@profullstack/qryptchat 0.12.0 → 0.14.0

package/README.md

@@ -49,6 +49,7 @@ The mouse works too: click a chat, scroll the transcript, click an emoji. Unread
 ```sh
 qc chats                        # id and name of every chat
 qc read alice -n 20             # the last 20 messages, decrypted
+qc dm @alice "hey, it's me"     # start (or reopen) a direct chat with anyone, by @username
 qc send alice "on my way"       # encrypted to every participant
 qc send ops "@ri deploy is done" # an @partial matching one person is sent as @riotcoder
 qc mentions ops @al             # who @al completes to: @alice, @alina

package/dist/{chunk-zh85gmtq.js → chunk-4mx8vtcw.js}

@@ -1,7 +1,7 @@
 import {
   openBrowser2,
   login2
-} from "./chunk-hmyhm26d.js";
+} from "./chunk-jfete02h.js";
 export {
   login2 as login,
   openBrowser2 as openBrowser

package/dist/{chunk-ycvwj8wy.js → chunk-amknn876.js}

@@ -1,7 +1,7 @@
 import {
   CALL_TYPE,
   parseCall
-} from "./chunk-hmyhm26d.js";
+} from "./chunk-jfete02h.js";
 
 // src/cli/voice-agent.js
 import { spawn } from "node:child_process";

package/dist/{chunk-hmyhm26d.js → chunk-jfete02h.js}

@@ -16,6 +16,13 @@ import {
   expandMentions
 } from "./chunk-4ea1xy2c.js";
 
+// src/cli/login.js
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { hostname } from "node:os";
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+
 // src/cli/crypto.js
 import { MlKem1024 as MlKem10242 } from "mlkem";
 
@@ -222,6 +229,17 @@ class PostQuantumEncryptionService {
       console.error("\uD83D\uDD10 Failed to load ML-KEM-768 keys:", error);
     }
   }
+  async storedUserKeys(alg) {
+    const is768 = alg === this.kemName768;
+    if (is768 ? !this.userKeys768 : !this.userKeys) {
+      await (is768 ? this.loadUserKeys768() : this.loadUserKeys());
+    }
+    const keys = is768 ? this.userKeys768 : this.userKeys;
+    if (!keys?.privateKey) {
+      throw new Error("No encryption keys on this device. Restore them in Settings > Keys (backup PIN).");
+    }
+    return keys;
+  }
   async getPublicKey() {
     const keys = await this.getUserKeys();
     return keys.publicKey;
@@ -346,7 +364,7 @@ class PostQuantumEncryptionService {
         return "[Legacy encrypted message - please delete]";
       }
       const open = async (alg) => {
-        const keys = alg === this.kemName768 ? await this.getUserKeys768() : await this.getUserKeys();
+        const keys = await this.storedUserKeys(alg);
         const privateKeyBytes = this.stripKeyHeaderIfPresent(Base64.decode(keys.privateKey));
         const expected = alg === this.kemName768 ? 2400 : 3168;
         if (privateKeyBytes.length !== expected) {
@@ -553,6 +571,188 @@ async function openKeyBlob(blob, ephemeral) {
   return { keys1024: keys.keys1024, keys768: keys.keys768 };
 }
 
+// src/lib/auth/cli-match.js
+var ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+async function matchCode(challenge, kemPublicKey) {
+  const bytes = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(`qc-login
+${challenge}
+${kemPublicKey}`)));
+  let out = "";
+  for (let i = 0;i < 8; i++)
+    out += ALPHABET[bytes[i] % ALPHABET.length];
+  return `${out.slice(0, 4)}-${out.slice(4)}`;
+}
+
+// src/cli/login.js
+var b64url = (buf) => Buffer.from(buf).toString("base64url");
+var TIMEOUT_MS = 5 * 60 * 1000;
+var PAGE = (title, body) => `<!doctype html><meta charset="utf-8"><title>${title}</title>
+<style>body{font:16px system-ui,sans-serif;display:grid;place-items:center;min-height:90vh;background:#0b0d12;color:#e6e8ee}main{max-width:28rem;text-align:center}</style>
+<main><h1>${title}</h1><p>${body}</p></main>`;
+function isRemote({ platform = process.platform, env = process.env } = {}) {
+  if (env.QC_NO_BROWSER)
+    return true;
+  if (platform === "darwin" || platform === "win32")
+    return false;
+  return !env.DISPLAY && !env.WAYLAND_DISPLAY;
+}
+function parsePasted(input, state) {
+  const text = String(input || "").trim();
+  if (!text)
+    return null;
