From ba9d9b356db18b0c33377c098daf54beb5c9f2a4 Mon Sep 17 00:00:00 2001
From: marks <markskram@protonmail.com>
Date: Fri, 23 Oct 2026 14:39:50 -0500
Subject: [PATCH] feat(agent): rebrand desktop display names to Maple Work

---
 apps/maple-agent/README.md                    |  5 +-
 .../app/assets/licenses/development.html      |  6 +-
 apps/maple-agent/app/macos/Info.plist         |  2 +-
 apps/maple-agent/app/src/hosted_oauth.rs      |  6 +-
 .../app/src/hosted_oauth_complete.html        |  2 +-
 .../maple-agent-updater/src/installer.rs      |  2 +-
 .../crates/maple-agent/src/acp/mod.rs         |  6 +-
 .../crates/maple-agent/src/acp/session.rs     |  2 +-
 .../crates/maple-agent/src/agent.rs           |  2 +-
 .../crates/maple-agent/src/agent/catalog.rs   |  4 +-
 apps/maple-agent/docs/desktop-builds.md       |  4 +-
 apps/maple-agent/docs/release-profiles.md     | 15 ++--
 apps/maple-agent/release-profiles.json        |  4 +-
 apps/maple-agent/release_profile.rs           |  2 +-
 .../scripts/generate-third-party-notices.py   |  4 +-
 apps/maple-agent/scripts/linux-install.py     |  4 +-
 apps/maple-agent/scripts/macos-debug-plist.py |  7 ++
 apps/maple-agent/scripts/macos-release-app.sh |  8 ++-
 apps/maple-agent/scripts/release-info.py      | 23 ++++--
 .../maple-agent/scripts/test_linux_install.py |  3 +
 .../scripts/test_linux_release_appimage.py    |  2 +-
 .../scripts/test_release_packaging.py         | 70 ++++++++++++++++++-
 apps/maple-agent/scripts/verify-release.sh    | 14 ++--
 23 files changed, 150 insertions(+), 47 deletions(-)

diff --git a/apps/maple-agent/README.md b/apps/maple-agent/README.md
index a1eb0bfa7..9f01c1a45 100644
--- a/apps/maple-agent/README.md
+++ b/apps/maple-agent/README.md
@@ -1,4 +1,4 @@
-# Maple Agent (GPUI prototype)
+# Maple Work (GPUI prototype)
 
 Maple’s desktop-v2 prototype lives in `apps/maple-agent/` in this monorepo.
 Its Cargo package is `maple-agent-app` and its executable is `maple-agent`. It rebuilds Maple Agent Mode in
@@ -331,7 +331,8 @@ identity, discovers and embeds any Swift compatibility libraries required by
 native dependencies, signs nested code before sealing the bundle, and prints
 the exact bundle path to launch. This requires a full Xcode toolchain but does
 not require a Developer ID or produce a release artifact. The default ad hoc
-bundle is named Maple Agent Debug with identifier
+bundle displays Maple Work Debug and keeps the filename `Maple Agent Debug.app`
+with identifier
 `cloud.opensecret.maple.agent.debug`, separate from both packaged profiles. Its
 identity changes when Maple is rebuilt, so macOS may require the development
 app's privacy grants again. Set `MAPLE_DEBUG_CODESIGN_IDENTITY` to the name or
diff --git a/apps/maple-agent/app/assets/licenses/development.html b/apps/maple-agent/app/assets/licenses/development.html
index 6787e34a7..8835b3b87 100644
--- a/apps/maple-agent/app/assets/licenses/development.html
+++ b/apps/maple-agent/app/assets/licenses/development.html
@@ -2,13 +2,13 @@
 <html lang="en">
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width">
-<title>Maple Agent third-party notices</title>
+<title>Maple Work third-party notices</title>
 <style>body{max-width:48rem;margin:2rem auto;padding:0 1rem;font:16px/1.5 system-ui}</style>
 <h1>Third-party notices</h1>
-<p>Maple Agent uses open-source software and data. Distributed packages include
+<p>Maple Work uses open-source software and data. Distributed packages include
 the license inventory for their platform alongside the application.</p>
 <ul>
-  <li><a href="https://github.com/MaplePrivacyLabs/Maple/tree/master/apps/maple-agent">Maple Agent source and dependency manifests</a></li>
+  <li><a href="https://github.com/MaplePrivacyLabs/Maple/tree/master/apps/maple-agent">Maple Work source and dependency manifests</a></li>
   <li><a href="https://github.com/MaplePrivacyLabs/Maple/blob/master/apps/maple-agent/app/assets/dict/LICENSE">SCOWL spelling dictionary acknowledgements</a></li>
   <li>Passphrase generation uses the unmodified EFF large wordlist, Electronic Frontier Foundation, 2016:
     <a href="https://www.eff.org/dice">wordlist</a>,
diff --git a/apps/maple-agent/app/macos/Info.plist b/apps/maple-agent/app/macos/Info.plist
index dc91df0af..5d1005256 100644
--- a/apps/maple-agent/app/macos/Info.plist
+++ b/apps/maple-agent/app/macos/Info.plist
@@ -13,7 +13,7 @@
     <key>CFBundleInfoDictionaryVersion</key>
     <string>6.0</string>
     <key>CFBundleName</key>
-    <string>Maple Agent Debug</string>
+    <string>Maple Work Debug</string>
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
diff --git a/apps/maple-agent/app/src/hosted_oauth.rs b/apps/maple-agent/app/src/hosted_oauth.rs
index 31b1691a0..409ecc712 100644
--- a/apps/maple-agent/app/src/hosted_oauth.rs
+++ b/apps/maple-agent/app/src/hosted_oauth.rs
@@ -13,7 +13,7 @@ pub(crate) const ATTEMPT_TIMEOUT: Duration = Duration::from_secs(15 * 60);
 const READ_TIMEOUT: Duration = Duration::from_secs(2);
 const MAX_REQUEST_BYTES: usize = 8192;
 const CALLBACK_PATH: &str = "/auth/callback";
-const RETURN_ERROR: &str = "Browser sign-in could not finish. Start again in Maple Agent.";
+const RETURN_ERROR: &str = "Browser sign-in could not finish. Start again in Maple Work.";
 
