@vellumai/assistant 0.8.7 → 0.8.8

package/src/plugins/defaults/empty-response/hooks/stop.ts

@@ -0,0 +1,126 @@
+/**
+ * Default `stop` hook: when the model yields a turn with no tool calls, decide
+ * whether to let the turn end or re-query the model with a nudge.
+ *
+ * Two cases warrant a nudge:
+ *
+ * 1. **Refusal stop.** The provider returned `stopReason === "refusal"` with no
+ *    visible text (Anthropic's safety classifier zeroed the response). Nudged
+ *    even on the first model call of the run — a refusal there guarantees no
+ *    organic text exists yet, so without intervening the loop would persist an
+ *    empty assistant bubble to the user. Uses `REFUSAL_NUDGE_TEXT`.
+ * 2. **Empty turn after tool use.** The turn produced no visible text, follows
+ *    at least one prior assistant turn this run, and no earlier turn this run
+ *    already delivered visible text. Uses `NUDGE_TEXT`.
+ *
+ * Every other case leaves the decision at `"stop"` (the model said its piece,
+ * or there is nothing to nudge about). The retry cap is owned by the agent
+ * loop: this hook always asks to continue when a nudge is warranted, and the
+ * loop stops anyway once the run's nudge budget is spent.
+ *
+ * Both prior-turn signals are derived from the current response cycle — the
+ * messages after the last genuine user prompt (a user turn that isn't purely
+ * tool results). Scoping this way keeps prior conversation turns from polluting
+ * the signals, and deriving the boundary from history content rather than an
+ * index means mid-run compaction (which rewrites the array in place) can't
+ * invalidate it. A prior assistant turn this cycle implies a completed tool-use
+ * iteration (an empty turn nudges-and-continues without pushing an assistant
+ * message), so "a prior assistant turn exists" is the equivalent of "this is
+ * not the first model call".
+ *
+ * Defaults register before any user plugin, so this hook runs at the front of
+ * the `stop` chain — later hooks see (and may override) its decision.
+ */
+
+import type { PluginHookFn, StopContext } from "@vellumai/plugin-api";
+
+import type { ContentBlock, Message } from "../../../../providers/types.js";
+
+/**
+ * Canonical nudge text for an empty turn after tool use. Must stay verbatim so
+ * a plugin that wraps the default sees a stable string.
+ *
+ * Wire-compat note: this is shown to the LLM, not the user. Edits here affect
+ * model behavior but not end-user UX directly.
+ */
+export const NUDGE_TEXT =
+  "<system_notice>Your previous response was empty. You must respond to the user with a summary of what you found or did. Do not use any tools — just respond with text.</system_notice>";
+
+/**
+ * Refusal-specific nudge. Used when the provider stops with `"refusal"` and no
+ * visible text — i.e. the safety classifier zeroed the response. Kept distinct
+ * from `NUDGE_TEXT` so the model gets context-appropriate guidance (no "summary
+ * of what you found or did" — there is no tool trail to summarize on a refusal).
+ *
+ * Wire-compat note: this is shown to the LLM, not the user. Edits here affect
+ * retry behavior but not end-user UX directly.
+ */
+export const REFUSAL_NUDGE_TEXT =
+  '<system_notice>Your previous response was empty because the upstream provider returned stop_reason="refusal". Please answer the user\'s last message directly with a plain-text response. Do not use any tools — just respond with text.</system_notice>';
+
+function hasVisibleText(content: ReadonlyArray<ContentBlock>): boolean {
+  return content.some(
+    (block) => block.type === "text" && block.text.trim().length > 0,
+  );
+}
+
+function isAssistantTurn(message: Message): boolean {
+  return message.role === "assistant";
+}
+
+/** A user-role message carrying only tool results, not a fresh prompt. */
+function isToolResultMessage(message: Message): boolean {
+  return (
+    message.role === "user" &&
+    message.content.length > 0 &&
+    message.content.every((block) => block.type === "tool_result")
+  );
+}
+
+/**
+ * Messages belonging to the current response cycle: everything after the last
+ * genuine user prompt. Falls back to the whole history when none is found.
+ */
+function currentCycleMessages(
+  messages: ReadonlyArray<Message>,
+): ReadonlyArray<Message> {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (message.role === "user" && !isToolResultMessage(message)) {
+      return messages.slice(i + 1);
+    }
+  }
+  return messages;
+}
+
+const stop: PluginHookFn<StopContext> = async (ctx) => {
+  const turnHasVisibleText = hasVisibleText(ctx.responseContent);
+
+  const appendNudge = (text: string): void => {
+    ctx.messages.push({ role: "user", content: [{ type: "text", text }] });
+    ctx.decision = "continue";
+  };
+
+  if (ctx.stopReason === "refusal" && !turnHasVisibleText) {
+    appendNudge(REFUSAL_NUDGE_TEXT);
+    return;
+  }
+
+  const cycleMessages = currentCycleMessages(ctx.messages);
+  const priorAssistantTurns = cycleMessages.filter(isAssistantTurn);
+  const hadPriorAssistantTurn = priorAssistantTurns.length > 0;
+  const priorAssistantHadVisibleText = priorAssistantTurns.some((message) =>
+    hasVisibleText(message.content),
+  );
+
+  const isEmptyTurnAfterTools =
+    !turnHasVisibleText &&
+    hadPriorAssistantTurn &&
+    !priorAssistantHadVisibleText;
+
+  if (isEmptyTurnAfterTools) {
+    appendNudge(NUDGE_TEXT);
+  }
+};
+
+export default stop;