+  if (/^https?:\/\//i.test(text)) {
+    let url;
+    try {
+      url = new URL(text);
+    } catch {
+      return null;
+    }
+    const got = url.searchParams.get("state");
+    if (got && got !== state)
+      throw new Error("That link belongs to a different login. Run qc login again.");
+    return url.searchParams.get("code");
+  }
+  return /^[A-Za-z0-9_-]{20,}$/.test(text) ? text : null;
+}
+function openBrowser2(url, { platform = process.platform, env = process.env } = {}) {
+  if (isRemote({ platform, env }))
+    return false;
+  const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function waitForCallback(server, state) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error("Timed out waiting for the browser (5 minutes). Run qc login again.")), TIMEOUT_MS);
+    server.on("request", (req, res) => {
+      const url = new URL(req.url, "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const done = (status, title, body) => {
+        res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" }).end(PAGE(title, body));
+      };
+      if (url.searchParams.get("state") !== state) {
+        done(400, "That was not this login", "The state did not match. Go back to your terminal.");
+        return;
+      }
+      clearTimeout(timer);
+      const error = url.searchParams.get("error");
+      if (error) {
+        done(200, "Not approved", "Nothing was shared. You can close this tab.");
+        reject(new Error(error === "access_denied" ? "Login was denied in the browser." : `Login failed: ${error}`));
+        return;
+      }
+      done(200, "Signed in", "You can close this tab and go back to your terminal.");
+      resolve(url.searchParams.get("code"));
+    });
+  });
+}
+async function login2(options = {}) {
+  const env = options.env ?? process.env;
+  const print = options.print ?? ((line) => process.stderr.write(`${line}
+`));
+  const base = (options.base ?? baseUrl(null, env)).replace(/\/+$/, "");
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash("sha256").update(verifier).digest());
+  const state = b64url(randomBytes(16));
+  const ephemeral = await ephemeralKeypair();
+  let server;
+  let redirectUri = "oob";
+  const oob = options.oob || isRemote({ env });
+  if (!oob) {
+    server = createServer();
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    redirectUri = `http://127.0.0.1:${server.address().port}/callback`;
+  }
+  const url = new URL("/cli/authorize", base);
+  for (const [k, v] of Object.entries({
+    response_type: "code",
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    redirect_uri: redirectUri,
+    state,
+    client_name: `qc on ${hostname()}`,
+    kem: ephemeral.publicKey
+  })) {
+    url.searchParams.set(k, v);
+  }
+  const match = await matchCode(challenge, ephemeral.publicKey);
+  print("");
+  print(`  Confirmation code: ${match}`);
+  print("  Check that the browser shows the same code before you approve.");
+  print("");
+  const opened = !oob && openBrowser2(url.toString(), { env });
+  print(opened ? "  Opened your browser. If it did not, open:" : "  Open this link in a browser where you are signed in to qrypt.chat:");
+  print(`  ${url.toString()}`);
+  print("");
+  let code;
+  let rl;
+  try {
+    if (server) {
+      const waits = [waitForCallback(server, state)];
+      if (process.stdin.isTTY) {
+        rl = createInterface({ input: process.stdin, output: process.stderr });
+        waits.push((async () => {
+          for (;; ) {
+            let line;
+            try {
+              line = await rl.question("  Waiting for the browser… or paste the URL it ended up on: ");
+            } catch {
+              return new Promise(() => {});
+            }
+            const pasted = parsePasted(line, state);
+            if (pasted)
+              return pasted;
+            print("  That is not a qc login code or callback URL.");
+          }
+        })());
+      }
+      code = await Promise.race(waits);
+    } else {
