@openclaw/matrix 2026.10.5-beta.4 → 2026.10.10-beta.2

package/dist/.setup/{cli-mbL9jCro.mjs → cli-CEmWh7wh.mjs}

@@ -1,36 +1,29 @@
 import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
 import { a as resolveMatrixAccountConfig, n as hasExplicitMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
-import { p as updateMatrixAccountConfig, r as matrixSetupAdapter, v as resolveMatrixAccountAsync } from "./setup-core-CKnNTfgD.mjs";
+import { l as sanitizeMatrixPathSegment } from "./storage-paths-B51JM-pC.mjs";
+import { p as updateMatrixAccountConfig, r as matrixSetupAdapter, v as resolveMatrixAccountAsync } from "./setup-core-DcCk1_Tv.mjs";
 import { n as resolveMatrixConfigPath } from "./config-paths-CnREYb1Y.mjs";
-import { n as withResolvedActionClient } from "./client-BlTvpEWC.mjs";
-import { d as resolveMatrixAuthContext } from "./client-vPPbaxNp.mjs";
+import { d as resolveMatrixAuthContext } from "./client-C4Gibhzl.mjs";
+import { n as withResolvedActionClient } from "./client-BKiiI29H.mjs";
 import { t as resolveMatrixRoomKeyBackupIssue } from "./backup-health-Dm_YMVFT.mjs";
 import { i as setMatrixConsoleLogging } from "./logger-CXQnpXCt.mjs";
 import { r as setMatrixSdkLogMode } from "./logging-BKV8TYQq.mjs";
 import { n as isOpenClawManagedMatrixDevice, r as summarizeMatrixDeviceHealth } from "./device-health-Be60VF1w.mjs";
-import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-C7bjaGR6.mjs";
-import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-B3VswneT.mjs";
+import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update--Pf3jCXD.mjs";
+import { n as listMatrixCryptoUnsafeState, r as recoverMatrixCryptoUnsafeState } from "./crypto-unsafe-state-doctor-C8szCYmf.mjs";
+import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification--qUbmRd-.mjs";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import path from "node:path";
 import { parseStrictInteger, timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
+import os from "node:os";
 import { formatZonedTimestamp } from "openclaw/plugin-sdk/time-runtime";
 import { readByteStreamWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 import { isDeepStrictEqual } from "node:util";
+import { runWithLocalStateOwner } from "openclaw/plugin-sdk/cli-state-owner";
 import { getRuntimeConfigSnapshot, getRuntimeConfigSourceSnapshot } from "openclaw/plugin-sdk/runtime-config-snapshot";
 //#region extensions/matrix/src/cli-shared.ts
-let matrixCliExitScheduled = false;
 const MATRIX_CLI_RECOVERY_KEY_STDIN_MAX_BYTES = 1048576;
-function scheduleMatrixCliExit() {
-	if (matrixCliExitScheduled || process.env.VITEST) return;
-	matrixCliExitScheduled = true;
-	setTimeout(() => {
-		process.stdout.write("", () => {
-			process.stderr.write("", () => {
-				process.exit(process.exitCode ?? 0);
-			});
-		});
-	}, 0);
-}
 async function readMatrixCliRecoveryKeyFromStdin() {
 	const recoveryKey = (await readByteStreamWithLimit(process.stdin, {
 		maxBytes: MATRIX_CLI_RECOVERY_KEY_STDIN_MAX_BYTES,
@@ -134,13 +127,23 @@ function parseOptionalInt(value, fieldName, opts = {}) {
 	return parsed;
 }
 async function runMatrixCliAccountCommand(options, config) {
-	const context = resolveMatrixCliAccountContext(options.account);
+	let accountId = normalizeAccountId(options.account);
 	await runMatrixCliCommand(options, {
 		...config,
-		run: () => config.run(context),
+		...config.gateway ? { gateway: {
+			...config.gateway,
+			onAccount: (id) => {
+				accountId = id;
+			}
+		} } : {},
+		run: () => {
+			const context = resolveMatrixCliAccountContext(options.account);
+			accountId = context.accountId;
+			return config.run(context);
+		},
 		onText: (result, verbose) => {
-			printAccountLabel(context.accountId);
-			config.onText(result, verbose, context.accountId);
+			printAccountLabel(accountId);
+			config.onText(result, verbose, accountId);
 		}
 	});
 }
@@ -150,7 +153,15 @@ async function runMatrixCliCommand(options, config) {
 	setMatrixSdkLogMode(verbose ? "default" : "quiet");
 	setMatrixConsoleLogging(verbose);
 	try {
-		const result = await config.run();
