@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/plugins/defaults/memory-retrieval/hooks/post-compact.ts

@@ -4,136 +4,100 @@
  * After the agent loop compacts a conversation mid-turn it must re-apply the
  * runtime injections compaction stripped — the NOW.md scratchpad, PKB context,
  * memory-v2 static block, workspace top-level context, and Slack chronological
- * snapshot — onto the compacted history before the turn continues. This hook
- * is the memory system's home for that transform: it receives the message
- * history plus the resolved runtime-injection options and returns the edited
- * history (and the blocks it captured), with no dependency on the agent loop's
- * closure state.
+ * snapshot — onto the compacted history before the turn continues. This hook is
+ * the memory system's home for that transform: it re-applies the injections via
+ * {@link applyRuntimeInjections}, writes the edited history back onto the
+ * context, and re-tracks the memory graph's cached nodes against the re-injected
+ * history. The injection blocks the transform captures are not needed by the
+ * re-injection caller, so only the messages propagate.
  *
- * It re-applies the runtime injections via {@link applyRuntimeInjections} and
- * re-tracks the memory graph's cached nodes against the re-injected history.
- * The remaining orchestrator-side step (the post-injection bookkeeping the
- * loop records) is expected to migrate here as the hook subsumes the loop's
- * re-injection ceremony.
+ * Every per-turn input the live conversation can supply is self-resolved from
+ * it (looked up by id) rather than threaded in by the loop:
+ * - The trust snapshot comes from the conversation's turn-start trust snapshot
+ *   ({@link Conversation.currentTurnTrustContext}), and the inbound actor
+ *   context from the turn-start actor snapshot
+ *   ({@link Conversation.currentTurnInboundActorContext}) — both frozen at turn
+ *   start, not read live. Post-compaction runs mid-turn in a later tool
+ *   iteration, where the live trust can be overwritten by a concurrent
+ *   request's actor and the contact/member registry the actor context derives
+ *   from can be mutated by contact tools; reading the frozen snapshots re-emits
+ *   the values the turn's initial assembly resolved.
+ * - The memory graph handle comes from the plugin's own conversation-keyed
+ *   registry ({@link getLiveGraphMemory}).
+ * - The call site and transcript inputs self-resolve inside
+ *   {@link applyRuntimeInjections}.
  *
- * The memory graph handle is sourced internally from the plugin's own
- * conversation-keyed registry ({@link getLiveGraphMemory}) rather than being
- * threaded in by the loop — it is memory-retrieval-specific state, not
- * something the generic loop should carry.
+ * The loop supplies only the irreducible turn-identity fields on the public
+ * {@link PostCompactContext}.
  */
 
