GptSkin Skill v0.6.0

Secure browser device authorization and paid-flow resume.

• Connect GptSkin from Codex with --login; no API key copying in the normal flow.
• Use short-lived, one-time device codes and narrowly scoped local tokens.
• Open Creem checkout when Credits are low, then resume the same confirmed theme request after Credits arrive.
• Preserve idempotency so retries do not create duplicate charges.
• Keep manual --key-stdin only as an advanced compatibility option.
• Includes macOS and Windows secure token storage and 95 passing tests.

GptSkin v0.5.0 — Native Semantic Themes

Highlights

• Turns source artwork into a complete semantic Codex design system instead of a wallpaper-only treatment.
• Adds a bounded, high-visibility new-task Hero stage with real floating suggestion cards and coordinated icon badges.
• Adds Daily and Seasonal modes, accessibility-checked semantic colors, editor syntax tokens, diff/status styling, and reduced-motion support.
• Adds upper/lower-third focal positioning so important text, faces, and symbols are not cropped by wide Hero layouts.
• Themes the real Codex shell, sidebar, composer, messages, code, menus, dialogs, tooltips, and status states.

Safety and compatibility

• Existing three-color and saved themes remain supported through a safe Daily fallback manifest.
• Theme injection stays local and transactional through a uniquely identified loopback Codex CDP target.
• GptSkin does not modify the Codex application bundle, executable, signature, or business content.
• Local Codex screenshots are prohibited from community previews; preview images must remain source-derived.

Validation

• Complete npm test suite passed.
• Skill structure validation passed.
• Live macOS Codex checks passed with artwork on and off, including light and rich Hero themes.
• Independent forward testing produced a second validated reference-driven Hero manifest without fake UI.

Full changelog: v0.4.0...v0.5.0

v0.4.0 — Windows Safety Guards + Paid-Flow Hardening

🛡️ Windows 安全护栏（真实用户事故驱动）

• CLI 路径拦截：OpenAI\Codex\bin\<hash>\codex.exe 是命令行 CLI，不是桌面应用——任何来源（含 CODEX_APP_PATH）指向它都会被拒绝并解释区别
• 进程发现：官方安装路径找不到时，自动发现正在运行的 Codex/ChatGPT 桌面进程
• 非官方安装闸门：exe 不在官方路径时，在杀任何进程之前拒绝执行并给出安全选项（官方版 / 手动 CDP 启动走免重启通道 / GPTSKIN_ALLOW_UNOFFICIAL_APP=1）——修复第三方便携 repack 被强杀后无法重启（0xc0000142）导致会话死亡的事故
• 重启失败自救指引：25 秒连不上 CDP 时输出完整恢复说明（主题未应用、无永久改动、手动开 app）

🔒 付费流程加固

• 幂等性：Idempotency-Key 预持久化覆盖上传/编译全流程；in-flight 202 轮询；终态退款持久化；显式重试 + key 轮换
• 密钥安全：新增 --key-stdin（argv 会进 shell 历史），--key 标记废弃；config-store 原子写加固
• 文档：README 注册赠送额度更正为 20 Credits；新增 THIRD-PARTY.md 干净实现声明；Windows 排障三条（0xc0000142、CLI vs 桌面版、CODEX_APP_PATH 用法）

✅ 质量

54/54 测试全绿（node:test）。完整变更：3b6af87...v0.4.0