@gakr-gakr/matrix 0.1.0

package/src/matrix/monitor/direct.ts

@@ -0,0 +1,296 @@
+import { promoteMatrixDirectRoomCandidate } from "../direct-management.js";
+import {
+  hasDirectMatrixMemberFlag,
+  isStrictDirectMembership,
+  readJoinedMatrixMembers,
+} from "../direct-room.js";
+import type { MatrixClient } from "../sdk.js";
+
+type DirectMessageCheck = {
+  roomId: string;
+  senderId?: string;
+  selfUserId?: string;
+};
+
+type DirectRoomTrackerOptions = {
+  log?: (message: string) => void;
+  canPromoteRecentInvite?: (roomId: string) => boolean | Promise<boolean>;
+  canPromoteUnmappedStrictRoom?: (roomId: string) => boolean | Promise<boolean>;
+  shouldKeepLocallyPromotedDirectRoom?:
+    | ((roomId: string) => boolean | undefined | Promise<boolean | undefined>)
+    | undefined;
+};
+
+const DM_CACHE_TTL_MS = 30_000;
+const RECENT_INVITE_TTL_MS = 30_000;
+const MAX_TRACKED_DM_ROOMS = 1024;
+const MAX_TRACKED_DM_MEMBER_FLAGS = 2048;
+
+function rememberBounded<T>(
+  map: Map<string, T>,
+  key: string,
+  value: T,
+  maxSize = MAX_TRACKED_DM_ROOMS,
+): void {
+  map.set(key, value);
+  if (map.size > maxSize) {
+    const oldest = map.keys().next().value;
+    if (typeof oldest === "string") {
+      map.delete(oldest);
+    }
+  }
+}
+
+export function createDirectRoomTracker(client: MatrixClient, opts: DirectRoomTrackerOptions = {}) {
+  const log = opts.log ?? (() => {});
+  let lastDmUpdateMs = 0;
+  // Once m.direct has seeded successfully, prefer the explicit cache over
+  // re-enabling the broad 2-person fallback after a later transient failure.
+  let hasSeededDmCache = false;
+  let cachedSelfUserId: string | null = null;
+  const joinedMembersCache = new Map<string, { members: string[]; ts: number }>();
+  const directMemberFlagCache = new Map<string, { isDirect: boolean | null; ts: number }>();
+  const recentInviteCandidates = new Map<string, { remoteUserId: string; ts: number }>();
+  const locallyPromotedDirectRooms = new Map<string, { remoteUserId: string }>();
+
+  const ensureSelfUserId = async (): Promise<string | null> => {
+    if (cachedSelfUserId) {
+      return cachedSelfUserId;
+    }
+    try {
+      cachedSelfUserId = await client.getUserId();
+    } catch {
+      cachedSelfUserId = null;
+    }
+    return cachedSelfUserId;
+  };
+
+  const refreshDmCache = async (): Promise<void> => {
+    const now = Date.now();
+    if (now - lastDmUpdateMs < DM_CACHE_TTL_MS) {
+      return;
+    }
+    lastDmUpdateMs = now;
+    hasSeededDmCache = (await client.dms.update()) || hasSeededDmCache;
+  };
+
+  const resolveJoinedMembers = async (roomId: string): Promise<string[] | null> => {
+    const cached = joinedMembersCache.get(roomId);
+    const now = Date.now();
+    if (cached && now - cached.ts < DM_CACHE_TTL_MS) {
+      return cached.members;
+    }
+    try {
+      const normalized = await readJoinedMatrixMembers(client, roomId);
+      if (!normalized) {
+        throw new Error("membership unavailable");
+      }
+      rememberBounded(joinedMembersCache, roomId, { members: normalized, ts: now });
+      return normalized;
+    } catch (err) {
+      log(`matrix: dm member lookup failed room=${roomId} (${String(err)})`);
+      return null;
+    }
+  };
+
+  const resolveDirectMemberFlag = async (
+    roomId: string,
+    userId?: string | null,
+  ): Promise<boolean | null> => {
+    const normalizedUserId = userId?.trim();
+    if (!normalizedUserId) {
+      return null;
+    }
+    const cacheKey = `${roomId}\n${normalizedUserId}`;
