@imenam/mcp-messenger 1.0.5 → 1.0.7

package/dist/src/core/types.d.ts

@@ -3,11 +3,22 @@ export declare const SYSTEM_FOLDERS: readonly ["inbox", "sent", "archive", "tras
 export type SystemFolder = (typeof SYSTEM_FOLDERS)[number];
 export declare const PRIORITIES: readonly ["low", "normal", "high"];
 export type Priority = (typeof PRIORITIES)[number];
-/** Rôle d'un agent vis-à-vis d'un message : destinataire, copie, ou expéditeur. */
-export declare const DELIVERY_ROLES: readonly ["to", "cc", "sender"];
+/** Rôle d'un agent vis-à-vis d'un message : destinataire ou expéditeur. */
+export declare const DELIVERY_ROLES: readonly ["to", "sender"];
 export type DeliveryRole = (typeof DELIVERY_ROLES)[number];
+/**
+ * Une boîte porte deux identités qui ne bougent pas au même rythme :
+ * - l'agent (`agent_name`, `agent_description`) : d'où il vient, typiquement le projet.
+ *   Posé par la configuration à l'enregistrement, stable pour toute la vie de la boîte.
+ * - la boîte (`display_name`, `description`) : de quoi cette session s'occupe. Vide au
+ *   départ, posé par l'agent lui-même (`rename_mailbox`), et libre de changer.
+ * Le nom de l'agent seul ne distingue pas deux sessions du même projet ; le nom de la boîte
+ * seul ne dit pas où l'agent travaille. La console et l'annuaire montrent les deux.
+ */
 export interface Agent {
     id: string;
+    agent_name: string | null;
+    agent_description: string | null;
     display_name: string | null;
     description: string | null;
     created_at: string;
@@ -26,8 +37,8 @@ export interface AgentDirectoryEntry extends Agent {
 }
 export interface SendMessageInput {
     from: string;
-    to: string[];
-    cc?: string[];
+    /** Un échange lie exactement deux boîtes : un seul destinataire par message. */
+    to: string;
     subject: string;
     body: string;
     priority?: Priority;
@@ -67,9 +78,9 @@ export interface SendMessageResult {
     /** Titre du fil après envoi, null s'il n'a jamais été nommé. */
     thread_title: string | null;
     created_at: string;
-    delivered_to: string[];
-    /** Destinataires jamais enregistrés sur ce serveur — le message les attend malgré tout. */
-    unknown_recipients: string[];
+    delivered_to: string;
+    /** Destinataire jamais enregistré sur ce serveur — le message l'attend malgré tout. */
+    unknown_recipient: boolean;
 }
 export interface MessageSummary {
     message_id: string;
@@ -77,8 +88,7 @@ export interface MessageSummary {
     /** Titre du fil, null tant que personne ne l'a nommé — le `subject` fait alors office. */
     thread_title: string | null;
     from: string;
-    to: string[];
-    cc: string[];
+    to: string;
     subject: string;
     preview: string;
     priority: Priority;

package/dist/src/core/types.js

@@ -1,5 +1,5 @@
 /** Dossiers présents pour tout agent : ils ne peuvent être ni créés ni supprimés. */
 export const SYSTEM_FOLDERS = ["inbox", "sent", "archive", "trash"];
 export const PRIORITIES = ["low", "normal", "high"];
-/** Rôle d'un agent vis-à-vis d'un message : destinataire, copie, ou expéditeur. */
-export const DELIVERY_ROLES = ["to", "cc", "sender"];
+/** Rôle d'un agent vis-à-vis d'un message : destinataire ou expéditeur. */
+export const DELIVERY_ROLES = ["to", "sender"];

package/dist/src/index.js

@@ -43,7 +43,7 @@ async function main() {
             "Ce jeton doit être identique aux trois endroits suivants :",
             "  1. le serveur       : MESSENGER_TOKEN",
             "  2. chaque agent     : MESSENGER_TOKEN dans son .mcp.json",
-            "  3. la console web   : http://127.0.0.1:3600/ui/?token=<jeton>",
+            "  3. la console web   : http://127.0.0.1:3600/ui/ (à saisir dans le formulaire)",
             "",
         ].join("\n"));
         return;

package/dist/src/mcp/tools.js

@@ -25,24 +25,37 @@ export const TOOLS = [
         },
     },
     {
-        name: "set_label",
-        description: "Give a plain-language name to this mailbox, or to a thread. Ids are opaque: a name is what makes a mailbox or a conversation recognisable later, both for the other agents and for the user reading the web console. Without thread_id it names this mailbox ('Développement des tests unitaires du parser'); with thread_id it names that thread ('Le test échoue sur un bug applicatif'). A thread has a single shared name: renaming it changes it for every participant, and the last caller wins.",
+        name: "rename_mailbox",
+        description: "Give a plain-language name to this mailbox, or change it: what this session is working on, e.g. 'Développement des tests unitaires du parser'. Addresses are opaque: the name is what makes this session recognisable later, both for the other agents (list_agents) and for the user reading the web console. It does not touch the agent name, which says where the agent comes from (its project) and is set by the configuration.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                name: { type: "string", description: "Short name, one line. Say what the work is about, not who does it." },
