fix(macos): harden runtime identity and add cross-platform CI

.github/scripts/ci-static-checks.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd -P)"
+NODE="${NODE:-$(command -v node)}"
+VERSION="$(tr -d '[:space:]' < "$ROOT/macos/VERSION")"
+
+case "$VERSION" in
+  ''|*[!0-9.]*)
+    printf 'Invalid macOS VERSION: %s\n' "$VERSION" >&2
+    exit 1
+    ;;
+esac
+
+while IFS= read -r -d '' file; do
+  bash -n "$file"
+done < <(find "$ROOT/macos" "$ROOT/windows" -type f \( -name '*.sh' -o -name '*.command' \) \
+  ! -path '*/release/*' -print0)
+
+while IFS= read -r -d '' file; do
+  "$NODE" --check "$file" >/dev/null
+done < <(find "$ROOT/macos" "$ROOT/windows" -type f \( -name '*.mjs' -o -name '*.js' \) \
+  ! -path '*/release/*' -print0)
+
+PACKAGE_VERSION="$("$NODE" -p 'require(process.argv[1]).version' "$ROOT/macos/package.json")"
+[ "$PACKAGE_VERSION" = "$VERSION" ] || {
+  printf 'macos/package.json version %s does not match VERSION %s.\n' "$PACKAGE_VERSION" "$VERSION" >&2
+  exit 1
+}
+
+if grep -R -n -E 'dream-skin-skin|DREAM_SKIN_SKIN|1\.0\.0-rc2' \
+  "$ROOT/macos/scripts" "$ROOT/macos/assets" "$ROOT/windows/scripts" "$ROOT/windows/assets" >/dev/null; then
+  printf 'Legacy release-candidate identifiers remain in runtime files.\n' >&2
+  exit 1
+fi
+if grep -R -n -E -i '(writeFile|rename|copyFile|rm|replace|move).*app\.asar' \
+  "$ROOT/macos/scripts" "$ROOT/windows/scripts" >/dev/null; then
+  printf 'A runtime script appears to mutate app.asar.\n' >&2
+  exit 1
+fi
+if grep -n -E '/usr/bin/python3|(^|[[:space:]])eval([[:space:]]|$)' \
+  "$ROOT/macos/scripts/common-macos.sh" >/dev/null; then
+  printf 'The macOS runtime must not depend on python3 or eval state data.\n' >&2
+  exit 1
+fi
+if grep -n -E 'verified_cdp_endpoint[^|]*\|\|[[:space:]]*cdp_http_ready|\*ChatGPT\*\|\*Codex\*\|\*codex\*' \
+  "$ROOT/macos/scripts/common-macos.sh" >/dev/null; then
+  printf 'The macOS runtime contains a soft CDP identity bypass.\n' >&2
+  exit 1
+fi
+if grep -R -n -E 'remote-debugging-address[= ]0\.0\.0\.0|http://0\.0\.0\.0|ws://0\.0\.0\.0' \
+  "$ROOT/macos" "$ROOT/windows" >/dev/null; then
+  printf 'A CDP endpoint is configured outside loopback.\n' >&2
+  exit 1
+fi
+if grep -R -n -F "$VERSION" "$ROOT/macos/scripts" "$ROOT/macos/tests" >/dev/null; then
+  printf 'The macOS version is hard-coded outside VERSION/package.json.\n' >&2
+  exit 1
+fi
+
+"$NODE" "$ROOT/macos/scripts/injector.mjs" --self-test >/dev/null
+"$NODE" "$ROOT/macos/scripts/injector.mjs" --check-payload >/dev/null
+"$NODE" "$ROOT/windows/scripts/injector.mjs" --self-test >/dev/null
+"$NODE" "$ROOT/windows/scripts/injector.mjs" --check-payload >/dev/null
+"$NODE" "$ROOT/windows/tests/renderer-inject.test.mjs" >/dev/null
+
+printf 'PASS: cross-platform syntax, payload, version, and security checks.\n'

