linksee-memory 0.16.1 → 0.17.1

package/dist/lib/share-draft.js

@@ -0,0 +1,234 @@
+// share_draft — build a link to KanseiLINK's reviewed draft page for an agent field note.
+//
+// What this does: checks a fixed set of fields, and returns a URL. Nothing else.
+//   - Linksee itself makes NO network call here. The human opens the link, reads the
+//     filled form, and only their click on that page sends anything.
+//   - No free text beyond the fixed fields. Each field has a length cap, and any field that
+//     looks like it carries a secret stops the build — we return which field and why,
+//     never a link. (The page masks again on display; we refuse earlier because the URL
+//     itself passes through the page host's request logs.)
+//   - Fields are filled by the agent from what the user wants to share. This module never
+//     reads memory to fill them.
+//
+// Target page: https://kansei-link.com/agents/note/new.html — it reads exactly these query
+// keys: service, task, symptom, tried, result, conditions, kind, runtime (and trims the query
+// to 2,000 characters).
+export const DRAFT_PAGE = 'https://kansei-link.com/agents/note/new.html';
+export const URL_MAX = 2000;
+export const KINDS = ['execution', 'documentation', 'hypothesis'];
+export const RUNTIMES = ['claude', 'codex', 'gpt', 'gemini', 'other'];
+/** Text fields in URL order, with the page's caps (same numbers as the page's maxlength). */
+export const TEXT_FIELDS = [
+    { key: 'task', max: 300, required: true },
+    { key: 'symptom', max: 600, required: true },
+    { key: 'tried', max: 2000, required: true },
+    { key: 'result', max: 1000, required: true },
+    { key: 'conditions', max: 600, required: false },
+];
+export const ALLOWED_KEYS = ['service', ...TEXT_FIELDS.map((f) => f.key), 'kind', 'runtime'];
+export const SERVICE_RE = /^[a-z0-9_.-]{1,160}$/;
+export const NOTICE = [
+    'この内容は、開いた画面で確認してから送られます。送るまでどこにも出ていません。',
+    'URL の中身は KanseiLINK の通信の記録（Cloudflare）を通ります。秘密は入れないでください。',
+];
+export const NOTICE_EN = [
+    'Nothing is sent yet: the page opens with these fields filled, and only your click there sends them.',
+    'The URL passes through KanseiLINK\'s request logs (Cloudflare). Do not put secrets in it.',
+];
+// ── Secret shapes ──────────────────────────────────────────────────────────────
+// Ported from KanseiLINK `src/utils/secret-mask.ts` (kansei-link/kansei-internal @ f39362a,
+// file last changed in 5cdd578), copied 2026-10-30. Same TENANT_HOSTS list as the draft page
+// (public/agents/note/new.html, which is itself a port of secret-mask.ts). Keep in sync.
+//
+// Differences, because here a match BLOCKS instead of masking:
+//   - Added: IP addresses, local paths (C:\, /Users/, /home/), bare tenant hosts without a scheme.
+//   - Long base64-ish blobs from 32 chars (the mask uses 40), but only when the run mixes letters
+//     and digits — so long error codes like PERMISSION_DENIED_INSUFFICIENT_SCOPES pass.
+//   - Bearer/Basic/Token needs a digit in the value (or 20+ chars), so "token authentication"
+//     in prose passes; a real credential nearly always has one.
+//   - A URL is blocked only when its host is a tenant of a TENANT_HOSTS service; other URLs
+//     (public docs) pass.
+const TENANT_HOSTS = [
+    'slack.com', 'atlassian.net', 'kintone.com', 'cybozu.com', 'zendesk.com', 'freshdesk.com',
+    'myshopify.com', 'salesforce.com', 'my.salesforce.com', 'lightning.force.com', 'okta.com',
+    'auth0.com', 'hubspot.com', 'notion.site', 'sharepoint.com', 'onmicrosoft.com', 'zoom.us',
+    'monday.com', 'asana.com', 'intercom.io', 'chatwork.com', 'smarthr.jp', 'secure.freee.co.jp',
+    'backlog.com', 'backlog.jp', 'box.com', 'github.io', 'supabase.co', 'vercel.app', 'railway.app',
+    'herokuapp.com', 'workers.dev', 'pages.dev',
+];