+import type { PluginHookFn, PostCompactContext } from "@vellumai/plugin-api";
+
+import { getConfig } from "../../../../config/loader.js";
+import { findConversationOrSubagent } from "../../../../daemon/conversation-registry.js";
 import {
   applyRuntimeInjections,
-  type InboundActorContext,
-  type InjectionMode,
-  type RuntimeInjectionResult,
+  resolveTurnModelProfileLabel,
 } from "../../../../daemon/conversation-runtime-assembly.js";
 import {
+  FALLBACK_TURN_TRUST,
   resolveTrustClass,
-  type TrustContext,
 } from "../../../../daemon/trust-context.js";
 import { getLiveGraphMemory } from "../../../../memory/graph/conversation-graph-memory.js";
-import type { Message } from "../../../../providers/types.js";
-
-/**
- * Everything the post-compaction hook needs, supplied by the agent loop from
- * its own working state. Re-injection inputs migrate loop-ward by growing this
- * type; the loop hands the hook an object of this shape when it calls
- * {@link postCompact} directly.
- *
- * The turn-identity fields are flat here: `conversationId` is the key the
- * re-injection resolves the live conversation through (and the only one that,
- * together with `requestId` and `trust`, cannot be recovered from that live
- * conversation), while `turnIndex` and `callSite` are intentionally omitted so
- * {@link applyRuntimeInjections} self-resolves them from the live conversation.
- * The memory graph handle is likewise sourced internally via
- * {@link getLiveGraphMemory} rather than threaded in.
- */
-export interface PostCompactContext {
-  /** Compacted message history to re-inject onto. */
-  history: Message[];
-  /**
-   * Stable ID for the current request, forwarded onto the injector turn
-   * context. The one turn-identity field that cannot be recovered from the
-   * live conversation, so the loop supplies it.
-   */
-  requestId: string | undefined;
-  /**
-   * Conversation the turn is scoped to. The key the re-injection resolves the
-   * live conversation (and its channel/trust/transcript state) through, so the
-   * loop always supplies it.
-   */
-  conversationId: string;
-  /**
-   * Trust classification and channel identity for the inbound actor, forwarded
-   * onto the injector turn context and used to gate the memory-graph re-track.
-   * Supplied by the loop as the turn-start snapshot rather than re-resolved
-   * mid-turn.
-   */
-  trust: TrustContext;
-  /**
-   * Whether the in-flight turn has no human present to answer clarification
-   * questions. Resolved once by the agent loop at turn start (from its
-   * `isInteractive` option, which can fall back to mutable client/headless
-   * state that flips mid-turn on SSE reconnect) and handed to the hook here, so
-   * re-injection uses the loop's turn-start snapshot rather than re-reading
-   * live conversation state.
-   */
-  isNonInteractive: boolean;
-  /**
-   * Injection volume for the re-applied blocks. Owned by the agent loop, which
-   * drops to `"minimal"` when overflow reduction trims the prompt; handed to
-   * the hook here so re-injection matches the loop's committed decision instead
-   * of re-deriving it.
-   */
-  mode: InjectionMode;
-  /**
-   * The `model_profile:` turn-context label, or `null` when the active
-   * inference profile is unchanged since the last notified one. The agent loop
-   * resolves it once at turn start from config and the turn's profile override,
-   * and notifies the model only on change — a decision that flips mid-turn once
-   * the notification is persisted, so it cannot be re-derived. Handed to the
-   * hook here so re-injection re-emits the loop's turn-start value.
-   */
-  modelProfile: string | null;
-  /**
-   * Inbound actor identity and trust fields for the unified `<turn_context>`
-   * block, or `null` on guardian turns (which suppress the actor section). The
-   * agent loop resolves it once at turn start via the actor-trust resolver,
-   * whose contact/member registry inputs can be mutated mid-turn by contact
-   * tools, so it cannot be re-derived. Handed to the hook here so re-injection
-   * re-emits the loop's turn-start value.
-   */
-  actorContext: InboundActorContext | null;
-}
 