+    const cached = directMemberFlagCache.get(cacheKey);
+    const now = Date.now();
+    if (cached && now - cached.ts < DM_CACHE_TTL_MS) {
+      return cached.isDirect;
+    }
+    const isDirect = await hasDirectMatrixMemberFlag(client, roomId, normalizedUserId);
+    rememberBounded(
+      directMemberFlagCache,
+      cacheKey,
+      { isDirect, ts: now },
+      MAX_TRACKED_DM_MEMBER_FLAGS,
+    );
+    return isDirect;
+  };
+
+  const hasRecentInviteCandidate = (roomId: string, remoteUserId?: string | null): boolean => {
+    const normalizedRemoteUserId = remoteUserId?.trim();
+    if (!normalizedRemoteUserId) {
+      return false;
+    }
+    const cached = recentInviteCandidates.get(roomId);
+    if (!cached) {
+      return false;
+    }
+    if (Date.now() - cached.ts >= RECENT_INVITE_TTL_MS) {
+      recentInviteCandidates.delete(roomId);
+      return false;
+    }
+    return cached.remoteUserId === normalizedRemoteUserId;
+  };
+
+  const canPromoteRecentInvite = async (roomId: string): Promise<boolean> => {
+    try {
+      return (await opts.canPromoteRecentInvite?.(roomId)) ?? true;
+    } catch (err) {
+      log(`matrix: recent invite promotion veto failed room=${roomId} (${String(err)})`);
+      return false;
+    }
+  };
+
+  const canPromoteUnmappedStrictRoom = async (roomId: string): Promise<boolean> => {
+    try {
+      return (await opts.canPromoteUnmappedStrictRoom?.(roomId)) ?? false;
+    } catch (err) {
+      log(`matrix: unmapped strict room promotion veto failed room=${roomId} (${String(err)})`);
+      return false;
+    }
+  };
+
+  const shouldKeepLocallyPromotedDirectRoom = async (
+    roomId: string,
+  ): Promise<boolean | undefined> => {
+    try {
+      return await opts.shouldKeepLocallyPromotedDirectRoom?.(roomId);
+    } catch (err) {
+      log(`matrix: local promotion keep-check failed room=${roomId} (${String(err)})`);
+      return undefined;
+    }
+  };
+
+  const hasLocallyPromotedDirectRoom = (roomId: string, remoteUserId?: string | null): boolean => {
+    const normalizedRemoteUserId = remoteUserId?.trim();
+    if (!normalizedRemoteUserId) {
+      return false;
+    }
+    return locallyPromotedDirectRooms.get(roomId)?.remoteUserId === normalizedRemoteUserId;
+  };
+
+  const rememberLocallyPromotedDirectRoom = (roomId: string, remoteUserId: string): void => {
+    const normalizedRemoteUserId = remoteUserId.trim();
+    if (!normalizedRemoteUserId) {
+      return;
+    }
+    rememberBounded(locallyPromotedDirectRooms, roomId, {
+      remoteUserId: normalizedRemoteUserId,
+    });
+  };
+
+  return {
+    invalidateRoom: (roomId: string): void => {
+      joinedMembersCache.delete(roomId);
+      for (const key of directMemberFlagCache.keys()) {
+        if (key.startsWith(`${roomId}\n`)) {
+          directMemberFlagCache.delete(key);
+        }
+      }
+      lastDmUpdateMs = 0;
+      log(`matrix: invalidated dm cache room=${roomId}`);
+    },
+    rememberInvite: (roomId: string, remoteUserId: string): void => {
+      const normalizedRemoteUserId = remoteUserId.trim();
+      if (!normalizedRemoteUserId) {
+        return;
+      }
+      rememberBounded(recentInviteCandidates, roomId, {
+        remoteUserId: normalizedRemoteUserId,
+        ts: Date.now(),
+      });
+      log(`matrix: remembered invite candidate room=${roomId} sender=${normalizedRemoteUserId}`);
+    },
+    isDirectMessage: async (params: DirectMessageCheck): Promise<boolean> => {
+      const { roomId, senderId } = params;