 pub(crate) struct HandoffListener {
     listener: TcpListener,
@@ -215,12 +215,12 @@ fn completion_response(outcome: Result<bool, ()>) -> String {
     let (title, message) = match outcome {
         Ok(true) => ("Signed in", "You can close this tab."),
         Ok(false) => (
-            "Signed in to Maple Agent",
+            "Signed in to Maple Work",
             "Your session could not be saved. You will need to sign in again when you restart the app. You can close this tab.",
         ),
         Err(()) => (
             "Sign-in could not finish",
-            "Return to Maple Agent and start again. You can close this tab.",
+            "Return to Maple Work and start again. You can close this tab.",
         ),
     };
     let body = include_str!("hosted_oauth_complete.html")
diff --git a/apps/maple-agent/app/src/hosted_oauth_complete.html b/apps/maple-agent/app/src/hosted_oauth_complete.html
index 7e0591d10..ba7ad6ed7 100644
--- a/apps/maple-agent/app/src/hosted_oauth_complete.html
+++ b/apps/maple-agent/app/src/hosted_oauth_complete.html
@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Maple Agent sign-in</title>
+    <title>Maple Work sign-in</title>
     <script>history.replaceState(null, "", "/auth/callback");</script>
     <style>
       * { box-sizing: border-box; }
diff --git a/apps/maple-agent/crates/maple-agent-updater/src/installer.rs b/apps/maple-agent/crates/maple-agent-updater/src/installer.rs
index 2afc60058..a944bf016 100644
--- a/apps/maple-agent/crates/maple-agent-updater/src/installer.rs
+++ b/apps/maple-agent/crates/maple-agent-updater/src/installer.rs
@@ -653,7 +653,7 @@ fn validate_destination(installed: &Path) -> Result<()> {
         || installed.starts_with("/Volumes")
     {
         return Err(InstallError::NotifyOnly(
-            "move Maple Agent to a writable installed application directory",
+            "move Maple Work to a writable installed application directory",
         ));
     }
     if fs::symlink_metadata(installed)?.file_type().is_symlink()
diff --git a/apps/maple-agent/crates/maple-agent/src/acp/mod.rs b/apps/maple-agent/crates/maple-agent/src/acp/mod.rs
index 80be1bedb..2bcbb62b9 100644
--- a/apps/maple-agent/crates/maple-agent/src/acp/mod.rs
+++ b/apps/maple-agent/crates/maple-agent/src/acp/mod.rs
@@ -546,7 +546,7 @@ impl AcpConnectionContext {
             && !available_models.iter().any(|available| available == model)
         {
             return Err(agent_client_protocol::Error::invalid_request().data(format!(
-                "This Maple Agent task uses model '{model}', which is no longer available; the task remains available in Maple Desktop"
+                "This Maple Work task uses model '{model}', which is no longer available; the task remains available in Maple Desktop"
             )));
         }
         let session_servers = prepare_session_mcp(&request.mcp_servers)?;
@@ -1552,7 +1552,7 @@ impl AcpConnectionContext {
                 return Err(agent_client_protocol::Error::resource_not_found(Some(
                     session_id.to_string(),
                 ))
-                .data("The Maple Agent task was removed outside this ACP connection"));
+                .data("The Maple Work task was removed outside this ACP connection"));
             }
             Err(error) => return Err(internal_acp_error(error)),
         };
@@ -1762,7 +1762,7 @@ impl AcpConnectionContext {
                             .await
                         }
                         None => Err(agent_client_protocol::Error::internal_error()
-                            .data("Maple Agent run ended without a terminal result")),
+                            .data("Maple Work run ended without a terminal result")),
                     };
                 }
             };
diff --git a/apps/maple-agent/crates/maple-agent/src/acp/session.rs b/apps/maple-agent/crates/maple-agent/src/acp/session.rs
index 47ec013d4..1d9275086 100644
--- a/apps/maple-agent/crates/maple-agent/src/acp/session.rs
+++ b/apps/maple-agent/crates/maple-agent/src/acp/session.rs
@@ -263,7 +263,7 @@ pub(super) fn find_acp_session<'a>(
         .iter()
         .find(|session| session.id == session_id)
         .ok_or_else(|| {
-            "The requested Maple Agent task does not exist in the supplied project directory"
+            "The requested Maple Work task does not exist in the supplied project directory"
                 .to_string()
         })
 }
diff --git a/apps/maple-agent/crates/maple-agent/src/agent.rs b/apps/maple-agent/crates/maple-agent/src/agent.rs
index 51c00f4e4..044e4fb64 100644
--- a/apps/maple-agent/crates/maple-agent/src/agent.rs
+++ b/apps/maple-agent/crates/maple-agent/src/agent.rs
@@ -72,7 +72,7 @@ const DEFAULT_MCP_TIMEOUT_SECONDS: u64 = 300;
 const AGENT_SERVICE_OPEN: u8 = 0;
 const AGENT_SERVICE_DRAINING: u8 = 1;
 const AGENT_SERVICE_DRAINING_ERROR: &str =
-    "Maple Agent services are draining and cannot accept new work";
+    "Maple Work services are draining and cannot accept new work";
 const RUNTIME_NOT_RUNNING_ERROR: &str = "Agent runtime is not running";
 const RUNTIME_SAVE_PENDING_ERROR: &str =
     "Agent history is waiting to be saved. Retry saving before starting more work.";
diff --git a/apps/maple-agent/crates/maple-agent/src/agent/catalog.rs b/apps/maple-agent/crates/maple-agent/src/agent/catalog.rs
index 6cc252ae6..7695199fc 100644
--- a/apps/maple-agent/crates/maple-agent/src/agent/catalog.rs
+++ b/apps/maple-agent/crates/maple-agent/src/agent/catalog.rs
@@ -88,7 +88,7 @@ async fn cached_model_ids(
             models
         }
         Err(error) => {
-            log::warn!("Failed to fetch the Maple Agent model catalog: {error}");
+            log::warn!("Failed to fetch the Maple Work model catalog: {error}");
             Vec::new()
         }
     }
@@ -158,7 +158,7 @@ impl AgentRuntimeHandle {
         match self.api().await?.model_catalog().await {
             Ok(catalog) => Ok(Some(catalog_entry(&catalog, model_id).unwrap_or_default())),
             Err(error) => {
-                log::warn!("Failed to fetch the Maple Agent model catalog: {error}");
+                log::warn!("Failed to fetch the Maple Work model catalog: {error}");
                 Ok(None)
             }
         }
diff --git a/apps/maple-agent/docs/desktop-builds.md b/apps/maple-agent/docs/desktop-builds.md
index 93e3b58fe..1f4d024f7 100644
--- a/apps/maple-agent/docs/desktop-builds.md
+++ b/apps/maple-agent/docs/desktop-builds.md
@@ -22,8 +22,8 @@ previews.
 