+                description: { type: "string", description: "Optional longer explanation of what this mailbox is for." },
+            },
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "rename_thread",
+        description: "Give a plain-language name to a thread, or change it, e.g. 'Le test échoue sur un bug applicatif'. A thread has a single shared name: renaming it changes it for every participant, and the last caller wins. Use it when a thread was opened without a name, or when the discussion has drifted away from its original name.",
         inputSchema: {
             type: "object",
             properties: {
-                label: { type: "string", description: "Short name, one line. Say what the work is about, not who does it." },
-                description: { type: "string", description: "Optional longer explanation of the mailbox or the thread." },
                 thread_id: {
                     type: "string",
-                    description: "Thread to name. Omit to name this mailbox instead. You must be a participant of the thread.",
+                    description: "Thread to rename. You must be a participant of the thread.",
                 },
+                name: { type: "string", description: "Short name, one line. Say what the thread is about." },
+                description: { type: "string", description: "Optional longer explanation of the thread." },
             },
+            required: ["thread_id"],
             additionalProperties: false,
         },
     },
     {
         name: "list_threads",
-        description: "List the conversations visible from this mailbox, most recently active first, with their name, participants and unread count. This is the readable map of the ongoing work: prefer it over list_messages when you want to know what is being discussed rather than what arrived last. A thread with no name falls back to the subject of its opening message — name it with set_label.",
+        description: "List the conversations visible from this mailbox, most recently active first, with their name, participants and unread count. This is the readable map of the ongoing work: prefer it over list_messages when you want to know what is being discussed rather than what arrived last. A thread with no name falls back to the subject of its opening message — name it with rename_thread.",
         inputSchema: {
             type: "object",
             properties: {
@@ -55,29 +68,23 @@ export const TOOLS = [
     },
     {
         name: "list_agents",
-        description: "List the agents known to the mailbox server, most recently active first, with their name and description. Use it to find the address of the agent you want to write to.",
+        description: "List the other agents known to the mailbox server, most recently active first, with their name and description. Your own mailbox is never listed — you cannot write to yourself. Use it to find the address of the agent you want to write to.",
         inputSchema: { type: "object", properties: {}, additionalProperties: false },
     },
     {
         name: "send_message",
-        description: "Send a message to one or more agents, identified by their mailbox address. Set reply_to to answer an existing message and keep the thread together.",
+        description: "Send a message to one agent, identified by its mailbox address. A message has a single recipient: to reach several agents, send each one its own message. Set reply_to to answer an existing message and keep the thread together.",
         inputSchema: {
             type: "object",
             properties: {
-                to: {
-                    type: "array",
-                    items: { type: "string" },
-                    minItems: 1,
-                    description: "Recipient agent ids (mailbox addresses).",
-                },
-                cc: { type: "array", items: { type: "string" }, description: "Agents to keep in copy." },
+                to: { type: "string", description: "Recipient agent id (mailbox address). Exactly one recipient." },
                 subject: { type: "string", description: "Short subject line." },
                 body: { type: "string", description: "Message body, plain text or markdown." },
                 priority: { type: "string", enum: [...PRIORITIES], description: "Defaults to normal." },
                 reply_to: { type: "string", description: "Id of the message being answered; the reply joins its thread." },
-                thread_title: {
+                thread_name: {
