@profullstack/qryptchat 0.1.1 → 0.3.0

package/README.md

@@ -73,7 +73,12 @@ claude mcp add qryptchat -- qc mcp
 
 Over SSH, `qc login --oob` shows a code in the browser for you to paste instead of redirecting back.
 
-The session and keys are kept in `~/.config/qc/session.json` (or `$QC_HOME`), mode 0600. Sessions refresh themselves; `qc logout` deletes them. Point at another server with `--url` or `QC_URL`.
+Your keys and tokens are **never stored in plaintext**. `~/.config/qc/session.json` (or `$QC_HOME`) keeps only your username and the server URL in the clear. Everything else is sealed with ChaCha20-Poly1305 under a key from:
+
+- your OS keychain (macOS Keychain, or libsecret's `secret-tool` on a Linux desktop), so you're never asked; or
+- a passphrase, stretched with scrypt. qc asks for it once per run; scripts and `qc mcp` read it from `QC_PASSPHRASE`.
+
+Sessions refresh themselves and are re-sealed each time. `qc logout` deletes them. Point at another server with `--url` or `QC_URL`.
 
 ## Licence
 

package/dist/{chunk-12bbzs4r.js → chunk-4r99spcc.js}

@@ -2,9 +2,10 @@ import {
   sessionPath,
   baseUrl,
   loadSession,
-  saveSession,
+  unlockSession,
+  storeSession,
   clearSession
-} from "./chunk-fb6zrz6m.js";
+} from "./chunk-vfahhydf.js";
 
 // src/cli/crypto.js
 import { MlKem1024 as MlKem10242 } from "mlkem";
@@ -822,6 +823,81 @@ async function openKeyBlob(blob, ephemeral) {
   return { keys1024: keys.keys1024, keys768: keys.keys768 };
 }
 