+		const outcome = await runWithLocalStateOwner({
+			method: config.gateway?.method ?? "matrix.cli",
+			params: await config.gateway?.params() ?? {},
+			target: "Matrix account state",
+			...config.gateway ? {} : { onForeignOwner: "refuse" },
+			runLocal: async () => ({ result: await config.run() })
+		});
+		if (outcome.accountId) config.gateway?.onAccount?.(outcome.accountId);
+		const result = outcome.result;
 		if (json) printJson(config.onJson ? config.onJson(result) : result);
 		else config.onText(result, verbose);
 		if (config.shouldFail?.(result)) process.exitCode = 1;
@@ -162,8 +173,6 @@ async function runMatrixCliCommand(options, config) {
 			config.onTextError?.(message);
 		}
 		process.exitCode = 1;
-	} finally {
-		scheduleMatrixCliExit();
 	}
 }
 function sanitizeMatrixCliText(value) {
@@ -396,7 +405,7 @@ async function addMatrixAccount(params) {
 			backupVersion: null
 		};
 		if (accountConfig.encryption === true) {
-			const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-CV-hHBXu.mjs");
+			const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-DmznRqYe.mjs");
 			verificationBootstrap = await maybeBootstrapNewEncryptedMatrixAccount({
 				previousCfg: cfg,
 				cfg: updated,
@@ -586,7 +595,7 @@ function printDirectRoomInspection(result) {
 }
 async function inspectMatrixDirectRoom(params) {
 	const cfg = getMatrixRuntime().config.current();
-	const [{ withResolvedActionClient }, { inspectMatrixDirectRooms }] = await Promise.all([import("./client-BlTvpEWC.mjs").then((n) => n.t), import("./direct-management-B3wYhx_M.mjs").then((n) => n.t)]);
+	const [{ withResolvedActionClient }, { inspectMatrixDirectRooms }] = await Promise.all([import("./client-BKiiI29H.mjs").then((n) => n.t), import("./direct-management-B3wYhx_M.mjs").then((n) => n.t)]);
 	return await withResolvedActionClient({
 		accountId: params.accountId,
 		cfg
@@ -604,7 +613,7 @@ async function repairMatrixDirectRoom(params) {
 		cfg,
 		accountId: params.accountId
 	});
-	const [{ withStartedActionClient }, { repairMatrixDirectRooms }] = await Promise.all([import("./client-BlTvpEWC.mjs").then((n) => n.t), import("./direct-management-B3wYhx_M.mjs").then((n) => n.t)]);
+	const [{ withStartedActionClient }, { repairMatrixDirectRooms }] = await Promise.all([import("./client-BKiiI29H.mjs").then((n) => n.t), import("./direct-management-B3wYhx_M.mjs").then((n) => n.t)]);
 	return await withStartedActionClient({
 		accountId: params.accountId,
 		cfg
@@ -676,6 +685,35 @@ function registerMatrixDirectCommands(root) {
 	});
 }
 //#endregion
+//#region extensions/matrix/src/cli-doctor.ts
+function registerMatrixDoctorCommands(root) {
+	const accountForRoot = (rootDir, stateDir) => rootDir === path.resolve(stateDir, "matrix") ? "default" : path.basename(path.dirname(path.dirname(rootDir)));
+	const doctor = root.command("doctor").description("Inspect and recover Matrix crypto storage refusal");
+	doctor.command("inspect").description("List accounts blocked by an unsafe crypto final save (read-only)").option("--json", "Output JSON").action(async (options) => {
+		const stateDir = getMatrixRuntime().state.resolveStateDir(process.env, os.homedir);
+		const accounts = (await listMatrixCryptoUnsafeState(stateDir)).map((rootDir) => ({
+			account: accountForRoot(rootDir, stateDir),
+			rootDir
+		}));
+		if (options.json) console.log(JSON.stringify({ blocked: accounts }, null, 2));
+		else {
+			console.log(accounts.length ? `Matrix crypto refusal: ${accounts.length} account store(s) blocked` : "No blocked Matrix crypto stores found.");
+			for (const account of accounts) console.log(`- ${account.account}: ${account.rootDir}`);
+		}
+	});
+	doctor.command("recover").description("Accept rollback to a validated SQLite snapshot and clear one account's refusal").requiredOption("--account <id>", "Blocked account ID").requiredOption("--accept-snapshot-rollback", "Acknowledge that keys from the failed owner may be lost").action(async (options) => {
+		const stateDir = getMatrixRuntime().state.resolveStateDir(process.env, os.homedir);