+      rl = createInterface({ input: process.stdin, output: process.stderr });
+      for (;; ) {
+        code = parsePasted(await rl.question("  Paste the code (or the URL) from the browser: "), state);
+        if (code)
+          break;
+        print("  That is not a qc login code.");
+      }
+    }
+  } finally {
+    rl?.close();
+    server?.close();
+  }
+  if (!code)
+    throw new Error("No code came back from the browser.");
+  const res = await fetch(`${base}/api/cli/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ grant_type: "authorization_code", code, code_verifier: verifier, redirect_uri: redirectUri })
+  });
+  const token = await res.json().catch(() => ({}));
+  if (!res.ok)
+    throw new Error(token.error_description || token.error || `Sign-in failed (HTTP ${res.status})`);
+  const keys = await openKeyBlob(token.key_blob, ephemeral);
+  const session = {
+    base,
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    expires_at: token.expires_at,
+    user: token.user,
+    keys,
+    created_at: new Date().toISOString()
+  };
+  const save = await storeSession(session, env, options.vault);
+  return { session, save };
+}
+
 // src/lib/chat/reactions.js
 var REACTION_TYPE = "reaction";
 var MAX_EMOJI_LENGTH = 32;
@@ -795,6 +995,24 @@ class QcClient {
     }));
     return { messages: out, hasMore };
   }
+  async searchUsers(query) {
+    const q = String(query ?? "").trim().replace(/^@/, "");
+    if (!q)
+      return [];
+    const { users = [] } = await this.request(`/api/users/search?q=${encodeURIComponent(q)}`);
+    return users;
+  }
+  async startDirect(who) {
+    const user = pickUser(await this.searchUsers(who), who);
+    const { conversation_id: id } = await this.request("/api/chat/conversations", {
+      method: "POST",
+      body: { type: "direct", participant_ids: [user.id] }
+    });
+    if (!id)
+      throw new QcError(`Could not start a chat with @${user.username}`);
+    const chat = (await this.conversations()).find((c) => c.id === id);
+    return chat ?? { id, title: user.display_name || user.username, participants: [] };
+  }
   async joinGroup(code) {
     return this.request("/api/conversations/join", { method: "POST", body: { code } });
   }
@@ -922,6 +1140,18 @@ function sleep(ms, signal) {
     });
   });
 }
+function pickUser(users, query) {
+  const q = String(query ?? "").trim().replace(/^@/, "").toLowerCase();
+  const exact = users.filter((u) => u.username?.toLowerCase() === q || u.unique_identifier?.toLowerCase() === q);
+  if (exact.length === 1)
+    return exact[0];
+  if (users.length === 1)
+    return users[0];
+  if (!users.length)
+    throw new QcError(`Nobody on qrypt.chat matches "${query}"`, 404);
+  const names = users.slice(0, 8).map((u) => `@${u.username}${u.display_name && u.display_name !== u.username ? ` (${u.display_name})` : ""}`);
+  throw new QcError(`"${query}" matches ${users.length} people: ${names.join(", ")}${users.length > 8 ? ", …" : ""}. Use their @username.`, 409);
+}
 function conversationTitle(c, me) {
   if (c.name)
     return c.name;
@@ -929,195 +1159,6 @@ function conversationTitle(c, me) {
   return others.length ? others.join(", ") : "Just you";
 }
 
-// src/cli/login.js
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { hostname } from "node:os";
-import { spawn } from "node:child_process";
-import { createInterface } from "node:readline/promises";
-
-// src/lib/auth/cli-match.js
-var ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-async function matchCode(challenge, kemPublicKey) {
-  const bytes = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(`qc-login
-${challenge}
-${kemPublicKey}`)));
-  let out = "";
-  for (let i = 0;i < 8; i++)
-    out += ALPHABET[bytes[i] % ALPHABET.length];
-  return `${out.slice(0, 4)}-${out.slice(4)}`;
-}
-
-// src/cli/login.js
-var b64url = (buf) => Buffer.from(buf).toString("base64url");
-var TIMEOUT_MS = 5 * 60 * 1000;
