@echomem/mcp 1.4.26 → 1.4.28

package/dist/v1-contract.js

@@ -11,6 +11,8 @@ export const canonicalToolNames = {
     others: "search_others_memories",
     publicMemory: "get_public_memory",
     groupContext: "get_group_context",
+    getGroupSessionSharing: "get_group_session_sharing",
+    setGroupSessionSharing: "set_group_session_sharing",
     createGroup: "create_memory_group",
     createGroupInvite: "create_group_invite",
     joinGroup: "join_memory_group",
@@ -115,6 +117,14 @@ export const publicMemorySchema = z.object({
 export const groupContextSchema = z.object({
     ...triggerMetadataSchema,
 });
+export const getGroupSessionSharingSchema = z.object({
+    ...triggerMetadataSchema,
+});
+export const setGroupSessionSharingSchema = z.object({
+    ...triggerMetadataSchema,
+    share: z.boolean(),
+    confirmed: z.literal(true),
+});
 export const createGroupSchema = z.object({
     ...triggerMetadataSchema,
     name: z.string().min(1).max(120),
@@ -237,7 +247,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.save,
-            description: "Save this conversation into EchoMem as long-term memory (durable memories are extracted automatically). New extraction input uses the plan's weekly processing allowance; if the limit is reached, nothing is saved. passthrough=true stores the text verbatim as a session capsule.",
+            description: "Save durable knowledge from this conversation into the user's private EchoMem (durable memories are extracted automatically). Call before the final response when work produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone; this private checkpoint does not require a separate user request. Omit secrets, incidental chatter, and trivial read-only work. If the encrypted vault is locked, tell the user to run `echomem-mcp unlock` and never silently skip a qualifying checkpoint. Private persistence happens first. If this MCP session has confirmed group sharing, eligible memories are then synced to the current group automatically; flagged memories stay private. If the session has no decision yet, ask once whether to share memories saved from this session. New extraction input uses the plan's weekly processing allowance; if the limit is reached, nothing is saved. passthrough=true stores the text verbatim as a session capsule.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -438,7 +448,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.groupContext,
-            description: "Get your current company group, its participant directory, declared titles and responsibilities, and published-memory coverage. Use this before answering who works on what or suggesting where a new group member could contribute. Treat declared profile fields as facts and memory-derived work as evidence or inference.",
+            description: "Get your current company group, its participant directory, declared titles and responsibilities, and published-memory coverage. Use this before answering who works on what or suggesting where a new group member could contribute. Treat declared profile fields as facts and memory-derived work as evidence or inference. Session sharing is separate; call get_group_session_sharing instead of inferring it.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -450,6 +460,29 @@ export function listToolSpecs(opts = {}) {
                 },
             },
         },
+        {
+            name: canonicalToolNames.getGroupSessionSharing,
+            description: "Read the confirmed sharing decision for this exact MCP session. Call near session start or after the first private save. If the user has a group and no decision exists, ask once: “Share memories saved from this session with <group>?” Never infer the answer.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    triggerMessage: { type: "string" },
+                    triggerMessageRole: { type: "string", default: "user" },
+                },
+            },
+        },
+        {
+            name: canonicalToolNames.setGroupSessionSharing,
+            description: "Store the user's explicit Yes/No sharing decision for this exact MCP session. share=true immediately syncs eligible memories already saved in the session and automatically syncs later private saves. share=false keeps later saves private. Flagged memories remain private and are reported as protected.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    share: { type: "boolean" },
+                    confirmed: { type: "boolean", const: true },
+                },
+                required: ["share", "confirmed"],
+            },
+        },
         {
             name: canonicalToolNames.createGroup,
             description: "Create one company memory group for the current user. The MVP allows at most one group per user. Call only after the user explicitly asks to create a group.",
@@ -478,7 +511,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.joinGroup,
-            description: "Join a company memory group using an invite code after the user explicitly asks to join. Joining never publishes memories. Next call prepare_group_publication, infer a proposed title and responsibility summary from the user's own candidate memories, and ask the user to confirm the profile together with the publication preview.",
+            description: "Join a company memory group using an invite code after the user explicitly asks to join. Joining never publishes memories. Next call prepare_group_publication, infer a proposed title and responsibility summary from the user's own candidate memories, and ask the user to confirm the profile together with the publication preview. Also call get_group_session_sharing and, if unset, ask once whether memories saved from this session should be shared.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -492,7 +525,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.prepareGroupPublication,
