@archipelagolab/lobi 1.0.0

package/src/cli.test.ts

@@ -0,0 +1,1015 @@
+import { Command } from "commander";
+import { formatZonedTimestamp } from "openclaw/plugin-sdk/matrix-runtime-shared";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { registerMatrixCli, resetMatrixCliStateForTests } from "./cli.js";
+
+const bootstrapMatrixVerificationMock = vi.fn();
+const getMatrixRoomKeyBackupStatusMock = vi.fn();
+const getMatrixVerificationStatusMock = vi.fn();
+const listMatrixOwnDevicesMock = vi.fn();
+const pruneMatrixStaleGatewayDevicesMock = vi.fn();
+const resolveMatrixAccountConfigMock = vi.fn();
+const resolveMatrixAccountMock = vi.fn();
+const resolveMatrixAuthContextMock = vi.fn();
+const matrixSetupApplyAccountConfigMock = vi.fn();
+const matrixSetupValidateInputMock = vi.fn();
+const matrixRuntimeLoadConfigMock = vi.fn();
+const matrixRuntimeWriteConfigFileMock = vi.fn();
+const resetMatrixRoomKeyBackupMock = vi.fn();
+const restoreMatrixRoomKeyBackupMock = vi.fn();
+const setMatrixSdkConsoleLoggingMock = vi.fn();
+const setMatrixSdkLogModeMock = vi.fn();
+const updateMatrixOwnProfileMock = vi.fn();
+const verifyMatrixRecoveryKeyMock = vi.fn();
+const consoleLogMock = vi.fn();
+const consoleErrorMock = vi.fn();
+
+vi.mock("./matrix/actions/verification.js", () => ({
+  bootstrapMatrixVerification: (...args: unknown[]) => bootstrapMatrixVerificationMock(...args),
+  getMatrixRoomKeyBackupStatus: (...args: unknown[]) => getMatrixRoomKeyBackupStatusMock(...args),
+  getMatrixVerificationStatus: (...args: unknown[]) => getMatrixVerificationStatusMock(...args),
+  resetMatrixRoomKeyBackup: (...args: unknown[]) => resetMatrixRoomKeyBackupMock(...args),
+  restoreMatrixRoomKeyBackup: (...args: unknown[]) => restoreMatrixRoomKeyBackupMock(...args),
+  verifyMatrixRecoveryKey: (...args: unknown[]) => verifyMatrixRecoveryKeyMock(...args),
+}));
+
+vi.mock("./matrix/actions/devices.js", () => ({
+  listMatrixOwnDevices: (...args: unknown[]) => listMatrixOwnDevicesMock(...args),
+  pruneMatrixStaleGatewayDevices: (...args: unknown[]) =>
+    pruneMatrixStaleGatewayDevicesMock(...args),
+}));
+
+vi.mock("./matrix/client/logging.js", () => ({
+  setMatrixSdkConsoleLogging: (...args: unknown[]) => setMatrixSdkConsoleLoggingMock(...args),
+  setMatrixSdkLogMode: (...args: unknown[]) => setMatrixSdkLogModeMock(...args),
+}));
+
+vi.mock("./matrix/actions/profile.js", () => ({
+  updateMatrixOwnProfile: (...args: unknown[]) => updateMatrixOwnProfileMock(...args),
+}));
+
+vi.mock("./matrix/accounts.js", () => ({
+  resolveMatrixAccount: (...args: unknown[]) => resolveMatrixAccountMock(...args),
+  resolveMatrixAccountConfig: (...args: unknown[]) => resolveMatrixAccountConfigMock(...args),
+}));
+
+vi.mock("./matrix/client.js", () => ({
+  resolveMatrixAuthContext: (...args: unknown[]) => resolveMatrixAuthContextMock(...args),
+}));
+
+vi.mock("./setup-core.js", () => ({
+  matrixSetupAdapter: {
+    applyAccountConfig: (...args: unknown[]) => matrixSetupApplyAccountConfigMock(...args),
+    validateInput: (...args: unknown[]) => matrixSetupValidateInputMock(...args),
+  },
+}));
+
+vi.mock("./runtime.js", () => ({
+  getMatrixRuntime: () => ({
+    config: {
+      loadConfig: (...args: unknown[]) => matrixRuntimeLoadConfigMock(...args),
+      writeConfigFile: (...args: unknown[]) => matrixRuntimeWriteConfigFileMock(...args),
+    },
+  }),
+}));
+
+function buildProgram(): Command {
+  const program = new Command();
+  registerMatrixCli({ program });
+  return program;
+}
+
+function formatExpectedLocalTimestamp(value: string): string {
+  return formatZonedTimestamp(new Date(value), { displaySeconds: true }) ?? value;
+}
+
+function mockMatrixVerificationStatus(params: {
+  recoveryKeyCreatedAt: string | null;
+  verifiedAt?: string;
+}) {
+  getMatrixVerificationStatusMock.mockResolvedValue({
+    encryptionEnabled: true,
+    verified: true,
+    localVerified: true,
+    crossSigningVerified: true,
+    signedByOwner: true,
+    userId: "@bot:example.org",
+    deviceId: "DEVICE123",
+    backupVersion: "1",
+    backup: {
+      serverVersion: "1",
