismatches and required qualifications
1. **Hosted sign-in omits the main permission boundary.** **Observed / Confirmed:** The hosted page calls the extension handoff “secure” and explains request-scoped forwarding and browser encryption, but does not state that this is the third-party Codex flow rather than the documented identity/plan-usage integration (`web/app/chat/page.tsx:30-33,42-70`). The cited official registration, endpoint, browser-storage, and user-controlled-runtime requirements differ. Attribution to Evan Zhou Dev does not supply OpenAI approval. This needs a visible qualification; storage wording alone is insufficient.
2. **“Credentials only with your request” is incomplete.** **Observed / Provisional:** The inference access token is request-bound on the hosted server, but browser code also sends exchange and refresh traffic directly to OpenAI. The server receives a reusable bearer, and OpenAI plus the hosting runtime process prompts/responses. The page should name these recipients and distinguish access-token forwarding from ID/refresh-token browser storage (`web/app/chat/page.tsx:30-33`; hosted data-flow table above).
3. **Browser encryption is real implementation behavior, but an insufficient security promise.** **Provisional / Confirmed:** AES-GCM encrypts the IndexedDB session, while a same-origin CryptoKey remains available to application code. “Encrypted in this browser” should not imply end-to-end encryption or protection from a compromised browser, extension, or origin (`web/app/components/ChatConsole.tsx:463-467`). It also does not satisfy the official plan-usage guidance to keep tokens out of browser storage.
4. **“Disconnect ChatGPT” overstates local session removal.** **Observed / Provisional:** The adjacent sentence accurately says it removes the local session, but the action does not revoke the renewable session, stop an already-running request, clear the transcript, or disconnect an OpenAI application grant (`web/app/chat/page.tsx:67-70`; `web/app/components/ChatConsole.tsx:451-461`). Official session guidance distinguishes local clearing from confirmed revocation. Label this as local sign-out and explain the separate provider disconnection boundary unless behavior changes.
5. **The homepage no-token-logging claim is broader than the evidence.** **Observed:** The explicit hosted route logs are limited to categories and do not log credentials. **Open:** “No OAuth tokens in application logs” across Relmio (`web/app/page.tsx:20-22`) is not established for the pinned CLI, dependencies, callback/access logging, hosting instrumentation, or deployed configuration. No token leak was observed. Scope the statement to reviewed Relmio log calls rather than asserting a system-wide guarantee. Keep the wizard's existing “Log retention for this pinned Codex login is not known” qualification (`src/ui/index.html:225`).
6. **Private-runtime summaries need a hosted exception.** **Observed:** `README.md:21-25` and `npm/README.md:17-22` explain the n8n credential-copy exception but not the hosted browser store and remote bearer processing. Their local-install scope can be retained, but they should not serve as the only credential explanation for the hosted chat. `docs/security.md:19-29,80-111` describes local/native/private trust assumptions and does not establish a privacy notice for this hosted flow. The legal adequacy of the pre-connect notice remains **Open**.
7. **Identity, plan permission, and readiness remain conflated in hosted status.** **Observed:** “Connected” means a session object exists, not that a plan-usage grant or `gpt-5.6-luna` inference succeeded. There is no displayed verified plan grant, active account identity, or usage-management control in the inspected connection block (`web/app/components/ChatConsole.tsx:403-467`). The generic upstream error recommends reconnecting for failures that may be permission, capability, or usage-limit failures (`web/app/components/ChatConsole.tsx:31-38`). Official guidance says signing in again does not restore usage. Recovery should preserve these distinctions without promising that reconnection fixes them.
8. **The local dashboard's footer is too general for the n8n bridge.** **Observed:** “Provider sign-in stays with its runtime” (`src/ui/local.html:352`) needs the host-file-copy exception already supplied elsewhere on that page and in its review (`src/ui/local.html:364`; `src/ui/local.js:3104,3231`). “Saved keys stay hidden” is supported for stored-secret redisplay, but the same product intentionally displays newly generated local capabilities once; keep that distinction explicit (`src/ui/local.html:271-272`; `src/ui/local.js:3665-3669`).
9. **Token lifetime wording needs product scope, not a replacement blanket lifetime.** **Confirmed / Observed:** The Codex authentication guide supports automatic refresh and does not publish a fixed ten-day lifetime. Current SIWC token reference separately documents one-hour access tokens and rotating thirty-day refresh tokens. `docs/security.md:9-17`, `docs/faq.md:35-43`, `docs/troubleshooting.md:26-34`, and `web/app/install/page.tsx:145-157` should not imply that no OpenAI flow has documented lifetimes or that the official Codex client manages hosted browser refresh. The hosted dependency and private bridge refresh their own copies. Do not apply SIWC lifetimes to the pinned Codex flow without evidence.
10. **Image support and the obsolete video recommendation need qualification/correction.** **Observed / Confirmed:** The wizard's image claim describes unofficial compatibility handlers, while current SIWC explicitly excludes image-generation tools. Model-list entries do not prove successful generation. The backend's recommendation to use Platform video is contradicted by the current shutdown notice. These findings are separate from sign-in permission and from TTS.
11. **Troubleshooting promises a manual link that the current login path does not provide.** **Observed:** `docs/troubleshooting.md:141-144` says “Open fresh ChatGPT sign-in” remains available. The HTML retains a hidden anchor (`src/ui/index.html:675`), but the current UI clears/hides it and the server returns only system-browser launch mode and attempt ID (`src/ui/app.js:1363-1370,1379-1402`; `src/web/server.js:3474-3478`). The current recovery is system-browser/Stop/retry, not a supplied manual authorization URL.
12. **Install copy has stale version scope.** **Observed:** `web/app/install/page.tsx:140-145` presents “Relmio 0.14.0 handles provider OAuth only,” while the current README describes stable 0.17.5, experimental 0.18.0-experimental.4, and separate API-key/artifact configuration (`README.md:21-41`). This does not make an OAuth flow a Platform API key, but the old version-specific sentence should not be read as a current product-wide exclusion of those separate configurations.
The positive boundaries should also be retained: no account-pool selection was found in the hosted request path; it uses the current request's credentials. The local wizard correctly discloses complete credential copying, makes deployment approval separate, and warns that file presence/model listings do not prove validity or workflow success (`src/ui/app.js:1041-1052`; `src/ui/index.html:223-225`). Those facts do not establish provider permission or prevent every misuse of a copied credential.
## Unverified
- Relmio-specific OpenAI registration, partner approval, written permissions, applicable account agreement, and authorization for this third-party credential bridge or shared hosting runtime.
- Actual scopes requested/granted by pinned official Codex login and device login; actual grants or eligibility for any hosted account.
- The browser extension's installed bytes, permissions, callback implementation, telemetry, and onward recipients. Extension-store availability was not verified.
- Any live account identity, model entitlement, completed inference, n8n workflow, image generation/edit, TTS, or deployed service acceptance.
- Production Vercel/framework logs, callback logging, privileged operator access, host/SSH/Docker/n8n logs, backups, registry mirrors/CDNs, and retention or training settings at OpenAI and intervening services.
- Confirmation of remote revocation after the hosted Disconnect action; the inspected implementation only clears local session records.
- Resolution of the SIWC Terms/developer-guide storage wording for self-hosted VMs, and whether any separate agreement changes the requirements for the named hosted application.
- An atomic final-candidate diff and rendered disclosure verification. The parent must reconcile this report's source references with the final candidate before recording release evidence.
The September 29 warning that login and private deployment do not prove permission still holds. Today's sources add concrete SIWC requirements; they do not retroactively approve the existing Codex bridge. The hosted flow should not be described as the documented OpenAI plan-sharing integration, or as policy-compliant, on the strength of its sign-in button, encrypted IndexedDB record, request-scoped server session, or a successful model response.
