Theme Studio

[Gabsplat]

Source

paseo-theme-studio

Categories

• Daemon management
• Themes
• Providers
• Orchestration
• Git
• Workspaces
• Sidebar
• Extras
• Utils

[github-actions]

Thanks! The listing is in review: #165

[paseo-bot]

Needs from you: nothing, changes requested

@Gabsplat, Theme Studio passes every check except one: its listing has no image. The plugin adds a sidebar screen, workspace panels, and a theme, and REVIEW.md requires at least one image for a plugin with visible surfaces.

Change needed: add a media array to paseo-plugin.json and publish a new version, for example:

"media": ["images/studio.png", "images/packs.png", "images/design.png", "images/mobile.png", "images/component.png"]

Those files are already in the package, and relative paths resolve against the published version. HTTPS URLs to png, jpg, webp, gif, mp4, or webm files also work; SVG does not. The registry doesn't read paseo-listing.json, so the media listed there doesn't reach the listing. Then comment on #152 once it is published; a maintainer reruns the submission, which updates this pull request to the latest version.

Nothing else needs to change.

Review data

• Artifact: npm paseo-theme-studio 0.6.2, https://registry.npmjs.org/paseo-theme-studio/-/paseo-theme-studio-0.6.2.tgz. npm gitHead is d834ce7859a61e9c5ee36dbe3243fbf0cb9c1912, which is tag v0.6.2. No npm provenance; the repository Gabsplat/paseo-theme-studio belongs to the submitter.
• Integrity: SHA-512 of the tarball matches the record and npm's dist.integrity; version and tarball URL match npm.
• Validation: npm test passes (143/143). node scripts/validate.ts --online --changed passes.
• Extracted and inspected: all 70 files. Server and shared code read in full; client code read for imports, network, execution, globals, and clipboard. server/export-assets.ts is generated and embeds four files identical to client/pack-runtime.tsx, client/pack-transform.ts, shared/theme.ts, and shared/pack.ts.
• Install-time commands: none. paseo-plugin.json has no install or build. package.json has no preinstall, install, postinstall, or prepare; prepublishOnly (package.json:46) runs only when the author publishes.
• Dependencies: none declared, so nothing is installed with the plugin. It imports zod, react, react-native, @tanstack/react-query, and @getpaseo/plugin, all provided by Paseo. The repository's pnpm-lock.yaml carries integrity for every entry and no git or tarball sources; it isn't used at install because there is nothing to install.
• Hosts: loopback only. server/bridge.ts:73 listens on 127.0.0.1 on a random port behind a random bearer token compared in constant time (server/bridge.ts:89-95), and the generated MCP script talks only to that endpoint (server/bridge-source.ts:51). No fetch, sockets, or external URLs.
• Credentials and environment: reads PASEO_HOME (index.server.ts:28, server/project.ts:26), PASEO_BIN and PATH to find the paseo command (server/paseo-cli.ts:12-31), and PASEO_AGENT_ID (server/bridge-source.ts:15). Gives connected agents a random per-owner token, PASEO_THEME_STUDIO_OWNER_TOKEN (server/agent-integration.ts:38). No credential files, keychains, or other plugins' storage.
• Filesystem: writes under $PASEO_HOME/theme-studio/. Activating a code component writes client/generated/*.tsx into the plugin's own folder (server/components.ts:619-630), only after the user presses "I reviewed this code · Activate" (client/component-library.tsx:671) and only where TypeScript is installed (server/typecheck.ts:161). No user files read.
• Execution: execFile of paseo plugin ls --json to find its own folder (server/project.ts:30); paseo plugin reload theme-studio after a code activation (index.server.ts:218); tsc --noEmit in a development checkout (server/typecheck.ts:188). Agents run the fixed-template theme-mcp.cjs as an MCP server (server/bridge.ts:65). Agent-written components pass an AST filter (server/components.ts:127-223) and user review before they become plugin code, as the overview says. "Connect your agents" is off by default (server/agent-connection.ts:115). No eval, new Function, or dynamic import() of remote or computed paths.
• Runtime installs: none. Export shows a paseo plugin install command for the user to copy (server/export.ts:143) and runs nothing.
• Readability: plain TypeScript and TSX, no minification or obfuscation.
• Source match: all 70 tarball files are byte-identical to the repository at d834ce7. Files outside the package are tests, dev scripts, docs, and media.
• Listing media and visible surfaces: none. The record has no listing.media and paseo-plugin.json has no media. The plugin adds a sidebar screen, workspace panels, a settings screen, Command Center items, a /theme command, a header button, chat cards, and the "Theme Studio · Live" theme (index.client.tsx:53-240).
• Overview: OVERVIEW.md is at the package root and follows the shape, with no install steps, badges, or marketing. Its claims match the code: 60 palettes, Codex as the default designer agent, agents can't activate packs or unlock colors (server/store.ts:70-73), agent connection off by default, loopback-only network.
• Decision: changes requested, because the listing has no image.
• Reviewed commit: d955ff9c68de33d2e00618c966529debeb799b0c