openmates 0.27.0-alpha.62 → 0.27.0-alpha.63

package/dist/{chunk-CFP7IA76.js → chunk-D6TL3ILK.js}

@@ -8,6 +8,7 @@ import {
   getCredentialStorageMode,
   installPrivacyModel,
   loadAnonymousId,
+  loadCachedDirectChatAccountKey,
   loadLocalTeamKey,
   loadSession,
   loadStoredSessionApiUrl,
@@ -25,6 +26,7 @@ import {
   readPrivacyPreferences,
   resolveStateDir,
   saveAnonymousId,
+  saveCachedDirectChatAccountKey,
   saveLocalTeamKey,
   saveSession,
   saveSyncCache,
@@ -34,7 +36,7 @@ import {
   verifyInstalledModel,
   verifyPrivacyRuntime,
   withSessionRefreshLock
-} from "./chunk-5SFXCJJ4.js";
+} from "./chunk-Q6PGA2B3.js";
 import {
   RemoteAccessReplayGuard,
   createRemoteAccessHandshake,
@@ -1634,6 +1636,183 @@ async function prepareCliMessagePrivacy(text7, memories, existing = [], scope2 =
 
 // src/client.ts
 import { createHash as createHash13, randomBytes as randomBytes4, randomUUID as randomUUID9, timingSafeEqual } from "crypto";
+
+// ../pairing-crypto/src/directChatCrypto.ts
+import nacl from "tweetnacl";
+var PREFIX = "OMDM1.";
+var MAX_ENVELOPE_LENGTH = 2048;
+var MAX_PAYLOAD_BYTES = 768;
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var KEY_ID = /^[0-9a-f]{64}$/;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+function ownedBuffer(bytes2) {
+  const copy = new Uint8Array(bytes2.length);
+  copy.set(bytes2);
+  return copy.buffer;
+}
+function directChatBase64Url(bytes2) {
+  let binary = "";
+  for (let offset = 0; offset < bytes2.length; offset += 8192) {
+    binary += String.fromCharCode(...bytes2.subarray(offset, offset + 8192));
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function directChatBase64UrlBytes(value, length, field3 = "key", maxLength = length ?? MAX_PAYLOAD_BYTES) {
+  if (typeof value !== "string" || value.length < 1 || value.length > Math.ceil(maxLength * 4 / 3) + 2 || !BASE64URL.test(value)) {
+    throw new Error(`Invalid direct-chat ${field3}`);
+  }
+  let decoded;
+  try {
+    const binary = atob(value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4));
+    decoded = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  } catch {
+    throw new Error(`Invalid direct-chat ${field3}`);
+  }
+  if (length !== void 0 && decoded.length !== length || decoded.length > maxLength || directChatBase64Url(decoded) !== value) throw new Error(`Invalid direct-chat ${field3}`);
+  return decoded;
+}
+function boundedIdentity(identity3) {
+  if (!identity3 || typeof identity3 !== "object") throw new Error("Invalid direct-chat identity");
+  for (const value of [identity3.teamId, identity3.chatId, identity3.recipientHash]) {
+    if (typeof value !== "string" || value.length < 1 || value.length > 128 || !/^[A-Za-z0-9_-]+$/.test(value)) {
+      throw new Error("Invalid direct-chat identity");
+    }
+  }
+  if (!KEY_ID.test(identity3.keyId)) throw new Error("Invalid direct-chat key ID");
+}
+function validNonzeroKey(value, field3) {
+  if (value.length !== 32 || value.every((byte) => byte === 0)) throw new Error(`Invalid direct-chat ${field3}`);
+}
+function validatePublicKey(value) {
+  const bytes2 = directChatBase64UrlBytes(value, 32, "public key");
+  validNonzeroKey(bytes2, "public key");
+  const probe = nacl.scalarMult(new Uint8Array(32).fill(7), bytes2);
+  if (probe.every((byte) => byte === 0)) throw new Error("Invalid direct-chat public key");
+  return bytes2;
+}
+async function directChatKeyId(publicKey) {
+  const bytes2 = validatePublicKey(publicKey);
+  const digest4 = new Uint8Array(await crypto.subtle.digest("SHA-256", ownedBuffer(bytes2)));
+  return [...digest4].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function generateIdentity() {
+  const pair = nacl.box.keyPair();
+  const publicKey = directChatBase64Url(pair.publicKey);
+  return { publicKey, privateKey: directChatBase64Url(pair.secretKey), keyId: await directChatKeyId(publicKey) };
+}
+async function sealDirectChatKey(rawKey, identity3, recipientPublicKey) {
+  boundedIdentity(identity3);
+  validNonzeroKey(rawKey, "chat key");
+  const recipient = validatePublicKey(recipientPublicKey);
+  if (identity3.keyId !== await directChatKeyId(recipientPublicKey)) throw new Error("Direct-chat recipient key ID mismatch");
+  const ephemeral = nacl.box.keyPair();
+  const nonce = nacl.randomBytes(24);
+  const payload = encoder.encode(JSON.stringify({
+    v: 1,
+    team_id: identity3.teamId,
+    chat_id: identity3.chatId,
+    recipient_hash: identity3.recipientHash,
+    key_id: identity3.keyId,
+    key: directChatBase64Url(rawKey)
+  }));
+  const ciphertext = nacl.box(payload, nonce, recipient, ephemeral.secretKey);
+  const envelope = PREFIX + directChatBase64Url(encoder.encode(JSON.stringify({
+    v: 1,
+    ephemeral_public_key: directChatBase64Url(ephemeral.publicKey),
+    nonce: directChatBase64Url(nonce),
+    ciphertext: directChatBase64Url(ciphertext)
+  })));
+  ephemeral.secretKey.fill(0);
+  if (envelope.length > MAX_ENVELOPE_LENGTH) throw new Error("Direct-chat envelope too large");
+  return envelope;
+}
+async function openDirectChatKey(envelope, expected, privateKey) {
+  boundedIdentity(expected);
+  if (typeof envelope !== "string" || !envelope.startsWith(PREFIX) || envelope.length > MAX_ENVELOPE_LENGTH) {
+    throw new Error("Invalid direct-chat envelope");
+  }
+  const encoded = envelope.slice(PREFIX.length);
+  const decoded = directChatBase64UrlBytes(encoded, void 0, "envelope");
+  if (decoded.length > MAX_PAYLOAD_BYTES) throw new Error("Direct-chat envelope too large");
+  let parsed;
+  try {
+    parsed = JSON.parse(decoder.decode(decoded));
+  } catch {
+    throw new Error("Invalid direct-chat envelope");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid direct-chat envelope");
+  const outer = parsed;
+  if (Object.keys(outer).sort().join(",") !== "ciphertext,ephemeral_public_key,nonce,v" || outer.v !== 1) {
+    throw new Error("Invalid direct-chat envelope version or fields");
+  }
+  const sender = validatePublicKey(String(outer.ephemeral_public_key));
+  const nonce = directChatBase64UrlBytes(String(outer.nonce), 24, "nonce");
+  const ciphertext = directChatBase64UrlBytes(String(outer.ciphertext), void 0, "ciphertext", 512);
+  if (ciphertext.length < 17) throw new Error("Invalid direct-chat ciphertext");
+  const secret = directChatBase64UrlBytes(privateKey, 32, "private key");
+  validNonzeroKey(secret, "private key");
+  const ownPublic = directChatBase64Url(nacl.scalarMult.base(secret));