## Disclosure reconciliation, 2026-10-01
This addendum records wording corrections after the source check above. The historical findings remain as written. The source reconciliation at `agent://FinalDisclosureReconcile/markdown` and R3Web's rendered audit at `/private/tmp/relmio-frontend-qa/audit-r3/R3Web.md` cover the earlier candidate: R3Web saw the hosted sign-in warning, recipient and browser-storage disclosures, local sign-out behavior in a synthetic session, and scoped logging text in the security guide. The homepage, troubleshooting, local image warning, and video error edits described here are source-only until the parent smoke check. R3Web did not render the local wizard, use a real account, or inspect production.
The hosted page and READMEs now label the third-party Codex flow unofficial and policy-uncertain. Chat copy names Relmio on Vercel and OpenAI as recipients; the security guide scopes its no-token/no-prompt logging statement to chat-route code. The homepage now uses that narrower scope. Sign out is labelled as local session removal, not provider revocation; the status badge indicates a stored session, not a verified grant or successful request. Local disclosures name the approved credential-file copy, keep Codex token lifetime separate from documented SIWC lifetimes, and no longer promise a manual authorization URL. Install and troubleshooting copy no longer claim that a past Relmio version rules out separately configured API keys or hosting artifacts. The local image warning now calls generation/editing unofficial compatibility, notes that documented SIWC plan usage excludes image generation, and does not treat model IDs as entitlement. The video 501 response no longer recommends a Platform connection for the shut-down Videos API; its route and status are unchanged.
These are disclosure and error-text edits, not a data-flow or capability change. The hosted third-party flow still keeps an encrypted, same-origin-readable session in browser IndexedDB and sends each prompt with a reusable bearer access token through Relmio's Vercel runtime to OpenAI's Codex `backend-api`; ID and refresh tokens remain in the browser and go directly to OpenAI for exchange/refresh. The private n8n route still copies complete Codex credentials into the selected sidecar after local deployment approval. The browser-token and hosted-runtime mismatches with the documented SIWC flow remain. Relmio-specific registered application identity, returned plan-usage grants, actual pinned Codex scopes, provider approval, extension behavior, and applicable account terms remain unverified. Hosting, provider, CLI, Docker, and n8n logs, retention, and downstream recipients are not established. No real hosted inference, image generation, n8n workflow, or TTS entitlement was proved; audio remains rejected by the bridge. A security guide is not a Relmio privacy notice or service terms, and the deferred script-execution CSP gap remains.
Official sources rechecked in the [source check's register](#official-sources-checked) on 2026-10-01: [registration and grants](https://developers.openai.com/siwc/token-sharing-open-source/sign-in.md), [browser and session guidance](https://developers.openai.com/siwc/token-sharing-open-source/profiles-and-sessions.md), [supported transport](https://developers.openai.com/siwc/token-sharing-open-source/models-and-inference.md), [image limitations](https://developers.openai.com/siwc/token-sharing-open-source/preview-limitations.md), [Sign in with ChatGPT Terms](https://openai.com/policies/sign-in-with-chatgpt-terms/), and the [Videos API shutdown notice](https://developers.openai.com/api/docs/deprecations#2026-03-24-sora-2-video-generation-models-and-videos-api) (shutdown 2026-09-24, no replacement listed). These sources do not approve Relmio's current bridge or settle provider retention.
## API-key and stable-channel disclosure addendum, 2026-10-01
This read-only check covers the revised API-key wording and stable-channel labels. It supplements the historical review, not its permission or capability findings. No credentials were accessed and no sign-in, provider API request, browser check, test, build, or edit was performed. Line references identify the inspected worktree and may move during final edits.
### Official sources rechecked
The Sign in with ChatGPT article was fetched first. Relative update labels are reproduced as displayed.
| Source | Displayed date |
| --- | --- |
| [Sign in with ChatGPT](https://help.openai.com/en/articles/20001410-sign-in-with-chatgpt) | Updated: 2 days ago |
| [Codex authentication](https://developers.openai.com/codex/auth/), redirected to [Authentication](https://learn.chatgpt.com/docs/auth) | None shown |
| [API authentication](https://developers.openai.com/api/reference/overview#authentication) | None shown |
| [Using your ChatGPT plan in other apps and sites](https://help.openai.com/en/articles/20001542-using-your-chatgpt-plan-in-other-apps-and-sites) | Updated: 3 hours ago |
| [Registration and sign-in](https://developers.openai.com/siwc/token-sharing-open-source/sign-in.md) | None shown |
| [Models and inference](https://developers.openai.com/siwc/token-sharing-open-source/models-and-inference.md) | None shown |
| [Text to speech](https://developers.openai.com/api/docs/guides/text-to-speech) | None shown |
| [Terms of Use](https://openai.com/policies/terms-of-use/) | Published/effective: January 1, 2026 |
| [Service Terms](https://openai.com/policies/service-terms/) | Updated: September 29, 2026 |
| [Sign in with ChatGPT Terms](https://openai.com/policies/sign-in-with-chatgpt-terms/) | September 29, 2026 |
| [Privacy Policy](https://openai.com/policies/privacy-policy/) | Updated: July 30, 2026 |
### API-key statements
- **Confirmed:** “ChatGPT sign-in does not create an OpenAI Platform API key” is accurate (`docs/faq.md:3-11`). Codex distinguishes subscription authentication from API-key authentication and Platform billing. The plan-usage article says users need not create or share an API key. This does not imply that all OpenAI API requests require Platform keys: documented plan usage uses a separately authorized OAuth bearer.
- **Observed:** The revised no-API-key/no-fallback statement correctly scopes itself to managed OAuth flows (`README.md:415-419`; `npm/README.md:390-394`; `docs/local-endpoints.md:52-56`; `docs/security.md:286-290`; `docs/faq.md:5-11`; `docs/roadmap.md:15-19`). Managed Codex forces ChatGPT authentication and requests device login; the n8n credential reader requires `auth_mode: chatgpt` (`src/domain/local-endpoints.js:258-265`; `src/services/codex-login.js:158-168`; `src/services/oauth.js:172-198,263-272`). Grok accepts its marked OIDC session and returns authentication/quota errors without choosing API-key billing (`src/supergrok/session.js:21-27,52-61`; `src/supergrok/chat.js:81-90,184-224`). xAI policy and CLI behavior remain **Provisional**, not OpenAI-confirmed. No API fallback must not be expanded into a promise of no possible charges: OpenAI separately documents optional ChatGPT credits and app charges.
- **Observed:** Separately configured API-key connections and operator hosting artifacts are accurately distinguished. The planner generates files and instructions; its endpoint profiles require independent incoming and upstream runtime secrets, not OAuth-derived keys (`src/domain/hosting-deployment.js:80-104,133-164`; `src/domain/hosting-edge-profiles.js:151-182`).
- **Observed:** The retirement text preserves the warning that an old gateway can keep running with its saved credential even without a dashboard row (`docs/local-endpoints.md:556-607`; `docs/local-dashboard.md:125-129`). Current managed targets exclude the retired API endpoints (`src/domain/local-endpoints.js:48-64`). Removing historical version qualifiers does not authorize automatic migration or deletion.
### Stable channel and feature labels
**Observed:** Package metadata now names 0.18.0, and README installation commands use `relmio@latest` (`package.json:3`; `package-lock.json:3,9`; `README.md:32-33,64-68`). The CLI notice is prerelease-only (`src/cli.js:86-90`). Feature-specific Experimental labels remain for SuperGrok and specialist Codex routes (`src/ui/local.html:343,364,375,381`; `src/ui/supergrok-vps.html:71`; `web/app/components/relay/SignalPlotter.tsx:40,65-79`). Hosting-provider labels use the catalog’s `tested` flag while generated plans remain “Not live tested” (`src/domain/hosting-providers.js:69,83`; `src/ui/hosting.js:173-176,209,374-376`). Publication to npm and the evidence supporting hosting test classifications were not checked here.