                     type: "string",
-                    description: "Plain-language name of the conversation, e.g. 'Résolution de l'échec du test de parsing'. Name the thread when you open it — you already know what it is about. On a reply it renames the thread for everyone, which is what you want when the discussion has drifted.",
+                    description: "Plain-language name of the conversation, e.g. 'Résolution de l'échec du test de parsing'. Name the thread when you open it — you already know what it is about. On a reply it renames the thread for everyone (same effect as rename_thread).",
                 },
                 thread_description: { type: "string", description: "Optional longer description of the thread." },
             },
@@ -210,13 +217,12 @@ export const TOOLS = [
 ];
 const schemas = {
     send_message: z.object({
-        to: z.union([z.string(), z.array(z.string()).min(1)]),
-        cc: z.union([z.string(), z.array(z.string())]).optional(),
+        to: z.string().min(1),
         subject: z.string().min(1),
         body: z.string().min(1),
         priority: z.enum(PRIORITIES).optional(),
         reply_to: z.string().optional(),
-        thread_title: z.string().trim().min(1).max(200).optional(),
+        thread_name: z.string().trim().min(1).max(200).optional(),
         thread_description: z.string().trim().min(1).max(2000).optional(),
     }),
     list_messages: z.object({
@@ -238,6 +244,24 @@ const schemas = {
     move_messages: z.object({ message_ids: z.array(z.string().min(1)).min(1), folder: z.string().min(1) }),
     delete_messages: z.object({ message_ids: z.array(z.string().min(1)).min(1), permanent: z.boolean().optional() }),
     attach_to_mailbox: z.object({ mailbox_id: z.string().trim().min(1).optional() }),
+    rename_mailbox: z
+        .object({
+        name: z.string().trim().min(1).max(200).optional(),
+        description: z.string().trim().min(1).max(2000).optional(),
+    })
+        .refine((v) => v.name !== undefined || v.description !== undefined, {
+        message: "provide `name` and/or `description`",
+    }),
+    rename_thread: z
+        .object({
+        thread_id: z.string().trim().min(1),
+        name: z.string().trim().min(1).max(200).optional(),
+        description: z.string().trim().min(1).max(2000).optional(),
+    })
+        .refine((v) => v.name !== undefined || v.description !== undefined, {
+        message: "provide `name` and/or `description`",
+    }),
+    // Ancien outil `set_label` : une seule entrée pour la boîte et le fil, `label` au lieu de `name`.
     set_label: z
         .object({
         label: z.string().trim().min(1).max(200).optional(),
@@ -273,9 +297,10 @@ export async function callTool(client, name, rawArgs) {
             const lines = [
                 `Mailbox address: ${client.agentId}`,
                 "  ↳ give this address to another agent so it can write to you.",
+                `Agent: ${self?.agent_name ?? "unnamed (set MESSENGER_AGENT_NAME in the MCP configuration)"}`,
                 self?.display_name
                     ? `Mailbox name: ${self.display_name}`
-                    : "Mailbox name: none — call set_label so the user can tell this session apart from the others.",
+                    : "Mailbox name: none — call rename_mailbox so the user can tell this session apart from the others.",
             ];
             if (client.isAttachedElsewhere) {
                 lines.push(`Attached to another mailbox. This session's own mailbox is ${client.sessionAgentId}.`);
@@ -303,8 +328,9 @@ export async function callTool(client, name, rawArgs) {
             client.setAgentId(target.id);
             const attachedStats = await client.stats();
             return [
-                `Attached to mailbox ${target.id}${target.display_name ? ` (${target.display_name})` : ""}.`,
-                target.description ? `Description: ${target.description}` : null,
+                `Attached to mailbox ${target.id}${formatAgentNames(target) ? ` (${formatAgentNames(target)})` : ""}.`,
+                target.agent_description ? `Agent: ${target.agent_description}` : null,
+                target.description ? `Mailbox: ${target.description}` : null,
                 `Unread (excluding trash): ${attachedStats.unread_total}`,
                 client.sessionAgentId && client.sessionAgentId !== target.id
                     ? `This session's own mailbox remains ${client.sessionAgentId} — attach_to_mailbox with no argument goes back to it.`
@@ -313,29 +339,24 @@ export async function callTool(client, name, rawArgs) {
                 .filter(Boolean)
                 .join("\n");
         }
-        // `set_mailbox_label` n'est plus publié, mais reste accepté : une session en cours
-        // peut l'avoir appris avant la mise à jour du serveur.
