IG: private-label leak guard — refuse to post products whose image URL/vendor exposes a hidden upstream (luca/momentum/wallquest/etc.)

4dbe72eabc93003bd232e20dbaf790ea88295c84 · 2026-08-11 11:48:52 -0700 · Steve Abrams

Files touched

M agents/instagram-agent/content.js

Diff

commit 4dbe72eabc93003bd232e20dbaf790ea88295c84
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Aug 11 11:48:52 2026 -0700

    IG: private-label leak guard — refuse to post products whose image URL/vendor exposes a hidden upstream (luca/momentum/wallquest/etc.)
---
 agents/instagram-agent/content.js | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/agents/instagram-agent/content.js b/agents/instagram-agent/content.js
index b5f1b0e..a560bfd 100644
--- a/agents/instagram-agent/content.js
+++ b/agents/instagram-agent/content.js
@@ -46,7 +46,19 @@ function autoCaption(p, url) {
   ].join('\n');
 }
 
-/** Resolve a product → { image_url, caption, title, url }. Throws if not found/imageless. */
+// Hidden upstream-vendor tokens that must NEVER be customer-facing. A public IG image
+// URL or vendor field containing any of these leaks a private label (e.g. the Hollywood
+// line's images are named `luca-vellum_*` — Luca is a Momentum line). Guard skips them.
+const PL_LEAK = [
+  'momentum', 'versa', 'luca', 'wallquest', 'chesapeake', 'nextwall', 'seabrook',
+  'brewster', 'command54', 'command-54', 'desima', 'carlsten', 'nicolette',
+];
+function leakToken(s) {
+  const t = String(s || '').toLowerCase();
+  return PL_LEAK.find((v) => t.includes(v)) || null;
+}
+
+/** Resolve a product → { image_url, caption, title, url }. Throws if not found/imageless/leaky. */
 async function resolveProduct(input) {
   const { handle, store } = handleFrom(input);
   const url = `${store}/products/${handle}.json`;
@@ -56,6 +68,9 @@ async function resolveProduct(input) {
   if (!product) throw new Error(`no product payload for "${handle}"`);
   const img = (product.images && product.images[0] && product.images[0].src) || product.image?.src;
   if (!img) throw new Error(`product "${handle}" has no image`);
+  // Private-label leak guard: the image URL and vendor go public — refuse if either leaks an upstream.
+  const leak = leakToken(img) || leakToken(product.vendor);
+  if (leak) throw new Error(`private-label leak (upstream "${leak}" in image/vendor) — skipped for compliance`);
   const productUrl = `${store}/products/${handle}`;
   return { image_url: img, caption: autoCaption(product, productUrl), title: product.title, url: productUrl };
 }

← c9d175d auto-data-snapshot: 2026-08-11T11:45:12 (1 data files) — age · back to Norma Platform · IG captions: strip internal mfr SKU numbers from title (Koro f0e553d →