@vellumai/assistant 0.6.6 → 0.7.0

package/src/plugins/defaults/index.ts

@@ -52,7 +52,7 @@ import { defaultToolResultTruncatePlugin } from "./tool-result-truncate.js";
  * contents are read at call time, after every imported plugin identifier is
  * guaranteed initialized.
  */
-export function getAllDefaultPlugins(): readonly Plugin[] {
+function getAllDefaultPlugins(): readonly Plugin[] {
   return [
     defaultLlmCallPlugin,
     defaultToolExecutePlugin,

package/src/plugins/defaults/injectors.ts

@@ -71,7 +71,7 @@ const PKB_HINT_THRESHOLD = 0.5;
 const PKB_HINT_ARCHIVE_THRESHOLD = 0.7;
 
 /**
- * Fixed order values for the seven default injectors. Exported so tests —
+ * Fixed order values for the eight default injectors. Exported so tests —
  * and any future integration code — can assert ordering without re-deriving
  * the constants.
  *
@@ -105,7 +105,7 @@ function readInjectionInputs(ctx: TurnContext): TurnInjectionInputs {
  *  - `mode === "full"` (skipped in minimal mode).
  *  - `workspaceTopLevelContext` is a non-null, non-empty string.
  */
-export const workspaceContextInjector: Injector = {
+const workspaceContextInjector: Injector = {
   name: "workspace-context",
   order: DEFAULT_INJECTOR_ORDER.workspaceContext,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -133,7 +133,7 @@ export const workspaceContextInjector: Injector = {
  * Active in both `full` and `minimal` mode — unified turn context is
  * safety-critical grounding that must survive injection downgrade.
  */
-export const unifiedTurnContextInjector: Injector = {
+const unifiedTurnContextInjector: Injector = {
   name: "unified-turn-context",
   order: DEFAULT_INJECTOR_ORDER.unifiedTurnContext,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -157,16 +157,16 @@ export const unifiedTurnContextInjector: Injector = {
  * yielding `[...memory, <system_reminder>, <knowledge_base>, ...user text]`.
  *
  * Emitting context and reminder as two separate blocks (rather than a single
- * concatenated text) preserves the pre-migration two-ContentBlock shape that
- * the rehydration path in `conversation-lifecycle.ts` recreates — keeping
- * fresh-injection and rehydrated-history structurally identical so
- * Anthropic's prefix cache matches across reloads.
+ * concatenated text) produces the two-ContentBlock shape that the rehydration
+ * path in `conversation-lifecycle.ts` recreates — keeping fresh-injection and
+ * rehydrated-history structurally identical so Anthropic's prefix cache
+ * matches across reloads.
  *
  * Gating:
  *  - `mode === "full"`.
  *  - Non-null, non-empty `pkbContext`.
  */
-export const pkbContextInjector: Injector = {
+const pkbContextInjector: Injector = {
   name: "pkb-context",
   order: DEFAULT_INJECTOR_ORDER.pkbContext,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -189,13 +189,13 @@ export const pkbContextInjector: Injector = {
  * hints) as its own after-memory-prefix splice. Higher `order` than
  * `pkb-context` so the reminder splices second and ends up immediately
  * after the memory prefix, pushing `<knowledge_base>` one slot further
- * down — matching the pre-migration [reminder, context] ordering.
+ * down — producing a [reminder, context] ordering.
  *
  * Gating:
  *  - `mode === "full"`.
  *  - `pkbActive === true`.
  */
-export const pkbReminderInjector: Injector = {
+const pkbReminderInjector: Injector = {
   name: "pkb-reminder",
   order: DEFAULT_INJECTOR_ORDER.pkbReminder,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -215,9 +215,7 @@ export const pkbReminderInjector: Injector = {
 /**
  * Render the PKB context block — wraps the raw content in
  * `<knowledge_base>...</knowledge_base>` while escaping any closing tags
- * inside the content that would break out of the XML wrapper. Mirrors the
- * body of the pre-migration `injectPkbContext` helper exactly so the emitted
- * bytes match.
+ * inside the content that would break out of the XML wrapper.
  */
 function buildPkbContextBlock(content: string): string {
   const escaped = content.replace(
@@ -309,7 +307,7 @@ async function buildPkbReminderWithHints(
  *  - `mode === "full"` (skipped in minimal mode).
  *  - `nowScratchpad` is a non-null, non-empty string.
  */
-export const nowMdInjector: Injector = {
+const nowMdInjector: Injector = {
   name: "now-md",
   order: DEFAULT_INJECTOR_ORDER.nowMd,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -341,7 +339,7 @@ export const nowMdInjector: Injector = {
  *  - `mode === "full"`.
  *  - `subagentStatusBlock` is a non-null, non-empty string.
  */
-export const subagentStatusInjector: Injector = {
+const subagentStatusInjector: Injector = {
   name: "subagent-status",
   order: DEFAULT_INJECTOR_ORDER.subagentStatus,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -367,10 +365,9 @@ export const subagentStatusInjector: Injector = {
  * orchestrator builds the transcript via `loadSlackChronologicalMessages`
  * before the chain runs.
  *
- * The injector preserves the pre-migration memory-block prepending
- * behaviour: `extractMemoryPrefixBlocks` is re-applied to the Slack
- * transcript's tail user message inside `applyRuntimeInjections` when the
- * replacement fires.
+ * Memory-block prepending is preserved across the replacement:
+ * `extractMemoryPrefixBlocks` is re-applied to the Slack transcript's tail
+ * user message inside `applyRuntimeInjections` when the replacement fires.
  *
  * Active in both `full` and `minimal` mode — Slack transcript replacement
  * is not a high-token optional block, it's the canonical view of Slack
@@ -380,7 +377,7 @@ export const subagentStatusInjector: Injector = {
  *  - `channelCapabilities.channel === "slack"`.
  *  - `slackChronologicalMessages` has at least one entry.
  */
-export const slackMessagesInjector: Injector = {
+const slackMessagesInjector: Injector = {
   name: "slack-messages",
   order: DEFAULT_INJECTOR_ORDER.slackMessages,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -419,7 +416,7 @@ export const slackMessagesInjector: Injector = {
  *    (non-DM Slack conversation).
  *  - `slackActiveThreadFocusBlock` is a non-empty string.
  */
-export const threadFocusInjector: Injector = {
+const threadFocusInjector: Injector = {
   name: "thread-focus",
   order: DEFAULT_INJECTOR_ORDER.threadFocus,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {

