feat: ship the Hermes Agent mark and give ChatGPT Desktop OpenAI's

[yujiezhang-ops]

Site half of MaimoryLab/BootAgent#133. Upstream shipped the app half in MaimoryLab/BootAgent#134.

Two of the four letter placeholders were avoidable. Two were not, and I did not force them.

Hermes Agent — now has a mark

lobe-icons publishes one under the same MIT licence the four existing marks come from, and licenses/lobehub-LICENSE already hashes identical to the copy upstream audited — so no new licence basis is introduced. Byte-identical to the app's copy (02d43c0a…).

It is also byte-identical to lobe-icons' nousresearch.svg but for the <title>. That is correct rather than a mix-up: Hermes Agent is Nous Research's product, so the company mark identifies it. Recorded in NOTICE so nobody reads the reuse as sloppiness later.

ChatGPT Desktop — was showing "C" for no reason

The desktop app has rendered OpenAI's mark for it all along, on the grounds that it is OpenAI's own application sharing Codex's configuration. The site fell back to a letter only because AgentMark.astro assumed the id and the filename matched.

The map is now keyed by file, so one file can serve two ids without a second copy on disk. This was the discrepancy I flagged in #133 — the gap there was site-only.

Aider, WorkBuddy — deliberately still letters

Neither has a mark in lobe-icons. Aider publishes no brand kit, has an open branding issue from 2024, and its Apache-2.0 code licence grants no trademark rights. WorkBuddy publishes no vector at all.

Copying either favicon would ship vendor artwork with no redistribution basis, which is what asset-rights.json exists to prevent. NOTICE and the component comment now state that reasoning, so the next reader does not mistake a decision for an oversight.

What the existing guards caught

Both allowlists in this repo did their job, which is worth noting since both are deliberately explicit rather than counted:

• src/lib/asset-rights.test.ts enforces bidirectional manifest consistency plus SHA-256. I confirmed it fails on a tampered digest before trusting it.
• The dark-scheme e2e test names every monochrome file so a coloured mark cannot join the set silently. It failed on this change and now lists codex.svg twice — a file shared by two rows appears once per row.

Verification

• pnpm test — 97 passed (8 files)
• pnpm run build — 45 pages, validate-build.mjs passed
• astro check — 0 errors, 0 warnings
• playwright test — 181 passed
• Built output confirmed: /agents/ references hermes.svg and codex.svg, and only Aider and WorkBuddy still render letters

🤖 Generated with Claude Code