**Observed / Confirmed:** Calling the bridge part of Relmio’s stable workflow does not itself claim OpenAI approval, provided the unofficial, private, policy-uncertain warning remains visible. It does in the inspected bridge UI and route description (`src/ui/index.html:193-194,681-682`; `src/ui/local.html:336,930`; `web/app/components/relay/SignalPlotter.tsx:26`). The hosting notes also withhold Platform-key and entitlement claims (`src/domain/hosting-providers.js:11,18`). Stable is Relmio’s release classification; it does not resolve the earlier documented SIWC mismatches or authorize credential copying.
Two wording corrections were required before acceptance; both are applied in this update:
1. `README.md:218-221` and `npm/README.md:195-198` still describe OpenAI’s documentation as identity-only. It now also covers separately authorized plan usage. Replace those stable/identity-only sentences with the following, preserving the existing source-check links:
> Relmio classifies this bridge as a stable workflow. It remains unofficial, private, and policy-uncertain. OpenAI documents identity sign-in and separately authorized ChatGPT plan usage; those documents do not establish approval for Relmio's Codex credential-copy bridge. The earlier source-check findings still apply.
2. `npm/README.md:305-306` retains an experimental bridge label that conflicts with the requested classification. Replace it with:
> Relmio does not edit or restart n8n. The bridge is unofficial, private, and policy-uncertain.
### Identity, permissions, and capability remain separate
- **Identity — Confirmed / Observed:** Supported identity sign-in shares basic identity information. Relmio’s n8n route reads and copies complete Codex credentials, so it cannot inherit that identity-only data boundary (`src/services/oauth.js:172-198`; `src/services/installer.js:285-289`).
- **Permissions — Confirmed / Open:** Official plan usage requires a separate grant. The registration guide distinguishes `openid profile email` from `offline_access resource.invoke chatgpt.tokens.use.direct`. Relmio delegates managed login to Codex without specifying or verifying those scopes (`src/services/oauth.js:263-272`; `src/services/codex-login.js:158-168`). Actual pinned-CLI scopes, grants, and bridge permission remain unknown. Login, deployment confirmation, and stable classification are not Terms compliance.
- **Model/TTS capability — Confirmed / Observed / Open:** Account-specific availability and completed inference remain separate requirements. The bridge still rejects audio routes with HTTP 501 (`src/gateway/openai-oauth-sidecar.mjs:20-25,109-116`). OpenAI documents TTS through its Audio API. These edits establish no new model entitlement or TTS support.
### Unchanged data flow and remaining unknowns
**Observed, based on the parent’s diff review:** The parent reports inspecting the complete change scope since `f436ce6`, including the requested README/docs comparison. The changes concern release metadata, disclosures, feature labels, layout/focus behavior, generated documentation, and tests; they do not change OAuth, credential storage, transmission, logging, scopes, or recipients. This subreview inspected current source but did not execute Git or independently receive the raw patch.
The existing boundaries remain: host credentials are read and stored under `~/.n8n-openai-oauth/auth.json` or its configured override (`src/services/oauth.js:123-133,172-198,381-407`); managed Codex uses its private volume (`src/domain/local-endpoints.js:447-450,531-534`); approved copies reach the local Docker helper/sidecar or selected VPS (`src/services/local-n8n-sidecar-installer.js:2034-2077`; `src/services/installer.js:272-289`). Grok reads its own marked session and sends requests to its configured xAI CLI proxy (`src/supergrok/runtime.js:14`; `src/supergrok/session.js:52-61`; `src/supergrok/chat.js:4-5,184-199`). Separate hosting artifacts forward requests using operator-supplied runtime secrets (`src/domain/hosting-edge-profiles.js:98-128,164-181`). Host-login output remains bounded in memory, not covered by a system-wide no-logging promise (`src/services/oauth.js:305-322`).
The earlier hosted-chat data-flow and dependency findings are not superseded: its browser-to-Relmio/OpenAI request path and category-only route logging remain present (`web/app/components/ChatConsole.tsx:123-133`; `web/app/api/chat/route.ts:169-203,266-273`). Provider approval, actual grants, third-party behavior, operator/platform retention, deployed release bytes, and live model/TTS capability remain **Open**. OpenAI’s Privacy Policy does not establish zero retention for these paths.
## Hosted web layout addendum, 2026-10-01
**Source rechecked:** the [Sign in with ChatGPT](https://help.openai.com/en/articles/20001410-sign-in-with-chatgpt) Help Center article was fetched again on 2026-10-01 (page shows "Updated: 2 days ago"). It still describes identity-only sign-in (name, email, profile picture), says the article does not share tokens, and treats subscription usage as a separate permission a partner tool requests after sign-in. Relmio is not a listed partner.
**Observed:** The hosted chat moved from `/chat` back onto the home page (`web/app/page.tsx`, section `#chat`); `/chat` now redirects to `/#chat`. Its disclosures moved with it unchanged: the third-party extension handoff, the prompt and access token sent to Relmio on Vercel and then OpenAI, refresh and ID tokens kept in the browser and sent only to OpenAI, and the IndexedDB storage caveat. `ChatConsole`, `web/app/api/chat/route.ts`, scopes, storage, logging and recipients are unchanged. The new site footer adds outbound links to the owner's GitHub, X, LinkedIn, YouTube, Facebook and Ko-fi pages; following one sends ordinary navigation metadata to that site, not prompts or tokens.
**Unchanged / Open:** Every hosted-chat finding above still applies. The hosted flow remains the unofficial third-party Codex flow, not documented Sign in with ChatGPT or approved subscription sharing; provider approval, grants and retention remain **Open**.
## Accessibility and browser-policy review, 2026-10-02
The source review fetched the following official documents on 2026-10-02:
- [Sign in with ChatGPT](https://help.openai.com/en/articles/20001410-sign-in-with-chatgpt) and [Using your ChatGPT plan in other apps and sites](https://help.openai.com/en/articles/20001542-using-your-chatgpt-plan-in-other-apps-and-sites).
- [Website integration](https://developers.openai.com/siwc/website.md), [registration and sign-in](https://developers.openai.com/siwc/token-sharing-open-source/sign-in.md), [accounts and sessions](https://developers.openai.com/siwc/token-sharing-open-source/profiles-and-sessions.md), and [models and inference](https://developers.openai.com/siwc/token-sharing-open-source/models-and-inference.md).
- [Codex authentication](https://learn.chatgpt.com/docs/auth), [Codex models](https://learn.chatgpt.com/docs/models), and [text to speech](https://developers.openai.com/api/docs/guides/text-to-speech).
- [Terms of Use](https://openai.com/policies/row-terms-of-use/), [Service Terms](https://openai.com/policies/service-terms/), [Sign in with ChatGPT Terms](https://openai.com/policies/sign-in-with-chatgpt-terms/), and [Privacy Policy](https://openai.com/policies/services-communications-privacy-policy/).
**Observed:** Target sizes, field errors, forced colors and dialog keyboard
handling do not add credential reads or recipients. The new CSP changes browser
resource permissions. Its script nonce is unrelated to an OIDC identity nonce;
it does not validate OAuth grants or protect stored credentials from authorized
same-origin code.
**Provisional, from the installed dependency:** Hosted sign-in requests
`openid profile email offline_access`; actual granted scopes remain unknown.
The browser reads the returned session and keeps access, ID and refresh tokens,
account identity and expiry information in encrypted IndexedDB alongside the
usable encryption key. Pending state and the PKCE verifier use sessionStorage.
OpenAI receives the authorization request and browser-side exchange/refresh
traffic at `auth.openai.com`. Relmio on Vercel receives the submitted prompt,
access-token bearer and account ID; its server forwards them with model settings
to OpenAI's Codex backend. Displayed turns remain in component memory.
Extension detection also probes the installed Chrome extension or the Firefox
loopback frame at `http://localhost:1455/openai-oauth/installed`. The inference
dependency can query OpenAI model metadata and npm's Codex-version metadata.
User-activated links lead to GitHub, browser-extension stores and the footer's
social/support services; they are not configured to carry prompts or tokens.
Extension onward recipients and telemetry are unverified.
