@harness-mix/cli 0.1.11 → 0.1.12

package/scripts/pets-test.cjs

@@ -2,9 +2,15 @@
 
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
+const http = require('node:http');
 const os = require('node:os');
 const path = require('node:path');
-const { createPetMarket, readAsarHeader } = require('../src/main/native/pets');
+const {
+  createPetMarket,
+  readAsarHeader,
+  isWebpBuffer,
+  validatePetMetadata,
+} = require('../src/main/native/pets');
 
 function buildSyntheticAsar(targetPath, petName, blobContent) {
   const tree = {
@@ -36,6 +42,16 @@ function buildSyntheticAsar(targetPath, petName, blobContent) {
   fs.writeFileSync(targetPath, asarBuf);
 }
 
+// 合法 WebP 容器头：RIFF + size + WEBP + VP8 块
+function webpPayload(label) {
+  return Buffer.concat([
+    Buffer.from('RIFF', 'latin1'),
+    Buffer.from([0x20, 0x00, 0x00, 0x00]),
+    Buffer.from('WEBPVP8 ', 'latin1'),
+    Buffer.from(`--${label}--`, 'latin1'),
+  ]);
+}
+
 (async () => {
   const testRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-mix-pets-test-'));
   const fakeAsarDir = path.join(testRoot, 'resources');
@@ -51,10 +67,61 @@ function buildSyntheticAsar(targetPath, petName, blobContent) {
   fs.mkdirSync(petsDir, { recursive: true });
 
   const env = {
-    CODEXHOST_STOCK_CODEX_PATH: fakeCodexBin,
+    HARNESSMIX_STOCK_CODEX_PATH: fakeCodexBin,
     HARNESS_MIX_PETS_DIR: petsDir,
   };
 
+  // 本地 HTTP 服务器模拟社区下载源，覆盖 成功/500/坏签名/超大/截断/慢响应 场景
+  const server = http.createServer((req, res) => {
+    const url = new URL(req.url, 'http://127.0.0.1');
+    if (url.pathname === '/ok.webp') {
+      const body = webpPayload('community');
+      res.writeHead(200, { 'content-type': 'image/webp', 'content-length': body.length });
+      res.end(body);
+      return;
+    }
+    if (url.pathname === '/bad-sig.webp') {
+      const body = Buffer.from('NOT-A-REAL-WEBP-PAYLOAD', 'latin1');
+      res.writeHead(200, { 'content-type': 'image/webp', 'content-length': body.length });
+      res.end(body);
+      return;
+    }
+    if (url.pathname === '/huge.webp') {
+      // 声明 64MB，应在读取 body 前被 content-length 预检拦截
+      res.writeHead(200, { 'content-type': 'image/webp', 'content-length': 64 * 1024 * 1024 });
+      res.end(webpPayload('huge'));
+      return;
+    }
+    if (url.pathname === '/truncated.webp') {
+      // 声明长度大于实际发送：客户端应下载失败
+      res.writeHead(200, { 'content-type': 'image/webp', 'content-length': 1000 });
+      try {
+        res.end(Buffer.from('RIFF....WEBP', 'latin1'));
+      } catch {
+        res.destroy();
+      }
+      return;
+    }
+    if (url.pathname === '/slow.webp') {
+      setTimeout(() => {
+        const body = webpPayload('slow');
+        res.writeHead(200, { 'content-type': 'image/webp', 'content-length': body.length });
+        res.end(body);
+      }, 300);
+      return;
+    }
+    res.writeHead(500);
+    res.end('boom');
+  });
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', resolve);
+  });
+  const baseUrl = `http://127.0.0.1:${server.address().port}`;
+
+  const leftoverArtifacts = () =>
+    fs.readdirSync(petsDir).filter(name => name.startsWith('.tmp-') || name.startsWith('.bak-'));
+
   try {
     // 1. Verify readAsarHeader
     const asarInfo = readAsarHeader(fakeAsarPath);
@@ -90,7 +157,7 @@ function buildSyntheticAsar(targetPath, petName, blobContent) {
     assert.throws(() => market.preview({ id: '../bad-pet' }), /Invalid pet id/);
     assert.throws(() => market.preview({ id: 'non-existent-pet' }), /Unknown pet/);
 
