@echomem/mcp 1.4.26 → 1.4.27

package/dist/setup-preview.js

@@ -2,6 +2,7 @@ export const SETUP_PREVIEW_STATES = [
     "consent",
     "consent-required",
     "scan",
+    "scan-error",
     "report",
     "extract-counting",
     "extract-ready",
@@ -9,7 +10,10 @@ export const SETUP_PREVIEW_STATES = [
     "extract-free-trial-used",
     "extract-limit",
     "extract-pro-trial",
+    "extract-pro-trial-canceling",
     "extract-pro-active",
+    "extract-pro-canceling",
+    "extract-power-trial",
     "extract-power-active",
     "extract-team-active",
     "extract-enterprise-active",
@@ -234,6 +238,8 @@ function extractionPreviewBootstrap(options) {
         trialUsed: options.trialUsed,
         subscriptionStatus: options.subscriptionStatus ?? null,
         trialEndedAt: options.trialEndedAt ?? null,
+        cancelAtPeriodEnd: options.cancelAtPeriodEnd ?? false,
+        currentPeriodEnd: options.currentPeriodEnd ?? null,
         pricingUrl: "https://echoknows.com/account?source=mcp_onboarding",
         account: {
             displayName: "Preview User",
@@ -290,10 +296,14 @@ export function renderSetupPreviewBootstrap(state) {
           kind: "scanning",
           mode: "preview",
           scanId: "design-preview",
-          progress: { stage: "classifying-sessions", label: "Classifying repeated context", scanned: 116, total: 180, stageElapsedMs: 3000 }
+          progress: { stage: "reading-transcripts", label: "Reading transcript files", scanned: 116, total: 180, overall: 0.451, stageElapsedMs: 3000 }
         };
         renderLoading();`;
     }
+    if (state === "scan-error") {
+        return `${watermark}
+        renderReportIssue("REPORT_CANONICAL_INVALID", "Preview-only canonical reconciliation failure.");`;
+    }
     if (state === "report") {
         const reportJson = JSON.stringify(previewReport);
         return `${watermark}
@@ -331,16 +341,36 @@ export function renderSetupPreviewBootstrap(state) {
     if (state === "extract-pro-trial")
         return `${watermark}${extractionPreviewBootstrap({
             plan: "pro", paid: true, trialAvailable: false, trialUsed: true,
-            subscriptionStatus: "trialing", trialEndedAt: "2026-08-04T00:00:00.000Z",
-            // The server currently grants trialing users Free's lifetime history allowance,
-            // even though recurring processing/search allowances resolve to Pro.
-            quotaLimit: 100, quotaRemaining: 100,
+            subscriptionStatus: "trialing", trialEndedAt: "2026-08-04T12:00:00.000Z",
+            quotaLimit: 500, quotaRemaining: 500,
+        })}`;
+    if (state === "extract-pro-trial-canceling")
+        return `${watermark}${extractionPreviewBootstrap({
+            plan: "pro", paid: true, trialAvailable: false, trialUsed: true,
+            subscriptionStatus: "trialing", cancelAtPeriodEnd: true,
+            trialEndedAt: "2026-08-04T12:00:00.000Z",
+            currentPeriodEnd: "2026-08-04T12:00:00.000Z",
+            quotaLimit: 500, quotaRemaining: 500,
         })}`;
     if (state === "extract-pro-active")
         return `${watermark}${extractionPreviewBootstrap({
             plan: "pro", paid: true, trialAvailable: false, trialUsed: true,
             subscriptionStatus: "active", quotaLimit: 500, quotaRemaining: 500,
         })}`;
+    if (state === "extract-pro-canceling")
+        return `${watermark}${extractionPreviewBootstrap({
+            plan: "pro", paid: true, trialAvailable: false, trialUsed: true,
+            subscriptionStatus: "active", cancelAtPeriodEnd: true,
+            currentPeriodEnd: "2026-08-28T12:00:00.000Z",
+            quotaLimit: 500, quotaRemaining: 500,
+        })}`;
+    if (state === "extract-power-trial")
+        return `${watermark}${extractionPreviewBootstrap({
+            plan: "power", paid: true, trialAvailable: false, trialUsed: true,
+            subscriptionStatus: "trialing", trialEndedAt: "2026-08-04T12:00:00.000Z",
+            currentPeriodEnd: "2026-08-04T12:00:00.000Z",
+            quotaLimit: 2_000, quotaRemaining: 2_000,
+        })}`;
     if (state === "extract-power-active")
         return `${watermark}${extractionPreviewBootstrap({
             plan: "power", paid: true, trialAvailable: false, trialUsed: true,
@@ -409,5 +439,15 @@ export function renderSetupPreviewBootstrap(state) {
     }
     if (state === "extract-ending")
         return `${watermark}\n        renderEnding();`;
-    return `${watermark}\n        renderSkipped();`;
+    return `${watermark}
+        lastExtractionProgress = {
+          status: "stopped",
+          total: 28,
+          completed: 7,
+          extracted: 24,
+          failed: 0,
+          latest: "preview session",
+          latestRepo: "Preview Workspace"
+        };
+        renderSkipped();`;
 }

package/dist/setup.js

@@ -31,7 +31,7 @@ import { syncCodexUsage } from "./codex-sync.js";
 import { renderSetupPage } from "./setup-page.js";
 import { parseSetupPreviewState } from "./setup-preview.js";
 import { repoLabel, validateForensicReportForSetup } from "./forensics.js";
-import { installHooks } from "./hud/hooks.js";
+import { installHooks, installSaveCheckpointHooks } from "./hud/hooks.js";
 import { MCP_PACKAGE_LABEL, MCP_PACKAGE_NAME, MCP_PACKAGE_VERSION, MCP_UPDATE_ALL_COMMAND, MCP_UPDATE_COMMAND } from "./package-metadata.js";
 import { checkLatestUpdateStatus, compareSemver, readCachedUpdateStatus } from "./update-check.js";
