@vellumai/assistant 0.10.4-staging.1 → 0.10.4

package/src/plugins/defaults/session/injectors.ts

@@ -0,0 +1,84 @@
+/**
+ * `session` plugin injectors.
+ *
+ * Contributes the session-state per-turn injections: the `<background_turn>`
+ * framing (the guardian isn't watching) and the `<active_subagents>` status
+ * block. Both read their inputs off the {@link TurnContext}; see
+ * {@link DEFAULT_INJECTOR_ORDER} for the global ordering contract.
+ */
+
+import { getConfig } from "../../../config/loader.js";
+import {
+  type InjectionBlock,
+  type Injector,
+  type TurnContext,
+} from "../../types.js";
+import { DEFAULT_INJECTOR_ORDER } from "../injector-order.js";
+
+/**
+ * `background-turn` injector — order 15, prepend-user-tail.
+ *
+ * Wraps the tail user message with a `<background_turn>` block that tells
+ * the assistant the guardian isn't watching and that anything noteworthy
+ * should be surfaced via the `notifications` skill. Fires only when (a) the
+ * conversation's type is "background" or "scheduled" (see
+ * `isBackgroundConversationType`) AND (b) no client is currently connected
+ * (`isNonInteractive`). The second gate is what prevents the reminder from
+ * firing on a manual follow-up the guardian sends into a background thread
+ * — at that point the guardian IS watching, so the framing doesn't apply.
+ *
+ * The inner text is read from `config.conversations.backgroundInjection`, so
+ * operators can edit the reminder without a code change. Setting it to the
+ * empty string disables the injection entirely.
+ */
+const backgroundTurnInjector: Injector = {
+  name: "background-turn",
+  order: DEFAULT_INJECTOR_ORDER.backgroundTurn,
+  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+    if (!ctx.isBackgroundConversation) return null;
+    if (!ctx.isNonInteractive) return null;
+    const inner = getConfig().conversations.backgroundInjection;
+    if (!inner) return null;
+    return {
+      id: "background-turn",
+      text: `<background_turn>\n${inner}\n</background_turn>`,
+      placement: "prepend-user-tail",
+    };
+  },
+};
+
+/**
+ * `subagent-status` injector — order 50, append-user-tail.
+ *
+ * Appends a pre-built `<active_subagents>` block to the tail user message
+ * so the parent LLM has visibility into active/completed child subagents.
+ *
+ * `applyRuntimeInjections` resolves the block from the live subagent manager
+ * before the chain runs; this injector is a thin passthrough that applies
+ * gating and positioning.
+ *
+ * Gating:
+ *  - `mode === "full"`.
+ *  - `subagentStatusBlock` is a non-null, non-empty string.
+ */
+const subagentStatusInjector: Injector = {
+  name: "subagent-status",
+  order: DEFAULT_INJECTOR_ORDER.subagentStatus,
+  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+    const mode = ctx.mode ?? "full";
+    if (mode !== "full") return null;
+    const block = ctx.subagentStatusBlock;
+    if (!block) return null;
+    return {
+      id: "subagent-status",
+      text: block,
+      placement: "append-user-tail",
+    };
+  },
+};
+
+/** The `session` plugin's runtime injectors, in ascending `order`. */
+export const sessionInjectors: Injector[] = [
+  backgroundTurnInjector,
+  subagentStatusInjector,
+];

package/src/plugins/defaults/session/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "default-session",
+  "version": "1.0.0",
+  "description": "First-party default plugin contributing the session-state runtime injectors (background-turn framing and subagent status).",
+  "private": true,
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=20.12.0"
+  },
+  "peerDependencies": {
+    "@vellumai/plugin-api": "^0.8.0"
+  }
+}

package/src/plugins/defaults/surface-completion-nudge/hooks/post-model-call.ts

@@ -45,9 +45,13 @@
  * the `post-model-call` chain — later hooks see (and may override) its decision.
  */
 
-import type { HookFunction, PostModelCallContext } from "@vellumai/plugin-api";
+import type {
+  ContentBlock,
+  HookFunction,
+  Message,
+  PostModelCallContext,
+} from "@vellumai/plugin-api";
 
