feat: sharing tests, property tests, tag-share UI, inline errors, route fix

- Add 10 sharing endpoint tests (share/unshare memory, tag shares, shared-with-me,
  my-shares, recall with shared, update permission checks)
- Add hypothesis property-based tests for model validation (roundtrip, bounds,
  enum, sort_by, limit)
- Tighten model validation: sort_by Literal, limit ge=1/le=500, tags/keywords max_length
- Fix dashboard shared_with_me stat to include tag-based shares
- Add tag-sharing management UI (share/remove tags, user typeahead)
- Replace alert() with inline error messages
- Fix route ordering bug: share-tag routes before {memory_id} parameterized routes

src/claude_memory/api/app.py

@@ -454,7 +454,12 @@ async def get_stats(user: AuthUser = Depends(get_current_user)) -> dict[str, Any
             user.user_id,
         )
         shared_with_me = await conn.fetchval(
-            "SELECT COUNT(*) FROM memory_shares WHERE shared_with = $1",
+            """SELECT COUNT(DISTINCT m.id) FROM memories m
+               WHERE m.deleted_at IS NULL AND (
+                 EXISTS (SELECT 1 FROM memory_shares ms WHERE ms.memory_id = m.id AND ms.shared_with = $1)
+                 OR EXISTS (SELECT 1 FROM tag_shares ts WHERE ts.owner_id = m.user_id AND ts.shared_with = $1
+                   AND EXISTS (SELECT 1 FROM unnest(string_to_array(m.tags, ',')) t WHERE trim(t) = ts.tag))
+               )""",
             user.user_id,
         )
 
@@ -467,6 +472,41 @@ async def get_stats(user: AuthUser = Depends(get_current_user)) -> dict[str, Any
     }
 
 
+# NOTE: Literal-path routes (share-tag, shared-with-me, my-shares) must be
+# registered before parameterized routes ({memory_id}) to prevent FastAPI
+# from matching the literal segment as a path parameter.
+
+
+@app.post("/api/memories/share-tag")
+async def share_tag(body: ShareTag, user: AuthUser = Depends(get_current_user)) -> dict[str, Any]:
+    pool = await get_pool()
+    if body.shared_with == user.user_id:
+        raise HTTPException(status_code=400, detail="Cannot share with yourself")
+
+    async with pool.acquire() as conn:
+        await conn.execute(
+            """
+            INSERT INTO tag_shares (owner_id, tag, shared_with, permission)
+            VALUES ($1, $2, $3, $4)
+            ON CONFLICT (owner_id, tag, shared_with)
+            DO UPDATE SET permission = EXCLUDED.permission
+            """,
+            user.user_id, body.tag, body.shared_with, body.permission,
+        )
+    return {"shared_tag": body.tag, "with": body.shared_with, "permission": body.permission}
+
+
+@app.delete("/api/memories/share-tag")
+async def unshare_tag(body: UnshareTag, user: AuthUser = Depends(get_current_user)) -> dict[str, Any]:
+    pool = await get_pool()
+    async with pool.acquire() as conn:
+        await conn.execute(
+            "DELETE FROM tag_shares WHERE owner_id = $1 AND tag = $2 AND shared_with = $3",
+            user.user_id, body.tag, body.shared_with,
+        )
+    return {"unshared_tag": body.tag, "from": body.shared_with}
+
+
 @app.delete("/api/memories/{memory_id}")
 async def delete_memory(memory_id: int, user: AuthUser = Depends(get_current_user)) -> dict[str, Any]:
     pool = await get_pool()
@@ -665,36 +705,6 @@ async def unshare_memory(memory_id: int, target_user: str, user: AuthUser = Depe
     return {"unshared": memory_id, "from": target_user}
 
 
-@app.post("/api/memories/share-tag")
-async def share_tag(body: ShareTag, user: AuthUser = Depends(get_current_user)) -> dict[str, Any]:
-    pool = await get_pool()
-    if body.shared_with == user.user_id:
-        raise HTTPException(status_code=400, detail="Cannot share with yourself")
-
-    async with pool.acquire() as conn:
-        await conn.execute(
-            """
-            INSERT INTO tag_shares (owner_id, tag, shared_with, permission)
-            VALUES ($1, $2, $3, $4)
-            ON CONFLICT (owner_id, tag, shared_with)
-            DO UPDATE SET permission = EXCLUDED.permission
-            """,
-            user.user_id, body.tag, body.shared_with, body.permission,
-        )
-    return {"shared_tag": body.tag, "with": body.shared_with, "permission": body.permission}
-
-
-@app.delete("/api/memories/share-tag")
-async def unshare_tag(body: UnshareTag, user: AuthUser = Depends(get_current_user)) -> dict[str, Any]:
-    pool = await get_pool()
-    async with pool.acquire() as conn:
-        await conn.execute(
-            "DELETE FROM tag_shares WHERE owner_id = $1 AND tag = $2 AND shared_with = $3",
-            user.user_id, body.tag, body.shared_with,
-        )
-    return {"unshared_tag": body.tag, "from": body.shared_with}
-
-
 @app.get("/api/memories/shared-with-me")
 async def shared_with_me(user: AuthUser = Depends(get_current_user)) -> dict[str, Any]:
     pool = await get_pool()