+        case "rename_mailbox": {
+            const input = schemas.rename_mailbox.parse(args);
+            return renameMailbox(client, input.name ?? null, input.description ?? null);
+        }
+        case "rename_thread": {
+            const input = schemas.rename_thread.parse(args);
+            return renameThread(client, input.thread_id, input.name ?? null, input.description ?? null);
+        }
+        // `set_label` et `set_mailbox_label` ne sont plus publiés, mais restent acceptés : une
+        // session en cours peut les avoir appris avant la mise à jour du serveur. Le mot « label »
+        // faisait penser à une étiquette, alors qu'il s'agissait du nom.
         case "set_mailbox_label":
         case "set_label": {
             const input = schemas.set_label.parse(args);
             if (input.thread_id) {
-                const thread = await client.setThreadLabel(input.thread_id, {
-                    title: input.label ?? null,
-                    description: input.description ?? null,
-                });
-                return [
-                    `Thread ${thread.thread_id} is now named "${thread.title}".`,
-                    thread.description ? `Description: ${thread.description}` : null,
-                    "Every participant of the thread sees this name.",
-                ]
-                    .filter(Boolean)
-                    .join("\n");
+                return renameThread(client, input.thread_id, input.label ?? null, input.description ?? null);
             }
-            const agent = await client.updateProfile({
-                display_name: input.label ?? null,
-                description: input.description ?? null,
-            });
-            return `Mailbox ${agent.id} named "${agent.display_name}".`;
+            return renameMailbox(client, input.label ?? null, input.description ?? null);
         }
         case "list_threads": {
             const input = schemas.list_threads.parse(args);
@@ -347,41 +368,44 @@ export async function callTool(client, name, rawArgs) {
         case "list_agents": {
             const agents = await client.listAgents();
             if (agents.length === 0)
-                return "No agent registered yet on this server.";
+                return "No other agent on this server yet.";
             return agents
                 .map((agent) => {
-                const flags = [agent.id === client.agentId ? "you" : null, agent.registered ? null : "never connected"]
-                    .filter(Boolean)
-                    .join(", ");
-                const title = agent.display_name ? `${agent.id} — ${agent.display_name}` : agent.id;
+                const flags = agent.registered ? "" : "never connected";
+                const names = formatAgentNames(agent);
+                const title = names ? `${agent.id} — ${names}` : agent.id;
                 // L'annuaire est classé par cette date : l'afficher rend l'ordre lisible.
                 const seen = agent.last_activity_at ? `last active ${agent.last_activity_at}` : "never active";
-                return [`• ${title}${flags ? ` (${flags})` : ""}`, `  ${agent.description ?? "no description"}`, `  ${seen}`].join("\n");
+                return [
+                    `• ${title}${flags ? ` (${flags})` : ""}`,
+                    `  ${agent.agent_description ?? agent.description ?? "no description"}`,
+                    `  ${seen}`,
+                ].join("\n");
             })
                 .join("\n");
         }
         case "send_message": {
             const input = schemas.send_message.parse(args);
             const result = await client.sendMessage({
-                to: asArray(input.to),
-                cc: asArray(input.cc),
+                to: input.to,
                 subject: input.subject,
                 body: input.body,
                 priority: input.priority,
                 reply_to: input.reply_to ?? null,
-                thread_title: input.thread_title ?? null,
+                // Le protocole HTTP et le stockage gardent `thread_title` ; seul l'outil dit `thread_name`.