+  if (await directChatKeyId(ownPublic) !== expected.keyId) throw new Error("Direct-chat private key ID mismatch");
+  const plaintext = nacl.box.open(ciphertext, nonce, sender, secret);
+  if (!plaintext) throw new Error("Direct-chat key authentication failed");
+  let inner;
+  try {
+    inner = JSON.parse(decoder.decode(plaintext));
+  } catch {
+    throw new Error("Invalid direct-chat key payload");
+  }
+  if (!inner || typeof inner !== "object" || Array.isArray(inner)) throw new Error("Invalid direct-chat key payload");
+  const payload = inner;
+  if (Object.keys(payload).sort().join(",") !== "chat_id,key,key_id,recipient_hash,team_id,v" || payload.v !== 1 || payload.team_id !== expected.teamId || payload.chat_id !== expected.chatId || payload.recipient_hash !== expected.recipientHash || payload.key_id !== expected.keyId) {
+    throw new Error("Direct-chat key binding mismatch");
+  }
+  const key = directChatBase64UrlBytes(String(payload.key), 32, "chat key");
+  validNonzeroKey(key, "chat key");
+  return key;
+}
+
+// src/directChats.ts
+function validatePublicChatEncryptionKey(value) {
+  const row3 = value;
+  if (!row3 || typeof row3.public_key !== "string" || typeof row3.key_id !== "string" || !/^[0-9a-f]{64}$/.test(row3.key_id)) {
+    throw new Error("Invalid member chat encryption key");
+  }
+  directChatBase64UrlBytes(row3.public_key, 32, "public key");
+  return { key_id: row3.key_id, public_key: row3.public_key };
+}
+async function validatePublicChatEncryptionKeyId(value) {
+  const key = validatePublicChatEncryptionKey(value);
+  if (await directChatKeyId(key.public_key) !== key.key_id) throw new Error("Member chat encryption key ID mismatch");
+  return key;
+}
+async function recoverAccountChatIdentity(record10, masterKey) {
+  if (record10.version !== 1 || record10.algorithm !== "x25519-xsalsa20poly1305") throw new Error("Unsupported account chat encryption key");
+  const publicKey = await validatePublicChatEncryptionKeyId(record10);
+  if (typeof record10.encrypted_private_key !== "string" || record10.encrypted_private_key.length > 2048) throw new Error("Invalid account chat private key backup");
+  const encoded = record10.encrypted_private_key;
+  if (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(encoded)) throw new Error("Invalid account chat private key backup");
+  const privateKey = await decryptWithAesGcmCombined(Buffer.from(encoded, "base64url").toString("base64"), masterKey);
+  if (!privateKey) throw new Error("Could not decrypt account chat private key");
+  const secret = directChatBase64UrlBytes(privateKey, 32, "private key");
+  if (secret.every((byte) => byte === 0)) throw new Error("Invalid account chat private key");
+  const nacl2 = (await import("tweetnacl")).default;
+  if (directChatBase64Url(nacl2.scalarMult.base(secret)) !== publicKey.public_key) throw new Error("Account chat key pair mismatch");
+  return { publicKey: publicKey.public_key, privateKey, keyId: publicKey.key_id };
+}
+async function createAccountChatIdentity(masterKey) {
+  const identity3 = await generateIdentity();
+  const backup = await encryptWithAesGcmCombined(identity3.privateKey, masterKey);
+  return { identity: identity3, record: {
+    version: 1,
+    algorithm: "x25519-xsalsa20poly1305",
+    key_id: identity3.keyId,
+    public_key: identity3.publicKey,
+    encrypted_private_key: Buffer.from(backup, "base64").toString("base64url")
+  } };
+}
+
+// src/client.ts
 import { arch, platform, release } from "os";
 import { createInterface as createInterface3 } from "readline/promises";
 import { stdin as stdin2, stdout } from "process";
@@ -2475,13 +2654,13 @@ var OpenMatesHttpClient = class {
       throw new Error("SSE response body is not readable");
     }
     const reader = response.body.getReader();
-    const decoder2 = new TextDecoder();
+    const decoder3 = new TextDecoder();
     let buffer = "";
     try {
       while (true) {
         const { done, value } = await reader.read();
         if (done) break;
-        buffer += decoder2.decode(value, { stream: true });
+        buffer += decoder3.decode(value, { stream: true });
         let separatorIndex = buffer.indexOf("\n\n");
         while (separatorIndex >= 0) {
           const rawEvent = buffer.slice(0, separatorIndex);
@@ -2701,12 +2880,12 @@ import { randomUUID as randomUUID3 } from "crypto";
 
 // ../ui/src/utils/projectIgnoredReadGrant.ts
 var GRANT_LIFETIME_MS = 5 * 60 * 1e3;
-var encoder = new TextEncoder();
+var encoder2 = new TextEncoder();
 function validScope(scope2) {
   return [scope2.projectId, scope2.sourceId, scope2.requestId, scope2.chatId, scope2.operationId].every((value) => typeof value === "string" && value.length > 0 && value.length <= 128) && typeof scope2.path === "string" && scope2.path.length > 0 && scope2.path.length <= 4096 && !scope2.path.includes("\\") && !scope2.path.startsWith("/") && !/^[a-z]:/i.test(scope2.path) && !Array.from(scope2.path).some((value) => value.charCodeAt(0) < 32 || value.charCodeAt(0) === 127) && scope2.path.split("/").every((part) => part && part !== "." && part !== "..");
 }
 function material(grant) {
-  return encoder.encode(JSON.stringify([
+  return encoder2.encode(JSON.stringify([
     "openmates-ignored-read-v1",
     grant.projectId,
     grant.sourceId,
@@ -9984,13 +10163,13 @@ import { client, ready, server } from "@serenity-kit/opaque";
 var PAIR_PIN_ALPHABET = "ABCDEFGHJKLMNPQRTUVWXY3468";
 var PIN_LENGTH = 6;
 var KSF = { "argon2id-custom": { memory: 8192, iterations: 3, parallelism: 1 } };
-var encoder2 = new TextEncoder();
-var decoder = new TextDecoder("utf-8", { fatal: true });
-var BUNDLE_INFO = encoder2.encode("openmates-pair-v2/bundle");
-var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var encoder3 = new TextEncoder();
+var decoder2 = new TextDecoder("utf-8", { fatal: true });
+var BUNDLE_INFO = encoder3.encode("openmates-pair-v2/bundle");
+var BASE64URL2 = /^[A-Za-z0-9_-]+$/;
 var HEX_256 = /^[0-9a-f]{64}$/;
 var BUNDLE_KEYS = /* @__PURE__ */ new Set(["protocol_version", "master_key_exported", "grant_secret", "user_email_salt", "hashed_email", "user_id", "account_context"]);
-function ownedBuffer(bytes2) {
+function ownedBuffer2(bytes2) {
   return bytes2;
 }
 function requireAscii(value, name, max = 128) {
@@ -10030,7 +10209,7 @@ function validateContext(context) {
     auto_logout_minutes: parsed[6]
   };
   if (createPairContext(fields) !== context) throw new Error("Noncanonical pairing context");
