Repository navigation
Conversation
added 3 commits
February 6, 2026 17:29
Adds proper outbound.sendText() implementation that uses the aX MCP messages tool to send messages. This enables: - Heartbeat delivery to ax-platform channel - Cron job delivery with 'Deliver' checkbox - Any agent reply routing to aX spaces Configuration: - outbound.tokenFile: Path to OAuth token JSON file - outbound.mcpEndpoint: MCP server URL (default: https://mcp.paxai.app) - outbound.defaultSpaceId: Default target space for delivery The implementation reads the access token from the configured file (or AX_ACCESS_TOKEN env var) and POSTs to the MCP messages tool. Resolves: empty-heartbeat-file and 'Outbound not configured' errors for cron jobs targeting ax-platform channel.
Implements the aX Platform visibility dashboard following the SEP-1865 MCP Apps Extension specification. Components: - ui/types.ts: DashboardContext schema with identity, space, tools, tasks, activity - ui/dashboard.ts: Flowbite/Tailwind HTML builder for the three-layer dashboard - ui/resource-handler.ts: MCP resources/read handler for ui://ax-platform/dashboard - tools/ax-dashboard.ts: Tool that returns the interactive dashboard Dashboard layers: 1. Header: Agent identity + space anchoring + permission badges 2. Content: Task Kanban board (Backlog → In Progress → Done) 3. Footer: Activity Pulse timeline (user actions + heartbeat work) The dashboard provides full visibility into: - Who: Agent identity via whoami - Where: Current space context - What: Available/restricted tools - History: Recent activity breadcrumbs Co-authored-by: @quantum_phoenix_307
The plugin was calling ${mcpEndpoint}/tools/${toolName} (REST) which doesn't
exist on the MCP server. The server only speaks JSON-RPC at ${mcpEndpoint}/mcp.
Changes:
- api.ts: callAxTool now sends proper JSON-RPC tools/call requests
- Handles both JSON and SSE response formats
- Extracts text content from MCP result envelopes
- Better error messages with response body context
- ax-channel.ts: outbound sendText/sendMedia match ChannelOutboundContext signature
- sendText(ctx: { cfg, to, text, ... }) -> OutboundDeliveryResult
- Added sendMedia for media delivery (text + link fallback)
- Added resolveTarget for proper target resolution
- Uses callAxTool instead of raw fetch to wrong endpoint
This fixes: tools registered by the plugin (ax_messages, ax_tasks, etc.)
returning errors, and outbound delivery (heartbeat/cron) failing silently.
This comment has been minimized.
This comment has been minimized.
1. XSS: Replace inline onclick handlers with data-* attributes + event delegation. Task IDs now escaped via escapeHtml(). 2. Missing space_id: Both sendText and sendMedia now pass space_id to callAxTool so outbound messages route to the correct space. 3. Dead code: Remove unused outboundConfig in createDispatchHandler (only needed in createAxChannel where it's actually used). 4. postMessage origin: Use window.location.origin instead of '*' to prevent data leakage to untrusted parent frames.
Member
Author
|
All 4 findings addressed in
Ready for re-review. @claude |
Member
Author
@claude review pr. |
This comment has been minimized.
This comment has been minimized.
Must-fix: 1. Tool context access — use Record<string, unknown> and check both sessionKey and SessionKey for cross-compatibility 2. Dashboard marked as [Preview] with demo data disclaimer 5. Input validation in callAxTool (mcpEndpoint, authToken, toolName) Should-fix: 3. Removed dead div from escapeHtml 4. Extracted resolveOutboundAuthToken() — eliminates 25 lines of duplication between sendText and sendMedia 2b. Added debug logging for SSE parse errors Nice-to-have: 9. Enhanced JSDoc for extractToolResult with full format docs 7. Consistent context access across all 5 tool files
Member
Author
|
All 9 review findings addressed in Must-fix:
Should-fix: Nice-to-have: Only thing NOT changed: Issue 8 (type assertions with Ready for final review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The plugin was calling
${mcpEndpoint}/tools/${toolName}(REST endpoint) which does not exist on the MCP server. The MCP server only speaks JSON-RPC at${mcpEndpoint}/mcp.This caused:
Fix
callAxTool()now sends proper MCP JSON-RPCtools/callrequests. OutboundsendText/sendMediamatch the ClawdbotChannelOutboundContextinterface and return properOutboundDeliveryResult.Files Changed
extension/lib/api.ts— JSON-RPC protocol, SSE handling, result extractionextension/channel/ax-channel.ts— outbound interface alignment, callAxTool usage