@imenam/mcp-messenger 1.0.32 → 1.0.33

package/dist/src/core/access-store.js

@@ -0,0 +1,307 @@
+import { API_KEY_PREFIX, digestSecret } from "./credentials.js";
+import { newId } from "./ids.js";
+import { MessengerError } from "./errors.js";
+/** Une date de dernier usage n'est réécrite qu'au-delà de ce délai : pas une écriture par requête. */
+const TOUCH_INTERVAL_MS = 60_000;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const KEY_COLUMNS = `k.id, k.name, k.prefix, k.suffix, k.agent_name, k.created_at, k.created_by, k.expires_at,
+  k.lifetime_days, k.revoked_at, k.last_used_at, k.last_used_ip,
+  (SELECT COUNT(*) FROM mailbox_keys mk JOIN agents a ON a.id = mk.mailbox WHERE mk.api_key_id = k.id) AS mailboxes`;
+export class AccessStore {
+    db;
+    now;
+    constructor(db, now = () => Date.now()) {
+        this.db = db;
+        this.now = now;
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS users (
+        id            TEXT PRIMARY KEY,
+        username      TEXT NOT NULL UNIQUE COLLATE NOCASE,
+        password_hash TEXT NOT NULL,
+        created_at    TEXT NOT NULL,
+        updated_at    TEXT
+      );
+
+      CREATE TABLE IF NOT EXISTS console_sessions (
+        id           TEXT PRIMARY KEY,
+        secret_hash  TEXT NOT NULL UNIQUE,
+        user_id      TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        created_at   TEXT NOT NULL,
+        last_seen_at TEXT NOT NULL,
+        expires_at   TEXT NOT NULL,
+        persistent   INTEGER NOT NULL DEFAULT 0,
+        user_agent   TEXT,
+        ip           TEXT
+      );
+
+      CREATE TABLE IF NOT EXISTS api_keys (
+        id            TEXT PRIMARY KEY,
+        name          TEXT NOT NULL,
+        secret_hash   TEXT NOT NULL UNIQUE,
+        prefix        TEXT NOT NULL,
+        suffix        TEXT NOT NULL,
+        agent_name    TEXT,
+        created_at    TEXT NOT NULL,
+        created_by    TEXT,
+        expires_at    TEXT,
+        lifetime_days INTEGER,
+        revoked_at    TEXT,
+        last_used_at  TEXT,
+        last_used_ip  TEXT
+      );
+
+      CREATE TABLE IF NOT EXISTS mailbox_keys (
+        mailbox    TEXT PRIMARY KEY,
+        api_key_id TEXT NOT NULL,
+        opened_at  TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_mailbox_keys_key ON mailbox_keys (api_key_id);
+      CREATE INDEX IF NOT EXISTS idx_console_sessions_user ON console_sessions (user_id);
+    `);
+    }
+    iso(offsetMs = 0) {
+        return new Date(this.now() + offsetMs).toISOString();
+    }
+    // --- Comptes --------------------------------------------------------------
+    hasUsers() {
+        return Boolean(this.db.prepare("SELECT 1 FROM users LIMIT 1").get());
+    }
+    createUser(username, passwordHash) {
+        const id = newId("usr");
+        try {
+            this.db
+                .prepare("INSERT INTO users (id, username, password_hash, created_at) VALUES (?, ?, ?, ?)")
+                .run(id, username, passwordHash, this.iso());
+        }
+        catch (error) {
+            if (isUniqueViolation(error))
+                throw new MessengerError(`username already taken: ${username}`, 409);
+            throw error;
+        }
+        return this.getUser(id);
+    }
+    getUser(id) {
+        return (this.db.prepare("SELECT id, username, created_at, updated_at FROM users WHERE id = ?").get(id) ?? null);
+    }
+    findUserByName(username) {
+        return this.db.prepare("SELECT * FROM users WHERE username = ?").get(username) ?? null;
+    }
+    listUsers() {
+        return this.db.prepare("SELECT id, username, created_at, updated_at FROM users ORDER BY created_at").all();
+    }
+    getPasswordHash(id) {
+        const row = this.db.prepare("SELECT password_hash FROM users WHERE id = ?").get(id);
+        return row?.password_hash ?? null;
+    }
+    renameUser(id, username) {
+        try {
+            const result = this.db
+                .prepare("UPDATE users SET username = ?, updated_at = ? WHERE id = ?")
+                .run(username, this.iso(), id);
+            if (result.changes === 0)
+                throw new MessengerError(`user not found: ${id}`, 404);
+        }
+        catch (error) {
+            if (isUniqueViolation(error))
+                throw new MessengerError(`username already taken: ${username}`, 409);
+            throw error;
+        }
+        return this.getUser(id);
+    }
+    setPassword(id, passwordHash) {
+        const result = this.db
+            .prepare("UPDATE users SET password_hash = ?, updated_at = ? WHERE id = ?")