+// src/lib/chat/reactions.js
+var REACTION_TYPE = "reaction";
+var MAX_EMOJI_LENGTH = 32;
+function reactionEnvelope(targetId, emoji, remove = false) {
+  return JSON.stringify({ v: 1, type: REACTION_TYPE, target: String(targetId), emoji: String(emoji), remove: !!remove });
+}
+function parseReaction(content) {
+  try {
+    const d = JSON.parse(content);
+    if (d?.type !== REACTION_TYPE || typeof d.target !== "string" || typeof d.emoji !== "string")
+      return null;
+    if (!d.emoji || d.emoji.length > MAX_EMOJI_LENGTH)
+      return null;
+    return { target: d.target, emoji: d.emoji, remove: !!d.remove };
+  } catch {
+    return null;
+  }
+}
+var senderName = (m) => m?.sender?.display_name || m?.sender?.username || "Someone";
+function snippet(m, max = 90) {
+  if (!m)
+    return "";
+  if (m.message_type === "file" || m.has_attachments)
+    return "\uD83D\uDCCE Attachment";
+  const text = String(m.content ?? "").replace(/\s+/g, " ").trim();
+  return text.length > max ? `${text.slice(0, max - 1)}…` : text;
+}
+function foldMessages(messages, myUserId) {
+  const visible = [];
+  const byId = new Map;
+  const picks = new Map;
+  for (const m of messages) {
+    if (m.message_type === REACTION_TYPE) {
+      const r = parseReaction(m.content);
+      if (!r)
+        continue;
+      const forTarget = picks.get(r.target) ?? new Map;
+      const current = forTarget.get(m.sender_id);
+      if (r.remove) {
+        if (current && current.emoji === r.emoji)
+          forTarget.delete(m.sender_id);
+      } else {
+        forTarget.set(m.sender_id, { emoji: r.emoji, name: senderName(m), at: m.created_at });
+      }
+      picks.set(r.target, forTarget);
+      continue;
+    }
+    visible.push(m);
+    byId.set(m.id, m);
+  }
+  return visible.map((m) => {
+    const out = { ...m, reactions: [] };
+    const forTarget = picks.get(m.id);
+    if (forTarget?.size) {
+      const groups = new Map;
+      for (const [senderId, p] of forTarget) {
+        const g = groups.get(p.emoji) ?? { emoji: p.emoji, count: 0, mine: false, names: [], first: p.at };
+        g.count += 1;
+        g.names.push(senderId === myUserId ? "You" : p.name);
+        if (senderId === myUserId)
+          g.mine = true;
+        if (p.at < g.first)
+          g.first = p.at;
+        groups.set(p.emoji, g);
+      }
+      out.reactions = [...groups.values()].sort((a, b) => b.count - a.count || String(a.first).localeCompare(String(b.first)));
+    }
+    if (m.reply_to_id) {
+      const target = byId.get(m.reply_to_id);
+      out.replyTo = target ? { id: target.id, name: target.sender_id === myUserId ? "You" : senderName(target), snippet: snippet(target), missing: false } : { id: m.reply_to_id, name: "", snippet: "Original message not loaded", missing: true };
+    }
+    return out;
+  });
+}
+
 // src/cli/api.js
 class QcError extends Error {
   constructor(message, status) {
@@ -835,7 +911,7 @@ class QcClient {
   constructor(session, options = {}) {
     this.session = session;
     this.base = baseUrl(session, options.env);
-    this.save = options.save ?? ((s) => saveSession(s, options.env));
+    this.save = options.save ?? (() => {});
     this.fetch = options.fetch ?? globalThis.fetch;
     this.ring = keyring(session.keys);
     this.refreshing = null;
@@ -889,34 +965,37 @@ class QcClient {
     const { conversations = [] } = await this.request("/api/conversations/load", { method: "POST", body: {} });
     return conversations.map((c) => ({ ...c, title: conversationTitle(c, this.me) }));
   }
-  async messages(conversationId, { limit = 100, before } = {}) {
+  async messages(conversationId, { limit = 200, before } = {}) {
     const { messages = [], hasMore = false } = await this.request("/api/messages/load", {
       method: "POST",
       body: { conversationId, limit, ...before ? { before } : {} }
     });
-    const out = [];
+    const raw = [];
     for (const m of messages) {
-      let text;
+      let content = m.encrypted_content ? await this.ring.decrypt(m.encrypted_content) : "";
       if (m.message_type === "file" || m.has_attachments) {
-        text = m.encrypted_content ? await this.ring.decrypt(m.encrypted_content) : "";
-        text = `\uD83D\uDCCE ${text && text !== "[File attachment]" ? `${text} ` : ""}(attachment: open qrypt.chat to download)`;
-      } else {
-        text = m.encrypted_content ? await this.ring.decrypt(m.encrypted_content) : "";
+        content = `\uD83D\uDCCE ${content && content !== "[File attachment]" ? `${content} ` : ""}(attachment: open qrypt.chat to download)`;
       }
-      out.push({
-        id: m.id,
-        conversationId: m.conversation_id,
-        senderId: m.sender_id,
-        sender: m.sender?.display_name || m.sender?.username || "unknown",
-        username: m.sender?.username || "",
-        mine: m.sender_id === this.me?.id,
-        text,
-        at: m.created_at
-      });
+      raw.push({ ...m, content });
     }
+    const out = foldMessages(raw, this.me?.id).map((m) => ({
+      id: m.id,
+      conversationId: m.conversation_id,
+      senderId: m.sender_id,
+      sender: m.sender?.display_name || m.sender?.username || "unknown",
+      username: m.sender?.username || "",
+      mine: m.sender_id === this.me?.id,
+      text: m.content,
+      at: m.created_at,
+      reactions: m.reactions.map(({ emoji, count, mine, names }) => ({ emoji, count, mine, names })),
+      ...m.replyTo ? { replyTo: m.replyTo } : {}
+    }));
     return { messages: out, hasMore };
   }
-  async send(conversationId, text) {
+  async react(conversationId, messageId, emoji, remove = false) {
+    return this.send(conversationId, reactionEnvelope(messageId, emoji, remove), { messageType: REACTION_TYPE });
+  }
+  async send(conversationId, text, { replyTo, messageType = "text" } = {}) {
     const { participants = [] } = await this.request(`/api/chat/conversations/${encodeURIComponent(conversationId)}/participants`);
     const userIds = participants.map((p) => p.user_id);
     if (!userIds.length)
@@ -935,7 +1014,7 @@ class QcClient {
       throw new QcError("No participant has a public key yet");
     const { message } = await this.request("/api/messages/send", {
       method: "POST",
-      body: { conversationId, encryptedContents, messageType: "text" }
+      body: { conversationId, encryptedContents, messageType, ...replyTo ? { replyToId: replyTo } : {} }
     });
     return { message, skipped: missing.length };
   }
@@ -1207,8 +1286,8 @@ async function login(options = {}) {
     keys,
     created_at: new Date().toISOString()
   };
-  saveSession(session, env);
-  return session;
+  const save = await storeSession(session, env, options.vault);
+  return { session, save };
 }
 