-  return { text: context, bytes: encoder2.encode(context), fields };
+  return { text: context, bytes: encoder3.encode(context), fields };
 }
 function identifiers(context) {
   return { client: `openmates-pair-v2/client/${context}`, server: `openmates-pair-v2/server/${context}` };
@@ -10046,7 +10225,7 @@ function base64url(bytes2) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 function decodeBase64url(value, maxBytes) {
-  if (typeof value !== "string" || value.length < 1 || value.length > Math.ceil(maxBytes * 4 / 3) + 2 || !BASE64URL.test(value)) {
+  if (typeof value !== "string" || value.length < 1 || value.length > Math.ceil(maxBytes * 4 / 3) + 2 || !BASE64URL2.test(value)) {
     throw new Error("Invalid pairing encoding");
   }
   let bytes2;
@@ -10073,7 +10252,7 @@ async function hashPairSecret(secret) {
   const bytes2 = decodeBase64url(secret, 32);
   if (bytes2.length !== 32) throw new Error("Invalid pairing secret");
   try {
-    const digest4 = new Uint8Array(await crypto.subtle.digest("SHA-256", ownedBuffer(bytes2)));
+    const digest4 = new Uint8Array(await crypto.subtle.digest("SHA-256", ownedBuffer2(bytes2)));
     return [...digest4].map((byte) => byte.toString(16).padStart(2, "0")).join("");
   } finally {
     bytes2.fill(0);
@@ -10089,10 +10268,10 @@ async function deriveBundleKey(sessionKey, contextBytes) {
   const raw = decodeBase64url(sessionKey, 64);
   if (raw.length !== 64) throw new Error("Invalid pairing session key");
   try {
-    const salt = await crypto.subtle.digest("SHA-256", ownedBuffer(contextBytes));
-    const ikm = await crypto.subtle.importKey("raw", ownedBuffer(raw), "HKDF", false, ["deriveKey"]);
+    const salt = await crypto.subtle.digest("SHA-256", ownedBuffer2(contextBytes));
+    const ikm = await crypto.subtle.importKey("raw", ownedBuffer2(raw), "HKDF", false, ["deriveKey"]);
     return crypto.subtle.deriveKey(
-      { name: "HKDF", hash: "SHA-256", salt, info: ownedBuffer(BUNDLE_INFO) },
+      { name: "HKDF", hash: "SHA-256", salt, info: ownedBuffer2(BUNDLE_INFO) },
       ikm,
       { name: "AES-GCM", length: 256 },
       false,
@@ -10168,13 +10347,13 @@ async function createPairReceiver(context, pin) {
         if (nonce.length !== 12) throw new Error("Invalid pairing IV");
         const ciphertext = decodeBase64url(encryptedBundle, 65536);
         const plaintext = new Uint8Array(await crypto.subtle.decrypt(
-          { name: "AES-GCM", iv: ownedBuffer(nonce), additionalData: ownedBuffer(binding.bytes), tagLength: 128 },
+          { name: "AES-GCM", iv: ownedBuffer2(nonce), additionalData: ownedBuffer2(binding.bytes), tagLength: 128 },
           key,
-          ownedBuffer(ciphertext)
+          ownedBuffer2(ciphertext)
         ));
         try {
           assertActive();
-          return validateBundle(JSON.parse(decoder.decode(plaintext)), binding.fields.authorizer_user_id);
+          return validateBundle(JSON.parse(decoder2.decode(plaintext)), binding.fields.authorizer_user_id);
         } finally {
           nonce.fill(0);
           ciphertext.fill(0);
@@ -11366,6 +11545,8 @@ var OpenMatesClient = class _OpenMatesClient {
   session;
   http;
   explicitSession;
+  directChatIdentity;
+  directChatUserHash;
   constructor(options = {}) {
     this.explicitSession = options.session !== void 0;
     const diskSession = options.session ?? (options.loadStoredSession === false ? null : this.getValidSessionFromDisk());
@@ -11631,6 +11812,8 @@ var OpenMatesClient = class _OpenMatesClient {
     if (!response.ok) throw new Error(`Team list failed with HTTP ${response.status}`);
     if (!owner2.isCurrent()) throw new Error("Account changed while loading Teams.");
     const teams = response.data.teams ?? [];
+    if (teams.length) await this.ensureDirectChatIdentity();
+    if (!owner2.isCurrent()) throw new Error("Account changed while loading Teams.");
     await Promise.all(teams.map((team) => this.cacheTeamKeyFromRecord(team, owner2.isCurrent)));
     if (!owner2.isCurrent()) throw new Error("Account changed while loading Teams.");
     const teamIds = teams.map((team) => team.team_id).filter((teamId) => typeof teamId === "string" && teamId.length > 0);
@@ -11640,6 +11823,60 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return teams;
   }
+  async openTeamDirectChat(teamId, recipientHash) {
+    if (!teamId || !/^[0-9a-f]{64}$/.test(recipientHash)) throw new Error("A Team ID and member hash are required.");
+    const owner2 = this.captureTeamAccountOwner();
+    const [ownHash, ownIdentity] = await Promise.all([this.ownDirectChatHash(), this.ensureDirectChatIdentity()]);
+    if (recipientHash === ownHash) throw new Error("Choose another Team member to message.");
+    const cache = await this.ensureSynced(false, [], { teamId });
+    if (!owner2.isCurrent()) throw new Error("Account changed while opening the direct chat.");
+    const existing = cache.chats.find((row4) => row4.details.chat_visibility === "direct" && (!row4.details.team_id || row4.details.team_id === teamId) && (!row4.details.hashed_team_id || row4.details.hashed_team_id === computeSHA256(teamId)) && Array.isArray(row4.details.participant_user_hashes) && row4.details.participant_user_hashes.length === 2 && row4.details.participant_user_hashes.includes(ownHash) && row4.details.participant_user_hashes.includes(recipientHash));
+    if (existing) {
+      const wrapping2 = await this.getChatWrappingKey(teamId, this.getMasterKeyBytes());
+      return this.decryptChatListItem(existing, wrapping2, cache, teamId);
+    }
+    const recipient = await this.http.get(
+      `/v1/teams/${encodeURIComponent(teamId)}/members/${encodeURIComponent(recipientHash)}/chat-encryption-key`,
+      this.getCliRequestHeaders()
+    );
+    if (recipient.status === 404) throw new Error("Direct message pending: this Team member has not enrolled a chat encryption key yet.");
+    if (!recipient.ok) throw new Error(`Team member chat encryption key failed with HTTP ${recipient.status}`);
+    const recipientKey = await validatePublicChatEncryptionKeyId(recipient.data);
+    const chatId = randomUUID9();
+    const chatKey = new Uint8Array(randomBytes4(32));
+    const ownEnvelope = await sealDirectChatKey(chatKey, { teamId, chatId, recipientHash: ownHash, keyId: ownIdentity.keyId }, ownIdentity.publicKey);
+    const recipientEnvelope = await sealDirectChatKey(chatKey, { teamId, chatId, recipientHash, keyId: recipientKey.key_id }, recipientKey.public_key);
