Codex Theme
Create Theme
Local data · Transparent packages · Explicit CDP boundary

A theme should be inspectable before it is attractive.

The Builder keeps images in browser memory. Installation is a separate upstream process with more power and a different risk boundary.

01

Images stay local

Uploads use object URLs and Canvas. There is no wallpaper upload API, account, or database. Recipes and share links contain settings only.

02

ZIPs stay data-only

Generated packages contain a wallpaper, recipe, CSS tokens, README, and SHA256SUMS. They contain no scripts, executables, credentials, or hidden installer.

03

CDP remains powerful

Loopback blocks ordinary network access but does not authenticate other same-user local processes. Run only trusted software and Restore when done.

04

Compatibility needs evidence

Record platform, architecture, Codex version, upstream commit, checked date, real routes, and restore outcome. A thumbnail is not verification.

Supply-chain rules

  • Use the original repository and compare the current main branch with 26c6c410e0e0.
  • Read commands before running them. Stop on package mutation, signature bypass, credential access, or non-loopback debug exposure.
  • Verify SHA-256 values for transported files, while remembering that checksums prove identity—not benevolence.
  • Never redistribute character, celebrity, game, film, or brand artwork without rights.
Read the CDP guideVerify checksums