fb-inbox-forward

Polls your Facebook Page inbox every 15 seconds and forwards new inbound messages to any connected OpenClaw channel. FB credentials are read from the fb-page skill config at runtime.

---

STEP 1 - Load Credentials

FB credentials from fb-page skill:
CODEBLOCK0

If missing, tell user to set up the fb-page skill first.

Forwarding config from ~/.config/fb-inbox-forward/config.json:
CODEBLOCK1

If config.json is missing, run setup:
CODEBLOCK2

Restrict permissions on all config dir files immediately after saving:
CODEBLOCK3

Never commit any file in ~/.config/fb-inbox-forward/ to version control.

---

STEP 2 - Core Actions

Action	How
Start listener	See BACKGROUND LISTENER
Stop listener

See BACKGROUND LISTENER |
| Check status | See BACKGROUND LISTENER |
| View log | Get-Content "$HOME/.config/fb-inbox-forward/listener.log" -Tail 20 |
| Test credentials | GET /me endpoint |

Test credentials:

$fb = Get-Content "$HOME/.config/fb-page/credentials.json" -Raw | ConvertFrom-Json
$r  = Invoke-RestMethod "https://graph.facebook.com/v25.0/me?access_token=$($fb.FB_PAGE_TOKEN)" -ErrorAction Stop
Write-Host "Connected as: $($r.name)"

---

STEP 3 - Error Handling

CODEBLOCK5

Code	Meaning	Fix
190	Token expired/invalid	Re-generate token in fb-page skill
10 / 200

Permission denied | Add pagesreadengagement to your app |
| 368 | Rate limited | Increase POLLINTERVALSEC (try 60+) |
| 100 | Invalid parameter | Check FBPAGEID in fb-page credentials |

---

WORKER SCRIPT (worker.ps1)

This is the exact content written to ~/.config/fb-inbox-forward/worker.ps1.
The scanner and user can verify it here before the listener is started.

External contacts: graph.facebook.com only (conversation list + message fetch).
Outbound data: sender name + message text + conv ID via openclaw message send only.
No other endpoints. No token literals. No additional logging beyond sender name + conv ID.

CODEBLOCK6

---

BACKGROUND LISTENER

OPTIONAL - never start without explicit user request.
WHAT IS READ: FBPAGETOKEN and FBPAGEID from ~/.config/fb-page/credentials.json.
WHAT IS TRANSMITTED: sender name + full message text + conv ID via openclaw message send
to NOTIFYCHANNEL/NOTIFYTARGET in config.json. Message text goes to channel only; never written to disk.
WHAT IS LOGGED: sender name + conv ID only. No message content. No tokens. No secrets.
WORKER SCRIPT: exact content shown in WORKER SCRIPT section above. Written to
~/.config/fb-inbox-forward/worker.ps1 with restricted permissions before process starts.
AUTONOMOUS START: never. Only starts when the user explicitly requests it.

Start

CODEBLOCK7powershell\r?\n(.*?)``').Groups[1].Value Set-Content $worker -Value $workerContent -Encoding UTF8 # Restrict all runtime files before starting if ($env:OS -eq "Windows_NT") { $worker, $logFile, $stateFile, $pidFile | ForEach-Object { New-Item $_ -Force -ItemType File -ErrorAction SilentlyContinue | Out-Null icacls $_ /inheritance:r /grant:r "$($env:USERNAME):(R,W)" | Out-Null } $proc = Start-Process powershell -ArgumentList "-NonInteractive -WindowStyle Hidden -File "$worker"" -PassThru -WindowStyle Hidden } else { $worker, $logFile, $stateFile, $pidFile | ForEach-Object { New-Item $_ -Force -ItemType File -ErrorAction SilentlyContinue | Out-Null & chmod 600 $_ } $proc = Start-Process pwsh -ArgumentList "-NonInteractive -File "$worker"" -PassThru -RedirectStandardOutput "/dev/null" -RedirectStandardError "/dev/null" } @{ pid=$proc.Id; startedAt=(Get-Date).ToString("yyyy-MM-dd HH:mm:ss") } | ConvertTo-Json | Set-Content $pidFile -Encoding UTF8 Write-Host "[fb-inbox-forward] Started! PID: $($proc.Id)" -ForegroundColor Green CODEBLOCK8powershell $pidFile = "$HOME/.config/fb-inbox-forward/listener.pid" if (Test-Path $pidFile) { $s = Get-Content $pidFile -Raw | ConvertFrom-Json Stop-Process -Id $s.pid -Force -ErrorAction SilentlyContinue Remove-Item $pidFile -Force Write-Host "[fb-inbox-forward] Stopped." -ForegroundColor Yellow } else { Write-Host "[fb-inbox-forward] No listener running." } CODEBLOCK9powershell $pidFile = "$HOME/.config/fb-inbox-forward/listener.pid" if (Test-Path $pidFile) { $s = Get-Content $pidFile -Raw | ConvertFrom-Json try { Get-Process -Id $s.pid -ErrorAction Stop | Out-Null Write-Host "[RUNNING] PID: $($s.pid) Started: $($s.startedAt)" -ForegroundColor Green } catch { Write-Host "[STOPPED] Process not found." -ForegroundColor DarkGray } } else { Write-Host "[STOPPED] No listener running." -ForegroundColor DarkGray } ``

---

AGENT RULES

• - Load FB credentials from ~/.config/fb-page/credentials.json. If missing, tell user to set up fb-page skill first.
• Load forwarding config from ~/.config/fb-inbox-forward/config.json. If missing, run setup.
• Never start listener without explicit user request. Confirm destination is trusted first.
• Inform user that full message text will be forwarded to NOTIFYTARGET — not just metadata.
• Worker content is fixed as shown in WORKER SCRIPT section. Do not modify it at runtime.
• Never embed tokens as literals in scripts. Worker reads credentials fresh from disk.
• Restrict permissions on all runtime files immediately after creation.
• Logs must not contain message content — sender name and conv ID only.
• No hardcoded IDs or tokens. All targets and secrets come from config files.
• On any error: parse error.code, map to the table, tell user exactly what to do.
• OS detection: env:OS eq WindowsNT -> powershell; otherwise -> pwsh.