-    // 4. Test install() of official pet
+    // 4. Test install() of official pet（原子流程：临时目录 -> 校验 -> 切换）
     const installRes = await market.install({ id: 'synthetic-buddy' });
     assert.equal(installRes.id, 'synthetic-buddy');
     assert.equal(installRes.installed, true);
@@ -102,6 +169,7 @@ function buildSyntheticAsar(targetPath, petName, blobContent) {
     const petSpritePath = path.join(installedDir, 'spritesheet.webp');
     assert.ok(fs.existsSync(petJsonPath), 'pet.json exists');
     assert.ok(fs.existsSync(petSpritePath), 'spritesheet.webp exists');
+    assert.deepEqual(leftoverArtifacts(), [], 'no staging/backup dirs left after official install');
 
     const meta = JSON.parse(fs.readFileSync(petJsonPath, 'utf8'));
     assert.equal(meta.id, 'synthetic-buddy');
@@ -139,8 +207,160 @@ function buildSyntheticAsar(targetPath, petName, blobContent) {
     const uninstalledEntry = catalogAfterUninstall.data.find(p => p.id === 'synthetic-buddy');
     assert.equal(uninstalledEntry.installed, false);
 
+    // 7. 社区下载安装成功路径（本地 HTTP 源），安装后无临时/备份目录残留
+    const communityInstall = await market.install({
+      id: 'community-pet',
+      displayName: 'Community Pet',
+      spritesheetUrl: `${baseUrl}/ok.webp`,
+    });
+    assert.equal(communityInstall.installed, true);
+    assert.equal(communityInstall.alreadyInstalled, false);
+    const communityDir = path.join(petsDir, 'community-pet');
+    assert.ok(fs.existsSync(path.join(communityDir, 'pet.json')));
+    assert.ok(fs.existsSync(path.join(communityDir, 'spritesheet.webp')));
+    const communityMeta = JSON.parse(fs.readFileSync(path.join(communityDir, 'pet.json'), 'utf8'));
+    assert.equal(communityMeta.displayName, 'Community Pet');
+    assert.equal(communityMeta.spriteVersionNumber, 1);
+    assert.deepEqual(leftoverArtifacts(), [], 'no staging/backup dirs left after community install');
+
+    // 8. 下载失败（HTTP 500）：拒绝安装且不留下任何目录
+    await assert.rejects(
+      market.install({ id: 'dl-fail-pet', spritesheetUrl: `${baseUrl}/missing.webp` }),
+      /Download failed \(500\)/,
+    );
+    assert.ok(!fs.existsSync(path.join(petsDir, 'dl-fail-pet')), 'failed install must not leave a pet dir');
+    assert.deepEqual(leftoverArtifacts(), [], 'download failure must not leave staging dirs');
+
+    // 9. 校验失败：坏 WebP 签名
+    await assert.rejects(
+      market.install({ id: 'bad-sig-pet', spritesheetUrl: `${baseUrl}/bad-sig.webp` }),
+      /RIFF\/WEBP signature/,
+    );
+    assert.ok(!fs.existsSync(path.join(petsDir, 'bad-sig-pet')));
+    assert.deepEqual(leftoverArtifacts(), [], 'signature failure must not leave staging dirs');
+
+    // 10. 校验失败：content-length 超过大小上限（预检拦截）
+    await assert.rejects(
+      market.install({ id: 'huge-pet', spritesheetUrl: `${baseUrl}/huge.webp` }),
+      /too large/,
+    );
+    assert.ok(!fs.existsSync(path.join(petsDir, 'huge-pet')));
+    assert.deepEqual(leftoverArtifacts(), []);
+