 | Profile | Application | macOS bundle ID | Configuration/data namespace | Update delivery |
 | --- | --- | --- | --- | --- |
-| Dev | Maple Agent Dev | `cloud.opensecret.maple.agent.dev` | `maple-agent-dev` | Disabled; master Actions artifacts |
-| Prod | Maple Agent | `cloud.opensecret.maple.agent` | `maple-agent-prod` | Signed Agent feed with primary/backup pins; publication separately gated |
+| Dev | Maple Work Dev | `cloud.opensecret.maple.agent.dev` | `maple-agent-dev` | Disabled; master Actions artifacts |
+| Prod | Maple Work | `cloud.opensecret.maple.agent` | `maple-agent-prod` | Signed Agent feed with primary/backup pins; publication separately gated |
 
 The binary embeds its profile, hosted API/client/billing settings, and PCR
 environment. `--build-info` prints the public build identity as JSON without
diff --git a/apps/maple-agent/docs/release-profiles.md b/apps/maple-agent/docs/release-profiles.md
index 9b466b127..57f98754e 100644
--- a/apps/maple-agent/docs/release-profiles.md
+++ b/apps/maple-agent/docs/release-profiles.md
@@ -1,4 +1,4 @@
-# Maple Agent build profiles
+# Maple Work build profiles
 
 `MAPLE_RELEASE_PROFILE=dev` or `prod` selects a packaged profile at compile
 time. `release-profiles.json` is the shared public configuration used by both
@@ -8,8 +8,15 @@ ID, or PCR trust environment.
 
 | Profile | Application | Bundle ID | State namespace | API / billing trust |
 | --- | --- | --- | --- | --- |
-| Dev | Maple Agent Dev | `cloud.opensecret.maple.agent.dev` | `maple-agent-dev` | Hosted Dev API and billing; development PCR |
-| Prod | Maple Agent | `cloud.opensecret.maple.agent` | `maple-agent-prod` | Hosted Prod API and billing; production PCR |
+| Dev | Maple Work Dev | `cloud.opensecret.maple.agent.dev` | `maple-agent-dev` | Hosted Dev API and billing; development PCR |
+| Prod | Maple Work | `cloud.opensecret.maple.agent` | `maple-agent-prod` | Hosted Prod API and billing; production PCR |
+
+Display branding is independent of installation identity. macOS keeps the
+`Maple Agent.app` and `Maple Agent Dev.app` filenames and updater archive roots;
+Linux keeps `maple-agent.app` and `maple-agent-dev.app`. Executables, bundle IDs,
+state namespaces, settings, update feeds, and artifact filenames are unchanged.
+macOS uses `Resources/en.lproj/InfoPlist.strings` for the new display name while
+the base `CFBundleDisplayName` matches the existing bundle filename for Finder.
 