+    if (!owner2.isCurrent()) throw new Error("Account changed while opening the direct chat.");
+    const response = await this.http.post(
+      `/v1/teams/${encodeURIComponent(teamId)}/direct-chats`,
+      {
+        chat_id: chatId,
+        recipient_user_hash: recipientHash,
+        participant_key_envelopes: {
+          [ownHash]: { key_id: ownIdentity.keyId, encrypted_chat_key: ownEnvelope },
+          [recipientHash]: { key_id: recipientKey.key_id, encrypted_chat_key: recipientEnvelope }
+        },
+        encrypted_title: await encryptWithAesGcmCombined("Private Team message", chatKey)
+      },
+      this.getCliRequestHeaders()
+    );
+    if (!owner2.isCurrent()) throw new Error("Account changed while opening the direct chat.");
+    if (!response.ok || !response.data.chat) throw new Error(`Direct chat creation failed with HTTP ${response.status}`);
+    const details = response.data.chat;
+    if (details.chat_visibility !== "direct" || details.team_id !== teamId || details.id !== chatId) {
+      throw new Error("Direct chat creation returned mismatched metadata.");
+    }
+    const latest = loadSyncCache(teamId) ?? cache;
+    const row3 = { details, messages: [] };
+    saveSyncCache({
+      ...latest,
+      chats: [row3, ...latest.chats],
+      loadedChatCount: latest.loadedChatCount + 1,
+      totalChatCount: latest.totalChatCount + 1
+    }, teamId);
+    const wrapping = await this.getChatWrappingKey(teamId, this.getMasterKeyBytes());
+    return this.decryptChatListItem(row3, wrapping, loadSyncCache(teamId), teamId);
+  }
   async approveTeamName(name) {
     this.requireSession();
     const normalized = name.trim().toLowerCase();
@@ -11690,6 +11927,7 @@ var OpenMatesClient = class _OpenMatesClient {
     return response.data.team;
   }
   async getTeam(teamId) {
+    await this.ensureDirectChatIdentity();
     const owner2 = this.captureTeamAccountOwner();
     const response = await this.http.get(`/v1/teams/${encodeURIComponent(teamId)}`, this.getCliRequestHeaders());
     if (!response.ok || !response.data.team) throw new Error(`Team get failed with HTTP ${response.status}`);
@@ -11739,6 +11977,7 @@ var OpenMatesClient = class _OpenMatesClient {
   }
   async listTeamMembers(teamId) {
     this.requireSession();
+    await this.ensureDirectChatIdentity();
     const response = await this.http.get(`/v1/teams/${encodeURIComponent(teamId)}/members`, this.getCliRequestHeaders());
     if (!response.ok) throw new Error(`Team members failed with HTTP ${response.status}`);
     return Promise.all((response.data.members ?? []).map((member) => this.decryptTeamMember(teamId, member)));
@@ -12865,6 +13104,111 @@ var OpenMatesClient = class _OpenMatesClient {
       return response.data.user ?? {};
     });
   }
+  async ownDirectChatHash() {
+    const session = this.requireSession();
+    const owner2 = this.captureTeamAccountOwner();
+    const scope2 = `${session.apiUrl}:${session.sessionId}:${session.hashedEmail}:${session.masterKeyExportedB64}`;
+    if (this.directChatUserHash?.scope !== scope2) {
+      const cached = loadCachedDirectChatAccountKey(session, this.apiUrl);
+      const promise = (cached ? Promise.resolve({ id: cached.accountId }) : this.whoAmI()).then((user2) => {
+        const id = typeof user2.id === "string" ? user2.id : typeof user2.user_id === "string" ? user2.user_id : null;
+        if (!id) throw new Error("Authenticated identity is required for direct chats.");
+        if (!owner2.isCurrent()) throw new Error("Account changed while loading direct chat identity.");
+        return createHash13("sha256").update(id).digest("hex");
+      }).catch((error) => {
+        if (!(error instanceof TypeError)) throw error;
+        const cached2 = loadCachedDirectChatAccountKey(session, this.apiUrl);
+        if (!cached2) throw error;
+        if (!owner2.isCurrent()) throw new Error("Account changed while loading direct chat identity.");
+        return createHash13("sha256").update(cached2.accountId).digest("hex");
+      }).catch((error) => {
+        if (this.directChatUserHash?.promise === promise) this.directChatUserHash = void 0;
+        throw error;
+      });
+      this.directChatUserHash = { scope: scope2, promise };
+    }
+    return this.directChatUserHash.promise;
+  }
+  async ensureDirectChatIdentity() {
+    const session = this.requireSession();
+    const scope2 = `${session.apiUrl}:${session.sessionId}:${session.hashedEmail}:${session.masterKeyExportedB64}`;
+    if (this.directChatIdentity?.scope !== scope2) {
+      const promise = this.loadDirectChatIdentity().catch((error) => {
+        if (this.directChatIdentity?.promise === promise) this.directChatIdentity = void 0;
+        throw error;
+      });
+      this.directChatIdentity = { scope: scope2, promise };
+    }
+    return this.directChatIdentity.promise;
+  }
+  async loadDirectChatIdentity() {
+    const owner2 = this.captureTeamAccountOwner();
+    const masterKey = this.getMasterKeyBytes();
+    const recover = async (record11) => {
+      const identity4 = await recoverAccountChatIdentity(record11, masterKey);
+      if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+      return identity4;
+    };
+    const local = loadCachedDirectChatAccountKey(this.requireSession(), this.apiUrl);
+    if (local) return recover(local.record);
+    const cacheVerifiedRecord = async (record11) => {
+      try {
+        const user2 = await this.whoAmI();
+        if (!owner2.isCurrent()) return;
+        const accountId = typeof user2.id === "string" ? user2.id : typeof user2.user_id === "string" ? user2.user_id : null;
+        const trustedAccountId = loadTrustedAccountId();
+        if (accountId && (trustedAccountId ? trustedAccountId === accountId : process.env.OPENMATES_ACCOUNT_GUARD !== "required")) {
+          saveCachedDirectChatAccountKey(this.requireSession(), this.apiUrl, accountId, record11);
+        }
+      } catch {
+      }
+    };
+    let existing;
+    try {
+      existing = await this.http.get(
+        "/v1/account/chat-encryption-key",
+        this.getCliRequestHeaders()
+      );
+    } catch (error) {
+      if (!(error instanceof TypeError)) throw error;
+      if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+      const cached = loadCachedDirectChatAccountKey(this.requireSession(), this.apiUrl);
+      if (!cached) throw error;
+      return recover(cached.record);
+    }