 // src/cli/commands.js
@@ -1221,12 +1300,14 @@ Usage:
   qc whoami               who this terminal is signed in as
   qc chats                list your chats
   qc read <chat> [-n 20]  print the last messages of a chat
-  qc send <chat> <text>   send a message (text "-" reads stdin)
+  qc send <chat> <text>   send a message (text "-" reads stdin; --reply <message-id> to reply)
+  qc react <chat> <message-id> <emoji> [--remove]   react to a message
   qc listen               print new messages as they arrive (NDJSON with --json)
   qc mcp                  run as an MCP server on stdio (list_chats, read_chat, send_message)
 
 <chat> is a chat id or part of its name. Options: --json, --url <server> (or QC_URL).
-Keys and session live in ${"$"}QC_HOME or ~/.config/qc (mode 0600).`;
+Keys and tokens are sealed (ChaCha20-Poly1305) in ${"$"}QC_HOME or ~/.config/qc; the key is in your
+OS keychain, or comes from a passphrase (QC_PASSPHRASE for scripts and qc mcp).`;
 function parseArgs2(argv) {
   const args = { _: [], flags: {} };
   for (let i = 0;i < argv.length; i++) {
@@ -1239,7 +1320,7 @@ function parseArgs2(argv) {
       const [k, v] = a.slice(2).split("=", 2);
       if (v !== undefined)
         args.flags[k] = v;
-      else if (["url", "n", "limit"].includes(k) && argv[i + 1] !== undefined)
+      else if (["url", "n", "limit", "reply"].includes(k) && argv[i + 1] !== undefined)
         args.flags[k] = argv[++i];
       else
         args.flags[k] = true;
@@ -1273,13 +1354,13 @@ function findChat2(chats, query) {
 async function client(flags, { interactive = false } = {}) {
   if (flags.url)
     process.env.QC_URL = flags.url;
-  let session = loadSession();
-  if (!session) {
+  let opened = await unlockSession();
+  if (!opened) {
     if (!interactive)
       throw new Error("Not signed in. Run qc login.");
-    session = await login({ oob: !!flags.oob });
+    opened = await login({ oob: !!flags.oob });
   }
-  return new QcClient(session);
+  return new QcClient(opened.session, { save: opened.save });
 }
 var stamp = (iso) => new Date(iso).toLocaleString(undefined, { dateStyle: "short", timeStyle: "short" });
 async function readStdin() {
@@ -1309,8 +1390,8 @@ async function main2(argv, { version = "0.0.0" } = {}) {
       return runTui(c, { initialChat: rest[0] });
     }
     case "login": {
-      const session = await login({ oob: !!flags.oob });
-      return out(`Signed in as @${session.user?.username ?? "unknown"} on ${session.base}. Keys saved to ${sessionPath()}.`);
+      const { session } = await login({ oob: !!flags.oob });
+      return out(`Signed in as @${session.user?.username ?? "unknown"} on ${session.base}. Keys sealed (ChaCha20-Poly1305) in ${sessionPath()}.`);
     }
     case "logout":
       clearSession();
@@ -1339,10 +1420,27 @@ async function main2(argv, { version = "0.0.0" } = {}) {
       const last = messages.slice(-Math.max(1, Number(flags.n || flags.limit || 20)));
       if (flags.json)
         return json(last);
-      for (const m of last)
-        out(`[${stamp(m.at)}] ${m.mine ? "you" : m.sender}: ${m.text}`);
+      for (const m of last) {
+        if (m.replyTo)
+          out(`    ┃ ${m.replyTo.name ? `${m.replyTo.name}: ` : ""}${m.replyTo.snippet}`);
+        const reactions = m.reactions?.length ? `  [${m.reactions.map((r) => `${r.emoji}${r.count > 1 ? r.count : ""}`).join(" ")}]` : "";
+        out(`[${stamp(m.at)}] ${m.mine ? "you" : m.sender}: ${m.text}${reactions}  (${m.id.slice(0, 8)})`);
+      }
       return;
     }
+    case "react": {
+      const [chatQuery, messageId, emoji] = rest;
+      if (!chatQuery || !messageId || !emoji)
+        throw new Error("Usage: qc react <chat> <message-id> <emoji> [--remove]");
+      const c = await client(flags);
+      const chat = findChat2(await c.conversations(), chatQuery);
+      const { messages } = await c.messages(chat.id);
+      const target = messages.filter((m) => m.id === messageId || m.id.startsWith(messageId));
+      if (target.length !== 1)
+        throw new Error(target.length ? `"${messageId}" matches ${target.length} messages` : `No message "${messageId}" in ${chat.title}`);
+      await c.react(chat.id, target[0].id, emoji, !!flags.remove);
+      return out(`${flags.remove ? "Removed" : "Reacted"} ${emoji} on ${chat.title}.`);
+    }
     case "send": {
       if (!rest[0] || rest.length < 2)
         throw new Error('Usage: qc send <chat> <text>   (text "-" reads stdin)');
@@ -1351,7 +1449,7 @@ async function main2(argv, { version = "0.0.0" } = {}) {
         throw new Error("Nothing to send.");
       const c = await client(flags);
       const chat = findChat2(await c.conversations(), rest[0]);
-      const { message, skipped } = await c.send(chat.id, text);
+      const { message, skipped } = await c.send(chat.id, text, { replyTo: flags.reply || undefined });
       if (flags.json)
         return json({ id: message?.id, conversation: chat.id, skipped });
       return out(`Sent to ${chat.title}${skipped ? ` (${skipped} participant(s) have no key yet)` : ""}.`);