package/src/plugins/defaults/empty-response/register.ts

@@ -1,19 +1,14 @@
 /**
- * Default `emptyResponse` plugin.
+ * Default `empty-response` plugin.
  *
- * The plugin's middleware is a passthrough — it calls `next(args)` and returns
- * the result unchanged. The actual decision lives in the terminal handler in
- * `./terminal.ts`, which is wired in as the pipeline's `terminal` argument by
- * the `runPipeline` call site in `agent/loop.ts`. This separation matters: the
- * default plugin is registered before any user plugin (defaults load first in
- * `bootstrapPlugins()`), which puts it at the OUTERMOST position of the onion
- * chain. If the default middleware were to decide directly without calling
- * `next`, it would shadow every later-registered plugin. Routing through
- * `next(args)` lets user middleware participate normally.
+ * Contributes a `stop` hook that re-queries the model when a turn yields with
+ * no tool calls but came back empty (or as a provider refusal). The decision
+ * logic lives in `./hooks/stop.ts`. Defaults register before user plugins, so
+ * this runs at the front of the `stop` hook chain.
  */
 
 import { type Plugin } from "../../types.js";
-import emptyResponse from "./middlewares/emptyResponse.js";
+import stop from "./hooks/stop.js";
 import pkg from "./package.json" with { type: "json" };
 
 /** Singleton plugin — the registry rejects duplicate registrations by name. */
@@ -22,7 +17,7 @@ export const defaultEmptyResponsePlugin: Plugin = {
     name: pkg.name,
     version: pkg.version,
   },
-  middleware: {
-    emptyResponse,
+  hooks: {
+    stop,
   },
 };

package/src/plugins/defaults/index.ts

@@ -23,22 +23,15 @@
  * registration work.
  */
 
-import { memoryV3ShadowPlugin } from "../../memory/v3/shadow-plugin.js";
 import { registerPlugin, resetPluginRegistryForTests } from "../registry.js";
 import { type Plugin, PluginExecutionError } from "../types.js";
 import { defaultCircuitBreakerPlugin } from "./circuit-breaker/register.js";
 import { defaultCompactionPlugin } from "./compaction/register.js";
 import { defaultEmptyResponsePlugin } from "./empty-response/register.js";
 import { defaultHistoryRepairPlugin } from "./history-repair/register.js";
-import { defaultInjectorsPlugin } from "./injectors/register.js";
-import { defaultLlmCallPlugin } from "./llm-call/register.js";
-import { defaultMemoryRetrievalPlugin } from "./memory-retrieval/register.js";
 import { defaultOverflowReducePlugin } from "./overflow-reduce/register.js";
-import { defaultPersistencePlugin } from "./persistence/register.js";
 import { defaultTitleGeneratePlugin } from "./title-generate/register.js";
-import { defaultTokenEstimatePlugin } from "./token-estimate/register.js";
 import { defaultToolErrorPlugin } from "./tool-error/register.js";
-import { defaultToolExecutePlugin } from "./tool-execute/register.js";
 import { defaultToolResultTruncatePlugin } from "./tool-result-truncate/register.js";
 
