release v1.5.12 (#350)

* release v1.5.12

* docs: record v1.5.12 release checkpoint

Author: Fei-Away

TASK_PROGRESS.md

@@ -1,5 +1,76 @@
 # Task Progress
 
+## Client release v1.5.12 (2026-08-08)
+
+- [scope] Reviewed and merged 10 pending community/self PRs that had accumulated
+  unmerged on `main` since late July (#68, #212, #283, #284, #285, #286, #288,
+  #289, #106, #342) — each individually verified against current `main` before
+  merge: git-mergeable both alone and stacked together, no version-fragile
+  selector/DOM assumptions, and (for #283 specifically) the Safe CSS sandbox
+  in `runtime/safe-css-policy.json` was cross-checked to confirm no community
+  theme can trip the stricter visibility check (opacity floored at 0.65,
+  display/visibility/position not themable at all).
+- [diagnosed] Merging #68 exposed that `macos/scripts/image-metadata.mjs` is
+  generated from `runtime/image-metadata.mjs` via `tools/sync-runtime-assets.mjs`;
+  #68 edited the generated output directly instead of the source, so
+  `--check` failed on `main` and `windows/scripts/image-metadata.mjs` never
+  picked up the new `readRawDimensions` export at all. Fixed at the source
+  and regenerated both platform outputs (#347).
+- [diagnosed] `Static checks` CI was independently red on `main` — 3 tests in
+  `macos/tests/renderer-verification.test.mjs` failed against `main` HEAD
+  directly, unrelated to any merge here. Root cause: the test's hand-rolled
+  DOM mock had drifted from the real runtime contract in three ways (stale
+  `shell-main` selector literal predating the 26.727 `:is(...)` update,
+  missing `scope.missingL1` that `assessRendererVerification` requires,
+  hardcoded `version: "1.5.6"` against the real `SKIN_VERSION` of `"1.5.11"`).
+  Fixed the fixtures and exported `SKIN_VERSION` so the test imports the real
+  constant instead of re-hardcoding a value that drifts on every release (#349).
+- [implemented] Regrouped the menu bar's ~16 flat top-level items into
+  `主题`/`链接`/`维护` submenus, and replaced the always-present manual
+  "检查更新…" item with a background check (24h timer + one-shot ~15s after
+  launch) that posts a system notification the first time a new version is
+  seen and shows a conditional "🆕 发现新版本" item only while one is
+  available; manual check moved into 维护 as "立即检查更新" (#348). Could not
+  run `swift build`/`swift test` locally — this sandbox's Command Line Tools
+  (Swift 5.10) don't match the macOS 15.2 SDK (needs 6.0.3) — so an
+  independent review agent read the full diff for compile-breaking issues
+  before push, and the PR was only merged after real CI's `macos-latest` job
+  (`swift test --package-path macos/menubar-app` + DMG build) came back
+  green. The review agent's two substantive findings (install doc no longer
+  matched the new background-polling behavior; a manual check during an
+  in-flight background check could double-spawn `check-update-macos.sh`)
+  were fixed before merge with a dedicated `updateCheckInFlight` guard
+  separate from the broader `operationInFlight` busy state, so the 24h timer
+  no longer disables the primary apply/open actions while it runs.
+- [verified] Before cutting the version: `node --test macos/tests/*.test.mjs
+  windows/tests/*.test.mjs tools/*.test.mjs` (93/93 pass), full
+  `macos/tests/run-tests.sh` including signed-runtime and Doctor checks, and
+  both `injector.mjs --check-payload` invocations all pass on `main` post-merge.
+- [implemented] Version bump touches all six release version sources
+  (`macos/VERSION`, `windows/VERSION`, `macos/package.json`,
+  `macos/scripts/common-macos.sh`, both platforms' `injector.mjs`
+  `SKIN_VERSION`) plus the two hardcoded `1.5.11` assertions in
+  `macos/tests/run-tests.sh` (the update-check JSON fixture and the
+  `common-macos.sh`-sourced `$SKIN_VERSION` check). A grep-only pass across
+  the repo for the literal `1.5.11` first missed a third real dependency:
+  `windows/tests/injector-window-readiness.test.mjs` imports `verifySession`
+  (not `assessRendererVerification` directly), so its mock
+  `__CODEX_DREAM_SKIN_STATE__.version` is transitively checked against the
+  real `SKIN_VERSION` even though the test file never names that identifier.
+  The full portable test run after the version bump caught this immediately
+  (4 failures) before it reached CI; fixed the same way as the macOS
+  `renderer-verification.test.mjs` case — export `SKIN_VERSION` from
+  `windows/scripts/injector.mjs` (as a separate `export { }` statement, same
+  reason as macOS) and import it into the test instead of re-hardcoding.
+  `windows/tests/start-verified-skin-preserved.tests.ps1`'s literal
+  `"version":"1.5.11"` is a fully mocked PowerShell fixture with no path to
+  `SKIN_VERSION` at all (grepped every `.ps1` script; it's JS-only), so that
+  one is genuinely safe to leave unchanged.
+- [gap] Live click-through of the reorganized macOS menu bar and a real
+  "update available" notification have not been manually exercised on a
+  physical Mac — verification here is CI (`swift test`) plus static review,
+  not an interactive smoke test.
+
 ## macOS menu reapply/open ChatGPT restart fix (2026-08-05)
 
