salamailer 1.0.0

package/cli/salamailer.mjs

@@ -0,0 +1,795 @@
+#!/usr/bin/env node
+// Salamailer CLI + MCP server. Zero dependencies; reuses the exact client crypto
+// module the web app serves (public/js/crypto.js — Node ships Web Crypto), so
+// the zero-knowledge property is identical: plaintext and content keys exist
+// only in THIS process; the server receives ciphertext and wrapped keys.
+//
+//   salamailer init --origin https://… --email you@firm.fi   (password prompted)
+//   salamailer send --to client@x.fi --message "…" [--file f.pdf] [--passphrase p | --sms +358…] [--burn] [--expiry 7] [--self-relay] [--save-passphrase]
+//   salamailer list | replies | reply <id> | status | contacts | receipt <id> | resend <id> | resend-code <id> | revoke <id>
+//   salamailer mcp        ← stdio MCP server for AI agents (12 tools: send/list/status/receipt/resend/resend-code/revoke + save/list/delete_contact + list/read_reply)
+//
+// Credentials (~/.config/salamailer/config.json, 0600): an API key (transport
+// auth) + the raw Vault Key. Treat the file like an SSH private key. The
+// account password itself is never stored.
+
+import { readFileSync, writeFileSync, mkdirSync, realpathSync, existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { homedir, hostname } from 'node:os';
+import { join, basename, dirname, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseArgs } from 'node:util';
+import { createInterface } from 'node:readline';
+import { randomBytes } from 'node:crypto';
+import * as C from '../public/js/crypto.js';
+
+const VERSION = '1.0.0';
+// Installs from before the Salamailer rename kept credentials under the old
+// product name's config dir. Keep reading that path (and the old env var) if
+// the new one doesn't exist yet, so the rename never locks an install out.
+const LEGACY_CONFIG_PATH = join(homedir(), '.config', 'salaemail', 'config.json');
+const DEFAULT_CONFIG_PATH = join(homedir(), '.config', 'salamailer', 'config.json');
+const CONFIG_PATH = process.env.SALAMAILER_CONFIG || process.env.SALAEMAIL_CONFIG ||
+  (!existsSync(DEFAULT_CONFIG_PATH) && existsSync(LEGACY_CONFIG_PATH) ? LEGACY_CONFIG_PATH : DEFAULT_CONFIG_PATH);
+
+// ---------------------------------------------------------------------------
+// config + api helpers
+// ---------------------------------------------------------------------------
+function loadConfig() {
+  try { return JSON.parse(readFileSync(CONFIG_PATH, 'utf8')); }
+  catch { die(`Not configured. Run: salamailer init --origin <url> --email <email>`); }
+}
+function saveConfig(cfg) {
+  mkdirSync(dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
+  writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2) + '\n', { mode: 0o600 });
+}
+function die(msg) { console.error(msg); process.exit(1); }
+
+async function api(cfg, method, path, body, raw = false) {
+  const headers = { authorization: `Bearer ${cfg.apiKey}` };
+  if (body && !raw) headers['content-type'] = 'application/json';
+  if (raw) headers['content-type'] = 'application/octet-stream';
+  const res = await fetch(cfg.origin + path, { method, headers, body: raw ? body : body ? JSON.stringify(body) : undefined });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.error || `${method} ${path} → ${res.status}`);
+  return data;
+}
+
+async function vaultKey(cfg) {
+  // Non-extractable in-process handle over the stored raw VK.
+  return crypto.subtle.importKey('raw', C.unb64(cfg.vk), { name: 'AES-GCM', length: 256 }, false, ['wrapKey', 'unwrapKey']);
+}
+
+async function apiBytes(cfg, path) {
+  const res = await fetch(cfg.origin + path, { headers: { authorization: `Bearer ${cfg.apiKey}` } });
+  if (!res.ok) throw new Error(`GET ${path} → ${res.status}`);
+  return new Uint8Array(await res.arrayBuffer());
+}
+
+// The account's reply PRIVATE key (wrapped under the VK, unwrapped locally).
+// Returns null for accounts that haven't created one yet (web login migrates).
+async function replySecretKey(cfg) {
+  const v = await api(cfg, 'GET', '/api/auth/vault');
+  if (!v.wrappedReplySk) return null;
+  return C.unwrapReplySK(v.wrappedReplySk, await vaultKey(cfg));
+}
+
+// ---------------------------------------------------------------------------
+// Agent guardrails (confused-deputy defence). A prompt-injected agent must not
+// be able to exfiltrate arbitrary local files or send to arbitrary recipients.
+// Configured in the credentials file:
+//   "contactsOnly": true       — recipients must already be saved contacts,
+//                                 i.e. approved by a human beforehand. In this
+//                                 mode the MCP (agent) channel cannot add or
+//                                 remove contacts — approval stays out-of-band.
+//   "hideRecipients": true     — privacy mode for the agent channel: the model
+//                                 never sees recipient emails/phones. Sends are
+//                                 addressed by saved-contact LABEL ("contact"
+//                                 arg); every tool output masks addresses.
+//                                 Implies contactsOnly. Interactive CLI use by
+//                                 the human is unaffected.