+      activeVersion: "1",
+      trusted: true,
+      matchesDecryptionKey: true,
+      decryptionKeyCached: true,
+    },
+    recoveryKeyStored: true,
+    recoveryKeyCreatedAt: params.recoveryKeyCreatedAt,
+    pendingVerifications: 0,
+    verifiedAt: params.verifiedAt,
+  });
+}
+
+describe("matrix CLI verification commands", () => {
+  beforeEach(() => {
+    resetMatrixCliStateForTests();
+    vi.clearAllMocks();
+    process.exitCode = undefined;
+    vi.spyOn(console, "log").mockImplementation((...args: unknown[]) => consoleLogMock(...args));
+    vi.spyOn(console, "error").mockImplementation((...args: unknown[]) =>
+      consoleErrorMock(...args),
+    );
+    consoleLogMock.mockReset();
+    consoleErrorMock.mockReset();
+    matrixSetupValidateInputMock.mockReturnValue(null);
+    matrixSetupApplyAccountConfigMock.mockImplementation(({ cfg }: { cfg: unknown }) => cfg);
+    matrixRuntimeLoadConfigMock.mockReturnValue({});
+    matrixRuntimeWriteConfigFileMock.mockResolvedValue(undefined);
+    resolveMatrixAuthContextMock.mockImplementation(
+      ({ cfg, accountId }: { cfg: unknown; accountId?: string | null }) => ({
+        cfg,
+        env: process.env,
+        accountId: accountId ?? "default",
+        resolved: {},
+      }),
+    );
+    resolveMatrixAccountMock.mockReturnValue({
+      configured: false,
+    });
+    resolveMatrixAccountConfigMock.mockReturnValue({
+      encryption: false,
+    });
+    bootstrapMatrixVerificationMock.mockResolvedValue({
+      success: true,
+      verification: {
+        recoveryKeyCreatedAt: null,
+        backupVersion: null,
+      },
+      crossSigning: {},
+      pendingVerifications: 0,
+      cryptoBootstrap: {},
+    });
+    resetMatrixRoomKeyBackupMock.mockResolvedValue({
+      success: true,
+      previousVersion: "1",
+      deletedVersion: "1",
+      createdVersion: "2",
+      backup: {
+        serverVersion: "2",
+        activeVersion: "2",
+        trusted: true,
+        matchesDecryptionKey: true,
+        decryptionKeyCached: true,
+        keyLoadAttempted: false,
+        keyLoadError: null,
+      },
+    });
+    updateMatrixOwnProfileMock.mockResolvedValue({
+      skipped: false,
+      displayNameUpdated: true,
+      avatarUpdated: false,
+      resolvedAvatarUrl: null,
+      convertedAvatarFromHttp: false,
+    });
+    listMatrixOwnDevicesMock.mockResolvedValue([]);
+    pruneMatrixStaleGatewayDevicesMock.mockResolvedValue({
+      before: [],
+      staleGatewayDeviceIds: [],
+      currentDeviceId: null,
+      deletedDeviceIds: [],
+      remainingDevices: [],
+    });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    process.exitCode = undefined;
+  });
+
+  it("sets non-zero exit code for device verification failures in JSON mode", async () => {
+    verifyMatrixRecoveryKeyMock.mockResolvedValue({
+      success: false,
+      error: "invalid key",
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "device", "bad-key", "--json"], {
+      from: "user",
+    });
+
+    expect(process.exitCode).toBe(1);
+  });
+
+  it("sets non-zero exit code for bootstrap failures in JSON mode", async () => {
+    bootstrapMatrixVerificationMock.mockResolvedValue({
+      success: false,
+      error: "bootstrap failed",
+      verification: {},
+      crossSigning: {},
+      pendingVerifications: 0,
+      cryptoBootstrap: null,
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "bootstrap", "--json"], { from: "user" });
+
+    expect(process.exitCode).toBe(1);
+  });
+
+  it("sets non-zero exit code for backup restore failures in JSON mode", async () => {
+    restoreMatrixRoomKeyBackupMock.mockResolvedValue({
+      success: false,
+      error: "missing backup key",
+      backupVersion: null,
+      imported: 0,
+      total: 0,
+      loadedFromSecretStorage: false,
+      backup: {
+        serverVersion: "1",
+        activeVersion: null,
+        trusted: true,
+        matchesDecryptionKey: false,
+        decryptionKeyCached: false,
+      },
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "backup", "restore", "--json"], {
+      from: "user",
+    });
+
