fraim-framework 2.0.196 → 2.0.198

package/dist/src/cli/doctor/checks/mcp-connectivity-checks.js

@@ -56,11 +56,51 @@ const toml = __importStar(require("toml"));
 const ide_detector_1 = require("../../setup/ide-detector");
 const fraim_mcp_latest_launcher_1 = require("../../mcp/fraim-mcp-latest-launcher");
 const command_resolution_1 = require("../../mcp/command-resolution");
+const fraim_mcp_diagnostics_1 = require("./fraim-mcp-diagnostics");
 // Cache the npm major version so execFileSync is called at most once per process.
 // Without caching, each IDE config check calls diagnoseFraimMcpLaunchPlan which calls
 // getNpmMajorVersion, and execFileSync blocks the event loop for ~2s on Windows.
 // With 8+ IDE checks running via Promise.all the blocking stacks sequentially.
 let _npmMajorVersionCache = undefined;
+function getGlobalFraimConfigPath() {
+    return path_1.default.join(os_1.default.homedir(), '.fraim', 'config.json');
+}
+function resolveFraimApiKeyForDiagnostics() {
+    const configPath = getGlobalFraimConfigPath();
+    if (process.env.FRAIM_API_KEY) {
+        return {
+            present: true,
+            source: 'env',
+            configPath,
+            apiKey: process.env.FRAIM_API_KEY,
+            fingerprint: (0, fraim_mcp_diagnostics_1.fingerprintSecret)(process.env.FRAIM_API_KEY)
+        };
+    }
+    try {
+        if (!fs_1.default.existsSync(configPath)) {
+            return { present: false, source: 'missing', configPath };
+        }
+        const config = JSON.parse(fs_1.default.readFileSync(configPath, 'utf8'));
+        if (config.apiKey) {
+            return {
+                present: true,
+                source: 'global-config',
+                configPath,
+                apiKey: String(config.apiKey),
+                fingerprint: (0, fraim_mcp_diagnostics_1.fingerprintSecret)(String(config.apiKey))
+            };
+        }
+        return { present: false, source: 'missing', configPath };
+    }
+    catch (error) {
+        return {
+            present: false,
+            source: 'config-error',
+            configPath,
+            error: error.message
+        };
+    }
+}
 function getNpmMajorVersion() {
     if (_npmMajorVersionCache !== undefined) {
         return _npmMajorVersionCache;
@@ -130,7 +170,7 @@ async function testFraimConnectivity() {
                 }
             };
         }
-        const globalConfigPath = path_1.default.join(os_1.default.homedir(), '.fraim', 'config.json');
+        const globalConfigPath = getGlobalFraimConfigPath();
         let apiKey;
         try {
             const config = JSON.parse(fs_1.default.readFileSync(globalConfigPath, 'utf8'));
@@ -164,7 +204,7 @@ async function testFraimConnectivity() {
         }
         // Test connectivity by making a request to the FRAIM server
         const startTime = Date.now();
-        const remoteUrl = process.env.FRAIM_REMOTE_URL || 'https://fraim.wellnessatwork.me';
+        const remoteUrl = process.env.FRAIM_REMOTE_URL || fraim_mcp_diagnostics_1.DEFAULT_FRAIM_REMOTE_URL;
         // Debug: Log what we're testing (helpful for troubleshooting)
         if (process.env.DEBUG_DOCTOR) {
             console.log('[DOCTOR DEBUG] Testing FRAIM connectivity:');
@@ -401,6 +441,24 @@ async function validateIDEMCPConfig(ide) {
                 }
             };
         }
+        if (fraimServer.command) {
+            const keyDiagnostic = resolveFraimApiKeyForDiagnostics();
+            const consistencyDiagnostic = (0, fraim_mcp_diagnostics_1.diagnoseFraimServerConfigConsistency)(fraimServer, {
+                expectedApiKey: keyDiagnostic.apiKey,
+                expectedRemoteUrl: process.env.FRAIM_REMOTE_URL || fraim_mcp_diagnostics_1.DEFAULT_FRAIM_REMOTE_URL
+            });
+            if (consistencyDiagnostic.status !== 'passed') {
+                return {
+                    ...consistencyDiagnostic,
+                    details: {
+                        ...consistencyDiagnostic.details,
+                        configPath,
+                        keySource: keyDiagnostic.source,
+                        keyConfigPath: keyDiagnostic.configPath
+                    }