 The API endpoints and client ID match `scripts/ci/_common.sh`'s existing
 Research Dev and Prod service selection. Billing browser pricing, checkout
@@ -43,7 +50,7 @@ state. Installing both channels therefore keeps separate sign-ins and history.
 With `MAPLE_RELEASE_PROFILE` unset, the binary reports `unpackaged`, retains the
 existing `maple-agent` namespace, runtime endpoint/client overrides, explicit
 compile-time PCR selection, and legacy `maple-gpui` adoption. Its debug bundle
-identity is `cloud.opensecret.maple.agent.debug` and display name is Maple Agent
+identity is `cloud.opensecret.maple.agent.debug` and display name is Maple Work
 Debug. Release packaging accepts only Dev or Prod metadata.
 
 `maple-agent --build-info` prints one JSON object and exits before changing the
diff --git a/apps/maple-agent/release-profiles.json b/apps/maple-agent/release-profiles.json
index f1a189ae9..052ac297d 100644
--- a/apps/maple-agent/release-profiles.json
+++ b/apps/maple-agent/release-profiles.json
@@ -1,6 +1,6 @@
 {
   "dev": {
-    "display_name": "Maple Agent Dev",
+    "display_name": "Maple Work Dev",
     "bundle_id": "cloud.opensecret.maple.agent.dev",
     "data_namespace": "maple-agent-dev",
     "api_url": "https://enclave.secretgpt.ai",
@@ -16,7 +16,7 @@
     "prerelease": true
   },
   "prod": {
-    "display_name": "Maple Agent",
+    "display_name": "Maple Work",
     "bundle_id": "cloud.opensecret.maple.agent",
     "data_namespace": "maple-agent-prod",
     "api_url": "https://enclave.trymaple.ai",
diff --git a/apps/maple-agent/release_profile.rs b/apps/maple-agent/release_profile.rs
index 40a3822bc..b348aa695 100644
--- a/apps/maple-agent/release_profile.rs
+++ b/apps/maple-agent/release_profile.rs
@@ -151,7 +151,7 @@ pub fn select_profile(
     }]
     .clone();
     if channel == "unpackaged" {
-        profile.display_name = "Maple Agent Debug".into();
+        profile.display_name = "Maple Work Debug".into();
         profile.bundle_id = "cloud.opensecret.maple.agent.debug".into();
         profile.data_namespace = "maple-agent".into();
         // Hosted return is admitted only by packaged profiles. Local
diff --git a/apps/maple-agent/scripts/generate-third-party-notices.py b/apps/maple-agent/scripts/generate-third-party-notices.py
index 4aec8d776..ce8305d76 100755
--- a/apps/maple-agent/scripts/generate-third-party-notices.py
+++ b/apps/maple-agent/scripts/generate-third-party-notices.py
@@ -16,7 +16,7 @@
 def render(inventory, component, target, default_features, features):
     feature_description = ", ".join(features) or "none"
     blocks = [
-        "Maple Agent — Third-party notices\n",
+        "Maple Work — Third-party notices\n",
         "This distribution includes software and data under the following licenses.\n"
         f"Application: maple-agent-app; target: {target}.\n"
         f"Default features: {default_features}; additional features: {feature_description}.\n"
@@ -42,7 +42,7 @@ def render(inventory, component, target, default_features, features):
     text = ("\n" + "=" * 78 + "\n\n").join(blocks).rstrip() + "\n"
     document = ('<!doctype html><html lang="en"><meta charset="utf-8">'
                 '<meta name="viewport" content="width=device-width">'
-                '<title>Maple Agent third-party notices</title>'
+                '<title>Maple Work third-party notices</title>'
                 '<style>body{max-width:76rem;margin:2rem auto;padding:0 1rem;'
                 'font:15px/1.5 system-ui}pre{white-space:pre-wrap;overflow-wrap:anywhere}</style>'
                 '<h1>Third-party notices</h1><pre>' + html.escape(text) + '</pre></html>\n')
diff --git a/apps/maple-agent/scripts/linux-install.py b/apps/maple-agent/scripts/linux-install.py
index 4e53ec941..db8c221d8 100644
--- a/apps/maple-agent/scripts/linux-install.py
+++ b/apps/maple-agent/scripts/linux-install.py
@@ -21,8 +21,8 @@
 FIELDS = {"format", "product", "profile", "version", "build", "source_sha",
           "bundle_id", "entrypoint", "executable"}
 PROFILES = {
-    "prod": ("maple-agent.app", "maple-agent", "cloud.opensecret.maple.agent", "Maple Agent"),
-    "dev": ("maple-agent-dev.app", "maple-agent-dev", "cloud.opensecret.maple.agent.dev", "Maple Agent Dev"),
+    "prod": ("maple-agent.app", "maple-agent", "cloud.opensecret.maple.agent", "Maple Work"),
+    "dev": ("maple-agent-dev.app", "maple-agent-dev", "cloud.opensecret.maple.agent.dev", "Maple Work Dev"),
 }
 MAX_ENTRIES = 20_000
 MAX_FILE = 2 * 1024**3
diff --git a/apps/maple-agent/scripts/macos-debug-plist.py b/apps/maple-agent/scripts/macos-debug-plist.py
index 153bcdfd4..c4b938c9c 100644
--- a/apps/maple-agent/scripts/macos-debug-plist.py
+++ b/apps/maple-agent/scripts/macos-debug-plist.py
@@ -43,3 +43,10 @@ def configure(plist: dict, environment: dict[str, str]) -> dict:
         configured = configure(plistlib.load(source), os.environ)
     with path.open("wb") as output:
         plistlib.dump(configured, output)
+    # Localize presentation while retaining the debug bundle's installed name.
+    localized = path.parent / "Resources/en.lproj/InfoPlist.strings"
+    localized.parent.mkdir(parents=True, exist_ok=True)
+    localized.write_bytes(plistlib.dumps({
+        "CFBundleDisplayName": configured["CFBundleName"],
+        "CFBundleName": configured["CFBundleName"],
+    }))
diff --git a/apps/maple-agent/scripts/macos-release-app.sh b/apps/maple-agent/scripts/macos-release-app.sh
index d5d4ec694..3345f9bd5 100755
--- a/apps/maple-agent/scripts/macos-release-app.sh
+++ b/apps/maple-agent/scripts/macos-release-app.sh
@@ -70,6 +70,8 @@ macos_release_main() {
     [[ -x "$binary" && -f "$output_dir/build-info.json" ]] || { echo "missing release binary/build-info" >&2; return 1; }
     local app_name="${MAPLE_PACKAGE_APP_NAME:?}" bundle_id="${MAPLE_PACKAGE_BUNDLE_ID:?}"
     local profile="${MAPLE_PACKAGE_CHANNEL:?}" build_number="${MAPLE_PACKAGE_BUILD_NUMBER:-1}"
+    local bundle_name
+    bundle_name="$(python3 "$component/scripts/release-info.py" bundle-name "$profile" "$output_dir/build-info.json")"
     local arches
     arches="$(macos_native lipo -archs "$binary")"
     [[ "$arches" == arm64 ]] || { echo "release binary must contain exactly the arm64 slice" >&2; return 1; }
@@ -83,7 +85,7 @@ macos_release_main() {
     trap 'exit 130' INT
     trap 'exit 143' TERM
     trap 'exit 129' HUP
-    local app="$macos_release_staging/$app_name.app"
+    local app="$macos_release_staging/$bundle_name.app"
     local frameworks="$app/Contents/Frameworks" executable="$app/Contents/MacOS/maple-agent"
     mkdir -p "$frameworks" "$app/Contents/MacOS" "$app/Contents/Resources"
     cp "$binary" "$executable"
@@ -222,7 +224,7 @@ print(matches[0])' "$APPLE_TEAM_ID")"
     local image_root="$macos_release_staging/image"
     mkdir "$image_root"
     chmod 0755 "$image_root"
-    macos_native ditto "$app" "$image_root/$app_name.app"
+    macos_native ditto "$app" "$image_root/$bundle_name.app"
     ln -s /Applications "$image_root/Applications"
     # hdiutil's own -srcfolder size estimate can come up short and fail with
     # "No space left on device". Size the image from the payload with headroom,
@@ -256,7 +258,7 @@ print(-(-total//(1024*1024)))' "$image_root")"
         macos_native xcrun stapler validate "$output_dir/$basename.dmg"
         macos_native spctl --assess --type open --context context:primary-signature --verbose=2 "$output_dir/$basename.dmg"
     fi
-    macos_archive_app "$macos_release_staging" "$app_name" "$output_dir/$basename.app.tar.gz"
+    macos_archive_app "$macos_release_staging" "$bundle_name" "$output_dir/$basename.app.tar.gz"
     chmod 0644 "$output_dir/$basename.dmg" "$output_dir/$basename.app.tar.gz"
 }
 