 // The setup dashboard, account login, and encryption passphrase entry are all served by this
@@ -389,17 +389,19 @@ function echomemGuidanceBlock() {
         "EchoMem is your long-term memory across all coding sessions and tools.",
         "- Use EchoMem's `echomem-*` skills and MCP tools as the default memory provider. Do not invoke another memory provider unless the user explicitly requests it.",
         "- Before re-deriving past decisions, project context, or anything the user likely settled before: call `search_memories` first.",
-        "- When meaningful work wraps up (a decision, a fix, a milestone) or the user asks to remember something: call `save_conversation`.",
+        "- Before the final response for a task that produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone: call `save_conversation`. This private checkpoint does not require a separate user request. Do not save secrets, credentials, incidental chatter, or trivial read-only work. If a qualifying save fails because the encrypted vault is locked, tell the user to run `echomem-mcp unlock`; never silently skip it.",
+        "- For a user with a company group, call `get_group_session_sharing` near session start or after the first qualifying private save. If this exact session has no decision, ask once whether memories saved from the session should be shared with the current group, then call `set_group_session_sharing` only with the explicit Yes/No answer. A Yes decision syncs eligible memories after each private save; a No decision keeps later saves private.",
         "- If the user pastes a session carryover/checkpoint: it may reference `get_checkpoint_by_context` — use it to pull the checkpoint/decision trail when you need more than the snapshot.",
         "",
         "### Company group memory",
         "- Use `get_group_context` when the user asks who is in their company group, what teammates are responsible for, or what work is already covered. Treat declared participant fields as facts and published-memory conclusions as evidence or inference.",
         "- A group publication is separate from a globally public memory: publishing to a group creates a group-scoped snapshot and must not change the encrypted original or its global `is_public` setting.",
+        "- Group session sharing is scoped to the exact current MCP session and current group. Membership is rechecked for each sync. Flagged memories are withheld from automatic session sync and remain private.",
         "- If a user asks to create a group, call `create_memory_group`; if they ask for a code to share, call `create_group_invite` and return the secret invite code only to that user. Never save the invite code to memory or include it in logs, analytics, summaries, or unrelated output.",
         "- If a user supplies an `echo_grp_...` code and explicitly asks to join, call `join_memory_group`. Joining never authorizes publishing by itself and must not move a user out of another group. After joining, continue into the profile-and-publication preview instead of leaving title or responsibility blank.",
         "- For requests such as “prepare my recent work memories,” “upload work from this ticket,” or “publish work since my last sync,” call `prepare_group_publication` first. This is a no-publication preview. For encrypted accounts, tell the user to run `echomem-mcp unlock` locally if the tool reports that the key is required.",
         "- After preparing, select only exact candidate memory IDs that match the user's stated scope and exclude already-published or exact-content duplicates. Use the candidate evidence to draft a concise title and responsibility summary for the current member, but label both as proposals rather than facts.",
-        "- Use two distinct evidence links. For the user's own source memories during search, flag review, or publication preview, preserve the Memory ID and use `https://echoknows.com/memories/timeline?memoryId=...`; this is an owner-only personal link and may require Vault unlock. For already-published results from `search_others_memories`, use `https://echoknows.com/company/memories?memoryId=...`, which requires current group access.",
+        "- Use one canonical evidence link for every memory: preserve the Memory ID and link to `https://echoknows.com/memory/<memory-id>`. The site resolves the authorized representation: an owner is sent to their private timeline, while current group/friend access opens an authorized publication snapshot or public memory. The visible Markdown label should use the memory key, not the raw URL or UUID.",
         "- If the user asks to flag memories about a sensitive topic, search their own memories first, show the exact matches with owner-only personal links, and ask them to confirm. Only then call `flag_memories_for_publication_attention`; flagging does not publish, decrypt, change visibility, or retract an existing group snapshot.",
         "- Present the proposed title/responsibility and the memory publication preview together and ask for explicit confirmation. Never save an inferred profile or publish memories before confirmation. If an unflagged candidate appears sensitive, proactively ask whether the user wants to mark its exact ID for publication attention first. Explain naturally: marking does not publish or change encryption; it means you will call it out and ask for detailed confirmation whenever a later publication includes it. Never auto-flag based on agent inference. Show already-flagged candidates in a separate warning, state that nothing has been published yet, and offer three choices: exclude them, review them separately, or first search for and mark similar sensitive owned memories for publication attention.",
