@cohortapp/agent-sdk 2.10.0 → 2.11.0

package/scripts/huddle/huddle-server.mjs

@@ -1139,11 +1139,126 @@ class HuddleServer extends EventEmitter {
 // Huddle-specific system prompt
 // ---------------------------------------------------------------------------
 
-function buildHuddleSystemPrompt() {
+/**
+ * A config value the operator has not filled in yet.
+ *
+ * The scaffold ships `"name": "UNCONFIGURED"` in config/company.json and empty
+ * strings/arrays everywhere else, so BOTH shapes mean "absent". Treating only
+ * `""` as absent is what let "UNCONFIGURED" reach a prompt.
+ *
+ * @param {*} v
+ * @returns {string} trimmed value, or "" when absent/unconfigured
+ */
+export function configuredStr(v) {
+  const s = typeof v === "string" ? v.trim() : (typeof v === "number" ? String(v) : "");
+  if (!s) return "";
+  if (s.toUpperCase() === "UNCONFIGURED") return "";
+  return s;
+}
+
+/** Normalise a config array to clean strings; drops blanks and UNCONFIGURED. */
+function configuredList(v) {
+  if (!Array.isArray(v)) return [];
+  return v
+    .map((x) => (x && typeof x === "object" ? configuredStr(x.name) || configuredStr(x.title) : configuredStr(x)))
+    .filter(Boolean);
+}
+
+/**
+ * Render the "about the company" section of the huddle prompt from
+ * config/company.json — the SoT that lib/setup/enroll-from-cohort.mjs syncs
+ * from Cohort.
+ *
+ * WHY THIS IS A FUNCTION AND NOT A STRING LITERAL
+ *   This block used to be five hardcoded bullets under an `ABOUT <X>:`
+ *   header naming one fictional company whose body then described a
+ *   DIFFERENT, equally fictional one (a head office, a jurisdiction count and
+ *   a licensing phase, none of them the header's). Two non-current identities
+ *   in one block is the tell that no code path ever grounded it. This text is SPOKEN ALOUD, on a huddle the server auto-joins
+ *   (`this.autoJoin = true`), to participants who can include people outside
+ *   the org, and the turn is persisted to logs/huddle/*.jsonl. A fabricated
+ *   employer said out loud to an outside participant cannot be retracted.
+ *
+ * FAIL CLOSED. Every line is conditional on a real value. When config/company.json
+ * is untouched (the scaffold ships it as UNCONFIGURED + empty) this returns ""
+ * and the prompt carries NO company section at all. Saying nothing about the
+ * employer is correct behaviour; saying something invented is not.
+ *
+ * @param {object} co parsed config/company.json
+ * @returns {string} the section (no trailing newline), or "" when nothing is known
+ */
+export function renderHuddleCompanyBlock(co) {
+  const c = co && typeof co === "object" ? co : {};
+  const name = configuredStr(c.name);
+  const legalName = configuredStr(c.legalName);
+  const description = configuredStr(c.description);
+  const industry = configuredStr(c.industry);
+  const stage = configuredStr(c.stage);
+  const jurisdictions = configuredList(c.jurisdictions);
+  const products = configuredList(c.products);
+  const priorities = configuredList(c.strategicPriorities);
+
+  const bullets = [];
+  if (description) bullets.push(`- ${description}`);
+  else if (industry) bullets.push(`- ${name || "The company"} operates in ${industry}`);
+  if (industry && description) bullets.push(`- Industry: ${industry}`);
+  if (legalName && legalName !== name) bullets.push(`- Legal entity: ${legalName}`);
+  if (jurisdictions.length) bullets.push(`- Jurisdictions: ${jurisdictions.join(", ")}`);
+  if (products.length) bullets.push(`- Products: ${products.join(", ")}`);
+  if (stage) bullets.push(`- Stage: ${stage}`);
+  if (priorities.length) bullets.push(`- Current priorities: ${priorities.join("; ")}`);
+
+  if (bullets.length === 0) return "";
+  const header = name ? `ABOUT ${name.toUpperCase()}:` : "ABOUT THE COMPANY:";
+  return [header, ...bullets].join("\n");
+}
+
+/**
+ * The identity line. Same omission rule as lib/identity/persona.mjs#renderPersona:
+ * an unset field drops its clause rather than taking a plausible default. The
+ * previous line interpolated `${a.company}` unconditionally, so an unconfigured
+ * seat introduced itself as "… of ." on a live call.
+ *
+ * @param {object} a config/agent.json
+ * @param {object} co config/company.json
+ * @returns {string}
+ */
+export function renderHuddleIdentityLine(a, co) {
+  const name = configuredStr(a.fullName) ||
+    [configuredStr(a.firstName), configuredStr(a.lastName)].filter(Boolean).join(" ").trim();
+  const title = configuredStr(a.title);
+  const company = configuredStr(a.company) || configuredStr(co && co.name);
+  const principal = (a.principal && typeof a.principal === "object") ? a.principal : {};
+  const pName = configuredStr(principal.fullName) || configuredStr(principal.firstName);
+  const pTitle = configuredStr(principal.title);
+
+  const who = [name, title].filter(Boolean).join(", ");
+  if (!who) {
+    // Nothing on record. Do not invent a persona — state the role of the seat
+    // in the conversation and nothing more.
+    return "You are participating in a Slack huddle — a real-time voice conversation.";
+  }
+  const at = company ? ` at ${company}` : "";
+  const lines = [`You are ${who}${at}.`];
+  if (pName) lines.push(pTitle ? `You report to ${pName}, ${pTitle}.` : `You report to ${pName}.`);
+  lines.push("You are participating in a Slack huddle — a real-time voice conversation.");
+  return lines.join("\n");
+}
+
+/** Read config/company.json from the agent repo. Never throws. */
+function loadCompany() {
+  try {
+    return JSON.parse(readFileSync(join(AGENT_REPO_DIR, "config/company.json"), "utf-8"));
+  } catch {
+    return {};
+  }
+}
+
+export function buildHuddleSystemPrompt() {
   const a = loadAgent();
-  const principal = a.principal || {};
-  return `You are ${a.fullName}, ${a.title} to ${principal.fullName || "the principal"}, ${principal.title || "the principal"} of ${a.company}.
-You are participating in a Slack huddle — a real-time voice conversation.
+  const co = loadCompany();
+  const companyBlock = renderHuddleCompanyBlock(co);
+  return `${renderHuddleIdentityLine(a, co)}
 