+//   "allowedRecipientDomains": ["client-firm.fi", …]  — empty/absent = any
+//   "attachmentRoot": "/path"  — MCP file_paths must resolve inside it
+//                                 (default: the cwd where `salamailer mcp` starts)
+// ---------------------------------------------------------------------------
+async function checkRecipientAllowed(cfg, to) {
+  const email = String(to).trim().toLowerCase();
+  if (cfg.contactsOnly) {
+    const { contacts } = await api(cfg, 'GET', '/api/contacts');
+    if (!contacts.some((c) => c.email === email))
+      throw new Error(
+        `recipient "${email}" is not an approved contact. A human can approve them with ` +
+        `"salamailer contacts add ${email}" or on the web Account page, then retry.`);
+  }
+  const domains = cfg.allowedRecipientDomains;
+  if (Array.isArray(domains) && domains.length) {
+    const d = email.split('@')[1];
+    if (!domains.some((x) => String(x).toLowerCase() === d))
+      throw new Error(
+        `recipient domain "${d}" is not approved. A human can approve it by adding it to ` +
+        `"allowedRecipientDomains" in ${CONFIG_PATH}, then retry.`);
+  }
+}
+
+// --- hideRecipients helpers ----------------------------------------------------
+// In privacy mode the agent addresses people by the LABEL a human gave a saved
+// contact; emails/phones never enter or leave the model's context. Labels are
+// resolved to addresses inside THIS process (which holds the credentials anyway).
+async function resolveContactByLabel(cfg, label) {
+  const { contacts } = await api(cfg, 'GET', '/api/contacts');
+  const l = String(label || '').trim().toLowerCase();
+  const matches = contacts.filter((c) => (c.label || '').trim().toLowerCase() === l);
+  if (matches.length === 1) return matches[0];
+  const available = contacts.map((c) => c.label).filter(Boolean).join(', ');
+  if (!matches.length)
+    throw new Error(`no saved contact labeled "${label}". Available labels: ${available || '(none — a human can label contacts on the web Account page)'}`);
+  throw new Error(`multiple saved contacts share the label "${label}" — a human should make the labels unique on the web Account page.`);
+}
+function maskEmail(email) {
+  const [local, domain = ''] = String(email).split('@');
+  const parts = domain.split('.');
+  const tld = parts.length > 1 ? '.' + parts.pop() : '';
+  return `${local.slice(0, 1)}***@${parts.join('.').slice(0, 1)}***${tld}`;
+}
+// email → label lookup for masking list/receipt output (labelled contacts show
+// their label; anyone else shows a masked address).
+async function recipientDisplayer(cfg) {
+  if (!cfg.hideRecipients) return (email) => email;
+  let labels = new Map();
+  try {
+    const { contacts } = await api(cfg, 'GET', '/api/contacts');
+    labels = new Map(contacts.filter((c) => c.label).map((c) => [c.email, c.label]));
+  } catch { /* mask-only fallback */ }
+  return (email) => labels.get(String(email || '').toLowerCase()) || maskEmail(email);
+}
+
+function checkAttachmentAllowed(path, root) {
+  let rp, rr;
+  try { rp = realpathSync(path); rr = realpathSync(root); }
+  catch { throw new Error(`cannot attach "${path}": not found or unreadable`); }
+  if (rp !== rr && !rp.startsWith(rr + sep))
+    throw new Error(`refusing to attach "${path}": outside the allowed attachment root (${rr})`);
+}
+
+/** Human-friendly generated gate passphrase, e.g. "kx3f-9qtm-2bwp". */
+function genPassphrase() {
+  const alphabet = 'abcdefghjkmnpqrstuvwxyz23456789'; // no lookalikes
+  const pick = () => [...randomBytes(4)].map((b) => alphabet[b % alphabet.length]).join('');
+  return `${pick()}-${pick()}-${pick()}`;
+}
+
+// ---------------------------------------------------------------------------
+// core send (shared by CLI + MCP)
+// ---------------------------------------------------------------------------
+async function sendSecure(cfg, { to, message, files = [], passphrase, smsPhone, waPhone, expiryDays = 30, burn = false, selfRelay = false, savePassphrase = false, paranoid = false, lang = 'fi' }) {
+  await checkRecipientAllowed(cfg, to);
+  if ([passphrase, smsPhone, waPhone].filter(Boolean).length > 1)
+    throw new Error('choose ONE gate: a passphrase, an SMS phone, or a WhatsApp phone');
+  const channel = waPhone ? 'whatsapp' : smsPhone ? 'sms' : 'passphrase';
+  if (paranoid && channel !== 'passphrase')
+    throw new Error('paranoid mode requires a passphrase gate (one-time codes rotate on resend)');
+  let generated = false;
+  let fromContact = false;
+  if (channel === 'passphrase' && !passphrase) {
+    // Reuse a standing per-recipient passphrase if one is saved; else generate one.
+    const saved = await getContactPassphrase(cfg, to);
+    if (saved) { passphrase = saved; fromContact = true; }
+    else { passphrase = genPassphrase(); generated = true; }
+  }
+
+  const ck = await C.generateCK();
+  // Paranoid mode (§5.4): content is encrypted under HKDF(CK, passphrase); the
+  // fragment and sender copy still carry the raw CK, so resend is unchanged.
+  const encKey = paranoid ? await C.deriveParanoidKey(ck, passphrase) : ck;
+  const vk = await vaultKey(cfg);
+  // Body envelope: carry our reply public key (derived locally from the wrapped
+  // private key) inside the E2E encryption so the recipient can reply securely.