+            .run(passwordHash, this.iso(), id);
+        if (result.changes === 0)
+            throw new MessengerError(`user not found: ${id}`, 404);
+    }
+    // --- Sessions de la console -----------------------------------------------
+    createSession(input) {
+        this.pruneSessions();
+        const id = newId("ses");
+        const now = this.iso();
+        this.db
+            .prepare(`INSERT INTO console_sessions (id, secret_hash, user_id, created_at, last_seen_at, expires_at, persistent, user_agent, ip)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, digestSecret(input.secret), input.userId, now, now, this.iso(input.ttlMs), input.persistent ? 1 : 0, input.userAgent?.slice(0, 300) ?? null, input.ip);
+        return this.getSession(id);
+    }
+    /** Session encore valide désignée par le contenu du cookie, avec son compte. */
+    findSession(secret, seen = { ip: null }) {
+        if (!secret)
+            return null;
+        const row = this.db
+            .prepare("SELECT * FROM console_sessions WHERE secret_hash = ? AND expires_at > ?")
+            .get(digestSecret(secret), this.iso());
+        if (!row)
+            return null;
+        const user = this.getUser(row.user_id);
+        if (!user)
+            return null;
+        if (this.now() - Date.parse(row.last_seen_at) > TOUCH_INTERVAL_MS) {
+            const now = this.iso();
+            this.db
+                .prepare("UPDATE console_sessions SET last_seen_at = ?, ip = COALESCE(?, ip) WHERE id = ?")
+                .run(now, seen.ip, row.id);
+            row.last_seen_at = now;
+            if (seen.ip)
+                row.ip = seen.ip;
+        }
+        return { session: toSession(row), user };
+    }
+    getSession(id) {
+        const row = this.db.prepare("SELECT * FROM console_sessions WHERE id = ?").get(id);
+        return row ? toSession(row) : null;
+    }
+    listSessions(userId) {
+        this.pruneSessions();
+        return this.db
+            .prepare("SELECT * FROM console_sessions WHERE user_id = ? ORDER BY last_seen_at DESC")
+            .all(userId).map(toSession);
+    }
+    revokeSession(userId, id) {
+        const result = this.db.prepare("DELETE FROM console_sessions WHERE id = ? AND user_id = ?").run(id, userId);
+        if (result.changes === 0)
+            throw new MessengerError(`session not found: ${id}`, 404);
+    }
+    revokeSessionBySecret(secret) {
+        if (secret)
+            this.db.prepare("DELETE FROM console_sessions WHERE secret_hash = ?").run(digestSecret(secret));
+    }
+    /** Ferme les sessions du compte sauf `keepId` (null : toutes). Rend le nombre fermé. */
+    revokeOtherSessions(userId, keepId) {
+        return this.db
+            .prepare("DELETE FROM console_sessions WHERE user_id = ? AND id != ?")
+            .run(userId, keepId ?? "").changes;
+    }
+    pruneSessions() {
+        this.db.prepare("DELETE FROM console_sessions WHERE expires_at <= ?").run(this.iso());
+    }
+    // --- Clés API -------------------------------------------------------------
+    createApiKey(input) {
+        const id = newId("key");
+        const visible = input.secret.startsWith(API_KEY_PREFIX) ? API_KEY_PREFIX.length : 0;
+        this.db
+            .prepare(`INSERT INTO api_keys (id, name, secret_hash, prefix, suffix, agent_name, created_at, created_by, expires_at, lifetime_days)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, input.name, digestSecret(input.secret), input.secret.slice(0, visible + 4), input.secret.slice(-4), input.agentName, this.iso(), input.createdBy, input.lifetimeDays === null ? null : this.iso(input.lifetimeDays * DAY_MS), input.lifetimeDays);
+        return this.getApiKey(id);
+    }
+    listApiKeys() {
+        return this.db.prepare(`SELECT ${KEY_COLUMNS} FROM api_keys k ORDER BY k.created_at DESC`).all().map((row) => this.toApiKey(row));
+    }
+    getApiKey(id) {
+        const row = this.db.prepare(`SELECT ${KEY_COLUMNS} FROM api_keys k WHERE k.id = ?`).get(id);
+        return row ? this.toApiKey(row) : null;
+    }
+    requireKey(id) {
+        const key = this.getApiKey(id);
+        if (!key)
+            throw new MessengerError(`API key not found: ${id}`, 404);
+        return key;
+    }
+    renameApiKey(id, name) {
+        this.requireKey(id);
+        this.db.prepare("UPDATE api_keys SET name = ? WHERE id = ?").run(name, id);
+        return this.getApiKey(id);
+    }
+    /**
+     * Repousse l'expiration de `days` jours, comptés depuis l'échéance encore à venir ou,
