@echomem/mcp 1.4.38 → 1.4.40

package/dist/index.js

@@ -1719,7 +1719,7 @@ Details: ${m.details || "N/A"}`)
                     syncedGroupNames.length
                         ? `Saved privately first and synced to approved groups: ${syncedGroupNames.join(", ")}.`
                         : "Saved to your private memory.",
-                    `This user has multiple groups: ${availableGroups.map((group) => `${readString(group, "name") ?? "Unnamed group"} (${readString(group, "id") ?? "unknown id"})`).join(", ")}. Call request_group_session_sharing with this conversation scope and one groupId at a time so supported hosts render a separate sharing choice for each group.`,
+                    `This user has multiple groups: ${availableGroups.map((group) => `${readString(group, "name") ?? "Unnamed group"} (${readString(group, "id") ?? "unknown id"})`).join(", ")}. Call request_group_session_sharing with this conversation scope and one groupId at a time to obtain a separate text confirmation question for each group.`,
                     failedSyncs.length
                         ? `${failedSyncs.length} approved group sync(s) failed; private memories were preserved.`
                         : "",
@@ -1728,7 +1728,7 @@ Details: ${m.details || "N/A"}`)
                         : "",
                 ].filter(Boolean).join(" ")
                 : sharing?.decision === null || sharing?.decision === undefined
-                    ? `Saved to your private memory. Call request_group_session_sharing with this conversation scope${readString(sharingGroup, "id") ? ` and groupId ${readString(sharingGroup, "id")}` : ""} so a supported host can show the sharing choice for ${readString(sharingGroup, "name") ?? "your current group"}. If the client cannot render it, relay that tool's fallback question. Decline, cancel, or silence leaves the state unset.`
+                    ? `Saved to your private memory. Call request_group_session_sharing with this conversation scope${readString(sharingGroup, "id") ? ` and groupId ${readString(sharingGroup, "id")}` : ""}, relay its exact text question for ${readString(sharingGroup, "name") ?? "your current group"}, and call set_group_session_sharing only after an explicit Yes or No. Silence leaves the state unset.`
                     : sharing.decision === "private"
                         ? "Saved to your private memory."
                         : syncedGroupNames.length
@@ -2202,7 +2202,7 @@ Details: ${m.details || "N/A"}`;
             return {
                 content: [{
                         type: "text",
-                        text: `${scopeText}\n\nThis user belongs to multiple groups: ${choices}. Reuse this same conversation scope and call request_group_session_sharing once per groupId so supported hosts render a separate sharing choice for each group.`,
+                        text: `${scopeText}\n\nThis user belongs to multiple groups: ${choices}. Reuse this same conversation scope and call request_group_session_sharing once per groupId to obtain a separate text confirmation question for each group.`,
                     }],
             };
         }
@@ -2212,7 +2212,7 @@ Details: ${m.details || "N/A"}`;
             return {
                 content: [{
                         type: "text",
-                        text: `${scopeText}\n\nNo sharing decision exists for this conversation. Call request_group_session_sharing with the scope above${readString(group, "id") ? ` and groupId ${readString(group, "id")}` : ""}. Supported hosts will show a native Share with team / Keep private choice. If the client cannot render it, relay that tool's fallback question. Decline, cancel, or silence is not a No and leaves the state unset.`,
+                        text: `${scopeText}\n\nNo sharing decision exists for this conversation. Call request_group_session_sharing with the scope above${readString(group, "id") ? ` and groupId ${readString(group, "id")}` : ""}, relay its exact text question, and call set_group_session_sharing only after an explicit Yes or No. Silence leaves the state unset.`,
                     }],
             };
         }
@@ -2233,10 +2233,10 @@ Details: ${m.details || "N/A"}`;
             ? `Conversation sharing scope: ${groupSharingScopeId}\nReuse this exact groupSharingScopeId only in this conversation for later get/request/set/save calls. Never persist it as memory.`
             : "";
     }
-    sharingFallbackText(scopeText, groupName) {
+    sharingPromptText(scopeText, groupName) {
         return [
             scopeText,
-            `This client cannot show EchoMem's sharing choice UI. Ask: “Share eligible memories saved from this conversation with ${groupName}?” Only an explicit Yes or No may be passed to set_group_session_sharing. Decline, cancel, or silence leaves the state unset.`,