diff --git a/apps/maple-agent/scripts/release-info.py b/apps/maple-agent/scripts/release-info.py
index 536d9fbe8..69cad1cf4 100755
--- a/apps/maple-agent/scripts/release-info.py
+++ b/apps/maple-agent/scripts/release-info.py
@@ -94,7 +94,8 @@ def write_plist(info, path, build_number):
         raise ValueError("package build number must be a positive integer")
     plist = plistlib.loads((COMPONENT / "app/macos/Info.plist").read_bytes())
     plist.update({
-        "CFBundleDisplayName": info["display_name"],
+        # Finder localizes only when this base name matches the bundle path.
+        "CFBundleDisplayName": macos_bundle_name(info["profile"]),
         "CFBundleName": info["display_name"],
         "CFBundleIdentifier": info["bundle_id"],
         "CFBundleShortVersionString": info["version"].split("-", 1)[0],
@@ -107,6 +108,17 @@ def write_plist(info, path, build_number):
     })
     plist.pop("LSEnvironment", None)
     Path(path).write_bytes(plistlib.dumps(plist))
+    localized = Path(path).parent / "Resources/en.lproj/InfoPlist.strings"
+    localized.parent.mkdir(parents=True, exist_ok=True)
+    localized.write_bytes(plistlib.dumps({
+        "CFBundleDisplayName": info["display_name"],
+        "CFBundleName": info["display_name"],
+    }))
+
+
+def macos_bundle_name(profile):
+    # Installed paths and updater archive roots predate the display branding.
+    return {"dev": "Maple Agent Dev", "prod": "Maple Agent"}[profile]
 
 
 def linux_package_name(info):
@@ -285,7 +297,7 @@ def payload(directory):
 
