codingsamss/mx-im

MX IM

Use this skill for MX / 美信 write-side interactions: user lookup, group lookup, group alias resolution, text sends, file/image sends, @user, and @all.

Rules

• Never print or persist raw tokens.
• Read-only lookups do not require extra authorization.
• Every live send requires explicit user authorization for the exact target and message in the current conversation.
• Prefer scripts/mx_safe_send.py for normal text sends. It dry-runs by default.
• Live text sends require both --send and --confirm-user-authorized.
• Use original scripts/im_send.py only for file, image, @user, @all, or push fields; it also requires --confirm-user-authorized.
• Do not read MX SQLite databases or local message cache files.

Auth

Send scripts resolve auth in this order:

1. MX_OC_TOKEN.
2. OPENCLAW_MX_SERVER_PORT + OPENCLAW_MX_SERVER_SECRET from the current env.
3. The MX OpenClaw LaunchAgent plist ai.midea-openclaw.gateway-stable.plist, then GET /oc-token with x-server-secret to exchange a fresh OC token. Search order includes: OPENCLAW_MX_LAUNCHD_PLIST, MX's nested profile path ~/Library/Application Support/mx/openclaw-home/<user>/Library/LaunchAgents/, all MX openclaw-home/*/Library/LaunchAgents/ profiles, and standard ~/Library/LaunchAgents/.
4. Runtime MCP config mcporter.json.
5. /tmp/ua_token.txt.
6. UA authorization flow only when explicitly running ua_login.py or when the original im_send.py needs a final fallback.

Never print or store the raw OC token or server secret in skill docs, repo files, logs, or memory.

To diagnose local MX/OpenClaw token discovery without exposing the token:

python3 scripts/get_mx_oc_token.py

Only use --print or --export when intentionally setting a local shell env.

Target Resolution

1. If the user gives a uid or groupId, use it directly.
2. If the user gives a group alias, resolve it first:

   python3 scripts/group_alias.py "<别名>"
   

3. If only a person name, employee id, or email prefix is given:

   python3 scripts/user_search.py --keyword "<姓名/工号/邮箱前缀>"
   

4. If only a group name is given:

   python3 scripts/group_search.py --keyword "<群名关键字>" --limit 5
   

Alias data is local-only at references/group-aliases.local.json; do not sync it to repos.

Text Send

Dry-run first:

python3 scripts/mx_safe_send.py \
  --from-id "<sender_uid>" \
  --to-id "<receiver_uid_or_group_id>" \
  --session-type p2p \
  --body "message text"

After explicit authorization:

python3 scripts/mx_safe_send.py \
  --from-id "<sender_uid>" \
  --to-id "<receiver_uid_or_group_id>" \
  --session-type p2p \
  --body "message text" \
  --send \
  --confirm-user-authorized

For detailed original script behavior, read only the relevant file in references/: mx-ua-auth.md, im-send.md, user-search.md, or group-search.md.