package/src/plugins/defaults/llm-call.ts

@@ -1,6 +1,6 @@
 /**
- * Default `llmCall` plugin — a true passthrough that declares the pipeline
- * surface and always yields to downstream middleware.
+ * Default `llmCall` plugin — a passthrough that declares the pipeline
+ * surface and yields to downstream middleware.
  *
  * The plugin system wraps every LLM request in the `llmCall` pipeline. The
  * actual call to {@link Provider.sendMessage} lives in the `runPipeline`
@@ -8,13 +8,10 @@
  * contribute the manifest (`provides.llmCall: "v1"`) so other plugins can
  * negotiate against the pipeline surface.
  *
- * Because this plugin is registered at module load — BEFORE user plugins are
- * loaded by `bootstrapPlugins()` — it sits at the outermost layer in
- * `composeMiddleware`'s onion ordering. If its middleware called
- * `provider.sendMessage` directly (instead of `next(args)`) it would
- * short-circuit the chain and silently disable every user-registered
- * `llmCall` middleware in production. The middleware therefore just forwards
- * to `next(args)`.
+ * This plugin registers at module load — before user plugins are loaded by
+ * `bootstrapPlugins()` — so it sits at the outermost layer in
+ * `composeMiddleware`'s onion ordering. To keep user-registered middleware
+ * reachable, the middleware forwards unconditionally via `next(args)`.
  *
  * Registered from `daemon/external-plugins-bootstrap.ts` via a side-effect
  * import so the plugin is present in the registry before

package/src/plugins/defaults/memory-retrieval.ts

@@ -121,15 +121,10 @@ export async function runDefaultMemoryRetrieval(
     };
   }
 