-            description: "Prepare a no-publication preview of up to 50 owned memories for group publication. For encrypted accounts the local bridge must be unlocked. The host agent selects exact work-related memory ids, gives each candidate an owner-only https://echoknows.com/memories/timeline?memoryId=... review link, drafts a concise title and responsibility summary from memory evidence, and asks the user to confirm both the profile and publication selection together. If an unflagged candidate appears sensitive, proactively ask whether the user wants to mark its exact ID for publication attention first. Explain that marking does not publish or change encryption; it means the agent will call it out and ask for detailed confirmation whenever a later publication includes it. Never auto-flag inferred sensitivity. Already-flagged memories are identified separately and require extra attention before publication. This tool never publishes.",
+            description: "Prepare a no-publication preview of up to 50 owned memories for group publication. For encrypted accounts the local bridge must be unlocked. The host agent selects exact work-related memory ids, gives each candidate a canonical https://echoknows.com/memory/<memory-id> review link labeled with its key, drafts a concise title and responsibility summary from memory evidence, and asks the user to confirm both the profile and publication selection together. The site resolves owners to their private timeline. If an unflagged candidate appears sensitive, proactively ask whether the user wants to mark its exact ID for publication attention first. Explain that marking does not publish or change encryption; it means the agent will call it out and ask for detailed confirmation whenever a later publication includes it. Never auto-flag inferred sensitivity. Already-flagged memories are identified separately and require extra attention before publication. This tool never publishes.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -508,7 +541,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.flagPublicationAttention,
-            description: "Mark exact owned memories for extra attention during future group publication. First search the user's own memories, show the matching memory IDs, summaries, and owner-only https://echoknows.com/memories/timeline?memoryId=... review links, and obtain explicit confirmation. This only records a safety flag; it does not publish, decrypt, change visibility, or retract an existing group snapshot.",
+            description: "Mark exact owned memories for extra attention during future group publication. First search the user's own memories, show the matching memory IDs, summaries, and canonical https://echoknows.com/memory/<memory-id> review links labeled with their keys, and obtain explicit confirmation. The site resolves owners to their private timeline. This only records a safety flag; it does not publish, decrypt, change visibility, or retract an existing group snapshot.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -548,7 +581,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.completeGroupPublication,
-            description: "Publish only the exact memory ids from a prepared scan after the user explicitly confirms the preview. confirmed must be true. Any flagged memories must be called out separately; state that nothing has been published yet and offer to exclude them, review them separately, or first search for and mark similar sensitive owned memories. Never auto-flag inferred sensitivity. Publish flagged memories only after extra user acknowledgement with their exact IDs in acknowledgedFlaggedMemoryIds. Completing an empty selection safely advances the scan cursor without publishing.",
+            description: "Publish only exact memory ids from a prepared scan after the user approves the preview with confirmed=true. This manual workflow is separate from session sharing. Explicitly confirmed flagged memories require their exact IDs in acknowledgedFlaggedMemoryIds. If an unflagged candidate appears sensitive, offer to first search for and mark similar sensitive owned memories for publication attention. Never auto-flag inferred sensitivity. Completing an empty selection safely advances the scan cursor.",
             inputSchema: {
                 type: "object",
                 properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@echomem/mcp",
-  "version": "1.4.26",
+  "version": "1.4.28",
   "description": "EchoMem MCP bridge: cloud-first memory tools, local context HUD, and the Agent Doctor workspace forensics report (cost ledger + 3D repo city)",
   "main": "dist/index.js",
   "type": "module",
@@ -26,7 +26,8 @@
     "test:registry": "node test/registry-artifact.test.mjs",
     "test:registry-ui": "npm run build && node test/registry-ui.test.mjs",
     "test:ui": "npm run build && node test/setup-ui.test.mjs",
-    "test": "npm run build && node test/local-data-paths.test.mjs && node test/crypto.test.mjs && node test/integration.test.mjs && node test/local-auth.test.mjs && node test/retrieval-only.test.mjs && node test/no-restart.test.mjs && node test/report.test.mjs && node test/forensics.test.mjs && node test/canonical-golden.test.mjs && node test/tools.test.mjs && node test/update-check.test.mjs && node test/delete.test.mjs && node test/low-touch-tools.test.mjs && node test/migrate.test.mjs && node test/restart-recovery.test.mjs && node test/hud.test.mjs",
+    "test:billing-ui": "npm run build && node test/setup-ui.test.mjs billing",
+    "test": "npm run build && node test/local-data-paths.test.mjs && node test/crypto.test.mjs && node test/integration.test.mjs && node test/local-auth.test.mjs && node test/retrieval-only.test.mjs && node test/no-restart.test.mjs && node test/report.test.mjs && node test/forensics.test.mjs && node test/canonical-golden.test.mjs && node test/tools.test.mjs && node test/update-check.test.mjs && node test/delete.test.mjs && node test/low-touch-tools.test.mjs && node test/migrate.test.mjs && node test/restart-recovery.test.mjs && node test/hud.test.mjs && node test/save-checkpoint-hook.test.mjs",
     "prepack": "npm run build && node scripts/bundle-city.mjs"
   },
   "dependencies": {