 /**
@@ -53,21 +46,14 @@ import { defaultToolResultTruncatePlugin } from "./tool-result-truncate/register
  */
 function getAllDefaultPlugins(): readonly Plugin[] {
   return [
-    defaultLlmCallPlugin,
-    defaultToolExecutePlugin,
     defaultToolResultTruncatePlugin,
     defaultEmptyResponsePlugin,
     defaultToolErrorPlugin,
-    defaultMemoryRetrievalPlugin,
-    defaultInjectorsPlugin,
-    defaultTokenEstimatePlugin,
     defaultOverflowReducePlugin,
     defaultHistoryRepairPlugin,
     defaultCompactionPlugin,
     defaultCircuitBreakerPlugin,
-    defaultPersistencePlugin,
     defaultTitleGeneratePlugin,
-    memoryV3ShadowPlugin,
   ];
 }
 
@@ -99,7 +85,7 @@ export function registerDefaultPlugins(): void {
  * so integration tests that exercise the full agent loop have a
  * production-parity plugin stack. Use this in `beforeEach` of tests that
  * dispatch through pipelines with a terminal that assumes the default
- * plugin handles every op (e.g. persistence, overflowReduce).
+ * plugin handles every op (e.g. overflowReduce).
  *
  * Tests that specifically need an empty registry (pipeline-unit tests, the
  * plugin-registry tests themselves) should continue to call

package/src/plugins/defaults/injectors/register.ts

@@ -32,35 +32,47 @@
  * closer to the memory prefix themselves. For appends, ascending `order` is
  * the natural left-to-right append sequence. The runtime-injection applier
  * sorts and applies blocks declaratively so this invariant holds even when
- * third-party injectors slot additional blocks at fractional order values.
- *
- * Third-party plugins may register additional {@link Injector}s at any
- * `order` value; the registry's `getInjectors()` returns all injectors
- * sorted ascending, so a plugin-registered injector at `order: 25`
- * reliably slots between `unified-turn-context` (20) and `pkb` (30).
- *
- * This module only builds and exports the `Plugin` object; the defaults
- * aggregator in `plugins/defaults/index.ts` registers it centrally, either
- * explicitly from `daemon/external-plugins-bootstrap.ts` or lazily via the
- * registry's default registrar the first time a query reads the registry.
+ * injectors slot additional blocks at fractional order values.
+ *
+ * This module exports the default injectors as a plain ordered array
+ * ({@link defaultInjectors}). The chain assembler in
+ * `plugins/defaults/memory-retrieval/injector-chain.ts` sorts them by `order`
+ * (alongside the memory-v3 injector) into the single sequence
+ * `applyRuntimeInjections` walks each turn — injection is not a plugin
+ * contribution, so injectors are imported directly rather than aggregated
+ * through the registry.
  */
 
 import { resolve } from "node:path";
 
 import { getConfig } from "../../../config/loader.js";
+import type { InjectionMatcher } from "../../../context/strip-injections.js";
+import { readNowScratchpad } from "../../../daemon/now-scratchpad.js";
 import { getInContextPkbPaths } from "../../../daemon/pkb-context-tracker.js";
 import { buildPkbReminder } from "../../../daemon/pkb-reminder-builder.js";
+import {
+  resolveTrustClass,
+  type TrustContext,
+} from "../../../daemon/trust-context.js";
 import { listComments } from "../../../documents/document-comments-store.js";
+import { getLiveGraphMemory } from "../../../memory/graph/conversation-graph-memory.js";
+import { getPkbAutoInjectList } from "../../../memory/pkb/autoinject.js";
+import { readPkbContext } from "../../../memory/pkb/context.js";
 import { searchPkbFiles } from "../../../memory/pkb/pkb-search.js";
+import { getPkbRoot, PKB_WORKSPACE_SCOPE } from "../../../memory/pkb/types.js";
+import {
+  readMemoryV2StaticContent,
+  shouldExposePersonalMemory,
+} from "../../../memory/v2/static-context.js";
+import type { Message } from "../../../providers/types.js";
 import { getLogger } from "../../../util/logger.js";
+import { getSandboxWorkingDir } from "../../../util/platform.js";
 import {
   type InjectionBlock,
   type Injector,
-  type Plugin,
   type TurnContext,
   type TurnInjectionInputs,
 } from "../../types.js";
-import pkg from "./package.json" with { type: "json" };
 
 const pkbReminderLog = getLogger("pkb-reminder");
 