package/dist/chunk-vfahhydf.js

@@ -0,0 +1,190 @@
+// src/cli/config.js
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// src/cli/vault.js
+import { randomBytes, scryptSync } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { createInterface } from "node:readline";
+import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
+var SERVICE = "qrypt-qc";
+var SCRYPT = { N: 1 << 16, r: 8, p: 1, maxmem: 256 * 1024 * 1024 };
+var SECRET_FIELDS = ["access_token", "refresh_token", "expires_at", "expires_in", "token_type", "keys"];
+var b64 = (u8) => Buffer.from(u8).toString("base64");
+var unb64 = (s) => Uint8Array.from(Buffer.from(s, "base64"));
+function deriveKey(passphrase, salt) {
+  return new Uint8Array(scryptSync(String(passphrase).normalize("NFKC"), Buffer.from(salt), 32, SCRYPT));
+}
+function seal(session, key, source) {
+  const secret = {};
+  const open = {};
+  for (const [k, v] of Object.entries(session))
+    (SECRET_FIELDS.includes(k) ? secret : open)[k] = v;
+  const nonce = Uint8Array.from(randomBytes(12));
+  const ct = chacha20poly1305(Uint8Array.from(key), nonce).encrypt(Uint8Array.from(Buffer.from(JSON.stringify(secret), "utf8")));
+  return { v: 2, ...open, sealed: { alg: "chacha20-poly1305", source: source.kind, ...source.salt ? { salt: source.salt } : {}, nonce: b64(nonce), ct: b64(ct) } };
+}
+function unseal(file, key) {
+  const { nonce, ct } = file.sealed;
+  let plain;
+  try {
+    plain = chacha20poly1305(Uint8Array.from(key), unb64(nonce)).decrypt(unb64(ct));
+  } catch {
+    throw new Error("Wrong passphrase, or the session was tampered with.");
+  }
+  const { v, sealed, ...open } = file;
+  return { ...open, ...JSON.parse(Buffer.from(plain).toString("utf8")) };
+}
+function run(cmd, args, input) {
+  try {
+    const r = spawnSync(cmd, args, { input, encoding: "utf8", timeout: 1e4 });
+    return r.status === 0 ? { ok: true, out: (r.stdout || "").trim() } : { ok: false };
+  } catch {
+    return { ok: false };
+  }
+}
+function keychain({ platform = process.platform, env = process.env } = {}) {
+  if (env.QC_NO_KEYCHAIN)
+    return null;
+  if (platform === "darwin") {
+    return {
+      get: (account) => {
+        const r = run("security", ["find-generic-password", "-s", SERVICE, "-a", account, "-w"]);
+        return r.ok && r.out ? r.out : null;
+      },
+      set: (account, secret) => run("security", ["add-generic-password", "-U", "-s", SERVICE, "-a", account, "-w", secret]).ok
+    };
+  }
+  if (platform === "linux" && (env.DBUS_SESSION_BUS_ADDRESS || env.DISPLAY || env.WAYLAND_DISPLAY) && run("secret-tool", ["--version"]).ok !== false) {
+    const probe = spawnSync("which", ["secret-tool"], { encoding: "utf8" });
+    if (probe.status !== 0)
+      return null;
+    return {
+      get: (account) => {
+        const r = run("secret-tool", ["lookup", "service", SERVICE, "account", account]);
+        return r.ok && r.out ? r.out : null;
+      },
+      set: (account, secret) => run("secret-tool", ["store", "--label", "qc (qrypt.chat) session key", "service", SERVICE, "account", account], secret).ok
+    };
+  }
+  return null;
+}
+function askHidden(question) {
+  return new Promise((resolve, reject) => {
+    if (!process.stdin.isTTY) {
+      reject(new Error("qc needs a passphrase to unlock your keys: set QC_PASSPHRASE, or run it on a terminal."));
+      return;
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
+    rl._writeToOutput = (s) => {
+      if (s.includes(question))
+        process.stderr.write(s);
+    };
+    rl.question(question, (answer) => {
+      rl.close();