+     * pour une clé déjà expirée, depuis maintenant. `null` retire toute échéance.
+     */
+    extendApiKey(id, days) {
+        const key = this.requireKey(id);
+        if (key.status === "revoked")
+            throw new MessengerError("a revoked key cannot be extended", 409);
+        const base = key.expires_at ? Math.max(this.now(), Date.parse(key.expires_at)) : this.now();
+        const expiresAt = days === null ? null : new Date(base + days * DAY_MS).toISOString();
+        this.db.prepare("UPDATE api_keys SET expires_at = ? WHERE id = ?").run(expiresAt, id);
+        return this.getApiKey(id);
+    }
+    revokeApiKey(id) {
+        const key = this.requireKey(id);
+        if (key.status === "revoked")
+            throw new MessengerError("this key is already revoked", 409);
+        this.db.prepare("UPDATE api_keys SET revoked_at = ? WHERE id = ?").run(this.iso(), id);
+        return this.getApiKey(id);
+    }
+    /**
+     * Remplace une clé : la nouvelle reprend le nom, l'agent et la durée de validité de
+     * l'ancienne ; l'ancienne reste acceptée `graceMs` encore, au plus jusqu'à son échéance.
+     */
+    rotateApiKey(id, secret, createdBy, graceMs) {
+        const old = this.requireKey(id);
+        if (old.status !== "active")
+            throw new MessengerError(`only an active key can be replaced (this one is ${old.status})`, 409);
+        return this.db.transaction(() => {
+            const key = this.createApiKey({
+                name: old.name,
+                agentName: old.agent_name,
+                lifetimeDays: old.lifetime_days,
+                createdBy,
+                secret,
+            });
+            const grace = this.iso(graceMs);
+            const expiresAt = old.expires_at && old.expires_at < grace ? old.expires_at : grace;
+            this.db.prepare("UPDATE api_keys SET expires_at = ? WHERE id = ?").run(expiresAt, id);
+            return { key, replaced: this.getApiKey(id) };
+        })();
+    }
+    /** Clé active désignée par le secret présenté, ou null. Note son dernier usage. */
+    authenticateApiKey(secret, ip) {
+        if (!secret)
+            return null;
+        const row = this.db
+            .prepare(`SELECT ${KEY_COLUMNS} FROM api_keys k WHERE k.secret_hash = ?`)
+            .get(digestSecret(secret));
+        if (!row)
+            return null;
+        const key = this.toApiKey(row);
+        if (key.status !== "active")
+            return null;
+        if (!key.last_used_at || this.now() - Date.parse(key.last_used_at) > TOUCH_INTERVAL_MS || key.last_used_ip !== ip) {
+            const now = this.iso();
+            this.db.prepare("UPDATE api_keys SET last_used_at = ?, last_used_ip = ? WHERE id = ?").run(now, ip, key.id);
+            key.last_used_at = now;
+            key.last_used_ip = ip;
+        }
+        return key;
+    }
+    /** Retient la clé qui a ouvert ou repris une boîte : la dernière fait foi. */
+    recordMailboxKey(mailbox, apiKeyId) {
+        this.db
+            .prepare(`INSERT INTO mailbox_keys (mailbox, api_key_id, opened_at) VALUES (?, ?, ?)
+         ON CONFLICT (mailbox) DO UPDATE SET api_key_id = excluded.api_key_id, opened_at = excluded.opened_at
+         WHERE mailbox_keys.api_key_id != excluded.api_key_id`)
+            .run(mailbox, apiKeyId, this.iso());
+    }
+    mailboxesForKey(id) {
+        this.requireKey(id);
+        const rows = this.db
+            .prepare(`SELECT a.id, a.agent_name, a.display_name,
+                MAX(COALESCE(a.last_seen_at, ''),
+                    COALESCE((SELECT MAX(d.created_at) FROM deliveries d WHERE d.agent_id = a.id), '')) AS last_activity_at
+           FROM mailbox_keys mk
+           JOIN agents a ON a.id = mk.mailbox
+          WHERE mk.api_key_id = ?
+          ORDER BY last_activity_at DESC, a.id`)
+            .all(id);
+        return rows.map((row) => ({ ...row, last_activity_at: row.last_activity_at || null }));
+    }
+    toApiKey(row) {
+        const status = row.revoked_at
+            ? "revoked"
+            : row.expires_at && Date.parse(row.expires_at) <= this.now()
+                ? "expired"
+                : "active";
+        return { ...row, status };
+    }
+}
+function toSession(row) {
+    const { secret_hash: _secret, ...rest } = row;
+    return { ...rest, persistent: Boolean(row.persistent) };
+}
+function isUniqueViolation(error) {
+    return typeof error === "object" && error !== null && error.code === "SQLITE_CONSTRAINT_UNIQUE";
+}