+    expect(process.exitCode).toBe(1);
+  });
+
+  it("sets non-zero exit code for backup reset failures in JSON mode", async () => {
+    resetMatrixRoomKeyBackupMock.mockResolvedValue({
+      success: false,
+      error: "reset failed",
+      previousVersion: "1",
+      deletedVersion: "1",
+      createdVersion: null,
+      backup: {
+        serverVersion: null,
+        activeVersion: null,
+        trusted: null,
+        matchesDecryptionKey: null,
+        decryptionKeyCached: null,
+        keyLoadAttempted: false,
+        keyLoadError: null,
+      },
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "backup", "reset", "--yes", "--json"], {
+      from: "user",
+    });
+
+    expect(process.exitCode).toBe(1);
+  });
+
+  it("lists matrix devices", async () => {
+    listMatrixOwnDevicesMock.mockResolvedValue([
+      {
+        deviceId: "A7hWrQ70ea",
+        displayName: "OpenClaw Gateway",
+        lastSeenIp: "127.0.0.1",
+        lastSeenTs: 1_741_507_200_000,
+        current: true,
+      },
+      {
+        deviceId: "BritdXC6iL",
+        displayName: "OpenClaw Gateway",
+        lastSeenIp: null,
+        lastSeenTs: null,
+        current: false,
+      },
+    ]);
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "devices", "list", "--account", "poe"], { from: "user" });
+
+    expect(listMatrixOwnDevicesMock).toHaveBeenCalledWith({ accountId: "poe" });
+    expect(console.log).toHaveBeenCalledWith("Account: poe");
+    expect(console.log).toHaveBeenCalledWith("- A7hWrQ70ea (current, OpenClaw Gateway)");
+    expect(console.log).toHaveBeenCalledWith("  Last IP: 127.0.0.1");
+    expect(console.log).toHaveBeenCalledWith("- BritdXC6iL (OpenClaw Gateway)");
+  });
+
+  it("prunes stale matrix gateway devices", async () => {
+    pruneMatrixStaleGatewayDevicesMock.mockResolvedValue({
+      before: [
+        {
+          deviceId: "A7hWrQ70ea",
+          displayName: "OpenClaw Gateway",
+          lastSeenIp: "127.0.0.1",
+          lastSeenTs: 1_741_507_200_000,
+          current: true,
+        },
+        {
+          deviceId: "BritdXC6iL",
+          displayName: "OpenClaw Gateway",
+          lastSeenIp: null,
+          lastSeenTs: null,
+          current: false,
+        },
+      ],
+      staleGatewayDeviceIds: ["BritdXC6iL"],
+      currentDeviceId: "A7hWrQ70ea",
+      deletedDeviceIds: ["BritdXC6iL"],
+      remainingDevices: [
+        {
+          deviceId: "A7hWrQ70ea",
+          displayName: "OpenClaw Gateway",
+          lastSeenIp: "127.0.0.1",
+          lastSeenTs: 1_741_507_200_000,
+          current: true,
+        },
+      ],
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "devices", "prune-stale", "--account", "poe"], {
+      from: "user",
+    });
+
+    expect(pruneMatrixStaleGatewayDevicesMock).toHaveBeenCalledWith({ accountId: "poe" });
+    expect(console.log).toHaveBeenCalledWith("Deleted stale OpenClaw devices: BritdXC6iL");
+    expect(console.log).toHaveBeenCalledWith("Current device: A7hWrQ70ea");
+    expect(console.log).toHaveBeenCalledWith("Remaining devices: 1");
+  });
+
+  it("adds a matrix account and prints a binding hint", async () => {
+    matrixRuntimeLoadConfigMock.mockReturnValue({ channels: {} });
+    matrixSetupApplyAccountConfigMock.mockImplementation(
+      ({ cfg, accountId }: { cfg: Record<string, unknown>; accountId: string }) => ({
+        ...cfg,
+        channels: {
+          ...(cfg.channels as Record<string, unknown> | undefined),
+          matrix: {
+            accounts: {
+              [accountId]: {
+                homeserver: "https://matrix.example.org",
+              },
+            },
+          },
+        },
+      }),
+    );
+    const program = buildProgram();
+
+    await program.parseAsync(
+      [
+        "matrix",
+        "account",
+        "add",
+        "--account",
+        "Ops",
+        "--homeserver",
+        "https://matrix.example.org",
+        "--user-id",
+        "@ops:example.org",
+        "--password",
+        "secret",
+      ],
+      { from: "user" },
+    );
+