 - [scope] Branch `codex/fix-macos-reapply-open-chatgpt` was created from latest

macos/CHANGELOG.md

@@ -2,8 +2,28 @@
 
 ## Unreleased
 
+### 新增
+
+- 菜单栏更新检查改为后台自动进行：启动后约 15 秒与此后每 24 小时静默访问一次 GitHub Releases，发现新版本时推送系统通知，并在菜单顶部显示可点击的「🆕 发现新版本」条目；同一版本只通知一次。原「检查更新」菜单项保留为「维护」子菜单里的「立即检查更新」，用于手动触发。
+- 菜单栏状态栏菜单由 16 个平铺项收纳进「主题」「链接」「维护」三个子菜单，只保留重新应用皮肤、打开 ChatGPT 与退出在最外层，降低误触和视觉噪音。
+
 ### 修复
 
+- 修复菜单栏「重新应用皮肤」与「打开 ChatGPT」入口语义不一致的问题（#341）：重新应用现在会先尝试热重载，失败才回退到完整重启；打开 ChatGPT 复用已安装的 Dream Skin 启动脚本而不是直接原生拉起。
+- 渲染器可见性校验加固（#294）：从仅检查宽高与 `display` 改为同时校验 `checkVisibility()`、`opacity`、`content-visibility` 与视口相交，减少"校验通过但皮肤实际不可见"的假阳性。已核实社区主题的 Safe CSS 沙盒不允许 `opacity` 低于 0.65、且不开放 `display`/`visibility`/`position`，不会被这次加固误伤。
+- macOS 自定义主题写入器输出对齐当前运行时 schema（#295）。
+- 导入主题背景图前先用轻量方式读取尺寸再决定是否用 `sips` 全量解码（#66），避免超大图片在校验尺寸上限前就把整张图解码进内存造成的内存膨胀风险。
+- 主题包 manifest 时间戳校验拒绝不合法的 RFC 3339 值（#297），双平台共享。
+
+### 内部
+
+- 同步 v1.5.12 版本号，发布菜单栏重组、更新通知与上述修复。
+- 仓库根目录补充 `LICENSE` 入口（此前只在 `macos/LICENSE`）（#57）。
+- README / SECURITY.md 补充说明换肤期间本机回环 CDP 调试口未做身份验证这一既有安全边界（#18）。
+- CI 新增对 shared runtime 与 tools 目录的测试覆盖（#300）。
+- 修复 `macos/scripts/image-metadata.mjs` 与其生成源 `runtime/image-metadata.mjs` 不同步的问题——后者补上 `readRawDimensions` 拆分后未重新生成，Windows 对应文件因此完全没有这个能力；现已重新生成双端产物并导出 `SKIN_VERSION` 供测试引用，避免下次发版再次手工漂移。
+- 修复 `renderer-verification.test.mjs` 的 mock fixture 与运行时契约脱节导致的 CI 常年报红（并非本次改动引入，是历史遗留）：选择器字符串、`scope.missingL1` 字段与版本号三处过时。
+
 - 修复 Codex Desktop 26.727 设置页改用新版导航标记后，被注入器误判为非 ChatGPT 页面并报 `No page matched the expected ChatGPT shell markers` 的问题。双端共享契约现识别 `data-settings-panel-slug="general-settings"`，同时保留旧版外观设置锚点和严格的 `app:` 来源校验；首页与任务页的 L1 校验边界不变。
 - 修复 Codex Desktop 26.727 更新后主区域、顶栏和顶部渐隐仍保持原生白底，或注入被错误报告为成功的问题（#320、#322、#326、#330）。共享选择器现同时识别旧结构与新版 app-shell 标记，首页和普通任务页必须达到完整 L1 可见性后才会提交成功。
 - 同 ID 社区主题再次导入时原地升级，不再生成重复的 `id-2` / `id-3` 目录；仅在身份与完整语义指纹都匹配时清理旧后缀副本，缺失或非法 ID 使用双端一致的稳定映射（#318）。