@@ -79,7 +91,7 @@ const PKB_HINT_ARCHIVE_THRESHOLD = 0.7;
  * and any future integration code — can assert ordering without re-deriving
  * the constants.
  *
- * Gaps of 10 between slots leave room for third-party injectors to slot in
+ * Gaps of 10 between slots leave room for future injectors to slot in
  * at granular positions (e.g. `25` between unified-turn-context and pkb)
  * without renumbering the defaults.
  */
@@ -241,20 +253,33 @@ const unifiedTurnContextInjector: Injector = {
  *
  * Gating:
  *  - `mode === "full"`.
- *  - Non-null, non-empty `pkbContext`.
+ *  - The personal-memory trust gate admits the actor and the workspace has
+ *    PKB content (see {@link readGatedPkbContext}).
+ *  - The `<knowledge_base>` block is not already present in the turn's working
+ *    messages. The big block is injected once and then persists in history, so
+ *    it only needs (re)injecting on the first turn and right after compaction
+ *    strips it — both of which leave the working messages without the block.
+ *    Skipping when it is present keeps the conversation prefix stable for
+ *    Anthropic's prefix caching and avoids a duplicate splice.
  */
 const pkbContextInjector: Injector = {
   name: "pkb-context",
   order: DEFAULT_INJECTOR_ORDER.pkbContext,
-  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+  async produce(
+    ctx: TurnContext,
+    runMessages?: Message[],
+  ): Promise<InjectionBlock | null> {
     const inputs = readInjectionInputs(ctx);
     const mode = inputs.mode ?? "full";
     if (mode !== "full") return null;
     if (isPkbInjectionSilencedByV2()) return null;
-    if (!inputs.pkbContext) return null;
+    const content = readGatedPkbContext(ctx.trust);
+    if (!content) return null;
+    if (hasInjectedUserTextBlock(runMessages, KNOWLEDGE_BASE_BLOCK_PREFIXES))
+      return null;
     return {
       id: "pkb-context",
-      text: buildPkbContextBlock(inputs.pkbContext),
+      text: buildPkbContextBlock(content),
       placement: "after-memory-prefix",
     };
   },
@@ -271,18 +296,21 @@ const pkbContextInjector: Injector = {
  *
  * Gating:
  *  - `mode === "full"`.
- *  - `pkbActive === true`.
+ *  - PKB is active for the turn (see {@link isPkbActive}).
  */
 const pkbReminderInjector: Injector = {
   name: "pkb-reminder",
   order: DEFAULT_INJECTOR_ORDER.pkbReminder,
-  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+  async produce(
+    ctx: TurnContext,
+    runMessages?: Message[],
+  ): Promise<InjectionBlock | null> {
     const inputs = readInjectionInputs(ctx);
     const mode = inputs.mode ?? "full";
     if (mode !== "full") return null;
-    if (!inputs.pkbActive) return null;
+    if (!isPkbActive(ctx.trust)) return null;
     if (isPkbInjectionSilencedByV2()) return null;
-    const reminder = await buildPkbReminderWithHints(inputs);
+    const reminder = await buildPkbReminderWithHints(ctx, runMessages);
     return {
       id: "pkb-reminder",
       text: reminder,
@@ -291,6 +319,125 @@ const pkbReminderInjector: Injector = {
   },
 };
 
