chore: remove CLI themes from dotfiles repo

.github/workflows/ci.yml

@@ -22,12 +22,6 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends zsh jq shellcheck
 
-      - name: Run OSS audit
-        shell: bash
-        env:
-          OSS_AUDIT_FORBIDDEN_REGEX: ${{ vars.OSS_AUDIT_FORBIDDEN_REGEX }}
-        run: scripts/oss-audit.sh
-
       - name: Validate shell syntax
         shell: bash
         run: |

.gitignore

@@ -1,6 +1,5 @@
 # Configuración local (paths, tokens, datos personales)
 local/env.zsh
-.oss-audit-denylist.local
 
 # macOS
 .DS_Store

CHANGELOG.md

@@ -5,7 +5,7 @@
 - Initial OSS-safe `cortex-dots` snapshot.
 - Generalized private paths and navigation defaults.
 - Removed custom font binary and private brand assets.
-- Added MIT license, security policy, third-party notices, release checklist, and OSS audit script.
+- Added MIT license, security policy, third-party notices, release checklist, and automated installer tests.
 
 ## 0.1.1 - 2026-07-04
 
@@ -17,11 +17,8 @@
 
 - `scripts/test-install.sh` — automated installer tests (copy, symlink, stale-opposite scenarios).
 - `scripts/check-agent-state.sh` — agent-state validator for release checklist.
-- `.oss-audit-denylist.local` — untracked personal denylist for OSS audit (one regex per line).
-- `OSS_AUDIT_FORBIDDEN_REGEX` CI variable support — configure repo-level denylist without committing.
+- Supply chain security rules — external tools must be pinned to specific versions, 15+ days old.
 
 ### Changed
 
-- OSS audit script — externalized forbidden identifiers to env var + local denylist; no longer hardcodes private terms.
-- CI — added installer integration tests step; passes `OSS_AUDIT_FORBIDDEN_REGEX` from repo vars.
-- `.gitignore` — added `.oss-audit-denylist.local`.
+- CI — added installer integration tests step.

CLAUDE.md

@@ -48,11 +48,9 @@ dotfiles/
 │   └── shaders/              # 4 cursor shaders (glsl)
 ├── herdr/config.toml         # Multiplexor → ~/.config/herdr/config.toml
 ├── claude/
-│   ├── statusline.sh         # Statusline para Claude Code
-│   └── themes/               # Temas Claude Code (cortex.json, cortex-green.json)
+│   └── statusline.sh         # Statusline para Claude Code
 ├── opencode/
-│   ├── tui.json              # TUI config → ~/.config/opencode/tui.json
-│   └── themes/               # Temas OpenCode
+│   └── tui.json              # TUI config → ~/.config/opencode/tui.json
 ├── lazygit/config.yml        # LazyGit → ~/.config/lazygit/config.yml
 ├── local/
 │   └── env.zsh.example       # Template para ~/.config/cortex-dots/local/env.zsh

CONTRIBUTING.md

@@ -28,9 +28,28 @@ All changes to `main` require maintainer review. This is especially important fo
 - Do not commit secrets, tokens, private keys, real emails, private hostnames, private IPs, customer names, or machine-specific paths.
 - Put local/private values in `~/.config/cortex-dots/local/env.zsh`.
 - Keep examples generic and placeholder-based.
-- Run `scripts/oss-audit.sh` before opening a PR.
 - Run the validation commands listed in `README.md` when touching scripts or config formats.
 
+## Supply Chain Security
+
+Any external tool, CLI, or dependency installed by `install.sh` or referenced in scripts must be pinned to a specific version. Do not use `latest`, `^ SemVer` ranges, or unpinned references in installation commands. Versions must be at least 15 days old before adoption — supply chain attacks typically target newly published releases.
+
+```bash
+# Good — pinned version, 15+ days old
+curl -fsSL https://starship.rs/install.sh | sh -s -- -b "$HOME/.local/bin" -y --commit abc123
+
+# Good — pinned package manager version
+npm install -g some-cli@2.4.1
+
+# Bad — no version pinning
+curl -fsSL https://example.com/install | bash
+
+# Bad — latest tag
+npm install -g some-cli@latest
+```
+
+For GitHub Actions in workflows, always use explicit commit SHAs (`@commit-sha`) or pinned minor versions (`@v4`). Avoid `${{ github.sha }}` or floating tags in production workflows.
+
 ## Pull Request Expectations
 
 Every PR should include:

README.md

@@ -118,29 +118,16 @@ Transparency depends on your Linux compositor/window manager. Shaders are
 opt-in in `ghostty/config`; uncomment one `custom-shader` line only after
 confirming your GPU/driver handles it well.
 