+                thread_title: input.thread_name ?? null,
                 thread_description: input.thread_description ?? null,
             });
             const lines = [
                 `Message sent: ${result.message_id}`,
                 `Thread: ${formatThreadRef(result.thread_title, result.thread_id)}`,
-                `Delivered to: ${result.delivered_to.join(", ")}`,
+                `Delivered to: ${result.delivered_to}`,
             ];
             if (!result.thread_title && !input.reply_to) {
-                lines.push("This thread has no name yet — set_label with its thread_id makes it readable for everyone.");
+                lines.push("This thread has no name yet — rename_thread with its thread_id makes it readable for everyone.");
             }
-            if (result.unknown_recipients.length > 0) {
-                lines.push(`Warning — never connected to this server, the message will wait in their mailbox: ${result.unknown_recipients.join(", ")}`);
+            if (result.unknown_recipient) {
+                lines.push(`Warning — ${result.delivered_to} has never connected to this server, the message will wait in their mailbox.`);
             }
             return lines.join("\n");
         }
@@ -497,10 +521,28 @@ export async function callTool(client, name, rawArgs) {
             throw new Error(`Unknown tool: ${name}`);
     }
 }
-function asArray(value) {
-    if (value === undefined)
-        return [];
-    return Array.isArray(value) ? value : [value];
+async function renameMailbox(client, name, description) {
+    const agent = await client.updateProfile({ display_name: name, description });
+    return [
+        `Mailbox ${agent.id} named "${agent.display_name}".`,
+        agent.agent_name ? `The agent name stays "${agent.agent_name}"; both are shown together.` : null,
+    ]
+        .filter(Boolean)
+        .join("\n");
+}
+/** `Agent · Boîte` : l'agent dit d'où l'on écrit, la boîte de quoi il est question. */
+function formatAgentNames(agent) {
+    return [agent.agent_name, agent.display_name].filter(Boolean).join(" · ");
+}
+async function renameThread(client, threadId, name, description) {
+    const thread = await client.setThreadLabel(threadId, { title: name, description });
+    return [
+        `Thread ${thread.thread_id} is now named "${thread.title}".`,
+        thread.description ? `Description: ${thread.description}` : null,
+        "Every participant of the thread sees this name.",
+    ]
+        .filter(Boolean)
+        .join("\n");
 }
 /** `titre (id)`, ou l'id seul tant que le fil n'a pas été nommé. */
 function formatThreadRef(title, threadId) {
@@ -523,7 +565,7 @@ function formatSummary(message) {
     const priority = message.priority === "normal" ? "" : ` [${message.priority}]`;
     return [
         `${flags} ${message.subject}${priority}`,
-        `   from ${message.from} to ${message.to.join(", ") || "—"}${message.cc.length ? ` (cc ${message.cc.join(", ")})` : ""} · ${message.created_at}`,
+        `   from ${message.from} to ${message.to || "—"} · ${message.created_at}`,
         `   ${message.preview}`,
         `   id ${message.message_id} · thread ${formatThreadRef(message.thread_title, message.thread_id)}`,
     ].join("\n");
@@ -532,8 +574,7 @@ function formatMessage(message) {
     const header = [
         `Subject: ${message.subject}`,
         `From: ${message.from}`,
-        `To: ${message.to.join(", ") || "—"}`,
-        message.cc.length ? `Cc: ${message.cc.join(", ")}` : null,
+        `To: ${message.to || "—"}`,
         `Date: ${message.created_at}`,
         `Priority: ${message.priority}`,
         `Folder: ${message.folder}${message.read ? "" : " (unread)"}${message.starred ? " ★" : ""}`,

package/dist/src/server/app.js

@@ -1,5 +1,4 @@
 import express from "express";
-import fs from "node:fs";
 import helmet from "helmet";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -9,20 +8,26 @@ import { z } from "zod";
