@echomem/mcp 1.4.31 → 1.4.33

package/README.md

@@ -10,7 +10,7 @@ This MCP Server bridges local tools and your EchoMem Cloud API entirely via auth
 - `save_conversation`: Connects to `POST /api/extension/memories/ingest`
 - `get_memories_by_time_range`: Connects to `POST /api/extension/memories/time-range`
 - `search_memories_by_keywords`: Connects to `POST /api/extension/memories/keywords`
-- `search_others_memories`: Connects to MemoryFeed public search without sending the authenticated Echo user id
+- `search_others_memories`: Connects to MemoryFeed public search without trusting a model-supplied identity; the hosted API resolves the caller from the EchoMem credential and the tool returns that authenticated viewer explicitly
 - `delete_memory`: Previews one personal memory and returns a confirmation token; only deletes after a second confirmed call
 
 No direct access to the `IndexedDB` or local files is required.

package/dist/context-analysis/vendored-canonical.js

@@ -27,18 +27,40 @@ const PROBLEM_META = {
     P13: { label: "Agent's Reasoning Notes", bucket: "dead", category: "Context Hygiene", confidence: "fallback" },
 };
 const SCORER_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../assets/canonical-scorer");
+const CANONICAL_FULL_FILE_MAX_BYTES = 8 * 1024 * 1024;
+const CANONICAL_MAX_TURNS_PER_SESSION = 10_000;
+const CANONICAL_HEAD_TURNS = 1_000;
+const CANONICAL_TAIL_TURNS = 6_000;
+const CANONICAL_MIDDLE_WINDOWS = 3;
+const CANONICAL_MIDDLE_WINDOW_TURNS = 1_000;
 // Per-session scored-result cache. Each Codex session is scored by spawning 3 vendored scorer
 // processes (~300ms/session) — the dominant cost of the whole forensic scan. A session's scored
 // output is a pure function of its immutable JSONL, so cache it by (mtime, size): re-runs only
 // re-score new/changed sessions. Mirrors the forensic engine's codex parse cache. Bump the version
 // whenever the vendored scorer scripts change so stale results are discarded.
-const CANONICAL_CACHE_VERSION = 3;
+const CANONICAL_CACHE_VERSION = 4;
 function canonicalCachePath() {
     return path.join(os.homedir(), ".echomem", "canonical-cache.json");
 }
 function loadCanonicalCache() {
     try {
-        const parsed = JSON.parse(fs.readFileSync(canonicalCachePath(), "utf8"));
+        const cachePath = canonicalCachePath();
+        // JSON.parse materializes the complete object before we can inspect `v`. Version 3 caches can
+        // contain full per-turn timelines and exceed the worker heap by themselves, so reject stale
+        // cache files from their small header before reading the full payload.
+        const header = Buffer.alloc(64);
+        const fd = fs.openSync(cachePath, "r");
+        let bytesRead = 0;
+        try {
+            bytesRead = fs.readSync(fd, header, 0, header.length, 0);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        const cachedVersion = /"v"\s*:\s*(\d+)/.exec(header.toString("utf8", 0, bytesRead))?.[1];
+        if (cachedVersion && Number(cachedVersion) !== CANONICAL_CACHE_VERSION)
+            return {};
+        const parsed = JSON.parse(fs.readFileSync(cachePath, "utf8"));
         if (parsed && parsed.v === CANONICAL_CACHE_VERSION && parsed.files && typeof parsed.files === "object")
             return parsed.files;
     }
@@ -96,7 +118,7 @@ export async function buildVendoredCanonicalReport(opts) {
         try {
             const hit = st ? cache[file] : null;
             const fresh = hit && hit.mtimeMs === st.mtimeMs && hit.size === st.size;
-            const slim = fresh ? hit.scored : slimScored(await scoreSession(file, "codex"));
+            const slim = fresh ? hit.scored : await scoreSession(file, "codex");
             if (fresh)
                 cachedCount++;
             else
@@ -159,7 +181,10 @@ export async function buildVendoredCanonicalReport(opts) {
 async function scoreSession(sessionPath, source) {
     const temp = fs.mkdtempSync(path.join(os.tmpdir(), "echomem-canonical-"));
     try {
-        const scorerInput = sessionPath;
+        // Large single-session histories make the vendored scorer's per-turn reconstruction grow beyond
+        // a practical onboarding budget. Use a deterministic internal sample for the immediate report;
+        // the original transcript remains untouched for the later import pipeline.
+        const scorerInput = await boundedCanonicalScorerInput(sessionPath, temp);
         const sessionId = sessionIdFor(sessionPath);
         const problemsPath = path.join(temp, "problems.json");
         const efficiencyPath = path.join(temp, "efficiency.json");
@@ -199,17 +224,114 @@ async function scoreSession(sessionPath, source) {
         const dashboard = readJson(dashboardPath);
         const efficiency = readJson(efficiencyPath);
         await enrichCodexDashboardTurns(dashboard, sessionPath);
-        return {
+        return slimScored({
             dashboard,
             efficiency,
             repo: repoLabel(dashboard.session.sourceSession?.cwd || null),
             source,
-        };
+            episodeSummaries: [],
+        });
     }
     finally {
         fs.rmSync(temp, { recursive: true, force: true });
     }
 }
+async function boundedCanonicalScorerInput(sessionPath, temp) {
+    let size = 0;
+    try {
+        size = fs.statSync(sessionPath).size;
+    }
+    catch {
+        return sessionPath;
+    }
+    if (size <= CANONICAL_FULL_FILE_MAX_BYTES)
+        return sessionPath;
+    const totalTurns = await countCodexTurns(sessionPath);
+    if (totalTurns <= CANONICAL_MAX_TURNS_PER_SESSION)
+        return sessionPath;
+    const ranges = canonicalTurnSampleRanges(totalTurns);
+    const sampledPath = path.join(temp, "bounded-session.jsonl");
+    const output = fs.openSync(sampledPath, "w");
+    let currentTurn = 0;
+    let currentUserMessage = "";
+    try {
+        const lines = readline.createInterface({ input: fs.createReadStream(sessionPath), crlfDelay: Infinity });
+        for await (const line of lines) {
+            if (!line.trim())
+                continue;
+            const parsed = parseCodexLine(line);
+            const userMessage = parsed ? codexUserMessageText(parsed.row, parsed.payload, parsed.type) : "";
+            if (userMessage && userMessage !== currentUserMessage) {
+                currentTurn += 1;
+                currentUserMessage = userMessage;
+            }
+            const isSessionMeta = parsed && (stringValue(parsed.row.type) === "session_meta" || parsed.type === "session_meta");
+            if (isSessionMeta || (currentTurn > 0 && turnInRanges(currentTurn, ranges))) {
+                fs.writeSync(output, `${line}\n`);
+            }
+        }
+    }
+    finally {
+        fs.closeSync(output);
+    }
+    return sampledPath;
+}
+async function countCodexTurns(sessionPath) {
+    let turns = 0;
+    let currentUserMessage = "";
+    const lines = readline.createInterface({ input: fs.createReadStream(sessionPath), crlfDelay: Infinity });
+    for await (const line of lines) {
+        if (!line.trim())
+            continue;
+        const parsed = parseCodexLine(line);
+        if (!parsed)