package/dist/src/core/credentials.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Secrets de l'authentification : mots de passe, clés API, sessions, code d'installation.
+ *
+ * Rien de ce qui est fabriqué ici n'est stocké en clair. Un mot de passe est haché par
+ * scrypt, lent et salé, parce qu'il est choisi par un humain et donc devinable. Une clé ou
+ * un identifiant de session sort de 256 bits d'aléa : une empreinte SHA-256 suffit à le
+ * retrouver sans le conserver, et se calcule à chaque requête sans coût.
+ */
+/** Préfixe des clés API : il les distingue des adresses (`box_`) et des messages (`msg_`). */
+export declare const API_KEY_PREFIX = "mk_";
+/** Longueur minimale d'un mot de passe. */
+export declare const PASSWORD_MIN_LENGTH = 12;
+/** Empreinte d'un mot de passe : `scrypt$N$r$p$sel$hash`, sel et hash en base64url. */
+export declare function hashPassword(password: string): Promise<string>;
+/** Vrai si le mot de passe correspond à l'empreinte. Toute empreinte illisible est un refus. */
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+/** Empreinte d'un secret à haute entropie (clé API, identifiant de session). */
+export declare function digestSecret(secret: string): string;
+/** Clé API neuve : le préfixe, puis 256 bits d'aléa. */
+export declare function generateApiKey(): string;
+/** Identifiant de session de la console, seul contenu de son cookie. */
+export declare function generateSessionSecret(): string;
+/** Code d'installation : trois groupes de quatre caractères, à recopier depuis le journal. */
+export declare function generateSetupCode(): string;
+/** Mot de passe temporaire donné par `--reset-password`. */
+export declare function generatePassword(): string;
+/** Comparaison à temps constant de deux chaînes. */
+export declare function safeEqual(a: string, b: string): boolean;