-import type { ContentBlock, Message } from "../../../../providers/types.js";
 import {
   isSurfaceCompletionNudged,
   markSurfaceCompletionNudged,

package/src/plugins/defaults/task-progress-nudge/hooks/post-tool-use.ts

@@ -15,10 +15,10 @@
  *   a card unnecessary.
  * - A failed or ignored card never blocks the turn.
  *
- * It is scoped to weaker open models (Kimi, DeepSeek, MiniMax) that disregard
- * the static progress-card instruction; capable models follow the prompt and
- * never need the reminder. It also self-targets: a model that already showed a
- * card this turn is never nudged.
+ * It is scoped to weaker open-weight model families (the plugin's own list,
+ * {@link NUDGE_TARGET_MODEL_PATTERN}) that disregard the static progress-card
+ * instruction; models that follow the prompt are never reminded. It also
+ * self-targets: a model that already showed a card this turn is never nudged.
  *
  * The turn state is derived from conversation history on every call (mirroring
  * the tool-error and exploration-drift plugins) so the signal survives
@@ -27,16 +27,17 @@
  * tool_result blocks). Within it we count tool-use rounds and detect whether a
  * `ui_show` task_progress card was issued.
  *
- * Gating:
- * - weaker open models only (Kimi, DeepSeek, MiniMax) — checked first on the
- *   hot path so capable-model turns short-circuit immediately.
- * - mainAgent call site only — background turns (wake, title-gen, memory) and
- *   subagents have no live user watching, so a progress card is pointless.
- * - the client must support dynamic UI — otherwise `ui_show` is blocked
- *   client-side and the nudge would only provoke a wasted, erroring call.
- *
- * The call-site, capability, and subagent gates are resolved lazily on the
- * would-nudge path; the model gate is a cheap regex test run up front.
+ * Gating (cheap `ctx` reads, checked up front so the hot path short-circuits
+ * before scanning history):
+ * - mainAgent call site only — background turns (wake, title-gen, memory) run
+ *   under their own call sites and subagents under `subagentSpawn`, none of
+ *   which have a live user watching a progress card.
+ * - the client must support dynamic UI surfaces — on channels that lack it
+ *   (SMS, phone, email, most chat bridges) `ui_show` is filtered out of the
+ *   tool set, so the nudge would only coach the model toward a tool it cannot
+ *   call.
+ * - a weaker open-weight model family ({@link NUDGE_TARGET_MODEL_PATTERN});
+ *   models that follow the static prompt never need the reminder.
  *
  * Dedup uses a per-conversation high-water mark of the round count at the last
  * nudge: a non-zero mark means "already nudged this turn", which also dedupes
@@ -45,10 +46,12 @@
  * below it (a new turn restarts counting low).
  */
 
-import type { HookFunction, PostToolUseContext } from "@vellumai/plugin-api";
-
-import type { ContentBlock, Message } from "../../../../providers/types.js";
-import { isWeakOpenModel } from "../../../../providers/weak-open-model.js";
+import type {
+  ContentBlock,
+  HookFunction,
+  Message,
+  PostToolUseContext,
+} from "@vellumai/plugin-api";
 
 /**
  * Canonical nudge notice. Module-level constant so tests and wrapping plugins
@@ -67,6 +70,16 @@ export const TASK_PROGRESS_NUDGE_TEXT =
  */
 export const TASK_PROGRESS_NUDGE_ROUND_THRESHOLD = 3;
 
+/**
+ * Weaker open-weight model families (Kimi, DeepSeek, MiniMax, GLM) that tend to
+ * disregard the static progress-card instruction and so benefit from the
+ * mid-turn nudge. This is the plugin's own coaching policy, kept local and
+ * matched against `ctx.model` rather than read off a shared context flag —
+ * "weak" / "needs steering" is a judgement specific to this nudge, not a
+ * general property of the turn, and the set is the plugin owner's to tune.
+ */
+const NUDGE_TARGET_MODEL_PATTERN = /kimi|deepseek|minimax|glm/i;
+
 /**
  * Round count at the last nudge, per conversation. A non-zero entry means the
  * turn has already been nudged; it resets when the round count drops below the
@@ -135,7 +148,14 @@ function scanTurn(messages: ReadonlyArray<Message>): {
 }
 