+            continue;
+        const userMessage = codexUserMessageText(parsed.row, parsed.payload, parsed.type);
+        if (!userMessage || userMessage === currentUserMessage)
+            continue;
+        currentUserMessage = userMessage;
+        turns += 1;
+    }
+    return turns;
+}
+function parseCodexLine(line) {
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    if (!isRecord(parsed))
+        return null;
+    const payload = recordValue(parsed.payload);
+    return {
+        row: parsed,
+        payload,
+        type: stringValue(payload.type) || stringValue(parsed.type),
+    };
+}
+function canonicalTurnSampleRanges(totalTurns) {
+    if (totalTurns <= CANONICAL_MAX_TURNS_PER_SESSION)
+        return [[1, totalTurns]];
+    const tailStart = totalTurns - CANONICAL_TAIL_TURNS + 1;
+    const ranges = [
+        [1, CANONICAL_HEAD_TURNS],
+        [tailStart, totalTurns],
+    ];
+    const middleStart = CANONICAL_HEAD_TURNS + 1;
+    const middleEnd = tailStart - 1;
+    const middleSpan = Math.max(0, middleEnd - middleStart + 1);
+    for (let index = 1; index <= CANONICAL_MIDDLE_WINDOWS; index += 1) {
+        const center = middleStart + Math.floor((middleSpan * index) / (CANONICAL_MIDDLE_WINDOWS + 1));
+        const start = Math.max(middleStart, Math.min(middleEnd - CANONICAL_MIDDLE_WINDOW_TURNS + 1, center - Math.floor(CANONICAL_MIDDLE_WINDOW_TURNS / 2)));
+        ranges.push([start, Math.min(middleEnd, start + CANONICAL_MIDDLE_WINDOW_TURNS - 1)]);
+    }
+    return ranges.sort((left, right) => left[0] - right[0]);
+}
+function turnInRanges(turn, ranges) {
+    return ranges.some(([start, end]) => turn >= start && turn <= end);
+}
 // Run fn over items with at most `limit` in flight at once, returning results in input order.
 async function mapPool(items, limit, fn) {
     const results = new Array(items.length);
@@ -325,13 +447,41 @@ function compactBlockPreview(text, limit = 1200) {
 function slimScored(row) {
     const d = row.dashboard;
     const t = d.totals;
+    const evidenceTurns = new Set((d.problemContributions || [])
+        .map((problem) => problem.worstTurnByAllocatedWaste?.turn)
+        .filter((turn) => typeof turn === "number"));
+    const rawBucketTotals = (row.efficiency.series || []).reduce((totals, series) => {
+        totals.keep_oh += series.keep_oh || 0;
+        totals.keep_prod += series.keep_prod || 0;
+        totals.opt_dup += series.opt_dup || 0;
+        totals.opt_refind += series.opt_refind || 0;
+        totals.opt_dead += series.opt_dead || 0;
+        return totals;
+    }, { keep_oh: 0, keep_prod: 0, opt_dup: 0, opt_refind: 0, opt_dead: 0 });
+    const episodeRows = new Map();
+    for (const turn of d.timeline || []) {
+        const episode = episodeRows.get(turn.episode) || {
+            turnStart: turn.turn,
+            turnEnd: turn.turn,
+            wasteTokens: 0,
+            byProblem: new Map(),
+        };
+        episode.turnEnd = turn.turn;
+        episode.wasteTokens += turn.wasteTokens || 0;
+        for (const item of turn.allocatedItems || []) {
+            if (!item.problemId)
+                continue;
+            episode.byProblem.set(item.problemId, (episode.byProblem.get(item.problemId) || 0) + (item.tokens || 0));
+        }
+        episodeRows.set(turn.episode, episode);
+    }
     return {
         dashboard: {
             session: {
                 id: d.session.id,
                 sourceSession: d.session.sourceSession ? {
                     cwd: d.session.sourceSession.cwd ?? null,
-                    turns: d.session.sourceSession.turns,
+                    turns: d.session.sourceSession.turns ?? d.timeline.length,
                     startedAt: d.session.sourceSession.startedAt ?? null,
                 } : undefined,
             },
@@ -360,7 +510,9 @@ function slimScored(row) {
                     }
                     : null,
             })),
-            timeline: (d.timeline || []).map((tt) => ({
+            // Workspace aggregation needs message text only for each problem's single worst evidence turn.
+            // Keeping every turn made one very long session retain hundreds of MB through the entire scan.
+            timeline: (d.timeline || []).filter((tt) => evidenceTurns.has(tt.turn)).map((tt) => ({
                 turn: tt.turn, episode: tt.episode,
                 inputTokens: tt.inputTokens || 0, usefulTokens: tt.usefulTokens || 0, wasteTokens: tt.wasteTokens || 0,
                 rawUsefulTokens: tt.rawUsefulTokens || 0, rawOutcomeWasteTokens: tt.rawOutcomeWasteTokens || 0,
@@ -371,10 +523,16 @@ function slimScored(row) {
             })),
         },
         efficiency: {
-            series: (row.efficiency.series || []).map((s) => ({
-                keep_oh: s.keep_oh || 0, keep_prod: s.keep_prod || 0, opt_dup: s.opt_dup || 0, opt_refind: s.opt_refind || 0, opt_dead: s.opt_dead || 0,
-            })),
+            // aggregate() only sums these fields. Store one per-session total instead of one row per turn.
+            series: [rawBucketTotals],
         },
+        episodeSummaries: [...episodeRows.entries()].map(([episode, values]) => ({
+            episode,
+            turnStart: values.turnStart,
+            turnEnd: values.turnEnd,
+            wasteTokens: values.wasteTokens,
+            dominantProblemId: [...values.byProblem.entries()].sort((a, b) => b[1] - a[1])[0]?.[0] || null,
+        })),
         repo: row.repo,
     };
 }
@@ -509,30 +667,17 @@ function aggregate(scored, metadata) {
     }
     const episodes = [];
     for (const row of scored) {
-        const byEpisode = new Map();
-        for (const turn of row.dashboard.timeline) {
-            const list = byEpisode.get(turn.episode) || [];
-            list.push(turn);
-            byEpisode.set(turn.episode, list);
-        }
-        for (const [episode, turns] of byEpisode) {
-            const byProblem = new Map();
-            for (const turn of turns)
-                for (const item of turn.allocatedItems || []) {
-                    if (item.problemId)
-                        byProblem.set(item.problemId, (byProblem.get(item.problemId) || 0) + (item.tokens || 0));
-                }
-            const dominant = [...byProblem.entries()].sort((a, b) => b[1] - a[1])[0]?.[0];
-            if (!dominant)
+        for (const episode of row.episodeSummaries) {
+            if (!episode.dominantProblemId)
                 continue;
             episodes.push({
-                id: `E${episode}`,
+                id: `E${episode.episode}`,
                 session: row.dashboard.session.id,
                 repo: row.repo,
-                turnStart: turns[0]?.turn || 0,
-                turnEnd: turns[turns.length - 1]?.turn || 0,
-                wasteTokens: turns.reduce((sum, turn) => sum + turn.wasteTokens, 0),
-                dominantProblemId: dominant,
+                turnStart: episode.turnStart,
+                turnEnd: episode.turnEnd,
+                wasteTokens: episode.wasteTokens,
+                dominantProblemId: episode.dominantProblemId,
             });
         }
     }