**Observed / Open:** Explicit chat-route logs contain fixed categories/status
codes, not prompts or tokens. Chat responses remain `no-store`; local sign-out
does not revoke provider access. Framework, hosting, extension, npm and OpenAI
logs and retention are not established by this source review.
**Confirmed / Open:** Identity sign-in, separately authorized plan usage and
model/TTS capability remain distinct. The official identity description is not
the hosted dependency's reusable-credential flow. Official plan usage requires
separate registration and grants; this frontend change does not establish them,
provider permission or Terms compliance. The fixed hosted model name proves no
account entitlement, and this route implements no TTS operation.
**Compatibility finding:** Source inspection identified the Firefox discovery
frame as incompatible with the initial `default-src 'self'` policy. A controlled
headless-browser probe reproduced the frame block and verified that allowing
the exact discovery URL permits a fixture-assisted authorization handoff with
no CSP violation. No real OAuth authorization, token exchange or model call was
completed. Actual installed-extension behavior, especially on Firefox itself,
remains unverified; an absent Chrome extension produces probe failures that
must not be reported as successful sign-in.
## Cookbook and integration requirements addendum, 2026-10-03
### Scope and conclusion
This is a read-only comparison of current official OpenAI sources with Relmio's hosted chat and local n8n Codex credential bridge. The inspected repository is `relmio-frontend-revamp`; the assignment identifies it as tag `v0.18.2`, production commit `f0cb6b5`. That Git identity and production deployment were not independently attested. No files were changed, credentials accessed, browser opened, sign-in completed, form submitted, provider API called, or build/test run. Source observations do not establish deployed behavior or successful inference.
Labels retain the earlier report's meaning:
- **Confirmed:** supported by a fetched official OpenAI source.
- **Observed:** present in Relmio source or disclosures.
- **Provisional:** installed third-party implementation or non-OpenAI evidence, not provider approval.
- **Open:** not resolved by the reviewed evidence.
Compliance classifications below mean conformity with the cited public integration requirements, not a legal opinion covering every account agreement or jurisdiction.
**Conclusion: Relmio cannot treat the hosted demo as permitted to keep running as-is under the published SIWC Terms and integration contract.** Its shared hosted inference runtime, browser token storage, third-party fixed-client login, missing returned plan-usage grant check, and Codex `backend-api` transport conflict with specific documented requirements. The new cookbook does not waive them. A successful login, working request, unofficial warning, or request-scoped server credential does not cure those differences. A separate agreement could change the applicable requirements, but none was provided or established by this review.
The local n8n credential-copy bridge is also not the newly documented open-source SIWC integration. Official Codex login can remain a distinct Codex authentication path; it does not by itself authorize exporting that session into a separate inference bridge.
### Official sources retrieved
All sources below were retrieved on **2026-10-03**. The Help Center sign-in article was fetched first. Relative update labels are reproduced as displayed, not converted into exact publication dates. Developer pages were returned through their Markdown counterparts where available.
| Source | Displayed publication/update date |
| --- | --- |
| [Sign in with ChatGPT](https://help.openai.com/en/articles/20001410-sign-in-with-chatgpt) | Updated: 15 hours ago |
| [Integrating Sign in with ChatGPT in your Opensource App](https://developers.openai.com/cookbook/articles/sign-in-with-chatgpt) | None shown in fetched representation |
| [Using your ChatGPT plan in other apps and sites](https://help.openai.com/en/articles/20001542-using-your-chatgpt-plan-in-other-apps-and-sites) | Updated: 19 hours ago |
| [SIWC index](https://developers.openai.com/siwc), [quickstart](https://developers.openai.com/siwc/quickstart), [request a client ID](https://developers.openai.com/siwc/request-client-id) | None shown |
| [Website integration](https://developers.openai.com/siwc/website) | None shown |
| [Open-source plan-usage overview](https://developers.openai.com/siwc/token-sharing-open-source) | None shown |
| [Registration and sign-in](https://developers.openai.com/siwc/token-sharing-open-source/sign-in) | None shown |
| [Accounts and sessions](https://developers.openai.com/siwc/token-sharing-open-source/profiles-and-sessions) | None shown |
| [Token reference](https://developers.openai.com/siwc/token-sharing-open-source/token-reference) | None shown |
| [Models and inference](https://developers.openai.com/siwc/token-sharing-open-source/models-and-inference) | None shown |
| [Errors and recovery](https://developers.openai.com/siwc/token-sharing-open-source/errors-and-recovery) | None shown |
| [Preview limitations](https://developers.openai.com/siwc/token-sharing-open-source/preview-limitations) | None shown |
| [Codex app-server for SIWC](https://developers.openai.com/siwc/token-sharing-open-source/codex-app-server) | None shown |
| [Self-hosted VMs](https://developers.openai.com/siwc/token-sharing-open-source/self-hosted-vms) | None shown |
| [UI/UX guidelines](https://developers.openai.com/siwc/ui-ux-guidelines) | None shown |
| [SIWC interest form](https://openai.com/form/sign-in-with-chatgpt-interest/) | None shown; read only, not submitted |
| [Sign in with ChatGPT Terms](https://openai.com/policies/sign-in-with-chatgpt-terms/) | September 29, 2026 |
| [Service Terms](https://openai.com/policies/service-terms/) | Updated: September 29, 2026 |
| [Terms of Use](https://openai.com/policies/terms-of-use/), canonical [ROW Terms](https://openai.com/policies/row-terms-of-use/) | Published/effective: January 1, 2026 |
| [Privacy Policy](https://openai.com/policies/privacy-policy/), canonical [Services Communications Privacy Policy](https://openai.com/policies/services-communications-privacy-policy/) | Updated: July 30, 2026 |
| [Brand guidelines](https://openai.com/brand/) | None shown |
| [Codex authentication](https://developers.openai.com/codex/auth/), redirected to [Authentication](https://learn.chatgpt.com/docs/auth) | None shown |
| [Codex models](https://developers.openai.com/codex/models/), redirected to [Models](https://learn.chatgpt.com/docs/models) | No page-update date; GPT-5.5 retirement dated October 14, 2026 |
| [API authentication](https://developers.openai.com/api/reference/overview#authentication) | None shown |
| [API data controls](https://developers.openai.com/api/docs/guides/your-data) | No page-update date; March 1, 2023 is the stated API training-policy date |
| [Text to speech](https://developers.openai.com/api/docs/guides/text-to-speech) | None shown |
The first Service Terms fetch returned HTTP 403. An official-domain search and a subsequent fetch of `https://openai.com/policies/service-terms/?utm_source=openai` returned the full page, including section 15 incorporating the SIWC Terms.
The cookbook links an OpenAI devkit hosted on GitHub. Its availability is described by the official cookbook, but that repository and its license were not independently inspected here. Relmio's installed `@openai-oauth/*` packages are **Provisional** third-party evidence: the React package identifies version `2.0.0`, author `EvanZhouDev`, and that author's repository (`web/node_modules/@openai-oauth/react/package.json:1-4,63-73`). It is not the cookbook's `@siwc/*` devkit. Package names and source availability do not establish OpenAI authorization.
### What changed relative to the October 2 addendum
**Confirmed:** The newly supplied cookbook makes the distribution boundary explicit: “If you're building a paid or remotely hosted app, join the waitlist to request access before offering it to users.” Its public local/open-source example keeps authentication, credential storage and inference in the Electron main process; the UI bridge does not receive tokens.
**Confirmed:** The cookbook supplies a concrete replacement path: persist a per-installation host ID; register using `dynamic_agent_client` and the app's actual name; save the issued client ID; request and check separate plan-usage permissions; verify the ID token; store profiles locally; discover models for the selected connection; and stream the public Responses API through `response.completed`. It also calls for visible **Using ChatGPT plan** and **Manage usage** actions.
**Observed:** The October 2 addendum already recorded browser credentials, reusable tokens forwarded through Vercel, backend inference, unresolved grants, local-only sign-out, and the separation of identity, permission and capability. The October 1 review already recorded most underlying SIWC requirements. Today's cookbook reinforces those findings rather than reversing them.