+            `Ask exactly: “Share eligible memories saved from this conversation with ${groupName}?” Only an explicit Yes or No may be passed to set_group_session_sharing. Silence leaves the state unset.`,
         ].filter(Boolean).join("\n\n");
     }
     formatGroupSessionSharingUpdate(share, payload, scopeText = "") {
@@ -2310,60 +2310,9 @@ Details: ${m.details || "N/A"}`;
                     }],
             };
         }
-        const formElicitation = this.server.getClientCapabilities()?.elicitation?.form;
-        if (!formElicitation) {
-            return {
-                content: [{ type: "text", text: this.sharingFallbackText(scopeText, groupName) }],
-            };
-        }
-        let elicitation;
-        try {
-            elicitation = await this.server.elicitInput({
-                mode: "form",
-                message: `EchoMem saved this checkpoint privately. Choose whether eligible memories from this conversation should also be shared with ${groupName}. Flagged memories always remain private.`,
-                requestedSchema: {
-                    type: "object",
-                    properties: {
-                        sharingDecision: {
-                            type: "string",
-                            title: "Team sharing",
-                            description: `Choose whether eligible conversation memories may be shared with ${groupName}.`,
-                            oneOf: [
-                                { const: "share", title: "Share with team" },
-                                { const: "private", title: "Keep private" },
-                            ],
-                        },
-                    },
-                    required: ["sharingDecision"],
-                },
-            });
-        }
-        catch {
-            return {
-                content: [{ type: "text", text: this.sharingFallbackText(scopeText, groupName) }],
-            };
-        }
-        if (elicitation.action !== "accept") {
-            return {
-                content: [{
-                        type: "text",
-                        text: this.sharingFallbackText(scopeText, groupName),
-                    }],
-            };
-        }
-        const sharingDecision = readString(elicitation.content ?? {}, "sharingDecision");
-        if (sharingDecision !== "share" && sharingDecision !== "private") {
-            return {
-                content: [{ type: "text", text: this.sharingFallbackText(scopeText, groupName) }],
-            };
-        }
-        const updatePayload = await this.client.setGroupSessionSharing({
-            ...parsed,
-            groupSharingScopeId,
-            share: sharingDecision === "share",
-            confirmed: true,
-        });
-        return this.formatGroupSessionSharingUpdate(sharingDecision === "share", updatePayload, scopeText);
+        return {
+            content: [{ type: "text", text: this.sharingPromptText(scopeText, groupName) }],
+        };
     }
     async handleSetGroupSessionSharing(args) {
         const parsed = setGroupSessionSharingSchema.parse(args ?? {});
@@ -2418,8 +2367,8 @@ Details: ${m.details || "N/A"}`;
             content: [{
                     type: "text",
                     text: payload?.alreadyMember
-                        ? `You are already a member of ${payload?.group?.name ?? "this group"}. No memories were published. Use prepare_group_publication to review memories and propose any missing title or responsibility fields, then call request_group_session_sharing so supported hosts render the native sharing choice. Decline or cancel stays unset for a later checkpoint.`
-                        : `Joined ${payload?.group?.name ?? "the company group"}. No memories were published. Next use prepare_group_publication to review candidates, infer a proposed title and responsibility summary, and ask the user to confirm that profile together with the publication preview. Also call request_group_session_sharing without a scope so supported hosts show the native team-sharing choice. Decline or cancel leaves consent unset for a later checkpoint.`,
+                        ? `You are already a member of ${payload?.group?.name ?? "this group"}. No memories were published. Use prepare_group_publication to review memories and propose any missing title or responsibility fields, then call request_group_session_sharing and relay its exact text question. Silence stays unset for a later checkpoint.`
+                        : `Joined ${payload?.group?.name ?? "the company group"}. No memories were published. Next use prepare_group_publication to review candidates, infer a proposed title and responsibility summary, and ask the user to confirm that profile together with the publication preview. Also call request_group_session_sharing without a scope and relay its exact text question. Silence leaves consent unset for a later checkpoint.`,
                 }],
         };
     }