+                };
+            }
+        }
         // Check for auth header (for HTTP servers)
         if (fraimServer.url) {
             const hasAuth = fraimServer.headers?.Authorization || fraimServer.http_headers?.Authorization;
@@ -432,6 +490,84 @@ async function validateIDEMCPConfig(ide) {
         };
     }
 }
+async function testFraimLocalProxyTroubleshooting() {
+    if (process.env.NODE_ENV === 'test') {
+        return {
+            status: 'warning',
+            message: 'FRAIM local proxy troubleshooting skipped (test mode)',
+            details: {
+                testMode: true,
+                skipped: true,
+                diagnosticVersion: 'fraim-mcp-startup-v1'
+            }
+        };
+    }
+    const keyDiagnostic = resolveFraimApiKeyForDiagnostics();
+    const logPath = path_1.default.join(os_1.default.tmpdir(), fraim_mcp_diagnostics_1.FRAIM_PROXY_LOG_FILE);
+    if (!keyDiagnostic.present || !keyDiagnostic.apiKey) {
+        return {
+            status: 'error',
+            message: 'FRAIM local proxy troubleshooting cannot resolve an API key',
+            suggestion: keyDiagnostic.source === 'config-error'
+                ? `Fix JSON syntax in ${keyDiagnostic.configPath}`
+                : 'Run: fraim setup or set FRAIM_API_KEY before running MCP diagnostics',
+            details: {
+                diagnosticVersion: 'fraim-mcp-startup-v1',
+                keySource: keyDiagnostic.source,
+                keyConfigPath: keyDiagnostic.configPath,
+                keyError: keyDiagnostic.error
+            }
+        };
+    }
+    if (!fs_1.default.existsSync(logPath)) {
+        const classification = 'no-log-file';
+        return {
+            status: 'warning',
+            message: 'FRAIM local proxy log not found',
+            suggestion: (0, fraim_mcp_diagnostics_1.buildAgentDebugSteps)(classification)[0],
+            details: {
+                diagnosticVersion: 'fraim-mcp-startup-v1',
+                classification,
+                interpretation: (0, fraim_mcp_diagnostics_1.interpretationForClassification)(classification),
+                agentDebugSteps: (0, fraim_mcp_diagnostics_1.buildAgentDebugSteps)(classification),
+                logPath,
+                keySource: keyDiagnostic.source,
+                keyFingerprint: keyDiagnostic.fingerprint
+            }
+        };
+    }
+    const logTail = (0, fraim_mcp_diagnostics_1.readFileTailUtf8)(logPath);
+    const analysis = (0, fraim_mcp_diagnostics_1.analyzeFraimProxyLog)(logTail.content, {
+        expectedKey: keyDiagnostic.apiKey,
+        maxLines: 300
+    });
+    const errorClassifications = [
+        'message-processing-failed',
+        'remote-request-failed'
+    ];
+    const passedClassifications = [
+        'local-proxy-forwarded-to-remote'
+    ];
+    const status = errorClassifications.includes(analysis.classification)
+        ? 'error'
+        : passedClassifications.includes(analysis.classification)
+            ? 'passed'
+            : 'warning';
+    return {
+        status,
+        message: `FRAIM local proxy diagnostic: ${analysis.interpretation}`,
+        suggestion: status === 'passed' ? undefined : analysis.agentDebugSteps[0],
+        details: {
+            diagnosticVersion: 'fraim-mcp-startup-v1',
+            logPath,
+            logBytesRead: logTail.bytesRead,
+            logFileSize: logTail.fileSize,
+            keySource: keyDiagnostic.source,
+            keyFingerprint: keyDiagnostic.fingerprint,
+            ...analysis
+        }
+    };
+}
 // ============================================================
 // Issue #532: Stdio MCP Runtime Connectivity Check
 // ============================================================
@@ -447,6 +583,8 @@ const STDIO_HANDSHAKE_TIMEOUT_MS = 15000;
 async function spawnAndHandshake(command, args, timeoutMs = STDIO_HANDSHAKE_TIMEOUT_MS) {
     return new Promise((resolve) => {
         const startTime = Date.now();
+        const keyDiagnostic = resolveFraimApiKeyForDiagnostics();
+        const knownSecrets = keyDiagnostic.apiKey ? [keyDiagnostic.apiKey] : [];
         let spawnCommand;
         let spawnArgs;