**Confirmed / Open:** Service Terms and SIWC Terms still display September 29, 2026. The Help Center articles show newer relative update labels. The repository does not preserve complete October 2 source snapshots, so this report does not claim that every detailed requirement below was newly introduced today. Newly examined details include strict `127.0.0.1` callback handling, retained registration through sign-out, refresh-session revocation, current re-consent rollout restrictions, and the developer-guided app-server configuration. These are current requirements, not a proved sentence-level historical diff.
### Data handling and receiving parties
Paths below are relative to the inspected repository. Third-party dependency behavior remains **Provisional**, even when its installed source is directly readable.
#### Hosted chat
| Operation | Source evidence and boundary |
| --- | --- |
| Reads identity and credentials | **Observed / Provisional:** `ChatConsole` uses the dependency without OAuth overrides (`web/app/components/ChatConsole.tsx:462-490`). The default session contains access token, account ID, optional ID/refresh tokens, expiry and refresh time (`web/node_modules/@openai-oauth/web/dist/index.js:325-345`). Account claims are decoded, not signature-verified (`web/node_modules/@openai-oauth/core/dist/runtime.js:59-137`). |
| Requests scopes | **Provisional:** `openid profile email offline_access`, fixed client ID `app_EMoamEEZ73f0CkXaXp7hrann`, Codex simplified-flow and organization-claim flags; authorization at `https://auth.openai.com/oauth/authorize` (`web/node_modules/@openai-oauth/core/dist/runtime.js:6-10,179-205`). No documented direct-plan resource/grant is supplied by the callsite. Actual granted scopes were not observed. |
| Callback and exchange | **Provisional:** browser extension handoff uses `http://localhost:1455/auth/callback`; pending state and PKCE verifier are stored in `sessionStorage`. The browser checks callback state, exchanges the code, saves the session and removes callback parameters from the visible URL (`web/node_modules/@openai-oauth/web/dist/index.js:10-16,416-434,446-550`). This URL cleanup does not prove the callback URL was absent from hosting/access logs. Extension onward handling is unknown. |
| Persistent storage | **Provisional:** encrypted session and a usable non-extractable AES-GCM key are stored in the same IndexedDB database. Same-origin code can ask the key to decrypt the session (`web/node_modules/@openai-oauth/web/dist/index.js:2-7,226-299`). Encryption does not satisfy the official instruction to keep tokens out of browser storage. |
| Transmits to Relmio/Vercel | **Observed / Provisional:** each `/api/chat` request carries the current prompt, access-token bearer and `chatgpt-account-id`; it can also carry the FedRAMP marker. ID and refresh tokens are not attached to this request (`web/app/components/ChatConsole.tsx:123-133`; `web/node_modules/@openai-oauth/web/dist/index.js:393-408`). Vercel/Relmio runtime and its request-processing infrastructure receive the prompt and reusable access token. |
| Transmits to OpenAI | **Provisional:** browser exchange/refresh sends credentials to `auth.openai.com/oauth/token` (`web/node_modules/@openai-oauth/core/dist/runtime.js:114-151,212-235`). The hosted route uses request-scoped credentials and forwards prompt, instructions, model and settings through `https://chatgpt.com/backend-api/codex/responses` (`web/app/api/chat/route.ts:169-191`; `web/node_modules/@openai-oauth/web/dist/server.js:1-30`; `web/node_modules/@openai-oauth/core/dist/runtime.js:6,246-266,493-505,573-585`). |
| Other recipients | **Provisional:** extension detection probes a Chrome extension resource or Firefox's loopback frame (`web/node_modules/@openai-oauth/web/dist/index.js:10-16,36-110`). Model discovery can fetch `https://registry.npmjs.org/@openai/codex/latest` using only an Accept header, then authenticated OpenAI model metadata (`web/node_modules/@openai-oauth/core/dist/models.js:4,60-98,105-128`). npm receives ordinary network metadata, not a configured OAuth bearer or prompt in that fetch. User-clicked extension-store and GitHub links introduce their own navigation recipients (`web/app/page.tsx:128-141`; `web/app/components/ChatConsole.tsx:492-502`). The package author is not established as a data recipient merely by authorship. |
| Conversation retention and logs | **Observed:** up to 12 turns remain in React memory; only the current prompt is submitted (`web/app/components/ChatConsole.tsx:40,123-133,251-287`). The route disables dependency response-state caching and returns `Cache-Control: no-store`. Explicit route logs contain fixed categories/statuses, not prompts/tokens (`web/app/api/chat/route.ts:177,197-203,266-273,284-291`). Browser persistence is not time-bounded by the app; sign-out deletes its stored session. Framework, Vercel, extension, npm and OpenAI retention are **Open**. |
OpenAI's Help Center and Privacy Policy separately describe authentication/security metadata, including account/application identifiers, requested permissions, sign-in outcome, IP address and device information. That processing must not be confused with the identity fields released to a participating application.
#### Local n8n credential-copy bridge
| Operation | Source evidence and boundary |
| --- | --- |
| Host login and reads | **Observed:** `npx` invokes pinned official `@openai/codex@0.154.0`, `codex -c cli_auth_credentials_store="file" login`, with an isolated pending `CODEX_HOME` (`src/services/oauth.js:19,252-292`). Relmio reads the complete credential JSON, checks its size, `auth_mode: chatgpt` and nonempty access/ID/refresh-token fields. It does not verify SIWC identity or scopes (`src/services/oauth.js:159-198`). npm/configured registry receives package-download traffic; OpenAI receives the Codex authentication traffic. The exact pinned CLI request/grant and callback verification remain **Open**. |
| Host storage | **Observed:** successful credentials are promoted to `~/.n8n-openai-oauth/auth.json`, or the `N8N_OPENAI_OAUTH_HOME` override, with protected directory/file handling and an atomic rename (`src/services/oauth.js:123-133,274-279,381-407`). The original saved host credential remains a separate copy from the installed sidecar credential. |
| Browser boundary | **Observed:** the local status endpoint returns status, attempt ID and sanitized error/retry state, rather than token contents. The start endpoint reports a system-browser launch (`src/web/server.js:3188-3202,3403-3479`). The local wizard therefore differs from hosted IndexedDB credential storage. |
| Local Docker copy | **Observed:** after rechecking the credential against the approved plan, Relmio sends the complete buffer over stdin to the `credential-seed` container (`src/services/local-n8n-sidecar-installer.js:2034-2077`). The seed helper has no network, writes a private volume through a temporary file with `0600` permissions, and disables its Docker logging driver; the volume mounts at `/home/node/.codex` in the sidecar (`src/domain/local-n8n-sidecar.js:134-137,169-209`). Docker daemon/host administrators and the helper/runtime are within the credential trust boundary. |
| VPS copy | **Observed:** the reviewed server-side install path reads the credential and passes it to the selected remote installer (`src/web/server.js:5058-5096`). The installer uploads the entire file with `0600` mode under the managed auth directory; Compose mounts it into `/home/node/.codex` (`src/services/installer.js:272-289`; `src/domain/templates.js:22-35`). The local UI names `/docker/n8n-openai-oauth` and expressly separates upload approval from OpenAI permission (`src/ui/index.html:193-213,677-679`). The selected VPS/SSH administrator and hosting infrastructure become trust boundaries. No Relmio-hosted credential recipient is shown on this path. |
| Sidecar reads, refreshes and transmits | **Observed / Provisional:** runtime reads `/home/node/.codex/auth.json` through third-party `openai-oauth` (`src/gateway/openai-oauth-sidecar.mjs:181-186`). Installed credential code reads and rewrites tokens on refresh (`node_modules/@openai-oauth/local/dist/auth-file.js:102-137,179-195,206-267`). It uses the fixed-client default and Codex backend, not an issued Relmio SIWC registration (`node_modules/@openai-oauth/core/dist/runtime.js:6-10,225-235,246,493-505`). n8n sends workflow content to the sidecar; OpenAI receives authenticated model requests and returns output through the sidecar to n8n. Root dependency model discovery also calls npm metadata (`node_modules/@openai-oauth/core/dist/models.js:4,76-78,105-107`). Docker/image registries and npm are additional build/install recipients, not configured recipients of the credential file (`src/domain/local-n8n-sidecar.js:89-110`; `src/domain/templates.js:5-16`). |
| Logs, retention and access scope | **Observed / Provisional:** host-login stdout/stderr are bounded in process memory (`src/services/oauth.js:305-322`). Sidecar top-level errors are generic (`src/gateway/openai-oauth-sidecar.mjs:169-176,193-196`). Dependency request logging is optional and can include request summaries, usage and error messages when enabled (`node_modules/openai-oauth/dist/chunk-INHW7GRB.js:343-365,614-678`). It is not a system-wide no-logging guarantee. Credential files/volumes persist; credential refresh has protected backup files (`src/services/local-n8n-sidecar-installer.js:64-98`). The bridge listens on all container interfaces on the selected private network, with no per-user authorization visible in its request handler (`src/gateway/openai-oauth-sidecar.mjs:109-148,181-186`; `src/domain/local-n8n-sidecar.js:134-142`). n8n execution history, configured workflow recipients, host logs, backups and provider retention remain **Open**. |
### Check 1: identity sign-in
**Confirmed:** Identity-only website integration needs an OpenAI-provisioned client, exact registered callbacks, one-time backend-bound state/PKCE/nonce, backend code exchange, verified ID-token signature/issuer/audience/expiration/nonce, and the application's own secure session. The standard identity-only contract does not require OpenAI access or refresh tokens. Identity does not authorize plan usage or access to ChatGPT conversations or memory.