package/dist/package-metadata.js

@@ -38,7 +38,7 @@ export const MCP_SERVER_INSTRUCTIONS = [
     "Before re-deriving prior decisions or preferences, use search_memories.",
     `Before the final response for a durable decision, implementation, fix, commit, passing verification, release, or milestone, call save_conversation. Skip secrets and trivial work. If the encrypted vault is locked, tell the user to ${MCP_VAULT_UNLOCK_INSTRUCTION}.`,
     "After a successful save, show every memory created by that call in a compact EchoMem saved: list with canonical links; this is separate from \"EchoMem sources:\".",
-    "For company groups, call request_group_session_sharing near conversation start or after a qualifying save. It renders a native choice on clients with MCP elicitation and returns a text fallback otherwise. Omit groupSharingScopeId only on the first call, then reuse the returned scope only in this conversation. Each group needs an explicit choice; decline, cancel, or silence stays unset. Never infer consent. Flagged memories stay private.",
+    "For company groups, call request_group_session_sharing near conversation start or after a qualifying save, relay its exact text question, and call set_group_session_sharing only after an explicit Yes or No. Omit groupSharingScopeId only on the first call, then reuse the returned scope only in this conversation. Each group needs an explicit choice; silence stays unset. Never infer consent. Flagged memories stay private.",
     "EchoMem credential identity is authoritative over Claude profiles, host accounts, git identity, or inference. Use get_group_context before group-orientation answers and never re-filter owners returned by search_others_memories.",
     "When a final answer materially uses teammate or friend memories, call record_memory_citations with only the exact used Memory IDs and a unique per-answer receiptId.",
     "End memory-informed answers with a compact EchoMem sources: list. Use each memory key as the label and https://echoknows.com/memory/<memory-id> as its canonical link.",

package/dist/save-checkpoint-hook.js

@@ -8,7 +8,7 @@ const CHECKPOINT_REASON = [
     "Review the work that just completed. If it produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone, call `save_conversation` now with a concise structured summary of the outcome, reasoning, relevant files, and constraints.",
     "Do not save secrets or incidental chatter. If the work was not durable, do not call the tool and finish normally.",
     "Private persistence happens first. For a user with a company group, call `request_group_session_sharing` near conversation start or after a qualifying private save.",
-    "On the first request_group_session_sharing call in a conversation, omit groupSharingScopeId so EchoMem mints a fresh opaque scope. Reuse that exact scope only in this conversation for later get/request/set/save calls, and never persist it as memory. If multiple groups are returned, reuse the same scope and call once per groupId. Supported clients render a native Share with team / Keep private choice; if the tool returns a text fallback, relay its exact question and call set_group_session_sharing only after an explicit Yes/No. Decline, cancel, or silence leaves that group's state unset. A Share decision syncs eligible memories from later saves carrying the same scope to that group; saves automatically sync to every approved group. Keep private keeps them private for that group.",
+    "On the first request_group_session_sharing call in a conversation, omit groupSharingScopeId so EchoMem mints a fresh opaque scope. Reuse that exact scope only in this conversation for later get/request/set/save calls, and never persist it as memory. If multiple groups are returned, reuse the same scope and call once per groupId. Relay the tool's exact text question and call set_group_session_sharing only after an explicit Yes/No. Silence leaves that group's state unset. A Share decision syncs eligible memories from later saves carrying the same scope to that group; saves automatically sync to every approved group. Keep private keeps them private for that group.",
     "Flagged memories are withheld from automatic conversation sync and remain private.",
     "If EchoMem reports that the encrypted vault is locked, tell the user to open Echo Desktop and unlock the vault there; on a headless system, use `echomem-mcp unlock`. Never silently skip a qualifying checkpoint.",
 ].join(" ");