+  let replyPub = null;
+  try { const sk = await replySecretKey(cfg); if (sk) replyPub = await C.replyPubJwk(sk); }
+  catch { /* reply key unavailable — send without the reply option */ }
+  const blobs = [];
+  const bodyEnc = await C.encryptBytes(encKey, C.utf8(C.packEnvelope(message, replyPub)));
+  blobs.push({ meta: { kind: 'body', iv: bodyEnc.iv, size: bodyEnc.ct.length }, ct: bodyEnc.ct });
+  for (const f of files) {
+    const bytes = new Uint8Array(await readFile(f));
+    const enc = await C.encryptBytes(encKey, bytes);
+    const nameEnc = await C.encryptBytes(encKey, C.utf8(basename(f)));
+    blobs.push({
+      meta: { kind: 'attachment', iv: enc.iv, size: enc.ct.length, filenameCipher: `${nameEnc.iv}.${C.b64(nameEnc.ct)}` },
+      ct: enc.ct,
+    });
+  }
+
+  const created = await api(cfg, 'POST', '/api/messages', {
+    recipientEmail: to, recipientPhone: waPhone || smsPhone || null, secondChannel: channel,
+    gateSecret: channel === 'passphrase' ? passphrase : null,
+    expiryDays, burnAfterRead: burn, wrappedCk: await C.wrapCK(ck, vk), paranoid, lang,
+    blobs: blobs.map((b) => b.meta),
+  });
+  for (let i = 0; i < created.uploads.length; i++)
+    await api(cfg, 'PUT', created.uploads[i].uploadUrl, blobs[i].ct, true);
+
+  const openUrl = `${cfg.origin}/m/${created.id}#${await C.exportCKFragment(ck)}`;
+  // Self-relay: finalize WITHOUT openUrl so the CK fragment never reaches the
+  // server even transiently (parity with the web compose checkbox, PLAN.md
+  // §5.5.1). The caller must then deliver `openUrl` over their own channel.
+  const fin = await api(cfg, 'POST', `/api/messages/${created.id}/finalize`, selfRelay ? {} : { openUrl });
+
+  // Optionally remember this passphrase for the recipient (encrypted under VK).
+  if (channel === 'passphrase' && savePassphrase && !fromContact) await saveContact(cfg, to, passphrase);
+
+  return {
+    id: created.id, openUrl, channel, selfRelay, paranoid,
+    passphrase: channel === 'passphrase' ? passphrase : undefined,
+    passphraseGenerated: generated, passphraseFromContact: fromContact,
+    emailDelivered: fin.emailDelivered, smsDelivered: fin.smsDelivered,
+    expiryDays, burnAfterRead: burn,
+  };
+}
+
+// --- saved recipients (standing per-recipient passphrase) -------------------
+// Stored server-side encrypted under the VK, so it syncs across web/CLI/MCP
+// without the server ever reading it. Resolve/save via the shared crypto helpers.
+async function getContactPassphrase(cfg, email) {
+  const { contacts } = await api(cfg, 'GET', '/api/contacts');
+  const c = contacts.find((x) => x.email === String(email).trim().toLowerCase());
+  if (!c) return null;
+  return C.unwrapPassphrase({ keyWrapped: c.keyWrapped, iv: c.iv, ct: c.ct }, await vaultKey(cfg));
+}
+async function saveContact(cfg, email, passphrase, label) {
+  const w = await C.wrapPassphrase(passphrase, await vaultKey(cfg));
+  return api(cfg, 'POST', '/api/contacts', {
+    email: String(email).trim().toLowerCase(), label: label || null,
+    keyWrapped: w.keyWrapped, iv: w.iv, ct: w.ct,
+  });
+}
+
+function sendReport(r, redactSecrets = false) {
+  let out;
+  if (r.selfRelay) {
+    out = `Sent (id ${r.id}). Self-relay mode: NO notification email sent — the server never received the key.\n`;
+    out += `Secure link (deliver this yourself, e.g. from your own email): ${r.openUrl}\n`;
+  } else {
+    out = `Sent (id ${r.id}). Notification email ${r.emailDelivered ? 'delivered to the recipient' : 'NOT delivered'}.\n`;
+    out += `Secure link: ${r.openUrl}\n`;
+  }
+  if (r.channel === 'passphrase') {
+    if (redactSecrets && r.passphraseFromContact) {
+      // Privacy mode: the standing passphrase is already known to the recipient
+      // and to the human on the Account page — the model does not need it.
+      out += `Gate: the recipient's standing passphrase (already known to them; hidden in privacy mode).`;
+    } else {
+      const tag = r.passphraseFromContact ? ' (saved for this recipient)' : r.passphraseGenerated ? ' (auto-generated)' : '';
+      out += `Gate passphrase${tag}: ${r.passphrase}\n`;
+      out += r.passphraseFromContact
+        ? `This recipient's standing passphrase was reused — they already know it; no need to relay it again.`
+        : `IMPORTANT: relay the passphrase over a DIFFERENT channel than the link (phone, SMS, in person) — never in the same email/thread.`;
+    }
+  } else {
+    const via = r.channel === 'whatsapp' ? 'WhatsApp' : 'SMS';
+    out += `A one-time ${via} code was ${r.smsDelivered ? 'sent' : 'NOT sent'} to the recipient's phone (the code is the gate, not the key).`;
+  }
+  if (r.paranoid) out += `\nParanoid mode: the passphrase is mixed into the encryption key — the link alone (even plus a server breach) cannot decrypt.`;
+  if (r.burnAfterRead) out += `\nBurn-after-read: the message self-destructs after first open.`;
+  return out;
+}
+
+// Rebuild a message's open link from the sender's wrapped-CK copy (needs the
+// VK). Used to resend a notification without ever storing the fragment server-side.
+async function reconstructOpenUrl(cfg, id) {
+  const sk = await api(cfg, 'GET', `/api/messages/${id}/sender-key`);
+  const ck = await C.unwrapCK(sk.wrappedCk, await vaultKey(cfg));
+  return `${cfg.origin}/m/${id}#${await C.exportCKFragment(ck)}`;
+}
+
+// --- secure replies (inbox) ---------------------------------------------------
+// Decrypt an inbound reply locally: unwrap our reply private key under the VK,
+// ECDH against the reply's ephemeral public key, HKDF → AES-GCM. Attachments are
+// written only when a save dir is given, with sanitized names, contained inside
+// the attachment root (an injected agent must not write outside it either).
