feat(web): add Open VSX theme search

[t3-code]

What Changed

• puts community theme search at the top of Add a theme
• imports permissively licensed Open VSX color themes with integrity and resource checks
• groups extension variants into one card with arrows
• keeps paired light and dark palettes together and shows active assignments
• confirms updates and atomically replaces extension variants

Why

Makes community themes easy to discover without relying on VS Marketplace.

UI Changes

browser-recording-msp1jdsj.mp4

Demo includes searching, installing, applying a theme, switching light and dark modes, and cycling variants:

https://t3bot-production.up.railway.app/files/lqR9cC183_sMgLrhVy3uH7vE/open-vsx-theme-variants-demo.mp4

Validation

• pnpm --filter @t3tools/web typecheck
• targeted lint and formatting checks
• 47 focused tests
• real workflow verified and recorded

Built with GPT-5.4 via T3bot.

---

Note

Medium Risk
Downloads and extracts third-party VSIX packages client-side, which expands the attack surface even with checksum, license, size, and zip-safety checks. Also changes custom theme storage/removal semantics around collections.

Overview
Adds Open VSX community theme discovery so users can search, preview, and install open-source editor themes without manual JSON imports.

The import dialog now leads with ThemeSearchSection, which searches Open VSX, filters to supported SPDX licenses, and installs extensions via checksum-verified VSIX download. Import resolves JSONC includes, pairs light/dark variants, and stores them as a theme collection.

Theme library UI groups collection variants onto one card, with a radial light/dark picker for switching among variants and multi-select removal when deleting an extension pack. Theme save/update paths preserve collection metadata, and replaceCustomThemeCollection atomically swaps an extension’s variants (with optimistic concurrency against concurrent edits).

^{Reviewed by Cursor Bugbot for commit 0871e31. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add Open VSX theme search and install to the theme import dialog

• Adds searchOpenVsxThemes and importOpenVsxThemeExtension to query Open VSX, validate VSIX packages (checksum, ZIP safety, JSONC includes), and import theme variants with stable IDs.
• Adds a ThemeSearchSection UI embedded in the theme import dialog, supporting keyword search, sort options, and one-click install or update with an update confirmation prompt.
• Custom themes are now grouped into collections in ThemeSettings, rendered as a single card with a radial light/dark variant selector; removal supports selecting multiple variants at once.
• Introduces replaceCustomThemeCollection and removeCustomThemes in themePalette.ts for atomic collection replacement (with optimistic concurrency) and batch removal.
• Risk: new runtime dependencies (jszip, jsonc-parser, @noble/hashes) are added; VSIX fetch and ZIP parsing happen client-side with size caps and abort support but add latency to theme installs.

^{Macroscope summarized 0871e31.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+19 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.4 KiB	5.5 KiB	+7 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	+12 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.9 KiB	5.9 KiB	+9 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2db0845 · PR result: 0871e31 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.6 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR adds a significant new feature: Open VSX theme search and import. It introduces new external API integrations, security-relevant package verification logic, and new UI components/workflows that warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cd45fc0. Configure here.}