package/dist/setup-page/client-extraction.js

@@ -1285,10 +1285,12 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
         var slot = document.getElementById("setupPlan");
         if (!slot) return;
         var readySettings = slot.closest ? slot.closest(".readySettings") : null;
+        var planGateDecision = slot.closest ? slot.closest(".planGateDecision") : null;
         if (!canExtract) {
           slot.innerHTML = "";
           slot.classList.add("is-hidden");
           if (readySettings) readySettings.classList.remove("is-plan-open", "is-checkout-pending");
+          if (planGateDecision) planGateDecision.classList.remove("is-checkout-pending");
           renderBillingCommitment("");
           return;
         }
@@ -1303,6 +1305,7 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
             return;
           }
           if (readySettings) readySettings.classList.remove("is-plan-open", "is-checkout-pending");
+          if (planGateDecision) planGateDecision.classList.remove("is-checkout-pending");
           rememberSetupPlanChoice("");
           setupPlanChoice = "paid";
           var planLabel = plan.charAt(0).toUpperCase() + plan.slice(1);
@@ -1329,6 +1332,7 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
         }
         if (setupPlanChoice === "free") {
           if (readySettings) readySettings.classList.remove("is-plan-open", "is-checkout-pending");
+          if (planGateDecision) planGateDecision.classList.remove("is-checkout-pending");
           slot.innerHTML = '<div class="setupPlanConfirmed"><span class="setupPlanConfirmedIcon" aria-hidden="true">' + setupIcon("check") + '</span><span class="setupPlanConfirmedCopy"><strong>Original Echo</strong><span>100 coding sessions and 100 memory recalls each week.</span></span><button type="button" class="textButton" id="changeSetupPlan">Change</button></div>';
           renderBillingCommitment("");
           var changeBtn = document.getElementById("changeSetupPlan");
@@ -1352,6 +1356,7 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
             readySettings.classList.remove("is-plan-open");
             readySettings.classList.add("is-checkout-pending");
           }
+          if (planGateDecision) planGateDecision.classList.add("is-checkout-pending");
           var selectedPaidPlan = pendingPaidPlan === "power" ? "Power" : "Pro";
           var pendingHasTrial = !billingStatus || billingStatus.trialAvailable !== false;
           var pendingPrice = pendingPaidPlan === "power" ? "$100" : "$20";
@@ -1361,15 +1366,15 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
             : "Checking automatically every few seconds");
           slot.innerHTML =
             '<section class="setupPlanChoice setupPlanCheckout" aria-labelledby="setupPlanHeading">' +
-              '<div class="setupPlanIntro"><h3 id="setupPlanHeading">' + esc(pendingHasTrial ? selectedPaidPlan + " trial — $0 today" : selectedPaidPlan + " subscription") + '</h3><p>Finish in Stripe. This page updates automatically.</p></div>' +
+              '<div class="setupPlanIntro"><h3 id="setupPlanHeading">' + esc(pendingHasTrial ? selectedPaidPlan + " trial — $0 today" : selectedPaidPlan + " subscription") + '</h3><p>Complete checkout in Stripe, then return here. This page updates automatically.</p></div>' +
               '<dl class="checkoutCommitment">' +
                 '<div><dt>Today</dt><dd>' + esc(pendingHasTrial ? "$0" : pendingPrice) + '</dd></div>' +
                 '<div><dt>History import</dt><dd>' + esc(pendingLimit) + ' sessions</dd></div>' +
                 '<div><dt>' + esc(pendingHasTrial ? "First charge" : "Billing") + '</dt><dd>' + esc(pendingHasTrial ? pendingPrice + " on " + trialChargeDateText() : pendingPrice + "/month now") + '</dd></div>' +
               '</dl>' +
-              '<div class="checkoutActions"><button type="button" class="primary" id="continueSelectedPaidPlan">Reopen Stripe checkout</button><button type="button" class="secondary" id="checkPaymentStatus">Check payment status</button></div>' +
+              '<div class="checkoutActions"><button type="button" class="primary" id="continueSelectedPaidPlan">Reopen Stripe checkout</button></div>' +
               '<p class="checkoutPollStatus" id="setupPlanStatus" role="status" aria-live="polite">' + esc(pendingStatus) + '</p>' +
-              '<div class="setupPlanFoot"><button type="button" class="textButton" id="changeSelectedPaidPlan">Choose another plan</button></div>' +
+              '<div class="setupPlanFoot"><button type="button" class="textButton" id="checkPaymentStatus">Check payment status</button><button type="button" class="textButton" id="changeSelectedPaidPlan">Choose another plan</button></div>' +
             '</section>';
           var checkPaid = document.getElementById("checkPaymentStatus");
           if (checkPaid) checkPaid.onclick = function () {
@@ -1395,6 +1400,7 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
           readySettings.classList.remove("is-checkout-pending");
           readySettings.classList.add("is-plan-open");
         }
+        if (planGateDecision) planGateDecision.classList.remove("is-checkout-pending");
         slot.innerHTML = renderPlanHabitat();
         renderBillingCommitment("");
         bindPlanHabitat();