+async function readReplyDecrypted(cfg, id, saveDir) {
+  const sk = await replySecretKey(cfg);
+  if (!sk) throw new Error('no reply key on this account yet — log in once on the web app to create it');
+  const r = await api(cfg, 'GET', `/api/replies/${id}`);
+  const key = await C.deriveReplyKeyForRead(sk, r.ephPub, r.hkdfSalt);
+  let body = '';
+  const attachments = [];
+  for (const bl of r.blobs) {
+    const ct = await apiBytes(cfg, `/api/replies/${id}/blob/${bl.id}`);
+    if (bl.kind === 'body') { body = C.fromUtf8(await C.decryptBytes(key, bl.iv, ct)); continue; }
+    const [nameIv, nameCt] = bl.filenameCipher.split('.');
+    const filename = basename(C.fromUtf8(await C.decryptBytes(key, nameIv, C.unb64(nameCt)))).replace(/[\x00-\x1f/\\]/g, '_') || 'attachment';
+    const a = { filename, size: bl.size };
+    if (saveDir) {
+      const root = cfg.attachmentRoot || process.cwd();
+      mkdirSync(saveDir, { recursive: true });
+      checkAttachmentAllowed(saveDir, root);
+      const dest = join(saveDir, filename);
+      writeFileSync(dest, await C.decryptBytes(key, bl.iv, ct));
+      a.savedTo = dest;
+    }
+    attachments.push(a);
+  }
+  return { id: r.id, from: r.recipientEmail, messageId: r.messageId, createdAt: r.createdAt, body, attachments };
+}
+
+function replyReport(r) {
+  let out = `Reply ${r.id} · from ${r.from} · to message ${r.messageId} · ${new Date(r.createdAt).toISOString()}\n`;
+  out += `--- decrypted locally ---\n${r.body}\n`;
+  for (const a of r.attachments)
+    out += a.savedTo ? `Attachment saved: ${a.savedTo}\n` : `Attachment (not saved — pass a save dir): ${a.filename} (${a.size} B encrypted)\n`;
+  return out;
+}
+
+function statusReport(s) {
+  const lines = [`Plan: ${s.plan}${s.status ? ` (${s.status})` : ''}`];
+  lines.push(`Can send: ${s.canSend ? 'yes' : `no — ${s.reason || 'unavailable'}`}`);
+  if (s.plan === 'trial') lines.push(`Trial sends left: ${s.trialSendsLeft ?? '—'}`);
+  lines.push(`SMS codes: ${s.canSms ? `included on every message (EU/EEA numbers; anti-fraud daily valve) · ${s.smsUsed ?? 0} used this period` : 'not available on trial — use passphrases'}`);
+  if (s.periodEnd) lines.push(`Billing period ends: ${new Date(s.periodEnd).toISOString().slice(0, 10)}`);
+  lines.push(`Billing account: ${s.hasBillingAccount ? 'linked' : 'none'} · Stripe checkout: ${s.stripeConfigured ? 'available' : 'off'}`);
+  return lines.join('\n');
+}
+
+// ---------------------------------------------------------------------------
+// commands
+// ---------------------------------------------------------------------------
+async function cmdInit(args) {
+  const { values: v } = parseArgs({ args, options: {
+    origin: { type: 'string' }, email: { type: 'string' }, password: { type: 'string' },
+    'allow-domain': { type: 'string', multiple: true },
+    'contacts-only': { type: 'boolean' },
+    'hide-recipients': { type: 'boolean' },
+  } });
+  if (v.password)
+    console.error('⚠️  --password lands in shell history and process lists — prefer the interactive prompt.');
+  const origin = (v.origin || (await prompt('Server origin (https://…): '))).replace(/\/+$/, '');
+  const email = v.email || (await prompt('Email: '));
+  const password = v.password || (await prompt('Password: ', true));
+
+  // Derive locally, unwrap VK (validates the password), never send the password.
+  const saltsRes = await fetch(`${origin}/api/auth/login-salts`, {
+    method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email }),
+  });
+  const salts = await saltsRes.json();
+  if (!saltsRes.ok) die(salts.error || 'server error');
+  let vkRaw;
+  try {
+    const kek = await C.deriveKEK(password, C.unb64(salts.vkSalt));
+    const vk = await C.unwrapVK(salts.wrappedVk, kek);
+    vkRaw = C.b64(await crypto.subtle.exportKey('raw', vk));
+  } catch { die('Wrong email or password.'); }
+
+  const verifier = await C.deriveAuthVerifier(password, C.unb64(salts.authSalt));
+  const loginRes = await fetch(`${origin}/api/auth/login`, {
+    method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email, authVerifier: verifier }),
+  });
+  if (!loginRes.ok) die('Wrong email or password.');
+  const cookie = (loginRes.headers.get('set-cookie') || '').split(';')[0];
+
+  const keyRes = await fetch(`${origin}/api/apikeys`, {
+    method: 'POST', headers: { 'content-type': 'application/json', cookie },
+    body: JSON.stringify({ name: `cli-${hostname()}` }),
+  });
+  const keyData = await keyRes.json();
+  if (!keyRes.ok) die(keyData.error || 'could not create API key');
+
+  // hideRecipients implies contactsOnly: label-addressing only works against
+  // the human-approved contact list, so the approval boundary comes with it.