+const GENERIC_LABELS = new Set(['www', 'api', 'app', 'docs', 'developer', 'developers', 'accounts', 'login', 'auth', 'secure', 'status', 'help', 'support', 'cdn', 'mail']);
+function tenantOf(host) {
+    const h = host.toLowerCase().replace(/:\d+$/, '').replace(/\.$/, '');
+    for (const base of TENANT_HOSTS) {
+        if (h.endsWith('.' + base) && h.length > base.length + 1) {
+            const first = h.slice(0, h.length - base.length - 1).split('.').pop() ?? '';
+            if (GENERIC_LABELS.has(first))
+                continue; // api.slack.com is the vendor, not a tenant
+            return base;
+        }
+    }
+    return null;
+}
+const has = (re) => (s) => { re.lastIndex = 0; return re.test(s); };
+const mixed = (t) => /[A-Za-z]/.test(t) && /\d/.test(t);
+const FINDERS = [
+    {
+        kind: 'BEARER', ja: '認証ヘッダーの値（Bearer／Basic／Token …）',
+        find: (s) => {
+            const re = /\b(?:Bearer|Basic|Token)\s+([A-Za-z0-9\-._~+/=]{8,})/gi;
+            for (const m of s.matchAll(re))
+                if (/\d/.test(m[1]) || m[1].length >= 20)
+                    return true;
+            return false;
+        },
+    },
+    {
+        kind: 'API_KEY', ja: 'API キー・トークンの形（sk-・ghp_・github_pat_・xox?-・AKIA・AIza など）',
+        find: has(/\b(?:sk-ant-[A-Za-z0-9\-_]{8,}|sk-[A-Za-z0-9\-_]{8,}|(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|xox[abprs]-[A-Za-z0-9\-]{8,}|(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{8,}|AKIA[A-Z0-9]{12,}|AIza[A-Za-z0-9\-_]{20,})/g),
+    },
+    {
+        kind: 'KV_SECRET', ja: '秘密の値の書き方（token=…・password: … など）',
+        find: has(/\b(access_token|refresh_token|id_token|api[_-]?key|apikey|client_secret|secret|password|passwd|token|signature|sig)(["']?\s*[=:]\s*)(?:"([^"\r\n]+)"|'([^'\r\n]+)'|[A-Za-z0-9\-._~+/%]{6,})/gi),
+    },
+    {
+        kind: 'JWT', ja: 'JWT の形（3 つの塊を . でつないだもの）',
+        find: has(/\b[A-Za-z0-9\-_]{10,}\.[A-Za-z0-9\-_]{10,}\.[A-Za-z0-9\-_]{10,}\b/g),
+    },
+    { kind: 'EMAIL', ja: 'メールアドレス', find: has(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g) },
+    {
+        kind: 'TENANT_URL', ja: '会社ごとの URL・ホスト名（acme.slack.com など）',
+        find: (s) => {
+            for (const m of s.matchAll(/(?:\b[a-z][a-z0-9+.-]*:\/\/)?((?:[a-z0-9-]+\.)+[a-z]{2,})(?::\d+)?/gi)) {
+                if (tenantOf(m[1]))
+                    return true;
+            }
+            return false;
+        },
+    },
+    {
+        kind: 'IP', ja: 'IP アドレス（localhost と書いてください）',
+        find: (s) => {
+            for (const m of s.matchAll(/(?<![\d.])(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})(?![\d.]*\d)/g)) {
+                if (m.slice(1, 5).every((o) => Number(o) <= 255))
+                    return true;
+            }
+            return has(/(?<![0-9a-f:])(?:(?:[0-9a-f]{1,4}:){7}[0-9a-f]{1,4}|(?:[0-9a-f]{1,4}:){1,6}:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4}|::1)(?![0-9a-f:])/gi)(s);
+        },
+    },
+    {
+        kind: 'LOCAL_PATH', ja: 'PC の中の道（C:\\・/Users/・/home/）',
+        find: has(/(?<![A-Za-z])[A-Za-z]:[\\/]|\/(?:Users|home)\/|\\Users\\/g),
+    },
+    { kind: 'UUID', ja: 'UUID（要求・テナントの id）', find: has(/\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi) },
+    { kind: 'HEX', ja: '長い 16 進の塊（32 字以上）', find: has(/\b[0-9a-f]{32,}\b/gi) },
+    {
+        kind: 'BLOB', ja: '長い base64 などの塊（32 字以上・英字と数字が混ざったもの）',
+        find: (s) => {
+            for (const m of s.matchAll(/[A-Za-z0-9+=_\-]{32,}/g))
+                if (mixed(m[0]))
+                    return true;
+            return false;
+        },
+    },
+];
+/** Which secret shapes a text contains (kinds, in check order). Empty = clean. */
+export function findSecretShapes(text) {
+    const out = [];
+    for (const f of FINDERS)
+        if (f.find(text))
+            out.push({ kind: f.kind, ja: f.ja });
