fix(release): harden installer rollback and rights boundaries

Author: Fei-Away

.github/workflows/release.yml

@@ -85,6 +85,7 @@ jobs:
             CODEX_DREAM_SKIN_SKIP_SIGNED_RUNTIME_TESTS=1 \
             CODEX_DREAM_SKIN_SKIP_DOCTOR=1 \
             ./macos/tests/run-tests.sh
+          swift test --package-path macos/menubar-app
           test -x macos/scripts/build-dmg.sh || chmod +x macos/scripts/build-dmg.sh
           # The builder owns app assembly, engine staging, and ad-hoc signing.
           # Release signing/notarization remains optional and is intentionally

docs/background-generation-prompts.md

@@ -12,7 +12,7 @@
 
 | 你要做的事 | 应看的文件 | 说明 |
 |---|---|---|
-| 直接切换当前置顶主题 | `macos/presets/preset-arina-hashimoto/theme.json` + `background.jpg`；Windows 对应 `windows/assets/theme.json` + `dream-reference.jpg` | 两端都播种「桥本有菜」；不是 `docs/images/presets/*-light/dark` 截图 |
+| 在获权的源码 checkout 中切换参考主题 | `macos/presets/preset-arina-hashimoto/theme.json` + `background.jpg`；源码 Windows 对应 `windows/assets/theme.json` + `dream-reference.jpg` | 仅限本地权利核验后的源码使用；公开 DMG/Setup.exe 只播种 Gothic Void Crusade，不是 `docs/images/presets/*-light/dark` 截图 |
 | 重新生成一张纯背景 | 本文件的通用模板或 [`reference-background-prompt-guide.md`](./reference-background-prompt-guide.md) | 输出应是独立的 `2560 × 1440`、16:9 图片，不是截图 |
 | 只看效果或找风格 | `docs/images/gallery/skin-01.jpg` ～ `skin-08.jpg` | 带 UI 的概念效果图，不能改名为 `background.jpg` 后导入 |
 | 查看当前主题在浅/暗色下的实机结果 | `docs/images/presets/arina-hashimoto-light.jpg`、`arina-hashimoto-dark.jpg` | 仅预览，包含真实控件，不能作为背景素材 |

docs/reference-background-prompt-guide.en.md

@@ -6,9 +6,9 @@ Chinese guide: [`reference-background-prompt-guide.md`](./reference-background-p
 
 > Public prompts default to an original fictional adult. They do not name or imitate a celebrity, private individual, copyrighted character, or living artist's signature style. Use an authorized identity reference only when you hold the necessary likeness and asset rights. Generated artwork is not an official OpenAI/Codex visual or endorsement.
 
-## Current Tested Feature: Arina Hashimoto
+## Source-Only Reference: Arina Hashimoto (Excluded From Public Packages)
 
-- **Switchable theme:** `macos/presets/preset-arina-hashimoto/`; Windows seeds from `windows/assets/theme.json` plus the byte-identical `windows/assets/dream-reference.jpg`. Both installers seed Arina Hashimoto.
+- **Source-only switchable reference:** `macos/presets/preset-arina-hashimoto/`; source Windows runs can use `windows/assets/theme.json` plus the byte-identical `windows/assets/dream-reference.jpg`. Public DMG and Setup.exe exclude these files and seed only the rights-reviewed Gothic Void Crusade.
 - **User-supplied pure source:** `docs/images/presets/arina-hashimoto-source.png` (`1672 × 941`). The preset's `2560 × 1440` JPEG is a standardized release derivative and does not create additional source detail.
 - **Real runtime results:** `arina-hashimoto-light.jpg` and `arina-hashimoto-dark.jpg` are light/dark screenshots for preview only. They are not importable wallpapers.
 - **Relationship to earlier examples:** this is the current tested preset, not `docs/images/gallery/skin-01.jpg` and not one of the skin-01–08 concept mockups. skin-01 contributes only a related pink-rose direction and UI-copy reference.
@@ -21,15 +21,15 @@ The “effect” shown in a README is not automatically an importable wallpaper.
 