+  saveConfig({
+    origin, email, apiKey: keyData.key, vk: vkRaw,
+    contactsOnly: Boolean(v['contacts-only']) || Boolean(v['hide-recipients']),
+    hideRecipients: Boolean(v['hide-recipients']),
+    allowedRecipientDomains: v['allow-domain'] || [],
+    attachmentRoot: null, // null = cwd of `salamailer mcp` at launch
+  });
+  console.log(`Configured. Credentials in ${CONFIG_PATH} (0600) — protect it like an SSH key.`);
+  if (!v['contacts-only'] && !v['hide-recipients'] && !(v['allow-domain'] || []).length)
+    console.log(`Tip (recommended before agent use): strictest is --hide-recipients (agents address\n` +
+      `people by contact label and never see emails/phones) or --contacts-only (agents may only\n` +
+      `send to recipients a human has saved as contacts); or restrict with --allow-domain <domain>.\n` +
+      `Also consider pinning "attachmentRoot" in the config.`);
+}
+
+function prompt(q, hide = false) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  if (hide) {
+    process.stderr.write(q);
+    rl.output = { write() {} }; // suppress echo (approximate; fine for a CLI)
+  }
+  return new Promise((resolve) => rl.question(hide ? '' : q, (a) => { rl.close(); if (hide) process.stderr.write('\n'); resolve(a.trim()); }));
+}
+
+async function cmdSend(args) {
+  const { values: v } = parseArgs({ args, options: {
+    to: { type: 'string' }, message: { type: 'string' }, 'message-file': { type: 'string' },
+    file: { type: 'string', multiple: true }, passphrase: { type: 'string' }, sms: { type: 'string' },
+    whatsapp: { type: 'string' },
+    burn: { type: 'boolean' }, expiry: { type: 'string' }, lang: { type: 'string' }, json: { type: 'boolean' },
+    'self-relay': { type: 'boolean' }, 'save-passphrase': { type: 'boolean' },
+    paranoid: { type: 'boolean' },
+  } });
+  if (!v.to) die('--to <email> is required');
+  let message = v.message;
+  if (!message && v['message-file']) message = readFileSync(v['message-file'], 'utf8');
+  if (!message && !process.stdin.isTTY) message = readFileSync(0, 'utf8');
+  if (!message) die('provide --message, --message-file, or pipe the body on stdin');
+
+  const r = await sendSecure(loadConfig(), {
+    to: v.to, message, files: v.file || [], passphrase: v.passphrase, smsPhone: v.sms,
+    waPhone: v.whatsapp,
+    expiryDays: v.expiry ? Number(v.expiry) : 30, burn: !!v.burn, selfRelay: !!v['self-relay'],
+    savePassphrase: !!v['save-passphrase'], paranoid: !!v.paranoid, lang: v.lang || 'fi',
+  });
+  console.log(v.json ? JSON.stringify(r, null, 2) : sendReport(r));
+}
+
+async function cmdContacts(args) {
+  const [sub, ...rest] = args;
+  const cfg = loadConfig();
+  if (!sub || sub === 'list') {
+    const { contacts } = await api(cfg, 'GET', '/api/contacts');
+    if (!contacts.length) return console.log('No saved recipients. Add one with: salamailer contacts add --to <email> --passphrase <p>');
+    for (const c of contacts) console.log(`${c.email}${c.label ? `  (${c.label})` : ''}  · saved passphrase`);
+    return;
+  }
+  if (sub === 'add') {
+    const { values: v } = parseArgs({ args: rest, options: {
+      to: { type: 'string' }, passphrase: { type: 'string' }, label: { type: 'string' },
+    } });
+    if (!v.to) die('usage: salamailer contacts add --to <email> --passphrase <p> [--label <name>]');
+    const passphrase = v.passphrase || (await prompt('Standing passphrase for this recipient: ', true));
+    if (passphrase.length < 4 || passphrase.length > 200) die('passphrase must be 4–200 characters');
+    await saveContact(cfg, v.to, passphrase, v.label);
+    return console.log(`Saved standing passphrase for ${v.to.trim().toLowerCase()}. Future sends reuse it automatically.`);
+  }
+  if (sub === 'rm' || sub === 'remove') {
+    const { values: v } = parseArgs({ args: rest, options: { to: { type: 'string' } } });
+    if (!v.to) die('usage: salamailer contacts rm --to <email>');
+    const { contacts } = await api(cfg, 'GET', '/api/contacts');
+    const c = contacts.find((x) => x.email === v.to.trim().toLowerCase());
+    if (!c) die(`no saved recipient for ${v.to}`);
+    await api(cfg, 'DELETE', `/api/contacts/${c.id}`);
+    return console.log(`Removed saved passphrase for ${c.email}.`);
+  }
+  die('usage: salamailer contacts [list | add --to <email> --passphrase <p> | rm --to <email>]');
+}
+
+async function cmdStatus(args) {
+  const { values: v } = parseArgs({ args, options: { json: { type: 'boolean' } } });
+  const s = await api(loadConfig(), 'GET', '/api/billing/status');
+  console.log(v.json ? JSON.stringify(s, null, 2) : statusReport(s));
+}
+
+async function cmdResend(id) {
+  if (!id) die('usage: salamailer resend <message-id>');
+  const cfg = loadConfig();
+  const openUrl = await reconstructOpenUrl(cfg, id);
+  await api(cfg, 'POST', `/api/messages/${id}/notify`, { openUrl });
+  console.log(`Notification email re-sent for ${id}.`);
+}
+
+async function cmdResendCode(id) {
+  if (!id) die('usage: salamailer resend-code <message-id>');
+  await api(loadConfig(), 'POST', `/api/messages/${id}/resend-code`);
+  console.log(`A fresh one-time SMS code was sent for ${id}.`);
+}
+
+async function cmdList() {
+  const { messages } = await api(loadConfig(), 'GET', '/api/messages');
+  if (!messages.length) return console.log('No messages.');
+  for (const m of messages) {
+    console.log(`${m.id}  ${m.status.padEnd(8)} ${m.second_channel.padEnd(10)} → ${m.recipient_email}  (expires ${new Date(m.expiry_at).toISOString().slice(0, 10)})`);
+  }
+}
+
+async function cmdReplies() {
+  const { replies } = await api(loadConfig(), 'GET', '/api/replies');
+  if (!replies.length) return console.log('No secure replies.');
+  for (const r of replies)