 PERSONALITY:
 - Sound like a thoughtful colleague, not an assistant. Full guide: policies/communication-style.md
@@ -1159,15 +1274,8 @@ BANNED OPENERS AND PHRASES (do not use):
 - "As an AI" / "As a language model" / "I should clarify that…"
 - "I hope this helps" / "Feel free to ask if you have any questions"
 - "Here's a comprehensive overview of…"
-- Don't re-introduce yourself by listing your role at length. "Hi, this is ${a.firstName || "the agent"}" is enough.
-
-ABOUT ADAPTIC:
-- Northwind is a global AI-native institutional asset management group
-- Headquartered in DIFC, Dubai with entities across seven plus jurisdictions
-- CEO and founder: the principal (resolved from config/agent.json)
-- Building Northwind OS, an algorithmic trading platform
-- Currently in regulatory licensing phase
-
+- Don't re-introduce yourself by listing your role at length. "Hi, this is ${configuredStr(a.firstName) || "the agent"}" is enough.
+${companyBlock ? `\n${companyBlock}\n` : ""}
 HUDDLE RULES:
 - Huddles are informal — keep responses short and natural
 - Listen more than you talk — do not dominate the conversation
@@ -1199,6 +1307,13 @@ const HUDDLE_SYSTEM_PROMPT = buildHuddleSystemPrompt();
 