src/claude_memory/api/models.py

@@ -9,8 +9,8 @@ MAX_MEMORY_CHARS = 800
 class MemoryStore(BaseModel):
     content: str = Field(..., max_length=MAX_MEMORY_CHARS)
     category: str = "facts"
-    tags: str = ""
-    expanded_keywords: str = ""
+    tags: str = Field(default="", max_length=500)
+    expanded_keywords: str = Field(default="", max_length=500)
     importance: float = Field(default=0.5, ge=0.0, le=1.0)
     force_sensitive: bool = False
 
@@ -19,8 +19,8 @@ class MemoryRecall(BaseModel):
     context: str
     expanded_query: str = ""
     category: Optional[str] = None
-    sort_by: str = "importance"
-    limit: int = 10
+    sort_by: Literal["importance", "relevance", "recency"] = "importance"
+    limit: int = Field(default=10, ge=1, le=500)
 
 
 class MemoryResponse(BaseModel):

src/claude_memory/ui/static/index.html

@@ -158,6 +158,11 @@
           </div>
         </div>
 
+        <!-- Error message -->
+        <template x-if="errorMsg">
+          <p class="text-sm mb-4" style="color: var(--danger)" x-text="errorMsg"></p>
+        </template>
+
         <!-- My Memories -->
         <div class="section-title">My Memories</div>
         <div class="space-y-2 mb-6">
@@ -325,6 +330,64 @@
             </div>
           </div>
         </template>
+
+        <!-- Tag Shares -->
+        <div class="mt-6">
+          <div class="flex items-center gap-3 mb-3">
+            <div class="section-title" style="margin-bottom:0">Tag Shares</div>
+            <button class="btn btn-ghost text-xs" @click="showTagShareForm = !showTagShareForm">
+              <span x-show="!showTagShareForm">+ Share Tag</span>
+              <span x-show="showTagShareForm">Cancel</span>
+            </button>
+          </div>
+
+          <!-- Tag Share Form -->
+          <div x-show="showTagShareForm" class="add-form-container mb-4">
+            <div class="grid grid-cols-1 md:grid-cols-3 gap-3 mb-3">
+              <div>
+                <label class="section-title">Tag</label>
+                <input type="text" class="input-field" x-model="tagShareForm.tag" placeholder="tag name">
+              </div>
+              <div class="relative">
+                <label class="section-title">User</label>
+                <input type="text" class="input-field" x-model="tagShareForm.user" placeholder="Username" @input="tagShareUserFilter = tagShareForm.user" @focus="tagShareUserFilter = tagShareForm.user">
+                <div x-show="tagShareForm.user && filteredTagShareUsers.length > 0" class="typeahead-dropdown">
+                  <template x-for="u in filteredTagShareUsers" :key="u">
+                    <div class="typeahead-item" @click="selectTagShareUser(u)" x-text="u"></div>
+                  </template>
+                </div>
+              </div>
+              <div>
+                <label class="section-title">Permission</label>
+                <select class="input-field" x-model="tagShareForm.permission">
+                  <option value="read">Read</option>
+                  <option value="write">Write</option>
+                </select>
+              </div>
+            </div>
+            <button class="btn btn-primary text-sm" @click="addTagShare()" :disabled="!tagShareForm.tag.trim() || !tagShareForm.user.trim()">Share Tag</button>
+          </div>
+
+          <!-- Existing Tag Shares -->
+          <template x-if="tagShares.length > 0">
+            <div class="space-y-2">
+              <template x-for="ts in tagShares" :key="ts.tag + ts.shared_with">
+                <div class="memory-card flex items-center justify-between">
+                  <div class="flex items-center gap-2">
+                    <span class="tag-pill" x-text="ts.tag"></span>
+                    <span class="text-sm" style="color: var(--text-secondary)">shared with</span>
+                    <span class="text-sm" style="color: var(--text-primary)" x-text="ts.shared_with"></span>
+                    <span class="badge" :class="ts.permission === 'write' ? 'badge-write' : 'badge-read'" x-text="ts.permission"></span>
+                  </div>
+                  <button class="btn text-xs" style="color: var(--danger)" @click="removeTagShare(ts.tag, ts.shared_with)">Remove</button>
+                </div>
+              </template>
+            </div>
+          </template>
+          <template x-if="tagShares.length === 0 && !showTagShareForm">
+            <p class="text-sm" style="color: var(--text-muted)">No tag shares yet</p>
+          </template>
+        </div>
       </div>
 