-var PAGE = (title, body) => `<!doctype html><meta charset="utf-8"><title>${title}</title>
-<style>body{font:16px system-ui,sans-serif;display:grid;place-items:center;min-height:90vh;background:#0b0d12;color:#e6e8ee}main{max-width:28rem;text-align:center}</style>
-<main><h1>${title}</h1><p>${body}</p></main>`;
-function isRemote({ platform = process.platform, env = process.env } = {}) {
-  if (env.QC_NO_BROWSER)
-    return true;
-  if (platform === "darwin" || platform === "win32")
-    return false;
-  return !env.DISPLAY && !env.WAYLAND_DISPLAY;
-}
-function parsePasted(input, state) {
-  const text = String(input || "").trim();
-  if (!text)
-    return null;
-  if (/^https?:\/\//i.test(text)) {
-    let url;
-    try {
-      url = new URL(text);
-    } catch {
-      return null;
-    }
-    const got = url.searchParams.get("state");
-    if (got && got !== state)
-      throw new Error("That link belongs to a different login. Run qc login again.");
-    return url.searchParams.get("code");
-  }
-  return /^[A-Za-z0-9_-]{20,}$/.test(text) ? text : null;
-}
-function openBrowser2(url, { platform = process.platform, env = process.env } = {}) {
-  if (isRemote({ platform, env }))
-    return false;
-  const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-  try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {});
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
-}
-function waitForCallback(server, state) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error("Timed out waiting for the browser (5 minutes). Run qc login again.")), TIMEOUT_MS);
-    server.on("request", (req, res) => {
-      const url = new URL(req.url, "http://127.0.0.1");
-      if (url.pathname !== "/callback") {
-        res.writeHead(404).end();
-        return;
-      }
-      const done = (status, title, body) => {
-        res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" }).end(PAGE(title, body));
-      };
-      if (url.searchParams.get("state") !== state) {
-        done(400, "That was not this login", "The state did not match. Go back to your terminal.");
-        return;
-      }
-      clearTimeout(timer);
-      const error = url.searchParams.get("error");
-      if (error) {
-        done(200, "Not approved", "Nothing was shared. You can close this tab.");
-        reject(new Error(error === "access_denied" ? "Login was denied in the browser." : `Login failed: ${error}`));
-        return;
-      }
-      done(200, "Signed in", "You can close this tab and go back to your terminal.");
-      resolve(url.searchParams.get("code"));
-    });
-  });
-}
-async function login2(options = {}) {
-  const env = options.env ?? process.env;
-  const print = options.print ?? ((line) => process.stderr.write(`${line}
-`));
-  const base = (options.base ?? baseUrl(null, env)).replace(/\/+$/, "");
-  const verifier = b64url(randomBytes(32));
-  const challenge = b64url(createHash("sha256").update(verifier).digest());
-  const state = b64url(randomBytes(16));
-  const ephemeral = await ephemeralKeypair();
-  let server;
-  let redirectUri = "oob";
-  const oob = options.oob || isRemote({ env });
-  if (!oob) {
-    server = createServer();
-    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-    redirectUri = `http://127.0.0.1:${server.address().port}/callback`;
-  }
-  const url = new URL("/cli/authorize", base);
-  for (const [k, v] of Object.entries({
-    response_type: "code",
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    redirect_uri: redirectUri,
-    state,
-    client_name: `qc on ${hostname()}`,
-    kem: ephemeral.publicKey
-  })) {
-    url.searchParams.set(k, v);
-  }
-  const match = await matchCode(challenge, ephemeral.publicKey);
-  print("");
-  print(`  Confirmation code: ${match}`);
-  print("  Check that the browser shows the same code before you approve.");
-  print("");
-  const opened = !oob && openBrowser2(url.toString(), { env });
-  print(opened ? "  Opened your browser. If it did not, open:" : "  Open this link in a browser where you are signed in to qrypt.chat:");