package/dist/forensics.js

@@ -1056,30 +1056,30 @@ function loadClaudeSessionTitles() {
     }
     return titles;
 }
-function enrichCanonicalSessionExamples(canonical, timelineFiles) {
+function enrichCanonicalSessionExamples(canonical, sessionRecords) {
     if (!canonical || "error" in canonical)
         return;
     const codexTitles = loadCodexSessionTitles();
     const claudeTitles = loadClaudeSessionTitles();
-    const records = timelineFiles
-        .filter(({ fe }) => Boolean(fe.session))
-        .sort((a, b) => (a.fe.firstTs ?? Number.POSITIVE_INFINITY) - (b.fe.firstTs ?? Number.POSITIVE_INFINITY));
+    const records = sessionRecords
+        .filter((record) => Boolean(record.session))
+        .sort((a, b) => (a.firstTs ?? Number.POSITIVE_INFINITY) - (b.firstTs ?? Number.POSITIVE_INFINITY));
     const sourceTotals = {
-        codex: records.filter(({ fe }) => fe.source === "codex").length,
-        "claude-code": records.filter(({ fe }) => fe.source === "claude-code").length,
+        codex: records.filter((record) => record.source === "codex").length,
+        "claude-code": records.filter((record) => record.source === "claude-code").length,
     };
     const sourceOrdinals = { codex: 0, "claude-code": 0 };
     const sessionMeta = new Map();
-    for (const { fe } of records) {
-        if (!fe.session)
+    for (const record of records) {
+        if (!record.session)
             continue;
-        sourceOrdinals[fe.source] += 1;
-        const indexedTitle = fe.source === "codex" ? codexTitles.get(fe.session) : claudeTitles.get(fe.session);
-        sessionMeta.set(fe.session, {
-            id: fe.session,
-            title: indexedTitle || fe.fallbackTitle || `${fe.cwd ? path.basename(fe.cwd) : "Local"} session`,
-            ordinal: sourceOrdinals[fe.source],
-            total: sourceTotals[fe.source],
+        sourceOrdinals[record.source] += 1;
+        const indexedTitle = record.source === "codex" ? codexTitles.get(record.session) : claudeTitles.get(record.session);
+        sessionMeta.set(record.session, {
+            id: record.session,
+            title: indexedTitle || record.fallbackTitle || `${record.cwd ? path.basename(record.cwd) : "Local"} session`,
+            ordinal: sourceOrdinals[record.source],
+            total: sourceTotals[record.source],
         });
     }
     const reports = [canonical];
@@ -1353,7 +1353,7 @@ export function validateForensicReportForSetup(value) {
 /** Scan both sources and build the merged forensic report. Local-only, $0, never throws on bad files. */
 export async function buildForensicReport(opts) {
     const sources = opts?.sources ?? ["codex", "claude"];
-    const eng = new Forensics();
+    let eng = new Forensics();
     const codexDiscovery = sources.includes("codex")
         ? discoverCodexSessionFiles({ includeArchived: opts?.includeArchivedCodex !== false })
         : null;
@@ -1433,12 +1433,22 @@ export async function buildForensicReport(opts) {
     }
     timelineFiles.sort((a, b) => (a.fe.firstTs ?? Number.POSITIVE_INFINITY) - (b.fe.firstTs ?? Number.POSITIVE_INFINITY) ||
         a.path.localeCompare(b.path));
+    // The title/enrichment pass only needs five scalar fields per session. Capture those before
+    // releasing the much larger usage/context/event arrays ahead of canonical classification.
+    const canonicalSessionRecords = timelineFiles.map(({ fe }) => ({
+        source: fe.source,
+        session: fe.session,
+        cwd: fe.cwd,
+        firstTs: fe.firstTs,
+        fallbackTitle: fe.fallbackTitle,
+    }));
     replayTimelineFiles(eng, timelineFiles);
     // Entering a stage means it has done none of its own work yet, so it opens its band rather than
     // inheriting the finished file counters — otherwise a stage announces itself at its band ceiling
     // and its real sub-progress then drags the bar back down.
     progress("building-summary", "aggregating rereads, model usage, cost, and local context signals", 0, 1);
     const report = eng.build();
+    eng = null;
     const firstTimelineSession = timelineFiles.find(({ fe }) => fe.firstTs != null);
     report.firstSession = firstTimelineSession ? {
         date: firstTimelineSession.fe.firstTs != null ? new Date(firstTimelineSession.fe.firstTs).toISOString() : null,
@@ -1467,6 +1477,15 @@ export async function buildForensicReport(opts) {
             },
         };
     }
+    // The forensic cache and timeline can be hundreds of MB for a small number of very long sessions.
+    // They are no longer needed after replay/build, and retaining them while loading the canonical
+    // cache was the peak-memory overlap that terminated the setup worker on large histories.
+    parsedCodexFiles.length = 0;
+    timelineFiles.length = 0;
+    for (const key of Object.keys(cache))
+        delete cache[key];
+    for (const key of Object.keys(nextCache))
+        delete nextCache[key];
     if (opts?.includeLegacyGoldenStandard !== false) {
         try {
             report.goldenStandard = buildWorkspaceContextReport();
@@ -1491,7 +1510,7 @@ export async function buildForensicReport(opts) {
             strictSessionErrors: false,
             onProgress: (canonicalDone, canonicalTotal) => progress("classifying-repeated-context", "reconstructing context windows and attributing P01/P03/P08/P10/P13 waste", canonicalDone, canonicalTotal),
         });
-        enrichCanonicalSessionExamples(report.canonicalGoldenStandard, timelineFiles);
+        enrichCanonicalSessionExamples(report.canonicalGoldenStandard, canonicalSessionRecords);
     }
     catch (error) {
         report.canonicalGoldenStandard = { error: error instanceof Error ? error.message : String(error) };