package/dist/src/core/credentials.js

@@ -0,0 +1,75 @@
+import { createHash, randomBytes, randomInt, scrypt, timingSafeEqual } from "node:crypto";
+/**
+ * Secrets de l'authentification : mots de passe, clés API, sessions, code d'installation.
+ *
+ * Rien de ce qui est fabriqué ici n'est stocké en clair. Un mot de passe est haché par
+ * scrypt, lent et salé, parce qu'il est choisi par un humain et donc devinable. Une clé ou
+ * un identifiant de session sort de 256 bits d'aléa : une empreinte SHA-256 suffit à le
+ * retrouver sans le conserver, et se calcule à chaque requête sans coût.
+ */
+/** Préfixe des clés API : il les distingue des adresses (`box_`) et des messages (`msg_`). */
+export const API_KEY_PREFIX = "mk_";
+/** Longueur minimale d'un mot de passe. */
+export const PASSWORD_MIN_LENGTH = 12;
+const SCRYPT = { N: 16384, r: 8, p: 1, keylen: 64 };
+function scryptAsync(password, salt, keylen, options) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, keylen, options, (error, derived) => (error ? reject(error) : resolve(derived)));
+    });
+}
+/** Empreinte d'un mot de passe : `scrypt$N$r$p$sel$hash`, sel et hash en base64url. */
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const derived = await scryptAsync(password, salt, SCRYPT.keylen, { N: SCRYPT.N, r: SCRYPT.r, p: SCRYPT.p });
+    return ["scrypt", SCRYPT.N, SCRYPT.r, SCRYPT.p, salt.toString("base64url"), derived.toString("base64url")].join("$");
+}
+/** Vrai si le mot de passe correspond à l'empreinte. Toute empreinte illisible est un refus. */
+export async function verifyPassword(password, stored) {
+    const [scheme, n, r, p, salt, hash] = stored.split("$");
+    if (scheme !== "scrypt" || !salt || !hash)
+        return false;
+    const expected = Buffer.from(hash, "base64url");
+    const derived = await scryptAsync(password, Buffer.from(salt, "base64url"), expected.length, {
+        N: Number(n),
+        r: Number(r),
+        p: Number(p),
+    });
+    return derived.length === expected.length && timingSafeEqual(derived, expected);
+}
+/** Empreinte d'un secret à haute entropie (clé API, identifiant de session). */
+export function digestSecret(secret) {
+    return createHash("sha256").update(secret).digest("hex");
+}
+/** Clé API neuve : le préfixe, puis 256 bits d'aléa. */
+export function generateApiKey() {
+    return `${API_KEY_PREFIX}${randomBytes(32).toString("base64url")}`;
+}
+/** Identifiant de session de la console, seul contenu de son cookie. */
+export function generateSessionSecret() {
+    return randomBytes(32).toString("base64url");
+}
+/** Lettres et chiffres sans les caractères qui se confondent à la lecture (0/O, 1/I/L). */
+const SETUP_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+/** Code d'installation : trois groupes de quatre caractères, à recopier depuis le journal. */
+export function generateSetupCode() {
+    const groups = [];
+    for (let g = 0; g < 3; g += 1) {
+        let group = "";
+        for (let i = 0; i < 4; i += 1)
+            group += SETUP_ALPHABET[randomInt(SETUP_ALPHABET.length)];
+        groups.push(group);
+    }
+    return groups.join("-");
+}
+/** Mot de passe temporaire donné par `--reset-password`. */
+export function generatePassword() {
+    return randomBytes(18).toString("base64url");
+}
+/** Comparaison à temps constant de deux chaînes. */
+export function safeEqual(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}

package/dist/src/core/errors.d.ts

@@ -0,0 +1,5 @@
+/** Erreur métier : traduite en 4xx par la couche HTTP, en message d'outil côté MCP. */
+export declare class MessengerError extends Error {
+    readonly status: number;
+    constructor(message: string, status?: number);
+}

package/dist/src/core/errors.js

@@ -0,0 +1,9 @@
+/** Erreur métier : traduite en 4xx par la couche HTTP, en message d'outil côté MCP. */
+export class MessengerError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.status = status;
+        this.name = "MessengerError";
+    }
+}

package/dist/src/core/store.d.ts

@@ -1,10 +1,8 @@
 import { EventEmitter } from "node:events";
+import { AccessStore } from "./access-store.js";
+import { MessengerError } from "./errors.js";
 import { type AdminThreadSummary, type Agent, type AgentDirectoryEntry, type AttachmentInfo, type DeliveryRole, type FolderInfo, type LinkedMailbox, type ListMessagesOptions, type ListThreadsOptions, type MailboxLink, type MailboxStats, type Message, type MessageSummary, type Priority, type SendMessageInput, type SendMessageResult, type ThreadInfo, type ThreadSummary } from "./types.js";
-/** Erreur métier : traduite en 4xx par la couche HTTP, en message d'outil côté MCP. */
-export declare class MessengerError extends Error {
-    readonly status: number;
-    constructor(message: string, status?: number);
-}
+export { MessengerError };
 /** Contenu d'une pièce jointe, avec ses métadonnées. */
 export interface AttachmentContent extends AttachmentInfo {
     message_id: string;
@@ -42,6 +40,8 @@ export interface StoreEvents {
  */
 export declare class MessageStore extends EventEmitter<StoreEvents> {
     private readonly db;
+    /** Comptes, sessions de la console et clés API, dans la même base. */
+    readonly access: AccessStore;
     constructor(dbPath: string);
     private migrate;
     close(): void;