+      process.stderr.write(`
+`);
+      resolve(answer);
+    });
+  });
+}
+async function dataKey(account, { existing, env = process.env, ask = askHidden, chain = keychain({ env }) } = {}) {
+  if (existing) {
+    if (existing.source === "keychain") {
+      const k = chain?.get(account);
+      if (!k)
+        throw new Error("Your session key is not in the keychain any more. Run qc login again.");
+      return { key: unb64(k), source: { kind: "keychain" } };
+    }
+    const pass = env.QC_PASSPHRASE ?? await ask("  Passphrase for your qc keys: ");
+    return { key: deriveKey(pass, existing.salt), source: { kind: "passphrase", salt: existing.salt } };
+  }
+  if (env.QC_PASSPHRASE) {
+    const salt = b64(randomBytes(16));
+    return { key: deriveKey(env.QC_PASSPHRASE, salt), source: { kind: "passphrase", salt } };
+  }
+  if (chain) {
+    const raw = randomBytes(32);
+    if (chain.set(account, b64(raw)))
+      return { key: new Uint8Array(raw), source: { kind: "keychain" } };
+  }
+  process.stderr.write(`
+  qc keeps your keys encrypted. Choose a passphrase (you will need it each time qc starts).
+`);
+  for (;; ) {
+    const a = await ask("  New passphrase: ");
+    if (a.length < 8) {
+      process.stderr.write(`  At least 8 characters, please.
+`);
+      continue;
+    }
+    const b = await ask("  Again: ");
+    if (a !== b) {
+      process.stderr.write(`  Those did not match.
+`);
+      continue;
+    }
+    const salt = b64(randomBytes(16));
+    return { key: deriveKey(a, salt), source: { kind: "passphrase", salt } };
+  }
+}
+
+// src/cli/config.js
+var DEFAULT_URL = "https://qrypt.chat";
+function configDir(env = process.env) {
+  if (env.QC_HOME)
+    return env.QC_HOME;
+  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "qc");
+}
+var sessionPath = (env = process.env) => join(configDir(env), "session.json");
+function baseUrl(session, env = process.env) {
+  return (env.QC_URL || session?.base || DEFAULT_URL).replace(/\/+$/, "");
+}
+function loadSession(env = process.env) {
+  try {
+    const file = JSON.parse(readFileSync(sessionPath(env), "utf8"));
+    if (file?.v === 2 && file.sealed && file.user)
+      return file;
+    return file && file.access_token && file.keys ? file : null;
+  } catch {
+    return null;
+  }
+}
+function writeFile(obj, env) {
+  const dir = configDir(env);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {}
+  const file = sessionPath(env);
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(obj, null, 2), { mode: 384 });
+  renameSync(tmp, file);
+}
+var accountOf = (session) => String(session.user?.id || session.user?.username || "default");
+async function unlockSession(env = process.env, opts = {}) {
+  const file = loadSession(env);
+  if (!file)
+    return null;
+  const existing = file.v === 2 ? file.sealed : undefined;
+  const { key, source } = await dataKey(accountOf(file), { existing, env, ...opts });
+  const session = file.v === 2 ? unseal(file, key) : file;
+  const save = (s) => writeFile(seal(s, key, source), env);
+  if (file.v !== 2)
+    save(session);
+  return { session, save };
+}
+async function storeSession(session, env = process.env, opts = {}) {
+  const { key, source } = await dataKey(accountOf(session), { env, ...opts });
+  const save = (s) => writeFile(seal(s, key, source), env);
+  save(session);
+  return save;
+}
+function clearSession(env = process.env) {
+  const file = sessionPath(env);
+  if (existsSync(file))
+    rmSync(file);
+}
+
+export { configDir, sessionPath, baseUrl, loadSession, unlockSession, storeSession, clearSession };