package/dist/index.js

@@ -12,7 +12,7 @@ import { contextHealthMarkdown, recomposeCapsuleMarkdown } from "./hud/api.js";
 import { createHash, randomUUID } from "node:crypto";
 import { fetchEncryptionConfig, decryptMemoryFields, verifyKeyB64, } from "./encryption.js";
 import { runCli } from "./setup.js";
-import { MCP_PACKAGE_VERSION, MCP_SERVER_INSTRUCTIONS, MEMORY_CITATION_INSTRUCTION, } from "./package-metadata.js";
+import { MCP_PACKAGE_VERSION, MCP_SERVER_INSTRUCTIONS, MEMORY_CITATION_INSTRUCTION, SAVED_MEMORY_RECEIPT_INSTRUCTION, } from "./package-metadata.js";
 import { clearBillingAlert, writeBillingAlert } from "./billing-alert.js";
 import { checkLatestUpdateStatus, formatUpdateNotice, formatUpdateStatusText, startBackgroundUpdateCheck, } from "./update-check.js";
 const ECHO_API_BASE_URL = process.env.ECHO_API_BASE_URL || "https://echo-mem-chrome.vercel.app";
@@ -816,6 +816,7 @@ class EchoMemApiClient {
     }
     async saveConversation(args) {
         const parsed = saveConversationSchema.parse(args ?? {});
+        const groupSharingScopeId = parsed.groupSharingScopeId ?? randomUUID();
         let rawData = parsed.conversation?.trim() || "";
         if (!rawData && parsed.messages?.length) {
             rawData = formatMessagesForIngest(parsed.messages);
@@ -841,15 +842,16 @@ class EchoMemApiClient {
                 sourceUrl: parsed.url,
                 source: parsed.source || "mcp_server",
                 title: parsed.title,
-                // Stable per-session id so multiple saves in this coding session group under one context.
-                conversationKey: this.sessionId,
+                // The MCP transport can outlive a host conversation. Group saves only by the opaque
+                // scope carried in that conversation, never by the bridge process id.
+                conversationKey: groupSharingScopeId,
                 passthrough: parsed.passthrough || false,
                 triggerMessage: parsed.triggerMessage ||
                     lastUserMessageFromMessages(parsed.messages) ||
                     lastUserMessageFromConversationText(parsed.conversation),
                 triggerMessageRole: parsed.triggerMessageRole || "user",
             }, config);
-            return response.data;
+            return { ...response.data, groupSharingScopeId };
         }
         catch (error) {
             if (axios.isAxiosError(error) && error.response?.status === 429) {
@@ -1029,14 +1031,18 @@ class EchoMemApiClient {
         }
     }
     async getGroupSessionSharing(args) {
-        getGroupSessionSharingSchema.parse(args ?? {});
-        const response = await this.axios.get(`/api/extension/social/groups/current/session-sharing?sessionKey=${encodeURIComponent(this.sessionId)}`);
-        return response.data;
+        const parsed = getGroupSessionSharingSchema.parse(args ?? {});
+        const groupSharingScopeId = parsed.groupSharingScopeId ?? randomUUID();
+        const query = new URLSearchParams({ sessionKey: groupSharingScopeId });
+        if (parsed.groupId)
+            query.set("groupId", parsed.groupId);
+        const response = await this.axios.get(`/api/extension/social/groups/current/session-sharing?${query.toString()}`);
+        return { ...response.data, groupSharingScopeId };
     }
     async setGroupSessionSharing(args) {
         const parsed = setGroupSessionSharingSchema.parse(args ?? {});
         const enc = await this.encState();
-        const response = await this.axios.patch("/api/extension/social/groups/current/session-sharing", { ...parsed, sessionKey: this.sessionId }, { headers: enc.enabled && enc.key ? { "X-Encryption-Key": enc.key } : undefined });
+        const response = await this.axios.patch("/api/extension/social/groups/current/session-sharing", { ...parsed, sessionKey: parsed.groupSharingScopeId }, { headers: enc.enabled && enc.key ? { "X-Encryption-Key": enc.key } : undefined });
         return response.data;
     }
     async createGroup(args) {
@@ -1552,7 +1558,7 @@ Details: ${m.details || "N/A"}`)
             rec.conversation_chars = text.length;
             rec.save_source = typeof a?.source === "string" ? a.source : sourceFallback;
         }
-        const { success, memoriesExtracted, memoriesDiscarded, extractedMemories, contextId, capsuleId, passthrough: isPassthrough, groupSessionSharing, groupSync, error, } = await this.client.saveConversation(enrichedArgs);
+        const { success, memoriesExtracted, memoriesDiscarded, extractedMemories, contextId, capsuleId, passthrough: isPassthrough, groupSessionSharing, groupSync, groupSyncs, groupSharingScopeId, error, } = await this.client.saveConversation(enrichedArgs);
         if (!success)
             throw new Error(`EchoMem API Error: ${error}`);
         if (rec)
@@ -1562,7 +1568,13 @@ Details: ${m.details || "N/A"}`)
             const text = [
                 `Session capsule saved (passthrough, no extraction).`,
                 typeof capsuleId === "string" && capsuleId ? `Capsule ID: ${capsuleId}` : "",
+                typeof capsuleId === "string" && capsuleId
+                    ? `Open saved capsule: ${memoryMarkdownLink(personalMemoryWebUrl(capsuleId), "Session capsule")}`
+                    : "",
                 typeof contextId === "string" && contextId ? `Context: ${contextId}` : "",
+                typeof groupSharingScopeId === "string" && groupSharingScopeId
+                    ? `Conversation sharing scope: ${groupSharingScopeId}`
+                    : "",
                 "",
                 `To reload this capsule in a fresh session: get_memories_by_context({ contextId: "${contextId}" })`,
             ].filter(Boolean).join("\n");
@@ -1572,23 +1584,49 @@ Details: ${m.details || "N/A"}`)
         // extraction, and so it holds the ids to deterministically re-fetch this batch later (warm-up).
         const saved = Array.isArray(extractedMemories) ? extractedMemories.filter(isRecord) : [];
         const sharing = isRecord(groupSessionSharing) ? groupSessionSharing : null;
-        const sync = isRecord(groupSync) ? groupSync : null;
+        const syncList = Array.isArray(groupSyncs)
+            ? groupSyncs.filter(isRecord)
+            : isRecord(groupSync)
+                ? [groupSync]
+                : [];
+        const sync = syncList.length === 1 ? syncList[0] : null;
         const sharingGroup = isRecord(sharing?.group) ? sharing.group : {};
-        const protectedIds = Array.isArray(sync?.protectedMemoryIds) ? sync.protectedMemoryIds : [];
+        const availableGroups = Array.isArray(sharing?.availableGroups)
+            ? sharing.availableGroups.filter(isRecord)
+            : [];
+        const syncedGroupNames = syncList
+            .filter((item) => item.synced === true)
+            .map((item) => readString(item, "groupName"))
+            .filter((name) => Boolean(name));
+        const failedSyncs = syncList.filter((item) => item.attempted === true && item.synced !== true);
+        const protectedIds = Array.from(new Set(syncList.flatMap((item) => Array.isArray(item.protectedMemoryIds) ? item.protectedMemoryIds : [])));
         const receipt = sharing?.hasGroup !== true
             ? "Saved to your private memory."
-            : sharing?.decision === null || sharing?.decision === undefined
-                ? `Saved to your private memory. Ask: “Share memories saved from this session with ${readString(sharingGroup, "name") ?? "your current group"}?” Silence leaves the state unset, so ask again at a later qualifying checkpoint until the user explicitly answers Yes or No; do not repeat the prompt in the same response.`
-                : sharing.decision === "private"
-                    ? "Saved to your private memory."
-                    : sync?.synced === true
-                        ? [
-                            "Saved to your private memory and synced to the group.",
-                            protectedIds.length
-                                ? `${protectedIds.length} protected memory item(s) stayed private.`
-                                : "",
-                        ].filter(Boolean).join(" ")
-                        : `Saved to your private memory, but group sync failed${readString(sync ?? {}, "error") ? `: ${readString(sync ?? {}, "error")}` : "."}`;
+            : sharing?.requiresGroupSelection === true
+                ? [
+                    syncedGroupNames.length
+                        ? `Saved privately first and synced to approved groups: ${syncedGroupNames.join(", ")}.`
+                        : "Saved to your private memory.",
+                    `This user has multiple groups: ${availableGroups.map((group) => `${readString(group, "name") ?? "Unnamed group"} (${readString(group, "id") ?? "unknown id"})`).join(", ")}. Call get_group_session_sharing with this conversation scope and one groupId at a time; obtain a separate explicit Yes/No decision for each group.`,
+                    failedSyncs.length
+                        ? `${failedSyncs.length} approved group sync(s) failed; private memories were preserved.`
+                        : "",
+                    protectedIds.length
+                        ? `${protectedIds.length} protected memory item(s) stayed private.`
+                        : "",
+                ].filter(Boolean).join(" ")
+                : sharing?.decision === null || sharing?.decision === undefined
+                    ? `Saved to your private memory. Ask: “Share memories saved from this conversation with ${readString(sharingGroup, "name") ?? "your current group"}?” Silence leaves the state unset, so ask again at a later qualifying checkpoint until the user explicitly answers Yes or No; do not repeat the prompt in the same response.`
+                    : sharing.decision === "private"
+                        ? "Saved to your private memory."
+                        : syncedGroupNames.length
+                            ? [
+                                `Saved to your private memory and synced to ${syncedGroupNames.join(", ")}.`,
+                                protectedIds.length
+                                    ? `${protectedIds.length} protected memory item(s) stayed private.`
+                                    : "",
+                            ].filter(Boolean).join(" ")
+                            : `Saved to your private memory, but group sync failed${readString(failedSyncs[0] ?? sync ?? {}, "error") ? `: ${readString(failedSyncs[0] ?? sync ?? {}, "error")}` : "."}`;
         const list = saved
             .map((m, idx) => {
             const keys = readString(m, "keys") ?? "(no key)";
@@ -1596,7 +1634,9 @@ Details: ${m.details || "N/A"}`)
             const details = readString(m, "details") ?? "";
             const id = readString(m, "id");
             return [
-                `[${idx + 1}] ${keys}${id ? ` · id ${id}` : ""}`,
+                id
+                    ? `[${idx + 1}] ${memoryMarkdownLink(personalMemoryWebUrl(id), keys, description)} · id ${id}`
+                    : `[${idx + 1}] ${keys}`,
                 description ? `Description: ${description}` : "",
                 details ? `Details: ${details}` : "",
             ].filter(Boolean).join("\n");
@@ -1605,13 +1645,17 @@ Details: ${m.details || "N/A"}`)
         const text = [
             `Successfully ingested conversation. Extracted ${memoriesExtracted} memory distinct events.`,
             receipt,
+            typeof groupSharingScopeId === "string" && groupSharingScopeId
+                ? `Conversation sharing scope: ${groupSharingScopeId}\nReuse this exact groupSharingScopeId only for get_group_session_sharing, set_group_session_sharing, and save_conversation calls in this conversation. Never reuse it in another conversation or save it as memory.`
+                : "",
             typeof memoriesDiscarded === "number" && memoriesDiscarded > 0
                 ? `${memoriesDiscarded} additional memories were not stored because your active-memory limit was reached.`