package/dist/src/core/store.js

@@ -3,17 +3,11 @@ import { EventEmitter } from "node:events";
 import fs from "node:fs";
 import path from "node:path";
 import { MAX_ATTACHMENTS, MAX_ATTACHMENTS_TOTAL_BYTES, MAX_ATTACHMENT_BYTES, formatBytes } from "./attachments.js";
+import { AccessStore } from "./access-store.js";
+import { MessengerError } from "./errors.js";
 import { newId } from "./ids.js";
 import { DELIVERY_ROLES, SYSTEM_FOLDERS, } from "./types.js";
-/** Erreur métier : traduite en 4xx par la couche HTTP, en message d'outil côté MCP. */
-export class MessengerError extends Error {
-    status;
-    constructor(message, status = 400) {
-        super(message);
-        this.status = status;
-        this.name = "MessengerError";
-    }
-}
+export { MessengerError };
 const PREVIEW_LENGTH = 160;
 const MAX_LIMIT = 100;
 const FOLDER_NAME_RE = /^[a-z0-9][a-z0-9 _-]{0,39}$/;
@@ -57,6 +51,8 @@ const ADMIN_DELIVERY = `'to' AS role,
  */
 export class MessageStore extends EventEmitter {
     db;
+    /** Comptes, sessions de la console et clés API, dans la même base. */
+    access;
     constructor(dbPath) {
         super();
         if (dbPath !== ":memory:") {
@@ -67,6 +63,7 @@ export class MessageStore extends EventEmitter {
         if (dbPath !== ":memory:")
             this.db.pragma("journal_mode = WAL");
         this.migrate();
+        this.access = new AccessStore(this.db);
     }
     migrate() {
         this.db.exec(`
@@ -723,10 +720,12 @@ export class MessageStore extends EventEmitter {
             const dropFolders = this.db.prepare("DELETE FROM folders WHERE agent_id = ?");
             const dropAgent = this.db.prepare("DELETE FROM agents WHERE id = ?");
             const dropLinks = this.db.prepare("DELETE FROM links WHERE mailbox_a = ? OR mailbox_b = ?");
+            const dropKey = this.db.prepare("DELETE FROM mailbox_keys WHERE mailbox = ?");
             for (const id of ids) {
                 deliveries += dropDeliveries.run(id).changes;
                 dropFolders.run(id);
                 dropLinks.run(id, id);
+                dropKey.run(id);
                 mailboxes += dropAgent.run(id).changes;
             }
             this.dropOrphanMessages();

package/dist/src/index.js

@@ -11,18 +11,28 @@ Usage:
   mcp-messenger --watch <mailbox>
                              Print one line per incoming message, forever. Meant to be
                              run by the agent's host as a background watcher, not by hand.
-  mcp-messenger --claude-setup-mcp [--force]
+  mcp-messenger --claude-setup-mcp [--server-url <url>] [--api-key <key>] [--force]
                              Write the messenger entry into ./.mcp.json.
-  mcp-messenger --generate-token
-                             Print a fresh random token for MESSENGER_TOKEN.
+  mcp-messenger --reset-password
+                             Give the web console account a new random password and
+                             close all its sessions. Run it on the server machine.
   mcp-messenger --version    Print the version.
   mcp-messenger --help       Print this help.
 