+    expect(matrixSetupValidateInputMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accountId: "ops",
+        input: expect.objectContaining({
+          homeserver: "https://matrix.example.org",
+          userId: "@ops:example.org",
+          password: "secret", // pragma: allowlist secret
+        }),
+      }),
+    );
+    expect(matrixRuntimeWriteConfigFileMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        channels: {
+          matrix: {
+            accounts: {
+              ops: expect.objectContaining({
+                homeserver: "https://matrix.example.org",
+              }),
+            },
+          },
+        },
+      }),
+    );
+    expect(console.log).toHaveBeenCalledWith("Saved matrix account: ops");
+    expect(console.log).toHaveBeenCalledWith(
+      "Bind this account to an agent: openclaw agents bind --agent <id> --bind matrix:ops",
+    );
+  });
+
+  it("bootstraps verification for newly added encrypted accounts", async () => {
+    resolveMatrixAccountConfigMock.mockReturnValue({
+      encryption: true,
+    });
+    listMatrixOwnDevicesMock.mockResolvedValue([
+      {
+        deviceId: "BritdXC6iL",
+        displayName: "OpenClaw Gateway",
+        lastSeenIp: null,
+        lastSeenTs: null,
+        current: false,
+      },
+      {
+        deviceId: "du314Zpw3A",
+        displayName: "OpenClaw Gateway",
+        lastSeenIp: null,
+        lastSeenTs: null,
+        current: true,
+      },
+    ]);
+    bootstrapMatrixVerificationMock.mockResolvedValue({
+      success: true,
+      verification: {
+        recoveryKeyCreatedAt: "2026-03-09T06:00:00.000Z",
+        backupVersion: "7",
+      },
+      crossSigning: {},
+      pendingVerifications: 0,
+      cryptoBootstrap: {},
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(
+      [
+        "matrix",
+        "account",
+        "add",
+        "--account",
+        "ops",
+        "--homeserver",
+        "https://matrix.example.org",
+        "--user-id",
+        "@ops:example.org",
+        "--password",
+        "secret",
+      ],
+      { from: "user" },
+    );
+
+    expect(bootstrapMatrixVerificationMock).toHaveBeenCalledWith({ accountId: "ops" });
+    expect(console.log).toHaveBeenCalledWith("Matrix verification bootstrap: complete");
+    expect(console.log).toHaveBeenCalledWith(
+      `Recovery key created at: ${formatExpectedLocalTimestamp("2026-03-09T06:00:00.000Z")}`,
+    );
+    expect(console.log).toHaveBeenCalledWith("Backup version: 7");
+    expect(console.log).toHaveBeenCalledWith(
+      "Matrix device hygiene warning: stale OpenClaw devices detected (BritdXC6iL). Run 'openclaw matrix devices prune-stale --account ops'.",
+    );
+  });
+
+  it("does not bootstrap verification when updating an already configured account", async () => {
+    matrixRuntimeLoadConfigMock.mockReturnValue({
+      channels: {
+        matrix: {
+          accounts: {
+            ops: {
+              enabled: true,
+              homeserver: "https://matrix.example.org",
+            },
+          },
+        },
+      },
+    });
+    resolveMatrixAccountConfigMock.mockReturnValue({
+      encryption: true,
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(
+      [
+        "matrix",
+        "account",
+        "add",
+        "--account",
+        "ops",
+        "--homeserver",
+        "https://matrix.example.org",
+        "--user-id",
+        "@ops:example.org",
+        "--password",
+        "secret",
+      ],
+      { from: "user" },
+    );
+
+    expect(bootstrapMatrixVerificationMock).not.toHaveBeenCalled();
+  });
+
+  it("warns instead of failing when device-health probing fails after saving the account", async () => {
+    listMatrixOwnDevicesMock.mockRejectedValue(new Error("homeserver unavailable"));
+    const program = buildProgram();
+
+    await program.parseAsync(
+      [
+        "matrix",
+        "account",
+        "add",
+        "--account",
+        "ops",
+        "--homeserver",
+        "https://matrix.example.org",
+        "--user-id",
+        "@ops:example.org",
+        "--password",
+        "secret",
+      ],
+      { from: "user" },