| Requirement | Hosted demo: classification, behavior and change | Local bridge: classification, behavior and change |
| --- | --- | --- |
| Application registration and truthful identity | **Non-compliant with documented SIWC. Observed / Provisional:** no Relmio client configuration is supplied; dependency uses a fixed foreign client identifier and Codex flags (`web/app/components/ChatConsole.tsx:462-490`; `web/node_modules/@openai-oauth/core/dist/runtime.js:6-10,179-205`). Obtain a Relmio website client after approval; do not reuse a Codex/default client. | **Non-compliant as OSS SIWC. Observed:** starts Codex login and imports its credential (`src/services/oauth.js:263-272,381-407`). For a new SIWC path, use the actual Relmio app name, stable per-runtime host ID, initial `dynamic_agent_client`, and saved issued client ID per verified registration. No client secret or partner API key is needed for the documented local dynamic flow. |
| Redirect and callback | **Non-compliant. Provisional:** extension intercepts `localhost:1455`, with client-side state and PKCE (`web/node_modules/@openai-oauth/web/dist/index.js:10,416-434,460-550`). State checking is present, but no explicit transaction expiry and no documented backend session binding appear. Replace with the exact registered website callback and one-time backend transaction, clearing failure state as well as success state. | **Unclear for native Codex; non-compliant as the documented Relmio SIWC flow. Observed:** callback ownership is delegated to pinned Codex; Relmio only probes loopback port availability (`src/services/oauth.js:20-27,63-120,252-272`). A replacement SIWC flow must start its listener before navigation and use `http://127.0.0.1:<port>/auth/callback`, not `localhost`. Preserve scheme/host/path on later logins, use the same exact URI within each exchange, reject denied/mismatched callbacks and changed returning client IDs. |
| ID-token verification and account mapping | **Non-compliant. Provisional:** base64 JSON decoding derives account ID without JWKS/signature, issuer, audience or OIDC nonce verification (`web/node_modules/@openai-oauth/core/dist/runtime.js:59-137`; `web/node_modules/@openai-oauth/web/dist/index.js:325-345`). Verify all required claims and map verified issuer/client/sub to the app account. The extension-state nonce and CSP nonce are not substitutes. | **Unclear for Codex's internal verification; non-compliant as SIWC validation in Relmio. Observed:** JSON shape/nonempty strings are checked, not the documented identity (`src/services/oauth.js:172-198`). A new SIWC registration must validate identity before activating or replacing a profile and keep registrations separate even when emails match. |
| Identity-only versus reusable provider session | **Non-compliant as identity-only. Observed / Provisional:** the route requires an access bearer and account ID; the browser retains renewable credentials (`web/node_modules/@openai-oauth/web/dist/server.js:7-18`; `web/node_modules/@openai-oauth/web/dist/index.js:325-345`). For identity-only, retain the minimum identity mapping and issue a secure first-party cookie; do not require these inference credentials. | **Compliant disclosure of the distinction, not approval of the bridge. Observed:** UI explicitly says this copies a saved credential and is not identity-only (`src/ui/index.html:193-213`; `src/ui/local.js:3234,3272-3273`). Preserve that distinction until the old path is replaced. |
| Branding and button | **Unclear. Observed / Provisional:** dependency defaults to “Sign in with ChatGPT,” shows an inline OpenAI logo, and Relmio restyles the button (`web/node_modules/@openai-oauth/react/dist/SignInWithChatGPT.js:47-48`; `web/app/components/ChatConsole.tsx:44-66,462-469`). That wording is one approved website label; it is not itself the defect. Permission, asset conformity and rendered appearance were not verified. Use approved assets/formats only with the authorized integration, and do not imply sponsorship. | **Unclear pending migration. Observed:** existing actions describe Codex sign-in, with an unofficial warning (`src/ui/index.html:193-213`). A supported SIWC onboarding action should use “Continue with ChatGPT,” the actual app identity and approved assets. Do not relabel the current credential copy as the official integration. |
**Observed:** `src/services/codex-login.js:145-168,203-234` is a separate managed Codex app-server device-login path. Its `clientInfo.name/title` identifies Relmio to app-server; that is not an issued SIWC OAuth client or proof of plan-use permission. Do not conflate this path with the hosted extension or automatically classify ordinary official Codex use as the unsupported hosted flow.
### Check 2: separately authorized plan usage
**Confirmed:** The local SIWC contract requests identity scopes `openid profile email` plus `offline_access resource.invoke chatgpt.tokens.use.direct`, with `resource=https://api.openai.com/v1`. It checks the token response's granted `chatgpt.tokens.use.direct` before inference. If a valid identity lacks that grant, preserve sign-in but disable plan use. User-approved deployment/copying is a different permission.