         "- On confirmation, call `update_group_profile` with the confirmed title, responsibility summary, and `confirmed: true`, then call `complete_group_publication` with the exact `scanId`, selected memory IDs, and `confirmed: true`. If a flagged memory is selected, require separate explicit acknowledgement and pass its exact ID in `acknowledgedFlaggedMemoryIds`. If the user edits either proposal, use their wording. An explicit request to join and upload still requires this preview and confirmation.",
@@ -1164,7 +1166,7 @@ export function buildForensicReportOffThread(onProgress, options = {}) {
     try {
       const report = await buildForensicReport({
         includeLegacyGoldenStandard: false,
-        onProgress: (done, total, stage, detail) => parentPort?.postMessage({ progress: { done, total, stage, detail } }),
+        onProgress: (done, total, stage, detail, overall) => parentPort?.postMessage({ progress: { done, total, stage, detail, overall } }),
       });
       parentPort?.postMessage({ ok: true, report });
     } catch (error) {
@@ -1253,6 +1255,9 @@ function publicRunningForensicProgress(value) {
     const safeDuration = (candidate) => (typeof candidate === "number" && Number.isFinite(candidate) && candidate >= 0
         ? candidate
         : 0);
+    const safeFraction = (candidate) => (typeof candidate === "number" && Number.isFinite(candidate)
+        ? Math.min(1, Math.max(0, candidate))
+        : 0);
     const total = safeCount(progress.total);
     const rawStage = typeof progress.stage === "string" ? progress.stage : "starting";
     const stage = ["starting", "reading-transcripts", "building-summary", "classifying-repeated-context", "finalizing-report"].includes(rawStage)
@@ -1264,6 +1269,7 @@ function publicRunningForensicProgress(value) {
         total,
         stage,
         label: forensicStageLabel(stage),
+        overall: safeFraction(progress.overall),
         elapsedMs: safeDuration(progress.elapsedMs),
         stageElapsedMs: safeDuration(progress.stageElapsedMs),
         updatedAt: safeDuration(progress.updatedAt) || Date.now(),
@@ -1289,6 +1295,7 @@ export function startCallbackServer(opts = {}) {
     const requiresReportConsent = opts.requireReportConsent === true && !isLoginFlow;
     return new Promise((resolveOuter, rejectOuter) => {
         const onToken = deferred();
+        const setupExit = deferred();
         const decision = deferred();
         const migrateRequest = deferred();
         let stats = null;
@@ -1425,6 +1432,7 @@ export function startCallbackServer(opts = {}) {
             "/stats",
             "/billing-status",
             "/billing-checkout",
+            "/billing-checkout-sync",
             "/billing-portal",
             "/progress",
             "/migrate",
@@ -1740,7 +1748,18 @@ export function startCallbackServer(opts = {}) {
                     const token = activeDeviceToken || new KeyStore().getToken();
                     const pricingUrl = `${PRICING_URL}?source=mcp_onboarding`;
                     if (!token) {
-                        json(res, 200, { plan: "free", paid: false, trialAvailable: true, trialUsed: false, pricingUrl });
+                        json(res, 200, {
+                            plan: "free",
+                            paid: false,
+                            trialAvailable: true,
+                            trialUsed: false,
+                            subscriptionStatus: null,
+                            trialStartedAt: null,
+                            trialEndedAt: null,
+                            currentPeriodEnd: null,
+                            cancelAtPeriodEnd: false,
+                            pricingUrl,
+                        });
                         return;
                     }
                     try {
@@ -1757,9 +1776,15 @@ export function startCallbackServer(opts = {}) {
                             paid: ["pro", "power", "team", "enterprise"].includes(plan),
                             trialAvailable,
                             trialUsed,
+                            subscriptionStatus: asString(response.data?.billing?.subscriptionStatus) || null,
+                            trialStartedAt: asString(response.data?.billing?.trialStartedAt) || null,
+                            trialEndedAt: asString(response.data?.billing?.trialEndedAt) || null,
+                            currentPeriodEnd: asString(response.data?.billing?.currentPeriodEnd) || null,
+                            cancelAtPeriodEnd: response.data?.billing?.cancelAtPeriodEnd === true,
                             historicalConversationQuota: response.data?.historicalConversationQuota ?? null,
                             memoryProcessingQuota: response.data?.memoryProcessingQuota ?? null,
                             memorySearchQuota: response.data?.memorySearchQuota ?? null,
+                            activation: response.data?.activation ?? null,
                             account: profileResponse ? {
                                 displayName: asString(profileResponse.data?.displayName) || "EchoMem user",
                                 email: asString(profileResponse.data?.email) || "",