         // spawnOptions is typed loosely so we can set windowsVerbatimArguments below.
@@ -492,14 +630,34 @@ async function spawnAndHandshake(command, args, timeoutMs = STDIO_HANDSHAKE_TIME
             });
             return;
         }
+        let settled = false;
+        let initializeResponse = null;
+        let toolsListResponse = null;
+        const settle = (result, killChild = false) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (killChild) {
+                try {
+                    child.stdin?.end();
+                }
+                catch { /* best effort */ }
+                try {
+                    child.kill('SIGTERM');
+                }
+                catch { /* best effort */ }
+            }
+            resolve(result);
+        };
         const timer = setTimeout(() => {
             try {
                 child.kill('SIGKILL');
             }
             catch { /* best effort */ }
-            resolve({
+            settle({
                 status: 'error',
-                phase: 'initialize',
+                phase: initializeResponse ? 'tools-list' : 'initialize',
                 message: `MCP server did not respond within ${timeoutMs}ms`,
                 suggestion: 'The server may be slow to start. Check that the package is installed and npx cache is warm.',
                 details: { command, args, timeoutMs, elapsed: Date.now() - startTime }
@@ -507,46 +665,89 @@ async function spawnAndHandshake(command, args, timeoutMs = STDIO_HANDSHAKE_TIME
         }, timeoutMs);
         let stderrBuffer = '';
         let stdoutBuffer = '';
+        let stdoutLineBuffer = '';
         let spawnError = null;
         child.stderr?.on('data', (d) => {
-            stderrBuffer += d.toString();
+            stderrBuffer = (0, fraim_mcp_diagnostics_1.appendLimited)(stderrBuffer, d.toString());
         });
         child.on('error', (err) => {
             spawnError = err;
         });
+        const handleStdoutLine = (line) => {
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            try {
+                const msg = JSON.parse(trimmed);
+                if (msg?.id === 1 && msg?.result !== undefined) {
+                    initializeResponse = msg;
+                }
+                if (msg?.id === 2 && msg?.result !== undefined) {
+                    toolsListResponse = msg;
+                }
+                if (initializeResponse && toolsListResponse) {
+                    const toolCount = Array.isArray(toolsListResponse.result?.tools)
+                        ? toolsListResponse.result.tools.length
+                        : 0;
+                    const elapsed = Date.now() - startTime;
+                    settle({
+                        status: 'passed',
+                        message: `MCP server responded with ${toolCount} tool(s) in ${elapsed}ms`,
+                        details: { command, args, toolCount, elapsed }
+                    }, true);
+                }
+            }
+            catch {
+                // Ignore non-JSON lines (e.g., startup log output)
+            }
+        };
         child.stdout?.on('data', (d) => {
-            stdoutBuffer += d.toString();
+            const chunk = d.toString();
+            stdoutBuffer = (0, fraim_mcp_diagnostics_1.appendLimited)(stdoutBuffer, chunk);
+            stdoutLineBuffer += chunk;
+            let newlineIndex;
+            while ((newlineIndex = stdoutLineBuffer.indexOf('\n')) !== -1) {
+                const line = stdoutLineBuffer.slice(0, newlineIndex);
+                stdoutLineBuffer = stdoutLineBuffer.slice(newlineIndex + 1);
+                handleStdoutLine(line);
+            }
         });
         child.on('close', (code) => {
+            if (settled)
+                return;
             clearTimeout(timer);
             if (spawnError) {
                 const msg = spawnError.message || '';
                 const isEnoent = msg.includes('ENOENT') || msg.includes('not found');
-                resolve({
+                settle({
                     status: 'error',
                     phase: 'spawn',
                     message: `Failed to start MCP server: ${msg}`,