 import { MessengerError, normalizeAgentId } from "../core/store.js";
 import { PRIORITIES } from "../core/types.js";
 import { WatcherRegistry } from "./watchers.js";
+import { CONSOLE_COOKIE, ConsoleSessions, consoleSessionId } from "./console-session.js";
 import { APP_VERSION } from "../version.js";
 import { logger } from "../logger.js";
 const UI_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "ui");
 const agentIdSchema = z.string().trim().min(1).max(128);
 const idListSchema = z.array(z.string().trim().min(1)).min(1).max(200);
-const registerSchema = z.object({
+/** Nom et description de la boîte : ce que l'agent pose lui-même sur sa session. */
+const mailboxProfileSchema = z.object({
     display_name: z.string().trim().max(200).nullish(),
     description: z.string().trim().max(2000).nullish(),
+});
+const registerSchema = mailboxProfileSchema.extend({
+    /** Identité de l'agent (le projet, typiquement) : vient de la configuration, pas de l'agent. */
+    agent_name: z.string().trim().max(200).nullish(),
+    agent_description: z.string().trim().max(2000).nullish(),
     /** true = l'adresse doit être inconnue du serveur (allocation d'une boîte neuve). */
     fresh: z.boolean().optional(),
 });
 const sendSchema = z.object({
-    to: z.union([agentIdSchema, z.array(agentIdSchema).min(1)]),
-    cc: z.union([agentIdSchema, z.array(agentIdSchema)]).optional(),
+    to: agentIdSchema,
     subject: z.string().min(1).max(500),
     body: z.string().min(1).max(200_000),
     priority: z.enum(PRIORITIES).optional(),
@@ -72,6 +77,7 @@ const waitQuerySchema = z.object({
     // attente longue, mais seul le premier prouve que l'agent est joignable en continu.
     watcher: z.enum(["true", "1"]).optional(),
 });
+const loginSchema = z.object({ token: z.string().min(1).max(1024) });
 const adminListSchema = z.object({
     search: z.string().trim().min(1).optional(),
     agent: z.string().trim().min(1).optional(),
@@ -106,8 +112,65 @@ export function createApp({ store, config }) {
         standardHeaders: "draft-8",
         legacyHeaders: false,
     }));
-    // Porte d'entrée unique : aucune requête, quelle qu'elle soit, n'est servie sans
-    // jeton valide. Les contrôles par route (identité de l'agent, console) viennent ensuite.
+    // --- Console web ----------------------------------------------------------
+    // La page et ses fichiers ne contiennent aucun secret : ils sont servis à tous. Ce sont
+    // les données (`/admin`) qui sont protégées, par une session ouverte contre le jeton
+    // admin. Voir `console-session.ts` pour le raisonnement.
+    const sessions = new ConsoleSessions();
+    const cookieOptions = (req) => ({
+        httpOnly: true,
+        sameSite: "strict",
+        // `req.secure` n'est vrai derrière un proxy TLS que si `trust proxy` est configuré.
+        secure: req.secure,
+        path: "/",
+    });
+    // Limite propre au formulaire : le jeton fait 256 bits, mais autant fermer la porte.
+    const loginLimiter = rateLimit({ windowMs: 15 * 60_000, limit: 10, standardHeaders: "draft-8", legacyHeaders: false });
+    app.post("/ui/login", loginLimiter, (req, res) => {
+        const input = loginSchema.parse(req.body ?? {});
+        if (!safeEqual(input.token, config.adminToken)) {
+            res.status(401).json({ error: "invalid admin token" });
+            return;
+        }
+        res.cookie(CONSOLE_COOKIE, sessions.create(), { ...cookieOptions(req), maxAge: sessions.ttlMs });
+        res.status(204).end();
+    });
+    app.post("/ui/logout", (req, res) => {
+        sessions.revoke(consoleSessionId(req));
+        res.clearCookie(CONSOLE_COOKIE, cookieOptions(req));
+        res.status(204).end();
+    });
+    // `maxAge: 0` + ETag : la console reflète immédiatement une mise à jour du paquet,
+    // sans laisser un navigateur servir l'ancienne version depuis son cache.