+    if (!existing.ok && existing.status !== 404) throw new Error(`Account chat encryption key failed with HTTP ${existing.status}`);
+    if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key enrollment.");
+    if (existing.data.key) {
+      const identity4 = await recover(existing.data.key);
+      await cacheVerifiedRecord(existing.data.key);
+      if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+      return identity4;
+    }
+    const generated = await createAccountChatIdentity(masterKey);
+    if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key enrollment.");
+    const saved = await this.http.put(
+      "/v1/account/chat-encryption-key",
+      generated.record,
+      this.getCliRequestHeaders()
+    );
+    if (saved.status === 409) {
+      const current2 = await this.http.get(
+        "/v1/account/chat-encryption-key",
+        this.getCliRequestHeaders()
+      );
+      if (!owner2.isCurrent() || !current2.ok || !current2.data.key) throw new Error("Account chat encryption key enrollment conflicted. Retry.");
+      const identity4 = await recover(current2.data.key);
+      await cacheVerifiedRecord(current2.data.key);
+      if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+      return identity4;
+    }
+    if (!owner2.isCurrent() || !saved.ok) throw new Error(`Account chat encryption key enrollment failed with HTTP ${saved.status}`);
+    const record10 = saved.data.key ?? generated.record;
+    const identity3 = await recover(record10);
+    await cacheVerifiedRecord(record10);
+    if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+    return identity3;
+  }
   async getTopicPreferences() {
     const user2 = await this.whoAmI();
     return await this.decryptTopicPreferences(user2.encrypted_settings);
@@ -13231,6 +13575,20 @@ var OpenMatesClient = class _OpenMatesClient {
   }
   async resolveChatKey(cache, cached, wrappingKey, teamId = null) {
     const chatId = String(cached.details.id ?? "");
+    if (cached.details.chat_visibility === "direct") {
+      if (!teamId || !chatId || cached.details.team_id && cached.details.team_id !== teamId || cached.details.hashed_team_id && cached.details.hashed_team_id !== computeSHA256(teamId)) {
+        throw new Error("Direct chat Team binding mismatch.");
+      }
+      const ownHash = await this.ownDirectChatHash();
+      const participants = cached.details.participant_user_hashes;
+      if (!Array.isArray(participants) || participants.length !== 2 || !participants.includes(ownHash)) {
+        throw new Error("Direct chat participant binding mismatch.");
+      }
+      const encrypted = cached.details.encrypted_chat_key;
+      if (typeof encrypted !== "string") throw new Error("Direct chat envelope unavailable.");
+      const identity3 = await this.ensureDirectChatIdentity();
+      return openDirectChatKey(encrypted, { teamId, chatId, recipientHash: ownHash, keyId: identity3.keyId }, identity3.privateKey);
+    }
     const wrapperKey = chatId ? this.getContextWrapperEncryptedChatKey(cache, chatId, teamId) : null;
     const encryptedChatKey = wrapperKey ?? (typeof cached.details.encrypted_chat_key === "string" ? cached.details.encrypted_chat_key : null);
     return encryptedChatKey ? this.decryptChatKey(encryptedChatKey, wrappingKey) : null;
@@ -13262,6 +13620,8 @@ var OpenMatesClient = class _OpenMatesClient {
     const slug = chatKeyBytes && typeof d.encrypted_slug === "string" ? slugValue ?? "" : null;
     return {
       id,
+      chatVisibility: d.chat_visibility === "direct" ? "direct" : teamId ? "team" : "personal",
+      participantUserHashes: Array.isArray(d.participant_user_hashes) ? d.participant_user_hashes.filter((value) => typeof value === "string") : void 0,
       shortId: id.slice(0, 8),
       slug,
       title,
@@ -14408,17 +14768,40 @@ var OpenMatesClient = class _OpenMatesClient {
     const selectedTeamId = this.getActiveTeamId();
     const current2 = () => {
       const active = this.session;
-      if (!active || active.apiUrl !== owner2[0] || active.hashedEmail !== owner2[1] || active.sessionId !== owner2[2] || active.createdAt !== owner2[3] || active.masterKeyExportedB64 !== owner2[4] || options.preferCache && this.getActiveTeamId() !== selectedTeamId)
+      if (!active || active.apiUrl !== owner2[0] || active.hashedEmail !== owner2[1] || active.sessionId !== owner2[2] || active.createdAt !== owner2[3] || active.masterKeyExportedB64 !== owner2[4] || this.getActiveTeamId() !== selectedTeamId || this.resolveTeamContext(options) !== teamId)
         throw new Error("Chat workspace changed");
     };
-    const cache = options.preferCache ? loadSyncCache(teamId) : await this.ensureSynced(false, [], options);
+    let cache = options.preferCache ? loadSyncCache(teamId) : await this.ensureSynced(false, [], options);
     current2();
     if (!cache) throw new Error("Chat cache unavailable. Open the chat to refresh it.");
+    const diskCacheAtStart = loadSyncCache(teamId);
+    const diskChatIdsAtStart = diskCacheAtStart?.chats.map((chat) => String(chat.details.id));
     const localTeamKey = options.preferCache && teamId ? loadLocalTeamKey(owner2[1], teamId) : null;
     if (options.preferCache && teamId && !localTeamKey) throw new Error("Team key unavailable offline. Reconnect to refresh Team access.");
     const wrappingKey = localTeamKey ? base64ToBytes(localTeamKey) : await this.getChatWrappingKey(teamId, masterKey);
     current2();
-    const found = await this.resolveCachedChatForQuery(query, cache, wrappingKey, teamId);
+    let found;
+    let fetchedMetadata = false;
+    try {
+      found = await this.resolveCachedChatForQuery(query, cache, wrappingKey, teamId);
+    } catch (error) {
+      if (options.preferCache || !(error instanceof Error) || !/^Chat '.*' not found\./.test(error.message) || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(query)) throw error;
+      const response2 = await this.http.post(
+        this.appendTeamQuery("/v1/chats/metadata/batch", { teamId }),
+        { chat_ids: [query] },
+        this.getCliRequestHeaders()
+      );
+      current2();
+      if (!response2.ok) throw new Error(`Chat metadata failed with HTTP ${response2.status}`);
+      const details = response2.data.chats.find((chat) => String(chat.id ?? "") === query);
+      if (!details) throw error;
+      found = { details, messages: [] };
+      fetchedMetadata = true;
+      cache = { ...cache, chats: [...cache.chats, found], chatKeyWrappers: [
+        ...cache.chatKeyWrappers ?? [],