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("operation", choices=("validate", "field", "plist", "manifest", "verify", "extract-app", "compare-apps"))
+    parser.add_argument("operation", choices=("validate", "field", "bundle-name", "plist", "manifest", "verify", "extract-app", "compare-apps"))
     parser.add_argument("profile", choices=("dev", "prod"))
     parser.add_argument("path")
     parser.add_argument("--source-sha")
@@ -299,14 +311,15 @@ def main():
         print(json.dumps(verify_artifacts(args.profile, args.path, args.unsigned, args.source_sha, args.platform)))
         return
     if args.operation == "extract-app":
-        app_name = json.loads((COMPONENT / "release-profiles.json").read_text())[args.profile]["display_name"]
-        extract_app_archive(args.path, args.output, app_name)
+        extract_app_archive(args.path, args.output, macos_bundle_name(args.profile))
         return
     if args.operation == "compare-apps":
         compare_app_payloads(args.path, args.output)
         return
     info = read_info(args.profile, args.path, args.source_sha, args.platform)
-    if args.operation == "field":
+    if args.operation == "bundle-name":
+        print(macos_bundle_name(args.profile))
+    elif args.operation == "field":
         if args.field not in BUILD_FIELDS:
             raise ValueError("field is not public release metadata")
         print(info[args.field])
diff --git a/apps/maple-agent/scripts/test_linux_install.py b/apps/maple-agent/scripts/test_linux_install.py
index b947d6afa..04c683959 100644
--- a/apps/maple-agent/scripts/test_linux_install.py
+++ b/apps/maple-agent/scripts/test_linux_install.py
@@ -98,6 +98,8 @@ def test_first_install_copies_bundle_and_integrates_without_profile_data_changes
         self.assertEqual(stat.S_IMODE(paths["wrapper"].stat().st_mode), 0o755)
         self.assertEqual(stat.S_IMODE(paths["receipt"].stat().st_mode), 0o600)
         desktop = paths["desktop"].read_text()
+        self.assertIn("Name=Maple Work\n", desktop)
+        self.assertEqual(paths["desktop"].name, "cloud.opensecret.maple.agent.desktop")
         self.assertIn("Exec=\"", desktop)
         self.assertIn("%%", desktop)
         self.assertIn(" %U\n", desktop)
@@ -113,6 +115,7 @@ def test_dev_and_prod_have_distinct_bundle_commands_and_desktop_entries(self):
         self.assertEqual(dev["bundle"].name, "maple-agent-dev.app")
         self.assertEqual(dev["wrapper"].name, "maple-agent-dev")
         self.assertEqual(dev["desktop"].name, "cloud.opensecret.maple.agent.dev.desktop")
+        self.assertIn("Name=Maple Work Dev\n", dev["desktop"].read_text())
         self.assertTrue(set(prod.values()).isdisjoint(dev.values()))
 
     def test_every_preexisting_managed_path_is_refused_without_replacement(self):
diff --git a/apps/maple-agent/scripts/test_linux_release_appimage.py b/apps/maple-agent/scripts/test_linux_release_appimage.py
index a6ee32a24..db12bf25f 100644
--- a/apps/maple-agent/scripts/test_linux_release_appimage.py
+++ b/apps/maple-agent/scripts/test_linux_release_appimage.py
@@ -25,7 +25,7 @@
 HEADER = b"\x7fELF\x02\x01" + b"\x00" * 12 + b"\x3e\x00"
 METADATA = {
     "channel": "dev",
-    "app_name": "Maple Agent Dev",
+    "app_name": "Maple Work Dev",
     "bundle_id": "cloud.opensecret.maple.agent.dev",
     "version": "0.1.0",
     "build_number": "1",
diff --git a/apps/maple-agent/scripts/test_release_packaging.py b/apps/maple-agent/scripts/test_release_packaging.py
index 4b36f5e31..4839bf35d 100644
--- a/apps/maple-agent/scripts/test_release_packaging.py
+++ b/apps/maple-agent/scripts/test_release_packaging.py
@@ -289,7 +289,7 @@ def setUp(self):
         shutil.copy2(SCRIPTS.parent / "app/packaging/macos-entitlements.plist", entitlements)
         self.info = {**profile_info("dev"), "profile": "dev", "version": "0.1.0",
                      "source_sha": "a" * 40, "git_revision": "a" * 8}
-        self.bundle = self.root / f"{self.info['display_name']}.app"
+        self.bundle = self.root / f"{release_info.macos_bundle_name('dev')}.app"
         binary = self.bundle / "Contents/MacOS/maple-agent"
         binary.parent.mkdir(parents=True)
         # Metadata-only Mach-O cannot execute. A successful static verification
@@ -392,6 +392,33 @@ def test_profile_and_source_must_match_the_binary(self):
             with self.subTest(profile=profile, source=source), self.assertRaises(ValueError):
                 release_info.read_info(profile, self.path, source)
 