 // ---------------------------------------------------------------------------
 // Main
+//
+// NOTE: this bootstrap deliberately runs on IMPORT, not behind an
+// `import.meta.url === process.argv[1]` entrypoint guard. Such a guard compares
+// a symlink-resolved path against an unresolved argv[1], so a repo reached
+// through a symlink would start NOTHING, silently, on a voice server that is
+// supposed to be listening. The prompt renderers are tested without importing
+// this module (see huddle-prompt.test.mjs) precisely so this stays as it is.
 // ---------------------------------------------------------------------------
 
 const server = new HuddleServer();

package/scripts/local-triggers/autoupdate.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# =============================================================================
+# autoupdate.sh — keep @cohortapp/agent-sdk at @latest, health-gated + rollback
+# =============================================================================
+# Runs hourly via the ai.maestro.<first>-autoupdate launchd job. Policy is
+# "auto to @latest": whenever npm's latest is a strictly-greater semver than the
+# installed SDK, this installs it, smart-merges the copied framework files
+# (`maestro upgrade`), restarts the daemon, and VERIFIES the daemon comes back
+# healthy — rolling back to the prior version if it does not.
+#
+# Safety rails:
+#   - kill-switch: `touch ~/.maestro-no-autoupdate` (or $AGENT_DIR/.no-autoupdate)
+#     halts all auto-updates fleet-wide without unloading the job.
+#   - jitter 0-600s so 15 machines don't hit npm / restart in lockstep.
+#   - re-exec from a /tmp copy so `maestro upgrade` overwriting THIS file
+#     mid-run cannot corrupt the running shell.
+#   - health-gate + automatic rollback to the previous version on a bad release.
+# =============================================================================
+set -uo pipefail
+export PATH="/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:${PATH:-}"
+
+# Re-exec from a stable copy: `maestro upgrade` may overwrite this very file.
+if [ "${MAESTRO_AUTOUPDATE_REEXEC:-}" != "1" ]; then
+  _tmp="$(mktemp "${TMPDIR:-/tmp}/maestro-autoupdate.XXXXXX")" || exit 0
+  cp "${BASH_SOURCE[0]}" "$_tmp" 2>/dev/null || exit 0
+  MAESTRO_AUTOUPDATE_REEXEC=1 exec /bin/bash "$_tmp" "$@"
+fi
+
+AGENT_DIR="${AGENT_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+cd "$AGENT_DIR" 2>/dev/null || exit 0
+PKG="@cohortapp/agent-sdk"
+LOG_DIR="$AGENT_DIR/logs/autoupdate"; mkdir -p "$LOG_DIR" 2>/dev/null
+LOG="$LOG_DIR/$(date +%Y-%m-%d).log"
+log(){ echo "[$(date -u +%FT%TZ)] $*" >> "$LOG" 2>/dev/null; }
+
+# ── kill-switch ──────────────────────────────────────────────────────────────
+if [ -e "$HOME/.maestro-no-autoupdate" ] || [ -e "$AGENT_DIR/.no-autoupdate" ]; then
+  log "SKIP: kill-switch present"; exit 0
+fi
+
+# ── jitter ───────────────────────────────────────────────────────────────────
+J=$(( RANDOM % 601 )); log "wake; jitter ${J}s"; sleep "$J"
+
+# ── version check ────────────────────────────────────────────────────────────
+CUR="$(node -p "require('$AGENT_DIR/node_modules/$PKG/package.json').version" 2>/dev/null || echo 0.0.0)"
+LATEST="$(npm view "$PKG" version 2>/dev/null || echo '')"
+[ -z "$LATEST" ] && { log "npm view failed; skip (still $CUR)"; exit 0; }
+if [ "$CUR" = "$LATEST" ] || [ "$(printf '%s\n%s\n' "$CUR" "$LATEST" | sort -V | tail -1)" != "$LATEST" ]; then
+  log "up to date ($CUR)"; exit 0
+fi
+log "UPDATE $CUR -> $LATEST"
+
+DAEMON_PLIST="$(ls "$HOME"/Library/LaunchAgents/ai.maestro.*-daemon.plist 2>/dev/null | head -1)"
+DAEMON_LABEL="$(basename "$DAEMON_PLIST" .plist 2>/dev/null)"
+UID_="$(id -u)"
+DLOG="$AGENT_DIR/logs/daemon/daemon-$(date +%Y-%m-%d).log"
+
+restart_daemon(){ [ -n "$DAEMON_LABEL" ] && launchctl kickstart -k "gui/$UID_/$DAEMON_LABEL" >> "$LOG" 2>&1; }
+apply_version(){ # $1 = version spec
+  npm install "$PKG@$1" --save >> "$LOG" 2>&1 || return 1
+  node "$AGENT_DIR/node_modules/$PKG/bin/maestro.mjs" upgrade --force-overwrite >> "$LOG" 2>&1 || log "WARN: upgrade nonzero for $1"
+  return 0
+}
+is_healthy(){ # daemon process alive AND a fresh boot/connect line
+  pgrep -f "$AGENT_DIR/scripts/daemon/maestro-daemon.mjs" >/dev/null 2>&1 || return 1
+  tail -80 "$DLOG" 2>/dev/null | grep -qE "org-mesh connected|daemon\] Running" || return 1
+  return 0
+}
+
+if ! apply_version "$LATEST"; then
+  log "npm install FAILED; aborting, staying on $CUR"; exit 1
+fi
+restart_daemon
+sleep 30
+if is_healthy; then
+  log "OK: healthy on $LATEST"
+else
+  log "UNHEALTHY on $LATEST -> ROLLBACK to $CUR"
+  apply_version "$CUR" || log "WARN: rollback install nonzero"
+  restart_daemon
+  sleep 20
+  is_healthy && log "rolled back to $CUR (healthy)" || log "ROLLBACK health still failing on $CUR — needs operator"
+fi

