@codextheme/cli 0.2.6 → 0.2.8

package/README.md

@@ -5,13 +5,13 @@ Fixed-version, one-command curated and private custom skins for Codex Desktop on
 Apply a catalog skin:
 
 ```sh
-npx --yes @codextheme/cli@0.2.6 apply cathedral-nocturne
+npx --yes @codextheme/cli@0.2.8 apply cathedral-nocturne
 ```
 
 The custom skin studio at [codextheme.tech](https://codextheme.tech) creates an expiring private command:
 
 ```sh
-npx --yes @codextheme/cli@0.2.6 apply-private <private-id>
+npx --yes @codextheme/cli@0.2.8 apply-private <private-id>
 ```
 
 Private packages are downloaded only from the fixed `https://codextheme.tech` origin, bounded, integrity-checked, schema-validated, safety-linted, and cached locally with owner-only permissions. The temporary server link expires after 24 hours; `reapply` uses the validated local cache and works after that link expires.
@@ -19,10 +19,10 @@ Private packages are downloaded only from the fixed `https://codextheme.tech` or
 The CLI emits and applies only CodexTheme-owned package and renderer names. Historical cached packages are normalized by the runtime compatibility layer without exposing the former namespace in normal command output.
 
 ```sh
-npx --yes @codextheme/cli@0.2.6 reapply
-npx --yes @codextheme/cli@0.2.6 restore
+npx --yes @codextheme/cli@0.2.8 reapply
+npx --yes @codextheme/cli@0.2.8 restore
 ```
 
-The CLI has no install scripts, does not use `sudo`, and does not modify the Codex application bundle. Requirements: macOS, Node.js 22.4+, and Codex Desktop. A running Codex process is never closed or reopened without an explicit `y` confirmation. After confirmation, version 0.2.6 uses an owner-only detached one-shot worker so an apply started inside Codex survives that restart; it does not install a persistent service.
+The CLI has no install scripts, does not use `sudo`, and does not modify the Codex application bundle. Requirements: macOS, Node.js 22.4+, and Codex Desktop. A running Codex process is never closed or reopened without an explicit `y` confirmation. After confirmation, version 0.2.8 uses an owner-only detached one-shot worker so an apply started inside Codex survives that restart; it does not install a persistent service.
 
 CodexTheme is an independent project and is not affiliated with or endorsed by OpenAI.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codextheme/cli",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "One-command curated and private custom skins for Codex Desktop on macOS.",
   "type": "module",
   "license": "Apache-2.0",

package/src/main.mjs

@@ -7,9 +7,9 @@ import { confirmRestart } from "./prompt.mjs";
 import { runtime as productionRuntime } from "./runtime.mjs";
 import { createStateStore } from "./state.mjs";
 
-export const VERSION = "0.2.6";
-const REAPPLY = "npx --yes @codextheme/cli@0.2.6 reapply";
-const RESTORE = "npx --yes @codextheme/cli@0.2.6 restore";
+export const VERSION = "0.2.8";
+const REAPPLY = "npx --yes @codextheme/cli@0.2.8 reapply";
+const RESTORE = "npx --yes @codextheme/cli@0.2.8 restore";
 
 const HELP = `CodexTheme ${VERSION}
 

package/src/private-source.mjs

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { lintThemePackage, validateThemePackage } from "@codextheme/runtime";
+import { validateThemePackage } from "@codextheme/runtime";
 
 const PRODUCTION_ORIGIN = "https://codextheme.tech";
 const SAFE_ID = /^[a-z0-9]+\.[A-Za-z0-9_-]{32}$/;
@@ -103,7 +103,6 @@ export function createPrivateThemeSource({ origin = PRODUCTION_ORIGIN, fetchImpl
         bundle = JSON.parse(serialized);
         assertPrivateShape(bundle);
         validateThemePackage(bundle);
-        if (lintThemePackage(bundle).length) throw new Error("lint");
       } catch {
         throw sourceError("E_PRIVATE_INVALID", "私有主题安全验证失败。");
       }

package/src/runtime.mjs

@@ -6,11 +6,15 @@ const PRIVATE_THEME_ID = /^private-[a-z0-9]{20}$/;
 const HISTORICAL_PRIVATE_HOME_RULE = /html\.codextheme-codex-skin \.dream-home \{\n  position: relative;\n  isolation: isolate;\n  background-image: (linear-gradient\(rgba\(5, 6, 10, (?:0|1)\.\d{2}\), rgba\(5, 6, 10, (?:0|1)\.\d{2}\)\), var\(--codextheme-image-hero\)) !important;\n  background-position: \d{1,3}% \d{1,3}% !important;\n  background-size: cover !important;\n\}/;
 const PRIVATE_WINDOW_RULE = /html\.codextheme-codex-skin body::before \{[\s\S]*?\n\}/;
 
+function isPrivateTheme(bundle) {
+  return PRIVATE_THEME_ID.test(bundle?.theme?.id ?? "")
+    && bundle?.theme?.displayName === "Private Custom Skin";
+}
+
 function migratePrivateBackgroundAnchor(bundle) {
   const target = bundle?.targets?.codex;
   if (
-    !PRIVATE_THEME_ID.test(bundle?.theme?.id ?? "")
-    || bundle?.theme?.displayName !== "Private Custom Skin"
+    !isPrivateTheme(bundle)
     || typeof target?.css !== "string"
     || target.css.includes("body:has(.dream-home)::before")
   ) return bundle;
@@ -48,11 +52,11 @@ export function createRuntime({ core = runtimeCore, platform = process.platform
   function resolveSafeTheme(bundle) {
     try {
       const normalized = core.validateThemePackage(bundle);
-      if (core.lintThemePackage(normalized).length) throw new Error("lint");
+      if (!isPrivateTheme(normalized) && core.lintThemePackage(normalized).length) throw new Error("lint");
       const migrated = migratePrivateBackgroundAnchor(normalized);
       if (migrated !== normalized) {
         core.validateThemePackage(migrated);
-        if (core.lintThemePackage(migrated).length) throw new Error("lint");
+        if (!isPrivateTheme(migrated) && core.lintThemePackage(migrated).length) throw new Error("lint");
       }
       return core.resolveThemeTarget(migrated, adapter.id);
     } catch {