 | Type | Repository path | What it is | A complete theme? |
 |---|---|---|---|
-| **Current featured preset** | `macos/presets/preset-arina-hashimoto/`; Windows seeds from `windows/assets/theme.json` plus the byte-identical `dream-reference.jpg` | A cross-platform theme pack containing a UI-free wallpaper; both installers seed Arina Hashimoto | **Yes** |
+| **Source-only reference preset** | `macos/presets/preset-arina-hashimoto/`; source Windows runs use `windows/assets/theme.json` plus the byte-identical `dream-reference.jpg` | Use locally only after an independent rights review; public DMG/Setup.exe use Gothic Void Crusade instead | **Only in an authorized local source checkout** |
 | **Pure source art** | `docs/images/presets/arina-hashimoto-source.png` | User-supplied source wallpaper around `1672 × 941`; no `theme.json` | **No**; it can be selected as an image, but is not a complete pack |
 | **Real injected previews** | `docs/images/presets/arina-hashimoto-light.jpg`, `arina-hashimoto-dark.jpg` | Light/dark Codex screenshots containing real controls | **No** |
 | **Concept gallery** | `docs/images/gallery/skin-01.jpg`–`skin-08.jpg` | UI effect mockups used only to communicate visual directions | **No** |
 | **Experimental/history images** | `docs/images/banner-*.png`, `docs/images/generated-*.png` | Unapproved local experiments or references | **No**; do not ship without rights/provenance review |
 
 `docs/images/hero-banner-red-white.png` and `macos/assets/portal-hero.png` are legacy 3:1 banner assets, not the current 16:9 universal-theme master. Do not substitute either for `preset-*/background.jpg` unless the output is intentionally homepage-banner-only.
 
-Rule of thumb: **switch themes from `macos/presets/preset-*`; generate from this guide; study directions in `docs/images/gallery/`; inspect runtime results in `docs/images/presets/*-light.jpg` / `*-dark.jpg`.** A `theme.json` and a `background.jpg` in the same `preset-*` directory form a seedable theme; `docs/images/` is documentation/archive space, not a mirror of the theme library.
+Rule of thumb: **public installers default to Gothic Void Crusade; use the source-only reference preset locally only after a rights review.** Generate from this guide; study directions in `docs/images/gallery/`; inspect runtime results in `docs/images/presets/*-light.jpg` / `*-dark.jpg`. A `theme.json` and a `background.jpg` in the same `preset-*` directory form a seedable theme; `docs/images/` is documentation/archive space, not a mirror of the theme library.
 
 Path classification is not a likeness or redistribution license. The current `preset-arina-hashimoto` contains user-provided human/AI portrait material included at the maintainer's direction. Public repository inclusion neither grants nor proves likeness, generation, commercial-use, or further-redistribution rights; see `macos/NOTICE.md` for the file-level boundary.
 

docs/reference-background-prompt-guide.md

@@ -6,9 +6,9 @@
 
 English guide: [`reference-background-prompt-guide.en.md`](./reference-background-prompt-guide.en.md)
 