-export default async function postCompact(
-  ctx: PostCompactContext,
-): Promise<RuntimeInjectionResult> {
-  const { history, requestId, conversationId, trust, ...options } = ctx;
-  // The remaining `options` carry the non-identity injection inputs
-  // (`isNonInteractive`, `mode`, `modelProfile`, `actorContext`). Forward the
-  // turn-identity fields the live conversation can't supply (`requestId`,
-  // `conversationId`, `trust`); `turnIndex` and `callSite` self-resolve from
-  // the live conversation so the re-injection matches the turn's initial
-  // assembly.
+const postCompact: PluginHookFn<PostCompactContext> = async (ctx) => {
+  const {
+    history,
+    requestId,
+    conversationId,
+    isNonInteractive,
+    modelProfileKey,
+    injectionMode,
+  } = ctx;
+  const mode = injectionMode ?? "full";
+  const config = getConfig();
+  const conversation = findConversationOrSubagent(conversationId);
+  // Trust and the inbound actor context are read from the conversation's
+  // turn-start snapshots rather than live state: post-compaction runs mid-turn
+  // in a later tool iteration, where the live trust can be overwritten by a
+  // concurrent request's actor and the contact/member registry the actor
+  // context derives from can be mutated by contact tools. The snapshots are the
+  // values the turn's initial assembly resolved.
+  const trust =
+    conversation?.currentTurnTrustContext ??
+    conversation?.trustContext ??
+    FALLBACK_TURN_TRUST;
+  const actorContext = conversation?.currentTurnInboundActorContext ?? null;
+  // Render the `model_profile:` label from the turn's resolved profile key,
+  // using the call site self-resolved from the live conversation — the same
+  // derivation the first-call user-prompt-submit assembly uses.
+  const modelProfile = resolveTurnModelProfileLabel(
+    modelProfileKey,
+    conversation?.currentCallSite ?? "mainAgent",
+    config.llm,
+    conversationId,
+  );
   const result = await applyRuntimeInjections(history, {
-    ...options,
+    isNonInteractive,
+    modelProfile,
+    actorContext,
+    mode,
     requestId,
     conversationId,
     trust,
   });
+  // Write the re-injected history back onto the threaded context; the loop
+  // reads it from there once the hook settles.
+  ctx.history = result.messages;
   // Re-track the nodes the memory graph last injected so they survive against
-  // the re-injected history. Untrusted actors and minimal-mode turns never
-  // received a memory-graph injection, so there is nothing to re-track. The
-  // actor's trust class is derived from the turn's own trust context (the same
-  // value the injector chain resolves). The live graph handle is looked up
-  // from the plugin's own registry by the turn's conversation id — the same
-  // instance the turn's retrieval mutated, so re-tracking sees the real
-  // cached-node state.
+  // the re-injected history. Untrusted actors never received a memory-graph
+  // injection, so there is nothing to re-track. The live graph handle is looked
+  // up from the plugin's own registry by the turn's conversation id — the same
+  // instance the turn's retrieval mutated.
   const isTrustedActor = resolveTrustClass(trust) === "guardian";
-  if (isTrustedActor && options.mode !== "minimal") {
+  if (isTrustedActor) {
     getLiveGraphMemory(conversationId)?.retrackCachedNodes();
   }
-  return result;
-}
+};
+
+export default postCompact;

package/src/plugins/defaults/memory-retrieval/hooks/{user-prompt-submit-temp.ts → user-prompt-submit.ts}

@@ -1,6 +1,6 @@
 /**
- * Default `user-prompt-submit-temp` hook: prepares a turn's prompt before the
- * first provider call by running memory-graph retrieval and then applying the
+ * Default `user-prompt-submit` hook: prepares a turn's prompt before the first
+ * provider call by running memory-graph retrieval and then applying the
  * runtime injections that assemble the turn.
  *
  * **Memory graph** via {@link ConversationGraphMemory.prepareMemory} —
@@ -22,88 +22,52 @@
  * post-compaction hook, which re-applies the same injections after a mid-loop
  * compaction.
  *
- * This fires at the early "prompt submitted, before context assembly" moment,
- * ahead of the canonical late `user-prompt-submit` hook (history repair,
- * title), which normalizes the assembled history after the overflow-reduction
- * transform that runs between the two moments. The `-temp` suffix marks this as
- * a transitional staging point that folds into `user-prompt-submit` once
- * compaction is cleared from the gap between the two call sites.
+ * Registered first in the `user-prompt-submit` chain, so it heads the chain
+ * ahead of history repair and title generation: those later hooks see the
+ * fully assembled, memory-injected history.
  */
 