+    console.log(`${r.id}  ${r.read_at ? 'read  ' : 'NEW   '} from ${r.recipient_email}  ${new Date(r.created_at).toISOString()}`);
+}
+
+async function cmdReply(args) {
+  const [id, ...rest] = args;
+  if (!id) die('usage: salamailer reply <reply-id> [--save-dir <dir>]');
+  const { values: v } = parseArgs({ args: rest, options: { 'save-dir': { type: 'string' }, json: { type: 'boolean' } } });
+  const r = await readReplyDecrypted(loadConfig(), id, v['save-dir']);
+  console.log(v.json ? JSON.stringify(r, null, 2) : replyReport(r));
+}
+
+async function cmdReceipt(id) {
+  if (!id) die('usage: salamailer receipt <message-id>');
+  console.log(JSON.stringify(await api(loadConfig(), 'GET', `/api/messages/${id}/receipt`), null, 2));
+}
+
+async function cmdRevoke(id) {
+  if (!id) die('usage: salamailer revoke <message-id>');
+  await api(loadConfig(), 'DELETE', `/api/messages/${id}`);
+  console.log(`Revoked and permanently deleted ${id}.`);
+}
+
+// ---------------------------------------------------------------------------
+// MCP server (stdio, newline-delimited JSON-RPC 2.0)
+// ---------------------------------------------------------------------------
+const TOOLS = [
+  {
+    name: 'send_secure_message',
+    description:
+      'Send an end-to-end encrypted message (and optional file attachments) to any email address. ' +
+      'The recipient needs no account: they get an email with a secure link, gated by a passphrase or SMS code. ' +
+      'Encryption happens locally; the server never sees plaintext. Returns the link and (if applicable) the ' +
+      'gate passphrase — the passphrase must be relayed to the recipient via a DIFFERENT channel than the link.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        recipient_email: { type: 'string', description: 'Recipient email address (unavailable when the account hides recipient details from agents — use "contact" instead)' },
+        contact: { type: 'string', description: 'Saved-contact label to send to (e.g. "Matti"), an alternative to recipient_email. The label is resolved to the address locally, outside the model. Required when the account is configured with hideRecipients.' },
+        message: { type: 'string', description: 'The confidential message body' },
+        passphrase: { type: 'string', description: 'Optional gate passphrase (4–200 chars). Auto-generated if omitted and sms_phone is not set.' },
+        sms_phone: { type: 'string', description: 'Recipient phone (e.g. +358401234567) to gate with an auto-sent SMS one-time code instead of a passphrase' },
+        whatsapp_phone: { type: 'string', description: 'Recipient phone to gate with an auto-sent WhatsApp one-time code instead of SMS/passphrase (where the server has WhatsApp configured)' },
+        file_paths: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach (encrypted before upload)' },
+        expiry_days: { type: 'number', enum: [7, 14, 30], description: 'Auto-delete after N days (default 30)' },
+        burn_after_read: { type: 'boolean', description: 'Delete permanently after the first read (default false)' },
+        self_relay: { type: 'boolean', description: 'If true, send NO notification email and never hand the key to the server — the returned Secure link must be delivered to the recipient by you/the user over their own channel (maximal zero-knowledge guarantee).' },
+        save_passphrase: { type: 'boolean', description: 'If true, remember the passphrase as this recipient’s standing passphrase so future sends to them reuse it automatically (stored encrypted; the server can’t read it).' },
+        paranoid: { type: 'boolean', description: 'Passphrase gates only: mix the passphrase into the encryption key itself, so even a server breach combined with an intercepted link cannot decrypt the message. The recipient just enters the passphrase as usual.' },
+        lang: { type: 'string', enum: ['fi', 'en', 'sv'], description: 'Recipient language for the notification email, one-time code text and read page (default fi)' },
+      },
+      required: ['message'],
+    },
+  },
+  {
+    name: 'list_sent_messages',
+    description: 'List sent secure messages with status (sent/opened/expired/revoked), recipient, and expiry.',
+    inputSchema: { type: 'object', properties: {} },
+  },
+  {
+    name: 'get_delivery_receipt',
+    description: 'Get the exportable, metadata-only delivery receipt for a message (audit evidence of delivery and opening).',
+    inputSchema: { type: 'object', properties: { message_id: { type: 'string' } }, required: ['message_id'] },
+  },
+  {
+    name: 'revoke_message',
+    description: 'Revoke a sent message: permanently deletes the ciphertext so the link stops working. Irreversible.',
+    inputSchema: { type: 'object', properties: { message_id: { type: 'string' } }, required: ['message_id'] },
+  },
+  {
+    name: 'get_account_status',
+    description: 'Get the sending account status and quotas: plan, whether sending is allowed (and why not), trial sends left, and SMS remaining this period.',
+    inputSchema: { type: 'object', properties: {} },
+  },
+  {
+    name: 'resend_notification',
+    description: 'Re-send the notification email for a sent message. The open link is reconstructed locally from the sender key; the server never stores the key.',
+    inputSchema: { type: 'object', properties: { message_id: { type: 'string' } }, required: ['message_id'] },
+  },
+  {
+    name: 'resend_sms_code',
+    description: 'Issue and send a fresh one-time SMS gate code for an SMS-gated message (e.g. after the recipient locked themselves out). Counts against the SMS quota.',
+    inputSchema: { type: 'object', properties: { message_id: { type: 'string' } }, required: ['message_id'] },
+  },
+  {