+    app.use("/ui", express.static(UI_DIR, { index: "index.html", maxAge: 0, etag: true }));
+    app.get("/", (_req, res) => {
+        res.redirect("/ui/");
+    });
+    // --- Supervision (lecture seule) -----------------------------------------
+    // Montée avant la porte d'entrée : son contrôle est au moins aussi strict (session de
+    // console ou jeton admin), et la session par cookie n'est reconnue nulle part ailleurs.
+    const admin = express.Router();
+    admin.use(authenticateAdmin(config, sessions));
+    admin.get("/overview", (_req, res) => {
+        res.json(store.overview());
+    });
+    admin.get("/messages", (req, res) => {
+        const query = adminListSchema.parse(req.query);
+        res.json({ messages: store.listAllMessages(query) });
+    });
+    admin.get("/messages/:id", (req, res) => {
+        res.json(store.getMessageAdmin(String(req.params.id)));
+    });
+    admin.get("/threads/:id", (req, res) => {
+        const threadId = String(req.params.id);
+        const messages = store.listAllMessages({ thread_id: threadId, limit: 100 });
+        if (messages.length === 0)
+            throw new MessengerError(`thread not found: ${threadId}`, 404);
+        res.json({ thread_id: threadId, thread: store.getThreadInfo(threadId), messages: messages.slice().reverse() });
+    });
+    app.use("/admin", admin);
+    // Porte d'entrée de tout le reste : aucune requête n'est servie sans jeton valide. Le
+    // contrôle par route (identité de l'agent) vient ensuite.
     app.use(requireAnyToken(config));
     // --- État du service ------------------------------------------------------
     app.get("/health", (_req, res) => {
@@ -133,16 +196,21 @@ export function createApp({ store, config }) {
         }
         const agent = store.ensureAgent(req.agentId, {
             registered: true,
+            agent_name: input.agent_name ?? null,
+            agent_description: input.agent_description ?? null,
+            // Un client antérieur à la séparation agent / boîte n'envoie que ces deux-là.
             display_name: input.display_name ?? null,
             description: input.description ?? null,
         });
         res.json({ agent });
     });
-    api.get("/agents", (_req, res) => {
-        res.json({ agents: store.listAgents() });
+    // L'agent ne se voit pas dans son propre annuaire : sa boîte est la seule interdite d'envoi.
+    api.get("/agents", (req, res) => {
+        res.json({ agents: store.listAgents(req.agentId) });
     });
+    // Ne touche qu'à la boîte : l'identité de l'agent ne se renomme pas depuis une session.
     api.patch("/agents/me", (req, res) => {
-        const input = registerSchema.parse(req.body ?? {});
+        const input = mailboxProfileSchema.parse(req.body ?? {});
         res.json({
             agent: store.ensureAgent(req.agentId, {
                 registered: true,
@@ -164,8 +232,7 @@ export function createApp({ store, config }) {
         const input = sendSchema.parse(req.body ?? {});
         const result = store.sendMessage({
             from: req.agentId,
-            to: toArray(input.to),
-            cc: toArray(input.cc),
+            to: input.to,
             subject: input.subject,
             body: input.body,
             priority: input.priority,
@@ -173,7 +240,7 @@ export function createApp({ store, config }) {
             thread_title: input.thread_title ?? null,
             thread_description: input.thread_description ?? null,
         });
-        logger.info(`message ${result.message_id}: ${req.agentId} -> ${result.delivered_to.join(", ")}`);
+        logger.info(`message ${result.message_id}: ${req.agentId} -> ${result.delivered_to}`);
         res.status(201).json(result);
     });
     api.get("/messages", (req, res) => {
@@ -260,53 +327,6 @@ export function createApp({ store, config }) {
         req.once("close", onClose);
     });
     app.use("/api", api);
-    // --- Supervision (lecture seule) -----------------------------------------
-    const admin = express.Router();
-    admin.use(authenticateAdmin(config));
-    admin.get("/overview", (_req, res) => {
-        res.json(store.overview());
-    });
-    admin.get("/messages", (req, res) => {
-        const query = adminListSchema.parse(req.query);
-        res.json({ messages: store.listAllMessages(query) });
-    });
-    admin.get("/messages/:id", (req, res) => {
-        res.json(store.getMessageAdmin(String(req.params.id)));
-    });
-    admin.get("/threads/:id", (req, res) => {
-        const threadId = String(req.params.id);
-        const messages = store.listAllMessages({ thread_id: threadId, limit: 100 });
-        if (messages.length === 0)
-            throw new MessengerError(`thread not found: ${threadId}`, 404);
-        res.json({ thread_id: threadId, thread: store.getThreadInfo(threadId), messages: messages.slice().reverse() });
-    });
-    app.use("/admin", admin);
-    // --- Interface web --------------------------------------------------------
-    // Un navigateur ne peut pas poser d'en-tête sur une navigation : la console s'ouvre
-    // donc avec `?token=`. La page est servie avec ce jeton propagé sur ses ressources,
-    // sans quoi le CSS et le script seraient refusés par la porte d'entrée.