 const postToolUse: HookFunction<PostToolUseContext> = async (ctx) => {
-  if (!isWeakOpenModel(ctx.model)) return;
+  // These gates are cheap ctx reads, so short-circuit before scanning history:
+  // act only on a live user-facing main-agent turn (subagents run under
+  // `subagentSpawn`, background work under its own call sites), on a client
+  // that can actually render the card, driven by a model family this nudge
+  // targets.
+  if (ctx.callSite !== "mainAgent") return;
+  if (!ctx.supportsDynamicUi) return;
+  if (!NUDGE_TARGET_MODEL_PATTERN.test(ctx.model)) return;
 
   const { rounds, taskProgressShown } = scanTurn(ctx.messages);
 
@@ -157,32 +177,6 @@ const postToolUse: HookFunction<PostToolUseContext> = async (ctx) => {
   if (rounds < TASK_PROGRESS_NUDGE_ROUND_THRESHOLD) return;
   if (lastNudged !== 0) return; // already nudged this turn
 
-  // Resolve gating lazily on the rare would-nudge path to keep the hot path
-  // free of the conversation-registry and subagent module graphs.
-  const { findConversation } =
-    await import("../../../../daemon/conversation-registry.js");
-  const conversation = findConversation(ctx.conversationId);
-  if (!conversation) return;
-
-  if (
-    conversation.currentCallSite &&
-    conversation.currentCallSite !== "mainAgent"
-  ) {
-    return; // background call site — no live user watching
-  }
-
-  const capabilities =
-    conversation.currentTurnChannelCapabilities ??
-    conversation.channelCapabilities;
-  if (capabilities && capabilities.supportsDynamicUi === false) {
-    return; // client cannot render surfaces — a nudge would only error
-  }
-
-  const { getSubagentManager } = await import("../../../../subagent/index.js");
-  if (getSubagentManager().getParentInfo(ctx.conversationId) !== undefined) {
-    return; // subagents have no live user
-  }
-
   lastNudgedRoundsByConversation.set(ctx.conversationId, rounds);
   ctx.logger.info(
     { plugin: "task-progress-nudge", rounds },

package/src/plugins/defaults/title-generate/hooks/stop.ts

@@ -8,7 +8,7 @@
  * recent messages. This hook is the trigger — it retries placeholder titles
  * after successful turns and fires the second-pass regeneration when the
  * conversation reaches its third user turn. The service
- * (`memory/conversation-title-service.ts`) re-checks that the title is still
+ * (`persistence/conversation-title-service.ts`) re-checks that the title is still
  * auto-generated, resolves the title provider, persists, and broadcasts the
  * `conversation_title_updated` / `sync_changed` events.
  *
@@ -18,16 +18,15 @@
  * stateless and means a mid-run array rewrite (compaction) can't invalidate it.
  */
 
-import type { HookFunction, StopContext } from "@vellumai/plugin-api";
+import type { HookFunction, Message, StopContext } from "@vellumai/plugin-api";
 
 import { getConfig } from "../../../../config/loader.js";
-import { getConversation } from "../../../../memory/conversation-crud.js";
+import { getConversation } from "../../../../persistence/conversation-crud.js";
 import {
   AUTO_TITLE_DETERMINISTIC,
   isReplaceableTitle,
   queueRegenerateConversationTitle,
-} from "../../../../memory/conversation-title-service.js";
-import type { Message } from "../../../../providers/types.js";
+} from "../../../../persistence/conversation-title-service.js";
 
 /**
  * User turn at which the second title pass fires. Matches the

package/src/plugins/defaults/title-generate/hooks/user-prompt-submit.ts

@@ -7,7 +7,7 @@
  * threaded through the agent loop. The hook is a pure trigger — it schedules
  * the work and returns; persistence and the resulting
  * `conversation_title_updated` / `sync_changed` broadcast are owned by the
- * title service (see `memory/conversation-title-service.ts`).
+ * title service (see `persistence/conversation-title-service.ts`).
  */
 
 import type {
@@ -15,8 +15,8 @@ import type {
   UserPromptSubmitContext,
 } from "@vellumai/plugin-api";
 