+    // 11. 下载截断（声明长度与实际不符）：拒绝安装且清理
+    await assert.rejects(
+      market.install({ id: 'truncated-pet', spritesheetUrl: `${baseUrl}/truncated.webp` }),
+    );
+    assert.ok(!fs.existsSync(path.join(petsDir, 'truncated-pet')));
+    assert.deepEqual(leftoverArtifacts(), []);
+
+    // 12. pet.json 必填字段校验：displayName 非法时在下载前拒绝，不创建目录
+    await assert.rejects(
+      market.install({ id: 'meta-bad-pet', displayName: 123, spritesheetUrl: `${baseUrl}/ok.webp` }),
+      /displayName/,
+    );
+    assert.ok(!fs.existsSync(path.join(petsDir, 'meta-bad-pet')));
+    assert.deepEqual(leftoverArtifacts(), []);
+
+    // 13. 路径安全：目录穿越 / 斜杠注入 / 大写 id 一律拒绝
+    await assert.rejects(market.install({ id: '../escape' }), /Invalid pet id/);
+    await assert.rejects(market.install({ id: 'a/b' }), /Invalid pet id/);
+    await assert.rejects(market.install({ id: 'a\\b' }), /Invalid pet id/);
+    await assert.rejects(market.install({ id: 'UPPERCASE' }), /Invalid pet id/);
+    assert.throws(() => market.uninstall({ id: '..\\evil' }), /Invalid pet id/);
+    assert.throws(() => market.uninstall({ id: '../evil' }), /Invalid pet id/);
+    assert.deepEqual(leftoverArtifacts(), []);
+    assert.ok(!fs.existsSync(path.join(testRoot, 'escape')), 'nothing written outside pets root');
+
+    // 14. 并发防护：同一 pet 安装进行中，第二个安装与卸载都被拒绝
+    const slowInstall = market.install({ id: 'conc-pet', spritesheetUrl: `${baseUrl}/slow.webp` });
+    await assert.rejects(
+      market.install({ id: 'conc-pet', spritesheetUrl: `${baseUrl}/slow.webp` }),
+      /in progress/,
+    );
+    assert.throws(() => market.uninstall({ id: 'conc-pet' }), /in progress/);
+    const slowResult = await slowInstall;
+    assert.equal(slowResult.installed, true);
+    assert.deepEqual(leftoverArtifacts(), []);
+    // 操作释放后可以正常卸载
+    const concUninstall = market.uninstall({ id: 'conc-pet' });
+    assert.equal(concUninstall.removed, true);
+
+    // 15. 修复损坏目录：已有目录缺少精灵图时，走 备份->切换 流程完成安装且不残留 .bak
+    const brokenDir = path.join(petsDir, 'broken-pet');
+    fs.mkdirSync(brokenDir, { recursive: true });
+    fs.writeFileSync(path.join(brokenDir, 'pet.json'), '{"id":"broken-pet"}');
+    const fixRes = await market.install({
+      id: 'broken-pet',
+      displayName: 'Broken Pet',
+      spritesheetUrl: `${baseUrl}/ok.webp`,
+    });
+    assert.equal(fixRes.alreadyInstalled, false);
+    assert.ok(fs.existsSync(path.join(brokenDir, 'spritesheet.webp')), 'spritesheet repaired');
+    const fixedMeta = JSON.parse(fs.readFileSync(path.join(brokenDir, 'pet.json'), 'utf8'));
+    assert.equal(fixedMeta.displayName, 'Broken Pet');
+    assert.deepEqual(leftoverArtifacts(), [], 'swap with existing dir must not leave backup dirs');
+
+    // 16. 已安装列表不容忍损坏目录：pet.json 无法解析或缺少精灵图的目录不出现
+    const badJsonDir = path.join(petsDir, 'bad-json-pet');
+    fs.mkdirSync(badJsonDir);
+    fs.writeFileSync(path.join(badJsonDir, 'pet.json'), '{not json');