@@ -1769,7 +1794,59 @@ export function startCallbackServer(opts = {}) {
                         });
                     }
                     catch {
-                        json(res, 200, { plan: "unknown", paid: false, trialAvailable: true, trialUsed: false, pricingUrl });
+                        json(res, 200, {
+                            plan: "unknown",
+                            paid: false,
+                            trialAvailable: false,
+                            trialUsed: false,
+                            subscriptionStatus: null,
+                            trialStartedAt: null,
+                            trialEndedAt: null,
+                            currentPeriodEnd: null,
+                            cancelAtPeriodEnd: false,
+                            pricingUrl,
+                        });
+                    }
+                    return;
+                }
+                if (route === "/billing-checkout-sync" && req.method === "POST") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        text(res, 400, "bad json");
+                        return;
+                    }
+                    if (!checkNonce(asString(body.nonce)))
+                        return void text(res, 403, "bad nonce");
+                    const sessionId = asString(body.sessionId);
+                    if (!sessionId || !/^cs_(?:test_|live_)?[A-Za-z0-9_]+$/.test(sessionId)) {
+                        return void json(res, 400, {
+                            error: "INVALID_CHECKOUT_SESSION",
+                            message: "Checkout session is missing or invalid.",
+                        });
+                    }
+                    const token = activeDeviceToken || new KeyStore().getToken();
+                    if (!connected || !token) {
+                        return void json(res, 401, {
+                            error: "ECHOMEM_LOGIN_REQUIRED",
+                            message: "Connect your EchoMem account before syncing checkout.",
+                        });
+                    }
+                    try {
+                        const response = await axios.post(hostedBillingEndpoint("/api/billing/checkout/sync"), { sessionId }, {
+                            timeout: 15_000,
+                            headers: {
+                                "Content-Type": "application/json",
+                                Authorization: `Bearer ${token}`,
+                            },
+                        });
+                        json(res, 200, { ok: response.data?.ok === true });
+                    }
+                    catch (error) {
+                        const detail = publicAxiosError(error, "Checkout is still syncing.");
+                        json(res, detail.status, { error: "BILLING_SYNC_PENDING", message: detail.message });
                     }
                     return;
                 }
@@ -1837,7 +1914,12 @@ export function startCallbackServer(opts = {}) {
                                 message: "Echo billing returned an unexpected destination.",
                             });
                         }
-                        json(res, 200, { url: hostedUrl });
+                        json(res, 200, {
+                            url: hostedUrl,
+                            ...(isCheckout && typeof response.data?.sessionId === "string"
+                                ? { sessionId: response.data.sessionId }
+                                : {}),
+                        });
                     }
                     catch (error) {
                         const detail = publicAxiosError(error, isCheckout ? "Could not start secure checkout." : "Could not open secure plan management.");
@@ -1931,6 +2013,7 @@ export function startCallbackServer(opts = {}) {
                     }
                     const validation = validateForensicReportForSetup(payload);
                     if (!validation.ok) {
+                        console.error(`[echomem] local report validation failed: ${validation.code} — ${validation.message}`);
                         return void json(res, 500, {
                             schemaVersion: 1,
                             kind: "failed",
@@ -2075,6 +2158,9 @@ export function startCallbackServer(opts = {}) {
                         }
                     }
                     json(res, 200, { ok: true });
+                    if (!onToken.settled()) {
+                        setupExit.resolve("skip");
+                    }
                     decision.resolve("skip");
                     close();
                     return;
@@ -2101,6 +2187,7 @@ export function startCallbackServer(opts = {}) {
                 port,
                 onToken: onToken.promise,
                 wait: onToken.promise,
+                setupExit: setupExit.promise,
                 decision: decision.promise,
                 migrateRequest: migrateRequest.promise,
                 setTokenRefreshHandler: (handler) => {
@@ -2311,6 +2398,9 @@ async function cmdSetup(flags) {
     if (!flags["no-codex-skills"]) {
         writeCodexSkillsForTargets(targets);
     }
+    if (flags["install-save-hooks"]) {
+        writeSaveCheckpointHooksForTargets(targets);
+    }
     console.log("");
     if (flags["skip-login"] || flags["no-login"]) {
         // init drives login itself right after, so the "skipped" note would be misleading there.