                     suggestion: isEnoent
                         ? 'Verify that npx is installed. Run: npm install -g npm to update npm/npx.'
                         : 'Check that the required package can be installed via npx.',
-                    details: { command, args, error: msg }
+                    details: { command, args, error: (0, fraim_mcp_diagnostics_1.sanitizeDiagnosticText)(msg, knownSecrets) }
                 });
                 return;
             }
             if (code !== 0 && stdoutBuffer.trim() === '') {
-                resolve({
+                settle({
                     status: 'error',
                     phase: 'spawn',
                     message: `MCP server exited with code ${code} before responding`,
                     suggestion: 'Run: npx -y <package> manually to check for installation errors.',
-                    details: { command, args, exitCode: code, stderr: stderrBuffer.slice(0, 500) }
+                    details: { command, args, exitCode: code, stderr: (0, fraim_mcp_diagnostics_1.sanitizeDiagnosticText)(stderrBuffer.slice(-1000), knownSecrets) }
                 });
                 return;
             }
-            // Parse all JSON-RPC messages received from stdout
+            if (stdoutLineBuffer.trim()) {
+                handleStdoutLine(stdoutLineBuffer);
+            }
+            if (settled)
+                return;
+            // Parse all JSON-RPC messages received from stdout as a fallback for servers
+            // that closed without a trailing newline.
             const lines = stdoutBuffer.split('\n').map((l) => l.trim()).filter(Boolean);
-            let initializeResponse = null;
-            let toolsListResponse = null;
             for (const line of lines) {
                 try {
                     const msg = JSON.parse(line);
@@ -562,17 +763,17 @@ async function spawnAndHandshake(command, args, timeoutMs = STDIO_HANDSHAKE_TIME
                 }
             }
             if (!initializeResponse) {
-                resolve({
+                settle({
                     status: 'error',
                     phase: 'initialize',
                     message: 'MCP server did not return a valid initialize response',
                     suggestion: 'The server may have crashed during startup. Check stderr for error details.',
-                    details: { command, args, exitCode: code, stderr: stderrBuffer.slice(0, 500) }
+                    details: { command, args, exitCode: code, stderr: (0, fraim_mcp_diagnostics_1.sanitizeDiagnosticText)(stderrBuffer.slice(-1000), knownSecrets) }
                 });
                 return;
             }
             if (!toolsListResponse) {
-                resolve({
+                settle({
                     status: 'error',
                     phase: 'tools-list',
                     message: 'MCP server did not respond to tools/list',
@@ -585,7 +786,7 @@ async function spawnAndHandshake(command, args, timeoutMs = STDIO_HANDSHAKE_TIME
                 ? toolsListResponse.result.tools.length
                 : 0;
             const elapsed = Date.now() - startTime;
-            resolve({
+            settle({
                 status: 'passed',
                 message: `MCP server responded with ${toolCount} tool(s) in ${elapsed}ms`,
                 details: { command, args, toolCount, elapsed }
@@ -611,7 +812,6 @@ async function spawnAndHandshake(command, args, timeoutMs = STDIO_HANDSHAKE_TIME
                 params: {}
             }) + '\n';
             child.stdin?.write(toolsMsg);
-            child.stdin?.end();
         }
         catch {
             // stdin may not be writable if the process exited immediately
@@ -686,6 +886,12 @@ function getMCPConnectivityChecks() {
         critical: true,
         run: testFraimConnectivity
     });
+    checks.push({
+        name: 'FRAIM local proxy troubleshooting',
+        category: 'mcpConnectivity',
+        critical: false,
+        run: testFraimLocalProxyTroubleshooting
+    });
     // Check 2: Validate each installed IDE's MCP config
     const installedIDEs = (0, ide_detector_1.detectInstalledIDEs)();
     for (const ide of installedIDEs) {