-  print(`  ${url.toString()}`);
-  print("");
-  let code;
-  let rl;
-  try {
-    if (server) {
-      const waits = [waitForCallback(server, state)];
-      if (process.stdin.isTTY) {
-        rl = createInterface({ input: process.stdin, output: process.stderr });
-        waits.push((async () => {
-          for (;; ) {
-            let line;
-            try {
-              line = await rl.question("  Waiting for the browser… or paste the URL it ended up on: ");
-            } catch {
-              return new Promise(() => {});
-            }
-            const pasted = parsePasted(line, state);
-            if (pasted)
-              return pasted;
-            print("  That is not a qc login code or callback URL.");
-          }
-        })());
-      }
-      code = await Promise.race(waits);
-    } else {
-      rl = createInterface({ input: process.stdin, output: process.stderr });
-      for (;; ) {
-        code = parsePasted(await rl.question("  Paste the code (or the URL) from the browser: "), state);
-        if (code)
-          break;
-        print("  That is not a qc login code.");
-      }
-    }
-  } finally {
-    rl?.close();
-    server?.close();
-  }
-  if (!code)
-    throw new Error("No code came back from the browser.");
-  const res = await fetch(`${base}/api/cli/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ grant_type: "authorization_code", code, code_verifier: verifier, redirect_uri: redirectUri })
-  });
-  const token = await res.json().catch(() => ({}));
-  if (!res.ok)
-    throw new Error(token.error_description || token.error || `Sign-in failed (HTTP ${res.status})`);
-  const keys = await openKeyBlob(token.key_blob, ephemeral);
-  const session = {
-    base,
-    access_token: token.access_token,
-    refresh_token: token.refresh_token,
-    expires_at: token.expires_at,
-    user: token.user,
-    keys,
-    created_at: new Date().toISOString()
-  };
-  const save = await storeSession(session, env, options.vault);
-  return { session, save };
-}
-
 // src/cli/agent.js
 import { randomBytes as randomBytes2 } from "node:crypto";
 function parseInvite(input) {
@@ -1271,7 +1312,7 @@ Usage:
   qc whoami               who this terminal is signed in as
   qc keys [publish]       whether this terminal's keys are your account's; publish makes them the
                           account's again (when another device published keys qc does not hold)
-  qc profile [--emoji \uD83D\uDD2D] [--pronouns she/her] [--website URL] [--bio TEXT]
+  qc profile [--name "Ada L"] [--emoji \uD83D\uDD2D] [--pronouns she/her] [--website URL] [--bio TEXT]
                           show or set your public profile (an empty value clears it);
                           --openprofile prints it as OpenProfile.md
   qc chats [--archived]   list your chats (archived ones only with --archived); qc list is the same
@@ -1285,10 +1326,12 @@ Usage:
   qc read <chat> [-n 20]  print the last messages of a chat
   qc send <chat> <text>   send a message (text "-" reads stdin; --reply <message-id> to reply);
                           an @partial that matches one person becomes their @username
+  qc dm <@user> [text]    start (or reopen) a direct chat with anyone on qrypt.chat and send
+                          text if given ("-" reads stdin); qc msg is the same. In the client: /msg @user
   qc mentions <chat> [@partial]   who @ completes to in a chat, best match first (one per line)
   qc react <chat> <message-id> <emoji> [--remove]   react to a message
   qc listen               print new messages as they arrive (NDJSON with --json; --notify alerts with it)
-  qc mcp                  run as an MCP server on stdio (list_chats, read_chat, send_message, list_mentions)
+  qc mcp                  run as an MCP server on stdio (list_chats, read_chat, send_message, start_direct_chat, list_mentions)
   qc join <link>          join a group chat from its invite link (https://qrypt.chat/join/...)