+    );
+
+    expect(matrixRuntimeWriteConfigFileMock).toHaveBeenCalled();
+    expect(process.exitCode).toBeUndefined();
+    expect(console.log).toHaveBeenCalledWith("Saved matrix account: ops");
+    expect(console.error).toHaveBeenCalledWith(
+      "Matrix device health warning: homeserver unavailable",
+    );
+  });
+
+  it("returns device-health warnings in JSON mode without failing the account add command", async () => {
+    listMatrixOwnDevicesMock.mockRejectedValue(new Error("homeserver unavailable"));
+    const program = buildProgram();
+
+    await program.parseAsync(
+      [
+        "matrix",
+        "account",
+        "add",
+        "--account",
+        "ops",
+        "--homeserver",
+        "https://matrix.example.org",
+        "--user-id",
+        "@ops:example.org",
+        "--password",
+        "secret",
+        "--json",
+      ],
+      { from: "user" },
+    );
+
+    expect(matrixRuntimeWriteConfigFileMock).toHaveBeenCalled();
+    expect(process.exitCode).toBeUndefined();
+    const jsonOutput = consoleLogMock.mock.calls.at(-1)?.[0];
+    expect(typeof jsonOutput).toBe("string");
+    expect(JSON.parse(String(jsonOutput))).toEqual(
+      expect.objectContaining({
+        accountId: "ops",
+        deviceHealth: expect.objectContaining({
+          currentDeviceId: null,
+          staleOpenClawDeviceIds: [],
+          error: "homeserver unavailable",
+        }),
+      }),
+    );
+  });
+
+  it("uses --name as fallback account id and prints account-scoped config path", async () => {
+    matrixRuntimeLoadConfigMock.mockReturnValue({ channels: {} });
+    const program = buildProgram();
+
+    await program.parseAsync(
+      [
+        "matrix",
+        "account",
+        "add",
+        "--name",
+        "Main Bot",
+        "--homeserver",
+        "https://matrix.example.org",
+        "--user-id",
+        "@main:example.org",
+        "--password",
+        "secret",
+      ],
+      { from: "user" },
+    );
+
+    expect(matrixSetupValidateInputMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accountId: "main-bot",
+      }),
+    );
+    expect(console.log).toHaveBeenCalledWith("Saved matrix account: main-bot");
+    expect(console.log).toHaveBeenCalledWith("Config path: channels.lobi.accounts.main-bot");
+    expect(updateMatrixOwnProfileMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accountId: "main-bot",
+        displayName: "Main Bot",
+      }),
+    );
+    expect(console.log).toHaveBeenCalledWith(
+      "Bind this account to an agent: openclaw agents bind --agent <id> --bind matrix:main-bot",
+    );
+  });
+
+  it("forwards --avatar-url through account add setup and profile sync", async () => {
+    matrixRuntimeLoadConfigMock.mockReturnValue({ channels: {} });
+    const program = buildProgram();
+
+    await program.parseAsync(
+      [
+        "matrix",
+        "account",
+        "add",
+        "--name",
+        "Ops Bot",
+        "--homeserver",
+        "https://matrix.example.org",
+        "--access-token",
+        "ops-token",
+        "--avatar-url",
+        "mxc://example/ops-avatar",
+      ],
+      { from: "user" },
+    );
+
+    expect(matrixSetupApplyAccountConfigMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accountId: "ops-bot",
+        input: expect.objectContaining({
+          name: "Ops Bot",
+          homeserver: "https://matrix.example.org",
+          accessToken: "ops-token",
+          avatarUrl: "mxc://example/ops-avatar",
+        }),
+      }),
+    );
+    expect(updateMatrixOwnProfileMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accountId: "ops-bot",
+        displayName: "Ops Bot",
+        avatarUrl: "mxc://example/ops-avatar",
+      }),
+    );
+    expect(console.log).toHaveBeenCalledWith("Saved matrix account: ops-bot");
+    expect(console.log).toHaveBeenCalledWith("Config path: channels.lobi.accounts.ops-bot");
+  });
+
+  it("sets profile name and avatar via profile set command", async () => {
+    const program = buildProgram();
+
+    await program.parseAsync(
+      [
+        "matrix",
+        "profile",
+        "set",