+        ...Array.isArray(details.chat_key_wrappers) ? details.chat_key_wrappers : []
+      ] };
+    }
     current2();
     const chatItem = await this.decryptChatListItem(found, wrappingKey, cache, teamId);
     current2();
@@ -14446,17 +14829,19 @@ var OpenMatesClient = class _OpenMatesClient {
     const rawMessages = Array.isArray(response.data.messages) ? response.data.messages : [];
     const messages = await this.decryptRawChatMessages(rawMessages, chatItem, chatKeyBytes, cache.embeds);
     current2();
-    if (options.preferCache && teamId && (options.direction ?? "latest") === "latest") {
+    if ((options.direction ?? "latest") === "latest") {
       const latestCache = loadSyncCache(teamId);
       const row3 = latestCache?.chats.find((chat) => String(chat.details.id) === chatId);
-      if (row3 && row3.details.messages_v === found.details.messages_v && row3.details.encrypted_chat_key === found.details.encrypted_chat_key && row3.messages.length === found.messages.length && row3.messages.every((raw, index) => raw === found.messages[index])) {
+      const sameVersion = row3 && row3.details.messages_v === found.details.messages_v && row3.details.encrypted_chat_key === found.details.encrypted_chat_key && row3.messages.length === found.messages.length && row3.messages.every((raw, index) => raw === found.messages[index]);
+      if (latestCache && (sameVersion || fetchedMetadata && !row3 && diskCacheAtStart && latestCache.syncedAt === diskCacheAtStart.syncedAt && latestCache.totalChatCount === diskCacheAtStart.totalChatCount && latestCache.loadedChatCount === diskCacheAtStart.loadedChatCount && latestCache.chats.length === diskChatIdsAtStart?.length && latestCache.chats.every((chat, index) => String(chat.details.id) === diskChatIdsAtStart[index]))) {
         const canonicalId = (raw) => {
           const value = typeof raw === "string" ? JSON.parse(raw) : raw;
           return String(value.client_message_id ?? value.id ?? value.message_id ?? "");
         };
-        const existingById = new Map(row3.messages.map((raw, index) => [canonicalId(raw), index]));
+        const existing = row3?.messages ?? [];
+        const existingById = new Map(existing.map((raw, index) => [canonicalId(raw), index]));
         const overlap = rawMessages.find((raw) => !!canonicalId(raw) && existingById.has(canonicalId(raw)));
-        const older = response.data.has_more_before !== true ? [] : overlap ? row3.messages.slice(0, existingById.get(canonicalId(overlap))) : row3.messages;
+        const older = response.data.has_more_before !== true ? [] : overlap ? existing.slice(0, existingById.get(canonicalId(overlap))) : existing;
         const byId = /* @__PURE__ */ new Map();
         for (const raw of [...older, ...rawMessages]) {
           const value = typeof raw === "string" ? JSON.parse(raw) : raw;
@@ -14466,8 +14851,21 @@ var OpenMatesClient = class _OpenMatesClient {
         }
         const merged = [...byId.values()].sort((a, b) => a.createdAt - b.createdAt).map((message) => message.raw);
         current2();
-        if (merged.length !== row3.messages.length || merged.some((raw, index) => raw !== row3.messages[index]))
-          saveSyncCache({ ...latestCache, chats: latestCache.chats.map((chat) => chat === row3 ? { ...row3, messages: merged } : chat) }, teamId);
+        try {
+          if (!row3) {
+            const wrappers = Array.isArray(found.details.chat_key_wrappers) ? found.details.chat_key_wrappers : [];
+            saveSyncCache({
+              ...latestCache,
+              chats: [...latestCache.chats, { details: found.details, messages: merged }],
+              loadedChatCount: latestCache.loadedChatCount + 1,
+              totalChatCount: Math.max(latestCache.totalChatCount, latestCache.loadedChatCount + 1),
+              chatKeyWrappers: [...latestCache.chatKeyWrappers ?? [], ...wrappers]
+            }, teamId);
+          } else if (merged.length !== row3.messages.length || merged.some((raw, index) => raw !== row3.messages[index])) {
+            saveSyncCache({ ...latestCache, chats: latestCache.chats.map((chat) => chat === row3 ? { ...row3, messages: merged } : chat) }, teamId);
+          }
+        } catch {
+        }
       }
     }
     return {
@@ -15764,7 +16162,7 @@ var OpenMatesClient = class _OpenMatesClient {
             baselineMessagesV = typeof chat.details.messages_v === "number" ? chat.details.messages_v : 0;
             const encKey = typeof chat.details.encrypted_chat_key === "string" ? chat.details.encrypted_chat_key : null;
             if (encKey) {
-              chatKeyBytes = await decryptBytesWithAesGcm(encKey, wrappingKey);
+              chatKeyBytes = await this.resolveChatKey(cache, chat, wrappingKey, teamId);
               encryptedChatKey = encKey;
               if (!chatKeyBytes) throw new Error("Could not decrypt the saved chat key.");
               if (typeof chat.details.encrypted_title === "string") {
@@ -29019,6 +29417,7 @@ var OpenMates = class {
   sdkName;
   sdkSessionPromise;
   masterKeyPromise;
+  chatIdentityPromise;
   constructor(options = {}) {
     this.apiKey = options.apiKey ?? process.env.OPENMATES_API_KEY;
     this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL2).replace(/\/$/, "");
@@ -29123,6 +29522,34 @@ var OpenMates = class {
   sdkSession() {
     return this.getSdkSession();
   }
+  async chatIdentity() {
+    if (!this.chatIdentityPromise) this.chatIdentityPromise = this.loadChatIdentity().catch((error) => {
+      this.chatIdentityPromise = void 0;
+      throw error;
+    });
+    return this.chatIdentityPromise;
+  }
+  async loadChatIdentity() {
+    const masterKey = await this.masterKey();
+    let response;
+    try {
+      response = await this.get("/v1/account/chat-encryption-key");
+    } catch (error) {
+      if (!(error instanceof OpenMatesApiError) || error.status !== 404) throw error;
+      response = { key: null };
+    }
+    if (response.key) return recoverAccountChatIdentity(response.key, masterKey);
+    const generated = await createAccountChatIdentity(masterKey);
+    try {
+      const saved = await this.put("/v1/account/chat-encryption-key", generated.record);
+      return recoverAccountChatIdentity(saved.key ?? generated.record, masterKey);
+    } catch (error) {
+      if (!(error instanceof OpenMatesApiError) || error.status !== 409) throw error;
+      const current2 = await this.get("/v1/account/chat-encryption-key");