+/**
+ * Whether personal-memory content (PKB, NOW.md) may be surfaced this turn: the
+ * trust gate admits the actor (guardian-class, or an internal/local flow). All
+ * memory-domain injectors share this gate so they apply identical exposure
+ * rules without it being threaded in from the agent loop.
+ */
+function isPersonalMemoryAllowed(trust: TrustContext): boolean {
+  return shouldExposePersonalMemory({
+    sourceChannel: trust.sourceChannel,
+    isTrustedActor: resolveTrustClass(trust) === "guardian",
+  });
+}
+
+/**
+ * Read the auto-injected PKB content for the turn, gated behind the
+ * personal-memory trust gate. Returns the content string when the gate admits
+ * the actor and the workspace has PKB content, otherwise `null`. Both the gate
+ * and the content are sourced from the turn's trust context and the PKB files
+ * directly, so the memory-domain injectors source their own inputs rather than
+ * having them threaded in from the agent loop.
+ */
+function readGatedPkbContext(trust: TrustContext): string | null {
+  return isPersonalMemoryAllowed(trust) ? readPkbContext() : null;
+}
+
+/**
+ * Read the NOW.md scratchpad content for the turn, gated behind the
+ * personal-memory trust gate and the `scratchpadInjection` config toggle.
+ * Returns the trimmed content when both gates admit and the file is non-empty,
+ * otherwise `null`. Sourced from the trust context and the NOW.md file directly
+ * so the `now-md` injector owns its input rather than having it threaded in.
+ */
+function readGatedNowScratchpad(trust: TrustContext): string | null {
+  if (!isPersonalMemoryAllowed(trust)) return null;
+  if (!getConfig().memory.retrieval.scratchpadInjection.enabled) return null;
+  return readNowScratchpad();
+}
+
+/**
+ * Read the v2 static memory content for the turn, gated behind the
+ * personal-memory trust gate. Returns the content (essentials/threads/recent/
+ * buffer concatenated) when the gate admits and v2 memory is enabled,
+ * otherwise `null`. {@link readMemoryV2StaticContent} self-gates on the v2
+ * flag + config, so the `memory-v2-static` injector owns its input rather than
+ * having it threaded in from the agent loop.
+ */
+function readGatedMemoryV2Static(trust: TrustContext): string | null {
+  return isPersonalMemoryAllowed(trust) ? readMemoryV2StaticContent() : null;
+}
+
+/**
+ * Whether PKB is active for the turn: the personal-memory trust gate admits
+ * the actor and the workspace has PKB content to surface.
+ */
+function isPkbActive(trust: TrustContext): boolean {
+  return readGatedPkbContext(trust) !== null;
+}
+
+/** Block prefixes that mark a persisted `<knowledge_base>` injection. */
+const KNOWLEDGE_BASE_BLOCK_PREFIXES = [
+  "<knowledge_base>",
+  "<pkb>", // backward-compat: pre-rename history
+] as const;
+
+/** Block prefixes that mark a persisted NOW.md injection. */
+const NOW_MD_BLOCK_PREFIXES = [
+  "<NOW.md Always keep this up to date",
+  "<now_scratchpad>", // backward-compat: pre-rename history
+] as const;
+
+/**
+ * Matchers that mark a persisted `memory-v2-static` injection. Uses the
+ * `{ prefix, suffix }` wrapper shape (not a bare prefix) so user-authored text
+ * merely starting with `<info>\n` is never mistaken for an injection — matching
+ * the full-wrapper requirement the compaction strip uses for this block.
+ *
+ * The static block is wrapped in `<info>…</info>` today, but rows persisted
+ * before that switch rehydrate verbatim as `<memory>…</memory>` (see
+ * `conversation-lifecycle`), so the legacy wrapper counts as present too.
+ * Matching `<memory>` cannot wrongly skip a needed injection: the static block
+ * is only (re)injected on the first turn (empty history) and right after
+ * compaction (which strips both wrappers), and on neither is a `<memory>` block
+ * present — the dynamic activation `<memory>` block only survives on normal
+ * cached turns, which is exactly when this injector must skip anyway.
+ */
+const MEMORY_V2_STATIC_BLOCK_MATCHERS: readonly InjectionMatcher[] = [
+  { prefix: "<info>\n", suffix: "\n</info>" },
+  { prefix: "<memory>\n", suffix: "\n</memory>" },
+];
+
+/**
+ * Whether a block matching any of the given matchers is already present in the
+ * turn's working messages. Mirrors `stripUserTextBlocksByPrefix` (a
+ * user-message text block whose content matches a bare-prefix or a
+ * `{ prefix, suffix }` wrapper matcher), so presence detection stays in
+ * lockstep with what compaction strips: a block is present here exactly when
+ * compaction would strip it.
+ */
+function hasInjectedUserTextBlock(
+  runMessages: Message[] | undefined,
+  matchers: readonly InjectionMatcher[],
+): boolean {
+  if (!runMessages) return false;
+  return runMessages.some(
+    (message) =>
+      message.role === "user" &&
+      message.content.some(
+        (block) =>
+          block.type === "text" &&
+          matchers.some((m) =>
+            typeof m === "string"
+              ? block.text.startsWith(m)
+              : block.text.startsWith(m.prefix) &&
+                block.text.endsWith(m.suffix),
+          ),
+      ),
+  );
+}
+
 /**
  * Render the PKB context block — wraps the raw content in
  * `<knowledge_base>...</knowledge_base>` while escaping any closing tags
@@ -305,38 +452,40 @@ function buildPkbContextBlock(content: string): string {
 }
 