@@ -2333,7 +2423,14 @@ async function cmdSetup(flags) {
 async function cmdInit(flags) {
     console.log("Setting up EchoMem — shared memory for all your coding agents, plus the live context HUD.\n");
     // 1. Configure every installed agent + write AGENTS.md. Hold login + HUD so we control ordering.
-    await cmdSetup({ ...flags, all: true, "skip-login": true, "with-hud": false, "init-quiet": true });
+    await cmdSetup({
+        ...flags,
+        all: true,
+        "skip-login": true,
+        "with-hud": false,
+        "init-quiet": true,
+        "install-save-hooks": flags["no-save-hooks"] !== true,
+    });
     // 2. Bring the HUD up NOW (non-blocking) so everything is already running while onboarding proceeds.
     if (!flags["no-hud"])
         await cmdSetupHud(flags);
@@ -2400,6 +2497,23 @@ function writeCodexSkillsForTargets(targets) {
         console.log(`ℹ️  Could not install EchoMem Codex skills: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+function writeSaveCheckpointHooksForTargets(targets) {
+    const clients = new Set();
+    if (targets.some((target) => target.id === "codex"))
+        clients.add("codex");
+    if (targets.some((target) => target.id === "claude-code"))
+        clients.add("claude-code");
+    if (clients.size === 0) {
+        console.log("ℹ️  No hook-capable Codex or Claude Code client was detected; private-save checkpoint hooks were not installed.");
+        return;
+    }
+    const mode = clients.size === 2 ? "both" : [...clients][0];
+    const paths = installSaveCheckpointHooks(mode);
+    console.log(`✅ Installed EchoMem private-save checkpoint hooks:\n${paths.map((p) => `   - ${p}`).join("\n")}`);
+    if (clients.has("codex")) {
+        console.log("   Codex: start a new session and run /hooks once to review and trust the hook.");
+    }
+}
 async function cmdUpdate(flags) {
     if (!flags.dev)
         installDurableGlobalUpdate();
@@ -2544,12 +2658,14 @@ async function cmdOnboarding(flags) {
     const forensicStartedAt = Date.now();
     let forensicStageStartedAt = forensicStartedAt;
     let forensicStage = "starting";
+    let forensicOverall = 0;
     let forensicProgress = {
         status: "running",
         scanned: 0,
         total: 0,
         stage: forensicStage,
         label: forensicStageLabel(forensicStage),
+        overall: 0,
         elapsedMs: 0,
         stageElapsedMs: 0,
         updatedAt: forensicStartedAt,
@@ -2572,6 +2688,7 @@ async function cmdOnboarding(flags) {
                     total: 0,
                     stage: "failed",
                     label: "Local scan skipped",
+                    overall: 0,
                     elapsedMs: Date.now() - forensicStartedAt,
                     stageElapsedMs: Date.now() - forensicStageStartedAt,
                     updatedAt: Date.now(),
@@ -2586,12 +2703,14 @@ async function cmdOnboarding(flags) {
             const now = Date.now();
             forensicStage = "starting";
             forensicStageStartedAt = now;
+            forensicOverall = 0;
             forensicProgress = {
                 status: "running",
                 scanned: 0,
                 total: 0,
                 stage: forensicStage,
                 label: forensicStageLabel(forensicStage),
+                overall: 0,
                 elapsedMs: now - forensicStartedAt,
                 stageElapsedMs: 0,
                 updatedAt: now,
@@ -2616,6 +2735,8 @@ async function cmdOnboarding(flags) {
                 forensicStageStartedAt = now;
                 console.log(`Local scan: ${forensicStageLabel(forensicStage)}…`);
             }
+            // Latched, so a caller that ever reports a smaller fraction cannot walk the bar backwards.