+		const account = sanitizeMatrixPathSegment(normalizeAccountId(options.account));
+		const roots = (await listMatrixCryptoUnsafeState(stateDir)).filter((rootDir) => accountForRoot(rootDir, stateDir) === account);
+		if (roots.length !== 1) throw new Error(`Expected exactly one blocked Matrix crypto store for account ${account}; found ${roots.length}. Refusing ambiguous recovery.`);
+		await recoverMatrixCryptoUnsafeState({
+			storageRootDir: roots[0],
+			acceptSnapshotRollback: options.acceptSnapshotRollback === true
+		});
+		console.log(`Matrix crypto refusal cleared for account ${account}; restart the Gateway.`);
+	});
+}
+//#endregion
 //#region extensions/matrix/src/cli-encryption.ts
 function isMatrixVerificationSetupComplete(status) {
 	return status.encryptionEnabled && status.verified && status.crossSigningVerified && status.signedByOwner && status.serverDeviceKnown === true && resolveMatrixRoomKeyBackupIssue(status.backup).code === "ok";
@@ -881,11 +919,20 @@ function registerMatrixVerificationBackupCommands(verify) {
 		});
 	});
 	verify.command("bootstrap").description("Bootstrap Matrix cross-signing and device verification state").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key <key>", "Recovery key to apply before bootstrap (prefer --recovery-key-stdin)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--force-reset-cross-signing", "Force reset cross-signing identity before bootstrap (requires active recovery key)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		const recoveryKey = resolveMatrixCliRecoveryKeyInput(options);
 		await runMatrixCliAccountCommand(options, {
+			gateway: {
+				method: "matrix.verify.bootstrap.owner",
+				params: async () => ({
+					accountId: options.account,
+					recoveryKey: await recoveryKey,
+					forceResetCrossSigning: options.forceResetCrossSigning === true
+				})
+			},
 			run: async ({ accountId, cfg }) => await bootstrapMatrixVerification({
 				accountId,
 				cfg,
-				recoveryKey: await resolveMatrixCliRecoveryKeyInput(options),
+				recoveryKey: await recoveryKey,
 				forceResetCrossSigning: options.forceResetCrossSigning === true
 			}),
 			onText: (result, verbose, accountId) => {
@@ -917,11 +964,19 @@ function registerMatrixVerificationBackupCommands(verify) {
 		});
 	});
 	verify.command("device [key]").description("Verify device using a Matrix recovery key").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (key, options) => {
+		const recoveryKey = requireMatrixCliRecoveryKeyInput({
+			recoveryKey: key,
+			recoveryKeyStdin: options.recoveryKeyStdin
+		});
 		await runMatrixCliAccountCommand(options, {
-			run: async ({ accountId, cfg }) => await verifyMatrixRecoveryKey(await requireMatrixCliRecoveryKeyInput({
-				recoveryKey: key,
-				recoveryKeyStdin: options.recoveryKeyStdin
-			}), {
+			gateway: {
+				method: "matrix.verify.recoveryKey.owner",
+				params: async () => ({
+					accountId: options.account,
+					key: await recoveryKey
+				})
+			},
+			run: async ({ accountId, cfg }) => await verifyMatrixRecoveryKey(await recoveryKey, {
 				accountId,
 				cfg
 			}),
@@ -1165,16 +1220,14 @@ function registerMatrixVerificationCommands(root) {
 		errorPrefix: "Verification start failed"
 	});
 	verify.command("sas <id>").description("Show SAS emoji or decimals for a Matrix verification request").option("--account <id>", "Account ID (for multi-account setups)").option("--user-id <id>", "Matrix user ID for DM verification follow-up").option("--room-id <id>", "Matrix direct-message room ID for verification follow-up").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (id, options) => {
-		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
-		await runMatrixCliCommand(options, {
-			run: () => getMatrixVerificationSas(id, {
+		await runMatrixCliAccountCommand(options, {
+			run: ({ accountId, cfg }) => getMatrixVerificationSas(id, {
 				accountId,
 				cfg,
 				...matrixCliVerificationDmLookupOptions(options)
 			}),
-			onText: (sas) => {
+			onText: (sas, _verbose, accountId) => {
 				const requestId = formatMatrixCliText(id);