+      const selfUserId = params.selfUserId ?? (await ensureSelfUserId());
+      const joinedMembers = await resolveJoinedMembers(roomId);
+      const strictDirectMembership = isStrictDirectMembership({
+        selfUserId,
+        remoteUserId: senderId,
+        joinedMembers,
+      });
+
+      try {
+        await refreshDmCache();
+      } catch (err) {
+        log(`matrix: dm cache refresh failed (${String(err)})`);
+      }
+
+      if (client.dms.isDm(roomId)) {
+        if (strictDirectMembership) {
+          log(`matrix: dm detected via m.direct room=${roomId}`);
+          return true;
+        }
+        log(`matrix: ignoring stale m.direct classification room=${roomId}`);
+      }
+
+      if (strictDirectMembership) {
+        const directViaSelf = await resolveDirectMemberFlag(roomId, selfUserId);
+        if (directViaSelf === true) {
+          log(`matrix: dm detected via member state room=${roomId}`);
+          return true;
+        }
+        if (directViaSelf === false) {
+          log(`matrix: dm rejected via member state room=${roomId}`);
+          return false;
+        }
+
+        if (!hasSeededDmCache) {
+          log(
+            `matrix: dm detected via exact 2-member fallback before dm cache seed room=${roomId}`,
+          );
+          return true;
+        }
+
+        if (hasLocallyPromotedDirectRoom(roomId, senderId)) {
+          const shouldKeep = await shouldKeepLocallyPromotedDirectRoom(roomId);
+          if (shouldKeep !== false) {
+            log(`matrix: dm detected via local promotion room=${roomId}`);
+            return true;
+          }
+          locallyPromotedDirectRooms.delete(roomId);
+          log(`matrix: local promotion cleared room=${roomId}`);
+        }
+
+        if (hasRecentInviteCandidate(roomId, senderId) && (await canPromoteRecentInvite(roomId))) {
+          const promotion = await promoteMatrixDirectRoomCandidate({
+            client,
+            remoteUserId: senderId ?? "",
+            roomId,
+            selfUserId,
+          });
+          if (promotion.classifyAsDirect) {
+            rememberLocallyPromotedDirectRoom(roomId, senderId ?? "");
+            log(
+              `matrix: dm detected via recent invite room=${roomId} reason=${promotion.reason} repaired=${String(promotion.repaired)}`,
+            );
+            return true;
+          }
+        }
+
+        if (await canPromoteUnmappedStrictRoom(roomId)) {
+          const promotion = await promoteMatrixDirectRoomCandidate({
+            client,
+            remoteUserId: senderId ?? "",
+            roomId,
+            selfUserId,
+          });
+          if (promotion.classifyAsDirect) {
+            rememberLocallyPromotedDirectRoom(roomId, senderId ?? "");
+            log(
+              `matrix: dm detected via per-room strict fallback room=${roomId} reason=${promotion.reason} repaired=${String(promotion.repaired)}`,
+            );
+            return true;
+          }
+        }
+      }
+
+      log(
+        `matrix: dm check room=${roomId} result=group members=${joinedMembers?.length ?? "unknown"}`,
+      );
+      return false;
+    },
+  };
+}

package/src/matrix/monitor/events.ts

@@ -0,0 +1,397 @@
+import { normalizeOptionalString } from "autobot/plugin-sdk/string-coerce-runtime";
+import type { PluginRuntime, RuntimeLogger } from "../../runtime-api.js";
+import type { CoreConfig } from "../../types.js";
+import type { MatrixAuth } from "../client.js";
+import { formatMatrixEncryptedEventDisabledWarning } from "../encryption-guidance.js";