| Requirement | Hosted demo: classification, behavior and change | Local bridge: classification, behavior and change |
| --- | --- | --- |
| Separate grants | **Non-compliant. Provisional:** requests only `openid profile email offline_access`; session conversion does not retain/check the returned direct-plan scope (`web/node_modules/@openai-oauth/core/dist/runtime.js:10,179-235`; `web/node_modules/@openai-oauth/web/dist/index.js:325-345`). Implement the approved hosted grant contract, separate identity from plan state and block inference without the actual grant. Adding a local consent checkbox is insufficient. | **Non-compliant as documented SIWC; actual Codex scopes Open. Observed:** no SIWC scope/resource or grant verification in the Codex invocation and credential reader (`src/services/oauth.js:172-198,263-272`). Obtain a fresh app-specific SIWC grant; do not reinterpret imported Codex tokens as that grant. |
| Runtime and storage | **Non-compliant. Observed / Confirmed:** browser IndexedDB plus a Relmio-controlled Vercel inference runtime (`web/node_modules/@openai-oauth/web/dist/index.js:226-299`; `web/app/api/chat/route.ts:169-191`; `web/app/page.tsx:125-157`). SIWC sessions says no browser token storage; Terms section 2 requires the user's local runtime or a remote runtime only that user controls. Moving tokens into Vercel storage would also conflict with section 1's persistent-storage rule. Remove this path or obtain explicit applicable hosted authorization and implement its prescribed architecture. | **Local storage safeguards comply in part; overall integration non-compliant; VPS interpretation Unclear. Observed:** host file/private volume are protected (`src/services/oauth.js:274-279,398-406`; `src/domain/local-n8n-sidecar.js:181-198`). Replace their contents/refresh logic with a Relmio SIWC registration. Terms says persistent tokens must be local, not remote/managed, while the VM guide allows protected self-hosted transfer. Obtain clarification before claiming the VPS variant complies. |
| Inference transport | **Non-compliant. Observed / Provisional:** default `chatgpt.com/backend-api/codex` (`web/app/api/chat/route.ts:170-191`; `web/node_modules/@openai-oauth/core/dist/runtime.js:6,246`). The guide explicitly says not to use `backend-api` for this plan-usage flow. Use public `/v1/responses` only with the appropriate newly authorized bearer and permitted runtime. | **Non-compliant as SIWC. Observed / Provisional:** the sidecar loads the same backend-oriented transport (`src/gateway/openai-oauth-sidecar.mjs:181-186`; `node_modules/@openai-oauth/core/dist/runtime.js:6,246`). Replace transport and authentication together. Do not just point existing Codex credentials at the public endpoint. |
| Connected application and authenticated-user activity | **Hosted runtime non-compliant; no pooling observed. Observed:** credentials are request-scoped, not selected from a pool (`web/node_modules/@openai-oauth/web/dist/server.js:7-30`; `web/app/api/chat/route.ts:169-191`). Preserve per-user isolation in any replacement. User-submitted activity does not remove the shared-runtime restriction. | **Unclear application boundary; missing enforcement for a SIWC claim. Observed:** intended consumer is selected n8n, but the private-network listener accepts compatible requests without per-user enforcement (`docs/local-endpoints.md:14,20-27`; `src/gateway/openai-oauth-sidecar.mjs:109-148,181-186`). Define the connected app and restrict use to that authenticated user's own activity or expressly approved automation. Do not serve unrelated tools, public webhook customers or other users from one subscription. A private Docker network alone does not prove this boundary. |
| Disclosure, consent and privacy notice | **Partly compliant disclosure; privacy adequacy Unclear. Observed:** UI and READMEs disclose unofficial status, token forwarding, browser storage and local-only sign-out (`web/app/components/ChatConsole.tsx:504-510`; `web/app/page.tsx:125-157`; `README.md:26-30`; `npm/README.md:23-27`; `docs/security.md:18-31`). Keep these facts, but replace “policy-uncertain” as the sole conclusion with the concrete unsupported-flow findings. Present an adequate Relmio privacy notice before any replacement processes data; a security guide alone does not establish legal adequacy. | **Deployment consent present; SIWC consent missing. Observed:** checkbox approves a complete credential copy and sidecar start, not an app-specific plan grant or all later background workflows (`src/ui/local.js:3270-3273`; `src/ui/index.html:211-213,677-679`). Separate provider grant, local/VPS transfer consent and express background-use consent. Explain actual recipients, saved copies, deletion and retention. |
| Sign-out and revocation | **Non-compliant for SIWC renewable-session logout; existing disclosure accurate. Provisional:** `logout` clears pending state and IndexedDB session only (`web/node_modules/@openai-oauth/web/dist/index.js:291-293,551-558`). In the supported plan flow, stop requests, attempt refresh-token revocation using discovery's revocation endpoint and issued client ID, then clear tokens. Report unconfirmed remote revocation and link ChatGPT disconnection controls. Identity-only app-session logout remains a separate case. | **Non-compliant as a SIWC session lifecycle. Observed:** bridge dashboard exposes setup/refresh/remove, not provider-session revocation (`src/web/server.js:1527-1530`); `/api/disconnect` detaches SSH only (`src/web/server.js:5106-5110`). Implement revocation before clearing SIWC tokens, coordinate installed copies and preserve registration/host mappings. Removing a container or host file does not prove remote revocation. |
| Usage limits, credits and recovery | **Non-compliant with documented plan-usage UX. Observed:** byte/time limits exist, but upstream policy, eligibility and usage failures collapse into generic errors (`web/app/api/chat/route.ts:6-11,193-204,241-254`; `web/app/components/ChatConsole.tsx:32-39`). Preserve safe status/code/request-ID diagnostics; distinguish temporary unavailability from an exhausted app/plan limit; pause on limits and make Manage usage primary. Replace the suggestion to try another host after a hosting block with permission/integration diagnosis, not protective-measure circumvention. | **Unclear provider outcomes; incomplete SIWC controls. Observed:** current UI approves installation and distinguishes a model list from a working workflow, but does not provide the documented per-app usage experience (`src/ui/local.js:3270-3273`; `src/services/installer.js:79-132`). Add active plan status, usage-settings links and exact provider-error handling. Do not rotate accounts, loop login to restore quota, or silently switch billing. |
| Eligibility and charges | **No approval established; not eligible merely by being open source. Confirmed / Open:** cookbook explicitly requires requesting access before offering paid/remotely hosted integration; website identity is a selected-partner trial. The current callsite contains no provisioned Relmio registration (`web/app/components/ChatConsole.tsx:462-490`). Obtain separate identity/plan-use approval as applicable, including written resolution of shared-host runtime requirements. Submitting the interest form is not approval. | **Potentially eligible after migration, not through the current bridge. Confirmed / Observed:** public local/open-source dynamic registration does not require a partner secret, but plan usage is for eligible Plus/Pro users. Current credential shape alone cannot establish that eligibility (`src/services/oauth.js:172-198`). Terms requires users be able to use their plan without paying Relmio/upgrading. Do not infer an exemption from generic partner pricing illustrations or another app's approval. |
| Logging and retention | **Explicit route logging compliant in its limited scope; total retention Unclear. Observed:** fixed categories, no-store response and no response-state cache are useful controls (`web/app/api/chat/route.ts:177,197-203,266-285`). Preserve these, audit callback/access/analytics logs and specify retention/deletion. Do not call `store:false` zero retention or guarantee that refresh/ID tokens reach only OpenAI beyond the inspected path. | **Protected seeding compliant in part; whole-system retention Unclear. Observed / Provisional:** seed logging disabled, host output bounded, optional dependency logs and persistent copies remain as listed above. Set a credential-copy/backup lifecycle, retain only required data and keep credentials out of logs/support. Establish n8n, Docker, VPS and provider practices before claiming no retention. |
**Confirmed:** Current plan-usage guidance supports weekly per-app caps; a cap does not reserve extra usage. Credit use is separately enabled, off by default where offered, and requires the app cap to be 100% as well as available credits and eligibility. Plus users also share a five-hour limit across apps; the sessions guide says that five-hour limit does not apply to Pro. Relmio must not interpret missing usage data as exhausted quota or treat repeated OAuth as a way to restore usage.
**Confirmed:** For user-requested re-consent after a declined grant, the recovery guide says to request the complete scopes again. `force_reconsent=true` requires OpenAI to confirm deployment for the integration; `prompt=consent` remains supported before that rollout. Neither is an excuse to force consent on every ordinary sign-in.
**Open:** The self-hosted VM guide permits SSH transfer of the selected SIWC registration, requires a distinct persistent VM host ID and lets the VM own subsequent refreshes. It says host-specific usage attribution and revocation for transferred sessions are not yet available. This is narrower than permission to copy arbitrary Codex credentials and conflicts with the literal remote-persistence wording in Terms section 1. The discrepancy needs OpenAI clarification; this report does not silently choose the more permissive text.