+        "--account",
+        "alerts",
+        "--name",
+        "Alerts Bot",
+        "--avatar-url",
+        "mxc://example/avatar",
+      ],
+      { from: "user" },
+    );
+
+    expect(updateMatrixOwnProfileMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accountId: "alerts",
+        displayName: "Alerts Bot",
+        avatarUrl: "mxc://example/avatar",
+      }),
+    );
+    expect(matrixRuntimeWriteConfigFileMock).toHaveBeenCalled();
+    expect(console.log).toHaveBeenCalledWith("Account: alerts");
+    expect(console.log).toHaveBeenCalledWith("Config path: channels.lobi.accounts.alerts");
+  });
+
+  it("returns JSON errors for invalid account setup input", async () => {
+    matrixSetupValidateInputMock.mockReturnValue("Matrix requires --homeserver");
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "account", "add", "--json"], {
+      from: "user",
+    });
+
+    expect(process.exitCode).toBe(1);
+    expect(console.log).toHaveBeenCalledWith(
+      expect.stringContaining('"error": "Matrix requires --homeserver"'),
+    );
+  });
+
+  it("keeps zero exit code for successful bootstrap in JSON mode", async () => {
+    process.exitCode = 0;
+    bootstrapMatrixVerificationMock.mockResolvedValue({
+      success: true,
+      verification: {},
+      crossSigning: {},
+      pendingVerifications: 0,
+      cryptoBootstrap: {},
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "bootstrap", "--json"], { from: "user" });
+
+    expect(process.exitCode).toBe(0);
+  });
+
+  it("prints local timezone timestamps for verify status output in verbose mode", async () => {
+    const recoveryCreatedAt = "2026-02-25T20:10:11.000Z";
+    mockMatrixVerificationStatus({ recoveryKeyCreatedAt: recoveryCreatedAt });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "status", "--verbose"], { from: "user" });
+
+    expect(console.log).toHaveBeenCalledWith(
+      `Recovery key created at: ${formatExpectedLocalTimestamp(recoveryCreatedAt)}`,
+    );
+    expect(console.log).toHaveBeenCalledWith("Diagnostics:");
+    expect(console.log).toHaveBeenCalledWith("Locally trusted: yes");
+    expect(console.log).toHaveBeenCalledWith("Signed by owner: yes");
+    expect(setMatrixSdkLogModeMock).toHaveBeenCalledWith("default");
+  });
+
+  it("prints local timezone timestamps for verify bootstrap and device output in verbose mode", async () => {
+    const recoveryCreatedAt = "2026-02-25T20:10:11.000Z";
+    const verifiedAt = "2026-02-25T20:14:00.000Z";
+    bootstrapMatrixVerificationMock.mockResolvedValue({
+      success: true,
+      verification: {
+        encryptionEnabled: true,
+        verified: true,
+        userId: "@bot:example.org",
+        deviceId: "DEVICE123",
+        backupVersion: "1",
+        backup: {
+          serverVersion: "1",
+          activeVersion: "1",
+          trusted: true,
+          matchesDecryptionKey: true,
+          decryptionKeyCached: true,
+        },
+        recoveryKeyStored: true,
+        recoveryKeyId: "SSSS",
+        recoveryKeyCreatedAt: recoveryCreatedAt,
+        localVerified: true,
+        crossSigningVerified: true,
+        signedByOwner: true,
+      },
+      crossSigning: {
+        published: true,
+        masterKeyPublished: true,
+        selfSigningKeyPublished: true,
+        userSigningKeyPublished: true,
+      },
+      pendingVerifications: 0,
+      cryptoBootstrap: {},
+    });
+    verifyMatrixRecoveryKeyMock.mockResolvedValue({
+      success: true,
+      encryptionEnabled: true,
+      userId: "@bot:example.org",
+      deviceId: "DEVICE123",
+      backupVersion: "1",
+      backup: {
+        serverVersion: "1",
+        activeVersion: "1",
+        trusted: true,
+        matchesDecryptionKey: true,
+        decryptionKeyCached: true,
+      },
+      verified: true,
+      localVerified: true,
+      crossSigningVerified: true,
+      signedByOwner: true,
+      recoveryKeyStored: true,
+      recoveryKeyId: "SSSS",
+      recoveryKeyCreatedAt: recoveryCreatedAt,
+      verifiedAt,
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "bootstrap", "--verbose"], {
