Package data · local software · recovery
Is a .cctheme package safe? App, Adapter and restore boundaries
Understand declarative package validation, local CC Theme App import, verified Adapter application, exact-version checks and native restore.
Reviewed
Separate package data from application software
The theme archive contains a unified theme family and declared media. It must not contain executable scripts, raw CSS, HTML, SVG, remote media URLs, absolute paths or undeclared files.
The CC Theme App and its Adapters are software with a different trust boundary. Evaluate them from the official 0.2.2 Release, source, integrity evidence and exact compatibility record.
- Theme packages do not install the App
- No separate Codex or WorkBuddy installer model
- Do not bypass App validation
- Do not treat a GitHub theme Release as an App Release
Validate before applying
The supported design rejects path traversal, abnormal expansion, unknown media types and hash mismatches. The CC Theme App then combines theme family ID, Adapter ID and Adapter capability version at runtime.
- Compare package SHA-256
- Use mac-codex only for verified ChatGPT Desktop evidence
- Use mac-workbuddy only for verified WorkBuddy evidence
- Respect EVA's CodeX visual exception
Keep a native restore path
Client updates can invalidate Adapter assumptions. Pause application and return to the host's native appearance whenever a version is unknown.
- Record the exact client build
- Stop the active Adapter
- Restore native appearance
- Wait for a fresh compatibility record
Current system boundary
Current support is macOS 13.5+ on Apple Silicon. Intel Mac, Windows, Claude Code and Claude Desktop are unsupported. Local operation reduces some exposure but is not a claim of zero risk or independent security certification.
- One unified CC Theme App
- Nine versioned theme packages
- No arbitrary third-party injection claim
CC Theme safety questions
Can a .cctheme execute JavaScript?
No. Executable theme code is outside the declarative package contract.
Does SHA-256 prove the software is safe?
It proves integrity against a published checksum, not authorship, signing or absence of all defects.
Can I force an older Adapter after a client update?
That is not the supported safe path. Restore and wait for verification.
Will restore recover deleted chats?
No. It removes CC Theme appearance and connection state only.
Where do I get the CC Theme App?
Use Download CC Theme to get the immutable 0.2.0 Apple Silicon DMG from the official GitHub Release.