package/dist/setup-page/styles-mvp.js

@@ -667,6 +667,52 @@ export const SETUP_PAGE_STYLES_MVP = String.raw `
       color: var(--echo-ink-text);
       text-align: left;
     }
+    .planGateDecision.is-checkout-pending {
+      width: min(680px, 100%);
+    }
+    .planGateDecision.is-checkout-pending .setupPlanSlot {
+      margin-top: 8px;
+    }
+    .planGateDecision.is-checkout-pending .setupPlanCheckout {
+      display: grid;
+      gap: 16px;
+      margin: 0 auto;
+      overflow: visible;
+      border: 1px solid rgba(26,58,143,0.11);
+      border-radius: 20px;
+      background: rgba(255,255,255,0.78);
+      padding: clamp(22px, 4vw, 34px);
+      box-shadow: 0 22px 55px -42px rgba(20,36,84,0.5);
+      backdrop-filter: blur(10px);
+    }
+    .planGateDecision.is-checkout-pending .setupPlanIntro {
+      padding: 0;
+    }
+    .planGateDecision.is-checkout-pending .setupPlanIntro h3 {
+      font-size: clamp(25px, 3vw, 32px);
+      line-height: 1.2;
+    }
+    .planGateDecision.is-checkout-pending .setupPlanIntro p {
+      max-width: 620px;
+      margin-top: 7px;
+      font-size: 14px;
+      line-height: 1.5;
+    }
+    .planGateDecision.is-checkout-pending .checkoutActions {
+      grid-template-columns: 1fr;
+    }
+    .planGateDecision.is-checkout-pending .setupPlanFoot {
+      justify-content: flex-start;
+      gap: 18px;
+      margin-top: 0;
+    }
+    .planGateDecision.is-checkout-pending .setupPlanFoot .textButton {
+      min-height: 0;
+      padding: 2px 0;
+      color: var(--echo-ink-mute);
+      font-size: 11px;
+      font-weight: 700;
+    }
     .mvpPricing {
       width: 100%;
     }