+import type { MatrixClient } from "../sdk.js";
+import type { MatrixRawEvent } from "./types.js";
+import { EventType } from "./types.js";
+import { createMatrixVerificationEventRouter } from "./verification-events.js";
+
+const MATRIX_POST_HEALTHY_SYNC_DECRYPT_FAILURE_WINDOW_MS = 2 * 60_000;
+const MATRIX_POST_HEALTHY_SYNC_DECRYPT_FAILURE_THRESHOLD = 3;
+const MATRIX_POST_HEALTHY_SYNC_DECRYPT_FAILURE_SAMPLE_LIMIT = 3;
+
+type MatrixPostHealthySyncDecryptFailureObservation = {
+  key: string;
+  roomId: string;
+  eventId: string;
+  sender: string | null;
+  eventTs: number;
+  error: string;
+};
+
+function formatMatrixPostHealthySyncDecryptionHint(accountId: string): string {
+  return (
+    "matrix: repeated fresh encrypted messages are still failing to decrypt after Matrix resumed healthy sync. " +
+    "This device may still be missing new room keys. " +
+    `Check 'autobot matrix verify status --verbose --account ${accountId}' and 'autobot matrix devices list --account ${accountId}'.`
+  );
+}
+
+function isFreshPostHealthySyncDecryptFailure(params: {
+  event: MatrixRawEvent;
+  healthySyncSinceMs?: number;
+  graceMs?: number;
+  nowMs: number;
+}): boolean {
+  const { event, healthySyncSinceMs, graceMs = 0, nowMs } = params;
+  if (typeof healthySyncSinceMs !== "number" || !Number.isFinite(healthySyncSinceMs)) {
+    return false;
+  }
+  const eventTs = event.origin_server_ts;
+  if (!Number.isFinite(eventTs) || eventTs <= 0) {
+    return false;
+  }
+  if (eventTs < healthySyncSinceMs + graceMs) {
+    return false;
+  }
+  if (eventTs > nowMs + 60_000) {
+    return false;
+  }
+  return true;
+}
+
+function createMatrixPostHealthySyncDecryptFailureTracker(params: {
+  getHealthySyncSinceMs?: () => number | undefined;
+  startupGraceMs?: number;
+}) {
+  let observations: MatrixPostHealthySyncDecryptFailureObservation[] = [];
+  let warningEmitted = false;
+  let trackedHealthySyncSinceMs: number | undefined;
+
+  const resetObservations = () => {
+    observations = [];
+    warningEmitted = false;
+  };
+
+  const pruneObservations = (nowMs: number) => {
+    observations = observations.filter(
+      (entry) => nowMs - entry.eventTs <= MATRIX_POST_HEALTHY_SYNC_DECRYPT_FAILURE_WINDOW_MS,
+    );
+    if (observations.length === 0) {
+      warningEmitted = false;
+    }
+  };
+
+  return {
+    recordFailure(roomId: string, event: MatrixRawEvent, error: Error) {
+      const nowMs = Date.now();
+      const healthySyncSinceMs = params.getHealthySyncSinceMs?.();
+      if (healthySyncSinceMs !== trackedHealthySyncSinceMs) {
+        trackedHealthySyncSinceMs = healthySyncSinceMs;
+        resetObservations();
+      }
+      if (
+        !isFreshPostHealthySyncDecryptFailure({
+          event,
+          healthySyncSinceMs,
+          graceMs: params.startupGraceMs,
+          nowMs,
+        })
+      ) {
+        return { freshAfterHealthySync: false, failureCount: 0 } as const;
+      }
+
+      pruneObservations(nowMs);
+
+      const key = `${roomId}|${event.event_id}`;
+      if (!observations.some((entry) => entry.key === key)) {
+        observations.push({
+          key,
+          roomId,
+          eventId: event.event_id,
+          sender: typeof event.sender === "string" ? event.sender : null,
+          eventTs: event.origin_server_ts,
+          error: error.message,
+        });
+      }
+
+      const failureCount = observations.length;
+      if (warningEmitted || failureCount < MATRIX_POST_HEALTHY_SYNC_DECRYPT_FAILURE_THRESHOLD) {