-  // `prepareMemory` requires a non-optional signal. In production the agent
-  // loop always threads one via `args.signal`; the fallback `AbortController`
-  // keeps direct callers (e.g. tests that skip the pipeline) working without
-  // forcing every call site to synthesize a dummy signal.
-  const abortSignal = args.signal ?? new AbortController().signal;
   const graphResult = await deps.graphMemory.prepareMemory(
     deps.messages,
     deps.config,
-    abortSignal,
+    args.signal,
     deps.onEvent,
   );
 

package/src/plugins/defaults/overflow-reduce.ts

@@ -12,11 +12,15 @@
  * callbacks carried on {@link OverflowReduceArgs}; the plugin itself has no
  * access to the agent-loop context object.
  *
- * Internal calls to `ContextWindowManager` remain direct — pipeline layering
- * ends at the top of the reducer, not within the forced-compaction tier.
- * The supplied `compactFn` delegates straight into the context window
- * manager, so only the tier-loop orchestration goes through the pipeline
- * runner.
+ * The forced-compaction tier runs through the orchestrator-supplied
+ * `compactFn`, which routes into the `compaction` plugin pipeline so
+ * registered compaction middleware observes reducer-initiated invocations
+ * alongside the orchestrator-owned call sites. Non-compaction tiers
+ * (tool-result truncation, media stubbing, injection downgrade) remain
+ * in-process: they mutate message arrays directly without crossing a
+ * pipeline boundary. The reducer itself runs under the `overflowReduce`
+ * pipeline, so the full layering is `overflowReduce` → reducer tier loop
+ * → (for the forced-compaction tier only) nested `compaction` pipeline.
  */
 
 import type { ContextWindowCompactOptions } from "../../context/window-manager.js";

package/src/plugins/defaults/token-estimate.ts

@@ -17,9 +17,8 @@
  * {@link import("../../context/token-estimator.js").estimatePromptTokens estimatePromptTokens},
  * which applies the EWMA calibration correction recorded from past provider
  * responses. Preflight + mid-loop checks must use the calibrated estimate —
- * before this pipeline existed, both call sites invoked `estimatePromptTokens`
- * directly, and the calibrated estimate is what keeps the overflow gate
- * consistent with the convergence path in the reducer. The pre-send
+ * the calibrated value keeps the overflow gate consistent with the
+ * convergence path in the reducer. The pre-send
  * calibration capture in `agent/loop.ts` still uses `estimatePromptTokensRaw`
  * on purpose — the calibrator must learn against the raw estimate so the EWMA
  * converges against provider ground truth rather than chasing its own

package/src/plugins/registry.ts

@@ -78,6 +78,19 @@ export const ASSISTANT_API_VERSIONS: Record<string, string[]> = {
  */
 const registeredPlugins = new Map<string, Plugin>();
 
+/**
+ * Latch that closes the per-boot registration window. Flipped to `true` by
+ * {@link closeRegistration} once `loadUserPlugins()` has returned. After that,
+ * any attempt to register a *new* plugin throws — this is the safety net
+ * against a user plugin whose dynamic `import()` was timed out but whose
+ * top-level `await` later resolves and still tries to call
+ * {@link registerPlugin}. Without the latch such a late arrival would land in
+ * the registry after `bootstrapPlugins()` has already walked it, leaving the
+ * plugin visible to `getMiddlewaresFor()` / `getInjectors()` with its
+ * `init()` hook never invoked.
+ */
+let registrationClosed = false;
+
 // ─── Registration ────────────────────────────────────────────────────────────
 
 /**
@@ -139,7 +152,10 @@ export function registerPlugin(plugin: Plugin): void {
   }
 
   // Duplicate-name check — plugins must be uniquely addressable in logs,
-  // storage paths, and error messages.
+  // storage paths, and error messages. Runs BEFORE the closed-registration
+  // check so `registerDefaultPlugins()` (which replays every default even
+  // after the registration window closes) keeps seeing the familiar
+  // "already registered" error it catches and swallows.
   if (registeredPlugins.has(name)) {
     throw new PluginExecutionError(
       `plugin ${name} is already registered`,
@@ -147,6 +163,17 @@ export function registerPlugin(plugin: Plugin): void {
     );
   }
 
+  // Closed-registration check — rejects a genuinely new plugin that arrives
+  // after {@link closeRegistration}. The canonical offender is a user plugin
+  // whose dynamic `import()` was timed out in `loadUserPlugins()` but whose
+  // module evaluation eventually completes and still calls this function.
+  if (registrationClosed) {
+    throw new PluginExecutionError(
+      `plugin ${name} cannot register: plugin registration is closed (late arrival after loadUserPlugins() returned)`,
+      name,
+    );
+  }
+
   // Capability negotiation. Every plugin must negotiate against
   // `pluginRuntime`; we enforce that by requiring an entry to exist rather
   // than special-casing it here, so the per-entry mismatch error is uniform.
@@ -219,6 +246,35 @@ export function getInjectors(): Injector[] {
   return out;
 }
 