+    return out;
+}
+/**
+ * Check the fields and build the draft URL. Pure: no I/O, no network, no DB.
+ * Returns problems (field + reason) instead of a URL when anything is off.
+ */
+export function buildShareDraft(input) {
+    const problems = [];
+    const args = (input && typeof input === 'object' && !Array.isArray(input)) ? input : {};
+    for (const k of Object.keys(args)) {
+        if (!ALLOWED_KEYS.includes(k)) {
+            problems.push({ field: k, reason: `この欄は受けません。使える欄: ${ALLOWED_KEYS.join(', ')}` });
+        }
+    }
+    const str = (k) => {
+        const v = args[k];
+        if (v === undefined || v === null)
+            return undefined;
+        if (typeof v !== 'string') {
+            problems.push({ field: k, reason: '文字列で渡してください' });
+            return undefined;
+        }
+        return v.trim();
+    };
+    const service = str('service');
+    if (!service)
+        problems.push({ field: 'service', reason: '必須です（KanseiLINK の service_id、例: freee, slack）' });
+    else if (!SERVICE_RE.test(service))
+        problems.push({ field: 'service', reason: '形が違います。小文字・数字・_ . - だけで 160 字まで（例: freee, google-drive）' });
+    const values = {};
+    for (const f of TEXT_FIELDS) {
+        const v = str(f.key);
+        if (!v) {
+            if (f.required)
+                problems.push({ field: f.key, reason: '必須です' });
+            continue;
+        }
+        if (v.length > f.max) {
+            problems.push({ field: f.key, reason: `長すぎます（${v.length} 字・上限 ${f.max} 字）` });
+            continue;
+        }
+        values[f.key] = v;
+    }
+    const kind = str('kind');
+    if (!kind)
+        problems.push({ field: 'kind', reason: `必須です: ${KINDS.join(' / ')}（実際に動かした／文書で読んだ／試していない推測）` });
+    else if (!KINDS.includes(kind))
+        problems.push({ field: 'kind', reason: `次のどれかにしてください: ${KINDS.join(' / ')}` });
+    const runtime = str('runtime');
+    if (runtime !== undefined && runtime !== '' && !RUNTIMES.includes(runtime)) {
+        problems.push({ field: 'runtime', reason: `次のどれかにしてください: ${RUNTIMES.join(' / ')}` });
+    }
+    // Secret shapes — every field, including service.
+    const scan = [['service', service], ...Object.entries(values)];
+    for (const [field, v] of scan) {
+        if (!v)
+            continue;
+        const hits = findSecretShapes(v);
+        if (hits.length) {
+            problems.push({
+                field,
+                reason: `秘密に見える形があります: ${hits.map((h) => h.ja).join('・')}。値は書かず、種類だけを書いてください（例: 「401 invalid_token」「テナントの URL」）`,
+                kinds: hits.map((h) => h.kind),
+            });
+        }
+    }
+    if (problems.length) {
+        return { ok: false, problems, hint: 'リンクは作っていません。上の欄を直して、もう一度呼んでください。' };
+    }
+    const q = new URLSearchParams();
+    q.set('service', service);
+    for (const f of TEXT_FIELDS)
+        if (values[f.key])
+            q.set(f.key, values[f.key]);
+    q.set('kind', kind);
+    if (runtime)
+        q.set('runtime', runtime);
+    const url = `${DRAFT_PAGE}?${q.toString()}`;
+    if (url.length > URL_MAX) {
+        const sizes = TEXT_FIELDS
+            .filter((f) => values[f.key])
+            .map((f) => ({ field: f.key, encoded: encodeURIComponent(values[f.key]).length }))
+            .sort((a, b) => b.encoded - a.encoded);
+        return {
+            ok: false,
+            problems: [{
+                    field: sizes[0]?.field ?? 'tried',
+                    reason: `リンクが長すぎます（${url.length} 字・上限 ${URL_MAX} 字）。短くしてください。日本語は 1 字が URL で 9 字になります。長い順: ${sizes.map((s) => `${s.field} ${s.encoded}`).join('・')}`,
+                }],
+            hint: 'リンクは作っていません。こちらでは欄を削りません。短くして、もう一度呼んでください。',
+        };
+    }
+    return { ok: true, url, length: url.length, notice: NOTICE, notice_en: NOTICE_EN };
+}
+//# sourceMappingURL=share-draft.js.map