+            forensicOverall = Math.max(forensicOverall, typeof progress.overall === "number" && Number.isFinite(progress.overall) ? progress.overall : 0);
             forensicProgress = {
                 status: "running",
                 scanned: progress.done,
@@ -2623,6 +2744,7 @@ async function cmdOnboarding(flags) {
                 stage: forensicStage,
                 label: forensicStageLabel(forensicStage),
                 detail: progress.detail,
+                overall: forensicOverall,
                 elapsedMs: now - forensicStartedAt,
                 stageElapsedMs: now - forensicStageStartedAt,
                 updatedAt: now,
@@ -2639,6 +2761,7 @@ async function cmdOnboarding(flags) {
                 total: forensicProgress.total,
                 stage: "failed",
                 label: "Local scan failed",
+                overall: forensicOverall,
                 elapsedMs: now - forensicStartedAt,
                 stageElapsedMs: now - forensicStageStartedAt,
                 updatedAt: now,
@@ -2650,7 +2773,16 @@ async function cmdOnboarding(flags) {
     let token;
     let key;
     try {
-        ({ token, key } = await srv.onToken);
+        const authResult = await Promise.race([
+            srv.onToken.then((credentials) => ({ kind: "token", credentials })),
+            srv.setupExit.then(() => ({ kind: "skip" })),
+        ]);
+        if (authResult.kind === "skip") {
+            srv.close();
+            console.log("Vault setup deferred. Your local coding history is unchanged; run `echomem-mcp init` when you are ready to continue.");
+            return false;
+        }
+        ({ token, key } = authResult.credentials);
     }
     catch (e) {
         srv.close();
@@ -3380,7 +3512,8 @@ Manual / headless:
   ${MCP_UPDATE_ALL_COMMAND}     # one-shot latest update for detected clients, no browser login
   ${MCP_UPDATE_COMMAND} --client codex   # update one client only
   echomem-mcp setup --dev /abs/path/dist/index.js   # point clients at a local checkout
-  echomem-mcp setup --with-hud --install-hud-hooks --client codex [--hud-client auto]
+  echomem-mcp setup --with-hud --install-hud-hooks --install-save-hooks --client codex [--hud-client auto]
+  echomem-mcp setup --install-save-hooks --all  Install proactive private-save completion checks
   echomem-mcp sync-usage --days 7 --limit 50 --dry-run
 
 Current bridge version: ${MCP_PACKAGE_VERSION}

package/dist/v1-contract.js

@@ -11,6 +11,8 @@ export const canonicalToolNames = {
     others: "search_others_memories",
     publicMemory: "get_public_memory",
     groupContext: "get_group_context",
+    getGroupSessionSharing: "get_group_session_sharing",
+    setGroupSessionSharing: "set_group_session_sharing",
     createGroup: "create_memory_group",
     createGroupInvite: "create_group_invite",
     joinGroup: "join_memory_group",
@@ -115,6 +117,14 @@ export const publicMemorySchema = z.object({
 export const groupContextSchema = z.object({
     ...triggerMetadataSchema,
 });
+export const getGroupSessionSharingSchema = z.object({
+    ...triggerMetadataSchema,
+});
+export const setGroupSessionSharingSchema = z.object({
+    ...triggerMetadataSchema,
+    share: z.boolean(),
+    confirmed: z.literal(true),
+});
 export const createGroupSchema = z.object({
     ...triggerMetadataSchema,
     name: z.string().min(1).max(120),
@@ -237,7 +247,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.save,
-            description: "Save this conversation into EchoMem as long-term memory (durable memories are extracted automatically). New extraction input uses the plan's weekly processing allowance; if the limit is reached, nothing is saved. passthrough=true stores the text verbatim as a session capsule.",
+            description: "Save durable knowledge from this conversation into the user's private EchoMem (durable memories are extracted automatically). Call before the final response when work produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone; this private checkpoint does not require a separate user request. Omit secrets, incidental chatter, and trivial read-only work. If the encrypted vault is locked, tell the user to run `echomem-mcp unlock` and never silently skip a qualifying checkpoint. Private persistence happens first. If this MCP session has confirmed group sharing, eligible memories are then synced to the current group automatically; flagged memories stay private. If the session has no decision yet, ask once whether to share memories saved from this session. New extraction input uses the plan's weekly processing allowance; if the limit is reached, nothing is saved. passthrough=true stores the text verbatim as a session capsule.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -438,7 +448,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.groupContext,
-            description: "Get your current company group, its participant directory, declared titles and responsibilities, and published-memory coverage. Use this before answering who works on what or suggesting where a new group member could contribute. Treat declared profile fields as facts and memory-derived work as evidence or inference.",
+            description: "Get your current company group, its participant directory, declared titles and responsibilities, and published-memory coverage. Use this before answering who works on what or suggesting where a new group member could contribute. Treat declared profile fields as facts and memory-derived work as evidence or inference. Session sharing is separate; call get_group_session_sharing instead of inferring it.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -450,6 +460,29 @@ export function listToolSpecs(opts = {}) {