-## 当前实测精选置顶：桥本有菜
+## 当前源码参考：桥本有菜（不随公开安装包提供）
 
-- **实际可切换主题**：`macos/presets/preset-arina-hashimoto/`；Windows 使用 `windows/assets/theme.json` 与 byte-identical 的 `windows/assets/dream-reference.jpg` 组成播种源，两端首装都会播种「桥本有菜」。
+- **源码中的可切换参考主题**：`macos/presets/preset-arina-hashimoto/`；源码 Windows 运行时使用 `windows/assets/theme.json` 与 byte-identical 的 `windows/assets/dream-reference.jpg`。公开 DMG 和 Setup.exe 不包含这套素材，公开包只播种已确认可分发的 Gothic Void Crusade。
 - **用户提供的纯背景源图**：`docs/images/presets/arina-hashimoto-source.png`（`1672 × 941`）；preset 中的 `2560 × 1440` JPEG 是标准化发行副本，不会凭空增加源图细节。
 - **真实运行效果**：`arina-hashimoto-light.jpg` 与 `arina-hashimoto-dark.jpg` 是浅色/暗色实机截图，只用于预览，不能导入为背景。
 - **与历史示例的关系**：它是当前实际预设，不是 `docs/images/gallery/skin-01.jpg`，也不是 skin-01～08 的概念效果图。skin-01 只提供相近的粉色玫瑰视觉方向和 UI 文案参考。
@@ -21,15 +21,15 @@ README 里的“效果图”不等于可以导入的背景。下面这些文件
 
 | 类型 | 仓库路径 | 作用 | 能否直接作为完整主题导入 |
 |---|---|---|---|
-| **实际可切换预设（当前置顶）** | `macos/presets/preset-arina-hashimoto/`；Windows 的播种源为 `windows/assets/theme.json` + byte-identical 的 `dream-reference.jpg` | 两端都会播种「桥本有菜」；macOS 用脚本/菜单栏切换，Windows 用系统托盘切换 | **可以** |
+| **源码参考预设（非公开包）** | `macos/presets/preset-arina-hashimoto/`；源码 Windows 播种源为 `windows/assets/theme.json` + byte-identical 的 `dream-reference.jpg` | 仅在本地源码且完成权利核验后使用；公开 DMG/Setup.exe 改用 Gothic Void Crusade | **仅限获权的本地源码场景** |
 | **纯背景源图** | `docs/images/presets/arina-hashimoto-source.png` | 用户提供的原始纯背景，约 `1672 × 941`；只有图片，没有 `theme.json` | **不能作为完整主题**；可手动换图，但应先检查比例和裁切 |
 | **真实实机效果预览** | `docs/images/presets/arina-hashimoto-light.jpg`、`arina-hashimoto-dark.jpg` | 浅色/暗色 Codex 注入截图，包含真实侧栏、卡片和输入框 | **不可以** |
 | **概念效果图** | `docs/images/gallery/skin-01.jpg` ～ `skin-08.jpg` | 只表达八种视觉方向的带 UI 示例；配套的 `background-generation-prompts.md` 按这些方向拆解 | **不可以** |
 | **实验/历史图片** | `docs/images/banner-*.png`、`docs/images/generated-*.png` | 尚未批准的本地实验图或参考图；不属于任何 preset pack | **不可以**，也不要未经权利核验放进发行包 |
 
 `docs/images/hero-banner-red-white.png` 与 `macos/assets/portal-hero.png` 是旧的 3:1 横幅资源，不是当前 16:9 通用主题母版；除非明确只做首页横幅，否则不要拿它们替代 `preset-*/background.jpg`。
 
-一句话判断：**要切换主题看 `macos/presets/preset-*`；要生成新图看本指南；要看视觉方向看 `docs/images/gallery/`；要看真实运行结果看 `docs/images/presets/*-light.jpg` / `*-dark.jpg`。** `theme.json` 和 `background.jpg` 同在一个 `preset-*` 目录时才是一套可播种的主题；`docs/images/` 是文档/归档目录，不是主题库的镜像。
+一句话判断：**公开安装包的默认主题是 Gothic Void Crusade；源码中的参考主题仅在完成权利核验后本地切换。** 要生成新图看本指南；要看视觉方向看 `docs/images/gallery/`；要看真实运行结果看 `docs/images/presets/*-light.jpg` / `*-dark.jpg`。`theme.json` 和 `background.jpg` 同在一个 `preset-*` 目录时才是一套可播种的主题；`docs/images/` 是文档/归档目录，不是主题库的镜像。
 