                 : "",
-            list,
+            list ? `EchoMem saved:\n\n${list}` : "",
             saved.length
                 ? `Verify these captured the key facts. Re-fetch this exact batch later by searching the ids above${typeof contextId === "string" && contextId ? ` (context ${contextId})` : ""}.`
                 : "",
+            saved.length ? SAVED_MEMORY_RECEIPT_INSTRUCTION : "",
         ].filter(Boolean).join("\n\n");
         return { content: [{ type: "text", text }] };
     }
@@ -1756,6 +1800,22 @@ Details: ${m.details || "N/A"}`)
         const parsed = othersSchema.parse(args ?? {});
         const payload = await this.client.searchOthersMemories(args);
         const memories = payload?.memories ?? [];
+        const authenticatedViewer = isRecord(payload?.authenticatedViewer)
+            ? payload.authenticatedViewer
+            : null;
+        const authenticatedUserId = authenticatedViewer
+            ? readString(authenticatedViewer, "userId")
+            : null;
+        const authenticatedDisplayName = authenticatedViewer
+            ? readString(authenticatedViewer, "displayName")
+            : null;
+        const authenticatedIdentity = authenticatedUserId
+            ? [
+                `Authenticated EchoMem user: ${authenticatedDisplayName ?? "Unknown display name"} (User ID: ${authenticatedUserId}).`,
+                "This identity comes from the EchoMem credential and is authoritative for this tool call.",
+                "EchoMem has already excluded only this authenticated user's own memories. Return every memory below; do not filter again using a Claude account, host profile, git identity, or inferred identity.",
+            ].join("\n")
+            : "EchoMem has already applied credential-based self filtering. Do not filter the returned memories again using a host account, profile, git identity, or inferred identity.";
         if (!memories.length) {
             const scope = parsed.ownerUserId
                 ? ` for peer ${parsed.ownerUserId}`
@@ -1770,7 +1830,7 @@ Details: ${m.details || "N/A"}`)
                                 : "";
             const queryLabel = parsed.query?.trim() ? ` matching the query: ${parsed.query}` : "";
             return {
-                content: [{ type: "text", text: `No others' public memories found${scope}${queryLabel}` }],
+                content: [{ type: "text", text: `${authenticatedIdentity}\n\nNo others' public memories found${scope}${queryLabel}` }],
             };
         }
         const metadata = [
@@ -1804,7 +1864,7 @@ Details: ${m.details || "N/A"}`;
             content: [
                 {
                     type: "text",
-                    text: withMemoryCitationInstruction(`Found ${memories.length} others' public memories${metadata ? ` (${metadata})` : ""}:\n\n${formattedResults}`),
+                    text: withMemoryCitationInstruction(`${authenticatedIdentity}\n\nFound ${memories.length} others' public memories${metadata ? ` (${metadata})` : ""}:\n\n${formattedResults}`),
                 },
             ],
         };
@@ -1989,12 +2049,15 @@ Details: ${m.details || "N/A"}`;
         const text = [
             `Company group: ${readString(group, "name") ?? "Unnamed group"}`,
             readString(group, "description") ? `Description: ${readString(group, "description")}` : "",
+            currentParticipant
+                ? `Authenticated EchoMem member: ${readString(currentParticipant, "displayName") ?? "Unknown display name"} (User ID: ${readString(currentParticipant, "userId") ?? "unknown"}). This identity comes from the EchoMem credential and overrides any conflicting host-account, Claude-profile, git, or inferred identity.`
+                : "EchoMem credential identity is authoritative for this tool; do not substitute a host-account, Claude-profile, git, or inferred identity.",
             `Coverage: ${coveredCount} of ${participantCount} participants have published memories (${totalPublished} total).`,
             "",
             participantText,
             "",
             "Declared titles and responsibilities are directory facts. Use search_others_memories for current work evidence, and label suggested contribution areas as inference that should be confirmed with the team.",
-            "Use get_group_session_sharing to read this exact session's decision; never infer sharing from the member's role or memories.",
+            "Use get_group_session_sharing to mint or read this conversation's sharing scope; never infer sharing from the member's role, memories, or MCP transport session.",
             currentParticipant
                 && (!readString(currentParticipant, "title") || !readString(currentParticipant, "responsibilitySummary"))
                 ? "Your group profile is incomplete. Use prepare_group_publication to review your memory evidence, propose the missing fields, and save them only after confirmation with update_group_profile."
@@ -2005,11 +2068,29 @@ Details: ${m.details || "N/A"}`;
     async handleGetGroupSessionSharing(args) {
         getGroupSessionSharingSchema.parse(args ?? {});
         const payload = await this.client.getGroupSessionSharing(args);
+        const groupSharingScopeId = readString(payload ?? {}, "groupSharingScopeId");
+        const scopeText = groupSharingScopeId
+            ? `Conversation sharing scope: ${groupSharingScopeId}\nReuse this exact groupSharingScopeId only in this conversation for later get/set/save calls. Never persist it as memory.`
+            : "";
         if (payload?.hasGroup !== true) {
             return {
                 content: [{
                         type: "text",
-                        text: "No company group is configured for this user. Saves remain private; do not ask about session sharing.",
+                        text: "No company group is configured for this user. Saves remain private; do not ask about conversation sharing.",
+                    }],
+            };
+        }
+        if (payload?.requiresGroupSelection === true) {
+            const availableGroups = Array.isArray(payload?.availableGroups)
+                ? payload.availableGroups.filter(isRecord)
+                : [];
+            const choices = availableGroups
+                .map((group) => `${readString(group, "name") ?? "Unnamed group"} (${readString(group, "id") ?? "unknown id"})`)
+                .join(", ");
+            return {
+                content: [{
+                        type: "text",
+                        text: `${scopeText}\n\nThis user belongs to multiple groups: ${choices}. Reuse this same conversation scope and call get_group_session_sharing once per groupId. Ask for a separate explicit Yes/No sharing decision for each selected group.`,
                     }],
             };
         }
@@ -2019,16 +2100,19 @@ Details: ${m.details || "N/A"}`;
             return {
                 content: [{
                         type: "text",
-                        text: `No sharing decision exists for this session. Ask: “Share memories saved from this session with ${readString(group, "name") ?? "your group"}?” Silence is not a No: leave the state unset and ask again at a later qualifying checkpoint until the user explicitly answers Yes or No, without repeating the prompt in the same response. Then call set_group_session_sharing with that explicit answer; an explicit No stops later prompts for this exact session.`,
+                        text: `${scopeText}\n\nNo sharing decision exists for this conversation. Ask: “Share memories saved from this conversation with ${readString(group, "name") ?? "your group"}?” Silence is not a No: leave the state unset and ask again at a later qualifying checkpoint until the user explicitly answers Yes or No, without repeating the prompt in the same response. Then call set_group_session_sharing with that explicit answer and the scope above; an explicit No stops later prompts for this conversation.`,
                     }],
             };
         }
         return {
             content: [{
                     type: "text",
-                    text: decision === "share"
-                        ? `This session is approved for ${readString(group, "name") ?? "the current group"}. Each save persists privately first, then eligible memories sync automatically. Flagged memories stay private.`
-                        : "This session is private. Future saves remain private unless the user explicitly changes this session's decision.",
+                    text: [
+                        scopeText,
+                        decision === "share"
+                            ? `This conversation is approved for ${readString(group, "name") ?? "the current group"}. Each save carrying this scope persists privately first, then eligible memories sync automatically. Flagged memories stay private.`
+                            : "This conversation is private. Future saves carrying this scope remain private unless the user explicitly changes this conversation's decision.",
+                    ].filter(Boolean).join("\n\n"),
                 }],
         };
     }
@@ -2040,9 +2124,9 @@ Details: ${m.details || "N/A"}`;
         const group = isRecord(payload?.group) ? payload.group : {};
         const receipt = parsed.share
             ? sync?.synced === false
-                ? "Session sharing is enabled, but the initial group sync failed. Private memories were preserved; retry before claiming publication."
-                : `Session sharing is enabled for ${readString(group, "name") ?? "the current group"}. Existing eligible session memories were synced and later saves will sync automatically.`
-            : "Session sharing is off. Future saves in this session remain private.";
+                ? "Conversation sharing is enabled, but the initial group sync failed. Private memories were preserved; retry before claiming publication."
+                : `Conversation sharing is enabled for ${readString(group, "name") ?? "the current group"}. Existing eligible memories in this scope were synced and later saves carrying the same scope will sync automatically.`
+            : "Conversation sharing is off. Future saves carrying this scope remain private.";
         return {
             content: [{
                     type: "text",
@@ -2099,7 +2183,7 @@ Details: ${m.details || "N/A"}`;
                     type: "text",
                     text: payload?.alreadyMember
                         ? `You are already a member of ${payload?.group?.name ?? "this group"}. No memories were published. Use prepare_group_publication to review memories and propose any missing title or responsibility fields, then call get_group_session_sharing and, if unset, ask again at later qualifying checkpoints until the user explicitly answers Yes or No.`
-                        : `Joined ${payload?.group?.name ?? "the company group"}. No memories were published. Next use prepare_group_publication to review candidates, infer a proposed title and responsibility summary, and ask the user to confirm that profile together with the publication preview. Also call get_group_session_sharing; if unset, ask whether memories saved from this session should be shared and ask again at a later qualifying checkpoint after silence until an explicit Yes or No.`,
+                        : `Joined ${payload?.group?.name ?? "the company group"}. No memories were published. Next use prepare_group_publication to review candidates, infer a proposed title and responsibility summary, and ask the user to confirm that profile together with the publication preview. Also call get_group_session_sharing without a scope to mint one for this conversation; if unset, ask whether memories saved from this conversation should be shared and ask again at a later qualifying checkpoint after silence until an explicit Yes or No.`,
                 }],
         };
     }