+      from: "user",
+    });
+    await program.parseAsync(["matrix", "verify", "device", "valid-key", "--verbose"], {
+      from: "user",
+    });
+
+    expect(console.log).toHaveBeenCalledWith(
+      `Recovery key created at: ${formatExpectedLocalTimestamp(recoveryCreatedAt)}`,
+    );
+    expect(console.log).toHaveBeenCalledWith(
+      `Verified at: ${formatExpectedLocalTimestamp(verifiedAt)}`,
+    );
+  });
+
+  it("keeps default output concise when verbose is not provided", async () => {
+    const recoveryCreatedAt = "2026-02-25T20:10:11.000Z";
+    mockMatrixVerificationStatus({ recoveryKeyCreatedAt: recoveryCreatedAt });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "status"], { from: "user" });
+
+    expect(console.log).not.toHaveBeenCalledWith(
+      `Recovery key created at: ${formatExpectedLocalTimestamp(recoveryCreatedAt)}`,
+    );
+    expect(console.log).not.toHaveBeenCalledWith("Pending verifications: 0");
+    expect(console.log).not.toHaveBeenCalledWith("Diagnostics:");
+    expect(console.log).toHaveBeenCalledWith("Backup: active and trusted on this device");
+    expect(setMatrixSdkLogModeMock).toHaveBeenCalledWith("quiet");
+  });
+
+  it("shows explicit backup issue in default status output", async () => {
+    getMatrixVerificationStatusMock.mockResolvedValue({
+      encryptionEnabled: true,
+      verified: true,
+      localVerified: true,
+      crossSigningVerified: true,
+      signedByOwner: true,
+      userId: "@bot:example.org",
+      deviceId: "DEVICE123",
+      backupVersion: "5256",
+      backup: {
+        serverVersion: "5256",
+        activeVersion: null,
+        trusted: true,
+        matchesDecryptionKey: false,
+        decryptionKeyCached: false,
+        keyLoadAttempted: true,
+        keyLoadError: null,
+      },
+      recoveryKeyStored: true,
+      recoveryKeyCreatedAt: "2026-02-25T20:10:11.000Z",
+      pendingVerifications: 0,
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "status"], { from: "user" });
+
+    expect(console.log).toHaveBeenCalledWith(
+      "Backup issue: backup decryption key is not loaded on this device (secret storage did not return a key)",
+    );
+    expect(console.log).toHaveBeenCalledWith(
+      "- Backup key is not loaded on this device. Run 'openclaw matrix verify backup restore' to load it and restore old room keys.",
+    );
+    expect(console.log).not.toHaveBeenCalledWith(
+      "- Backup is present but not trusted for this device. Re-run 'openclaw matrix verify device <key>'.",
+    );
+  });
+
+  it("includes key load failure details in status output", async () => {
+    getMatrixVerificationStatusMock.mockResolvedValue({
+      encryptionEnabled: true,
+      verified: true,
+      localVerified: true,
+      crossSigningVerified: true,
+      signedByOwner: true,
+      userId: "@bot:example.org",
+      deviceId: "DEVICE123",
+      backupVersion: "5256",
+      backup: {
+        serverVersion: "5256",
+        activeVersion: null,
+        trusted: true,
+        matchesDecryptionKey: false,
+        decryptionKeyCached: false,
+        keyLoadAttempted: true,
+        keyLoadError: "secret storage key is not available",
+      },
+      recoveryKeyStored: true,
+      recoveryKeyCreatedAt: "2026-02-25T20:10:11.000Z",
+      pendingVerifications: 0,
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "status"], { from: "user" });
+
+    expect(console.log).toHaveBeenCalledWith(
+      "Backup issue: backup decryption key could not be loaded from secret storage (secret storage key is not available)",
+    );
+  });
+
+  it("includes backup reset guidance when the backup key does not match this device", async () => {
+    getMatrixVerificationStatusMock.mockResolvedValue({
+      encryptionEnabled: true,
+      verified: true,
+      localVerified: true,
+      crossSigningVerified: true,
+      signedByOwner: true,
+      userId: "@bot:example.org",
+      deviceId: "DEVICE123",
+      backupVersion: "21868",
+      backup: {
+        serverVersion: "21868",
+        activeVersion: "21868",
+        trusted: true,
+        matchesDecryptionKey: false,