package/dist/mcp/prompts.js

@@ -27,7 +27,7 @@ export const PROMPTS = [
     },
     {
         name: 'weekly-consolidation',
-        description: 'Sleep-mode summary of the past week\'s memories for an entity. Produces a single learning-layer entry that captures the trajectory. Use as input to the consolidate tool, or to write a Friday digest.',
+        description: 'Sleep-mode summary of the past week\'s memories for an entity. Produces a single learning-layer entry that captures the trajectory. Use as input when distilling learnings, or to write a Friday digest.',
         arguments: [
             { name: 'entity_name', description: 'The entity to consolidate.', required: true },
             { name: 'week_offset', description: 'Weeks-ago offset (0 = this week, 1 = last week). Default 0.', required: false },

package/dist/mcp/server.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 // linksee-memory MCP server (stdio transport).
-// Tools: remember / recall / read_smart / drift_status / check_decision / declare_anchor / resolve_drift / flag_proposals / dream / resolve_proposal
+// Tools: remember / recall / read_smart / drift_status / check_decision / declare_anchor / resolve_drift / flag_proposals / dream / resolve_proposal / share_draft
 // v0.10.0 — Re-injection layer: pre-action guard (PreToolUse/SessionStart hooks) + extraction
 //           quality gate + distillation routine (dream distill_queue) + harden/soften escalation
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ReadResourceRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
-import { openDb, runMigrations } from '../db/migrate.js';
+import { openDb, runMigrations, DbRefusedError } from '../db/migrate.js';
 import { computeHeat } from '../lib/heat-index.js';
 import { decideForgetting } from '../lib/forgetting.js';
 import { refreshMomentumForEntity } from '../lib/momentum.js';
-import { consolidate as runConsolidate } from '../lib/consolidate.js';
+import { consolidate as runConsolidate, autoConsolidateEnabled } from '../lib/consolidate.js';
 import { isPastedExternalContent } from '../lib/session-parser.js';
 import { inferAltitude, inferType, inferState } from '../lib/session-extractor.js';
 import { normalizeEntityName } from '../lib/normalize.js';
@@ -26,6 +26,7 @@ import { getReinjectionFriction, setGateMode } from '../lib/guard.js';
 import { logAnchorTouch } from '../lib/anchor-touch.js';
 import { triageDistillQueue, distillPending } from '../lib/distill-triage.js';
 import { whereAmI, listMapProjects } from '../lib/map-view.js';
+import { buildShareDraft, KINDS, RUNTIMES } from '../lib/share-draft.js';
 import { readFileSync, existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
@@ -62,6 +63,7 @@ const SUBCOMMANDS = {
     declare: 'declare-anchor.js',
     detect: 'detect-drift.js',
     export: 'export-report.js',
+    'share-draft': 'share-draft.js',
 };
 const subcommand = process.argv[2];
 if (subcommand && Object.prototype.hasOwnProperty.call(SUBCOMMANDS, subcommand)) {
@@ -70,8 +72,20 @@ if (subcommand && Object.prototype.hasOwnProperty.call(SUBCOMMANDS, subcommand))
     const r = spawnSync(process.execPath, [binPath, ...process.argv.slice(3)], { stdio: 'inherit' });
     process.exit(r.status ?? (r.signal ? 1 : 0));
 }
-const db = openDb();
-runMigrations(db);
+let db;
+try {
+    db = openDb();
+    runMigrations(db);
+}
+catch (e) {
+    // A pre-June-2026 DB (schema < 6) is refused before any write; print what to do
+    // instead of a stack trace. MCP clients show the server's stderr in their logs.
+    if (e instanceof DbRefusedError) {
+        process.stderr.write(`${e.message}\n`);
+        process.exit(1);
+    }
+    throw e;
+}
 // Distill triage runs on EVERY start, before the first request. It is one indexed scan and a
 // handful of JSON rewrites — cheap — and 0.16.0 had tucked it inside the auto-consolidate block