+      if (!current2.key) throw new OpenMatesConfigError("Account chat encryption key enrollment conflicted; retry.");
+      return recoverAccountChatIdentity(current2.key, masterKey);
+    }
+  }
   /** @internal Resource-key resolver shared by the Project namespace. */
   async _getProjectGrantKey(projectId) {
     const session = await this.getSdkSession();
@@ -29197,6 +29624,26 @@ var OpenMates = class {
     return { ...payload, chat: decryptedChat, messages, embeds };
   }
   async resolveLoadedChatKey(chat, chatKeyWrappers) {
+    if (chat.chat_visibility === "direct") {
+      const session = await this.sdkSession();
+      const userId = session.user?.id;
+      if (!userId) throw new OpenMatesConfigError("Authenticated identity is required for a direct chat");
+      const ownHash = createHash14("sha256").update(userId).digest("hex");
+      const participants = chat.participant_user_hashes;
+      if (!Array.isArray(participants) || participants.length !== 2 || !participants.includes(ownHash)) {
+        throw new OpenMatesConfigError("Direct chat participant binding mismatch");
+      }
+      const identity3 = await this.chatIdentity();
+      if (typeof chat.team_id !== "string" || typeof chat.encrypted_chat_key !== "string") {
+        throw new OpenMatesConfigError("Direct chat key metadata is incomplete");
+      }
+      return openDirectChatKey(chat.encrypted_chat_key, {
+        teamId: chat.team_id,
+        chatId: chat.id,
+        recipientHash: ownHash,
+        keyId: identity3.keyId
+      }, identity3.privateKey);
+    }
     const hashedChatId = createHash14("sha256").update(chat.id).digest("hex");
     const wrapper = (chatKeyWrappers ?? []).find(
       (entry) => entry.key_type === "master" && entry.hashed_chat_id === hashedChatId && typeof entry.encrypted_chat_key === "string"
@@ -32833,9 +33280,11 @@ var OpenMatesTeams = class {
   }
   async list() {
     const result = await this.client.get("/v1/teams");
+    if (result.teams?.length) await this.client.chatIdentity();
     return result.teams ?? [];
   }
   async get(teamId) {
+    await this.client.chatIdentity();
     const result = await this.client.get(`/v1/teams/${encodeURIComponent(teamId)}`);
     return result.team ?? result;
   }
@@ -32893,6 +33342,62 @@ var OpenMatesTeams = class {
   async members(teamId) {
     return this.client.get(`/v1/teams/${encodeURIComponent(teamId)}/members`);
   }
+  async memberChatEncryptionKey(teamId, memberHash) {
+    if (!/^[0-9a-f]{64}$/.test(memberHash)) throw new OpenMatesConfigError("Member hash must be a SHA-256 hex digest");
+    try {
+      const result = await this.client.get(
+        `/v1/teams/${encodeURIComponent(teamId)}/members/${encodeURIComponent(memberHash)}/chat-encryption-key`
+      );
+      return validatePublicChatEncryptionKeyId(result);
+    } catch (error) {
+      if (error instanceof OpenMatesApiError && error.status === 404) {
+        throw new OpenMatesConfigError("Direct message pending: this Team member has not enrolled a chat encryption key yet.");
+      }
+      throw error;
+    }
+  }
+  async openDirectChat(teamId, recipientHash) {
+    if (!teamId || !/^[0-9a-f]{64}$/.test(recipientHash)) throw new OpenMatesConfigError("A Team ID and member hash are required");
+    const session = await this.client.sdkSession();
+    const userId = session.user?.id;
+    if (!userId) throw new OpenMatesConfigError("Authenticated identity is required for a direct chat");
+    const ownHash = createHash14("sha256").update(userId).digest("hex");
+    if (ownHash === recipientHash) throw new OpenMatesConfigError("Choose another Team member to message");
+    const [ownIdentity, recipientKey] = await Promise.all([
+      this.client.chatIdentity(),
+      this.memberChatEncryptionKey(teamId, recipientHash)
+    ]);
+    const chatId = randomUUID10();
+    const chatKey = new Uint8Array(randomBytes6(32));
+    const ownEnvelope = await sealDirectChatKey(
+      chatKey,
+      { teamId, chatId, recipientHash: ownHash, keyId: ownIdentity.keyId },
+      ownIdentity.publicKey
+    );
+    const recipientEnvelope = await sealDirectChatKey(
+      chatKey,
+      { teamId, chatId, recipientHash, keyId: recipientKey.key_id },
+      recipientKey.public_key
+    );
+    const result = await this.client.request(
+      `/v1/teams/${encodeURIComponent(teamId)}/direct-chats`,
+      {
+        chat_id: chatId,
+        recipient_user_hash: recipientHash,
+        participant_key_envelopes: {
+          [ownHash]: { key_id: ownIdentity.keyId, encrypted_chat_key: ownEnvelope },
+          [recipientHash]: { key_id: recipientKey.key_id, encrypted_chat_key: recipientEnvelope }
+        },
+        encrypted_title: await encryptWithAesGcmCombined("Private Team message", chatKey)
+      }
+    );
+    if (!result.chat) throw new OpenMatesConfigError("Direct chat creation returned no metadata");
+    const participants = result.chat.participant_user_hashes;
+    if (result.chat.chat_visibility !== "direct" || result.chat.team_id !== teamId || result.chat.id !== chatId || !Array.isArray(participants) || participants.length !== 2 || !participants.includes(ownHash) || !participants.includes(recipientHash)) {
+      throw new OpenMatesConfigError("Direct chat creation returned mismatched metadata");
+    }
+    return this.client.decryptChatMetadata(result.chat);
+  }
   async decryptMemberProfile(teamKey, member) {
     const encrypted = member.encrypted_member_profile;
     if (typeof encrypted !== "string" || !encrypted) return { ...member, profile: null };
@@ -78429,6 +78934,14 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
     }
   },
   notifications: {
+    team_direct_chat: {
+      title: {
+        text: "Private Team message"
+      },
+      body: {
+        text: "You have a new private conversation in your Team."
+      }
+    },
     auto_logout: {
       title: {
         text: "Auto logout"
@@ -86624,6 +87137,18 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
       members_description: {
         text: "Manage your team members and their permissions."
       },
+      direct_message_action: {
+        text: "Message"
+      },
+      direct_message_scope: {
+        text: "Only you and this member can read this chat."
+      },
+      direct_message_pending: {
+        text: "Secure messaging setup is pending. Ask this member to open OpenMates."
+      },
+      direct_message_failed: {
+        text: "Could not open a private message. Try again."