package/dist/setup.js

@@ -360,7 +360,7 @@ function echomemGuidanceBlock() {
         '- If the final user-facing answer materially relies on one or more EchoMem memories, end it with a compact `EchoMem sources:` list containing only the memories actually used. Link each memory key to its canonical `https://echoknows.com/memory/<memory-id>` URL. Do not cite memories that were merely retrieved, and omit the section when no memory informed the answer.',
         "- Before the final response for a task that produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone: call `save_conversation`. This private checkpoint does not require a separate user request. Do not save secrets, credentials, incidental chatter, or trivial read-only work. If a qualifying save fails because the encrypted vault is locked, tell the user to open Echo Desktop and unlock the vault there; on a headless system, use `echomem-mcp unlock`. Never silently skip it.",
         '- After `save_conversation` succeeds and returns one or more saved memory IDs, make the save visible in the final user-facing answer with a compact `EchoMem saved:` list containing every memory created by that call. Link each memory key to its canonical `https://echoknows.com/memory/<memory-id>` URL. This save receipt is separate from `EchoMem sources:` and does not imply the newly saved memories informed the answer.',
-        "- For a user with a company group, call `request_group_session_sharing` near conversation start or after a qualifying private save. On the first call in a conversation, omit `groupSharingScopeId` so EchoMem mints a fresh opaque scope. Reuse that exact scope only in this conversation for later get/request/set/save calls, and never persist it as memory. If multiple groups are returned, reuse the same scope and call once per `groupId`. Supported clients render a native Share with team / Keep private choice. If the tool returns a text fallback, relay its exact question and call `set_group_session_sharing` only after an explicit Yes/No. Decline, cancel, or silence leaves that group's state unset; never infer an answer. Saves sync eligible memories to every approved group; a No keeps them private for that group.",
+        "- For a user with a company group, call `request_group_session_sharing` near conversation start or after a qualifying private save. On the first call in a conversation, omit `groupSharingScopeId` so EchoMem mints a fresh opaque scope. Reuse that exact scope only in this conversation for later get/request/set/save calls, and never persist it as memory. If multiple groups are returned, reuse the same scope and call once per `groupId`. Relay the tool's exact text question and call `set_group_session_sharing` only after an explicit Yes/No. Silence leaves that group's state unset; never infer an answer. Saves sync eligible memories to every approved group; a No keeps them private for that group.",
         "- If the user pastes a session carryover/checkpoint: it may reference `get_checkpoint_by_context` — use it to pull the checkpoint/decision trail when you need more than the snapshot.",
         "",
         "### Company group memory",
@@ -416,7 +416,26 @@ export function writeJsonClientConfig(configPath, entry) {
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
 }
 export function writeClaudeCodeConfig(entry) {
-    const addArguments = ["mcp", "add-json", "-s", "local", "echomem", JSON.stringify(entry)];
+    // EchoMem is a memory server that should load in EVERY Claude Code project, so it belongs at
+    // `user` scope (~/.claude.json, all projects) rather than `local` scope (the current project only).
+    const addArguments = ["mcp", "add-json", "-s", "user", "echomem", JSON.stringify(entry)];
+    const removeFromScope = (scope) => {
+        try {
+            execFileSync("claude", ["mcp", "remove", "echomem", "-s", scope], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "pipe"],
+                timeout: 10000,
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    // Older builds installed EchoMem at `local` scope. Left in place it would shadow the user-scoped
+    // entry and keep launching the stale command, so drop it first. Best-effort: `local` is per-project,
+    // so this only clears the directory setup runs from — a no-op (ignored) when nothing is there.
+    removeFromScope("local");
     try {
         execFileSync("claude", addArguments, {
             encoding: "utf8",
@@ -431,14 +450,11 @@ export function writeClaudeCodeConfig(entry) {
         if (!detail.includes("already exists"))
             return "unavailable";
     }
-    // Claude Code's CLI will not replace a same-name local server. Once the replacement entry is
-    // fully constructed, remove only EchoMem and immediately re-add it; sibling MCP servers remain.
+    // Claude Code's CLI will not replace a same-name server. Once the replacement entry is fully
+    // constructed, remove only EchoMem and immediately re-add it; sibling MCP servers remain.
     try {
-        execFileSync("claude", ["mcp", "remove", "echomem", "-s", "local"], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "pipe"],
-            timeout: 10000,
-        });
+        if (!removeFromScope("user"))
+            return "unavailable";
         execFileSync("claude", addArguments, {
             encoding: "utf8",
             stdio: ["ignore", "pipe", "pipe"],