 // below, which runs at most once a week and only after a 3-second timer. So it never ran.
@@ -82,29 +96,37 @@ try {
     }
 }
 catch { /* never block startup */ }
-// Auto-maintenance: consolidate stale memories on startup (non-blocking)
-setTimeout(() => {
-    try {
-        let shouldRun = true;
+// Auto-maintenance: consolidate stale memories on startup (non-blocking).
+//
+// OFF by default since 0.17.1 (L-1-106 / audit F1): consolidate deletes the original rows after
+// writing a summary that keeps only the top 3 × 200 characters, ignores thread_id, and cascades
+// away their edges — reasons and history lost with no action from the user. It now runs only
+// when asked: LINKSEE_AUTO_CONSOLIDATE=1 (or `--auto-consolidate` on the server command line).
+// There is no `consolidate` tool (merged away in 0.7.0). Rows already removed by earlier versions
+// are not restored.
+if (autoConsolidateEnabled(process.env, process.argv.slice(2)))
+    setTimeout(() => {
         try {
-            // Check if consolidations table exists before querying
-            const tableExists = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='consolidations'").get();
-            if (tableExists) {
-                const lastRow = db.prepare('SELECT MAX(created_at) as ts FROM consolidations').get();
-                if (lastRow?.ts && (Date.now() / 1000 - lastRow.ts) / 86400 < 7)
-                    shouldRun = false;
+            let shouldRun = true;
+            try {
+                // Check if consolidations table exists before querying
+                const tableExists = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='consolidations'").get();
+                if (tableExists) {
+                    const lastRow = db.prepare('SELECT MAX(created_at) as ts FROM consolidations').get();
+                    if (lastRow?.ts && (Date.now() / 1000 - lastRow.ts) / 86400 < 7)
+                        shouldRun = false;
+                }
+            }
+            catch {
+                shouldRun = false; /* genuinely unexpected — skip to be safe */
+            }
+            if (shouldRun) {
+                runConsolidate(db, { scope: 'all', min_age_days: 7 });
+                process.stderr.write('[linksee-memory] auto-consolidate complete\n');
             }
         }
-        catch {
-            shouldRun = false; /* genuinely unexpected — skip to be safe */
-        }
-        if (shouldRun) {
-            runConsolidate(db, { scope: 'all', min_age_days: 7 });
-            process.stderr.write('[linksee-memory] auto-consolidate complete\n');
-        }
-    }
-    catch { /* non-fatal */ }
-}, 3000);
+        catch { /* non-fatal */ }
+    }, 3000);
 const server = new Server({ name: 'linksee-memory', version: SERVER_VERSION }, {
     capabilities: {
         tools: {},
@@ -388,6 +410,35 @@ const TOOLS = [
             required: ['candidate_id', 'verdict', 'rationale'],
         },
     },
+    // ── Share a fix (opt-in, link only) ──────────────────────
+    {
+        name: 'share_draft',
+        description: 'Make a LINK to a reviewed draft of a field note for other agents (KanseiLINK note page). ' +
+            'ONLY when the user says they want to share — never call it on your own.\n\n' +
+            'Use after a SaaS / MCP / API connection got stuck and was fixed (or was not). You write the fields; ' +
+            'this tool only checks them and builds the URL. Linksee sends nothing: the user opens the link, ' +
+            'reviews the filled form, and only their click on that page sends it.\n\n' +
+            'No values, only kinds: write "401 invalid_token", not the token. A field that looks like a key, ' +
+            'token, JWT, e-mail, tenant URL (acme.slack.com), IP, local path (C:\, /Users/, /home/) or a long ' +