-import type { PluginHookFn } from "@vellumai/plugin-api";
-import type { Logger } from "pino";
+import type {
+  PluginHookFn,
+  UserPromptSubmitContext,
+} from "@vellumai/plugin-api";
 
 import { getConfig } from "../../../../config/loader.js";
 import { findConversationOrSubagent } from "../../../../daemon/conversation-registry.js";
 import {
   applyRuntimeInjections,
   resolveTurnInboundActorContext,
+  resolveTurnModelProfileLabel,
   type RuntimeInjectionResult,
 } from "../../../../daemon/conversation-runtime-assembly.js";
-import type { ServerMessage } from "../../../../daemon/message-protocol.js";
 import type { MemoryRecalled } from "../../../../daemon/message-types/memory.js";
 import { resolveTrustClass } from "../../../../daemon/trust-context.js";
 import { updateMessageMetadata } from "../../../../memory/conversation-crud.js";
 import { recordMemoryRecallLog } from "../../../../memory/memory-recall-log-store.js";
-import type { Message } from "../../../../providers/types.js";
+import { broadcastMessage } from "../../../../runtime/assistant-event-hub.js";
 import type { GraphMemoryResult } from "../../../types.js";
-
-/**
- * Context threaded through the `user-prompt-submit-temp` hook. The
- * conversation-scoped retrieval state (graph handle, abort signal, trust
- * class) is self-resolved from the live conversation by id; the readonly
- * fields here carry the event sink and the turn-start injection snapshot,
- * while `latestMessages` straddles input and output — the loop seeds it with
- * the pre-injection array and the hook overwrites it with the injected result.
- */
-export interface MemoryRetrievalHookContext {
-  /** Event sink used by the graph retriever and `memory_recalled` emission. */
-  readonly onEvent: (msg: ServerMessage) => void;
-  /** Conversation the turn belongs to — keys the recall-log row. */
-  readonly conversationId: string;
-  /** User message the injected memory block is persisted onto. */
-  readonly userMessageId: string;
-  /** Turn-scoped logger for non-fatal persistence warnings. */
-  readonly logger: Logger;
-  /**
-   * Working message list for the turn. Seeded by the loop with the
-   * pre-injection messages and consumed as the retrieval input; the hook
-   * overwrites it with the fully injected result (the memory-graph block, when
-   * the actor is trusted, plus the runtime injections). Read back by the loop.
-   */
-  latestMessages: Message[];
-  /**
-   * Stable ID for the current request, forwarded onto the injector turn
-   * context. The one turn-identity field the live conversation can't recover.
-   */
-  readonly requestId: string | undefined;
-  /**
-   * Whether the in-flight turn has no human present to answer clarification
-   * questions. Resolved once at turn start and threaded in so injection uses
-   * the turn-start snapshot rather than live state that can flip mid-turn.
-   */
-  readonly isNonInteractive: boolean;
-  /**
-   * The `model_profile:` turn-context label, or `null` when the active
-   * inference profile is unchanged since the last notified one. Resolved once
-   * at turn start, so it is threaded in rather than re-derived.
-   */
-  readonly modelProfile: string | null;
-}
+import { MEMORY_V3_INJECTED_BLOCK_METADATA_KEY } from "../../memory-v3-shadow/ever-injected-store.js";
 
 /**
  * Persist and broadcast the retrieval's side effects: the injected block on
  * the user message's metadata (so it survives reloads), a recall-log row, and
- * the `memory_recalled` debug event. All three are best-effort — a failure to
- * persist must not abort the turn.
+ * the `memory_recalled` debug event. All three are best-effort — a failure
+ * must not abort the turn.
+ *
+ * The injected-block persist runs HERE, immediately after retrieval — not
+ * after runtime assembly. v2's activation store marks the block's pages
+ * `everInjected` during retrieval, so deferring the metadata write would open
+ * a window (which includes memory-v3's selector LLM call when the shadow flag
+ * is on) where a crash/abort leaves pages claimed-but-never-persisted: absent
+ * from history on reload AND suppressed until compaction. When memory-v3
+ * supersedes (strips) the block later this turn, {@link
+ * persistInjectionBlocks} REMOVES this key again in its combined update — a
+ * transient both-keys state mid-turn is acceptable; a v2 loss window is not.
  */
 function recordRecallSideEffects(
   graphResult: GraphMemoryResult,
-  ctx: MemoryRetrievalHookContext,
+  ctx: UserPromptSubmitContext,
 ): void {
-  // Persist the injected block text in message metadata so it survives
-  // conversation reloads (eviction, restart, fork). loadFromDb re-injects
-  // from metadata.
   if (graphResult.injectedBlockText) {
     try {
       updateMessageMetadata(ctx.userMessageId, {
@@ -174,7 +138,7 @@ function recordRecallSideEffects(
         recency: c.recencyBoost,
       })),
     };
-    ctx.onEvent(memoryRecalledEvent);
+    broadcastMessage(memoryRecalledEvent);
   }
 }
 