+    fs.writeFileSync(path.join(badJsonDir, 'spritesheet.webp'), webpPayload('x'));
+    const noSheetDir = path.join(petsDir, 'no-sheet-pet');
+    fs.mkdirSync(noSheetDir);
+    fs.writeFileSync(path.join(noSheetDir, 'pet.json'), JSON.stringify({ id: 'no-sheet-pet' }));
+    const robustCatalogIds = market.catalog().data.map(p => p.id);
+    assert.ok(!robustCatalogIds.includes('bad-json-pet'), 'unparseable pet.json excluded');
+    assert.ok(!robustCatalogIds.includes('no-sheet-pet'), 'missing spritesheet excluded');
+    assert.ok(robustCatalogIds.includes('community-pet'), 'healthy install still listed');
+    assert.ok(robustCatalogIds.includes('broken-pet'), 'repaired install now listed');
+
+    // 17. 崩溃残留清扫：超过年龄的 .tmp-* / .bak-* 在下一次安装/卸载时被清理
+    const staleTmp = path.join(petsDir, '.tmp-stale-pet-0-0-aaaaaa');
+    const staleBak = path.join(petsDir, '.bak-stale-pet-0-0-bbbbbb');
+    fs.mkdirSync(staleTmp);
+    fs.mkdirSync(staleBak);
+    const oldTime = new Date(Date.now() - 60 * 60 * 1000);
+    fs.utimesSync(staleTmp, oldTime, oldTime);
+    fs.utimesSync(staleBak, oldTime, oldTime);
+    market.uninstall({ id: 'no-such-pet' });
+    assert.ok(!fs.existsSync(staleTmp), 'stale .tmp dir swept');
+    assert.ok(!fs.existsSync(staleBak), 'stale .bak dir swept');
+
+    // 18. 校验辅助函数单元测试
+    assert.equal(isWebpBuffer(webpPayload('t')), true);
+    assert.equal(isWebpBuffer(Buffer.from('RIFF....WEBP', 'latin1')), true);
+    assert.equal(isWebpBuffer(Buffer.from('RIFF....AVIF', 'latin1')), false);
+    assert.equal(isWebpBuffer(Buffer.from('WEBP....RIFF', 'latin1')), false);
+    assert.equal(isWebpBuffer(Buffer.from('RIFF', 'latin1')), false);
+    assert.equal(isWebpBuffer(Buffer.alloc(0)), false);
+
+    assert.throws(() => validatePetMetadata(null, 'x'), /must be an object/);
+    assert.throws(
+      () => validatePetMetadata({ id: 'y', displayName: 'A', spriteVersionNumber: 1, spritesheetPath: 'spritesheet.webp' }, 'x'),
+      /id mismatch/,
+    );
+    assert.throws(
+      () => validatePetMetadata({ id: 'x', displayName: '  ', spriteVersionNumber: 1, spritesheetPath: 'spritesheet.webp' }, 'x'),
+      /displayName/,
+    );
+    assert.throws(
+      () => validatePetMetadata({ id: 'x', displayName: 'A', spriteVersionNumber: 0, spritesheetPath: 'spritesheet.webp' }, 'x'),
+      /spriteVersionNumber/,
+    );
+    assert.throws(
+      () => validatePetMetadata({ id: 'x', displayName: 'A', spriteVersionNumber: 1, spritesheetPath: '../evil.webp' }, 'x'),
+      /spritesheetPath/,
+    );
+    assert.equal(
+      validatePetMetadata({ id: 'x', displayName: 'A', spriteVersionNumber: 2, spritesheetPath: 'spritesheet.webp' }, 'x').id,
+      'x',
+    );
+
     console.log('Pets market native tests passed successfully!');
   } finally {
+    try { server.closeAllConnections(); } catch { /* Node < 18.2 无此 API */ }
+    server.close();
     fs.rmSync(testRoot, { recursive: true, force: true });
   }
 })();