+            'hex/base64 run stops the build and returns which field. The whole URL must fit in 2,000 characters ' +
+            '(a Japanese character takes 9) — if not, it asks you to shorten; it does not cut.\n\n' +
+            'Returns { url, notice } — show the user both. Linksee records only that a draft was made (no field text).',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                service: { type: 'string', description: 'KanseiLINK service_id, lowercase (e.g. freee, slack, google-drive). ^[a-z0-9_.-]{1,160}$' },
+                task: { type: 'string', maxLength: 300, description: 'What you were trying to do (≤300 chars)' },
+                symptom: { type: 'string', maxLength: 600, description: 'The KIND of error that came back — no values (≤600 chars)' },
+                tried: { type: 'string', maxLength: 2000, description: 'The steps you tried (≤2,000 chars)' },
+                result: { type: 'string', maxLength: 1000, description: 'How it was solved, or that it was not (≤1,000 chars)' },
+                conditions: { type: 'string', maxLength: 600, description: 'Optional. Tool + version, kind of environment (≤600 chars)' },
+                kind: { type: 'string', enum: [...KINDS], description: 'execution = you ran it · documentation = you read it · hypothesis = untested guess' },
+                runtime: { type: 'string', enum: [...RUNTIMES], description: 'Optional. Which AI wrote this' },
+            },
+            required: ['service', 'task', 'symptom', 'tried', 'result', 'kind'],
+            additionalProperties: false,
+        },
+    },
 ];
 // ============================================================
 // Handlers
@@ -2097,6 +2148,18 @@ const LEGACY_TOOLS = {
     dream: 'recall({ dream: true }) — recall() with no arguments already includes the counts',
     resolve_proposal: "resolve_drift({ candidate_id, action: 'surface' | 'dismiss', rationale })",
 };
+// share_draft: check fields + build the link. No network. Records only that a draft was made.
+function handleShareDraft(args) {
+    const r = buildShareDraft(args);
+    if (!r.ok)
+        return JSON.stringify(r, null, 2);
+    try {
+        // events row with no entity and no payload: the fact and the time, nothing from the fields.
+        db.prepare('INSERT INTO events (entity_id, kind, payload) VALUES (NULL, ?, NULL)').run('share_draft_created');
+    }
+    catch { /* the record must never break the tool */ }
+    return JSON.stringify(r, null, 2);
+}
 server.setRequestHandler(ListToolsRequestSchema, async () => {
     const showLegacy = process.env.LINKSEE_LEGACY_TOOLS === '1';
     const tools = TOOLS
@@ -2146,13 +2209,17 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
             case 'resolve_proposal':
                 text = handleResolveProposal(args);
                 break;
+            // Share a fix (link only)
+            case 'share_draft':
+                text = handleShareDraft(args);
+                break;
             default: {
                 const migrations = {
                     update_memory: 'remember({ memory_id: <id>, content: "...", importance: 0.8 })',
                     forget: 'remember({ forget: true, memory_id: <id> })',
                     list_entities: 'recall() with no params',
                     recall_file: 'recall({ path: "<file_path>" })',
-                    consolidate: 'Auto-runs on server startup. No manual call needed.',
+                    consolidate: 'No longer a tool, and since 0.17.1 it does not run on server start either (it deletes the original rows). Opt in on the server with LINKSEE_AUTO_CONSOLIDATE=1 if you want the old weekly start-up run.',
                 };
                 if (name in migrations) {
                     throw new Error(`Tool "${name}" was merged in v0.7.0. Migration: ${migrations[name]}`);