-import { getConversation } from "../../../../memory/conversation-crud.js";
-import { queueGenerateConversationTitle } from "../../../../memory/conversation-title-service.js";
+import { getConversation } from "../../../../persistence/conversation-crud.js";
+import { queueGenerateConversationTitle } from "../../../../persistence/conversation-title-service.js";
 
 const userPromptSubmit: HookFunction<UserPromptSubmitContext> = async (ctx) => {
   // System conversations (background/scheduled) carry a deterministic title

package/src/plugins/defaults/tool-error/hooks/post-tool-use.ts

@@ -22,9 +22,11 @@
  * result for the tool resets its streak.
  */
 
-import type { HookFunction, PostToolUseContext } from "@vellumai/plugin-api";
-
-import type { Message } from "../../../../providers/types.js";
+import type {
+  HookFunction,
+  Message,
+  PostToolUseContext,
+} from "@vellumai/plugin-api";
 
 /**
  * Canonical tool-error coaching text. Kept as a module-level constant so tests

package/src/plugins/defaults/turn-context/injectors.ts

@@ -0,0 +1,52 @@
+/**
+ * `turn-context` plugin injectors.
+ *
+ * Contributes the unified `<turn_context>` block that combines temporal, actor,
+ * channel, and interface grounding into a single per-turn injection. Active in
+ * both `full` and `minimal` mode — turn context is safety-critical grounding
+ * that must survive injection downgrade.
+ */
+
+import type { InjectionBlock, Injector, TurnContext } from "../../types.js";
+import { DEFAULT_INJECTOR_ORDER } from "../injector-order.js";
+import { buildUnifiedTurnContextBlock } from "./unified-turn-context.js";
+
+/**
+ * `unified-turn-context` injector — order 20, prepend-user-tail.
+ *
+ * Injects the `<turn_context>` block that combines temporal, actor, channel,
+ * and interface context. The orchestrator resolves the block's inputs onto the
+ * per-turn {@link TurnContext}; this injector builds the text from them
+ * via `buildUnifiedTurnContextBlock`. Emits nothing when no `timestamp` is
+ * present (the inputs were not resolved for this turn).
+ *
+ * Active in both `full` and `minimal` mode — unified turn context is
+ * safety-critical grounding that must survive injection downgrade.
+ */
+const unifiedTurnContextInjector: Injector = {
+  name: "unified-turn-context",
+  order: DEFAULT_INJECTOR_ORDER.unifiedTurnContext,
+  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+    const { timestamp } = ctx;
+    if (!timestamp) return null;
+    const text = buildUnifiedTurnContextBlock({
+      timestamp,
+      interfaceName: ctx.interfaceName,
+      channelName: ctx.channelName,
+      actorContext: ctx.actorContext,
+      configuredUserTimezone: ctx.configuredUserTimezone,
+      clientTimezone: ctx.clientTimezone,
+      detectedTimezone: ctx.detectedTimezone,
+      timeSinceLastMessage: ctx.timeSinceLastMessage,
+      modelProfile: ctx.modelProfile,
+    });
+    return {
+      id: "unified-turn-context",
+      text,
+      placement: "prepend-user-tail",
+    };
+  },
+};
+
+/** The `turn-context` plugin's runtime injectors. */
+export const turnContextInjectors: Injector[] = [unifiedTurnContextInjector];

package/src/plugins/defaults/turn-context/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "default-turn-context",
+  "version": "1.0.0",
+  "description": "First-party default plugin contributing the unified <turn_context> runtime injector (temporal, actor, channel, and interface grounding).",
+  "private": true,
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=20.12.0"
+  },
+  "peerDependencies": {
+    "@vellumai/plugin-api": "^0.8.0"
+  }
+}