package/scripts/local-triggers/generate-plists.sh

@@ -293,6 +293,15 @@ generate_plist "ai.maestro.${AGENT_FIRST}-slack-socket" \
     "${AGENT_DIR}/scripts/cadence/launchd-socket-mode-wrapper.sh" \
     "" "" "true"
 
+# 2c. SDK auto-updater (hourly + in-script jitter). Keeps @cohortapp/agent-sdk at
+#     @latest: installs a strictly-newer published version, smart-merges the
+#     copied framework files (`maestro upgrade`), restarts the daemon, and rolls
+#     back if the daemon fails to come up healthy. Kill-switch:
+#     `touch ~/.maestro-no-autoupdate`. See scripts/local-triggers/autoupdate.sh.
+generate_plist "ai.maestro.${AGENT_FIRST}-autoupdate" \
+    "${AGENT_DIR}/scripts/daemon/launchd-wrapper-generic.sh|${AGENT_DIR}/scripts/local-triggers/autoupdate.sh" \
+    "" "3600" ""
+
 # 3. Standard cadence triggers — derived from the canonical STANDARD_CADENCES
 #    in lib/cadences.mjs (the single source of truth), NOT a second hardcoded
 #    list. Previously these were hand-maintained here and drifted from the SoT

package/scripts/local-triggers/generate-plists.test.mjs

@@ -107,10 +107,10 @@ function listPlists(agentRoot) {
 // Tests
 // ---------------------------------------------------------------------------
 
