Crap, Cookie beat me again.
I knew it would be impossible to return a value from within an asynchronous onreadystatechange callback, so I went with a synchronous call, which is basically just another way to block Messenger. I must agree that it is much better to just return an empty string when the command is captured and send something whenever the request finishes (without using the return value to send a message). My solution isn't really a solution, your solution is far superior.
And yes, that command parsing is very bad, basically you're pushing all the other commands and scripts out of the way and only let your command through. Not good.
* Matti needs some coffee...
/ 