package/scripts/platform-test.cjs

@@ -10,12 +10,12 @@ const { evaluateDesktopCompatibility, enforceDesktopCompatibility } = require('.
 
 async function main() {
   const home = path.resolve(os.tmpdir(), 'hm-home');
-  assert.equal(dataDirectory({}, 'darwin', home), path.join(home, 'Library/Application Support/harness-mix/codexhost'));
-  assert.equal(dataDirectory({}, 'linux', home), path.join(home, '.local/share/harness-mix/codexhost'));
-  assert.equal(dataDirectory({ XDG_DATA_HOME: home }, 'linux', '/ignored'), path.join(home, 'harness-mix/codexhost'));
+  assert.equal(dataDirectory({}, 'darwin', home), path.join(home, 'Library/Application Support/harnessmix'));
+  assert.equal(dataDirectory({}, 'linux', home), path.join(home, '.local/share/harnessmix'));
+  assert.equal(dataDirectory({ XDG_DATA_HOME: home }, 'linux', '/ignored'), path.join(home, 'harnessmix'));
   assert.equal(dataDirectory({ XDG_DATA_HOME: 'relative' }, 'linux', home), dataDirectory({}, 'linux', home));
-  assert.equal(dataDirectory({ CODEXHOST_DATA_DIR: home }, 'darwin'), home);
-  assert.equal(dataDirectory({ APPDATA: home }, 'win32'), path.join(home, 'harness-mix/codexhost'));
+  assert.equal(dataDirectory({ HARNESSMIX_DATA_DIR: home }, 'darwin'), home);
+  assert.equal(dataDirectory({ APPDATA: home }, 'win32'), path.join(home, 'harnessmix'));
   for (const platform of ['win32', 'darwin', 'linux']) {
     assert.equal(path.basename(nativePaths(platform).shim), executableName('harness-mix-shim', platform));
     assert.equal('activation' in nativePaths(platform), platform === 'win32');
@@ -24,7 +24,7 @@ async function main() {
     assert.throws(() => enforceDesktopCompatibility(result, { HARNESS_MIX_STRICT_COMPATIBILITY: '1' }));
   }
   assert.equal(evaluateDesktopCompatibility('1.2.3', undefined, 'darwin').state, 'unverified');
-  const env = { HARNESS_MIX_DESKTOP_EXECUTABLE: process.execPath, CODEXHOST_STOCK_CODEX_PATH: process.execPath };
+  const env = { HARNESS_MIX_DESKTOP_EXECUTABLE: process.execPath, HARNESSMIX_STOCK_CODEX_PATH: process.execPath };
   assert.equal(inspectPosix(env, 'linux').version, 'unknown');
   assert.equal(inspectPosix({ ...env, HARNESS_MIX_DESKTOP_VERSION: '1.2.3' }, 'linux').stock, fs.realpathSync(process.execPath));
   assert.throws(() => inspectPosix({}, 'linux'), /Install Codex Desktop/);

package/scripts/publish-native-package.cjs

@@ -24,7 +24,7 @@ if (!sourceOnly) {
 }
 fs.writeFileSync(path.join(pkg, 'package.json'), JSON.stringify({
   name: `@harness-mix/native-${key}`, version, description: `Harness Mix native runtime for ${key}${sourceOnly ? ' (source-only; build locally)' : ''}`,
-  license: 'Apache-2.0', os: [platform], cpu: [arch], files: ['bin'], publishConfig: { access: 'public' },
+  license: '(Apache-2.0 OR MIT)', os: [platform], cpu: [arch], files: ['bin'], publishConfig: { access: 'public' },
 }, null, 2) + '\n');
 fs.writeFileSync(path.join(pkg, 'README.md'), `# @harness-mix/native-${key}\n\nNative runtime selected automatically by @harness-mix/cli.\n`);
 const publish = flags.includes('--publish');