   qc invite <chat>        print a group's invite link (group admins) [--reset makes a new one, --off turns it off]
 
@@ -1388,7 +1431,7 @@ async function main2(argv, { version = "0.0.0" } = {}) {
     }
     case "agent": {
       if (rest[0] === "call") {
-        const { runVoiceAgent } = await import("./chunk-ycvwj8wy.js");
+        const { runVoiceAgent } = await import("./chunk-amknn876.js");
         return runVoiceAgent(await client(flags), {
           brain: typeof flags.brain === "string" ? flags.brain : undefined,
           voice: typeof flags.voice === "string" ? flags.voice : undefined,
@@ -1497,9 +1540,11 @@ ${ok("Installed OpenEmoji. Restart the terminal, then run: qc fonts status")}`);
       for (const k of ["emoji", "pronouns", "website", "bio"])
         if (flags[k] !== undefined)
           fields[k] = flags[k] === true ? "" : String(flags[k]);
+      if (flags.name !== undefined && flags.name !== true)
+        fields.displayName = String(flags.name);
       const p = Object.keys(fields).length ? await c.updateProfile(fields) : await c.profile();
       if (flags.json)
-        return json({ username: p.username, emoji: p.emoji ?? null, pronouns: p.pronouns ?? null, website: p.website ?? null, bio: p.bio ?? null });
+        return json({ username: p.username, displayName: p.displayName ?? p.display_name ?? null, emoji: p.emoji ?? null, pronouns: p.pronouns ?? null, website: p.website ?? null, bio: p.bio ?? null });
       out(who(p));
       if (p.website)
         out(`${mark("link")}${p.website}`);
@@ -1507,7 +1552,7 @@ ${ok("Installed OpenEmoji. Restart the terminal, then run: qc fonts status")}`);
         out(p.bio);
       if (!Object.keys(fields).length)
         out(`
-${info("Set: qc profile --emoji :telescope: --pronouns she/her --website https://you.example  (an empty value clears)")}`);
+${info('Set: qc profile --name "Ada L" --emoji :telescope: --pronouns she/her --website https://you.example  (an empty value clears)')}`);
       return;
     }
     case "chats":
@@ -1552,7 +1597,7 @@ ${info("Set: qc profile --emoji :telescope: --pronouns she/her --website https:/
         throw new Error('Usage: qc call <number>   (e.g. qc call "(415) 555-1234" or qc call +442079460958)');
       const c = await client(flags);
       const url = `${c.base}/phone?to=${encodeURIComponent(rest.join(" "))}`;
-      const { openBrowser } = await import("./chunk-zh85gmtq.js");
+      const { openBrowser } = await import("./chunk-4mx8vtcw.js");
       const opened = openBrowser(url);
       return out(`${mark("send")}${opened === false ? "Open" : "Opened"} ${url}
   Calls to phones need your browser for the audio; tap Call there.`);
@@ -1653,6 +1698,20 @@ ${info("Set: qc profile --emoji :telescope: --pronouns she/her --website https:/
         out(warn(`@${a.query} could be ${a.matches.join(", ")}: sent as typed.`));
       return out(`${mark("send")}Sent to ${chat.title}.`);
     }
+    case "dm":
+    case "msg": {
+      if (!rest[0])
+        throw new Error(`Usage: qc ${cmd} <@user> [text]   (a username, or a name only one person has)`);
+      const text = rest[1] === "-" && rest.length === 2 ? (await readStdin()).trim() : rest.slice(1).join(" ");
+      const c = await client(flags);
+      const chat = await c.startDirect(rest[0]);
+      const sent = text ? await c.send(chat.id, text) : null;
+      if (flags.json)
+        return json({ conversation: chat.id, title: chat.title, ...sent ? { id: sent.message?.id, skipped: sent.skipped } : {} });
+      if (sent?.skipped)
+        out(warn(`${chat.title} has no key yet and will not see it until they sign in.`));
+      return out(`${mark("send")}${sent ? `Sent to ${chat.title}` : `Chat with ${chat.title} is open (qc send "${chat.title}" <text>)`}.`);
+    }
     case "listen": {
       const c = await client(flags);
       const chats = await c.conversations();

package/dist/commands.js

@@ -7,7 +7,7 @@ import {
   mentionMatches2,
   withMentions2,
   main2
-} from "./chunk-hmyhm26d.js";
+} from "./chunk-jfete02h.js";