+        return { freshAfterHealthySync: true, failureCount } as const;
+      }
+
+      warningEmitted = true;
+      const rooms = [...new Set(observations.map((entry) => entry.roomId))].slice(
+        0,
+        MATRIX_POST_HEALTHY_SYNC_DECRYPT_FAILURE_SAMPLE_LIMIT,
+      );
+      const senders = [...new Set(observations.map((entry) => entry.sender).filter(Boolean))].slice(
+        0,
+        MATRIX_POST_HEALTHY_SYNC_DECRYPT_FAILURE_SAMPLE_LIMIT,
+      );
+      const eventIds = observations
+        .slice(-MATRIX_POST_HEALTHY_SYNC_DECRYPT_FAILURE_SAMPLE_LIMIT)
+        .map((entry) => entry.eventId);
+      const latestError = observations.at(-1)?.error ?? error.message;
+      return {
+        freshAfterHealthySync: true,
+        failureCount,
+        warning: {
+          rooms,
+          roomCount: new Set(observations.map((entry) => entry.roomId)).size,
+          senders,
+          senderCount: new Set(observations.map((entry) => entry.sender).filter(Boolean)).size,
+          eventIds,
+          latestError,
+          windowMs: MATRIX_POST_HEALTHY_SYNC_DECRYPT_FAILURE_WINDOW_MS,
+        },
+      } as const;
+    },
+  };
+}
+
+function formatMatrixSelfDecryptionHint(accountId: string): string {
+  return (
+    "matrix: failed to decrypt a message from this same Matrix user. " +
+    "This usually means another Matrix device did not share the room key, or another AutoBot runtime is using the same account. " +
+    `Check 'autobot matrix verify status --verbose --account ${accountId}' and 'autobot matrix devices list --account ${accountId}'.`
+  );
+}
+
+async function resolveMatrixSelfUserId(
+  client: MatrixClient,
+  logVerboseMessage: (message: string) => void,
+): Promise<string | null> {
+  if (typeof client.getUserId !== "function") {
+    return null;
+  }
+  try {
+    return (await client.getUserId()) ?? null;
+  } catch (err) {
+    logVerboseMessage(`matrix: failed resolving self user id for decrypt warning: ${String(err)}`);
+    return null;
+  }
+}
+
+export function registerMatrixMonitorEvents(params: {
+  cfg: CoreConfig;
+  client: MatrixClient;
+  auth: MatrixAuth;
+  allowFrom: string[];
+  dmEnabled: boolean;
+  dmPolicy: "open" | "pairing" | "allowlist" | "disabled";
+  readStoreAllowFrom: () => Promise<string[]>;
+  directTracker?: {
+    invalidateRoom: (roomId: string) => void;
+    rememberInvite?: (roomId: string, remoteUserId: string) => void;
+  };
+  logVerboseMessage: (message: string) => void;
+  warnedEncryptedRooms: Set<string>;
+  warnedCryptoMissingRooms: Set<string>;
+  logger: RuntimeLogger;
+  startupGraceMs?: number;
+  getHealthySyncSinceMs?: () => number | undefined;
+  formatNativeDependencyHint: PluginRuntime["system"]["formatNativeDependencyHint"];
+  onRoomMessage: (roomId: string, event: MatrixRawEvent) => void | Promise<void>;
+  runDetachedTask?: (label: string, task: () => Promise<void>) => Promise<void>;
+  sasNoticeRetryDelayMs?: number;
+}): void {
+  const {
+    cfg,
+    client,
+    auth,
+    allowFrom,
+    dmEnabled,
+    dmPolicy,
+    readStoreAllowFrom,
+    directTracker,
+    logVerboseMessage,
+    warnedEncryptedRooms,
+    warnedCryptoMissingRooms,
+    logger,
+    startupGraceMs,
+    getHealthySyncSinceMs,
+    formatNativeDependencyHint,
+    onRoomMessage,
+    runDetachedTask,
+    sasNoticeRetryDelayMs,
+  } = params;
+  const postHealthySyncDecryptFailureTracker = createMatrixPostHealthySyncDecryptFailureTracker({
+    getHealthySyncSinceMs,
+    startupGraceMs,
+  });