package/src/plugins/defaults/workspace/injectors.ts

@@ -0,0 +1,295 @@
+/**
+ * `workspace` plugin injectors.
+ *
+ * Contributes the workspace-grounding per-turn injections: the disk-pressure
+ * cleanup warning, the `<workspace>` top-level directory context, the
+ * config-quarantine notice, and the NOW.md scratchpad. Each reads its inputs
+ * directly off the {@link TurnContext} (or the workspace files) and runs its own
+ * gating; see {@link DEFAULT_INJECTOR_ORDER} for the global ordering contract.
+ */
+
+import { existsSync, readFileSync, rmSync } from "node:fs";
+
+import type { Message } from "@vellumai/plugin-api";
+
+import { getConfig } from "../../../config/loader.js";
+import type { InjectionMatcher } from "../../../context/strip-injections.js";
+import { findConversationOrSubagent } from "../../../daemon/conversation-registry.js";
+import { resolveWorkspaceTopLevelContext } from "../../../daemon/conversation-workspace.js";
+import { readNowScratchpad } from "../../../daemon/now-scratchpad.js";
+import {
+  isPersonalMemoryAllowed,
+  type TrustContext,
+} from "../../../daemon/trust-context.js";
+import { getConfigQuarantineNoticePath } from "../../../util/platform.js";
+import {
+  type InjectionBlock,
+  type Injector,
+  type TurnContext,
+} from "../../types.js";
+import { hasInjectedUserTextBlock } from "../injection-presence.js";
+import { DEFAULT_INJECTOR_ORDER } from "../injector-order.js";
+
+export const DISK_PRESSURE_WARNING_PROMPT = `<disk_pressure_warning>
+Storage is critically low and normal work is suspended until space is freed.
+
+Your first user-visible paragraph must warn the user that storage is critically low and normal work is suspended.
+
+Before taking cleanup actions, call \`skill_load\` with \`skill: "system-storage-cleanup"\` and follow the cleanup skill.
+
+Unrelated work remains blocked until disk usage drops below the critical threshold or the guardian explicitly overrides the lock. Background processes and trusted-contact messages remain blocked while this cleanup mode is active.
+</disk_pressure_warning>`;
+
+/**
+ * `disk-pressure-warning` injector — order 5, prepend-user-tail.
+ *
+ * Emits the storage cleanup-mode warning at the very top of the user tail when
+ * the turn is restricted to disk-pressure cleanup. Reads the cleanup-mode flag
+ * off the live `Conversation` looked up by conversation id — the agent loop
+ * sets `diskPressureCleanupModeActive` when it classifies the turn's
+ * disk-pressure policy — rather than having the loop thread it as an injection
+ * input.
+ */
+const diskPressureWarningInjector: Injector = {
+  name: "disk-pressure-warning",
+  order: DEFAULT_INJECTOR_ORDER.diskPressureWarning,
+  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+    const conversation = findConversationOrSubagent(ctx.conversationId);
+    if (!conversation?.diskPressureCleanupModeActive) return null;
+    return {
+      id: "disk-pressure-warning",
+      text: DISK_PRESSURE_WARNING_PROMPT,
+      placement: "prepend-user-tail",
+    };
+  },
+};
+
+/**
+ * Matchers that mark a persisted `<workspace>` top-level injection. Uses the
+ * `{ prefix, suffix }` wrapper shape so user-authored text merely starting with
+ * `<workspace>\n` is never mistaken for an injection — matching the full-wrapper
+ * requirement the compaction strip uses for this block. The legacy
+ * `<workspace_top_level>` tag (pre-rename history) counts as present too.
+ */
+const WORKSPACE_BLOCK_MATCHERS: readonly InjectionMatcher[] = [
+  { prefix: "<workspace>\n", suffix: "\n</workspace>" },
+  "<workspace_top_level>",
+];
+
+/**
+ * `workspace-context` injector — order 10, prepend-user-tail.
+ *
+ * Injects the workspace top-level directory context at the very top of the
+ * user tail's content so the assistant sees a workspace grounding block before
+ * any other per-turn context.
+ *
+ * Sources the dirty-guarded top-level cache itself via
+ * {@link resolveWorkspaceTopLevelContext} (keyed by conversation id) rather than
+ * having the agent loop compute and thread it. Decides inject/skip by presence
+ * detection: the block is (re)injected only when it is absent from the working