 路径分类不代表肖像或再分发许可。当前 `preset-arina-hashimoto` 含维护者指示收录的用户提供真人/AI 肖像素材；仓库公开包含这些文件并不授予或证明肖像、生成、商业使用或再次分发权利，具体边界以 `macos/NOTICE.md` 为准。
 

macos/README.md

@@ -10,7 +10,7 @@ This project injects through **local loopback CDP**. It does **not** modify the
 
 ## Requirements
 
-- macOS
+- macOS 13 Ventura or newer (the native DMG app declares macOS 13 as its minimum)
 - Official Codex Desktop installed and launched at least once (`~/.codex/config.toml` exists)
 - No global Node.js install required (uses Codex’s signed bundled Node after validation)
 
@@ -56,7 +56,7 @@ Install location after step 2:
 | State / logs / user images | `~/Library/Application Support/CodexDreamSkinStudio` |
 | Theme backup | under Application Support (`theme-backup.json`) |
 
-## Legacy customer ZIP (optional packaging)
+## Legacy standalone ZIP (maintainer/offline packaging only)
 
 To build the “double-click install” folder layout for non-git users:
 
@@ -65,8 +65,11 @@ To build the “double-click install” folder layout for non-git users:
 ```
 
 That ZIP contains a visible installer plus a hidden `.codex-dream-skin-studio`
-engine. Prefer the DMG for new deliveries; keep this ZIP only for existing
-offline workflows. Do not ship only CSS/images.
+engine and is staged as a rights-clean package with only the redistributable
+Gothic Void Crusade preset. It is retained for existing offline workflows;
+prefer the DMG for ordinary users, and do not share a source checkout or an
+archive containing the excluded Arina reference files. Do not ship only
+CSS/images.
 
 ## How it works (security boundary)
 

macos/menubar-app/Sources/CodexDreamSkinMenuBar/AppDelegate.swift

@@ -150,17 +150,18 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     addDisabledItem("版本：v\(appVersion)")
 
     menu.addItem(.separator())
+    let busy = operationInFlight || engineInstallInFlight || snapshot.busy
     let needsEngineInstall = engineNeedsInstall()
     if engineInstallInFlight {
       addDisabledItem("正在安装引擎…")
     } else {
       addActionItem(
         needsEngineInstall ? "安装 / 升级引擎…" : "修复 / 重新安装引擎…",
-        action: #selector(reinstallEngine)
+        action: #selector(reinstallEngine),
+        enabled: !busy
       )
     }
 
-    let busy = operationInFlight || engineInstallInFlight || snapshot.busy
     let applyTitle: String
     switch snapshot.session {
     case "active": applyTitle = "重新应用皮肤"
@@ -311,6 +312,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
   }
 
   @objc private func reinstallEngine() {
+    guard !operationInFlight, !snapshot.busy else { return }
     installBundledEngineIfNeeded(force: true)
   }
 
@@ -524,7 +526,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
   }
 
   private func installBundledEngineIfNeeded(force: Bool) {
-    guard !engineInstallInFlight else { return }
+    guard !engineInstallInFlight, !operationInFlight, !snapshot.busy else { return }
     if !force && !engineNeedsInstall() { return }