package/dist/package-metadata.js

@@ -24,18 +24,20 @@ export const MCP_PACKAGE_LABEL = `${MCP_PACKAGE_NAME}@${MCP_PACKAGE_VERSION}`;
 export const MCP_UPDATE_COMMAND = `npx -y ${MCP_PACKAGE_NAME}@latest update`;
 export const MCP_UPDATE_ALL_COMMAND = `${MCP_UPDATE_COMMAND} --all`;
 export const MEMORY_CITATION_INSTRUCTION = 'If the user-facing answer materially relies on one or more EchoMem memories, end it with a compact "EchoMem sources:" list containing only the memories actually used. For memories owned by teammates or accepted friends, call record_memory_citations immediately before the final answer with those exact Memory IDs. Do not cite memories that were merely retrieved. Use each memory key as the Markdown label and its canonical https://echoknows.com/memory/<memory-id> URL. Omit the sources section and citation receipt when no memory informed the answer.';
+export const SAVED_MEMORY_RECEIPT_INSTRUCTION = 'After save_conversation succeeds and returns one or more saved memory IDs, make the save visible in the final user-facing answer with a compact "EchoMem saved:" list containing every memory created by that call. Use each memory key as the Markdown label and its canonical https://echoknows.com/memory/<memory-id> URL. This save receipt is separate from "EchoMem sources:" and does not imply that the newly saved memories informed the answer.';
 export const MCP_SERVER_INSTRUCTIONS = [
     `${MCP_PACKAGE_DESCRIPTION} (${MCP_PACKAGE_LABEL}).`,
     `If the user or local config expects a newer EchoMem MCP version than ${MCP_PACKAGE_VERSION}, update once with \`${MCP_UPDATE_ALL_COMMAND}\` and start a new MCP session.`,
     "Use echomem_update_status to check whether npm has a newer bridge; it is cached and non-blocking during normal tool listing.",
     "Do not auto-update on every MCP startup; this bridge is intentionally stable between explicit updates.",
     "Before the final response for work that produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone, call save_conversation. This is a private checkpoint and does not require a separate user request. Skip secrets, incidental chatter, and trivial read-only work. If an encrypted vault is locked, tell the user to run echomem-mcp unlock rather than silently skipping the checkpoint.",
-    "For a user with a company group, call get_group_session_sharing near session start or after a qualifying private save. If this exact session has no decision, ask whether memories saved from the session should be shared with the current group. Silence is not a No: leave the state unset and ask again at a later qualifying checkpoint until the user explicitly answers Yes or No, without repeating the prompt in the same response. Store only the explicit answer with set_group_session_sharing. A Yes decision syncs eligible memories after each private save; a No decision keeps later saves private and stops later prompts for this exact session. Flagged memories stay private.",
+    "For a user with a company group, call get_group_session_sharing near conversation start or after a qualifying private save. On the first call in a conversation, omit groupSharingScopeId so EchoMem mints a fresh opaque scope. Reuse that exact scope only in this conversation for later get/set/save calls, and never persist it as memory. If multiple groups are returned, reuse the same scope and check one groupId at a time. Each group requires its own explicit Yes/No decision. Silence leaves that group's state unset; never infer an answer or repeat the prompt in the same response. Store only explicit answers with set_group_session_sharing, the same scope, and the selected groupId. Saves sync eligible memories to every approved group; a No keeps them private for that group. Flagged memories stay private.",
     "For company-group sharing, use get_group_context for orientation; create_memory_group/create_group_invite/join_memory_group for membership; and prepare_group_publication as a no-publication preview.",
     "After joining or when profile fields are missing, use candidate memory evidence to propose a title and responsibility summary. Ask the user to confirm that proposal together with the publication preview, then call update_group_profile and complete_group_publication.",
     "Use one canonical https://echoknows.com/memory/<memory-id> link for private, group, and friend evidence. Label it with the memory key; the site resolves the authorized representation.",
     "Each search result is one memory: preserve its Memory ID and canonical echoknows.com link when citing it.",
     MEMORY_CITATION_INSTRUCTION,
+    SAVED_MEMORY_RECEIPT_INSTRUCTION,
     "During a publication preview, if an unflagged candidate appears sensitive, proactively ask whether the user wants to mark its exact ID for publication attention first. Explain that marking does not publish or change encryption; it means the agent will call it out and ask for detailed confirmation whenever a later publication includes it. Never auto-flag inferred sensitivity. For sensitive-topic flags, search and preview exact owned memories before confirmed flag_memories_for_publication_attention. Separate already-flagged candidates, state that nothing has been published yet, and offer to exclude them, review them separately, or first search for and mark similar sensitive owned memories.",
     "Never save an inferred group profile. Manual prepared publication requires explicit preview confirmation; flagged memories still require separate exact-memory confirmation. Never store or log an echo_grp_ invite code.",
 ].join(" ");

package/dist/save-checkpoint-hook.js

@@ -7,9 +7,9 @@ const CHECKPOINT_REASON = [
     "Run EchoMem's private completion checkpoint before finishing this turn.",
     "Review the work that just completed. If it produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone, call `save_conversation` now with a concise structured summary of the outcome, reasoning, relevant files, and constraints.",
     "Do not save secrets or incidental chatter. If the work was not durable, do not call the tool and finish normally.",
-    "Private persistence happens first. For a user with a company group, call `get_group_session_sharing` near session start or after a qualifying private save.",
-    "If this exact session has no decision, ask whether memories saved from the session should be shared with the current group. Silence leaves the state unset, so ask again at a later qualifying checkpoint until the user explicitly answers Yes or No; do not repeat the prompt in the same response. Call `set_group_session_sharing` only with that explicit answer. A Yes decision automatically syncs eligible memories after later private saves; a No decision keeps later saves private and stops later prompts for this exact session.",
-    "Flagged memories are withheld from automatic session sync and remain private.",
+    "Private persistence happens first. For a user with a company group, call `get_group_session_sharing` near conversation start or after a qualifying private save.",
+    "On the first get_group_session_sharing call in a conversation, omit groupSharingScopeId so EchoMem mints a fresh opaque scope. Reuse that exact scope only in this conversation for later get/set/save calls, and never persist it as memory. If multiple groups are returned, reuse the same scope and check one groupId at a time. Each group needs its own explicit Yes/No decision. Silence leaves that group's state unset; do not infer an answer or repeat the prompt in the same response. A Yes decision syncs eligible memories from later saves carrying the same scope to that group; saves automatically sync to every approved group. A No decision keeps them private for that group.",
+    "Flagged memories are withheld from automatic conversation sync and remain private.",
     "If EchoMem reports that the encrypted vault is locked, tell the user to run `echomem-mcp unlock`; never silently skip a qualifying checkpoint.",
 ].join(" ");
 function currentTurnSlice(transcript) {

package/dist/setup.js

@@ -391,13 +391,14 @@ function echomemGuidanceBlock() {
         "- Before re-deriving past decisions, project context, or anything the user likely settled before: call `search_memories` first.",
         '- If the final user-facing answer materially relies on one or more EchoMem memories, end it with a compact `EchoMem sources:` list containing only the memories actually used. Link each memory key to its canonical `https://echoknows.com/memory/<memory-id>` URL. Do not cite memories that were merely retrieved, and omit the section when no memory informed the answer.',
         "- Before the final response for a task that produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone: call `save_conversation`. This private checkpoint does not require a separate user request. Do not save secrets, credentials, incidental chatter, or trivial read-only work. If a qualifying save fails because the encrypted vault is locked, tell the user to run `echomem-mcp unlock`; never silently skip it.",
-        "- For a user with a company group, call `get_group_session_sharing` near session start or after a qualifying private save. If this exact session has no decision, ask whether memories saved from the session should be shared with the current group. Silence is not a No: leave the state unset and ask again at a later qualifying checkpoint until the user explicitly answers Yes or No, without repeating the prompt in the same response. Call `set_group_session_sharing` only with that explicit answer. A Yes decision syncs eligible memories after each private save; a No decision keeps later saves private and stops later prompts for this exact session.",
+        '- After `save_conversation` succeeds and returns one or more saved memory IDs, make the save visible in the final user-facing answer with a compact `EchoMem saved:` list containing every memory created by that call. Link each memory key to its canonical `https://echoknows.com/memory/<memory-id>` URL. This save receipt is separate from `EchoMem sources:` and does not imply the newly saved memories informed the answer.',
+        "- For a user with a company group, call `get_group_session_sharing` near conversation start or after a qualifying private save. On the first call in a conversation, omit `groupSharingScopeId` so EchoMem mints a fresh opaque scope. Reuse that exact scope only in this conversation for later get/set/save calls, and never persist it as memory. If multiple groups are returned, reuse the same scope and check one `groupId` at a time. Each group requires its own explicit Yes/No decision. Silence leaves that group's state unset; never infer an answer or repeat the prompt in the same response. Store only explicit answers with `set_group_session_sharing`, the same scope, and the selected groupId. Saves sync eligible memories to every approved group; a No keeps them private for that group.",
         "- If the user pastes a session carryover/checkpoint: it may reference `get_checkpoint_by_context` — use it to pull the checkpoint/decision trail when you need more than the snapshot.",
         "",
         "### Company group memory",
         "- Use `get_group_context` when the user asks who is in their company group, what teammates are responsible for, or what work is already covered. Treat declared participant fields as facts and published-memory conclusions as evidence or inference.",
         "- A group publication is separate from a globally public memory: publishing to a group creates a group-scoped snapshot and must not change the encrypted original or its global `is_public` setting.",
-        "- Group session sharing is scoped to the exact current MCP session and current group. Membership is rechecked for each sync. Flagged memories are withheld from automatic session sync and remain private.",
+        "- Group sharing is scoped to an opaque id carried only in the current conversation, not to the MCP transport session. Membership is rechecked for each sync. Flagged memories are withheld from automatic conversation sync and remain private.",
         "- If a user asks to create a group, call `create_memory_group`; if they ask for a code to share, call `create_group_invite` and return the secret invite code only to that user. Never save the invite code to memory or include it in logs, analytics, summaries, or unrelated output.",
         "- If a user supplies an `echo_grp_...` code and explicitly asks to join, call `join_memory_group`. Joining never authorizes publishing by itself and must not move a user out of another group. After joining, continue into the profile-and-publication preview instead of leaving title or responsibility blank.",
         "- For requests such as “prepare my recent work memories,” “upload work from this ticket,” or “publish work since my last sync,” call `prepare_group_publication` first. This is a no-publication preview. For encrypted accounts, tell the user to run `echomem-mcp unlock` locally if the tool reports that the key is required.",
@@ -1325,7 +1326,10 @@ export function buildForensicReportOffThread(onProgress, options = {}) {
       parentPort?.postMessage({ ok: false, message: error instanceof Error ? error.message : String(error) });
     }
   `;
-    const worker = new Worker(new URL(`data:text/javascript;charset=utf-8,${encodeURIComponent(code)}`));
+    const requestedHeapMb = options.maxOldGenerationSizeMb;
+    const worker = new Worker(new URL(`data:text/javascript;charset=utf-8,${encodeURIComponent(code)}`), Number.isFinite(requestedHeapMb)
+        ? { resourceLimits: { maxOldGenerationSizeMb: Math.max(16, Math.floor(requestedHeapMb)) } }
+        : undefined);
     return new Promise((resolve, reject) => {
         let settled = false;
         const requestedTimeoutMs = options.timeoutMs ?? 15 * 60_000;