macos/VERSION

@@ -1 +1 @@
-1.5.11
+1.5.12

macos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-dream-skin-studio",
-  "version": "1.5.11",
+  "version": "1.5.12",
   "private": true,
   "type": "module",
   "scripts": {

macos/scripts/common-macos.sh

@@ -29,7 +29,7 @@ CODEX_APP_JOB_LABEL="com.openai.codex-dream-skin-studio.app"
 INJECTOR_JOB_LABEL="com.openai.codex-dream-skin-studio.injector"
 EXPECTED_CODEX_TEAM_ID="2DC432GLL2"
 EXPECTED_CODEX_REQUIREMENT="anchor apple generic and certificate leaf[subject.OU] = \"$EXPECTED_CODEX_TEAM_ID\""
-SKIN_VERSION="1.5.11"
+SKIN_VERSION="1.5.12"
 DREAM_SKIN_VALIDATED_RUNTIME_PID=""
 DREAM_SKIN_VALIDATED_RUNTIME_BUNDLE=""
 DREAM_SKIN_VALIDATED_RUNTIME_EXE=""

macos/scripts/injector.mjs

@@ -43,7 +43,7 @@ const stableTestidLiteral = (testid) => {
   }
   return JSON.stringify(`[data-testid="${testid}"]`);
 };
-const SKIN_VERSION = "1.5.11";
+const SKIN_VERSION = "1.5.12";
 // .github/workflows/ci.yml's version-consistency check greps this file for a
 // literal `const SKIN_VERSION = "...";` line, so the export stays a separate
 // statement rather than an inline `export const`.

macos/tests/run-tests.sh

@@ -86,7 +86,7 @@ UPDATE_JSON="$({
 })"
 "$NODE" -e '
   const value = JSON.parse(process.argv[1]);
-  if (value.currentVersion !== "v1.5.11" || value.latestVersion !== "v9.8.7") process.exit(1);
+  if (value.currentVersion !== "v1.5.12" || value.latestVersion !== "v9.8.7") process.exit(1);
   if (!value.updateAvailable) process.exit(1);
   if (value.releaseUrl !== "https://github.com/Fei-Away/Codex-Dream-Skin/releases/latest") process.exit(1);
 ' "$UPDATE_JSON"
@@ -1138,7 +1138,7 @@ CRLF_BACKUP="$TMP/config-crlf-backup.json"
 "$NODE" "$ROOT/scripts/theme-config.mjs" restore "$CRLF_CONFIG" "$CRLF_BACKUP" >/dev/null
 /usr/bin/cmp -s "$CRLF_CONFIG" "$TMP/original-crlf.toml"
 
