Epic: #159
Depends on: TP-F2 (metadata/checksum fields recommended), TP-23 (import), shipped in 0.4.2
Source: docs/planned-0.4.3.md, docs/market-tech.md
Goal
Allow installing a theme from a user-provided HTTPS URL into {appSupport}/themes/ with integrity checks and explicit consent — groundwork for marketplace downloadUrl + sha256Checksum.
Files
- new
lib/core/theme/theme_remote_install_service.dart (or extend theme_import_service.dart)
lib/features/settings/... (URL field + Install button)
- optional
lib/core/market/marketplace_client.dart interface stub
docs/theme-import.md
- tests with mocked HTTP
Implementation
- Preferences → Appearance → Install from URL… (or dialog from import section).
- Require HTTPS only; block private IP / localhost unless debug flag (document threat model).
- Download to temp file; verify optional
sha256 query param or manifest field when provided.
- Parse as
querya.theme.v1 or VS Code JSON/JSONC; on success copy into themes folder via existing import dedup logic.
- Show progress + clear errors (network, checksum mismatch, invalid JSON).
- User confirmation before download (show host + theme name if HEAD/metadata available).
Acceptance Criteria
- Valid public HTTPS theme URL installs and appears in picker after refresh/watcher.
- Checksum mismatch aborts install and deletes temp file.
- Invalid/non-theme content never lands in themes folder.
- HTTP (non-TLS) URLs rejected with actionable error.
- Works offline gracefully (network error message).
Tests
- Mock HTTP: success, 404, checksum fail, invalid JSON.
- Import dedup: same URL/content does not duplicate ids.
Security notes
- No silent background downloads.
- Document trust model in
theme-import.md; signature verification out of scope unless trivially added later.
Epic: #159
Depends on: TP-F2 (metadata/checksum fields recommended), TP-23 (import), shipped in 0.4.2
Source:
docs/planned-0.4.3.md,docs/market-tech.mdGoal
Allow installing a theme from a user-provided HTTPS URL into
{appSupport}/themes/with integrity checks and explicit consent — groundwork for marketplacedownloadUrl+sha256Checksum.Files
lib/core/theme/theme_remote_install_service.dart(or extendtheme_import_service.dart)lib/features/settings/...(URL field + Install button)lib/core/market/marketplace_client.dartinterface stubdocs/theme-import.mdImplementation
sha256query param or manifest field when provided.querya.theme.v1or VS Code JSON/JSONC; on success copy into themes folder via existing import dedup logic.Acceptance Criteria
Tests
Security notes
theme-import.md; signature verification out of scope unless trivially added later.