 /**
- * Build the PKB `<system_reminder>` text. When a dense query vector plus
- * enough scope metadata is available, run the hybrid PKB search to
+ * Build the PKB `<system_reminder>` text. When a dense query vector and the
+ * turn's working messages are available, run the hybrid PKB search to
  * surface up to three relevance hints; fall back to the flat static
  * reminder on empty results or any error.
+ *
+ * The dense/sparse query pair is read off the conversation's live graph
+ * handle ({@link getLiveGraphMemory}) — the memory-retrieval hook records it
+ * there during the turn's retrieval. In-context PKB paths are computed from
+ * the turn's working messages (`runMessages`, supplied by the injector chain)
+ * resolved against the workspace working directory, so the reminder sources
+ * its inputs itself rather than having them threaded through the agent loop.
  */
 async function buildPkbReminderWithHints(
-  inputs: TurnInjectionInputs,
+  ctx: TurnContext,
+  runMessages?: Message[],
 ): Promise<string> {
   let hints: string[] = [];
-  const queryVector = inputs.pkbQueryVector;
-  if (
-    queryVector &&
-    queryVector.length > 0 &&
-    inputs.pkbScopeId &&
-    inputs.pkbConversation &&
-    inputs.pkbRoot
-  ) {
+  const graphMemory = getLiveGraphMemory(ctx.conversationId);
+  const queryVector = graphMemory?.pkbQueryVector;
+  if (queryVector && queryVector.length > 0 && runMessages) {
     try {
+      const pkbRoot = getPkbRoot();
       const results = await searchPkbFiles(
         queryVector,
-        inputs.pkbSparseVector,
+        graphMemory?.pkbSparseVector,
         8,
-        [inputs.pkbScopeId],
+        [PKB_WORKSPACE_SCOPE],
       );
-      const workingDir = inputs.pkbWorkingDir ?? inputs.pkbRoot;
       const inContext = getInContextPkbPaths(
-        inputs.pkbConversation,
-        inputs.pkbAutoInjectList ?? [],
-        inputs.pkbRoot,
-        workingDir,
+        { messages: runMessages },
+        getPkbAutoInjectList(pkbRoot),
+        pkbRoot,
+        getSandboxWorkingDir(),
       );
-      const pkbRoot = inputs.pkbRoot;
       // Gate on `denseScore` (cosine, [0, 1]) so the quality bar is stable
       // regardless of whether sparse was provided. Rank by `hybridScore`
       // (RRF) when available — that captures the sparse signal for
@@ -395,18 +544,30 @@ async function buildPkbReminderWithHints(
  * the memory prefix so `now-md` (40) splices after it.
  *
  * Gating:
- *  - `mode === "full"`.
- *  - `memoryV2Static` is a non-null, non-empty string.
+ *  - `mode === "full"` (skipped in minimal mode).
+ *  - The personal-memory trust gate admits the actor and v2 static memory has
+ *    content (see {@link readGatedMemoryV2Static}).
+ *  - The `<info>` block is not already present in the turn's working messages.
+ *    Like `<knowledge_base>`, the block is injected once and then persists in
+ *    history, so it only needs (re)injecting on the first turn and right after
+ *    compaction strips it — both of which leave the working messages without
+ *    the block. Skipping when it is present keeps the conversation prefix
+ *    stable for Anthropic's prefix caching and avoids a duplicate splice.
  */
 const memoryV2StaticInjector: Injector = {
   name: "memory-v2-static",
   order: DEFAULT_INJECTOR_ORDER.memoryV2Static,
-  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+  async produce(
+    ctx: TurnContext,
+    runMessages?: Message[],
+  ): Promise<InjectionBlock | null> {
     const inputs = readInjectionInputs(ctx);
     const mode = inputs.mode ?? "full";
     if (mode !== "full") return null;
-    const content = inputs.memoryV2Static;
+    const content = readGatedMemoryV2Static(ctx.trust);
     if (!content) return null;
+    if (hasInjectedUserTextBlock(runMessages, MEMORY_V2_STATIC_BLOCK_MATCHERS))
+      return null;
     return {
       id: "memory-v2-static",
       text: buildMemoryV2StaticBlock(content),
@@ -438,17 +599,30 @@ function buildMemoryV2StaticBlock(content: string): string {
  *
  * Gating:
  *  - `mode === "full"` (skipped in minimal mode).
- *  - `nowScratchpad` is a non-null, non-empty string.
+ *  - The personal-memory trust gate admits the actor, the `scratchpadInjection`
+ *    config toggle is on, and NOW.md has content (see
+ *    {@link readGatedNowScratchpad}).
+ *  - The NOW.md block is not already present in the turn's working messages.
+ *    Like `<knowledge_base>`, the block is injected once and then persists in
+ *    history, so it only needs (re)injecting on the first turn and right after
+ *    compaction strips it — both of which leave the working messages without
+ *    the block. Skipping when it is present keeps the conversation prefix
+ *    stable for Anthropic's prefix caching and avoids a duplicate splice.
  */
 const nowMdInjector: Injector = {
   name: "now-md",
   order: DEFAULT_INJECTOR_ORDER.nowMd,
-  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+  async produce(
+    ctx: TurnContext,
+    runMessages?: Message[],
+  ): Promise<InjectionBlock | null> {
     const inputs = readInjectionInputs(ctx);
     const mode = inputs.mode ?? "full";
     if (mode !== "full") return null;
-    const content = inputs.nowScratchpad;
+    const content = readGatedNowScratchpad(ctx.trust);
     if (!content) return null;
+    if (hasInjectedUserTextBlock(runMessages, NOW_MD_BLOCK_PREFIXES))
+      return null;
     const text = `<NOW.md Always keep this up to date; keep under 10 lines>\n${content}\n</NOW.md>`;
     return {
       id: "now-md",
@@ -675,31 +849,26 @@ const threadFocusInjector: Injector = {
 };
 