package/dist/src/cli/utils/org-pack-sync.js

@@ -4,6 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ORG_CACHE_MANAGED_HEADER = exports.ORG_SYNC_METADATA_FILE = exports.ORG_CACHE_DIRNAME = void 0;
+exports.isSafePackPath = isSafePackPath;
+exports.shouldDecorateAsMarkdown = shouldDecorateAsMarkdown;
 exports.getOrgCacheDir = getOrgCacheDir;
 exports.readOrgCacheMetadata = readOrgCacheMetadata;
 exports.getOrgCacheAgeHours = getOrgCacheAgeHours;
@@ -37,6 +39,28 @@ const ORG_PACK_DIRS = ['context', 'rules', 'learnings'];
  * backend response can never write outside the cache directory.
  */
 const SAFE_PACK_RELATIVE_PATH = /^(context|rules|learnings)\/[\w.-]+\.md$/;
+/**
+ * Issue #744: the org brand descriptor is stored ALONGSIDE company info, in the
+ * same org context scope as org_context.md, as a single JSON file. Allow exactly
+ * that path (not arbitrary JSON) so cobranding syncs like org context.
+ */
+const ORG_BRAND_PACK_PATH = 'context/org_brand.json';
+/**
+ * True when a pack-relative path is safe to materialize: a markdown file inside
+ * one of the three org pack dirs, or the org brand descriptor. A single guard
+ * shared by the git and cloud paths.
+ */
+function isSafePackPath(relativePath) {
+    return SAFE_PACK_RELATIVE_PATH.test(relativePath) || relativePath === ORG_BRAND_PACK_PATH;
+}
+/**
+ * Managed-content decoration prepends a markdown "synced from your org" header.
+ * It must only touch markdown — prepending it to org_brand.json would corrupt
+ * the JSON (#744).
+ */
+function shouldDecorateAsMarkdown(relativePath) {
+    return relativePath.toLowerCase().endsWith('.md');
+}
 function getOrgCacheDir() {
     return path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), exports.ORG_CACHE_DIRNAME);
 }
@@ -83,10 +107,12 @@ function collectGitPackFiles(snapshotDir) {
         if (!fs_1.default.existsSync(dirPath))
             continue;
         for (const entry of fs_1.default.readdirSync(dirPath, { withFileTypes: true })) {
-            if (!entry.isFile() || !entry.name.endsWith('.md'))
+            const relativePath = `${dirName}/${entry.name}`;
+            // Markdown in any pack dir, plus the org brand descriptor (#744).
+            if (!entry.isFile() || !isSafePackPath(relativePath))
                 continue;
             files.push({
-                relativePath: `${dirName}/${entry.name}`,
+                relativePath,
                 content: fs_1.default.readFileSync(path_1.default.join(dirPath, entry.name), 'utf8')
             });
         }
@@ -101,7 +127,7 @@ async function fetchCloudPack(remoteUrl, apiKey) {
     const files = Array.isArray(response.data?.files) ? response.data.files : [];
     return {
         files: files.filter((f) => typeof f?.relativePath === 'string' &&
-            SAFE_PACK_RELATIVE_PATH.test(f.relativePath) &&
+            isSafePackPath(f.relativePath) &&
             typeof f?.content === 'string'),
         version: String(response.data?.version ?? '0')
     };
@@ -113,11 +139,15 @@ function materializeCache(files, metadata) {
     fs_1.default.rmSync(stagingDir, { recursive: true, force: true });
     fs_1.default.mkdirSync(stagingDir, { recursive: true });
     for (const file of files) {
-        if (!SAFE_PACK_RELATIVE_PATH.test(file.relativePath))
+        if (!isSafePackPath(file.relativePath))
             continue;
         const destination = path_1.default.join(stagingDir, file.relativePath);
         fs_1.default.mkdirSync(path_1.default.dirname(destination), { recursive: true });
-        fs_1.default.writeFileSync(destination, decorateManagedOrgFile(file.content, metadata.backend));
+        // #744: only markdown gets the managed-content header; JSON is written verbatim.
+        const content = shouldDecorateAsMarkdown(file.relativePath)
+            ? decorateManagedOrgFile(file.content, metadata.backend)
+            : file.content;
+        fs_1.default.writeFileSync(destination, content);
     }
     fs_1.default.writeFileSync(path_1.default.join(stagingDir, exports.ORG_SYNC_METADATA_FILE), JSON.stringify(metadata, null, 2));
     fs_1.default.rmSync(cacheDir, { recursive: true, force: true });

