codingsamss/mx-interaction

MX Interaction

Use this skill for MX / 美信读写交互. Keep all token handling local and explicit.

Core Rules

• Never print, persist, or ask the user to paste a raw token in chat.
• Read-only MX lookups do not require extra user authorization when the user's request asks to search users, groups, sessions, or messages.
• Any live send requires explicit user authorization for that exact send target and message in the current conversation. A generic MX task, token lookup, dry-run, or prior unrelated approval is not enough.
• Prefer scripts/mx_safe_send.py for message sends. It dry-runs by default.
• Only send live MX messages when the user explicitly authorizes sending and the command includes both --send and --confirm-user-authorized.
• Do not read MX SQLite databases, app internals, or local message files. Message reading must use exposed mx_message_* tools only.
• If no mx_message_* tools are available in the current Codex context, say that the current context has no MX query tools and stop.
• For auth details, read references/auth-and-token.md.
• For message-query tool contracts, read references/message-query.md.

Write Workflow

1. Identify the target:
   • If the user provides a uid or groupId, use it directly.
   • If only a person name, employee id, or email prefix is given, run scripts/user_search.py.
   • If only a group name is given, run scripts/group_search.py.
2. Build a dry-run first:

   python3 scripts/mx_safe_send.py \
     --from-id "<sender_uid>" \
     --to-id "<receiver_uid_or_group_id>" \
     --session-type p2p \
     --body "message text"
   

3. Review the dry-run payload. Confirm no token appears in output.
4. Send only after explicit user approval:

   python3 scripts/mx_safe_send.py \
     --from-id "<sender_uid>" \
     --to-id "<receiver_uid_or_group_id>" \
     --session-type p2p \
     --body "message text" \
     --send \
     --confirm-user-authorized
   

For file, image, @user, @all, or push fields, read references/auth-and-token.md and use the copied original scripts only when the user explicitly asks for those behaviors. The original im_send.py also requires --confirm-user-authorized for any live send.

Lookup Commands

Search users:

python3 scripts/user_search.py --keyword "<姓名/工号/邮箱前缀>"

Search groups:

python3 scripts/group_search.py --keyword "<群名关键字>" --limit 5

These commands require a valid token from MX_OC_TOKEN, the current MX/OpenClaw runtime MCP config, or /tmp/ua_token.txt; do not run them if the user asked for static analysis only.

Read Workflow

Use mx_message_sessions, mx_message_list, mx_message_search_global, mx_message_search_session, and mx_message_history only when those tools are exposed in the current Codex tool list.

Do not emulate those tools with filesystem reads. mx_team_info and mx_team_search are documented in the MX package but are not exported by the current dist/src/tools/index, so treat them as unconfirmed until live tool availability proves otherwise.