+  const { routeVerificationEvent, routeVerificationSummary } = createMatrixVerificationEventRouter({
+    client,
+    allowFrom,
+    dmEnabled,
+    dmPolicy,
+    readStoreAllowFrom,
+    logVerboseMessage,
+    runDetachedTask,
+    sasNoticeRetryDelayMs,
+  });
+
+  const runMonitorTask = (label: string, task: () => Promise<void>) => {
+    if (runDetachedTask) {
+      return runDetachedTask(label, task);
+    }
+    return Promise.resolve()
+      .then(task)
+      .catch((error) => {
+        logVerboseMessage(`matrix: ${label} failed (${String(error)})`);
+      });
+  };
+
+  client.on("room.message", (roomId: string, event: MatrixRawEvent) => {
+    if (routeVerificationEvent(roomId, event)) {
+      return;
+    }
+    void runMonitorTask(
+      `room message handler room=${roomId} id=${event.event_id ?? "unknown"}`,
+      async () => {
+        await onRoomMessage(roomId, event);
+      },
+    );
+  });
+
+  client.on("room.encrypted_event", (roomId: string, event: MatrixRawEvent) => {
+    const eventId = event?.event_id ?? "unknown";
+    const eventType = event?.type ?? "unknown";
+    logVerboseMessage(`matrix: encrypted event room=${roomId} type=${eventType} id=${eventId}`);
+  });
+
+  client.on("room.decrypted_event", (roomId: string, event: MatrixRawEvent) => {
+    const eventId = event?.event_id ?? "unknown";
+    const eventType = event?.type ?? "unknown";
+    logVerboseMessage(`matrix: decrypted event room=${roomId} type=${eventType} id=${eventId}`);
+    if (routeVerificationEvent(roomId, event)) {
+      return;
+    }
+    if (eventType !== EventType.RoomMessage) {
+      return;
+    }
+    void runMonitorTask(
+      `decrypted room message handler room=${roomId} id=${event.event_id ?? "unknown"}`,
+      async () => {
+        await onRoomMessage(roomId, event);
+      },
+    );
+  });
+
+  client.on(
+    "room.failed_decryption",
+    async (roomId: string, event: MatrixRawEvent, error: Error) => {
+      const failureState = postHealthySyncDecryptFailureTracker.recordFailure(roomId, event, error);
+      const selfUserId = await resolveMatrixSelfUserId(client, logVerboseMessage);
+      const sender = typeof event.sender === "string" ? event.sender : null;
+      const senderMatchesOwnUser = Boolean(selfUserId && sender && selfUserId === sender);
+      logger.warn(
+        failureState.freshAfterHealthySync
+          ? "Failed to decrypt fresh post-healthy-sync message"
+          : "Failed to decrypt message",
+        {
+          roomId,
+          eventId: event.event_id,
+          sender,
+          senderMatchesOwnUser,
+          error: error.message,
+          freshAfterHealthySync: failureState.freshAfterHealthySync,
+          ...(failureState.freshAfterHealthySync
+            ? {
+                postHealthySyncFailureCount: failureState.failureCount,
+              }
+            : {}),
+        },
+      );
+      if (failureState.warning) {
+        logger.warn(formatMatrixPostHealthySyncDecryptionHint(auth.accountId), {
+          roomId,
+          eventId: event.event_id,
+          failureCount: failureState.failureCount,
+          roomCount: failureState.warning.roomCount,
+          rooms: failureState.warning.rooms,
+          senderCount: failureState.warning.senderCount,
+          senders: failureState.warning.senders,
+          sampleEventIds: failureState.warning.eventIds,
+          latestError: failureState.warning.latestError,
+          windowMs: failureState.warning.windowMs,
+        });
+      }