package/dist/src/first-run/types.js

@@ -52,7 +52,7 @@ exports.FIRST_RUN_AGENT_OPTIONS = [
     },
     {
         id: 'copilot-cli',
-        label: 'GitHub Copilot',
+        label: 'GitHub Copilot CLI',
         detectAliases: ['copilot', 'copilot-cli', 'github copilot cli'],
         loginCommand: 'copilot login',
         launchCommand: 'copilot',

package/dist/src/local-mcp-server/learning-context-builder.js

@@ -14,6 +14,8 @@ exports.buildTeamContextSection = buildTeamContextSection;
 exports.resolveTeamContextFiles = resolveTeamContextFiles;
 exports.isTeamContextKey = isTeamContextKey;
 exports.resolveTeamContextFile = resolveTeamContextFile;
+exports.readOrgBrand = readOrgBrand;
+exports.resolveOrgBrandWriteDir = resolveOrgBrandWriteDir;
 exports.countPreservedLearnings = countPreservedLearnings;
 exports.readPreservedLearnings = readPreservedLearnings;
 exports.applyLearningEntryChange = applyLearningEntryChange;
@@ -21,6 +23,7 @@ exports.isTruthyFlag = isTruthyFlag;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
+const brand_store_1 = require("../ai-hub/brand-store");
 const REPO_LEARNINGS_REL = (0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)('personalized-employee/learnings').replace(/\/$/, '');
 const DEFAULT_THRESHOLD = 3.0;
 const AGING_HORIZON_DAYS = 7;
@@ -695,6 +698,44 @@ function resolveTeamContextFile(workspaceRoot, key) {
         scope
     };
 }
+// ---------------------------------------------------------------------------
+// Issue #744 — Org brand (Hub cobranding).
+//
+// The brand descriptor (company name/logo/color) is stored ALONGSIDE company
+// info, in the SAME org context storage as org_context.md (manager directive,
+// spec R7.4), as `context/org_brand.json`. Read resolves with the same org-scope
+// layering as org context (repo-local override → synced org cache → user-level);
+// writes target the same writable location org context edits use.
+// ---------------------------------------------------------------------------
+/** Ordered directories to look for org_brand.json, mirroring org-context layering. */
+function orgBrandCandidateDirs(workspaceRoot) {
+    return [
+        (0, path_1.join)((0, project_fraim_paths_1.getWorkspaceFraimDir)(workspaceRoot), 'personalized-employee', 'context'),
+        (0, path_1.join)((0, project_fraim_paths_1.getUserFraimDirPath)(), 'org', 'context'),
+        (0, path_1.join)((0, project_fraim_paths_1.getUserFraimDirPath)(), 'personalized-employee', 'context'),
+    ];
+}
+/** Read the resolved org brand, or null when none is set on this machine. */
+function readOrgBrand(workspaceRoot) {
+    for (const dir of orgBrandCandidateDirs(workspaceRoot)) {
+        const brand = (0, brand_store_1.readBrandFromDir)(dir);
+        if (brand)
+            return brand;
+    }
+    return null;
+}
+/**
+ * Directory an org-brand edit should be written to. Mirrors org-context write
+ * resolution: the repo-local override dir when the repo carries its own org
+ * context, otherwise the portable user-level context dir (where org onboarding
+ * writes). Never the synced org cache (managed, overwritten on sync).
+ */
+function resolveOrgBrandWriteDir(workspaceRoot) {
+    const loc = resolveTeamContextFile(workspaceRoot, 'org');
+    if (loc.writePath)
+        return (0, path_1.dirname)(loc.writePath);
+    return (0, path_1.join)((0, project_fraim_paths_1.getUserFraimDirPath)(), 'personalized-employee', 'context');
+}
 /**
  * Count the number of `## [P-...]`-style entries inside a preserved learning
  * file. Returns 0 when the file is absent or unreadable. Counts ALL entries