-/usr/bin/env -u HOME /bin/bash -c '. "$1/scripts/common-macos.sh"; [ -n "$HOME" ] && [ "$SKIN_VERSION" = "1.5.11" ]' _ "$ROOT"
+/usr/bin/env -u HOME /bin/bash -c '. "$1/scripts/common-macos.sh"; [ -n "$HOME" ] && [ "$SKIN_VERSION" = "1.5.12" ]' _ "$ROOT"
 if [ "${CODEX_DREAM_SKIN_SKIP_DOCTOR:-0}" = "1" ]; then
   printf 'SKIP: Doctor requires an installed, signed Codex app.\n'
   DOCTOR_RESULT="skipped"

windows/CHANGELOG.md

@@ -4,6 +4,17 @@
 
 ### 修复
 
+- Windows 路径穿越校验此前会把合法的、以 `.` 开头的主题文件名也当作可疑路径拒绝；现在能正确区分它们与真正的 `..` 路径穿越（#296）。
+- Windows 运行时加载主题前强制校验 `schemaVersion` 必须是数字 `1`，拒绝缺失或未来版本的 schema（#299）。
+- 主题包 manifest 时间戳校验拒绝不合法的 RFC 3339 值（#297），双平台共享。
+
+### 内部
+
+- 同步 v1.5.12 版本号，发布上述修复。
+- README / SECURITY.md 补充说明换肤期间本机回环 CDP 调试口未做身份验证这一既有安全边界（#18）。
+- CI 新增对 shared runtime 与 tools 目录的测试覆盖（#300）。
+- 修复共享的 `image-metadata.mjs` 生成源与 macOS 产物不同步的问题：Windows 一侧此前完全没有拿到 `readRawDimensions` 拆分后的能力，现已随双端产物重新生成补上。
+
 - 修复 Codex Desktop 26.727 设置页改用新版导航标记后，被注入器误判为非 ChatGPT 页面并报 `No page matched the expected ChatGPT shell markers` 的问题。双端共享契约现识别 `data-settings-panel-slug="general-settings"`，同时保留旧版外观设置锚点和严格的 `app:` 来源校验；首页与任务页的 L1 校验边界不变。
 - 修复 Codex Desktop 26.727 更新后主区域、顶栏和顶部渐隐仍保持原生白底，或注入被错误报告为成功的问题（#320、#322、#326、#330）。共享选择器现同时识别旧结构与新版 app-shell 标记，首页和普通任务页必须达到完整 L1 可见性后才会提交成功。
 - 同 ID 社区主题再次导入时原地升级，不再生成重复的 `id-2` / `id-3` 目录；仅在身份与完整语义指纹都匹配时清理旧后缀副本，缺失或非法 ID 使用双端一致的稳定映射（#318）。

windows/VERSION

@@ -1 +1 @@
-1.5.11
+1.5.12

windows/scripts/injector.mjs

@@ -39,7 +39,11 @@ const stableTestidLiteral = (testid) => {
   }
   return JSON.stringify(`[data-testid="${testid}"]`);
 };
-const SKIN_VERSION = "1.5.11";
+const SKIN_VERSION = "1.5.12";
+// .github/workflows/ci.yml's version-consistency check greps this file for a
+// literal `const SKIN_VERSION = "...";` line, so the export stays a separate
+// statement rather than an inline `export const`.
+export { SKIN_VERSION };
 const MAX_ART_BYTES = 10 * 1024 * 1024;
 const MAX_SAFE_CSS_BYTES = 256 * 1024;
 const STRONG_THEME_AUDIT_MS = 30000;