-				printAccountLabel(accountId);
 				console.log(`Verification id: ${requestId}`);
 				printMatrixVerificationSas(sas);
 				printMatrixVerificationSasGuidance(requestId, accountId, formatMatrixVerificationDmFollowupParts(options));
@@ -1209,6 +1262,14 @@ function registerMatrixVerificationCommands(root) {
 	});
 	verify.command("status").description("Check Matrix device verification status").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--include-recovery-key", "Include stored recovery key in output").option("--allow-degraded-local-state", "Return best-effort diagnostics without preparing the Matrix account").option("--json", "Output as JSON").action(async (options) => {
 		await runMatrixCliAccountCommand(options, {
+			gateway: {
+				method: "matrix.verify.status.owner",
+				params: () => ({
+					accountId: options.account,
+					includeRecoveryKey: options.includeRecoveryKey === true,
+					allowDegradedLocalState: options.allowDegradedLocalState === true
+				})
+			},
 			run: ({ accountId, cfg }) => getMatrixVerificationStatus({
 				accountId,
 				cfg,
@@ -1234,6 +1295,7 @@ function registerMatrixCli(params) {
 	registerMatrixEncryptionCommands(root);
 	registerMatrixVerificationCommands(root);
 	registerMatrixDeviceCommands(root);
+	registerMatrixDoctorCommands(root);
 }
 //#endregion
 export { registerMatrixCli };

package/dist/.setup/{cli-metadata-6MOGuyHq.mjs → cli-metadata-CBLGwJT6.mjs}

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/matrix/src/cli-metadata.ts
 function registerMatrixCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerMatrixCli } = await import("./cli-mbL9jCro.mjs");
+		const { registerMatrixCli } = await import("./cli-CEmWh7wh.mjs");
 		registerMatrixCli({ program });
 	}, { descriptors: [{
 		name: "matrix",

package/dist/.setup/{client-BlTvpEWC.mjs → client-BKiiI29H.mjs}

@@ -1,5 +1,5 @@
 import { i as __exportAll } from "./doctor-contract-CsTNmbMa.mjs";
-import { C as resolveMatrixRoomId } from "./send-LCOuTVc1.mjs";
+import { C as resolveMatrixRoomId } from "./send-BprM-Wmx.mjs";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 //#region extensions/matrix/src/matrix/actions/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
@@ -7,8 +7,8 @@ var client_exports = /* @__PURE__ */ __exportAll({
 	withResolvedRoomAction: () => withResolvedRoomAction,
 	withStartedActionClient: () => withStartedActionClient
 });
-const loadMatrixActionClientRuntime = createLazyRuntimeModule(() => import("./client-bootstrap-D05xy1HB.mjs"));
-async function withResolvedActionClient(opts, run, mode = "stop") {
+const loadMatrixActionClientRuntime = createLazyRuntimeModule(() => import("./client-bootstrap-kOIDV4z_.mjs"));
+async function withResolvedActionClient(opts, run, mode = "persist") {
 	const { withResolvedRuntimeMatrixClient } = await loadMatrixActionClientRuntime();
 	return await withResolvedRuntimeMatrixClient(opts, run, mode);
 }

package/dist/.setup/{client-vPPbaxNp.mjs → client-C4Gibhzl.mjs}

@@ -5,7 +5,7 @@ import { t as getMatrixScopedEnvVarNames } from "./env-vars-aEBngJPa.mjs";
 import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as findMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
 import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.mjs";
 import { n as validateMatrixHomeserverUrl, t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-CF6pG6eE.mjs";
-import { i as repairCurrentTokenStorageMetaDeviceId } from "./storage-DkC6bHgA.mjs";
+import { i as repairCurrentTokenStorageMetaDeviceId } from "./storage-l8V0XsGM.mjs";
 import { createLazyRuntimeMethod, createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
 import { formatErrorMessage, toErrorObject, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
@@ -15,12 +15,13 @@ import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime
 import { ssrfPolicyFromDangerouslyAllowPrivateNetwork } from "openclaw/plugin-sdk/ssrf-runtime";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { racePromiseWithAbortSignal, raceWithTimeout } from "openclaw/plugin-sdk/time-runtime";