-MCP mode requires MESSENGER_SERVER_URL and MESSENGER_TOKEN; each session gets its own
-mailbox unless MESSENGER_AGENT_ID pins a fixed address.
-Server mode requires MESSENGER_TOKEN (or MESSENGER_AGENT_TOKENS) and reads MESSENGER_PORT
-and MESSENGER_DB_PATH. It always listens on 127.0.0.1.
+MCP mode requires MESSENGER_SERVER_URL and MESSENGER_API_KEY (an API key created in the
+web console); each session gets its own mailbox unless MESSENGER_AGENT_ID pins a fixed
+address.
+Server mode reads MESSENGER_PORT and MESSENGER_DB_PATH and always listens on 127.0.0.1.
+At the first start it prints a setup code: open /ui/ to create the console account.
 See .env.example for the full list.`;
+/** Valeur qui suit une option (`--api-key mk_…`), ou null si l'option est absente ou vide. */
+function optionValue(args, name) {
+    const index = args.indexOf(name);
+    if (index === -1)
+        return null;
+    const value = args[index + 1];
+    return value && !value.startsWith("--") ? value : null;
+}
 async function main() {
     const args = process.argv.slice(2);
     if (args.includes("--help") || args.includes("-h")) {
@@ -33,17 +43,17 @@ async function main() {
         process.stdout.write(`${APP_VERSION}\n`);
         return;
     }
-    // Le jeton part seul sur stdout : la commande reste utilisable dans un pipe
-    // (`mcp-messenger --generate-token > token.txt`), les conseils vont sur stderr.
-    if (args.includes("--generate-token")) {
-        const { generateToken } = await import("./cli/generate-token.js");
-        process.stdout.write(`${generateToken()}\n`);
+    // Le mot de passe part seul sur stdout : la commande reste utilisable dans un pipe, les
+    // explications vont sur stderr.
+    if (args.includes("--reset-password")) {
+        const { resetPassword } = await import("./cli/reset-password.js");
+        const result = await resetPassword();
+        process.stdout.write(`${result.password}\n`);
         process.stderr.write([
             "",
-            "Ce jeton doit être identique aux trois endroits suivants :",
-            "  1. le serveur       : MESSENGER_TOKEN",
-            "  2. chaque agent     : MESSENGER_TOKEN dans son .mcp.json",
-            "  3. la console web   : http://127.0.0.1:3600/ui/ (à saisir dans le formulaire)",
+            `Nouveau mot de passe du compte « ${result.username} » ci-dessus.`,
+            `${result.closedSessions} session(s) de la console fermée(s).`,
+            "Connectez-vous avec lui, puis changez-le depuis Mon compte.",
             "",
         ].join("\n"));
         return;
@@ -52,7 +62,12 @@ async function main() {
     // l'utilisateur, elle n'ouvre ni base ni serveur.
     if (args.includes("--claude-setup-mcp")) {
         const { runSetupMcp } = await import("./cli/setup-mcp.js");
-        process.exit(runSetupMcp({ cwd: process.cwd(), force: args.includes("--force") }));
+        process.exit(runSetupMcp({
+            cwd: process.cwd(),
+            force: args.includes("--force"),
+            serverUrl: optionValue(args, "--server-url"),
+            apiKey: optionValue(args, "--api-key"),
+        }));
     }
     // `--watch` prend l'adresse en argument positionnel : c'est la seule chose que l'agent
     // recopie, le reste (URL, jeton) vient du relais déposé par `enable_notifications`.