.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  static-and-node:
+    name: Static and Node checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Run cross-platform checks
+        run: .github/scripts/ci-static-checks.sh
+
+  windows-powershell:
+    name: Windows PowerShell checks
+    runs-on: windows-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Parse PowerShell scripts
+        shell: powershell
+        run: |
+          $failed = $false
+          Get-ChildItem windows -Recurse -Filter *.ps1 | ForEach-Object {
+            $tokens = $null
+            $errors = $null
+            [System.Management.Automation.Language.Parser]::ParseFile(
+              $_.FullName,
+              [ref]$tokens,
+              [ref]$errors
+            ) | Out-Null
+            foreach ($error in $errors) {
+              Write-Error "$($_.FullName):$($error.Extent.StartLineNumber): $($error.Message)" -ErrorAction Continue
+              $failed = $true
+            }
+          }
+          if ($failed) { exit 1 }
+      - name: Run Windows Node regression checks
+        shell: powershell
+        run: |
+          node windows/scripts/injector.mjs --self-test
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          node windows/scripts/injector.mjs --check-payload
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          node windows/tests/renderer-inject.test.mjs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

macos/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 1.1.3 — 2026-07-16
+
+### 改进
+
+- macOS 版本统一从 `VERSION` 读取，并增加版本一致性检查，减少发版遗漏
+- 增加 macOS / Windows 双端静态 CI，自动检查脚本语法、注入 payload、安全边界和版本一致性
+- 应用启动校验改为检查 bundle seal，并单独严格验签实际使用的内置 Node.js，避免递归重复扫描所有嵌套组件
+
+### 修复
+
+- CDP 端口必须由官方 Codex 主进程或其子进程监听，不再接受仅 HTTP 可访问或命令行含 `Codex` 字样的进程
+- 热切换会重新发现官方 Codex，并按 Apple 信任链、固定 OpenAI Team ID、架构和最低版本严格校验内置 Node.js，不再信任环境覆盖、外部 `NODE` 快路径或磁盘缓存
+- 停止注入器前严格核对 PID、启动时间、Node 路径、注入器路径和完整命令行；状态不完整时保守跳过，且强制停止前再次防护 PID 复用
+- 忽略畸形 CDP 消息；截图不再向前台页面派发 Escape 或鼠标事件，避免关闭用户菜单或弹窗并减少等待
+
+### 说明
+
+- `--watch` 只监听 Codex 页面加载与 target 生命周期；主题文件切换仍通过现有热重载流程立即生效，不增加常驻文件轮询
+
+---
+
 ## 1.1.2 — 2026-07-16
 
 ### 修复

macos/SKILL.md

@@ -24,6 +24,7 @@ This file is an optional Codex capability entry. The delivery is a complete stan
 - Keep decoration at `pointer-events: none`.
 - Require explicit authorization before restarting an already-running Codex instance.
 - Stop an injector only when its recorded PID, executable, command line, and start time all match.
+- `--watch` tracks Codex page and target lifecycles, not arbitrary theme-file edits. Use the provided customize and theme-switch commands so they can reload the payload safely.
 
 ## Key resources
 

macos/VERSION

@@ -1 +1 @@
-1.1.2
+1.1.3

macos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-dream-skin-studio",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "private": true,
   "type": "module",
   "scripts": {

macos/scripts/build-client-release.sh

@@ -2,6 +2,7 @@
 
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+VERSION="$(/usr/bin/tr -d '[:space:]' < "$ROOT/VERSION")"
 OUTPUT="${1:-$HOME/Desktop/Codex 主题编辑器.zip}"
 TMP="$(/usr/bin/mktemp -d /tmp/codex-dream-client.XXXXXX)"
 CLIENT_ROOT="$TMP/Codex 主题编辑器"
@@ -25,7 +26,7 @@ trap '/bin/rm -rf "$TMP"' EXIT
   > "$CLIENT_ROOT/安装 Codex 主题编辑器.command"
 
 /usr/bin/printf '%s\n' \
-  'Codex 主题编辑器 1.1.2' \
+  "Codex 主题编辑器 $VERSION" \
   '' \
   '推荐方式：把这个完整 ZIP、你喜欢的图片和“给 Codex 的部署提示词.md”一起发给自己的 Codex。' \
   '' \