+    def test_display_branding_preserves_installed_bundle_names_and_metadata_contract(self):
+        for profile, display, bundle in (
+            ("prod", "Maple Work", "Maple Agent"),
+            ("dev", "Maple Work Dev", "Maple Agent Dev"),
+        ):
+            with self.subTest(profile=profile):
+                info = {**self.info, **profile_info(profile), "profile": profile}
+                self.path.write_text(json.dumps(info))
+                result = subprocess.run(
+                    [sys.executable, str(SCRIPTS / "release-info.py"), "bundle-name", profile, str(self.path)],
+                    check=True, capture_output=True, text=True,
+                )
+                self.assertEqual(result.stdout.strip(), bundle)
+                self.assertEqual(info["display_name"], display)
+                output = self.directory / "Info.plist"
+                release_info.write_plist(info, output, "42")
+                plist = plistlib.loads(output.read_bytes())
+                self.assertEqual(plist["CFBundleDisplayName"], bundle)
+                self.assertEqual(plist["CFBundleName"], display)
+                localized = output.parent / "Resources/en.lproj/InfoPlist.strings"
+                self.assertEqual(plistlib.loads(localized.read_bytes()), {
+                    "CFBundleDisplayName": display, "CFBundleName": display,
+                })
+                self.assertEqual(plist["CFBundleIdentifier"], info["bundle_id"])
+                self.assertEqual(plist["CFBundleExecutable"], "maple-agent")
+                self.assertEqual(set(info), release_info.BUILD_FIELDS)
+
     def test_dirty_or_incomplete_source_revision_is_rejected(self):
         for revision in ("aaaaaaaa-dirty", "unknown", "bbbbbbbb"):
             self.info["git_revision"] = revision
@@ -399,6 +426,24 @@ def test_dirty_or_incomplete_source_revision_is_rejected(self):
             with self.subTest(revision=revision), self.assertRaises(ValueError):
                 release_info.read_info("dev", self.path)
 
+    def test_debug_bundle_localizes_branding_without_changing_its_identity(self):
+        output = self.directory / "Maple Agent Debug.app/Contents/Info.plist"
+        output.parent.mkdir(parents=True)
+        shutil.copyfile(SCRIPTS.parent / "app/macos/Info.plist", output)
+        subprocess.run(
+            [sys.executable, str(SCRIPTS / "macos-debug-plist.py"), str(output)],
+            env=dict(os.environ, MAPLE_DEBUG_BUNDLE_ID="cloud.opensecret.maple.agent.debug"),
+            check=True, capture_output=True, text=True,
+        )
+        plist = plistlib.loads(output.read_bytes())
+        self.assertEqual(plist["CFBundleIdentifier"], "cloud.opensecret.maple.agent.debug")
+        self.assertEqual(plist["CFBundleExecutable"], "maple-agent")
+        self.assertEqual(plist["CFBundleDisplayName"], "Maple Agent Debug")
+        localized = output.parent / "Resources/en.lproj/InfoPlist.strings"
+        self.assertEqual(plistlib.loads(localized.read_bytes()), {
+            "CFBundleDisplayName": "Maple Work Debug", "CFBundleName": "Maple Work Debug",
+        })
+
     def test_endpoint_or_state_namespace_drift_is_rejected(self):
         for field, value in (("api_url", "https://wrong.invalid"), ("data_namespace", "maple-agent-prod")):
             original = self.info[field]
@@ -670,6 +715,17 @@ def test_extracts_exact_expected_app_and_compares_every_payload_file(self):
         with self.assertRaises(ValueError):
             release_info.compare_app_payloads(first, second)
 