+/**
+ * Close the per-boot registration window. After this call, any attempt to
+ * register a genuinely new plugin throws a {@link PluginExecutionError}.
+ * Re-registering an already-registered plugin still hits the duplicate-name
+ * check first (so idempotent callers like `registerDefaultPlugins()` keep
+ * working unchanged).
+ *
+ * Called by `loadUserPlugins()` immediately before it returns so the
+ * `bootstrapPlugins()` invariant ("registry has been fully populated for this
+ * boot cycle") cannot be violated by a user plugin whose dynamic `import()`
+ * timed out mid-load but whose top-level `await` resolves later and still
+ * reaches `registerPlugin()`. Idempotent.
+ */
+export function closeRegistration(): void {
+  registrationClosed = true;
+}
+
+/**
+ * Remove a plugin from the registry. Invoked from the bootstrap's failure path
+ * after {@link Plugin.onShutdown} and contribution teardown have run, so
+ * {@link getMiddlewaresFor} and {@link getInjectors} no longer expose a
+ * plugin whose `init()` aborted mid-bootstrap. Without this, every subsequent
+ * pipeline invocation would re-enter the uninitialized plugin's middleware.
+ * Safe to call on an already-absent name (no-op).
+ */
+export function unregisterPlugin(name: string): void {
+  registeredPlugins.delete(name);
+}
+
 // ─── Test hooks ──────────────────────────────────────────────────────────────
 
 /**
@@ -238,4 +294,8 @@ export function resetPluginRegistryForTests(): void {
     );
   }
   registeredPlugins.clear();
+  // Re-open the registration window so subsequent tests can register plugins
+  // again. Without this, the latch set by a prior `closeRegistration()` call
+  // would leak across test cases and reject legitimate registrations.
+  registrationClosed = false;
 }

package/src/plugins/types.ts

@@ -27,11 +27,11 @@ import type {
   ChannelCapabilities,
   ChannelCommandContext,
   InjectionMode,
-  TrustContext,
 } from "../daemon/conversation-runtime-assembly.js";
 import type { RepairResult } from "../daemon/history-repair.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import type { PkbContextConversation } from "../daemon/pkb-context-tracker.js";
+import type { TrustContext } from "../daemon/trust-context.js";
 import type { QdrantSparseVector } from "../memory/qdrant-client.js";
 import type {
   ContentBlock,
@@ -110,7 +110,7 @@ export interface PluginInitContext {
    * to avoid pulling pino into the types module.
    */
   logger: unknown;
-  /** Absolute path to `~/.vellum/plugins-data/<plugin>/` (created by bootstrap). */
+  /** Absolute path to `<workspaceDir>/plugins-data/<plugin>/` (created by bootstrap). */
   pluginStorageDir: string;
   /** Assistant semver for compatibility checks inside the plugin. */
   assistantVersion: string;
@@ -236,7 +236,7 @@ export interface MemoryArgs {
   readonly conversationId: string;
   readonly trustContext: TrustContext | undefined;
   readonly turnIndex: number;
-  readonly signal?: AbortSignal;
+  readonly signal: AbortSignal;
 }
 
 /**
@@ -411,7 +411,7 @@ export interface OverflowReduceArgs {
    * mutable shared state. Returns the new `runMessages`.
    *
    * Two distinct "did compact" signals are passed so the orchestrator can
-   * match the pre-PR-23 semantics:
+   * apply the correct per-iteration vs sticky gating:
    * - `stepCompacted` — whether THIS iteration's reducer step produced a
    *   fresh compaction. Gates PKB / NOW re-injection: compaction strips the
    *   existing blocks, so only iterations that just compacted need the
@@ -921,9 +921,8 @@ export interface TurnContext {
  *   user's typed text (e.g. subagent status, slack active-thread focus).
  * - `"after-memory-prefix"` — insert the block immediately after any leading
  *   memory-prefix blocks (`<memory_context>`, `<memory __injected>`) on the
- *   tail user message. Preserves the splice behaviour of `injectPkbContext`
- *   and `injectNowScratchpad` so memory/PKB/NOW ordering matches the
- *   pre-migration output byte-for-byte.
+ *   tail user message. Keeps memory/PKB/NOW in their canonical relative
+ *   order regardless of how many after-memory-prefix blocks are spliced.
  * - `"replace-run-messages"` — replace the full `runMessages` array with the
  *   block's `messagesOverride`. Used by the Slack chronological-transcript
  *   injector (the transcript is a whole new message list rendered from the