 import"./chunk-4ea1xy2c.js";
 export {
   HELP2 as HELP,

package/dist/mcp.js

@@ -3,7 +3,7 @@ import {
   findChat2,
   mentionMatches2,
   withMentions2
-} from "./chunk-hmyhm26d.js";
+} from "./chunk-jfete02h.js";
 
 // src/cli/mcp.js
 import { createInterface } from "node:readline";
@@ -40,6 +40,19 @@ var TOOLS = [
       additionalProperties: false
     }
   },
+  {
+    name: "start_direct_chat",
+    description: "Start (or reopen) an end-to-end encrypted direct chat with anyone on qrypt.chat, by @username or a name only one person has, and optionally send the first message. Returns the chat id for read_chat/send_message.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        user: { type: "string", description: "Their @username (or a name that matches only them)" },
+        text: { type: "string", description: "Optional: the first message" }
+      },
+      required: ["user"],
+      additionalProperties: false
+    }
+  },
   {
     name: "list_mentions",
     description: "Who an @mention can complete to in a conversation, best match first (like typing @ali then Tab). Without partial: everyone you can mention.",
@@ -98,6 +111,13 @@ async function callTool(client, name, args = {}) {
     const { message, skipped } = await client.send(chat.id, m.text, { replyTo: typeof args.reply_to === "string" ? args.reply_to : undefined });
     return { sent: true, id: message?.id, chat: chat.title, skipped, ...m.mentions.length ? { mentions: m.mentions } : {}, ...m.ambiguous.length ? { ambiguous: m.ambiguous } : {} };
   }
+  if (name === "start_direct_chat") {
+    if (!args.user || typeof args.user !== "string")
+      throw new Error("user is required");
+    const chat = await client.startDirect(args.user);
+    const sent = typeof args.text === "string" && args.text.trim() ? await client.send(chat.id, args.text.trim()) : null;
+    return { chat: chat.title, id: chat.id, ...sent ? { sent: true, message_id: sent.message?.id, skipped: sent.skipped } : {} };
+  }
   if (name === "list_mentions") {
     const chat = findChat2(await client.conversations(), args.chat);
     const matches = mentionMatches2(chat, client.me, typeof args.partial === "string" ? args.partial : "");

package/dist/tui.js

@@ -74,7 +74,12 @@ function chatsWithNews(prev, next) {
   const seen = new Map(prev.map((c) => [c.id, c.updated_at ?? ""]));
   return next.filter((c) => !seen.has(c.id) || (c.updated_at ?? "") > seen.get(c.id)).map((c) => c.id);
 }
-var SLASH_COMMANDS = ["voice", "archive", "unarchive", "archived", "names", "list"];
+var SLASH_COMMANDS = ["voice", "archive", "unarchive", "archived", "names", "list", "msg", "dm", "query", "new"];
+var NEW_CHAT_COMMANDS = ["msg", "dm", "query", "new"];
+function parseNewChat(args) {
+  const m = /^(\S+)(?:\s+([\s\S]*))?$/.exec(String(args ?? "").trim());
+  return m ? { who: m[1], text: (m[2] ?? "").trim() } : null;
+}
 var pad2 = (n) => String(n).padStart(2, "0");
 var timeOf = (iso) => {
   const d = new Date(iso);
@@ -132,7 +137,8 @@ function drawTranscript(surface, state) {
   const theme = surface.theme;
   const messages = state.messages[state.activeId] || [];
   if (!state.activeId) {
-    surface.text(1, 1, state.loading ? "Loading your chats…" : "Pick a chat on the left.", { fg: theme.muted });
+    const hint = state.loading ? "Loading your chats…" : state.conversations.length ? "Pick a chat on the left, or type /msg @name to start one." : "No chats yet. Type /msg @name to message someone.";
+    surface.text(1, 1, hint, { fg: theme.muted });
     return;
   }
   if (!messages.length) {
@@ -217,7 +223,7 @@ function render({ ui, width, height, theme }, state, on = {}) {
       p.textInput({
         value: state.field.value,
         cursor: state.field.cursor,
-        placeholder: active ? `Message ${active.title}  (@name Tab, Ctrl+E emoji, :rocket: works too)` : "Pick a chat first",
+        placeholder: active ? `Message ${active.title}  (@name Tab, Ctrl+E emoji, /msg @name for a new chat)` : "/msg @name to start a chat",