 import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { resolveGlobalSingleton } from "openclaw/plugin-sdk/global-singleton";
+import { racePromiseWithAbortSignal, raceWithTimeout } from "openclaw/plugin-sdk/time-runtime";
 //#region extensions/matrix/src/matrix/client/auth-request.ts
-const loadMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-Cfc6m7fY.mjs").then((n) => n.t), import("./logging-BKV8TYQq.mjs").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
+const loadMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-ByU8So5S.mjs").then((n) => n.t), import("./logging-BKV8TYQq.mjs").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
 	MatrixClient: sdkModule.MatrixClient,
 	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
 })));
@@ -89,8 +90,8 @@ async function fetchMatrixWhoamiIdentity(params) {
 }
 //#endregion
 //#region extensions/matrix/src/matrix/client/config.ts
-const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-CqRiEAQa.mjs").then((n) => n.i));
-const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-Bf9PQ7xs.mjs"));
+const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-D2ULV55A.mjs").then((n) => n.i));
+const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-CPnJZaZB.mjs"));
 const loadMatrixSecretInputDeps = createLazyRuntimeModule(() => import("openclaw/plugin-sdk/secret-input-runtime"));
 function credentialsMatchBackfillAuthLineage(params) {
 	if (!params.stored) return true;
@@ -378,16 +379,21 @@ async function resolveMatrixAuth(params) {
 		ssrfPolicy: resolved.ssrfPolicy,
 		dispatcherPolicy: resolved.dispatcherPolicy
 	});
-	const login = await retryMatrixAuthRequest("matrix auth login", async () => await loginClient.doRequest("POST", "/_matrix/client/v3/login", void 0, {
-		type: "m.login.password",
-		identifier: {
-			type: "m.id.user",
-			user: resolved.userId
-		},
-		password,
-		device_id: resolved.deviceId,
-		initial_device_display_name: resolved.deviceName ?? "OpenClaw Gateway"
-	}));
+	let login;
+	try {
+		login = await retryMatrixAuthRequest("matrix auth login", async () => await loginClient.doRequest("POST", "/_matrix/client/v3/login", void 0, {
+			type: "m.login.password",
+			identifier: {
+				type: "m.id.user",
+				user: resolved.userId
+			},
+			password,
+			device_id: resolved.deviceId,
+			initial_device_display_name: resolved.deviceName ?? "OpenClaw Gateway"
+		}));
+	} finally {
+		await loginClient.stopWithoutPersist();
+	}
 	const loginAccessToken = login.access_token?.trim();
 	if (!loginAccessToken) throw new Error("Matrix login did not return an access token");
 	const auth = buildResolvedMatrixAuth(resolved, {
@@ -517,10 +523,23 @@ async function awaitMatrixStartupWithAbort(promise, abortSignal) {
 }
 //#endregion
 //#region extensions/matrix/src/matrix/client/shared.ts
-const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => import("./create-client-CroC4BVc.mjs"));
+const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => import("./create-client-BS8UYx6N.mjs"));
 const MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS = 5e3;
-const sharedClientStates = /* @__PURE__ */ new Map();
-const sharedClientPromises = /* @__PURE__ */ new Map();
+const sharedClientRegistry = resolveGlobalSingleton(Symbol.for("openclaw.matrix.shared-client-registry"), () => ({
+	states: /* @__PURE__ */ new Map(),
+	promises: /* @__PURE__ */ new Map(),
+	storageOwners: /* @__PURE__ */ new Map()
+}));
+const sharedClientStates = sharedClientRegistry.states;
+const sharedClientPromises = sharedClientRegistry.promises;
+const sharedStorageOwners = sharedClientRegistry.storageOwners;
+var MatrixTransportGenerationBusyError = class extends Error {
+	constructor() {
+		super("Matrix account transport is changing; retry after the account restart finishes.");
+		this.code = "MATRIX_ACCOUNT_RESTARTING";
+		this.retryable = true;
+	}
+};
 function buildSharedClientKey(auth) {
 	return JSON.stringify([
 		auth.homeserver,
@@ -538,8 +557,9 @@ async function createSharedMatrixClient(params) {
 		client: await createMatrixClient({
 			...params.auth,
 			localTimeoutMs: params.timeoutMs