package/dist/src/mcp/start.js

@@ -18,31 +18,31 @@ import { TOOLS, callTool } from "./tools.js";
  * recopier une adresse dans le corps d'un message (le serveur la pose déjà, la copie ment
  * dès qu'elle vieillit). Les dire ici, c'est les dire avant l'erreur.
  */
-const INSTRUCTIONS = `mcp-messenger gives this session a mailbox and lets it exchange messages with other agent sessions.
-
-Two words, two different things, used consistently by every tool here:
-- a **mailbox** is an address (\`box_…\`). It identifies exactly one session, and it is what you write to.
-- an **agent name** is the project a session works for. It is a label, never an address, and every session of that project carries it.
-
-Who you are, and who the others are — read this before writing to anyone:
-- A session is identified by its mailbox address, and by nothing else. \`whoami\` gives you yours.
-- The agent name (e.g. "Ai Corrector Dev") comes from the configuration and says which project the agent works on. It is NOT unique: every session started from that configuration carries it.
-- \`list_agents\` groups mailboxes under their agent name: one group per project, one line per session. A group holding several lines is several live sessions of that project, each with its own address — pick one of those addresses, never the group name.
-- One of those groups may carry the same agent name as yours. Recognising your own agent name there does not mean you are looking at yourself — those are other sessions of the same project, each a different agent with its own mailbox. Compare addresses, never names.
-- Your own mailbox is never listed in \`list_agents\`: every address you see there belongs to someone else.
-
-Resuming earlier work:
-- A resumed session usually keeps the mailbox it had: the address, the threads and the unread messages come back on their own. \`whoami\` says so when it happens.
-- When it cannot be decided automatically, \`whoami\` lists the mailboxes left by a stopped session of this project. If you are continuing that work, call \`attach_to_mailbox\` with the right address.
-- If a \`box_…\` address appears earlier in your own context, from a previous part of this conversation, that is your mailbox from before: attach to it rather than writing from a fresh one, so your correspondents keep reaching you at the address they know.
-
-Linked mailboxes:
-- The user can link this mailbox to others from the web console: those are the correspondents you are meant to work with. \`whoami\` and \`list_links\` list them, and the notification watcher announces each new link as it arrives.
-
-Writing:
-- One message goes to exactly one mailbox, and never to your own. To reach several correspondents, send each one its own message.
-- Never write a mailbox address in the body of a message. The server attaches the sender and the recipient to every message, and the reader sees them: an address copied by hand adds nothing and misleads as soon as it is stale or mistaken.
-- Call \`enable_notifications\` once at the start of the session and arm the watcher it hands you. Until then, no incoming message reaches you.
+const INSTRUCTIONS = `mcp-messenger gives this session a mailbox and lets it exchange messages with other agent sessions.
+
+Two words, two different things, used consistently by every tool here:
+- a **mailbox** is an address (\`box_…\`). It identifies exactly one session, and it is what you write to.
+- an **agent name** is the project a session works for. It is a label, never an address, and every session of that project carries it.
+
+Who you are, and who the others are — read this before writing to anyone:
+- A session is identified by its mailbox address, and by nothing else. \`whoami\` gives you yours.
+- The agent name (e.g. "Ai Corrector Dev") comes from the configuration and says which project the agent works on. It is NOT unique: every session started from that configuration carries it.
+- \`list_agents\` groups mailboxes under their agent name: one group per project, one line per session. A group holding several lines is several live sessions of that project, each with its own address — pick one of those addresses, never the group name.
+- One of those groups may carry the same agent name as yours. Recognising your own agent name there does not mean you are looking at yourself — those are other sessions of the same project, each a different agent with its own mailbox. Compare addresses, never names.
+- Your own mailbox is never listed in \`list_agents\`: every address you see there belongs to someone else.
+
+Resuming earlier work:
+- A resumed session usually keeps the mailbox it had: the address, the threads and the unread messages come back on their own. \`whoami\` says so when it happens.
+- When it cannot be decided automatically, \`whoami\` lists the mailboxes left by a stopped session of this project. If you are continuing that work, call \`attach_to_mailbox\` with the right address.
+- If a \`box_…\` address appears earlier in your own context, from a previous part of this conversation, that is your mailbox from before: attach to it rather than writing from a fresh one, so your correspondents keep reaching you at the address they know.
+
+Linked mailboxes:
+- The user can link this mailbox to others from the web console: those are the correspondents you are meant to work with. \`whoami\` and \`list_links\` list them, and the notification watcher announces each new link as it arrives.
+
+Writing:
+- One message goes to exactly one mailbox, and never to your own. To reach several correspondents, send each one its own message.
+- Never write a mailbox address in the body of a message. The server attaches the sender and the recipient to every message, and the reader sees them: an address copied by hand adds nothing and misleads as soon as it is stale or mistaken.
+- Call \`enable_notifications\` once at the start of the session and arm the watcher it hands you. Until then, no incoming message reaches you.
 - The host stops that watcher after 30 minutes at most. Each time it tells you the watcher expired, re-arm it at once with the same Monitor call; otherwise notifications stop for good.`;
 /** Serveur MCP prêt à être branché sur n'importe quel transport (stdio en production, mémoire en test). */
 export function createMcpServer(client) {
@@ -201,7 +201,7 @@ export async function runMcpMode() {
     // Tant que ce battement continue, la boîte de cette session n'est reprise par personne.
     // `unref` : c'est une trace, pas une raison de garder le processus en vie.
     setInterval(heartbeat, HEARTBEAT_MS).unref();
-    // Le relais vers le veilleur porte le jeton de la session : il ne survit pas à la
+    // Le relais vers le veilleur porte la clé API de la session : il ne survit pas à la
     // session. Un arrêt brutal le laisse en place, la purge par ancienneté le rattrape.
     // L'entrée du registre suit le même sort, à ceci près qu'elle est close et non effacée :
     // c'est elle qui rendra sa boîte à la session suivante.