+        decryptionKeyCached: true,
+        keyLoadAttempted: false,
+        keyLoadError: null,
+      },
+      recoveryKeyStored: true,
+      recoveryKeyCreatedAt: "2026-03-09T14:40:00.000Z",
+      pendingVerifications: 0,
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "status"], { from: "user" });
+
+    expect(console.log).toHaveBeenCalledWith(
+      "- If you want a fresh backup baseline and accept losing unrecoverable history, run 'openclaw matrix verify backup reset --yes'. This may also repair secret storage so the new backup key can be loaded after restart.",
+    );
+  });
+
+  it("requires --yes before resetting the Matrix room-key backup", async () => {
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "backup", "reset"], { from: "user" });
+
+    expect(process.exitCode).toBe(1);
+    expect(resetMatrixRoomKeyBackupMock).not.toHaveBeenCalled();
+    expect(console.error).toHaveBeenCalledWith(
+      "Backup reset failed: Refusing to reset Matrix room-key backup without --yes",
+    );
+  });
+
+  it("resets the Matrix room-key backup when confirmed", async () => {
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "backup", "reset", "--yes"], {
+      from: "user",
+    });
+
+    expect(resetMatrixRoomKeyBackupMock).toHaveBeenCalledWith({ accountId: "default" });
+    expect(console.log).toHaveBeenCalledWith("Reset success: yes");
+    expect(console.log).toHaveBeenCalledWith("Previous backup version: 1");
+    expect(console.log).toHaveBeenCalledWith("Deleted backup version: 1");
+    expect(console.log).toHaveBeenCalledWith("Current backup version: 2");
+    expect(console.log).toHaveBeenCalledWith("Backup: active and trusted on this device");
+  });
+
+  it("prints resolved account-aware guidance when a named Matrix account is selected implicitly", async () => {
+    resolveMatrixAuthContextMock.mockImplementation(
+      ({ cfg, accountId }: { cfg: unknown; accountId?: string | null }) => ({
+        cfg,
+        env: process.env,
+        accountId: accountId ?? "assistant",
+        resolved: {},
+      }),
+    );
+    getMatrixVerificationStatusMock.mockResolvedValue({
+      encryptionEnabled: true,
+      verified: false,
+      localVerified: false,
+      crossSigningVerified: false,
+      signedByOwner: false,
+      userId: "@bot:example.org",
+      deviceId: "DEVICE123",
+      backupVersion: null,
+      backup: {
+        serverVersion: null,
+        activeVersion: null,
+        trusted: null,
+        matchesDecryptionKey: null,
+        decryptionKeyCached: null,
+        keyLoadAttempted: false,
+        keyLoadError: null,
+      },
+      recoveryKeyStored: false,
+      recoveryKeyCreatedAt: null,
+      pendingVerifications: 0,
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "status"], { from: "user" });
+
+    expect(getMatrixVerificationStatusMock).toHaveBeenCalledWith({
+      accountId: "assistant",
+      includeRecoveryKey: false,
+    });
+    expect(console.log).toHaveBeenCalledWith("Account: assistant");
+    expect(console.log).toHaveBeenCalledWith(
+      "- Run 'openclaw matrix verify device <key> --account assistant' to verify this device.",
+    );
+    expect(console.log).toHaveBeenCalledWith(
+      "- Run 'openclaw matrix verify bootstrap --account assistant' to create a room key backup.",
+    );
+  });
+
+  it("prints backup health lines for verify backup status in verbose mode", async () => {
+    getMatrixRoomKeyBackupStatusMock.mockResolvedValue({
+      serverVersion: "2",
+      activeVersion: null,
+      trusted: true,
+      matchesDecryptionKey: false,
+      decryptionKeyCached: false,
+      keyLoadAttempted: true,
+      keyLoadError: null,
+    });
+    const program = buildProgram();
+
+    await program.parseAsync(["matrix", "verify", "backup", "status", "--verbose"], {
+      from: "user",
+    });
+
+    expect(console.log).toHaveBeenCalledWith("Backup server version: 2");
+    expect(console.log).toHaveBeenCalledWith("Backup active on this device: no");
+    expect(console.log).toHaveBeenCalledWith("Backup trusted by this device: yes");
+  });
+});