-		}),
+		}, params.preparedStorage),
 		key: buildSharedClientKey(params.auth),
+		storageOwnerKey: params.preparedStorage.storagePaths?.idbSnapshotPath ?? null,
 		started: false,
 		startPromise: null,
 		phase: "open",
@@ -553,30 +573,17 @@ async function createSharedMatrixClient(params) {
 	};
 }
 function deleteSharedClientState(state) {
-	if (sharedClientStates.get(state.key) === state) sharedClientStates.delete(state.key);
+	if (sharedClientStates.get(state.key) === state) {
+		sharedClientStates.delete(state.key);
+		if (state.storageOwnerKey) sharedStorageOwners.delete(state.storageOwnerKey);
+	}
 	const detachLifecycle = state.detachLifecycle;
 	state.detachLifecycle = void 0;
 	detachLifecycle?.();
 }
 function bindSharedClientLifecycle(state, lifecycle) {
 	if (!lifecycle) return;
-	const retire = () => forceRetireState(state);
-	const onAbort = () => {
-		retire().catch(() => void 0);
-	};
-	lifecycle.signal.addEventListener("abort", onAbort, { once: true });
-	let removeDisposer;
-	try {
-		removeDisposer = lifecycle.onDispose(retire);
-	} catch (error) {
-		lifecycle.signal.removeEventListener("abort", onAbort);
-		throw error;
-	}
-	state.detachLifecycle = () => {
-		lifecycle.signal.removeEventListener("abort", onAbort);
-		removeDisposer();
-	};
-	if (lifecycle.signal.aborted) onAbort();
+	state.detachLifecycle = lifecycle.onDispose(() => forceRetireState(state));
 }
 async function ensureSharedClientStarted(state, abortSignal) {
 	if (state.started) return;
@@ -626,12 +633,28 @@ async function resolveOpenSharedMatrixClientState(params, lifecycle) {
 			await awaitMatrixStartupWithAbort(pending, params.abortSignal);
 			continue;
 		}
+		const { prepareMatrixClientStorage } = await loadMatrixCreateClientDeps();
+		const preparedStorage = await prepareMatrixClientStorage(auth);
+		throwIfMatrixStartupAborted(params.abortSignal);
+		if (sharedClientStates.has(key) || sharedClientPromises.has(key)) continue;
+		const storageOwnerKey = preparedStorage.storagePaths?.idbSnapshotPath ?? null;
+		const ownerPromise = storageOwnerKey ? sharedStorageOwners.get(storageOwnerKey) : void 0;
+		if (ownerPromise) {
+			const owner = await awaitMatrixStartupWithAbort(ownerPromise, params.abortSignal);
+			if (owner.retirementPromise) {
+				await awaitMatrixStartupWithAbort(owner.retirementPromise, params.abortSignal);
+				continue;
+			}
+			throw new MatrixTransportGenerationBusyError();
+		}
 		const creationPromise = createSharedMatrixClient({
 			auth,
 			timeoutMs: params.timeoutMs,
-			lifecycle
+			lifecycle,
+			preparedStorage
 		});
 		sharedClientPromises.set(key, creationPromise);
+		if (storageOwnerKey) sharedStorageOwners.set(storageOwnerKey, creationPromise);
 		try {
 			const created = await creationPromise;
 			sharedClientStates.set(key, created);
@@ -644,6 +667,7 @@ async function resolveOpenSharedMatrixClientState(params, lifecycle) {
 			return created;
 		} finally {
 			if (sharedClientPromises.get(key) === creationPromise) sharedClientPromises.delete(key);
+			if (storageOwnerKey && !sharedClientStates.has(key) && sharedStorageOwners.get(storageOwnerKey) === creationPromise) sharedStorageOwners.delete(storageOwnerKey);
 		}
 	}
 }
@@ -681,40 +705,20 @@ function forceReleaseLeases(state, releasePromise) {
 	state.leases.clear();
 	state.noLeases.resolve();
 }
-async function waitForRetirementDrain(state, task, isPending, timeoutMessage) {
-	if (!isPending()) return;
-	await raceWithTimeout(task, MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS, () => {
-		if (!isPending()) return task;
-		state.phase = "late-drain";
-		throw new Error(timeoutMessage);
+function waitForRetirement(retirement) {
+	return raceWithTimeout(retirement, MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS, () => {
+		throw new Error("Matrix client retirement did not settle within 5000ms");
 	}, { ref: false });
 }
 function beginGenerationRetirement(params) {
 	const { state } = params;
-	if (state.retirementPromise) return state.retirementPromise;
-	state.phase = "quiescing";