package/dist/v1-contract.js

@@ -50,6 +50,7 @@ const READ_ONLY_TOOL_NAMES = new Set([
     canonicalToolNames.publicMemory,
     canonicalToolNames.groupContext,
     canonicalToolNames.getGroupSessionSharing,
+    canonicalToolNames.requestGroupSessionSharing,
     canonicalToolNames.getByContext,
     canonicalToolNames.checkpointByContext,
     canonicalToolNames.report,
@@ -59,7 +60,6 @@ const READ_ONLY_TOOL_NAMES = new Set([
 ]);
 const IDEMPOTENT_WRITE_TOOL_NAMES = new Set([
     canonicalToolNames.recordCitations,
-    canonicalToolNames.requestGroupSessionSharing,
     canonicalToolNames.setGroupSessionSharing,
     canonicalToolNames.updateGroupProfile,
     canonicalToolNames.completeGroupPublication,
@@ -417,7 +417,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.save,
-            description: `Save durable knowledge from this conversation into the user's private EchoMem (durable memories are extracted automatically). Call before the final response when work produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone; this private checkpoint does not require a separate user request. Omit secrets, incidental chatter, and trivial read-only work. If the encrypted vault is locked, tell the user to ${MCP_VAULT_UNLOCK_INSTRUCTION} and never silently skip a qualifying checkpoint. Private persistence happens first. For group sharing, reuse the exact groupSharingScopeId returned by get_group_session_sharing, request_group_session_sharing, or an earlier save in this conversation. Never reuse it in another conversation or save it as memory. Each group has an independent decision under the same conversation scope; eligible memories sync automatically to every approved group, while flagged memories stay private. If a selected group has no decision yet, call request_group_session_sharing so supported hosts render a choice UI; its fallback tells you when a text Yes/No prompt is required. Silence leaves consent unset; never infer the answer. New extraction input uses the plan's weekly processing allowance; if the limit is reached, nothing is saved. passthrough=true stores the text verbatim as a session capsule. ${SAVED_MEMORY_RECEIPT_INSTRUCTION}`,
+            description: `Save durable knowledge from this conversation into the user's private EchoMem (durable memories are extracted automatically). Call before the final response when work produced a durable decision, confirmed preference, implementation, resolved bug, commit, passing verification, release, or project milestone; this private checkpoint does not require a separate user request. Omit secrets, incidental chatter, and trivial read-only work. If the encrypted vault is locked, tell the user to ${MCP_VAULT_UNLOCK_INSTRUCTION} and never silently skip a qualifying checkpoint. Private persistence happens first. For group sharing, reuse the exact groupSharingScopeId returned by get_group_session_sharing, request_group_session_sharing, or an earlier save in this conversation. Never reuse it in another conversation or save it as memory. Each group has an independent decision under the same conversation scope; eligible memories sync automatically to every approved group, while flagged memories stay private. If a selected group has no decision yet, call request_group_session_sharing, relay its exact text question, and call set_group_session_sharing only after an explicit Yes or No. Silence leaves consent unset; never infer the answer. New extraction input uses the plan's weekly processing allowance; if the limit is reached, nothing is saved. passthrough=true stores the text verbatim as a session capsule. ${SAVED_MEMORY_RECEIPT_INSTRUCTION}`,
             inputSchema: {
                 type: "object",
                 properties: {
@@ -661,7 +661,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.getGroupSessionSharing,
-            description: "Read the confirmed sharing decision for one group in this exact conversation. On the first call, omit groupSharingScopeId; EchoMem returns a new opaque scope. Reuse that scope only in this conversation. If the user belongs to multiple groups and groupId is omitted, EchoMem returns the available groups. If a decision is unset, call request_group_session_sharing with this scope and the selected groupId so supported hosts render a choice UI. Silence leaves that group's state unset; never infer the answer.",
+            description: "Read the confirmed sharing decision for one group in this exact conversation. On the first call, omit groupSharingScopeId; EchoMem returns a new opaque scope. Reuse that scope only in this conversation. If the user belongs to multiple groups and groupId is omitted, EchoMem returns the available groups. If a decision is unset, call request_group_session_sharing with this scope and the selected groupId, relay its exact text question, and call set_group_session_sharing only after an explicit Yes or No. Silence leaves that group's state unset; never infer the answer.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -682,7 +682,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.requestGroupSessionSharing,
-            description: "Check one group's sharing decision for this exact conversation and, only when it is unset, ask the user through the MCP client's native choice UI. Omit groupSharingScopeId only on the first call so EchoMem can mint a fresh scope; reuse the returned scope only in this conversation. When multiple groups are returned, call again with the same scope and one groupId at a time. An accepted Share choice backfills eligible private memories and syncs later saves; Keep private records No. Decline or cancel records nothing. If the client cannot render MCP elicitation, relay the returned fallback question and call set_group_session_sharing only after the user explicitly answers.",
+            description: "Check one group's sharing decision for this exact conversation and, only when it is unset, return the exact text confirmation question the agent must relay to the user. Omit groupSharingScopeId only on the first call so EchoMem can mint a fresh scope; reuse the returned scope only in this conversation. When multiple groups are returned, call again with the same scope and one groupId at a time. Call set_group_session_sharing only after the user explicitly answers Yes or No. A confirmed Yes backfills eligible private memories and syncs later saves; a confirmed No keeps them private. Silence records nothing.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -743,7 +743,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.joinGroup,
-            description: "Join a company memory group using an invite code after the user explicitly asks to join. Joining never publishes memories. Next call prepare_group_publication, infer a proposed title and responsibility summary from the user's own candidate memories, and ask the user to confirm the profile together with the publication preview. Also call request_group_session_sharing without a scope so supported hosts render a native sharing choice. Decline or cancel stays unset and should be prompted again at a later qualifying checkpoint.",
+            description: "Join a company memory group using an invite code after the user explicitly asks to join. Joining never publishes memories. Next call prepare_group_publication, infer a proposed title and responsibility summary from the user's own candidate memories, and ask the user to confirm the profile together with the publication preview. Also call request_group_session_sharing without a scope and relay its exact text question. Silence stays unset and should be prompted again at a later qualifying checkpoint.",
             inputSchema: {
                 type: "object",
                 properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@echomem/mcp",
-  "version": "1.4.38",
+  "version": "1.4.40",
   "description": "EchoMem MCP bridge: cloud-first memory tools and the Agent Doctor workspace forensics report (cost ledger + 3D repo city)",
   "main": "dist/index.js",
   "type": "module",