 /**
- * Bundle every default injector into a single first-party plugin. Registered
- * at daemon startup via `external-plugins-bootstrap.ts`.
+ * Every default injector in ascending `order`. This is the canonical
+ * first-party injection sequence consumed by `applyRuntimeInjections` via the
+ * assembled injector chain.
  *
- * Using one plugin per injector would inflate the registry and create
- * spurious registration-order dependencies; a single plugin keeps the
- * ordering contract entirely in the `order` field.
+ * `order` is the source of truth for sequencing (see {@link DEFAULT_INJECTOR_ORDER});
+ * the chain assembler sorts by it, so this array's literal order is only a
+ * readability convenience.
  */
-export const defaultInjectorsPlugin: Plugin = {
-  manifest: {
-    name: pkg.name,
-    version: pkg.version,
-  },
-  injectors: [
-    diskPressureWarningInjector,
-    workspaceContextInjector,
-    backgroundTurnInjector,
-    unifiedTurnContextInjector,
-    pkbContextInjector,
-    pkbReminderInjector,
-    memoryV2StaticInjector,
-    nowMdInjector,
-    activeDocumentsInjector,
-    documentCommentsInjector,
-    subagentStatusInjector,
-    slackMessagesInjector,
-    threadFocusInjector,
-  ],
-};
+export const defaultInjectors: Injector[] = [
+  diskPressureWarningInjector,
+  workspaceContextInjector,
+  backgroundTurnInjector,
+  unifiedTurnContextInjector,
+  pkbContextInjector,
+  pkbReminderInjector,
+  memoryV2StaticInjector,
+  nowMdInjector,
+  activeDocumentsInjector,
+  documentCommentsInjector,
+  subagentStatusInjector,
+  slackMessagesInjector,
+  threadFocusInjector,
+];