+	if (state.retirementPromise) return waitForRetirement(state.retirementPromise);
+	state.phase = "retiring";
 	if (state.leases.size === 0) state.noLeases.resolve();
 	const result = createDeferred();
 	state.retirementPromise = result.promise;
 	Promise.resolve().then(async () => {
-		const startup = state.startPromise;
-		if (startup) try {
-			await waitForRetirementDrain(state, startup.catch(() => void 0), () => state.startPromise === startup, `Matrix client startup did not settle within ${MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS}ms during retirement`);
-		} catch (error) {
-			state.poisonError = toStringifiedError(error);
-			result.reject(state.poisonError);
-			const failure = (await Promise.allSettled([
-				startup.catch(() => void 0).then(async () => {
-					state.started = false;
-					await state.client.stopWithoutPersist();
-				}),
-				retireMonitorLeases(state, params.monitorLeases ?? []),
-				state.noLeases.promise
-			])).find((outcome) => outcome.status === "rejected");
-			if (failure) state.poisonError = toStringifiedError(failure.reason);
-			else deleteSharedClientState(state);
-			throw state.poisonError;
-		}
+		await state.startPromise?.catch(() => void 0);
 		try {
 			await state.client.quiesceSync();
 			state.started = false;
@@ -722,30 +726,16 @@ function beginGenerationRetirement(params) {
 		} catch (error) {
 			state.poisonError = toStringifiedError(error);
 		}
-		let monitorRetired = true;
 		try {
 			await retireMonitorLeases(state, params.monitorLeases ?? []);
 		} catch (error) {
 			state.poisonError ??= toStringifiedError(error);
-			monitorRetired = false;
-		}
-		state.phase = "closing";
-		let lateLeaseDrain = null;
-		try {
-			await waitForRetirementDrain(state, state.noLeases.promise, () => state.leases.size > 0, `Matrix transient leases did not drain within ${MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS}ms`);
-		} catch (error) {
-			state.poisonError ??= toStringifiedError(error);
-			result.reject(state.poisonError);
-			lateLeaseDrain = state.noLeases.promise;
 		}
+		await state.noLeases.promise;
+		if (state.poisonError) await state.client.drainPendingDecryptions("matrix failed shutdown").catch((error) => {
+			state.poisonError = toStringifiedError(error);
+		});
 		let failure = state.poisonError;
-		let canDelete = monitorRetired;
-		if (failure) canDelete = await state.client.drainPendingDecryptions("matrix poisoned client shutdown").then(() => true, () => false) && canDelete;
-		else try {
-			await state.client.drainPendingDecryptions("matrix shared client final shutdown");
-		} catch (error) {
-			failure = state.poisonError = toStringifiedError(error);
-		}
 		let discard = failure !== null || state.releaseMode === "discard";
 		if (!discard) try {
 			await state.client.stopAndPersist();
@@ -753,19 +743,18 @@ function beginGenerationRetirement(params) {
 			discard = true;
 			if (state.releaseMode === "persist") failure = state.poisonError = toStringifiedError(error);
 		}
-		if (discard) await state.client.stopWithoutPersist().catch((error) => {
-			failure = state.poisonError = toStringifiedError(error);
-			canDelete = false;
-		});
-		await lateLeaseDrain;
-		if (canDelete) deleteSharedClientState(state);
+		if (discard) await state.client.stopWithoutPersist();
+		deleteSharedClientState(state);
 		if (failure) throw failure;
-	}).then(result.resolve, result.reject);
+	}).then(result.resolve, (error) => {
+		state.poisonError = toStringifiedError(error);
+		result.reject(state.poisonError);
+	});
 	abortTransientLeases(state);
-	return state.retirementPromise;
+	return waitForRetirement(state.retirementPromise);
 }
 function createSharedMatrixClientLease(state, role) {
-	if (state.phase !== "open" || state.poisonError) return null;
+	if (state.phase !== "open" || state.poisonError) throw new Error("Matrix client is retiring; retry the operation after shutdown");
 	const leaseState = {
 		abortController: new AbortController(),
 		monitorRetirement: null,
@@ -779,9 +768,6 @@ function createSharedMatrixClientLease(state, role) {
 		client: state.client,
 		role,