package/dist/v1-contract.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { MEMORY_CITATION_INSTRUCTION, withMcpVersion } from "./package-metadata.js";
+import { MEMORY_CITATION_INSTRUCTION, SAVED_MEMORY_RECEIPT_INSTRUCTION, withMcpVersion, } from "./package-metadata.js";
 export const canonicalToolNames = {
     search: "search_memories",
     save: "save_conversation",
@@ -59,6 +59,7 @@ export const saveConversationSchema = z.object({
     source: z.string().optional(),
     tags: z.array(z.string()).optional(),
     passthrough: z.boolean().optional(),
+    groupSharingScopeId: z.string().uuid().optional(),
     messages: z
         .array(z.object({
         role: z.string(),
@@ -125,9 +126,13 @@ export const groupContextSchema = z.object({
 });
 export const getGroupSessionSharingSchema = z.object({
     ...triggerMetadataSchema,
+    groupSharingScopeId: z.string().uuid().optional(),
+    groupId: z.string().uuid().optional(),
 });
 export const setGroupSessionSharingSchema = z.object({
     ...triggerMetadataSchema,
+    groupSharingScopeId: z.string().uuid(),
+    groupId: z.string().uuid().optional(),
     share: z.boolean(),
     confirmed: z.literal(true),
 });
@@ -260,7 +265,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.save,
-            description: "Save durable knowledge from this conversation into the user's private EchoMem (durable memories are extracted automatically). Call before the final response when work produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone; this private checkpoint does not require a separate user request. Omit secrets, incidental chatter, and trivial read-only work. If the encrypted vault is locked, tell the user to run `echomem-mcp unlock` and never silently skip a qualifying checkpoint. Private persistence happens first. If this MCP session has confirmed group sharing, eligible memories are then synced to the current group automatically; flagged memories stay private. If the session has no decision yet, ask whether to share. Silence leaves it unset, so ask again at a later qualifying checkpoint until the user explicitly answers Yes or No; do not repeat the prompt in the same response. New extraction input uses the plan's weekly processing allowance; if the limit is reached, nothing is saved. passthrough=true stores the text verbatim as a session capsule.",
+            description: `Save durable knowledge from this conversation into the user's private EchoMem (durable memories are extracted automatically). Call before the final response when work produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone; this private checkpoint does not require a separate user request. Omit secrets, incidental chatter, and trivial read-only work. If the encrypted vault is locked, tell the user to run \`echomem-mcp unlock\` and never silently skip a qualifying checkpoint. Private persistence happens first. For group sharing, reuse the exact groupSharingScopeId returned by get_group_session_sharing or an earlier save in this conversation. Never reuse it in another conversation or save it as memory. Each group has an independent decision under the same conversation scope; eligible memories sync automatically to every approved group, while flagged memories stay private. If a selected group has no decision yet, ask whether to share with that named group. Silence leaves it unset; never infer the answer. New extraction input uses the plan's weekly processing allowance; if the limit is reached, nothing is saved. passthrough=true stores the text verbatim as a session capsule. ${SAVED_MEMORY_RECEIPT_INSTRUCTION}`,
             inputSchema: {
                 type: "object",
                 properties: {
@@ -273,6 +278,11 @@ export function listToolSpecs(opts = {}) {
                         type: "boolean",
                         description: "When true, store the conversation text verbatim as a session capsule — no LLM extraction, no embeddings. Use for warm-up capsules.",
                     },
+                    groupSharingScopeId: {
+                        type: "string",
+                        format: "uuid",
+                        description: "Opaque scope returned by get_group_session_sharing or an earlier save in this conversation. Reuse only within this conversation; never persist it as memory.",
+                    },
                     messages: {
                         type: "array",
                         items: {
@@ -397,7 +407,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.others,
-            description: `Search public memories from accepted friends or people who share your company group. For onboarding and division-of-work questions, call get_group_context first, then use this tool for current evidence. Returned memories are recorded in memory_views for the owners. ${memoryCitationInstruction}${groupMapSection}`,
+            description: `Search public memories from accepted friends or people who share your company group. EchoMem identifies the caller from the EchoMem credential and has already excluded only that authenticated user's own memories. Present every returned owner; never filter again using a Claude account, host profile, git identity, or inferred identity. For onboarding and division-of-work questions, call get_group_context first, then use this tool for current evidence. Returned memories are recorded in memory_views for the owners. ${memoryCitationInstruction}${groupMapSection}`,
             inputSchema: {
                 type: "object",
                 properties: {
@@ -489,7 +499,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.groupContext,
-            description: `Get your current company group, its participant directory, declared titles and responsibilities, and published-memory coverage. Use this before answering who works on what or suggesting where a new group member could contribute. Treat declared profile fields as facts and memory-derived work as evidence or inference. Session sharing is separate; call get_group_session_sharing instead of inferring it.${groupMapSection}`,
+            description: `Get your current company group, its participant directory, declared titles and responsibilities, published-memory coverage, and the current member authenticated by the EchoMem credential. That authenticated EchoMem identity is authoritative over any conflicting Claude account, host profile, git identity, or inference. Use this before answering who works on what or suggesting where a new group member could contribute. Treat declared profile fields as facts and memory-derived work as evidence or inference. Conversation sharing is separate; call get_group_session_sharing instead of inferring it.${groupMapSection}`,
             inputSchema: {
                 type: "object",
                 properties: {
@@ -503,10 +513,20 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.getGroupSessionSharing,
-            description: "Read the confirmed sharing decision for this exact MCP session. Call near session start or after a qualifying private save. If the user has a group and no decision exists, ask: “Share memories saved from this session with <group>?” Silence leaves the state unset; ask again at a later qualifying checkpoint until the user explicitly answers Yes or No, but never repeat the prompt in the same response or infer the answer. An explicit No stops later prompts for this exact session.",
+            description: "Read the confirmed sharing decision for one group in this exact conversation. On the first call, omit groupSharingScopeId; EchoMem returns a new opaque scope. Reuse that scope only in this conversation. If the user belongs to multiple groups and groupId is omitted, EchoMem returns the available groups; call again with the same scope and one groupId at a time. Each group requires an independent explicit Yes/No decision. Silence leaves that group's state unset; never infer the answer.",
             inputSchema: {
                 type: "object",
                 properties: {
+                    groupSharingScopeId: {
+                        type: "string",
+                        format: "uuid",
+                        description: "Reuse the opaque scope previously returned in this conversation. Omit only on the first call so EchoMem can mint a fresh scope.",
+                    },
+                    groupId: {
+                        type: "string",
+                        format: "uuid",
+                        description: "Group to inspect. Required when the user belongs to multiple groups; EchoMem validates membership server-side.",
+                    },
                     triggerMessage: { type: "string" },
                     triggerMessageRole: { type: "string", default: "user" },
                 },
@@ -514,14 +534,16 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.setGroupSessionSharing,
-            description: "Store the user's explicit Yes/No sharing decision for this exact MCP session. share=true immediately syncs eligible memories already saved in the session and automatically syncs later private saves. share=false keeps later saves private. Flagged memories remain private and are reported as protected.",
+            description: "Store the user's explicit Yes/No sharing decision for one group in this exact conversation scope. Pass the exact groupSharingScopeId returned in this conversation and the selected groupId when the user belongs to multiple groups. EchoMem validates membership server-side. Decisions are independent per group: share=true backfills that group and later saves sync to every approved group; share=false keeps this conversation private for that group. Flagged memories remain private.",
             inputSchema: {
                 type: "object",
                 properties: {
+                    groupSharingScopeId: { type: "string", format: "uuid" },
+                    groupId: { type: "string", format: "uuid" },
                     share: { type: "boolean" },
                     confirmed: { type: "boolean", const: true },
                 },
-                required: ["share", "confirmed"],
+                required: ["groupSharingScopeId", "share", "confirmed"],
             },
         },
         {
@@ -552,7 +574,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.joinGroup,
-            description: "Join a company memory group using an invite code after the user explicitly asks to join. Joining never publishes memories. Next call prepare_group_publication, infer a proposed title and responsibility summary from the user's own candidate memories, and ask the user to confirm the profile together with the publication preview. Also call get_group_session_sharing and, if unset, ask whether memories saved from this session should be shared. Silence stays unset and should be prompted again at a later qualifying checkpoint until an explicit Yes or No.",
+            description: "Join a company memory group using an invite code after the user explicitly asks to join. Joining never publishes memories. Next call prepare_group_publication, infer a proposed title and responsibility summary from the user's own candidate memories, and ask the user to confirm the profile together with the publication preview. Also call get_group_session_sharing without a scope to mint one for this conversation and, if unset, ask whether memories saved from this conversation should be shared. Silence stays unset and should be prompted again at a later qualifying checkpoint until an explicit Yes or No.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -622,7 +644,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.completeGroupPublication,
-            description: "Publish only exact memory ids from a prepared scan after the user approves the preview with confirmed=true. This manual workflow is separate from session sharing. Explicitly confirmed flagged memories require their exact IDs in acknowledgedFlaggedMemoryIds. If an unflagged candidate appears sensitive, offer to first search for and mark similar sensitive owned memories for publication attention. Never auto-flag inferred sensitivity. Completing an empty selection safely advances the scan cursor.",
+            description: "Publish only exact memory ids from a prepared scan after the user approves the preview with confirmed=true. This manual workflow is separate from conversation sharing. Explicitly confirmed flagged memories require their exact IDs in acknowledgedFlaggedMemoryIds. If an unflagged candidate appears sensitive, offer to first search for and mark similar sensitive owned memories for publication attention. Never auto-flag inferred sensitivity. Completing an empty selection safely advances the scan cursor.",
             inputSchema: {
                 type: "object",
                 properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@echomem/mcp",
-  "version": "1.4.31",
+  "version": "1.4.33",
   "description": "EchoMem MCP bridge: cloud-first memory tools, local context HUD, and the Agent Doctor workspace forensics report (cost ledger + 3D repo city)",
   "main": "dist/index.js",
   "type": "module",
@@ -22,6 +22,7 @@
     "dev": "node dist/index.js",
     "smoke": "node smoke.mjs",
     "preview:extraction": "npm run build && node scripts/preview-extraction.mjs",
+    "stress:long-history": "npm run build && node scripts/stress-long-history.mjs",
     "test:artifact": "npm run build && node test/package-artifact.test.mjs",
     "test:registry": "node test/registry-artifact.test.mjs",
     "test:registry-ui": "npm run build && node test/registry-ui.test.mjs",