+    def test_profile_extraction_keeps_the_installed_name_after_rebranding(self):
+        self.write_archive()
+        output = self.directory / "profile-output"
+        subprocess.run(
+            [sys.executable, str(SCRIPTS / "release-info.py"), "extract-app", "dev",
+             str(self.archive), "--output", str(output)],
+            check=True, capture_output=True, text=True,
+        )
+        self.assertTrue((output / "Maple Agent Dev.app/Contents/maple-agent").is_file())
+        self.assertFalse((output / "Maple Work Dev.app").exists())
+
     def test_rejects_traversal_unexpected_roots_and_link_escape(self):
         cases = [
             ("/outside", "file", "fixture"),
@@ -872,6 +928,9 @@ def test_inside_out_signing_notarization_and_ephemeral_keychain_cleanup(self):
         self.assert_secrets_not_returned(result)
         archive = next(call for call in calls if call[0] == "tar")
         self.assertEqual(archive[1:5], ["--no-xattrs", "--no-fflags", "--no-acls", "--no-mac-metadata"])
+        self.assertEqual(archive[-1], "Maple Agent Dev.app")
+        image = next(call for call in calls if call[:2] == ["hdiutil", "create"])
+        self.assertEqual(image[image.index("-volname") + 1], "Maple Work Dev")
         signs = [call for call in calls if call[0] == "codesign" and "--force" in call]
         self.assertTrue(signs[0][-1].endswith("libswiftFixture.dylib"))
         self.assertTrue(signs[1][-1].endswith(".app"))
@@ -894,7 +953,12 @@ def test_inside_out_signing_notarization_and_ephemeral_keychain_cleanup(self):
         self.assert_search_list_restored(calls)
         self.assertFalse(list(self.directory.glob(".macos-release.*")))
         with tarfile.open(self.directory / "fixture.app.tar.gz") as archive:
-            icon = archive.extractfile(f"{self.info['display_name']}.app/Contents/Resources/MapleAgent.icns").read()
+            bundle = release_info.macos_bundle_name("dev") + ".app"
+            plist = plistlib.loads(archive.extractfile(f"{bundle}/Contents/Info.plist").read())
+            self.assertEqual(plist["CFBundleDisplayName"], "Maple Agent Dev")
+            localized = plistlib.loads(archive.extractfile(f"{bundle}/Contents/Resources/en.lproj/InfoPlist.strings").read())
+            self.assertEqual(localized["CFBundleDisplayName"], "Maple Work Dev")
+            icon = archive.extractfile(f"{bundle}/Contents/Resources/MapleAgent.icns").read()
             self.assertEqual(icon, (SCRIPTS.parent / "app/packaging/maple-agent-dev.icns").read_bytes())
             self.assertNotEqual(icon, (SCRIPTS.parent / "app/packaging/maple-agent.icns").read_bytes())
             for member in archive:
@@ -902,7 +966,7 @@ def test_inside_out_signing_notarization_and_ephemeral_keychain_cleanup(self):
                 if member.isdir():
                     self.assertTrue(member.mode & 0o001, f"package directory is not publicly accessible: {member.name}")
         extracted = release_info.extract_app_archive(
-            self.directory / "fixture.app.tar.gz", self.directory / "extracted", self.info["display_name"]
+            self.directory / "fixture.app.tar.gz", self.directory / "extracted", release_info.macos_bundle_name("dev")
         )
         self.assertTrue((extracted / "Contents/MacOS/maple-agent").is_file())
         self.assertEqual(extracted.stat().st_mode & 0o777, 0o755)
diff --git a/apps/maple-agent/scripts/verify-release.sh b/apps/maple-agent/scripts/verify-release.sh
index 1483a0515..f21ea04d8 100755
--- a/apps/maple-agent/scripts/verify-release.sh
+++ b/apps/maple-agent/scripts/verify-release.sh
@@ -71,6 +71,7 @@ if [[ "$platform" == macos-aarch64 ]]; then
     mkdir "$mount"
     /usr/bin/hdiutil attach -readonly -nobrowse -noautoopen -mountpoint "$mount" "$directory/$package" >/dev/null
     app_name="$(python3 "$component/scripts/release-info.py" field "$profile" "$directory/build-info.json" --field display_name)"
+    bundle_name="$(python3 "$component/scripts/release-info.py" bundle-name "$profile" "$directory/build-info.json")"
     bundle_id="$(python3 "$component/scripts/release-info.py" field "$profile" "$directory/build-info.json" --field bundle_id)"
     verify_macos_app() {
         local app="$1" signature executable
@@ -98,14 +99,19 @@ actual=plistlib.loads(open(sys.argv[1], "rb").read())
 expected=plistlib.loads(open(sys.argv[2], "rb").read())
 assert actual == expected, "downloaded app entitlements differ from the reviewed policy"
 PY
-        python3 - "$app/Contents/Info.plist" "$bundle_id" "$app_name" "$directory/build-info.json" <<'PY'
+        python3 - "$app/Contents/Info.plist" "$bundle_id" "$app_name" "$directory/build-info.json" "$bundle_name" <<'PY'
 import json,plistlib,re,sys
+from pathlib import Path
 with open(sys.argv[1], "rb") as source:
     plist=plistlib.load(source)
 info=json.load(open(sys.argv[4]))
 assert plist["CFBundleIdentifier"] == sys.argv[2]
-assert plist["CFBundleDisplayName"] == sys.argv[3]
+assert plist["CFBundleDisplayName"] == sys.argv[5]
 assert plist["CFBundleName"] == sys.argv[3]
+localized=Path(sys.argv[1]).parent / "Resources/en.lproj/InfoPlist.strings"
+assert plistlib.loads(localized.read_bytes()) == {
+    "CFBundleDisplayName": sys.argv[3], "CFBundleName": sys.argv[3],
+}
 assert plist["CFBundleExecutable"] == "maple-agent"
 assert plist["CFBundleShortVersionString"] == info["version"].split("-",1)[0]
 assert re.fullmatch(r"[1-9][0-9]*", plist["CFBundleVersion"])
@@ -127,12 +133,12 @@ PY
             fi
         fi
     }
-    dmg_app="$mount/$app_name.app"
+    dmg_app="$mount/$bundle_name.app"
     verify_macos_app "$dmg_app"
     archives=("$directory"/*.app.tar.gz)
     [[ ${#archives[@]} == 1 && -f "${archives[0]}" ]] || { echo "expected exactly one app archive" >&2; exit 1; }
     python3 "$component/scripts/release-info.py" extract-app "$profile" "${archives[0]}" --output "$temporary/archive"
-    archive_app="$temporary/archive/$app_name.app"
+    archive_app="$temporary/archive/$bundle_name.app"
     verify_macos_app "$archive_app"
     python3 "$component/scripts/release-info.py" compare-apps "$profile" "$dmg_app" --output "$archive_app"
     if [[ "$static" == false ]]; then