package/scripts/test-live-mentions.cjs

@@ -43,14 +43,14 @@ async function main() {
   console.log('Waiting for probe to mount...');
   await evaluate(`(async () => {
     for (let i = 0; i < 50; i++) {
-      if (window.__codexhostRendererBindingProbeV1 && document.querySelector('.ProseMirror')) break;
+      if (window.__harnessmixRendererBindingProbeV1 && document.querySelector('.ProseMirror')) break;
       await new Promise(r => setTimeout(r, 100));
     }
   })()`);
 
   const directClientTest = await evaluate(`(async () => {
     try {
-      const probe = window.__codexhostRendererBindingProbeV1;
+      const probe = window.__harnessmixRendererBindingProbeV1;
       return {
         hasProbe: !!probe,
         probeKeys: probe ? Object.keys(probe) : []

package/scripts/workspace-test.cjs

@@ -54,7 +54,9 @@ const { HostRuntime } = require('../src/main/host/runtime');
   rt.subscribe(e => { if (e.type === 'turn/diff/updated') updates.push(e); });
   await rt.store.load();
   rt.adapters.set('test', {
-    manifest: { id: 'test', name: 'Test', capabilities: {} },
+    // Even a Harness that advertises nativePatch may omit a native file event.
+    // Host final Diff must still close the gap from its authoritative snapshot.
+    manifest: { id: 'test', name: 'Test', capabilities: { nativeDiff: true, nativePatch: true } },
     open: async () => ({}), close: async () => {},
     send: async (_session, _text, { emit }) => {
       emit({ kind: 'text-delta', text: 'progress' });
@@ -73,7 +75,7 @@ const { HostRuntime } = require('../src/main/host/runtime');
   assert.equal(t.status, 'ready');
   const answer = t.messages.at(-1);
   assert.deepEqual(answer.coreItems.filter(i => ['agent_message', 'tool_call'].includes(i.type)).map(i => i.type), ['agent_message', 'tool_call', 'agent_message']);
-  assert.equal(answer.review.files.length, 1);
+  assert.equal(answer.review.files.length, 1, 'Host final Diff supplements a missing native patch');
   assert.equal(answer.review.files[0].path, 'dirty.js');
   assert.ok(updates.some(e => e.turnId === answer.id && e.review?.live && e.review.files.some(f => f.path === 'dirty.js')), 'Runtime pushes live diff without Renderer polling');
   assert.ok(updates.some(e => e.turnId === answer.id && e.review?.live === false), 'Runtime pushes final diff');