+    name: 'save_contact',
+    description: 'Save a standing gate passphrase for a recipient so every future send to them reuses the same passphrase (they only learn it once). Stored encrypted under your vault key; the server can never read it. Ideal for a regular correspondent you message often.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        recipient_email: { type: 'string' },
+        passphrase: { type: 'string', description: 'The shared passphrase (4–200 chars) this recipient will use for all your messages.' },
+        label: { type: 'string', description: 'Optional display name for the contact.' },
+      },
+      required: ['recipient_email', 'passphrase'],
+    },
+  },
+  {
+    name: 'list_replies',
+    description: 'List inbound secure replies from recipients (id, from, read/unread, date). Replies are end-to-end encrypted; use read_reply to decrypt one locally.',
+    inputSchema: { type: 'object', properties: {} },
+  },
+  {
+    name: 'read_reply',
+    description: 'Decrypt an inbound secure reply locally (the server only ever held ciphertext). Returns the reply text and attachment names; pass save_dir to write the attachments to disk (must be inside the attachment root).',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        reply_id: { type: 'string' },
+        save_dir: { type: 'string', description: 'Optional directory to save decrypted attachments into (contained in the attachment root)' },
+      },
+      required: ['reply_id'],
+    },
+  },
+  {
+    name: 'list_contacts',
+    description: 'List recipients that have a saved standing passphrase (emails and labels only; the passphrases themselves are never returned).',
+    inputSchema: { type: 'object', properties: {} },
+  },
+  {
+    name: 'delete_contact',
+    description: 'Forget a recipient’s saved standing passphrase. Future sends to them will auto-generate a fresh passphrase again.',
+    inputSchema: { type: 'object', properties: { recipient_email: { type: 'string' } }, required: ['recipient_email'] },
+  },
+];
+
+async function mcpToolCall(cfg, name, args) {
+  switch (name) {
+    case 'send_secure_message': {
+      // Containment: an injected agent must not exfiltrate files outside the root.
+      const root = cfg.attachmentRoot || process.cwd();
+      for (const p of args.file_paths || []) checkAttachmentAllowed(p, root);
+      let to = args.recipient_email;
+      if (cfg.hideRecipients) {
+        // Privacy mode: raw addresses neither accepted nor revealed. Phone-code
+        // gates are off here too — a phone number is exactly the PII being hidden.
+        if (args.recipient_email || args.sms_phone || args.whatsapp_phone)
+          throw new Error('this account hides recipient details from the agent channel: address the recipient ' +
+            'with the "contact" argument (a saved-contact label). Phone-gated sends are unavailable in this mode.');
+        if (!args.contact) throw new Error('missing "contact": in hideRecipients mode, sends are addressed by saved-contact label. Use list_contacts to see the labels.');
+        to = (await resolveContactByLabel(cfg, args.contact)).email;
+      } else if (args.contact && !args.recipient_email) {
+        to = (await resolveContactByLabel(cfg, args.contact)).email;
+      }
+      if (!to) throw new Error('recipient_email (or contact) is required');
+      const r = await sendSecure(cfg, {
+        to, message: args.message, files: args.file_paths || [],
+        passphrase: args.passphrase, smsPhone: args.sms_phone, waPhone: args.whatsapp_phone,
+        expiryDays: args.expiry_days || 30, burn: !!args.burn_after_read, selfRelay: !!args.self_relay,
+        savePassphrase: !!args.save_passphrase, paranoid: !!args.paranoid, lang: args.lang || 'fi',
+      });
+      return sendReport(r, !!cfg.hideRecipients);
+    }
+    case 'list_sent_messages': {
+      const { messages } = await api(cfg, 'GET', '/api/messages');
+      const show = await recipientDisplayer(cfg);
+      return messages.length
+        ? messages.map((m) => `${m.id} · ${m.status} · ${m.second_channel} → ${show(m.recipient_email)} · expires ${new Date(m.expiry_at).toISOString()}`).join('\n')
+        : 'No messages sent yet.';
+    }
+    case 'get_delivery_receipt': {
+      const receipt = await api(cfg, 'GET', `/api/messages/${args.message_id}/receipt`);
+      if (cfg.hideRecipients) {
+        const show = await recipientDisplayer(cfg);
+        for (const k of ['recipientEmail', 'recipient_email'])
+          if (receipt[k]) receipt[k] = show(receipt[k]);
+        if (receipt.recipientPhone) receipt.recipientPhone = '***';
+        if (receipt.recipient_phone) receipt.recipient_phone = '***';
+      }
+      return JSON.stringify(receipt, null, 2);
+    }
+    case 'revoke_message':
+      await api(cfg, 'DELETE', `/api/messages/${args.message_id}`);
+      return `Message ${args.message_id} revoked and permanently deleted.`;
+    case 'get_account_status':
+      return statusReport(await api(cfg, 'GET', '/api/billing/status'));
+    case 'resend_notification': {
+      const openUrl = await reconstructOpenUrl(cfg, args.message_id);
+      await api(cfg, 'POST', `/api/messages/${args.message_id}/notify`, { openUrl });
+      return `Notification email re-sent for ${args.message_id}.`;
+    }
+    case 'resend_sms_code':
+      await api(cfg, 'POST', `/api/messages/${args.message_id}/resend-code`);
+      return `A fresh one-time SMS code was sent for ${args.message_id}.`;
+    case 'save_contact': {
+      // contactsOnly: the contact list IS the approval boundary, so the agent
+      // channel must not be able to grow it — else a prompt-injected agent
+      // simply approves its own recipient before sending.