@@ -186,23 +150,50 @@ function recordRecallSideEffects(
  * correspond to `userMessageId`. All present blocks are written in a single
  * update to avoid doubling SQLite SELECT+UPDATE work each turn. Best-effort — a
  * persistence failure must not abort the turn.
+ *
+ * The two `<memory>` layers end the turn mutually exclusive per row:
+ *  - v2's block (`memoryInjectedBlock`) was already persisted right after
+ *    retrieval (see {@link recordRecallSideEffects} — no loss window). When
+ *    memory-v3 superseded it this turn (`blocks.memoryV3Active`), assembly
+ *    stripped the v2 block from the tail, so this combined update REMOVES the
+ *    key again (persisting it would rehydrate a block that is not in the live
+ *    history — a reload cache-bust and duplicated memory). `v2BlockPersisted`
+ *    tells this function whether there is anything to remove.
+ *  - `blocks.memoryV3InjectedBlock` (the frozen net-new card block, unwrapped)
+ *    persists under `MEMORY_V3_INJECTED_BLOCK_METADATA_KEY`; `loadFromDb`
+ *    re-wraps and splices it on load, freezing the cards into history.
  */
 function persistInjectionBlocks(
   blocks: RuntimeInjectionResult["blocks"],
-  ctx: MemoryRetrievalHookContext,
+  ctx: UserPromptSubmitContext,
+  v2BlockPersisted: boolean,
 ): void {
+  const removeV2Block = Boolean(blocks.memoryV3Active) && v2BlockPersisted;
   if (
     !blocks.unifiedTurnContext &&
     !blocks.pkbSystemReminder &&
     !blocks.workspaceBlock &&
     !blocks.nowScratchpadBlock &&
     !blocks.pkbContextBlock &&
-    !blocks.memoryV2StaticBlock
+    !blocks.memoryV2StaticBlock &&
+    !blocks.memoryV3InjectedBlock &&
+    !removeV2Block
   ) {
     return;
   }
   try {
     const metadataUpdates: Record<string, unknown> = {};
+    if (removeV2Block) {
+      // An explicit `undefined` overrides the value persisted after retrieval
+      // and is dropped by `updateMessageMetadata`'s JSON.stringify, deleting
+      // the key — the metadata schema types the field `string | absent`, so
+      // removal must drop the key rather than write null.
+      metadataUpdates.memoryInjectedBlock = undefined;
+    }
+    if (blocks.memoryV3InjectedBlock) {
+      metadataUpdates[MEMORY_V3_INJECTED_BLOCK_METADATA_KEY] =
+        blocks.memoryV3InjectedBlock;
+    }
     if (blocks.unifiedTurnContext) {
       metadataUpdates.turnContextBlock = blocks.unifiedTurnContext;
     }
@@ -243,13 +234,14 @@ function persistInjectionBlocks(
  * into `prepareMemory`.
  */
 const userPromptSubmitMemoryRetrieval: PluginHookFn<
-  MemoryRetrievalHookContext
+  UserPromptSubmitContext
 > = async (ctx) => {
   // The conversation-scoped retrieval state — graph handle, abort signal, and
   // trust class — is resolved from the live conversation by id rather than
   // threaded in, mirroring how `applyRuntimeInjections` self-resolves its
   // per-turn inputs.
   const conversation = findConversationOrSubagent(ctx.conversationId);
+  const config = getConfig();
   const abortSignal = conversation?.abortController?.signal;
   const isTrustedActor =
     resolveTrustClass(conversation?.trustContext) === "guardian";
@@ -258,15 +250,24 @@ const userPromptSubmitMemoryRetrieval: PluginHookFn<
     conversation?.assistantId,
   );
 