     guard let bundledVersion = version(at: bundledEngineURL?.appendingPathComponent("VERSION")) else {
       showError(title: "安装资源损坏", message: "App 内的版本信息无效，请重新下载。")

macos/scripts/build-client-release.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 
 set -euo pipefail
+export LC_ALL=C
+export LANG=C
+export LC_CTYPE=C
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 VERSION="$(/usr/bin/tr -d '[:space:]' < "$ROOT/VERSION")"
 OUTPUT="${1:-$HOME/Desktop/Codex 主题编辑器.zip}"
@@ -16,6 +19,7 @@ trap '/bin/rm -rf "$TMP"' EXIT
   --exclude '.DS_Store' \
   --exclude 'release/' \
   --exclude 'runtime/' \
+  --exclude 'presets/preset-arina-hashimoto/' \
   "$ROOT/" "$ENGINE/"
 
 # Keep the customer ZIP self-contained: bundle prompt docs and referenced
@@ -57,8 +61,13 @@ fi
 /bin/cp "$ROOT/CLIENT_DEPLOY_PROMPT.md" "$CLIENT_ROOT/给 Codex 的部署提示词.md"
 /bin/chmod 755 "$CLIENT_ROOT/安装 Codex 主题编辑器.command"
 /bin/chmod 755 "$ENGINE"/*.command "$ENGINE"/scripts/*.sh "$ENGINE"/tests/*.sh
-/usr/bin/xattr -cr "$CLIENT_ROOT"
 /usr/bin/find "$CLIENT_ROOT" -type f \( -name '.DS_Store' -o -name '._*' \) -delete
+[ ! -e "$ENGINE/presets/preset-arina-hashimoto" ] \
+  || { printf 'Restricted Arina preset entered the standalone ZIP.\n' >&2; exit 1; }
+if /usr/bin/find "$CLIENT_ROOT" -type f -name 'arina-hashimoto-*' -print -quit | /usr/bin/grep -q .; then
+  printf 'Restricted Arina documentation asset entered the standalone ZIP.\n' >&2
+  exit 1
+fi
 /bin/mkdir -p "$(dirname "$OUTPUT")"
 /bin/rm -f "$OUTPUT"
 COPYFILE_DISABLE=1 /usr/bin/ditto -c -k --keepParent --norsrc --noextattr "$CLIENT_ROOT" "$OUTPUT"

macos/scripts/build-menubar-app.sh

@@ -112,12 +112,17 @@ done
 /usr/bin/rsync -a "$ROOT/assets/" "$ENGINE/assets/"
 PUBLIC_PRESET="preset-gothic-void-crusade"
 PUBLIC_PRESET_SHA256="b76a7cbe2ff9d923846e931984d243a7ba1f25de8d190b5c6412c809c41aee42"
+PUBLIC_PRESET_THEME_SHA256="fd250dc6c0ec1eea724f59a86c7c126a6bd9b90798289483a00948d57e23e52e"
 [ -d "$ROOT/presets/$PUBLIC_PRESET" ] \
   || { printf 'Public release preset missing: %s\n' "$PUBLIC_PRESET" >&2; exit 1; }
 actual_public_preset_sha256="$(LC_ALL=C /usr/bin/shasum -a 256 \
   "$ROOT/presets/$PUBLIC_PRESET/background.jpg" | /usr/bin/awk '{print $1}')"
 [ "$actual_public_preset_sha256" = "$PUBLIC_PRESET_SHA256" ] \
   || { printf 'Reviewed public preset hash changed: %s\n' "$actual_public_preset_sha256" >&2; exit 1; }
+actual_public_preset_theme_sha256="$(LC_ALL=C /usr/bin/shasum -a 256 \
+  "$ROOT/presets/$PUBLIC_PRESET/theme.json" | /usr/bin/awk '{print $1}')"
+[ "$actual_public_preset_theme_sha256" = "$PUBLIC_PRESET_THEME_SHA256" ] \
+  || { printf 'Reviewed public preset metadata hash changed: %s\n' "$actual_public_preset_theme_sha256" >&2; exit 1; }
 /bin/mkdir -p "$ENGINE/presets/$PUBLIC_PRESET"
 /usr/bin/rsync -a "$ROOT/presets/$PUBLIC_PRESET/" "$ENGINE/presets/$PUBLIC_PRESET/"
 /bin/cp "$ROOT/VERSION" "$ENGINE/VERSION"

macos/scripts/build-release.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 
 set -euo pipefail
+export LC_ALL=C