+ * messages — true on the first turn and right after compaction strips it — and
+ * skipped on normal cached turns where it already persists in history. This
+ * keeps the conversation prefix stable for Anthropic's prefix caching.
+ *
+ * Gating:
+ *  - `mode === "full"` (skipped in minimal mode).
+ *  - the rendered workspace context is a non-null, non-empty string.
+ *  - no `<workspace>` block is already present in `runMessages`.
+ */
+const workspaceContextInjector: Injector = {
+  name: "workspace-context",
+  order: DEFAULT_INJECTOR_ORDER.workspaceContext,
+  async produce(
+    ctx: TurnContext,
+    runMessages?: Message[],
+  ): Promise<InjectionBlock | null> {
+    const mode = ctx.mode ?? "full";
+    if (mode !== "full") return null;
+    const text = resolveWorkspaceTopLevelContext(ctx.conversationId);
+    if (!text) return null;
+    if (hasInjectedUserTextBlock(runMessages, WORKSPACE_BLOCK_MATCHERS))
+      return null;
+    return {
+      id: "workspace-context",
+      text,
+      placement: "prepend-user-tail",
+    };
+  },
+};
+
+/**
+ * Maximum age of a config-quarantine notice before it is considered stale.
+ * After this window the sentinel is deleted and nothing is injected — the
+ * event is no longer actionable context for the agent.
+ */
+const CONFIG_QUARANTINE_NOTICE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+
+/** Shape of the config-quarantine notice sentinel written by the config loader. */
+interface ConfigQuarantineNotice {
+  quarantinedAt: string;
+  quarantinePath: string;
+  originalPath: string;
+}
+
+/**
+ * Read and validate the config-quarantine notice sentinel. Returns the parsed
+ * notice when the file exists and carries the expected string fields, otherwise
+ * `null`. Best-effort: any read/parse error is swallowed and treated as absent.
+ */
+function readConfigQuarantineNotice(): ConfigQuarantineNotice | null {
+  const noticePath = getConfigQuarantineNoticePath();
+  if (!existsSync(noticePath)) return null;
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(noticePath, "utf-8"));
+    if (parsed == null || typeof parsed !== "object") return null;
+    const { quarantinedAt, quarantinePath, originalPath } = parsed as Record<
+      string,
+      unknown
+    >;
+    if (
+      typeof quarantinedAt !== "string" ||
+      typeof quarantinePath !== "string" ||
+      typeof originalPath !== "string"
+    ) {
+      return null;
+    }
+    return { quarantinedAt, quarantinePath, originalPath };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `config-quarantine-notice` injector — order 25, prepend-user-tail.
+ *
+ * Surfaces a recent config-quarantine event to the agent. The config loader
+ * writes a JSON sentinel ({@link getConfigQuarantineNoticePath}) when it
+ * quarantines a corrupt `config.json` and falls back to defaults. This injector
+ * reads that sentinel and, when it is younger than
+ * {@link CONFIG_QUARANTINE_NOTICE_MAX_AGE_MS}, injects a short block telling the
+ * agent the user's settings were reset and where the original is preserved, so
+ * it can explain the change if the user asks about missing settings/API keys —
+ * or mention it proactively when relevant. A stale sentinel is deleted and
+ * nothing is injected.
+ *
+ * Active in both `full` and `minimal` mode — a settings reset is grounding the
+ * agent should not lose to injection downgrade. The block is non-persisted
+ * (re-evaluated every turn) so the notice naturally stops appearing once the
+ * sentinel ages out or is removed.
+ *
+ * Guardian-only: turns driven by non-guardian actors (trusted contacts,
+ * unknown channel senders) must not see workspace file paths or be told the
+ * guardian's settings were reset — the notice is only actionable in guardian
+ * conversations.
+ */
+const configQuarantineNoticeInjector: Injector = {
+  name: "config-quarantine-notice",
+  order: DEFAULT_INJECTOR_ORDER.configQuarantineNotice,
+  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+    if (ctx.trust.trustClass !== "guardian") return null;
+
+    const notice = readConfigQuarantineNotice();
+    if (!notice) return null;
+