                 },
             },
         },
+        {
+            name: canonicalToolNames.getGroupSessionSharing,
+            description: "Read the confirmed sharing decision for this exact MCP session. Call near session start or after the first private save. If the user has a group and no decision exists, ask once: “Share memories saved from this session with <group>?” Never infer the answer.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    triggerMessage: { type: "string" },
+                    triggerMessageRole: { type: "string", default: "user" },
+                },
+            },
+        },
+        {
+            name: canonicalToolNames.setGroupSessionSharing,
+            description: "Store the user's explicit Yes/No sharing decision for this exact MCP session. share=true immediately syncs eligible memories already saved in the session and automatically syncs later private saves. share=false keeps later saves private. Flagged memories remain private and are reported as protected.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    share: { type: "boolean" },
+                    confirmed: { type: "boolean", const: true },
+                },
+                required: ["share", "confirmed"],
+            },
+        },
         {
             name: canonicalToolNames.createGroup,
             description: "Create one company memory group for the current user. The MVP allows at most one group per user. Call only after the user explicitly asks to create a group.",
@@ -478,7 +511,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.joinGroup,
-            description: "Join a company memory group using an invite code after the user explicitly asks to join. Joining never publishes memories. Next call prepare_group_publication, infer a proposed title and responsibility summary from the user's own candidate memories, and ask the user to confirm the profile together with the publication preview.",
+            description: "Join a company memory group using an invite code after the user explicitly asks to join. Joining never publishes memories. Next call prepare_group_publication, infer a proposed title and responsibility summary from the user's own candidate memories, and ask the user to confirm the profile together with the publication preview. Also call get_group_session_sharing and, if unset, ask once whether memories saved from this session should be shared.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -492,7 +525,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.prepareGroupPublication,
-            description: "Prepare a no-publication preview of up to 50 owned memories for group publication. For encrypted accounts the local bridge must be unlocked. The host agent selects exact work-related memory ids, gives each candidate an owner-only https://echoknows.com/memories/timeline?memoryId=... review link, drafts a concise title and responsibility summary from memory evidence, and asks the user to confirm both the profile and publication selection together. If an unflagged candidate appears sensitive, proactively ask whether the user wants to mark its exact ID for publication attention first. Explain that marking does not publish or change encryption; it means the agent will call it out and ask for detailed confirmation whenever a later publication includes it. Never auto-flag inferred sensitivity. Already-flagged memories are identified separately and require extra attention before publication. This tool never publishes.",
+            description: "Prepare a no-publication preview of up to 50 owned memories for group publication. For encrypted accounts the local bridge must be unlocked. The host agent selects exact work-related memory ids, gives each candidate a canonical https://echoknows.com/memory/<memory-id> review link labeled with its key, drafts a concise title and responsibility summary from memory evidence, and asks the user to confirm both the profile and publication selection together. The site resolves owners to their private timeline. If an unflagged candidate appears sensitive, proactively ask whether the user wants to mark its exact ID for publication attention first. Explain that marking does not publish or change encryption; it means the agent will call it out and ask for detailed confirmation whenever a later publication includes it. Never auto-flag inferred sensitivity. Already-flagged memories are identified separately and require extra attention before publication. This tool never publishes.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -508,7 +541,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.flagPublicationAttention,
-            description: "Mark exact owned memories for extra attention during future group publication. First search the user's own memories, show the matching memory IDs, summaries, and owner-only https://echoknows.com/memories/timeline?memoryId=... review links, and obtain explicit confirmation. This only records a safety flag; it does not publish, decrypt, change visibility, or retract an existing group snapshot.",
+            description: "Mark exact owned memories for extra attention during future group publication. First search the user's own memories, show the matching memory IDs, summaries, and canonical https://echoknows.com/memory/<memory-id> review links labeled with their keys, and obtain explicit confirmation. The site resolves owners to their private timeline. This only records a safety flag; it does not publish, decrypt, change visibility, or retract an existing group snapshot.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -548,7 +581,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.completeGroupPublication,