package/dist/commands.js

@@ -3,7 +3,8 @@ import {
   parseArgs2,
   findChat2,
   main2
-} from "./chunk-12bbzs4r.js";
+} from "./chunk-4r99spcc.js";
+import"./chunk-vfahhydf.js";
 export {
   HELP2 as HELP,
   findChat2 as findChat,

package/dist/mcp.js

@@ -1,6 +1,7 @@
+import"./chunk-vfahhydf.js";
 import {
   findChat2
-} from "./chunk-12bbzs4r.js";
+} from "./chunk-4r99spcc.js";
 
 // src/cli/mcp.js
 import { createInterface } from "node:readline";
@@ -30,11 +31,27 @@ var TOOLS = [
       type: "object",
       properties: {
         chat: { type: "string", description: "Conversation id or part of its name" },
-        text: { type: "string", description: "The message" }
+        text: { type: "string", description: "The message" },
+        reply_to: { type: "string", description: "Optional: id of the message this replies to (from read_chat)" }
       },
       required: ["chat", "text"],
       additionalProperties: false
     }
+  },
+  {
+    name: "react_to_message",
+    description: "React to a message with an emoji (Signal-style: one reaction per person; a new one replaces yours). End-to-end encrypted.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat: { type: "string", description: "Conversation id or part of its name" },
+        message_id: { type: "string", description: "The message id, from read_chat" },
+        emoji: { type: "string", description: "The emoji, e.g. ❤️" },
+        remove: { type: "boolean", description: "Withdraw this reaction instead" }
+      },
+      required: ["chat", "message_id", "emoji"],
+      additionalProperties: false
+    }
   }
 ];
 async function callTool(client, name, args = {}) {
@@ -46,15 +63,32 @@ async function callTool(client, name, args = {}) {
     const chat = findChat2(await client.conversations(), args.chat);
     const { messages } = await client.messages(chat.id, { limit: 100 });
     const limit = Math.min(100, Math.max(1, Number(args.limit) || 20));
-    return { chat: { id: chat.id, title: chat.title }, messages: messages.slice(-limit).map(({ sender, mine, text, at }) => ({ from: mine ? "me" : sender, text, at })) };
+    return {
+      chat: { id: chat.id, title: chat.title },
+      messages: messages.slice(-limit).map(({ id, sender, mine, text, at, reactions, replyTo }) => ({
+        id,
+        from: mine ? "me" : sender,
+        text,
+        at,
+        ...reactions?.length ? { reactions: reactions.map(({ emoji, count, mine: m }) => ({ emoji, count, mine: m })) } : {},
+        ...replyTo ? { reply_to: { id: replyTo.id, from: replyTo.name, text: replyTo.snippet } } : {}
+      }))
+    };
   }
   if (name === "send_message") {
     if (!args.text || typeof args.text !== "string")
       throw new Error("text is required");
     const chat = findChat2(await client.conversations(), args.chat);
-    const { message, skipped } = await client.send(chat.id, args.text);
+    const { message, skipped } = await client.send(chat.id, args.text, { replyTo: typeof args.reply_to === "string" ? args.reply_to : undefined });
     return { sent: true, id: message?.id, chat: chat.title, skipped };
   }
+  if (name === "react_to_message") {
+    if (!args.emoji || typeof args.emoji !== "string")
+      throw new Error("emoji is required");
+    const chat = findChat2(await client.conversations(), args.chat);
+    await client.react(chat.id, String(args.message_id), args.emoji, !!args.remove);
+    return { reacted: !args.remove, emoji: args.emoji, chat: chat.title };
+  }
   throw new Error(`Unknown tool ${name}`);
 }
 async function handle(client, msg, { version }) {