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-framework",
-  "version": "2.0.196",
+  "version": "2.0.198",
   "description": "FRAIM: AI Workforce Infrastructure — the organizational capability that turns AI agents into an accountable workforce, their operators into capable AI managers, and executives into leaders with clear optics on AI proficiency.",
   "main": "index.js",
   "bin": {

package/public/ai-hub/index.html

@@ -12,6 +12,9 @@
     // #700: set the theme pre-paint (no flash). Explicit choice in
     // localStorage wins; otherwise follow the OS preference.
     try{var t=localStorage.getItem('fraim-theme');if(t!=='light'&&t!=='dark'){t=(window.matchMedia&&window.matchMedia('(prefers-color-scheme: dark)').matches)?'dark':'light';}h.setAttribute('data-theme',t);}catch(e){h.setAttribute('data-theme','light');}
+    // #744: apply the cached org brand pre-paint (no flash of FRAIM identity
+    // before company branding). script.js refines the per-theme accent on load.
+    try{var b=JSON.parse(localStorage.getItem('fraim-org-brand')||'null');if(b){if(typeof b.color==='string'&&/^#[0-9a-f]{6}$/i.test(b.color)){h.style.setProperty('--accent',b.color);h.style.setProperty('--accent-strong',b.color);}if(typeof b.name==='string'&&b.name){document.title=b.name+' Hub';}}}catch(e){}
   })();</script>
   <link rel="stylesheet" href="./styles.css?v=conv-panels-20260611b">
   <link rel="stylesheet" href="./review.css">
@@ -20,10 +23,15 @@
 
   <!-- Issue #512: three-area top nav + account menu (surface=hub only). -->
   <nav class="hub-tabs" id="hub-tabs" hidden>
+    <!-- #744: company brand lockup (logo + name), populated from bootstrap.orgBrand. -->
+    <span class="hub-brand" id="hub-brand" hidden></span>
+    <span class="hub-brand-divider" id="hub-brand-divider" hidden></span>
     <button class="hub-tab" type="button" data-area="company">Company</button>
     <button class="hub-tab" type="button" data-area="manager">Manager</button>
     <button class="hub-tab on" type="button" data-area="projects">Projects</button>
     <div class="nav-right">
+      <!-- #744: FRAIM co-mark (co-branding, not white-label) shown when a brand is set. -->
+      <span class="hub-cobrand" id="hub-cobrand" hidden></span>
       <button class="avatar-btn" id="avatar-btn" type="button" title="Account &amp; settings">SM</button>
       <div id="account-menu" class="account-menu">
         <div class="am-header">
@@ -68,6 +76,12 @@
             <div class="area-h1">Company</div>
             <p class="area-lede">Your organization's identity — what you do, how you operate, and the guardrails every employee follows on every job.</p>
             <div id="company-push-banner"></div>
+            <!-- #744: Brand editor — company identity across the Hub. -->
+            <details class="ctx-acc" id="company-brand-acc">
+              <summary><span class="ca-chev">▸</span> <span>🎨 Brand</span>
+                <span class="ca-note">— your company's identity across the Hub, applied for every teammate</span></summary>
+              <div class="ctx-acc-body"><div class="card area-profile" id="company-brand-editor"></div></div>
+            </details>
             <details class="ctx-acc" id="company-ctx-acc">
               <summary><span class="ca-chev">▸</span> <span>🏢 Context &amp; rules</span></summary>
               <div class="ctx-acc-body"><div class="card area-profile" id="company-profile"></div></div>
@@ -199,6 +213,7 @@
           <!-- Onboarding state banner lives ABOVE the accordions so it shows even
                when the Brief is collapsed (so the conversation keeps its height). -->
           <div id="proj-onboarding-banner"></div>
+          <div id="hub-agent-setup-panel" class="hub-agent-setup-panel" data-testid="hub-cli-setup-panel" hidden></div>
           <details class="ctx-acc" id="proj-brief-acc">
             <summary><span class="ca-chev">▸</span> <span>📋 Brief</span>
               <span class="ca-note">— this project's context and rules, captured by Project Onboarding</span></summary>
@@ -839,6 +854,7 @@
         <span class="cp-agent-label">Run with:</span>
         <span id="cp-agent-picker" class="cp-agent-pills"></span>
       </div>
+      <div id="cp-agent-install-panel" class="cp-agent-install-panel" data-testid="cp-cli-setup-panel" hidden></div>
     </div>
   </div>
 
@@ -868,6 +884,6 @@
     </div>
   </div>
 
-  <script src="./script.js?v=conv-persist-20260705"></script>
+  <script src="./script.js?v=persona-mgr-del-20260707"></script>
 </body>
 </html>