-            description: "Publish only the exact memory ids from a prepared scan after the user explicitly confirms the preview. confirmed must be true. Any flagged memories must be called out separately; state that nothing has been published yet and offer to exclude them, review them separately, or first search for and mark similar sensitive owned memories. Never auto-flag inferred sensitivity. Publish flagged memories only after extra user acknowledgement with their exact IDs in acknowledgedFlaggedMemoryIds. Completing an empty selection safely advances the scan cursor without publishing.",
+            description: "Publish only exact memory ids from a prepared scan after the user approves the preview with confirmed=true. This manual workflow is separate from session sharing. Explicitly confirmed flagged memories require their exact IDs in acknowledgedFlaggedMemoryIds. If an unflagged candidate appears sensitive, offer to first search for and mark similar sensitive owned memories for publication attention. Never auto-flag inferred sensitivity. Completing an empty selection safely advances the scan cursor.",
             inputSchema: {
                 type: "object",
                 properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@echomem/mcp",
-  "version": "1.4.26",
+  "version": "1.4.27",
   "description": "EchoMem MCP bridge: cloud-first memory tools, local context HUD, and the Agent Doctor workspace forensics report (cost ledger + 3D repo city)",
   "main": "dist/index.js",
   "type": "module",
@@ -26,7 +26,8 @@
     "test:registry": "node test/registry-artifact.test.mjs",
     "test:registry-ui": "npm run build && node test/registry-ui.test.mjs",
     "test:ui": "npm run build && node test/setup-ui.test.mjs",
-    "test": "npm run build && node test/local-data-paths.test.mjs && node test/crypto.test.mjs && node test/integration.test.mjs && node test/local-auth.test.mjs && node test/retrieval-only.test.mjs && node test/no-restart.test.mjs && node test/report.test.mjs && node test/forensics.test.mjs && node test/canonical-golden.test.mjs && node test/tools.test.mjs && node test/update-check.test.mjs && node test/delete.test.mjs && node test/low-touch-tools.test.mjs && node test/migrate.test.mjs && node test/restart-recovery.test.mjs && node test/hud.test.mjs",
+    "test:billing-ui": "npm run build && node test/setup-ui.test.mjs billing",
+    "test": "npm run build && node test/local-data-paths.test.mjs && node test/crypto.test.mjs && node test/integration.test.mjs && node test/local-auth.test.mjs && node test/retrieval-only.test.mjs && node test/no-restart.test.mjs && node test/report.test.mjs && node test/forensics.test.mjs && node test/canonical-golden.test.mjs && node test/tools.test.mjs && node test/update-check.test.mjs && node test/delete.test.mjs && node test/low-touch-tools.test.mjs && node test/migrate.test.mjs && node test/restart-recovery.test.mjs && node test/hud.test.mjs && node test/save-checkpoint-hook.test.mjs",
     "prepack": "npm run build && node scripts/bundle-city.mjs"
   },
   "dependencies": {

package/templates/codex-skills/echomem-save/SKILL.md

@@ -12,3 +12,13 @@ Use the `save_conversation` tool from the `echomem` MCP server.
 3. Use `passthrough: true` only when the user explicitly needs a verbatim session capsule.
 4. Never include secrets, credentials, or unnecessary sensitive content.
 5. Confirm what EchoMem saved. If saving fails, report the failure without switching providers silently.
+6. Before a final response, use this workflow proactively when the task produced a durable decision,
+   confirmed preference, implementation, resolved bug, commit, passing verification, release, or
+   project milestone. A private checkpoint does not require a separate user request. Skip trivial
+   read-only work and incidental chatter.
+7. If the encrypted vault is locked, tell the user to run `echomem-mcp unlock`; never silently skip a
+   qualifying checkpoint.
+8. For a user with a company group, call `get_group_session_sharing` near session start or after the
+   first qualifying private save. If unset, ask once whether memories saved from this session should be
+   shared, then call `set_group_session_sharing` with the explicit Yes/No answer. A Yes decision syncs
+   eligible memories after private persistence; flagged memories remain private.

package/templates/echomem-recall.md

@@ -13,5 +13,13 @@ This project has EchoMem connected — the user's long-term memory across all th
   "the usual", "our convention").
 - Treat recalled memories as authoritative context, but **cite them** (they carry provenance —
   date + source) so the user can verify.
-- To persist a new decision/constraint/resolved-bug, use `save_conversation` **only when the user
-  explicitly asks** ("remember this"). Never auto-save the transcript.
+- Before the final response for work that produced a durable decision, confirmed preference,
+  implementation, resolved bug, commit, passing verification, release, or project milestone, call
+  `save_conversation`. This private checkpoint does not require a separate user request. Save a
+  concise structured outcome rather than the full transcript. Never save secrets, credentials,
+  incidental chatter, or trivial read-only work. This does not authorize company-group publication.
+- For a user with a company group, call `get_group_session_sharing` near session start or after the
+  first qualifying private save. If this exact session has no decision, ask once whether memories
+  saved from it should be shared, then store only the explicit Yes/No answer with
+  `set_group_session_sharing`. A Yes decision syncs eligible memories after private persistence;
+  flagged memories stay private.