feat: improve Windows compatibility and add switchable home styles

[1622352030]

Summary / 摘要

This PR carries the Windows compatibility work from the fork forward from upstream v1.5.6 and prepares the synchronized client sources as v1.6.0. It is broader than a visual-only change: it fixes Codex 26.721 renderer compatibility, Windows login startup, community theme entry/import compatibility, and adds two persistent live view switches.

• Fix the Windows PowerShell 5.1 tray-menu binding failure and improve native menu readability.
• Adapt the shared renderer/CSS to the Codex 26.721+ home DOM and route transitions.
• Fix browser-normalized one-click theme links and a strict Safe CSS compatibility case used by Studio ZIP themes.
• Make a successful Windows one-click apply exit automatically after visible verification, so the operation lock is released for the next theme.
• Add live tray switches for menu background coverage and home-page presentation.
• Repair the Windows login/start-menu launch path so opting into login startup starts a real skinned Codex session, not only the tray.
• Add repository secret scanning and keep local credentials/tools/build artifacts out of Git.

User-visible fixes / 用户可见修复

Codex 26.721+ layout and renderer compatibility

• Supports the new home structure where the real content column is a sibling of .home-banners, rather than its descendant.
• Handles both home suggestion layers introduced by current Codex builds: [data-home-ambient-suggestions] and the portal-rendered .group/home-suggestions layer.
• Refreshes route/public-part state when Codex replaces route DOM without firing the Navigation API, preventing a real conversation from remaining classified as home.
• Removes three skin-only decorative text elements that became redundant in current Codex: the home quote, task-page brand label, and online-status label.
• Keeps the home composer, project controls, plugin entry points, native controls, and all conversation content intact.

Integration follow-up for the fork's background composition

These items are not upstream defects. Upstream's continuous dark left-block design is retained as-is. The regressions appeared only after this branch merged that design with the fork's existing route-dependent home/conversation overlays and native-menu styling.

• Publishes the live sidebar width through ResizeObserver, including fractional widths and sidebar resize/collapse/rebuild changes, so the fork's additional menu treatment follows the upstream left block precisely.
• Corrects the branch integration that accidentally extended the conversation/main overlay onto the new-task/home page; the home main surface is transparent again while the upstream left block remains intact.
• Applies the fork's right-side top-menu continuation only on conversation routes, where it matches the fork's main-surface readability gradient.
• Removes the bright seam, and the subsequent double-opacity dark seam introduced while correcting it, between the merged left-block treatment and the fork's route-dependent right-side overlay.

Theme ZIP import and one-click apply compatibility

• Accepts Chromium's normalized one-click URI form dreamskin://apply/?version=ver_... in addition to the canonical dreamskin://apply?version=ver_... form.
• Keeps the URI parser fail closed: extra path segments, a second slash, extra query parameters, fragments, ports, credentials, arbitrary URLs, paths, and commands are still rejected.
• Fixes Safe CSS validation for the registered Studio form backdrop-filter: blur(var(--ds-theme-surface-blur)).
• Keeps the Safe CSS boundary strict: unknown variables, fallbacks, extra filter functions, malformed values, and out-of-range literal blur values remain rejected.
• Updates renderer verification so intentionally hidden suggestion layers in the clean-home mode are valid, while malformed visible-card layouts still fail verification.
• Fixes a post-download Windows failure for current Studio themes that use the colors contract and omit the legacy optional palette field. apply-community-theme.ps1 runs under PowerShell strict mode; direct reads of missing optional id, appearance, art, or palette properties previously raised PropertyNotFoundStrict after the ZIP had passed validation, so the transaction cleaned the download and never committed an active theme.
• Active-theme writing and runtime-content fingerprint normalization now inspect property existence before adding the existing compatibility defaults. Present values are preserved, and the ZIP, manifest, archive identity, image, Safe CSS, active baseline, transaction lock, visible verification, and rollback gates are unchanged.
• Fixes the second one-click operation being rejected as Another one-click theme apply is already running after the first theme had already applied successfully. Start-Process -Wait follows the whole Windows descendant process tree, including the intentionally persistent Node injector watcher, so the protocol process never reached lock cleanup. The handler now performs a bounded wait on only the direct start/verify child and exits as soon as visible verification succeeds.
• Removes the redundant success acknowledgement dialog after a verified apply. Errors and recovery results still use native messages, while successful protocol invocations now close automatically.

This does not weaken the theme ZIP contract. Imported ZIPs still require the normal non-empty theme.json, non-empty theme.css, referenced background image, manifest/hash checks where applicable, image bounds, archive safety checks, and Safe CSS validation. Local test packages and generated background assets are not included in this PR.