package/src/plugins/user-loader.ts

@@ -1,17 +1,16 @@
 /**
- * User plugin loader — discovers plugins under `~/.vellum/plugins/*` and
+ * User plugin loader — discovers plugins under `<workspaceDir>/plugins/*` and
  * invokes each plugin's registration side effect via a dynamic import.
  *
- * A user plugin is a directory under `vellumRoot()/plugins/` that contains a
+ * A user plugin is a directory under `getWorkspaceDir()/plugins/` that contains a
  * `register.ts` (or `register.js` after compilation). The file is expected to
  * call {@link registerPlugin} at import time so the plugin ends up in the
  * registry before {@link bootstrapPlugins} runs during daemon startup.
  *
  * The loader deliberately:
  *
- * - Uses {@link vellumRoot} rather than `homedir()` directly so the
- *   multi-instance invariant in the root CLAUDE.md holds — each instance
- *   loads its own plugin set from its own `.vellum` directory.
+ * - Uses `getWorkspaceDir()` so each instance loads its own plugin set
+ *   when `VELLUM_WORKSPACE_DIR` is set.
  * - Prefers `register.js` over `register.ts` when both exist (compiled plugins
  *   always win; this matches how `bun`/Node consumers resolve modules at
  *   runtime in the compiled binary).
@@ -39,7 +38,8 @@ import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 
 import { getLogger } from "../util/logger.js";
-import { vellumRoot } from "../util/platform.js";
+import { getWorkspaceDir } from "../util/platform.js";
+import { closeRegistration } from "./registry.js";
 
 const log = getLogger("user-plugin-loader");
 
@@ -55,13 +55,13 @@ const log = getLogger("user-plugin-loader");
 const USER_PLUGIN_IMPORT_TIMEOUT_MS = 10_000;
 
 /**
- * Scan `vellumRoot()/plugins/` for subdirectories containing a
+ * Scan `getWorkspaceDir()/plugins/` for subdirectories containing a
  * `register.{ts,js}` file, and dynamic-import each one so the module's
  * side-effecting {@link registerPlugin} calls populate the registry.
  *
  * Invariants:
  *
- * - No-ops when `vellumRoot()/plugins/` does not exist — a clean install with
+ * - No-ops when `getWorkspaceDir()/plugins/` does not exist — a clean install with
  *   zero user plugins must not generate errors.
  * - Per-plugin isolation: a failing import is logged and skipped. The
  *   function resolves normally even when every plugin fails to load.
@@ -77,12 +77,16 @@ export async function loadUserPlugins(
 ): Promise<void> {
   const importTimeoutMs =
     options.importTimeoutMs ?? USER_PLUGIN_IMPORT_TIMEOUT_MS;
-  const pluginsDir = join(vellumRoot(), "plugins");
+  const pluginsDir = join(getWorkspaceDir(), "plugins");
   if (!existsSync(pluginsDir)) {
     log.debug(
       { pluginsDir },
       "loadUserPlugins: no plugins directory — skipping",
     );
+    // Close the registration window even on the fast path so a late arrival
+    // from an unrelated source (e.g. a mis-ordered static import) still can't
+    // slip in after bootstrap walks the registry.
+    closeRegistration();
     return;
   }
 
@@ -97,6 +101,7 @@ export async function loadUserPlugins(
       { err, pluginsDir },
       "loadUserPlugins: failed to read plugins directory",
     );
+    closeRegistration();
     return;
   }
 
