Codex theme safety and compatibility
See how Codex Skin limits theme packages, verifies its Helper and the official Codex process, rolls back failures, and handles app updates.
Codex Skin is an independent third-party project, not an OpenAI product. It changes the supported Codex view in the ChatGPT desktop app through a narrow local transaction. It does not modify the official application package or claim control over Chat, Work, the web app, CLI, or IDE extensions.
This page explains the user-facing trust boundary. The architecture guide covers the component design in more detail.
Product boundary
The current Paid Alpha supports macOS and Windows. Each platform is checked independently; a result on one operating system is not used as proof for the other.
The skin owns only verified Home, conversation, and composer surfaces. Native Sites, Scheduled, Plugins, settings, and right-side utility surfaces keep the matching official light or dark palette. The Helper reclassifies the current route before it applies the fixed skin rules, so a native utility page is not treated as a chat surface simply because Codex reused a container.
Codex Skin never edits the Codex .app, app.asar, WindowsApps package, official code signature, or another system-protected installation path.
Components and trust
The user path has distinct parts:
| Part | Responsibility |
|---|---|
| Website | Catalog, sign-in, device approval, checkout, account, and theme delivery authorization |
| Plugin | Recognizes supported tasks, keeps the six-digit ID separate, calls fixed wrappers, and interprets structured results |
| Bootstrap | Selects the pinned release, verifies it, runs fixed self-tests, and activates an external Helper atomically |
| Helper | Performs one bounded local Apply, Switch, Status, or Restore transaction and exits |
| Theme package | Supplies declared structured data and local images for one published theme |
The public Plugin repository contains the installable Plugin, Skills, wrappers, Helper, Bootstrap, Restorer, allowlisted public contracts, tests, and release documents under the MIT License. Website source, customer data, private keys, Production configuration, commercial theme packages, source artwork, rights records, and unreleased assets remain private.
The separation matters: a theme package cannot redefine what the signed Helper is allowed to do.
Data-only themes
Published themes contain versioned, allowlisted structured fields and declared local PNG, JPEG, or WebP assets. Before staging, the engine checks the manifest, file list, paths, MIME types, size limits, package digest, and detached signature.
A theme package cannot provide:
- arbitrary CSS or JavaScript;
- Shell or PowerShell commands;
- its own selectors or adapter code;
- a remote execution URL;
- path traversal, symbolic links, or undeclared files.
The signed Helper contains the fixed implementation that applies the allowed data. Saying that themes are data-only does not mean that no local code runs; it means that catalog content cannot turn itself into executable code.
Helper supply chain
The Plugin pins a release-tagged Bootstrap launcher and its platform SHA-256. Bootstrap accepts the fixed public GitHub Releases source, verifies the signed descriptor, platform, file size, SHA-256, and Helper self-tests, then updates the external current pointer atomically.
The descriptor uses Ed25519 and binds the expected Helper binaries. A wrong signature, platform, size, hash, release profile, self-test, or activation result stops the candidate before it becomes current. The previous verified Helper and recovery engine remain available when activation fails.
Production Paid Alpha currently reports Plugin 0.1.0-paid-alpha, Helper .17, Bootstrap .16, and https://codexskin.ai. The release is a GitHub prerelease, not stable/latest.
Commercial Apple Developer ID/notarization and public Windows code signing are post-launch priorities for the Paid Alpha. Operating systems may therefore show Gatekeeper or SmartScreen prompts. Codex Skin does not ask users to remove security attributes, turn off Gatekeeper or Defender, or disguise a publisher.
Official Codex and loopback
A familiar process name or an open debug port is not enough. Before a theme operation, the Helper checks the official Codex application identity, the current process and profile, the loopback CDP listener, and the renderer structures and capabilities needed by the fixed adapter.
The controlled session connects only through loopback, such as 127.0.0.1. It does not expose a general network control endpoint. If the process identity, profile, listener, or required surface cannot be confirmed, the operation fails closed.