### Check 3: model and TTS capability
| Requirement | Current behavior | Classification and change |
| --- | --- | --- |
| Account-specific models | **Observed:** hosted request and badge fix `gpt-5.6-luna` (`web/app/api/chat/route.ts:185`; `web/app/components/ChatConsole.tsx:439-440`). **Provisional:** dependency may query Codex model metadata, but that is not the public SIWC catalog or a user selection (`web/node_modules/@openai-oauth/core/dist/models.js:105-132`). Local bridge appends two image IDs to successful lists (`src/gateway/openai-oauth-sidecar.mjs:6-11,80-87`). | **Non-compliant with documented SIWC discovery. Confirmed:** request `GET https://api.openai.com/v1/models` for the active grant, preserve displayable server ordering, display `display_name`, submit `slug`, and refresh when the account changes. Do not synthesize entitlement. Current Codex docs still list GPT-5.6 Luna during rollout; the defect is assuming account availability, not evidence that Luna has retired. |
| Request shape and completion | **Observed / Provisional:** hosted dependency normalizes input, `store:false` and streaming; route disables replay caching and requires `response.completed`, rejecting terminal failures and empty output (`web/node_modules/@openai-oauth/core/dist/runtime.js:389-445`; `web/app/api/chat/route.ts:177,225-254`). | **Compliant in these narrow source-level controls, not end-to-end SIWC.** Preserve them after transport migration. Public SIWC requires array `input`, `store:false`, `stream:true`, no unsupported fields and explicit incomplete/failed/interrupted handling. Decode usage failures even when they arrive after output begins. No live completed request was tested. |
| Images and other services | **Observed:** compatibility handlers expose image routes in the dependency and add image IDs; UI now qualifies them as unofficial (`node_modules/openai-oauth/dist/chunk-INHW7GRB.js:810-815`; `src/gateway/openai-oauth-sidecar.mjs:6-11,80-87`; `src/ui/index.html:212`). | **Non-compliant if advertised or retained as SIWC-supported generation. Confirmed:** current SIWC preview excludes image-generation tools, Files API, audio/video input and transcription. Image/file input to a compatible model is a separate capability. Remove unsupported generation behavior from the SIWC path or put supported alternatives behind a separately authorized API connection. |
| TTS | **Observed:** hosted route is text-only; local sidecar returns 501 for `/v1/audio`, including speech (`web/app/api/chat/route.ts:179-191`; `src/gateway/openai-oauth-sidecar.mjs:20-25,109-116`). | **No TTS capability established. Confirmed:** official speech documentation describes the separate Audio API and requires AI-generated voice disclosure. Identity, a plan grant or successful text inference does not grant TTS access. Preserve the unsupported status unless a separately documented and authorized audio path is implemented and verified. |
**Confirmed:** If Relmio chooses the documented SIWC app-server route, the official guide says to read its own SIWC token file, pass `ACCESS_TOKEN` only to the child process, configure a Responses provider at `https://api.openai.com/v1`, and manage refresh/restart itself. No separate Codex sign-in is needed in that configuration. Its `model/list` may be a bundled catalog, so it is not an entitlement check. This is a possible supported replacement, not evidence that current `account/login/start: chatgptDeviceCode` provides the same contract.
### Minimum change set and required approvals
#### Hosted demo
1. **Immediate minimum:** disable the third-party hosted sign-in/inference path, including direct requests to `/api/chat`; hiding only its UI would leave credential forwarding active. Keep a clear explanation and a route to local installation. Do not replace the warning with a compliance claim.
2. **To preserve hosted chat without SIWC approval:** implement a separately billed Platform API path using Relmio's server-held API credentials, with explicit funding/consent disclosures, application access controls and usage bounds. Do not silently bill this path after a ChatGPT-plan failure, and do not reuse imported Codex tokens. This is an alternative product/authentication path, not a small repair to SIWC.
3. **To preserve hosted ChatGPT sign-in:** obtain the selected-partner client provisioning for identity. If hosted plan use is wanted, obtain its separate approval and a documented architecture/agreement covering the shared host; identity approval alone is insufficient. Implement backend-bound website OAuth and verified app sessions. For plan use, follow the contract OpenAI actually approves, including token placement, grants, inference, consent, usage and revocation.
4. Remove obsolete extension onboarding, browser-token persistence and Codex-backend forwarding when replacing the flow. Offer explicit cleanup of existing local sessions and explain provider disconnection separately; a release must not silently claim remote revocation. Reconcile `README.md`, `npm/README.md`, `docs/security.md`, `docs/faq.md`, homepage and chat copy with the actual replacement.
#### Local bridge
1. Replace credential import from Codex with fresh Relmio-named OSS SIWC registration. Keep host ID, issued client ID, verified issuer/sub, scopes, expiry and rotating credentials together per registration. Support reconnect/account selection without cross-wiring identities.
2. Keep tokens in a protected local runtime, not browser JavaScript. Refresh atomically and serialize refreshes for each session. Do not continue independent refreshes of copied sessions. Retire the old bridge credential path deliberately; do not delete unrelated native Codex credentials.
3. Use the public model catalog and Responses endpoint with the authorized grant, supported request shape and completed-stream handling. Remove backend-only image compatibility from this SIWC path. Keep native Codex use and separately authorized Platform API features distinct.
4. Restrict use to the connected application and the authenticated user's activity. Obtain express consent for background workflows. A generic adapter for unrelated tools or other users cannot be justified by a private network or deployment checkbox; narrow it or obtain a separate authorized API arrangement.
5. Add plan-enabled state, first-use confirmation, Manage usage, precise limit/error handling, renewable-session revocation and honest local/remote disconnect reporting. Update local/VPS UI and the required documentation together.
6. For VPS credentials, obtain clarification of the Terms/storage discrepancy before claiming support. If the approved design follows the VM guide, generate/preserve the VM's own host ID, transfer only the same user's app registration securely and let the VM own refresh.
The public local/open-source flow does **not** require Relmio to obtain a website partner client or secret merely to register a qualifying local installation. It does require the documented implementation and Terms. The existing Codex bridge does not acquire approval by association with that new option.
**OpenAI approval or clarification not established by this review:** Relmio's hosted identity client; hosted/paid plan-use participation; an applicable exception or agreement for the shared Vercel runtime; permission for the current fixed-client Codex credential bridge; any use outside the connected-application restriction; resolution of remote persistent storage for the proposed VPS path; `force_reconsent` deployment confirmation; and sponsorship/co-branding permission if such claims are desired. The interest form is a request channel, not evidence of approval.
### Remaining unknowns and verification limits
- Actual production dependencies, extension bytes/permissions/telemetry, callbacks and deployed Vercel behavior were not exercised.
- Actual pinned Codex requested/granted scopes, ID-token validation internals, live SIWC eligibility and provider authorization remain unverified. No credentials were inspected to infer them.
- No selected-account model list, completed model request, image workflow or TTS call was tested. Source-level completion checks are not capability proof.
- Request-scoped handling, browser encryption, `Cache-Control: no-store` and provider `store:false` do not establish zero retention. The API data-control page distinguishes application state from abuse-monitoring logs, while Codex authentication says data handling depends on sign-in method/workspace. Do not import Platform API retention or training promises into this Codex bridge without evidence that they apply.
- The privacy notice's legal adequacy, applicable regional/customer agreements, infrastructure logging, backups, n8n execution retention and downstream workflow recipients remain unresolved.
- The existing CSP limits browser resources but does not validate OAuth identity or grants. Its nonce is unrelated to OIDC; dialog focus code changes keyboard handling, not recipients or permissions (`web/proxy.ts:7-30`; `web/app/components/dialogFocus.ts:14-63`).
The actionable result is unchanged by a newer Help Center article: the hosted flow needs removal or a different approved architecture, and the local bridge needs a real authentication/transport migration. Disclosure edits alone cannot make either current bridge the documented SIWC integration.
### Owner decisions, 2026-10-03
- **Hosted chat:** disable the hosted third-party sign-in and `/api/chat` forwarding, and apply to OpenAI for access through the official request channel. Rebuild hosted ChatGPT sign-in only on the architecture OpenAI approves. The interest form is a request, not approval.
- **Local n8n bridge:** keep the existing credential-copy bridge with its Unofficial label for now, and plan a migration to the documented open-source SIWC flow (Relmio-named dynamic registration, verified grants, protected local tokens, account-specific model discovery and the public Responses API). The VPS storage question goes to OpenAI for clarification before any VPS claim.