+      if (cfg.contactsOnly || cfg.hideRecipients)
+        throw new Error('contactsOnly mode: contacts can only be approved by a human ' +
+          '(web Account page or "salamailer contacts add"), not via the agent channel.');
+      if (String(args.passphrase || '').length < 4 || String(args.passphrase).length > 200)
+        throw new Error('passphrase must be 4–200 characters');
+      await saveContact(cfg, args.recipient_email, args.passphrase, args.label);
+      return `Saved a standing passphrase for ${String(args.recipient_email).trim().toLowerCase()}. Future sends to them reuse it automatically.`;
+    }
+    case 'list_replies': {
+      const { replies } = await api(cfg, 'GET', '/api/replies');
+      const show = await recipientDisplayer(cfg);
+      return replies.length
+        ? replies.map((r) => `${r.id} · ${r.read_at ? 'read' : 'NEW'} · from ${show(r.recipient_email)} · ${new Date(r.created_at).toISOString()}`).join('\n')
+        : 'No secure replies yet.';
+    }
+    case 'read_reply':
+      return replyReport(await readReplyDecrypted(cfg, args.reply_id, args.save_dir));
+    case 'list_contacts': {
+      const { contacts } = await api(cfg, 'GET', '/api/contacts');
+      if (cfg.hideRecipients)
+        return contacts.length
+          ? contacts.map((c) => `${c.label || maskEmail(c.email)} · saved passphrase`).join('\n')
+          : 'No saved recipients yet.';
+      return contacts.length
+        ? contacts.map((c) => `${c.email}${c.label ? ` (${c.label})` : ''} · saved passphrase`).join('\n')
+        : 'No saved recipients yet.';
+    }
+    case 'delete_contact': {
+      if (cfg.contactsOnly || cfg.hideRecipients)
+        throw new Error('contactsOnly mode: the contact list is managed by a human, not via the agent channel.');
+      const { contacts } = await api(cfg, 'GET', '/api/contacts');
+      const c = contacts.find((x) => x.email === String(args.recipient_email).trim().toLowerCase());
+      if (!c) throw new Error(`no saved passphrase for ${args.recipient_email}`);
+      await api(cfg, 'DELETE', `/api/contacts/${c.id}`);
+      return `Removed the saved passphrase for ${c.email}.`;
+    }
+    default:
+      throw new Error(`unknown tool: ${name}`);
+  }
+}
+
+async function cmdMcp() {
+  const cfg = loadConfig();
+  const out = (obj) => process.stdout.write(JSON.stringify(obj) + '\n');
+  const rl = createInterface({ input: process.stdin });
+  rl.on('line', async (line) => {
+    if (!line.trim()) return;
+    let msg;
+    try { msg = JSON.parse(line); }
+    catch { return out({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'parse error' } }); }
+    const { id, method, params } = msg;
+    try {
+      if (method === 'initialize') {
+        return out({ jsonrpc: '2.0', id, result: {
+          protocolVersion: params?.protocolVersion || '2025-06-18',
+          capabilities: { tools: {} },
+          serverInfo: { name: 'salamailer', version: VERSION },
+        } });
+      }
+      if (method === 'notifications/initialized' || method?.startsWith('notifications/')) return; // no response
+      if (method === 'ping') return out({ jsonrpc: '2.0', id, result: {} });
+      if (method === 'tools/list') return out({ jsonrpc: '2.0', id, result: { tools: TOOLS } });
+      if (method === 'tools/call') {
+        try {
+          const text = await mcpToolCall(cfg, params.name, params.arguments || {});
+          return out({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text }] } });
+        } catch (err) {
+          return out({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true } });
+        }
+      }
+      if (id !== undefined) out({ jsonrpc: '2.0', id, error: { code: -32601, message: `method not found: ${method}` } });
+    } catch (err) {
+      if (id !== undefined) out({ jsonrpc: '2.0', id, error: { code: -32603, message: err.message } });
+    }
+  });
+}
+
+// ---------------------------------------------------------------------------
+const [cmd, ...rest] = process.argv.slice(2);
+const commands = {
+  init: () => cmdInit(rest),
+  send: () => cmdSend(rest),
+  list: () => cmdList(),
+  replies: () => cmdReplies(),
+  reply: () => cmdReply(rest),
+  status: () => cmdStatus(rest),
+  contacts: () => cmdContacts(rest),
+  receipt: () => cmdReceipt(rest[0]),
+  resend: () => cmdResend(rest[0]),
+  'resend-code': () => cmdResendCode(rest[0]),
+  revoke: () => cmdRevoke(rest[0]),
+  mcp: () => cmdMcp(),
+};
+if (!cmd || !commands[cmd]) {
+  console.log(`salamailer v${VERSION} — zero-knowledge secure messaging
+
+Usage:
+  salamailer init --origin <url> --email <email>       configure (password prompted)
+                 [--contacts-only]                    agents may only send to human-saved contacts
+                 [--allow-domain <d>]...              restrict agent sends to these recipient domains
+  salamailer send --to <email> --message <text>
+                 [--file <path>]... [--passphrase <p> | --sms <phone> | --whatsapp <phone>]
+                 [--burn] [--expiry 7|14|30] [--lang fi|en|sv] [--self-relay] [--save-passphrase] [--paranoid] [--json]
+  salamailer list                                      sent messages + status
+  salamailer replies                                   inbound secure replies
+  salamailer reply <id> [--save-dir <dir>]             decrypt a reply locally
+  salamailer status [--json]                           plan, sends left, SMS quota
+  salamailer contacts [list | add --to <email> --passphrase <p> | rm --to <email>]
+                                                      standing per-recipient passphrases
+  salamailer receipt <id>                              delivery receipt (JSON)
+  salamailer resend <id>                               re-send the notification email
+  salamailer resend-code <id>                          re-send the SMS gate code
+  salamailer revoke <id>                               permanent delete
+  salamailer mcp                                       run as an MCP server (stdio)
+
+MCP (Claude Code):  claude mcp add salamailer -- salamailer mcp`);
+  process.exit(cmd ? 1 : 0);
+}
+commands[cmd]().catch((err) => die(`Error: ${err.message}`));