-test("generator emits 23 standard plists with the agent's first name", async () => {
+test("generator emits 24 standard plists with the agent's first name", async () => {
   // Standard inventory (cadence-bus v1 + slack-socket-mode v1), with NO
   // config/.cadence-plists.tsv present (no archetype cadences):
-  //   daemon, poll-relay, slack-socket (3 infra), PLUS one trigger plist per
+  //   daemon, poll-relay, slack-socket, autoupdate (4 infra), PLUS one trigger plist per
   //   STANDARD_CADENCES entry in lib/cadences.mjs (the SoT):
   //   inbox-processor, backlog-executor, meeting-prep, meeting-action-capture,
   //   daily-morning-brief, daily-midday-sweep, daily-evening-wrap,
@@ -120,7 +120,7 @@ test("generator emits 23 standard plists with the agent's first name", async ()
   //   messaging-inbound cadence (1), PLUS the 2026-07 Directory & Design
   //   stewards directory-hygiene + brand-steward (2), PLUS the D3 self-directed
   //   loop goal-steward (1), PLUS the 2026-08 DR cadence nightly-backup (1).
-  //   = 3 infra + 20 trigger = 23 total.
+  //   = 4 infra + 20 trigger = 24 total.
   // org-pulse used to be declared standard but was OMITTED by the old hardcoded
   // list (it never got a plist); deriving from the SoT fixes that drift.
   // The former weekly-* cadences are still ARCHETYPE-DRIVEN (function × altitude),
@@ -130,7 +130,9 @@ test("generator emits 23 standard plists with the agent's first name", async ()
     const r = runGenerator(root);
     assert.equal(r.status, 0, r.stderr);
     const plists = listPlists(root);
-    assert.equal(plists.length, 23, `expected 23 standard plists; got ${plists.join(",")}`);
+    assert.equal(plists.length, 24, `expected 24 standard plists; got ${plists.join(",")}`);
+    assert.ok(plists.includes("ai.maestro.alice-autoupdate.plist"),
+      `autoupdate plist missing; got ${plists.join(",")}`);
     assert.ok(plists.includes("ai.maestro.alice-messaging-inbound.plist"),
       "messaging-inbound (SP10 standard cadence) must get a SoT-derived plist");
     assert.ok(plists.includes("ai.maestro.alice-nightly-backup.plist"),
@@ -203,7 +205,7 @@ test("archetype cadences from config/.cadence-plists.tsv emit extra trigger plis
     const r = runGenerator(root);
     assert.equal(r.status, 0, r.stderr);
     const plists = listPlists(root);
-    assert.equal(plists.length, 25, `expected 23 standard + 2 archetype; got ${plists.join(",")}`);
+    assert.equal(plists.length, 26, `expected 24 standard + 2 archetype; got ${plists.join(",")}`);
     const dir = join(root, "scripts/local-triggers/plists");
     const eng = readFileSync(join(dir, "ai.maestro.erin-engineering-health.plist"), "utf-8");
     assert.match(eng, /<key>Weekday<\/key>\s*<integer>3<\/integer>/); // base64 schedule decoded
@@ -232,12 +234,12 @@ test("NO trigger plist invokes run-trigger.sh", async () => {
     const dir = join(root, "scripts/local-triggers/plists");
     for (const name of listPlists(root)) {
       const body = readFileSync(join(dir, name), "utf-8");
-      // Exception: the daemon/poll-relay/slack-socket plists don't run cadence
-      // triggers at all (the first two are KeepAlive workers; slack-socket is
-      // a KeepAlive WSS listener). The trigger plists must invoke
-      // enqueue-cadence-tick.mjs.
+      // Exception: the daemon/poll-relay/slack-socket/autoupdate plists don't run
+      // cadence triggers at all (daemon + slack-socket are KeepAlive workers;
+      // poll-relay is a 5s poller; autoupdate is an hourly SDK self-updater). The
+      // trigger plists must invoke enqueue-cadence-tick.mjs.
       if (name.endsWith("-daemon.plist") || name.endsWith("-poll-relay.plist") ||
-          name.endsWith("-slack-socket.plist")) {
+          name.endsWith("-slack-socket.plist") || name.endsWith("-autoupdate.plist")) {
         continue;
       }
       assert.ok(!body.includes("run-trigger.sh"),