package/src/assets/icons/PROVENANCE.md

@@ -0,0 +1,92 @@
+# Icon provenance
+
+33 brand marks are bundled in this directory and read by `src/main/native/icons.js`.
+They exist so the UI can label the harnesses and models this project integrates with.
+Every mark remains a trademark of its owner; see the trademark note at the end.
+
+## Redistributed from lobehub/lobe-icons — 24 of 33 (MIT)
+
+`@lobehub/icons-static-svg` v1.95.0, `Copyright (c) 2023 LobeHub`.
+Source: https://github.com/lobehub/lobe-icons
+License text: `licenses/lobe-icons-MIT.txt`
+
+Fifteen files are byte-identical to the upstream package:
+
+| local | upstream |
+| --- | --- |
+| `claude-color.svg` | `claude-color.svg` |
+| `cline-color.svg` | `cline.svg` |
+| `cursor-cli-color.svg` | `cursor.svg` |
+| `deepseek-color.svg` | `deepseek-color.svg` |
+| `grok-color.svg` | `grok.svg` |
+| `model-claude.svg` | `claude.svg` |
+| `model-deepseek.svg` | `deepseek.svg` |
+| `model-kimi.svg` | `kimi.svg` |
+| `model-minimax.svg` | `minimax.svg` |
+| `model-openai.svg` | `openai.svg` |
+| `model-qwen-color.svg` | `qwen-color.svg` |
+| `model-xiaomimimo.svg` | `xiaomimimo.svg` |
+| `openclaw-color.svg` | `openclaw-color.svg` |
+| `opencode-color.svg` | `opencode.svg` |
+| `pi.svg` | `pi.svg` |
+
+Nine more carry the same artwork (identical `path` data) behind a slightly different
+export wrapper, so they come from the same set:
+
+| local | upstream |
+| --- | --- |
+| `antigravity-color.svg` | `antigravity-color.svg` |
+| `cursor.svg` | `cursor.svg` |
+| `model-gemini.svg` | `gemini.svg` |
+| `model-grok.svg` | `grok.svg` |
+| `model-zai.svg` | `zai.svg` |
+| `qoder-color.svg` | `qoder-color.svg` |
+| `trae-color.svg` | `trae-color.svg` |
+| `workbuddy-color.svg` | `yuanbao-color.svg` |
+| `zcode-color.svg` | `zai.svg` |
+
+Note that two local file names do not match the mark they contain: `workbuddy-color.svg`
+is the upstream *Yuanbao* mark, and `zcode-color.svg` is the upstream *Z.ai* mark.
+The upstream `<title>` element in those files still carries the original names.
+
+## Bundled from product brand marks — 8 of 33
+
+| local | known origin |
+| --- | --- |
+| `kiro-cli-color.svg` | Official Kiro icon, `https://kiro.dev/icon.svg`. Byte-identical to `src/native-ui/renderer-extension/src/assets/kiro-agent.svg`, whose provenance is recorded in that directory's `README.md`. |
+| `codex-color.svg`, `codex-harness.svg` | The Codex mark. Both names hold the same bytes and both are referenced (`adapters/codex.js` uses `codex-color.svg`, `native/icons.js` and `README.md` use `codex-harness.svg`). |
+| `codebuddy-color.svg` | CodeBuddy harness mark. Source record not kept. |
+| `hermes-color.svg` | Hermes harness mark. Source record not kept. |
+| `omp-color.svg` | Oh My Pi harness mark whose source record was not kept. It is **not** the official mark: `omp-agent.svg` in the renderer assets has identical path data to the official Oh My Pi favicon (`packages/collab-web/public/favicon.svg`), while this file is a different, simpler shape. |
+| `model-astra.svg` | Drawn in this repository (gradient disc), not third-party artwork. |
+| `model-hunyuan.svg` | Drawn in this repository (rounded plate with a glyph), not third-party artwork. |
+
+## Unknown provenance — 1 of 33
+
+`pinumber1_80899.svg` is a pi glyph exported by Adobe Illustrator 18.1.1; the file name
+matches the download naming of free icon sites. It is used as the Pi harness icon
+(`src/main/adapters/pi.js`). The exact source and its license could not be established,
+so it should be replaced with original artwork or have its source recorded.
+
+## Usage
+
+`src/main/native/icons.js` resolves icons through an explicit file list and nothing globs
+this directory, so three files are currently referenced by no code path:
+
+| file | why it is unused |
+| --- | --- |
+| `cursor-cli-color.svg` | Both the `cursor` and `cursor-cli` entries resolve to `cursor.svg`. |
+| `model-grok.svg` | The `grok` model family resolves to `grok-color.svg`. The other eleven model families all use `model-*.svg`, so this is the convention-consistent file — either it should be wired up or the duplicate dropped. |
+| `workbuddy-color.svg` | Every alias map resolves `workbuddy` to `codebuddy`, which uses `codebuddy-color.svg`. |
+
+`grok-color.svg` and `model-grok.svg` carry identical path data, so despite the names they
+are the same artwork under two file names.
+
+Everything in this directory is published: `package.json` lists `src` in `files`.
+
+## Trademarks
+
+These marks are the property of their respective owners and are bundled only to identify
+the harnesses and models this project integrates with. No trademark right, endorsement or
+affiliation is claimed. Copyright licenses covering a mark (such as the MIT license above)
+do not grant any trademark right.