Recovering access

There is no forgot-password flow in Slick, on purpose. A self-hosted instance may have no mail relay configured at all, and a reset link is only ever as trustworthy as the mailbox it lands in. What the person running the server does have is a shell on the machine, so that is where the recovery path lives.

Resetting a password

node dist/index.js reset-password you@example.com

It prompts, without echoing, and then:

• replaces the password hash, using the same Argon2id path as signup
• signs out every existing session for that account, which is the point when the reason for the reset is that someone else got in

In Docker:

docker exec -it slick node dist/index.js reset-password you@example.com

The -it matters. Without it there is no terminal to prompt on, and the command will tell you so rather than hanging.

Scripting it

printf '%s' "$NEW_PASSWORD" | node dist/index.js reset-password you@example.com --stdin

The password is never accepted as an argument. Arguments are visible to any other process through ps and land in shell history, which is a poor place for a credential to sit.

Finding the account

If you are not sure which address the account uses, ask the database:

sqlite3 data/slick.db 'select email, display_name from users'

Bot accounts appear here too, with @slick.invalid addresses. They have no usable password by design, so resetting one does nothing useful. Revoke and recreate the bot from Workspace settings instead.

If the owner account is gone entirely

Ownership cannot currently be transferred from the command line. If the only owner account has been deleted, promote another member to owner directly:

sqlite3 data/slick.db \
  "update workspace_members set role='owner' where user_id=(select id from users where email='you@example.com')"

Take a backup first. Editing the database by hand is a last resort, not a routine.