package/scripts/media-generation/brand-clause.test.mjs

@@ -0,0 +1,135 @@
+/**
+ * brand-clause.test.mjs — generated imagery must not be branded for a company
+ * that does not exist.
+ *
+ * WHAT BROKE
+ *   `buildDefaultPrompt()` appended, to EVERY illustration prompt on EVERY
+ *   deployment: "IMPORTANT: This is for <one fictional company>, an
+ *   institutional-grade AI asset management platform." — while `spec.style`,
+ *   `spec.mood` and `spec.colorPalette` three lines above were already
+ *   parameterised correctly. `gemini-image-client.mjs` then closed every
+ *   refinement pass with "... and <that company>'s brand aesthetic
+ *   requirements", re-asserting a brand the module cannot know.
+ *
+ * WHAT THESE TESTS PIN
+ *   1. GROUNDED — the brand sentence is built from config/company.json (name,
+ *      tagline, description, industry) and config/brand-assets.yaml
+ *      (usage_rules), which bin/maestro.mjs generates per agent.
+ *   2. EMPTY — nothing configured ⇒ NO brand clause is emitted at all. The
+ *      craft direction (which names no company) survives, because it is true on
+ *      any deployment. An unbranded illustration is a correct outcome.
+ *
+ * HOW IT RUNS
+ *   generate-assets.mjs imports "dotenv/config" and gemini-image-client.mjs
+ *   imports "@google/genai" — neither is a dependency of this package, so
+ *   neither module can be imported in-process. The renderers are pure, so we
+ *   lift their REAL source and evaluate it.
+ *
+ * Run: node --test scripts/media-generation/brand-clause.test.mjs
+ */
+
+"use strict";
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+const ASSETS_SRC = readFileSync(new URL("./generate-assets.mjs", import.meta.url), "utf8");
+const GEMINI_SRC = readFileSync(new URL("./gemini-image-client.mjs", import.meta.url), "utf8");
+
+function extractFunction(src, name, file) {
+  const re = new RegExp(`(?:export\\s+)?function\\s+${name}\\s*\\(`);
+  const m = re.exec(src);
+  assert.ok(m, `${file} no longer defines ${name}() — update this test deliberately`);
+  const open = src.indexOf("{", m.index + m[0].length - 1);
+  let depth = 0;
+  for (let i = open; i < src.length; i++) {
+    if (src[i] === "{") depth++;
+    else if (src[i] === "}" && --depth === 0) return src.slice(m.index, i + 1).replace(/^export\s+/, "");
+  }
+  throw new Error(`unbalanced braces extracting ${name}`);
+}
+
+const assetNames = ["configuredStr", "buildBrandClause", "buildDefaultPrompt"];
+const assets = new Function(
+  `${assetNames.map((n) => extractFunction(ASSETS_SRC, n, "generate-assets.mjs")).join("\n\n")}\n` +
+    `return { ${assetNames.join(", ")} };`,
+)();
+const gemini = new Function(
+  `${extractFunction(GEMINI_SRC, "buildRefinementPrompt", "gemini-image-client.mjs")}\nreturn { buildRefinementPrompt };`,
+)();
+
+const { buildBrandClause, buildDefaultPrompt } = assets;
+const { buildRefinementPrompt } = gemini;
+
+const SPEC = { title: "Depot network", purpose: "Board deck cover", elements: ["a map"] };
+
+// ── GROUNDED ────────────────────────────────────────────────────────────────
+
+test("grounded: the brand sentence is built from config/company.json", () => {
+  const clause = buildBrandClause(
+    { name: "Meridian Freight", tagline: "Cold chain, unbroken", industry: "Logistics" },
+    {},
+  );
+  assert.equal(clause, "This is for Meridian Freight — Cold chain, unbroken.");
+});
+
+test("grounded: description or industry stands in when there is no tagline", () => {
+  assert.match(buildBrandClause({ name: "Meridian Freight", description: "Regional logistics." }, {}), /— Regional logistics\./);
+  assert.match(buildBrandClause({ name: "Meridian Freight", industry: "Logistics" }, {}), /— Logistics\./);
+  assert.equal(buildBrandClause({ name: "Meridian Freight" }, {}), "This is for Meridian Freight.");
+});
+
+test("grounded: config/brand-assets.yaml usage_rules pass through verbatim", () => {
+  const clause = buildBrandClause(
+    { name: "Meridian Freight" },
+    { usage_rules: { never: "stretch, rotate, recolour, or modify the assets" } },
+  );
+  assert.match(clause, /Never stretch, rotate, recolour, or modify the assets\./);
+});
+
+test("grounded: the brand clause reaches the prompt", () => {
+  const prompt = buildDefaultPrompt(SPEC, "This is for Meridian Freight — Cold chain, unbroken.");
+  assert.match(prompt, /IMPORTANT: This is for Meridian Freight — Cold chain, unbroken\./);
+  assert.match(prompt, /premium, restrained, and sophisticated/, "craft direction survives");
+});
+
+// ── EMPTY — no config, no brand claim ───────────────────────────────────────
+
+test("empty: the scaffold's UNCONFIGURED company yields NO brand clause", () => {
+  assert.equal(buildBrandClause({ name: "UNCONFIGURED", tagline: "", description: "", industry: "" }, {}), "");
+});
+
+test("empty: a missing/garbage config yields NO brand clause", () => {
+  assert.equal(buildBrandClause({}, {}), "");
+  assert.equal(buildBrandClause(null, null), "");
+  assert.equal(buildBrandClause(undefined, undefined), "");
+});
+
+test("empty: with no brand clause the prompt names NO company at all", () => {
+  const prompt = buildDefaultPrompt(SPEC, "");
+  assert.doesNotMatch(prompt, /This is for/);
+  assert.doesNotMatch(prompt, /UNCONFIGURED/);
+  // The company-agnostic craft direction is still stated — it is true anywhere.
+  assert.match(prompt, /IMPORTANT: The illustration must feel premium, restrained, and sophisticated\./);
+  assert.match(prompt, /Create an illustration for: Depot network/);
+});
+
+test("empty: buildDefaultPrompt defaults to no brand clause when called with one argument", () => {
+  assert.doesNotMatch(buildDefaultPrompt(SPEC), /This is for/);
+});
+
+// ── The refinement pass re-asserts nothing ──────────────────────────────────
+
+test("the refinement prompt preserves the brand STATED ABOVE, it does not name one", () => {
+  const out = buildRefinementPrompt("ORIGINAL PROMPT BODY", "fix the horizon line");
+  assert.match(out, /ORIGINAL PROMPT BODY/);
+  assert.match(out, /fix the horizon line/);
+  assert.match(out, /every brand and style requirement stated above/);
+});
+
+test("neither media-generation source carries a hardcoded brand", () => {
+  assert.doesNotMatch(ASSETS_SRC, /\bNorthwind\b/i);
+  assert.doesNotMatch(GEMINI_SRC, /\bNorthwind\b/i);
+  assert.doesNotMatch(ASSETS_SRC, /institutional-grade AI asset management/i);
+});