-## OSS Audit
-
-Run before publishing or packaging:
-
-```bash
-scripts/oss-audit.sh
-```
-
-The audit scans tracked files only and fails on configured private identifiers, private paths, and email-shaped strings.
-Set `OSS_AUDIT_FORBIDDEN_REGEX` or create an untracked `.oss-audit-denylist.local` file with one regex per line to add private denylist terms locally.
-For CI, configure the repository variable `OSS_AUDIT_FORBIDDEN_REGEX` with private denylist terms instead of committing them.
-
 ## Validation
 
 ```bash
-scripts/oss-audit.sh
 scripts/test-install.sh
 scripts/test-install.sh --symlink
 scripts/test-install.sh --seed-stale-opposite
 scripts/test-install.sh --symlink --seed-stale-opposite
 bash -n install.sh
 zsh -n zsh/zshrc
-for path in opencode/*.json opencode/**/*.json claude/themes/*.json; do jq . "$path" >/dev/null 2>&1 || echo "invalid: $path"; done
+for path in opencode/*.json; do jq . "$path" >/dev/null 2>&1 || echo "invalid: $path"; done
 python3 - <<'PY'
 import pathlib, tomllib
 for path in pathlib.Path('.').rglob('*.toml'):

docs/keymaps.md

@@ -47,7 +47,7 @@ This table favors the shortcuts used by these dotfiles and Herdr defaults. It is
 | OpenCode | `oc [path]` | Start OpenCode in the current or given directory. |
 | OpenCode | `ocb [path]` | Alias for `oc`, preserving default flags. |
 
-Claude Code and OpenCode keybindings are mostly app-native. This repo adds launch helpers, themes/statusline config, and Herdr integration so sessions survive terminal detach/reattach.
+Claude Code and OpenCode keybindings are mostly app-native. This repo adds launch helpers, statusline config, and Herdr integration so sessions survive terminal detach/reattach.
 
 ## Collision Notes
 

install.sh

@@ -253,9 +253,7 @@ PY
     check_install_target "$DOTFILES/ghostty/config" "$HOME/.config/ghostty/config"
     check_install_target "$DOTFILES/ghostty/shaders" "$HOME/.config/ghostty/shaders"
     check_install_target "$DOTFILES/opencode/tui.json" "$HOME/.config/opencode/tui.json"
-    check_install_target "$DOTFILES/opencode/themes" "$HOME/.config/opencode/themes"
     check_install_target "$DOTFILES/claude/statusline.sh" "$HOME/.claude/statusline.sh"
-    check_install_target "$DOTFILES/claude/themes" "$HOME/.claude/themes"
     check_install_target "$DOTFILES/lazygit/config.yml" "$HOME/.config/lazygit/config.yml"
 
     echo ""
@@ -266,7 +264,7 @@ PY
     for path in "$DOTFILES"/zsh/scripts/*.zsh; do
         check_shell "$path" zsh
     done
-    for path in "$DOTFILES"/opencode/*.json "$DOTFILES"/opencode/**/*.json "$DOTFILES"/claude/themes/*.json; do
+    for path in "$DOTFILES"/opencode/*.json; do
         check_json "$path"
     done
     check_toml "$DOTFILES/starship/starship.toml"
@@ -799,9 +797,7 @@ backup_if_exists "$HOME/.config/herdr/config.toml"
 backup_if_exists "$HOME/.config/ghostty/config"
 backup_if_exists "$HOME/.config/herdr/config.toml"
 backup_if_exists "$HOME/.config/opencode/tui.json"
-backup_if_exists "$HOME/.config/opencode/themes"
 backup_if_exists "$HOME/.claude/statusline.sh"
-backup_if_exists "$HOME/.claude/themes"
 backup_if_exists "$HOME/.config/lazygit/config.yml"
 
 # --- Instalar configs ---
@@ -880,10 +876,8 @@ install_target "$DOTFILES/herdr/config.toml"      "$HOME/.config/herdr/config.to
 install_target "$DOTFILES/ghostty/config"         "$HOME/.config/ghostty/config"
 install_target "$DOTFILES/ghostty/shaders"        "$HOME/.config/ghostty/shaders"
 install_target "$DOTFILES/opencode/tui.json"      "$HOME/.config/opencode/tui.json"
-install_target "$DOTFILES/opencode/themes"        "$HOME/.config/opencode/themes"
 install_target "$DOTFILES/claude/statusline.sh"   "$HOME/.claude/statusline.sh"
 run_or_plan "chmod +x $HOME/.claude/statusline.sh" chmod +x "$HOME/.claude/statusline.sh"
-install_target "$DOTFILES/claude/themes"          "$HOME/.claude/themes"
 install_target "$DOTFILES/lazygit/config.yml"     "$HOME/.config/lazygit/config.yml"
 
 if [[ "$GHOSTTY_DEFER_WORKER_NEEDED" == true ]]; then