package/templates/codex-skills/echomem-save/SKILL.md

@@ -27,8 +27,7 @@ Use the `save_conversation` tool from the `echomem` MCP server.
    after a qualifying private save. On the first call in a conversation, omit `groupSharingScopeId` so
    EchoMem mints a fresh opaque scope. Reuse that exact scope only in this conversation for later
    get/request/set/save calls, and never persist it as memory. If multiple groups are returned, reuse
-   the same scope and call once per `groupId`. Supported clients render a native Share with team / Keep
-   private choice. If the tool returns a text fallback, relay its exact question and call
-   `set_group_session_sharing` only after an explicit Yes/No. Decline, cancel, or silence leaves that
+   the same scope and call once per `groupId`. Relay the tool's exact text question and call
+   `set_group_session_sharing` only after an explicit Yes/No. Silence leaves that
    group's state unset; never infer an answer. Saves sync eligible memories to every approved group;
    Keep private keeps them private for that group; flagged memories remain private.

package/templates/echomem-recall.md

@@ -27,8 +27,7 @@ This project has EchoMem connected — the user's long-term memory across all th
   after a qualifying private save. On the first call in a conversation, omit `groupSharingScopeId` so
   EchoMem mints a fresh opaque scope. Reuse that exact scope only in this conversation for later
   get/request/set/save calls, and never persist it as memory. If multiple groups are returned, reuse
-  the same scope and call once per `groupId`. Supported clients render a native Share with team / Keep
-  private choice. If the tool returns a text fallback, relay its exact question and call
-  `set_group_session_sharing` only after an explicit Yes/No. Decline, cancel, or silence leaves that
+  the same scope and call once per `groupId`. Relay the tool's exact text question and call
+  `set_group_session_sharing` only after an explicit Yes/No. Silence leaves that
   group's state unset; never infer an answer. Saves sync eligible memories to every approved group;
   Keep private keeps them private for that group; flagged memories stay private.