package/dist/skill/SKILL.md

@@ -372,26 +372,19 @@ Recording `prior_belief` leaves a **belief-update history**. Later, this becomes
 2. ❌ Solve an error on the spot without recording — future you (or another agent) will hit the same failure
 3. ❌ Use `Read` everywhere instead of `read_smart` (wastes tokens)
 4. ❌ Write caveats in a flippant tone — preserve them seriously
-5. ❌ Skip `consolidate` during long-running work — run it weekly
+5. ❌ Try to call a `consolidate` tool — there is none; consolidation is a server opt-in that deletes originals (see below)
 6. ❌ Recall the same entity twice in one session without new context (wastes tokens)
 7. ❌ Write `recall({ query: "what happened last time" })` — use specific keywords
 
 ---
 
-## 🔁 Consolidate — periodic memory tidy-up
+## 🔁 Consolidation — off unless the user turns it on
 
-When memory has grown (rough guideline: DB > 20MB, memories > 15,000):
+There is no `consolidate` tool. Consolidation clusters cold, low-importance memories older than 7 days into one `learning`-layer entry and **deletes the originals**, so since 0.17.1 it never runs on its own. The user can opt in by starting the server with `LINKSEE_AUTO_CONSOLIDATE=1` (then it runs at start-up, at most weekly).
 
-```
-mcp__linksee__consolidate({
-  scope: "session",
-  min_age_days: 7
-})
-```
-
-This clusters cold, low-importance memories older than 7 days → compresses them into a single `learning`-layer entry → deletes originals.
+Do not suggest turning it on as routine housekeeping. If the user asks about a large DB, explain the trade-off (originals are deleted) and suggest backing up `~/.linksee-memory/` first.
 
-**`caveat` memories and active `goal` memories are never consolidated away.** Equivalent to sleep-time memory reorganization.
+**`caveat` memories and active `goal` memories are never consolidated away.**
 
 ---
 
@@ -525,7 +518,6 @@ User: "That's it for today"
    })
 
 3. Report: "Recorded N decisions, M caveats. Retrievable via recall."
-4. Optionally suggest: consolidate({scope:"session", min_age_days: 14})
 ```
 
 ### Case F2 — Flag orphaned proposals at session end
@@ -725,7 +717,7 @@ Now you have both bodies of knowledge before starting
 | Day 1 | low (little data) | Stop hook is still collecting |
 | Week 1 | medium | thousands of memories, FTS5 kicks in |
 | Month 1 | high | heat_score stabilizes, important memories surface |
-| Month 3+ | strongest | consolidate has run, learnings crystallized |
+| Month 3+ | strongest | learnings crystallized (distilled) |
 
 **"Gets smarter with use"** — time is on your side. Today's record is read by tomorrow's you.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linksee-memory",
-  "version": "0.16.1",
+  "version": "0.17.1",
   "mcpName": "io.github.michielinksee/linksee-memory",
   "description": "Hand a project over — to your next session, to Cursor/Codex/Gemini, to your successor — with the reasons attached. Local-first memory MCP for coding agents: decisions re-injected before the agent acts, drift detection across every project you run. One SQLite file, nothing leaves your machine.",
   "type": "module",
@@ -15,7 +15,8 @@
     "linksee-memory-detect": "dist/bin/detect-drift.js",
     "linksee-memory-guard": "dist/bin/guard-hook.js",
     "linksee-memory-map": "dist/bin/map-import.js",
-    "linksee-memory-export": "dist/bin/export-report.js"
+    "linksee-memory-export": "dist/bin/export-report.js",
+    "linksee-memory-share-draft": "dist/bin/share-draft.js"
   },
   "main": "./dist/mcp/server.js",
   "files": [
@@ -72,7 +73,7 @@
   },
   "dependencies": {
     "@babel/parser": "^7.25.0",
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "better-sqlite3": "^12.9.0",
     "sqlite-vec": "^0.1.6",
     "yaml": "^2.9.0"