+  let v2BlockPersisted = false;
   if (conversation && isTrustedActor && abortSignal) {
+    // Retrieval progress (`memory_status`) and the `memory_recalled` summary
+    // publish to the shared `broadcastMessage` hub — the sink every turn
+    // publisher converges to — rather than a threaded event callback. This
+    // keeps any raw client-emit capability off the hook contract.
     const graphResult = await conversation.graphMemory.prepareMemory(
       ctx.latestMessages,
-      getConfig(),
+      config,
       abortSignal,
-      ctx.onEvent,
+      broadcastMessage,
     );
 
     recordRecallSideEffects(graphResult, ctx);
+    // The v2 block is persisted inside `recordRecallSideEffects`. If
+    // memory-v3 supersedes it later this turn, `persistInjectionBlocks`
+    // removes the key in its combined post-assembly update.
+    v2BlockPersisted = Boolean(graphResult.injectedBlockText);
 
     ctx.latestMessages = graphResult.runMessages;
     // Select dense+sparse as a matched pair so RRF fusion combines two signals
@@ -300,21 +301,29 @@ const userPromptSubmitMemoryRetrieval: PluginHookFn<
   // input — the Slack chronological transcript, the unified `<turn_context>`
   // block, channel/voice/transport hints, and the turn's trust/index/call-site
   // — from the live conversation, so we hand in only the request id and
-  // conversation id plus the fields resolved once at turn start
-  // (`isNonInteractive`, `modelProfile`). The unified `<turn_context>` actor
-  // input is self-resolved from the live conversation's trust context. This
-  // first-call assembly always runs at `"full"` volume; overflow reduction only
-  // downgrades the mode on later re-injection.
+  // conversation id plus the field resolved once at turn start
+  // (`isNonInteractive`). The `model_profile` label is rendered here from the
+  // turn's resolved profile key, using the call site self-resolved from the
+  // live conversation. The unified `<turn_context>` actor input is
+  // self-resolved from the live conversation's trust context. This first-call
+  // assembly always runs at `"full"` volume; overflow reduction only downgrades
+  // the mode on later re-injection.
+  const modelProfile = resolveTurnModelProfileLabel(
+    ctx.modelProfileKey,
+    conversation?.currentCallSite ?? "mainAgent",
+    config.llm,
+    ctx.conversationId,
+  );
   const injection = await applyRuntimeInjections(ctx.latestMessages, {
     isNonInteractive: ctx.isNonInteractive,
-    modelProfile: ctx.modelProfile,
+    modelProfile,
     actorContext,
     mode: "full",
     requestId: ctx.requestId,
     conversationId: ctx.conversationId,
   });
   ctx.latestMessages = injection.messages;
-  persistInjectionBlocks(injection.blocks, ctx);
+  persistInjectionBlocks(injection.blocks, ctx, v2BlockPersisted);
 };
 
 export default userPromptSubmitMemoryRetrieval;

package/src/plugins/defaults/memory-retrieval/injector-chain.ts

@@ -8,10 +8,11 @@
  * injectors out of the plugin registry.
  *
  * The chain combines the default injectors ({@link defaultInjectors}) with the
- * memory-v3 injector ({@link memoryV3Injector}). The sort mirrors the previous
- * registry aggregation (`Array.prototype.sort` is stable, so injectors sharing
- * an `order` keep their listed order), so the produced sequence — and therefore
- * the injected content — is identical.
+ * memory-v3 injectors ({@link memoryV3Injector} — frozen net-new cards — and
+ * {@link memoryV3SpotlightInjector} — the ephemeral section spotlight). The
+ * sort mirrors the previous registry aggregation (`Array.prototype.sort` is
+ * stable, so injectors sharing an `order` keep their listed order), so the
+ * produced sequence — and therefore the injected content — is identical.
  *
  * The chain is assembled lazily on first access and memoized, so the sort runs
  * once per process rather than per turn and module evaluation stays free of any
@@ -19,7 +20,10 @@
  */
 