 		registerMonitorRetirement: (retirement) => {
-			if (role !== "monitor") throw new Error("Matrix transient leases cannot register monitor retirement");
-			if (leaseState.releasePromise || state.phase !== "open") throw new Error("Matrix monitor lease is already retiring");
-			if (leaseState.monitorRetirement && leaseState.monitorRetirement !== retirement) throw new Error("Matrix monitor retirement is already registered");
 			leaseState.monitorRetirement = retirement;
 		},
 		start: async (abortSignal) => {
@@ -794,10 +780,6 @@ function createSharedMatrixClientLease(state, role) {
 			state.releaseMode = mergeReleaseMode(state.releaseMode, releaseParams.mode ?? "stop");
 			state.leases.delete(leaseState);
 			if (state.leases.size === 0) state.noLeases.resolve();
-			if (state.phase === "late-drain") {
-				leaseState.releasePromise = Promise.resolve();
-				return leaseState.releasePromise;
-			}
 			const finalMonitor = role === "monitor" && !Array.from(state.leases).some((lease) => lease.role === "monitor");
 			if (role === "monitor" && !finalMonitor) {
 				leaseState.releasePromise = retireMonitorLease(state, leaseState);
@@ -827,37 +809,29 @@ async function acquireSharedMatrixClient(params = {}) {
 		...params,
 		abortSignal
 	};
-	while (true) {
+	throwIfMatrixStartupAborted(abortSignal);
+	const state = await resolveOpenSharedMatrixClientState(acquisition, lifecycle);
+	if (abortSignal?.aborted) {
+		if (state.phase === "open" && state.leases.size === 0) await beginGenerationRetirement({ state });
 		throwIfMatrixStartupAborted(abortSignal);
-		const state = await resolveOpenSharedMatrixClientState(acquisition, lifecycle);
-		if (abortSignal?.aborted) {
-			if (state.phase === "open" && state.leases.size === 0) await beginGenerationRetirement({ state });
-			throwIfMatrixStartupAborted(abortSignal);
-		}
-		const lease = createSharedMatrixClientLease(state, params.role ?? "transient");
-		if (!lease) continue;
-		if (params.startClient !== false) try {
-			await lease.start(abortSignal);
-		} catch (error) {
-			await lease.release({ mode: "stop" }).catch(() => void 0);
-			throw error;
-		}
-		return lease;
 	}
+	const lease = createSharedMatrixClientLease(state, params.role ?? "transient");
+	if (params.startClient !== false) try {
+		await lease.start(abortSignal);
+	} catch (error) {
+		await lease.release({ mode: "stop" }).catch(() => void 0);
+		throw error;
+	}
+	return lease;
 }
 async function forceRetireState(state) {
-	if (state.phase === "late-drain") throw state.poisonError ?? /* @__PURE__ */ new Error("Matrix client generation is still retiring");
 	state.releaseMode = mergeReleaseMode(state.releaseMode, "stop");
 	const retirementPromise = beginGenerationRetirement({
 		state,
 		monitorLeases: Array.from(state.leases).filter((lease) => lease.role === "monitor")
 	});
 	forceReleaseLeases(state, retirementPromise);
-	try {
-		await retirementPromise;
-	} catch (error) {
-		if (sharedClientStates.get(state.key) === state) throw state.poisonError ?? error;
-	}
+	await retirementPromise;
 }
 async function stopSharedClientForAccount(auth) {
 	const state = sharedClientStates.get(buildSharedClientKey(auth));
@@ -881,7 +855,7 @@ var client_exports = /* @__PURE__ */ __exportAll({
 	stopSharedClientForAccount: () => stopSharedClientForAccount,
 	validateMatrixHomeserverUrl: () => validateMatrixHomeserverUrl
 });
-const loadMatrixClientRuntime = createLazyRuntimeModule(() => import("./create-client-CroC4BVc.mjs"));
+const loadMatrixClientRuntime = createLazyRuntimeModule(() => import("./create-client-BS8UYx6N.mjs"));
 const createMatrixClient = createLazyRuntimeMethod(loadMatrixClientRuntime, (runtime) => runtime.createMatrixClient);
 //#endregion
 export { isMatrixStartupAbortError as a, getMatrixMonitorTaskSignal as c, resolveMatrixAuthContext as d, createMatrixStartupAbortError as i, backfillMatrixAuthDeviceIdAfterStartup as l, acquireSharedMatrixClient as n, throwIfMatrixStartupAborted as o, awaitMatrixStartupWithAbort as r, createMatrixMonitorTaskRunner as s, client_exports as t, resolveMatrixAuth as u };