@@ -149,8 +154,21 @@ export async function loadUserPlugins(
           importTimeoutMs,
         );
       });
-      const result = await Promise.race([import(moduleUrl), timeoutPromise]);
+      // Retain the import promise so we can attach a terminal `.catch` on the
+      // timeout branch. `Promise.race` does not cancel the losing promise —
+      // the module evaluation keeps running in the background even after we
+      // stop awaiting it, and if it eventually throws (either from the
+      // module body or from the late `registerPlugin()` hitting a closed
+      // registry) an unhandled rejection would crash the daemon.
+      const importPromise = import(moduleUrl);
+      const result = await Promise.race([importPromise, timeoutPromise]);
       if (result === timeoutSentinel) {
+        importPromise.catch(() => {
+          // Abandoned import completed (or threw) after the timeout. The
+          // closed-registration latch in registry.ts guarantees any late
+          // `registerPlugin()` call is rejected, so swallowing the outcome
+          // here is the safe default.
+        });
         log.warn(
           { pluginDir, registerPath, timeoutMs: importTimeoutMs },
           `Timed out loading user plugin ${pluginDir} after ${importTimeoutMs}ms — skipping`,
@@ -174,4 +192,12 @@ export async function loadUserPlugins(
       if (timeoutHandle !== undefined) clearTimeout(timeoutHandle);
     }
   }
+
+  // Close the registration window once every candidate plugin has been
+  // awaited (or timed out). The per-plugin try/catch guarantees no throw
+  // escapes the loop, so this line always runs. Any abandoned import that
+  // later resolves and reaches `registerPlugin()` is rejected by the latch,
+  // preserving the `bootstrapPlugins()` invariant that the registry is
+  // fully populated before it is walked.
+  closeRegistration();
 }