+export LANG=C
+export LC_CTYPE=C
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 VERSION="$(/usr/bin/tr -d '[:space:]' < "$ROOT/VERSION")"
 RELEASE_DIR="$ROOT/release"
@@ -15,6 +18,7 @@ if [ "${1:-}" != "--skip-tests" ]; then "$ROOT/tests/run-tests.sh"; fi
   --exclude '.git/' \
   --exclude '.DS_Store' \
   --exclude 'release/' \
+  --exclude 'presets/preset-arina-hashimoto/' \
   "$ROOT/" "$TMP/codex-dream-skin-studio/"
 
 # The macOS tree is also published as a standalone ZIP. Bundle prompt guides
@@ -37,6 +41,12 @@ if [ -f "$PRESET_README" ]; then
   /bin/mv "$temporary" "$PRESET_README"
 fi
 /usr/bin/find "$TMP/codex-dream-skin-studio" -type f \( -name '.DS_Store' -o -name '._*' \) -delete
+[ ! -e "$TMP/codex-dream-skin-studio/presets/preset-arina-hashimoto" ] \
+  || { printf 'Restricted Arina preset entered the standalone ZIP.\n' >&2; exit 1; }
+if /usr/bin/find "$TMP/codex-dream-skin-studio" -type f -name 'arina-hashimoto-*' -print -quit | /usr/bin/grep -q .; then
+  printf 'Restricted Arina documentation asset entered the standalone ZIP.\n' >&2
+  exit 1
+fi
 /bin/chmod 755 "$TMP/codex-dream-skin-studio"/*.command
 /bin/chmod 755 "$TMP/codex-dream-skin-studio"/scripts/*.sh "$TMP/codex-dream-skin-studio"/tests/*.sh
 /bin/rm -f "$ARCHIVE"

macos/scripts/install-dream-skin-macos.sh

@@ -31,21 +31,48 @@ deploy_project() {
     --exclude 'runtime/' \
     "$PROJECT_ROOT/" "$temporary/"
   /bin/chmod 700 "$temporary"/*.command "$temporary"/scripts/*.sh 2>/dev/null || true
+  /bin/rm -rf "$previous"
   if [ -e "$INSTALL_ROOT" ]; then /bin/mv "$INSTALL_ROOT" "$previous"; fi
   if ! /bin/mv "$temporary" "$INSTALL_ROOT"; then
     [ -e "$previous" ] && /bin/mv "$previous" "$INSTALL_ROOT"
     fail "Could not install the project at $INSTALL_ROOT"
   fi
-  /bin/rm -rf "$previous"
+  DEPLOY_PREVIOUS="$previous"
 }
 
+commit_deployed_project() {
+  [ -n "${DEPLOY_PREVIOUS:-}" ] || return 0
+  /bin/rm -rf "$DEPLOY_PREVIOUS" || true
+  DEPLOY_PREVIOUS=""
+}
+
+rollback_deployed_project() {
+  local status="$1"
+  /bin/rm -rf "$INSTALL_ROOT"
+  if [ -n "${DEPLOY_PREVIOUS:-}" ] && [ -e "$DEPLOY_PREVIOUS" ]; then
+    /bin/mv "$DEPLOY_PREVIOUS" "$INSTALL_ROOT" \
+      || fail "Installation failed and the previous engine could not be restored."
+  fi
+  DEPLOY_PREVIOUS=""
+  return "$status"
+}
+
+DEPLOY_PREVIOUS=""
+
 if [ "$IN_PLACE" = "false" ] && [ "$PROJECT_ROOT" != "$INSTALL_ROOT" ]; then
   /bin/mkdir -p "$(dirname "$INSTALL_ROOT")"
   deploy_project
   install_args=(--in-place --port "$PORT")
   [ "$CREATE_LAUNCHERS" = "true" ] || install_args+=(--no-launchers)
   [ "$LAUNCH_AFTER_INSTALL" = "true" ] || install_args+=(--no-launch)
-  exec "$INSTALL_ROOT/scripts/install-dream-skin-macos.sh" "${install_args[@]}"
+  if "$INSTALL_ROOT/scripts/install-dream-skin-macos.sh" "${install_args[@]}"; then
+    commit_deployed_project
+    exit 0
+  else
+    status=$?
+    rollback_deployed_project "$status"
+    exit "$status"
+  fi
 fi
 
 discover_codex_app