-    app.get(["/ui", "/ui/", "/ui/index.html"], (req, res, next) => {
-        const token = presentedToken(req);
-        if (!token) {
-            next();
-            return;
-        }
-        fs.readFile(path.join(UI_DIR, "index.html"), "utf-8", (error, html) => {
-            if (error) {
-                next(error);
-                return;
-            }
-            const suffix = `?token=${encodeURIComponent(token)}`;
-            res.type("html").send(html.replaceAll("./styles.css", `./styles.css${suffix}`).replaceAll("./app.js", `./app.js${suffix}`));
-        });
-    });
-    // `maxAge: 0` + ETag : la console reflète immédiatement une mise à jour du paquet,
-    // sans laisser un navigateur servir l'ancienne version depuis son cache.
-    app.use("/ui", express.static(UI_DIR, { index: false, maxAge: 0, etag: true }));
-    app.get("/", (req, res) => {
-        const token = presentedToken(req);
-        res.redirect(token ? `/ui/?token=${encodeURIComponent(token)}` : "/ui/");
-    });
     // --- Erreurs --------------------------------------------------------------
     app.use((_req, res) => {
         res.status(404).json({ error: "not found" });
@@ -326,11 +346,6 @@ export function createApp({ store, config }) {
     });
     return app;
 }
-function toArray(value) {
-    if (value === undefined)
-        return [];
-    return Array.isArray(value) ? value : [value];
-}
 /**
  * Exige un jeton connu du serveur sur toute requête entrante.
  *
@@ -379,8 +394,13 @@ function authenticateAgent(config) {
         next();
     };
 }
-function authenticateAdmin(config) {
+/** Session de console (navigateur) ou jeton admin (script, `curl`). */
+function authenticateAdmin(config, sessions) {
     return (req, res, next) => {
+        if (sessions.has(consoleSessionId(req))) {
+            next();
+            return;
+        }
         const presented = presentedToken(req);
         if (!presented || !safeEqual(presented, config.adminToken)) {
             res.status(401).json({ error: "invalid or missing admin token" });
@@ -390,19 +410,15 @@ function authenticateAdmin(config) {
     };
 }
 /**
- * Jeton présenté par l'appelant, dans l'ordre de préférence : en-tête `Authorization`,
- * en-tête `X-Messenger-Token`, puis paramètre `?token=` — ce dernier existe pour la
- * navigation navigateur vers la console, qui ne peut pas poser d'en-tête.
+ * Jeton présenté par l'appelant : en-tête `Authorization`, sinon `X-Messenger-Token`.
+ * Jamais l'URL : un jeton en query string finit dans les journaux d'accès du proxy.
  */
 function presentedToken(req) {
     const header = req.header("authorization");
     if (header?.toLowerCase().startsWith("bearer "))
         return header.slice(7).trim() || null;
     const alt = req.header("x-messenger-token");
-    if (alt?.trim())
-        return alt.trim();
-    const query = req.query.token;
-    return typeof query === "string" && query.trim() ? query.trim() : null;
+    return alt?.trim() ? alt.trim() : null;
 }
 /** Comparaison à temps constant : évite de laisser fuiter le jeton octet par octet. */
 function safeEqual(a, b) {