chore(release): bump version to 1.5.4

Ship the #256 native-window-check fix (#257, merged to main as
8ea67fd). Syncs all six release-gate version sources (macos/VERSION,
windows/VERSION, macos/package.json, common-macos.sh SKIN_VERSION,
both platforms' injector.mjs SKIN_VERSION) plus the two hardcoded
version-string assertions in macos/tests/run-tests.sh that the release
workflow's macOS build step exercises. No Windows-visible change, so
windows/CHANGELOG.md is untouched, matching the 1.5.3 precedent.

Also adds an AGENTS.md rule: when an issue fix merges with green CI,
cut the release and close the issue in the same pass instead of
leaving it as a separate follow-up.

Author: Fei-Away

AGENTS.md

@@ -59,6 +59,7 @@
 - 保留用户现有改动；禁止未经授权的 reset、checkout 丢弃、强推、移动已公开 tag 或覆盖已公开 Release。
 - 功能开发、版本准备和紧急修复使用独立分支；提交只包含当前范围，推送前审查 staged diff。
 - 客户端发布由 `main` 上的版本变化驱动。版本未变化的普通合并不得重复构建或覆盖 Release。
+- Issue 修复的 PR 合并、CI 转绿后，同一轮工作里直接完成版本号提升（含六处版本一致）与 Release 触发，并在关闭 Issue 的评论中写清根因、修复提交与验证方式；不要把"已修复"停在合并这一步、让发布和关闭 Issue 变成另一次单独请求才做的事。
 - 自动发布必须验证六处版本一致、版本递增、tag 与发布提交一致、目标 Release 尚未公开。失败后的 `workflow_dispatch` 只能幂等重试同一 tag 和提交。
 - 构建资产必须来自 tag 对应提交。发布前核对 DMG、Setup.exe、`SHA256SUMS.txt` 的文件名、非空大小和摘要；发布后再次核对 Release 为公开状态且三个资产齐全。
 - 发布失败时保留可诊断状态，不把不完整资产标记为成功，也不通过重用旧版本号规避更新检测。

macos/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.5.4 — 2026-07-25
+
+### 修复
+
+- 修复 Codex 26.721.x（Chrome/150）上应用/校验主题永远报 `Injection verification failed` / `Initial theme verification failed` 的问题（#256）：原生窗口就绪检查调用的 CDP `Browser.getWindowForTarget` 在这个 build 上对真实、聚焦、可见的窗口也返回 `-32000 Browser window not found`。旧代码只把 `-32601`（方法不存在）当作"该信号不可用"降级信任 `documentVisible`，其余错误一律判定 not-ready，导致这个版本永远验证失败。已在真实 Codex 26.721.41059 会话上用 CDP 直连复现并验证：切换窗口前后台时 `documentVisibility` 正确地在 hidden/visible 间变化，但 `Browser.getWindowForTarget` 两次返回一模一样的 `-32000`，证明该调用在此 build 上本身失效。现在 `-32000` 与 `-32601` 同样降级为不可用信号，继续以本就是硬性要求的 `documentVisible` 作为真实可见性依据。
+
 ## 1.5.3 — 2026-07-25
 
 ### 修复

macos/VERSION

@@ -1 +1 @@
-1.5.3
+1.5.4

macos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-dream-skin-studio",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "private": true,
   "type": "module",
   "scripts": {

macos/scripts/common-macos.sh

@@ -29,7 +29,7 @@ CODEX_APP_JOB_LABEL="com.openai.codex-dream-skin-studio.app"
 INJECTOR_JOB_LABEL="com.openai.codex-dream-skin-studio.injector"
 EXPECTED_CODEX_TEAM_ID="2DC432GLL2"
 EXPECTED_CODEX_REQUIREMENT="anchor apple generic and certificate leaf[subject.OU] = \"$EXPECTED_CODEX_TEAM_ID\""
-SKIN_VERSION="1.5.3"
+SKIN_VERSION="1.5.4"
 DREAM_SKIN_VALIDATED_RUNTIME_PID=""
 DREAM_SKIN_VALIDATED_RUNTIME_BUNDLE=""
 DREAM_SKIN_VALIDATED_RUNTIME_EXE=""

macos/scripts/injector.mjs

@@ -42,7 +42,7 @@ const stableTestidLiteral = (testid) => {
   }
   return JSON.stringify(`[data-testid="${testid}"]`);
 };
-const SKIN_VERSION = "1.5.3";
+const SKIN_VERSION = "1.5.4";
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
 const CDP_ID_PATTERN = /^[A-Za-z0-9._-]{1,200}$/;
 const MAX_ART_BYTES = 10 * 1024 * 1024;

macos/tests/run-tests.sh

@@ -82,7 +82,7 @@ UPDATE_JSON="$({
 })"
 "$NODE" -e '
   const value = JSON.parse(process.argv[1]);
-  if (value.currentVersion !== "v1.5.3" || value.latestVersion !== "v9.8.7") process.exit(1);
+  if (value.currentVersion !== "v1.5.4" || value.latestVersion !== "v9.8.7") process.exit(1);
   if (!value.updateAvailable) process.exit(1);
   if (value.releaseUrl !== "https://github.com/Fei-Away/Codex-Dream-Skin/releases/latest") process.exit(1);
 ' "$UPDATE_JSON"
@@ -1063,7 +1063,7 @@ CRLF_BACKUP="$TMP/config-crlf-backup.json"
 "$NODE" "$ROOT/scripts/theme-config.mjs" restore "$CRLF_CONFIG" "$CRLF_BACKUP" >/dev/null
 /usr/bin/cmp -s "$CRLF_CONFIG" "$TMP/original-crlf.toml"
 
-/usr/bin/env -u HOME /bin/bash -c '. "$1/scripts/common-macos.sh"; [ -n "$HOME" ] && [ "$SKIN_VERSION" = "1.5.3" ]' _ "$ROOT"
+/usr/bin/env -u HOME /bin/bash -c '. "$1/scripts/common-macos.sh"; [ -n "$HOME" ] && [ "$SKIN_VERSION" = "1.5.4" ]' _ "$ROOT"
 if [ "${CODEX_DREAM_SKIN_SKIP_DOCTOR:-0}" = "1" ]; then
   printf 'SKIP: Doctor requires an installed, signed Codex app.\n'
   DOCTOR_RESULT="skipped"

windows/VERSION

@@ -1 +1 @@
-1.5.3
+1.5.4

windows/scripts/injector.mjs

@@ -39,7 +39,7 @@ const stableTestidLiteral = (testid) => {
   }
   return JSON.stringify(`[data-testid="${testid}"]`);
 };
-const SKIN_VERSION = "1.5.3";
+const SKIN_VERSION = "1.5.4";
 const MAX_ART_BYTES = 10 * 1024 * 1024;
 const MAX_SAFE_CSS_BYTES = 256 * 1024;
 const STRONG_THEME_AUDIT_MS = 30000;