package/src/prompts/__tests__/system-prompt-memory-v2.test.ts

@@ -0,0 +1,197 @@
+/**
+ * Tests for the memory-v2 autoload block in buildSystemPrompt.
+ *
+ * Verifies that when the `memory-v2-enabled` feature flag is on, the four
+ * top-level memory files (essentials/threads/recent/buffer) are appended to
+ * the dynamic suffix in order, each wrapped in a Markdown header. With the
+ * flag off, none of these files leak into the prompt — even if present.
+ */
+
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+const TEST_DIR = process.env.VELLUM_WORKSPACE_DIR!;
+
+const noopLogger: Record<string, unknown> = new Proxy(
+  {} as Record<string, unknown>,
+  {
+    get: (_target, prop) => (prop === "child" ? () => noopLogger : () => {}),
+  },
+);
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realLogger = require("../../util/logger.js");
+mock.module("../../util/logger.js", () => ({
+  ...realLogger,
+  getLogger: () => noopLogger,
+  getCliLogger: () => noopLogger,
+  truncateForLog: (v: string) => v,
+  initLogger: () => {},
+  pruneOldLogFiles: () => 0,
+}));
+
+const mockLoadedConfig: Record<string, unknown> = {};
+
+mock.module("../../config/loader.js", () => ({
+  getConfig: () => ({
+    ui: {},
+    services: {
+      inference: {
+        mode: "your-own",
+        provider: "anthropic",
+        model: "claude-opus-4-6",
+      },
+      "image-generation": {
+        mode: "your-own",
+        provider: "gemini",
+        model: "gemini-3.1-flash-image-preview",
+      },
+      "web-search": { mode: "your-own", provider: "inference-provider-native" },
+    },
+  }),
+  loadConfig: () => mockLoadedConfig,
+  loadRawConfig: () => ({}),
+  saveConfig: () => {},
+  saveRawConfig: () => {},
+  invalidateConfigCache: () => {},
+  getNestedValue: () => undefined,
+  setNestedValue: () => {},
+}));
+
+const { _setOverridesForTesting } =
+  await import("../../config/assistant-feature-flags.js");
+const { buildSystemPrompt, SYSTEM_PROMPT_CACHE_BOUNDARY } =
+  await import("../system-prompt.js");
+
+const MEMORY_FILES = [
+  "essentials.md",
+  "threads.md",
+  "recent.md",
+  "buffer.md",
+] as const;
+
+const ALL_HEADINGS = ["## Essentials", "## Threads", "## Recent", "## Buffer"];
+
+function writeMemoryFile(name: string, body: string): void {
+  const memoryDir = join(TEST_DIR, "memory");
+  mkdirSync(memoryDir, { recursive: true });
+  writeFileSync(join(memoryDir, name), body);
+}
+
+function cleanupMemoryDir(): void {
+  const memoryDir = join(TEST_DIR, "memory");
+  if (existsSync(memoryDir))
+    rmSync(memoryDir, { recursive: true, force: true });
+}
+
+function expectNoHeadings(result: string): void {
+  for (const heading of ALL_HEADINGS) {
+    expect(result).not.toContain(heading);
+  }
+}
+
+describe("buildSystemPrompt — memory v2 autoload", () => {
+  beforeEach(() => {
+    mkdirSync(TEST_DIR, { recursive: true });
+    _setOverridesForTesting({});
+  });
+
+  afterEach(() => {
+    cleanupMemoryDir();
+    _setOverridesForTesting({});
+  });
+
+  test("flag off: no memory headings appear even when files are populated", () => {
+    _setOverridesForTesting({ "memory-v2-enabled": false });
+    for (const file of MEMORY_FILES) {
+      writeMemoryFile(file, `Content for ${file}`);
+    }
+    const result = buildSystemPrompt();
+    expectNoHeadings(result);
+    for (const file of MEMORY_FILES) {
+      expect(result).not.toContain(`Content for ${file}`);
+    }
+  });
+
+  test("flag on, all files populated: all four blocks appear in canonical order", () => {
+    _setOverridesForTesting({ "memory-v2-enabled": true });
+    writeMemoryFile("essentials.md", "Alice prefers dark mode.");
+    writeMemoryFile("threads.md", "Open thread: ship PR-123 review.");
+    writeMemoryFile(
+      "recent.md",
+      "Yesterday Alice asked about Postgres tuning.",
+    );
+    writeMemoryFile(
+      "buffer.md",
+      "Bob mentioned a pager rotation conflict on Friday.",
+    );
+
+    const result = buildSystemPrompt();
+
+    expect(result).toContain("## Essentials");
+    expect(result).toContain("## Threads");
+    expect(result).toContain("## Recent");
+    expect(result).toContain("## Buffer");
+
+    expect(result).toContain("Alice prefers dark mode.");
+    expect(result).toContain("Open thread: ship PR-123 review.");
+    expect(result).toContain("Yesterday Alice asked about Postgres tuning.");
+    expect(result).toContain(
+      "Bob mentioned a pager rotation conflict on Friday.",
+    );
+
+    const essentialsIdx = result.indexOf("## Essentials");
+    const threadsIdx = result.indexOf("## Threads");
+    const recentIdx = result.indexOf("## Recent");
+    const bufferIdx = result.indexOf("## Buffer");
+    expect(essentialsIdx).toBeLessThan(threadsIdx);
+    expect(threadsIdx).toBeLessThan(recentIdx);
+    expect(recentIdx).toBeLessThan(bufferIdx);
+  });
+
+  test("flag on, files empty: blocks are omitted", () => {
+    _setOverridesForTesting({ "memory-v2-enabled": true });
+    for (const file of MEMORY_FILES) {
+      writeMemoryFile(file, "");
+    }
+    expectNoHeadings(buildSystemPrompt());
+  });
+
+  test("flag on, only some files have content: only populated blocks appear", () => {
+    _setOverridesForTesting({ "memory-v2-enabled": true });
+    writeMemoryFile("essentials.md", "Alice prefers VS Code.");
+    writeMemoryFile("threads.md", "");
+    writeMemoryFile("recent.md", "Recent topic: GraphQL pagination.");
+    writeMemoryFile("buffer.md", "");
+
+    const result = buildSystemPrompt();
+    expect(result).toContain("## Essentials");
+    expect(result).toContain("Alice prefers VS Code.");
+    expect(result).toContain("## Recent");
+    expect(result).toContain("Recent topic: GraphQL pagination.");
+    expect(result).not.toContain("## Threads");
+    expect(result).not.toContain("## Buffer");
+  });
+
+  test("flag on, files missing entirely: section is silently skipped", () => {
+    _setOverridesForTesting({ "memory-v2-enabled": true });
+    cleanupMemoryDir();
+    expectNoHeadings(buildSystemPrompt());
+  });
+
+  test("memory blocks live in the dynamic-suffix cache region", () => {
+    _setOverridesForTesting({ "memory-v2-enabled": true });
+    writeMemoryFile("essentials.md", "Alice prefers dark mode.");
+    const result = buildSystemPrompt();
+    const boundaryIdx = result.indexOf(SYSTEM_PROMPT_CACHE_BOUNDARY);
+    expect(boundaryIdx).toBeGreaterThan(-1);
+    const staticBlock = result.slice(0, boundaryIdx);
+    const dynamicBlock = result.slice(
+      boundaryIdx + SYSTEM_PROMPT_CACHE_BOUNDARY.length,
+    );
+    expect(staticBlock).not.toContain("## Essentials");
+    expect(dynamicBlock).toContain("## Essentials");
+    expect(dynamicBlock).toContain("Alice prefers dark mode.");
+  });
+});