+      },
       admins: {
         text: "Admins"
       },
@@ -99667,6 +100192,8 @@ var TUI_ACTIONS = [
   { label: "Show all workspace items", command: "/browse" },
   { label: "Use selected app skill", command: "/app-run" },
   { label: "Recent chats", command: "/chats" },
+  { label: "Team members", command: "/members" },
+  { label: "Message Team member", command: "/message" },
   { label: "Example chats", command: "/examples" },
   { label: "Projects", command: "/projects" },
   { label: "Tasks", command: "/tasks" },
@@ -102306,7 +102833,7 @@ function relativeTime(timestamp) {
   return `${Math.floor(seconds / 86400)}d ago`;
 }
 function renderStatus(state, width) {
-  return ["OpenMates", "", state.status ?? "Working..."].flatMap((line3) => wrap(line3, width));
+  return ["OpenMates", "", ...(state.status ?? "Working...").split("\n")].flatMap((line3) => wrap(line3, width).map((text7) => line3 === "Message \xB7 Enter" ? pointerLine(text7, { kind: "key", name: "return" }) : line3 === "Next member \xB7 \u2193" ? pointerLine(text7, { kind: "key", name: "down" }) : text7));
 }
 function prepareMessageContent(content, width, state, questionBlocks = true) {
   const segments2 = parseMessageSegments(content, { preserveCodeFences: true }).map((segment) => segment.type === "embed" ? segment : {
@@ -105034,6 +105561,19 @@ function createChatModelPreferences(client2) {
 }
 
 // src/tui.ts
+var teamMemberActions = /* @__PURE__ */ new WeakMap();
+function showSelectedTeamMember(state) {
+  const selection = teamMemberActions.get(state);
+  if (!selection?.members.length) {
+    state.status = "No other active Team members are available.";
+    return;
+  }
+  const member = selection.members[state.selectedIndex] ?? selection.members[0];
+  state.status = `Team members ${state.selectedIndex + 1}/${selection.members.length}
+${member.label}
+Message \xB7 Enter
+Next member \xB7 \u2193`;
+}
 function defaultModeForStreams(input, output) {
   return input.isTTY === true && output.isTTY === true ? "tui" : "quickstart";
 }
@@ -105316,6 +105856,21 @@ async function handleKey(params) {
     modelShell,
     mentionShell
   };
+  const memberActions = teamMemberActions.get(state);
+  if (state.screen === "status" && memberActions && !memberActions.isCurrent()) teamMemberActions.delete(state);
+  if (state.screen === "status" && memberActions && memberActions.isCurrent() && memberActions.teamId === client2.getActiveTeamId()) {
+    if (memberActions.members.length > 0 && (key.name === "up" || key.name === "down")) {
+      state.selectedIndex = (state.selectedIndex + (key.name === "down" ? 1 : -1) + memberActions.members.length) % memberActions.members.length;
+      showSelectedTeamMember(state);
+      render();
+      return;
+    }
+    if (key.name === "return" && !state.input.trim()) {
+      const member = memberActions.members[state.selectedIndex];
+      if (member) await handleCommand({ command: `/message ${member.hash}`, state, client: client2, terminal, render, finish, modelShell });
+      return;
+    }
+  }
   if (key.name === "mouseclick") {
     if (!key.mouse || key.ctrl || key.meta || key.shift) return;
     const action2 = pointerTargetAt(state, key.mouse.column, key.mouse.row, terminal.width, terminal.height);
@@ -105491,6 +106046,50 @@ async function handleCommand(params) {
   rememberDraft(state);
   state.input = "";
   state.inputCursor = null;
+  if (name === "/members") {
+    const teamId = client2.getActiveTeamId();
+    if (!teamId) {
+      state.status = "Select a Team to view members.";
+      state.screen = "status";
+      render();
+      return;
+    }
+    const isCurrent = captureTuiWorkspaceOwner(client2);
+    const members = await client2.listTeamMembers(teamId);
+    if (!isCurrent() || client2.getActiveTeamId() !== teamId) return;
+    const user2 = await client2.whoAmI();
+    if (!isCurrent() || client2.getActiveTeamId() !== teamId) return;
+    const ownId = typeof user2.id === "string" ? user2.id : typeof user2.user_id === "string" ? user2.user_id : "";
+    teamMemberActions.set(state, { teamId, isCurrent, members: members.filter((member) => member.status === "active" && member.hashed_user_id && member.user_id !== ownId).map((member) => ({ hash: member.hashed_user_id, label: `${member.profile?.display_name || member.user_id} \xB7 ${member.role}` })) });
+    state.selectedIndex = 0;
+    state.screen = "status";
+    showSelectedTeamMember(state);
+    render();
+    return;
+  }
+  if (name === "/message") {
+    const teamId = client2.getActiveTeamId();
+    if (!teamId) {
+      state.status = "Select a Team to message a member.";
+      state.screen = "status";
+      render();
+      return;
+    }
+    const memberHash = parts[0];
+    if (!memberHash) {
+      state.status = "Use /members to find a member, then /message <member-hash>.";
+      state.screen = "status";
+      render();
+      return;
+    }
+    const chat = await client2.openTeamDirectChat(teamId, memberHash);
+    if (client2.getActiveTeamId() !== teamId) return;
+    state.recentChats = [chat, ...state.recentChats.filter((item) => item.id !== chat.id)];
+    await openSavedChat({ state, client: client2, terminal, render, command: async () => {
+    }, send: async () => {
+    } }, chat.id);
+    return;
+  }
   if (name === "/privacy") {
     const action2 = parts[0] ?? "status";
     if (action2 === "later") {
@@ -115342,24 +115941,33 @@ async function handleTeams(client2, subcommand, rest, flags) {
     else printTeamRecord(team, client2.getActiveTeamId());
     return;
   }
-  if (subcommand === "members") {
+  if (subcommand === "members" || subcommand === "member") {
     const action2 = rest[0];
     const teamId = requiredStringFlag(rest[1], "<team-id>");
+    if (action2 === "message") {
+      const memberHash = requiredStringFlag(rest[2], "<member-hash>");
+      const chat = await client2.openTeamDirectChat(teamId, memberHash);
+      const message = rest.slice(3).join(" ").trim();
+      const response = message ? await client2.sendMessage({ message, chatId: chat.id, teamId }) : void 0;
+      if (flags.json === true) printJson2({ chat_id: chat.id, chat, ...response ? { response } : {} });
+      else console.log(message ? `Message sent in direct chat ${chat.id}` : `Direct chat: ${chat.id}`);
+      return;
+    }
     if (action2 === "list") {
       const members = (await client2.listTeamMembers(teamId)).map(publicTeamMember);
       if (flags.json === true) printJson2({ members });
       else if (!members.length) console.log("No Team members.");
-      else for (const member of members) console.log(`${member.display_name || member.user_id}  ${member.role}  ${member.status || ""}  ${member.user_id}`.trim());
+      else for (const member of members) console.log(`${member.display_name || member.user_id}  ${member.role}  ${member.status || ""}  ${member.hashed_user_id || member.user_id}`.trim());
       return;
     }
     if (action2 === "show") {
       const userId = requiredStringFlag(rest[2], "<member-user-id>");
       const member = publicTeamMember(await client2.getTeamMember(teamId, userId));
       if (flags.json === true) printJson2({ member });
-      else console.log(`${member.display_name || member.user_id}  ${member.role}  ${member.status || ""}  ${member.user_id}`.trim());
+      else console.log(`${member.display_name || member.user_id}  ${member.role}  ${member.status || ""}  ${member.hashed_user_id || member.user_id}`.trim());
       return;
     }
-    throw new Error("Use teams members list <team-id> or teams members show <team-id> <member-user-id>.");
+    throw new Error("Use teams members list, show, or message <team-id> <member-hash> [text].");
   }
   if (subcommand === "profile") {
     const action2 = rest[0];
@@ -124613,6 +125221,7 @@ function printTeamsHelp() {
   openmates teams role <team-id> --user <user-id> --role admin|member|viewer [--json]
   openmates teams members list <team-id> [--json]
   openmates teams members show <team-id> <member-user-id> [--json]
+  openmates teams member message <team-id> <member-hash> [text] [--json]
   openmates teams profile show <team-id> [--json]
   openmates teams profile edit <team-id> [--name <display-name>] [--avatar <value>] [--json]
   openmates teams remove-member <team-id> --user <user-id> [--json]