 import type { Injector } from "../../types.js";
-import { memoryV3Injector } from "../memory-v3-shadow/injector.js";
+import {
+  memoryV3Injector,
+  memoryV3SpotlightInjector,
+} from "../memory-v3-shadow/injector.js";
 import { defaultInjectors } from "./injectors.js";
 
 let cachedChain: Injector[] | null = null;
@@ -27,9 +31,11 @@ let cachedChain: Injector[] | null = null;
 /** The order-sorted runtime injector chain, assembled once and memoized. */
 export function getInjectorChain(): Injector[] {
   if (cachedChain === null) {
-    cachedChain = [...defaultInjectors, memoryV3Injector].sort(
-      (a, b) => a.order - b.order,
-    );
+    cachedChain = [
+      ...defaultInjectors,
+      memoryV3Injector,
+      memoryV3SpotlightInjector,
+    ].sort((a, b) => a.order - b.order);
   }
   return cachedChain;
 }

package/src/plugins/defaults/memory-retrieval/injectors.ts

@@ -53,7 +53,7 @@ import { readNowScratchpad } from "../../../daemon/now-scratchpad.js";
 import { getInContextPkbPaths } from "../../../daemon/pkb-context-tracker.js";
 import { buildPkbReminder } from "../../../daemon/pkb-reminder-builder.js";
 import {
-  resolveTrustClass,
+  isPersonalMemoryAllowed,
   type TrustContext,
 } from "../../../daemon/trust-context.js";
 import { listComments } from "../../../documents/document-comments-store.js";
@@ -62,10 +62,7 @@ import { getPkbAutoInjectList } from "../../../memory/pkb/autoinject.js";
 import { readPkbContext } from "../../../memory/pkb/context.js";
 import { searchPkbFiles } from "../../../memory/pkb/pkb-search.js";
 import { getPkbRoot, PKB_WORKSPACE_SCOPE } from "../../../memory/pkb/types.js";
-import {
-  readMemoryV2StaticContent,
-  shouldExposePersonalMemory,
-} from "../../../memory/v2/static-context.js";
+import { readMemoryV2StaticContent } from "../../../memory/v2/static-context.js";
 import type { Message } from "../../../providers/types.js";
 import { getLogger } from "../../../util/logger.js";
 import { getSandboxWorkingDir } from "../../../util/platform.js";
@@ -360,19 +357,6 @@ const pkbReminderInjector: Injector = {
   },
 };
 
-/**
- * Whether personal-memory content (PKB, NOW.md) may be surfaced this turn: the
- * trust gate admits the actor (guardian-class, or an internal/local flow). All
- * memory-domain injectors share this gate so they apply identical exposure
- * rules without it being threaded in from the agent loop.
- */
-function isPersonalMemoryAllowed(trust: TrustContext): boolean {
-  return shouldExposePersonalMemory({
-    sourceChannel: trust.sourceChannel,
-    isTrustedActor: resolveTrustClass(trust) === "guardian",
-  });
-}
-
 /**
  * Read the auto-injected PKB content for the turn, gated behind the
  * personal-memory trust gate. Returns the content string when the gate admits

package/src/plugins/defaults/memory-retrieval/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "default-memory-retrieval",
+  "version": "1.0.0",
+  "description": "First-party default plugin running memory-graph retrieval and runtime injection at the front of the user-prompt-submit chain.",
+  "private": true,
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=20.12.0"
+  },
+  "peerDependencies": {
+    "@vellumai/plugin-api": "^0.8.0"
+  }
+}