package/templates/codex-skills/echomem-save/SKILL.md

@@ -12,3 +12,13 @@ Use the `save_conversation` tool from the `echomem` MCP server.
 3. Use `passthrough: true` only when the user explicitly needs a verbatim session capsule.
 4. Never include secrets, credentials, or unnecessary sensitive content.
 5. Confirm what EchoMem saved. If saving fails, report the failure without switching providers silently.
+6. Before a final response, use this workflow proactively when the task produced a durable decision,
+   confirmed preference, implementation, resolved bug, commit, passing verification, release, or
+   project milestone. A private checkpoint does not require a separate user request. Skip trivial
+   read-only work and incidental chatter.
+7. If the encrypted vault is locked, tell the user to run `echomem-mcp unlock`; never silently skip a
+   qualifying checkpoint.
+8. For a user with a company group, call `get_group_session_sharing` near session start or after the
+   first qualifying private save. If unset, ask once whether memories saved from this session should be
+   shared, then call `set_group_session_sharing` with the explicit Yes/No answer. A Yes decision syncs
+   eligible memories after private persistence; flagged memories remain private.

package/templates/echomem-recall.md

@@ -13,5 +13,13 @@ This project has EchoMem connected — the user's long-term memory across all th
   "the usual", "our convention").
 - Treat recalled memories as authoritative context, but **cite them** (they carry provenance —
   date + source) so the user can verify.
-- To persist a new decision/constraint/resolved-bug, use `save_conversation` **only when the user
-  explicitly asks** ("remember this"). Never auto-save the transcript.
+- Before the final response for work that produced a durable decision, confirmed preference,
+  implementation, resolved bug, commit, passing verification, release, or project milestone, call
+  `save_conversation`. This private checkpoint does not require a separate user request. Save a
+  concise structured outcome rather than the full transcript. Never save secrets, credentials,
+  incidental chatter, or trivial read-only work. This does not authorize company-group publication.
+- For a user with a company group, call `get_group_session_sharing` near session start or after the
+  first qualifying private save. If this exact session has no decision, ask once whether memories
+  saved from it should be shared, then store only the explicit Yes/No answer with
+  `set_group_session_sharing`. A Yes decision syncs eligible memories after private persistence;
+  flagged memories stay private.