package/scripts/media-generation/gemini-image-client.mjs

@@ -1,5 +1,5 @@
 /**
- * Gemini Image Generation Client for Northwind CEO Brain
+ * Gemini Image Generation Client
  *
  * Generates branded illustrations, diagrams, and visual assets for
  * board materials, investor presentations, and corporate communications.
@@ -140,14 +140,20 @@ async function generateViaImagen(ai, model, prompt, aspectRatio) {
 }
 
 /**
- * Generate a refined image by re-generating with enhanced prompt
+ * Build the refinement prompt. Pure, so the wording is testable.
+ *
+ * The closing sentence used to name one specific company's brand aesthetic on
+ * every refinement, for every deployment. The originalPrompt ALREADY carries whatever brand direction the
+ * caller resolved from config/company.json + config/brand-assets.yaml
+ * (generate-assets.mjs#buildBrandClause), so the correct instruction here is to
+ * preserve THAT — not to re-assert a brand this module cannot know.
+ *
+ * @param {string} originalPrompt
+ * @param {string} refinementInstructions
+ * @returns {string}
  */
-export async function generateImageGeminiWithRefinement(
-  originalPrompt,
-  refinementInstructions,
-  options = {},
-) {
-  const enhancedPrompt = `${originalPrompt}
+export function buildRefinementPrompt(originalPrompt, refinementInstructions) {
+  return `${originalPrompt}
 
 ---
 
@@ -158,7 +164,18 @@ ${refinementInstructions}
 ---
 
 Generate a corrected version addressing ALL refinement instructions above while maintaining
-the original composition, concept, and Northwind brand aesthetic requirements.`;
+the original composition, concept, and every brand and style requirement stated above.`;
+}
+
+/**
+ * Generate a refined image by re-generating with enhanced prompt
+ */
+export async function generateImageGeminiWithRefinement(
+  originalPrompt,
+  refinementInstructions,
+  options = {},
+) {
+  const enhancedPrompt = buildRefinementPrompt(originalPrompt, refinementInstructions);
 
   console.log(
     `   [ImageGen] Regenerating with refinement instructions (${refinementInstructions.length} chars)`,
@@ -170,4 +187,5 @@ the original composition, concept, and Northwind brand aesthetic requirements.`;
 export default {
   generateImageGemini,
   generateImageGeminiWithRefinement,
+  buildRefinementPrompt,
 };