package/templates/codex-skills/echomem-save/SKILL.md

@@ -11,17 +11,24 @@ Use the `save_conversation` tool from the `echomem` MCP server.
 2. Prefer structured `messages`; add a concise title, source, and useful tags.
 3. Use `passthrough: true` only when the user explicitly needs a verbatim session capsule.
 4. Never include secrets, credentials, or unnecessary sensitive content.
-5. Confirm what EchoMem saved. If saving fails, report the failure without switching providers silently.
+5. Confirm what EchoMem saved. When the tool returns one or more saved memory IDs, end the final
+   user-facing answer with a compact `EchoMem saved:` list containing every memory created by that
+   call. Use each memory key as the Markdown label and its canonical
+   `https://echoknows.com/memory/<memory-id>` URL. Keep this separate from `EchoMem sources:`; a save
+   receipt does not imply the newly saved memories informed the answer. If saving fails, report the
+   failure without switching providers silently.
 6. Before a final response, use this workflow proactively when the task produced a durable decision,
    confirmed preference, implementation, resolved bug, commit, passing verification, release, or
    project milestone. A private checkpoint does not require a separate user request. Skip trivial
    read-only work and incidental chatter.
 7. If the encrypted vault is locked, tell the user to run `echomem-mcp unlock`; never silently skip a
    qualifying checkpoint.
-8. For a user with a company group, call `get_group_session_sharing` near session start or after a
-   qualifying private save. If unset, ask whether memories saved from this session should be shared.
-   Silence is not a No: leave the state unset and ask again at a later qualifying checkpoint until the
-   user explicitly answers Yes or No, without repeating the prompt in the same response. Then call
-   `set_group_session_sharing` with that explicit answer. A Yes decision syncs eligible memories after
-   private persistence; a No decision stops later prompts for this exact session; flagged memories
-   remain private.
+8. For a user with a company group, call `get_group_session_sharing` near conversation start or after a
+   qualifying private save. On the first call in a conversation, omit `groupSharingScopeId` so EchoMem
+   mints a fresh opaque scope. Reuse that exact scope only in this conversation for later get/set/save
+   calls, and never persist it as memory. If multiple groups are returned, reuse the same scope and
+   check one `groupId` at a time. Each group requires its own explicit Yes/No decision. Silence leaves
+   that group's state unset; never infer an answer or repeat the prompt in the same response. Store only
+   explicit answers with `set_group_session_sharing`, the same scope, and the selected groupId. Saves
+   sync eligible memories to every approved group; a No keeps them private for that group; flagged
+   memories remain private.

package/templates/echomem-recall.md

@@ -18,10 +18,17 @@ This project has EchoMem connected — the user's long-term memory across all th
   `save_conversation`. This private checkpoint does not require a separate user request. Save a
   concise structured outcome rather than the full transcript. Never save secrets, credentials,
   incidental chatter, or trivial read-only work. This does not authorize company-group publication.
-- For a user with a company group, call `get_group_session_sharing` near session start or after a
-  qualifying private save. If this exact session has no decision, ask whether memories saved from it
-  should be shared. Silence is not a No: leave the state unset and ask again at a later qualifying
-  checkpoint until the user explicitly answers Yes or No, without repeating the prompt in the same
-  response. Store only the explicit answer with `set_group_session_sharing`. A Yes decision syncs
-  eligible memories after private persistence; a No decision stops later prompts for this exact
-  session; flagged memories stay private.
+- After `save_conversation` succeeds and returns one or more saved memory IDs, make the save visible
+  in the final user-facing answer with a compact `EchoMem saved:` list containing every memory
+  created by that call. Link each memory key to its canonical
+  `https://echoknows.com/memory/<memory-id>` URL. This save receipt is separate from
+  `EchoMem sources:` and does not imply that the newly saved memories informed the answer.
+- For a user with a company group, call `get_group_session_sharing` near conversation start or after a
+  qualifying private save. On the first call in a conversation, omit `groupSharingScopeId` so EchoMem
+  mints a fresh opaque scope. Reuse that exact scope only in this conversation for later get/set/save
+  calls, and never persist it as memory. If multiple groups are returned, reuse the same scope and
+  check one `groupId` at a time. Each group requires its own explicit Yes/No decision. Silence leaves
+  that group's state unset; never infer an answer or repeat the prompt in the same response. Store only
+  explicit answers with `set_group_session_sharing`, the same scope, and the selected groupId. Saves
+  sync eligible memories to every approved group; a No keeps them private for that group; flagged
+  memories stay private.