These checks do not rely on a single exact-version allowlist. A version that has not been seen before can proceed when identity, capability, and marker checks pass. A known version still stops when those checks fail.
Transaction and rollback
Apply and Switch use this transaction:
validate -> stage -> backup -> apply -> verify -> commitValidation and staging happen before renderer mutation. The first Apply stores the exact native system, light, or dark choice and related code-theme setting outside the Plugin cache. The Helper then applies only to the verified current window and commits only after the requested theme is visibly confirmed.
If package validation fails, the new content never reaches the renderer. If apply or final verification fails, the operation rolls back the skin and any native appearance change. When rollback cannot be confirmed, the Helper returns a stable failure and stops instead of reporting success or guessing at the current state.
Offline Restore is a separate recovery boundary. It remains outside the replaceable Plugin cache and does not depend on network, login, current access, Node, or a working Plugin cache.
Privacy
The product contract prohibits collecting or uploading prompts, conversations, code, project files, absolute local paths, tokens, cookies, or screenshots. Access Tokens remain memory-only. Refresh credentials use macOS Keychain or Windows Credential Manager rather than an ordinary state file.
Minimal service records can include the user, device, theme, version, time, result, and necessary byte count for delivery, support, or payment-bound access. Public issue reports should not contain account, payment, prompt, source-code, or local-path data. Use Contact for private account or order help.
Compatibility checks
Compatibility is evaluated in three places:
- Identity checks confirm that the operation targets the supported official Codex process and the same user profile.
- Capability and marker checks confirm that the current renderer has the surfaces required by the fixed adapter.
- Post-apply verification confirms the requested ID, marker, artwork, palette, route scope, and readable result in the current window.
A Codex update can change the internal interface without changing the ordinary product features. When the fixed contract is missing or ambiguous, new Apply and Switch operations stop safely. Codex Skin does not click localized text by guesswork or inject a partial theme to appear compatible.
The current package and recovery point remain local. Restore stays available even when a new Apply cannot prove compatibility.
Platforms and system prompts
The Paid Alpha product scope covers supported macOS systems and Windows x64. A platform can use a different execution path while keeping the same package, identity, transaction, verification, and Restore boundaries.
- macOS prefers the verified in-app Appearance contract for a trusted cross-mode change. It falls back to one confirmed controlled reload when that contract is unavailable before mutation.
- Windows uses one confirmed controlled reload for a cross-mode change.
Do not infer an in-app Windows path from the macOS result. Do not interpret an operating-system warning as permission to disable protection. Keep the warning and use the documented release source or report the block.
Updates and the session boundary
Apply, Switch, and Restore use a bounded one-shot Helper. After current-window verification, the Helper exits. There is no Guardian, controller, heartbeat, login item, tray app, daemon, or background auto-reapply promise in the Paid Alpha.
An ordinary Apply or Switch usually takes 20–60 seconds. During that active operation, keep the current Codex window untouched until an explicit result appears. Browser authorization or Pricing pages opened by the transaction remain usable.
Completely quitting Codex, restarting the computer, or a later renderer reload ends the visible guarantee. Ask Codex Skin to Apply again next time. A saved last-applied ID is historical local state, not proof that a new renderer is still themed.
If a Codex update blocks a new operation, check Troubleshooting or return to the saved official appearance with Restore.
Questions
Is Codex Skin an OpenAI product?
No. It is an independent third-party project for the supported Codex view in the ChatGPT desktop app.
Can a theme package run code?
The theme package cannot supply executable code, selectors, or remote commands. A fixed, signed Helper performs the bounded local transaction using the package's allowed data and images.
Does Codex Skin collect my conversations or code?
The product contract prohibits collecting or uploading prompts, conversations, code, project files, absolute paths, tokens, cookies, and screenshots.
Will every Codex version work?
No universal compatibility claim is made. Each new operation must pass identity, capability, marker, and final visible-result checks. When those checks cannot prove safety, the operation stops and Restore remains available.