+      if (senderMatchesOwnUser) {
+        logger.warn(formatMatrixSelfDecryptionHint(auth.accountId), {
+          roomId,
+          eventId: event.event_id,
+          sender,
+        });
+      }
+      logVerboseMessage(
+        `matrix: failed decrypt room=${roomId} id=${event.event_id ?? "unknown"} freshAfterHealthySync=${String(failureState.freshAfterHealthySync)} error=${error.message}`,
+      );
+    },
+  );
+
+  client.on("verification.summary", (summary) => {
+    void runMonitorTask("verification summary handler", async () => {
+      await routeVerificationSummary(summary);
+    });
+  });
+
+  client.on("room.invite", (roomId: string, event: MatrixRawEvent) => {
+    directTracker?.invalidateRoom(roomId);
+    const eventId = event?.event_id ?? "unknown";
+    const sender = event?.sender ?? "unknown";
+    const invitee = normalizeOptionalString(event?.state_key) ?? "";
+    const senderIsInvitee =
+      Boolean(invitee) && (normalizeOptionalString(event?.sender) ?? "") === invitee;
+    const isDirect = (event?.content as { is_direct?: boolean } | undefined)?.is_direct === true;
+    const rememberedSender = normalizeOptionalString(event?.sender);
+    if (rememberedSender && !senderIsInvitee) {
+      directTracker?.rememberInvite?.(roomId, rememberedSender);
+    }
+    logVerboseMessage(
+      `matrix: invite room=${roomId} sender=${sender} direct=${String(isDirect)} id=${eventId}`,
+    );
+  });
+
+  client.on("room.join", (roomId: string, event: MatrixRawEvent) => {
+    directTracker?.invalidateRoom(roomId);
+    const eventId = event?.event_id ?? "unknown";
+    logVerboseMessage(`matrix: join room=${roomId} id=${eventId}`);
+  });
+
+  client.on("room.event", (roomId: string, event: MatrixRawEvent) => {
+    const eventType = event?.type ?? "unknown";
+    if (eventType === EventType.RoomMessageEncrypted) {
+      logVerboseMessage(
+        `matrix: encrypted raw event room=${roomId} id=${event?.event_id ?? "unknown"}`,
+      );
+      if (auth.encryption !== true && !warnedEncryptedRooms.has(roomId)) {
+        warnedEncryptedRooms.add(roomId);
+        const warning = formatMatrixEncryptedEventDisabledWarning(cfg, auth.accountId);
+        logger.warn(warning, { roomId });
+      }
+      if (auth.encryption === true && !client.crypto && !warnedCryptoMissingRooms.has(roomId)) {
+        warnedCryptoMissingRooms.add(roomId);
+        const hint = formatNativeDependencyHint({
+          packageName: "@matrix-org/matrix-sdk-crypto-nodejs",
+          manager: "pnpm",
+          downloadCommand: "node node_modules/@matrix-org/matrix-sdk-crypto-nodejs/download-lib.js",
+        });
+        const warning = `matrix: encryption enabled but crypto is unavailable; ${hint}`;
+        logger.warn(warning, { roomId });
+      }
+      return;
+    }
+    if (eventType === EventType.RoomMember) {
+      directTracker?.invalidateRoom(roomId);
+      const membership = (event?.content as { membership?: string } | undefined)?.membership;
+      const stateKey = (event as { state_key?: string }).state_key ?? "";
+      logVerboseMessage(
+        `matrix: member event room=${roomId} stateKey=${stateKey} membership=${membership ?? "unknown"}`,
+      );
+    }
+    if (eventType === EventType.Reaction) {
+      void runMonitorTask(
+        `reaction handler room=${roomId} id=${event.event_id ?? "unknown"}`,
+        async () => {
+          await onRoomMessage(roomId, event);
+        },
+      );
+      return;
+    }
+
+    routeVerificationEvent(roomId, event);
+  });
+}