Windows automation and tray switches / Windows 自动化与托盘切换

Menu background

The tray now exposes 菜单背景:

• 左侧连续背景 (default): only the sidebar and matching left menu segment use the continuous background block.
• 整条菜单栏背景: the full application menu receives the menu background.

The selection is stored as the bounded local chrome-mode preference. It is included in the payload identity, source stamp, strong watcher comparison, and renderer root attributes, so a running background watcher reinjects the style immediately without restarting Codex or rerunning the full skin startup flow.

Home style

The tray now exposes 首页样式:

• 简洁首页: hides the native headline and both suggestion-card layers while preserving the real composer and controls.
• 标题与建议卡 (upgrade default): restores the generated theme title/subtitle and the two-layer glass suggestion-card presentation.

The selection is stored independently as home-mode; it does not modify the active theme ZIP, saved themes, or last-known-good state. Like chrome-mode, it participates in watcher change detection and payload identity, allowing a hot switch in the existing verified renderer session.

Windows startup repair / Windows 启动修复

• Replaces persisted Sysnative launch targets with the real System32 PowerShell path; Sysnative is a process-only alias and is unavailable to 64-bit Explorer/startup shortcuts.
• Adds login-dream-skin.ps1 as the explicit login orchestrator: start the tray if needed, honor persistent pause state, then start and verify a real skin-enabled Codex session.
• Splits the Start-menu entries into the real skin launcher and a separate tray-only launcher.
• Changes the tray option wording to 登录时启动皮肤和 Codex so the behavior is explicit.
• Preserves the existing restart-consent boundary: an already-running ordinary non-CDP Codex session is not silently terminated.

Repository hygiene / 仓库脱敏

• Adds tools/check-secrets.mjs to CI to scan tracked and otherwise committable text files for common credentials, private keys, provider tokens, and webhook forms without printing secret values.
• Expands .gitignore for real .env files, signing material, credential JSON, local Codex data, release tool caches, smoke fixtures, generated images, and installer artifacts while allowing explicit .env.example templates.
• Local credentials, generated wallpapers, temporary repair files, build tool caches, and local Setup executables are not part of the branch.

Type / 类型

• Bug fix / 缺陷修复
• Feature / 新功能
• Docs / 文档
• Theme / CSS / visual / 主题或视觉
• Scripts / install / restore / 脚本或安装恢复
• Chore / 杂项

Platform / 平台

• Both / 双平台

The canonical renderer, selectors and Safe CSS validator are synchronized to both platforms. The new native tray/startup controls are Windows-only; macOS retains the v1.5.9/classic home presentation by default and does not gain a new menu item in this PR.

Self-check / 自测

Shared/runtime

• Shared runtime synchronization checks passed for Windows and macOS assets.
• Renderer, selector, payload construction, route refresh, visible-card, sidebar geometry, and Safe CSS Node regressions passed.
• git diff --check and relevant Node/PowerShell syntax checks passed.

Windows

• Complete Windows PowerShell regression suite passed, including installer contracts, login startup, tray preference persistence, watcher payload identity, one-click URI parsing, ZIP/import paths, startup recovery, and renderer readiness.
• Added PowerShell strict-mode regressions for a current official colors-only package and for a minimal theme missing all four optional compatibility fields; import, active-theme roundtrip, and runtime fingerprint generation pass.
• Added a direct-child wait regression that starts a short-lived PowerShell child with a still-running descendant watcher. The helper returns after the direct child exits, proves the descendant remains alive, then cleans up the fixture; the protocol source check also rejects reintroducing Start-Process -Wait or a success acknowledgement dialog.
• Real Codex 26.721.4979 smoke tests passed for both home modes, both menu-background modes, watcher hot reload, home and conversation routes, composer visibility, and no horizontal overflow.
• A local unsigned CodexDreamSkin-Setup-v1.6.0.exe was rebuilt after the one-click repair and passed static/version/payload checks. The installer is a local validation artifact and is not committed to this PR.

macOS

• Portable shared Node tests and synchronized payload checks passed on the Windows host.
• Full macOS native/shell/Swift suite was not run locally because this work was validated on Windows; it remains a CI/macOS-host gate.

User-facing and security

• Updated both changelogs and all six bound version sources/assertions to 1.6.0.
• Does not modify official Codex/ChatGPT binaries, app.asar, WindowsApps ACLs, or signatures.
• Does not silently write API Base URLs or keys; CDP remains loopback-oriented.
• Current tracked/committable files and reachable branch history were scanned for recognized credential patterns.

Release note / 发布说明

This PR prepares the source/version state for v1.6.0, but the locally built Setup is not a GitHub Release asset. Merge, tag creation, CI completion, and publication remain separate upstream release facts; this PR should not be described as released until the upstream Release workflow publishes verified assets from the merged commit.