+    const quarantinedAtMs = Date.parse(notice.quarantinedAt);
+    const ageMs = Number.isNaN(quarantinedAtMs)
+      ? Number.POSITIVE_INFINITY
+      : Date.now() - quarantinedAtMs;
+    if (ageMs > CONFIG_QUARANTINE_NOTICE_MAX_AGE_MS) {
+      try {
+        rmSync(getConfigQuarantineNoticePath(), { force: true });
+      } catch {
+        // Best-effort cleanup — a failed delete just means we re-check (and
+        // re-attempt deletion) next turn.
+      }
+      return null;
+    }
+
+    const text =
+      `<config_reset_notice>\n` +
+      `The user's config.json was unreadable and was reset to defaults at ` +
+      `${notice.quarantinedAt}. The original file was preserved at ` +
+      `${notice.quarantinePath}. Any custom settings the user had (API keys, ` +
+      `model choices, voice preferences) are still in that file but are not ` +
+      `currently active.\n\n` +
+      `If the user asks why a setting, API key, or preference is missing or ` +
+      `changed, explain this reset and point them at the preserved file to ` +
+      `recover their settings. Otherwise mention it proactively only when it ` +
+      `is clearly relevant — do not interrupt unrelated work.\n` +
+      `</config_reset_notice>`;
+    return {
+      id: "config-quarantine-notice",
+      text,
+      placement: "prepend-user-tail",
+    };
+  },
+};
+
+/** Block prefixes that mark a persisted NOW.md injection. */
+const NOW_MD_BLOCK_PREFIXES = [
+  "<NOW.md Always keep this up to date",
+  "<now_scratchpad>", // backward-compat: pre-rename history
+] as const;
+
+/**
+ * Read the NOW.md scratchpad content for the turn, gated behind the
+ * personal-memory trust gate and the `scratchpadInjection` config toggle.
+ * Returns the trimmed content when both gates admit and the file is non-empty,
+ * otherwise `null`. Sourced from the trust context and the NOW.md file directly
+ * so the `now-md` injector owns its input rather than having it threaded in.
+ */
+function readGatedNowScratchpad(trust: TrustContext): string | null {
+  if (!isPersonalMemoryAllowed(trust)) return null;
+  if (!getConfig().memory.retrieval.scratchpadInjection.enabled) return null;
+  return readNowScratchpad();
+}
+
+/**
+ * `now-md` injector — order 40, after-memory-prefix.
+ *
+ * Injects the NOW.md scratchpad content as
+ * `<NOW.md Always keep this up to date; keep under 10 lines>...` after any
+ * memory-prefix blocks. NOW.md is workspace state independent of PKB, so it
+ * lives in the workspace plugin even though it splices at the memory boundary.
+ *
+ * Gating:
+ *  - `mode === "full"` (skipped in minimal mode).
+ *  - The personal-memory trust gate admits the actor, the `scratchpadInjection`
+ *    config toggle is on, and NOW.md has content (see
+ *    {@link readGatedNowScratchpad}).
+ *  - The NOW.md block is not already present in the turn's working messages.
+ *    Like `<knowledge_base>`, the block is injected once and then persists in
+ *    history, so it only needs (re)injecting on the first turn and right after
+ *    compaction strips it — both of which leave the working messages without
+ *    the block. Skipping when it is present keeps the conversation prefix
+ *    stable for Anthropic's prefix caching and avoids a duplicate splice.
+ */
+const nowMdInjector: Injector = {
+  name: "now-md",
+  order: DEFAULT_INJECTOR_ORDER.nowMd,
+  async produce(
+    ctx: TurnContext,
+    runMessages?: Message[],
+  ): Promise<InjectionBlock | null> {
+    const mode = ctx.mode ?? "full";
+    if (mode !== "full") return null;
+    const content = readGatedNowScratchpad(ctx.trust);
+    if (!content) return null;
+    if (hasInjectedUserTextBlock(runMessages, NOW_MD_BLOCK_PREFIXES))
+      return null;
+    const text = `<NOW.md Always keep this up to date; keep under 10 lines>\n${content}\n</NOW.md>`;
+    return {
+      id: "now-md",
+      text,
+      placement: "after-memory-prefix",
+    };
+  },
+};
+
+/** The `workspace` plugin's runtime injectors, in ascending `order`. */
+export const workspaceInjectors: Injector[] = [
+  diskPressureWarningInjector,
+  workspaceContextInjector,
+  configQuarantineNoticeInjector,
+  nowMdInjector,
+];