       <!-- Tab: Search -->

src/claude_memory/ui/static/js/api.js

@@ -63,8 +63,12 @@ const api = {
     return this.fetch(url, { method: 'PUT', body: JSON.stringify(data) });
   },
 
-  del(url) {
-    return this.fetch(url, { method: 'DELETE' });
+  del(url, data) {
+    const options = { method: 'DELETE' };
+    if (data) {
+      options.body = JSON.stringify(data);
+    }
+    return this.fetch(url, options);
   },
 
   async login(key) {

src/claude_memory/ui/static/js/memories.js

@@ -23,9 +23,15 @@ function memoriesBrowser() {
     showShareForm: null,
     shareForm: { user: '', permission: 'read' },
     shareUserFilter: '',
+    // Tag shares
+    tagShares: [],
+    showTagShareForm: false,
+    tagShareForm: { tag: '', user: '', permission: 'read' },
+    tagShareUserFilter: '',
+    errorMsg: '',
 
     async init() {
-      await Promise.all([this.loadMemories(), this.loadShared(), this.loadCategories(), this.loadUsers()]);
+      await Promise.all([this.loadMemories(), this.loadShared(), this.loadCategories(), this.loadUsers(), this.loadTagShares()]);
     },
 
     async loadCategories() {
@@ -100,6 +106,7 @@ function memoriesBrowser() {
     },
 
     async saveEdit(id) {
+      this.errorMsg = '';
       try {
         await api.put(`/api/memories/${id}`, {
           content: this.editForm.content,
@@ -110,7 +117,7 @@ function memoriesBrowser() {
         this.offset = 0;
         await this.loadMemories();
       } catch (e) {
-        alert('Save failed: ' + e.message);
+        this.errorMsg = 'Save failed: ' + e.message;
       }
     },
 
@@ -119,13 +126,14 @@ function memoriesBrowser() {
     },
 
     async doDelete(id) {
+      this.errorMsg = '';
       try {
         await api.del(`/api/memories/${id}`);
         this.deleteConfirm = null;
         this.offset = 0;
         await this.loadMemories();
       } catch (e) {
-        alert('Delete failed: ' + e.message);
+        this.errorMsg = 'Delete failed: ' + e.message;
       }
     },
 
@@ -153,6 +161,7 @@ function memoriesBrowser() {
 
     async addMemory() {
       if (!this.addForm.content.trim()) return;
+      this.errorMsg = '';
       try {
         await api.post('/api/memories', {
           content: this.addForm.content,
@@ -164,7 +173,7 @@ function memoriesBrowser() {
         this.offset = 0;
         await Promise.all([this.loadMemories(), this.loadCategories()]);
       } catch (e) {
-        alert('Failed to add memory: ' + e.message);
+        this.errorMsg = 'Failed to add memory: ' + e.message;
       }
     },
 
@@ -191,6 +200,7 @@ function memoriesBrowser() {
 
     async shareMemory(memId) {
       if (!this.shareForm.user.trim()) return;
+      this.errorMsg = '';
       try {
         await api.post(`/api/memories/${memId}/share`, {
           shared_with: this.shareForm.user,
@@ -203,7 +213,51 @@ function memoriesBrowser() {
           await this.toggleShares(memId);
         }
       } catch (e) {
-        alert('Share failed: ' + e.message);
+        this.errorMsg = 'Share failed: ' + e.message;
+      }
+    },
+
+    async loadTagShares() {
+      try {
+        const data = await api.get('/api/memories/my-shares');
+        this.tagShares = data.tag_shares || [];
+      } catch (e) { console.error('Failed to load tag shares:', e); }
+    },
+
+    get filteredTagShareUsers() {
+      const q = this.tagShareForm.user.toLowerCase();
+      if (!q) return this.allUsers.slice(0, 10);
+      return this.allUsers.filter(u => u.toLowerCase().includes(q));
+    },
+
+    selectTagShareUser(user) {
+      this.tagShareForm.user = user;
+    },
+
+    async addTagShare() {
+      if (!this.tagShareForm.tag.trim() || !this.tagShareForm.user.trim()) return;
+      this.errorMsg = '';
+      try {
+        await api.post('/api/memories/share-tag', {
+          tag: this.tagShareForm.tag,
+          shared_with: this.tagShareForm.user,
+          permission: this.tagShareForm.permission,
+        });
+        this.tagShareForm = { tag: '', user: '', permission: 'read' };
+        this.showTagShareForm = false;
+        await this.loadTagShares();
+      } catch (e) {
+        this.errorMsg = 'Failed to share tag: ' + e.message;
+      }
+    },
+
+    async removeTagShare(tag, sharedWith) {
+      this.errorMsg = '';
+      try {
+        await api.del('/api/memories/share-tag', { tag, shared_with: sharedWith });
+        await this.loadTagShares();
+      } catch (e) {
+        this.errorMsg = 'Failed to remove tag share: ' + e.message;
       }
     },