         focused: state.focus === "compose" && !state.picker,
         size: 1
       });
@@ -229,7 +235,7 @@ function render({ ui, width, height, theme }, state, on = {}) {
       { key: "Ctrl+E", label: "emoji" },
       { key: "Tab", label: state.focus === "list" ? "compose" : mention?.matches.length ? "complete @" : "chats" },
       { key: "PgUp", label: "scroll" },
-      ...state.focus === "list" ? [{ key: "a", label: state.showArchived ? "unarchive" : "archive" }] : [],
+      ...state.focus === "list" ? [{ key: "n", label: "new chat" }, { key: "a", label: state.showArchived ? "unarchive" : "archive" }] : [],
       { key: "Ctrl+O", label: state.showArchived ? "chats" : "archived" },
       { key: "Ctrl+C", label: "quit" }
     ],
@@ -381,13 +387,43 @@ async function runTui(client, { initialChat } = {}) {
       note(`Could not ${on ? "archive" : "unarchive"}: ${err.message}`);
     }
   }
+  function openById(id) {
+    const chat = state.conversations.find((c) => c.id === id);
+    if (!chat)
+      return;
+    state.showArchived = !!chat.is_archived;
+    openAt(listed(state).findIndex((c) => c.id === id));
+    state.focus = "compose";
+  }
+  async function startChat(args) {
+    const want = parseNewChat(args);
+    if (!want)
+      return note("Usage: /msg @name [message]  (a username, or a name only one person has)");
+    note(`Looking up ${want.who}…`, { sticky: true });
+    try {
+      const chat = await client.startDirect(want.who);
+      if (!state.conversations.some((c) => c.id === chat.id))
+        state.conversations = [chat, ...state.conversations];
+      openById(chat.id);
+      note(`Chat with ${chat.title} is open`);
+      if (want.text) {
+        state.field = { value: want.text, cursor: want.text.length };
+        await send({ text: true });
+      }
+    } catch (err) {
+      note(err.message, { sticky: err.status === 409 });
+    }
+    redraw();
+  }
   function runSlash(raw) {
     const cmd = parseSlashCommand(raw, SLASH_COMMANDS);
     if (!cmd)
       return false;
     const active = state.conversations.find((c) => c.id === state.activeId);
     state.field = { value: "", cursor: 0 };
-    if (cmd.name === "archived")
+    if (NEW_CHAT_COMMANDS.includes(cmd.name))
+      startChat(cmd.args);
+    else if (cmd.name === "archived")
       toggleArchivedView();
     else if (!active)
       note("Pick a chat first");
@@ -407,8 +443,8 @@ async function runTui(client, { initialChat } = {}) {
     redraw();
     return true;
   }
-  async function send({ raw = false } = {}) {
-    if (!raw && runSlash(state.field.value))
+  async function send({ raw = false, text: plain = false } = {}) {
+    if (!raw && !plain && runSlash(state.field.value))
       return;
     const text = raw ? state.field.value.trim() : emojify(state.field.value.trim(), { mode: "emoji" });
     if (!text || !state.activeId)
@@ -492,7 +528,10 @@ async function runTui(client, { initialChat } = {}) {
         state.selected = Math.min(listed(state).length - 1, state.selected + 1);
       else if (event.key === "enter" || event.key === "right" || event.key === "l")
         handlers.open(state.selected);
-      else if (event.key === "a") {
+      else if (event.key === "n") {
+        state.field = { value: "/msg @", cursor: 6 };
+        state.focus = "compose";
+      } else if (event.key === "a") {
         const c = listed(state)[state.selected];
         if (c)
           setArchived(c, !c.is_archived);
@@ -585,11 +624,13 @@ async function runTui(client, { initialChat } = {}) {
 }
 export {
   CHAT_LIST_REFRESH_MS,
+  NEW_CHAT_COMMANDS,
   SLASH_COMMANDS,
   chatsWithNews,
   initialState,
   listed,
   mentionSuggestions,
+  parseNewChat,
   render,
   runTui,
   tabComplete,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/qryptchat",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "qc: qrypt.chat in your terminal. A full-screen end-to-end encrypted chat client (ML-KEM-1024), plus a scriptable CLI and an MCP server.",
   "type": "module",
   "bin": {