package/dist/tui.js

@@ -1,6 +1,6 @@
 import {
   configDir
-} from "./chunk-fb6zrz6m.js";
+} from "./chunk-vfahhydf.js";
 
 // src/cli/tui.js
 import { createApp, editText, emojify, insertText, stringWidth, truncate, widgets, wrap } from "@profullstack/hqtui";
@@ -61,11 +61,19 @@ function transcriptLines(messages, width, theme) {
         ]
       });
     }
+    if (m.replyTo) {
+      const who = m.replyTo.name ? `${m.replyTo.name}: ` : "";
+      lines.push({ text: truncate(`  ┃ ${who}${m.replyTo.snippet}`, width), fg: theme.muted });
+    }
     for (const part of String(m.text ?? "").split(`
 `)) {
       for (const line of wrap(part, Math.max(4, width - 2)))
         lines.push({ text: `  ${line}`, fg: theme.foreground });
     }
+    if (m.reactions?.length) {
+      const summary = m.reactions.map((r) => `${r.emoji}${r.count > 1 ? ` ${r.count}` : ""}`).join("  ");
+      lines.push({ text: truncate(`  ${summary}`, width), fg: m.reactions.some((r) => r.mine) ? theme.accent : theme.muted });
+    }
     last = m;
   }
   return lines;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/qryptchat",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "qc: qrypt.chat in your terminal. A full-screen end-to-end encrypted chat client (ML-KEM-1024), plus a scriptable CLI and an MCP server.",
   "type": "module",
   "bin": {

package/dist/chunk-fb6zrz6m.js

@@ -1,40 +0,0 @@
-// src/cli/config.js
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var DEFAULT_URL = "https://qrypt.chat";
-function configDir(env = process.env) {
-  if (env.QC_HOME)
-    return env.QC_HOME;
-  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "qc");
-}
-var sessionPath = (env = process.env) => join(configDir(env), "session.json");
-function baseUrl(session, env = process.env) {
-  return (env.QC_URL || session?.base || DEFAULT_URL).replace(/\/+$/, "");
-}
-function loadSession(env = process.env) {
-  try {
-    const session = JSON.parse(readFileSync(sessionPath(env), "utf8"));
-    return session && session.access_token && session.keys ? session : null;
-  } catch {
-    return null;
-  }
-}
-function saveSession(session, env = process.env) {
-  const dir = configDir(env);
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  try {
-    chmodSync(dir, 448);
-  } catch {}
-  const file = sessionPath(env);
-  const tmp = `${file}.${process.pid}.tmp`;
-  writeFileSync(tmp, JSON.stringify(session, null, 2), { mode: 384 });
-  renameSync(tmp, file);
-}
-function clearSession(env = process.env) {
-  const file = sessionPath(env);
-  if (existsSync(file))
-    rmSync(file);
-}
-
-export { configDir, sessionPath, baseUrl, loadSession, saveSession, clearSession };