@openclaw/matrix 2026.5.9-beta.1 → 2026.5.10-beta.1

package/dist/api.js

@@ -2,7 +2,7 @@ import { d as setMatrixThreadBindingIdleTimeoutBySessionKey, n as getMatrixThrea
 import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-BWwIruri.js";
 import { n as listMatrixEnvAccountIds, r as resolveMatrixEnvAccountToken, t as getMatrixScopedEnvVarNames } from "./env-vars-C7uQCTKn.js";
 import { a as resolveMatrixCredentialsPath, c as resolveMatrixLegacyFlatStoreRoot, i as resolveMatrixCredentialsFilename, l as sanitizeMatrixPathSegment, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as resolveMatrixLegacyFlatStoragePaths, t as hashMatrixAccessToken } from "./storage-paths-BJLdnCjV.js";
-import { t as matrixPlugin } from "./channel-DJNir3Rb.js";
+import { t as matrixPlugin } from "./channel-H_6lMgwf.js";
 import { n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-CfZy05oW.js";
 import { n as matrixOnboardingAdapter } from "./setup-surface-CqT_o61M.js";
 import { t as createMatrixThreadBindingManager } from "./thread-bindings-B9mesxXk.js";

package/dist/{channel-DJNir3Rb.js → channel-H_6lMgwf.js}

@@ -9,7 +9,7 @@ import { a as isMatrixExecApprovalAuthorizedSender, c as shouldHandleMatrixAppro
 import { t as formatMatrixErrorMessage } from "./errors-CTcpEDq-.js";
 import { n as DEFAULT_ACCOUNT_ID$2, r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-nPLpEgHl.js";
 import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-D4-64QuJ.js";
-import { n as resolveMatrixRoomConfig, t as resolveMatrixStoredSessionMeta } from "./session-store-metadata-DI5SCofx.js";
+import { n as resolveMatrixRoomConfig, t as resolveMatrixStoredSessionMeta } from "./session-store-metadata-DQXjgNLt.js";
 import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-DcrJWCQI.js";
 import { a as namedAccountPromotionKeys, o as resolveSingleAccountPromotionTarget, s as singleAccountKeysToMove } from "./setup-dm-policy-2-r1FrQh.js";
 import { n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-CfZy05oW.js";
@@ -129,7 +129,7 @@ const matrixMessageActions = {
 		return extractToolSend(args, "sendMessage");
 	},
 	handleAction: async (ctx) => {
-		const { handleMatrixAction } = await import("./tool-actions.runtime-BIH49vRr.js");
+		const { handleMatrixAction } = await import("./tool-actions.runtime-ThYhfHtZ.js");
 		const { action, params, cfg, accountId, mediaLocalRoots } = ctx;
 		const dispatch = async (actionParams) => await handleMatrixAction({
 			...actionParams,
@@ -689,7 +689,7 @@ async function runMatrixStartupMaintenance(params) {
 //#region extensions/matrix/src/channel.ts
 let matrixStartupLock = Promise.resolve();
 const loadMatrixSetupWizard = createLazyRuntimeNamedExport(() => import("./setup-surface-CqT_o61M.js").then((n) => n.t), "matrixSetupWizard");
-const loadMatrixChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-BQu0hTih.js"), "matrixChannelRuntime");
+const loadMatrixChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-BnO9f0pR.js"), "matrixChannelRuntime");
 const meta = {
 	id: "matrix",
 	label: "Matrix",
@@ -1054,7 +1054,7 @@ const matrixPlugin = createChatChannelPlugin({
 			await previousLock;
 			let monitorMatrixProvider;
 			try {
-				monitorMatrixProvider = (await import("./monitor-C_81r_Ck.js")).monitorMatrixProvider;
+				monitorMatrixProvider = (await import("./monitor-BaRCKyLd.js")).monitorMatrixProvider;
 			} finally {
 				releaseLock();
 			}

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as matrixPlugin } from "./channel-DJNir3Rb.js";
+import { t as matrixPlugin } from "./channel-H_6lMgwf.js";
 export { matrixPlugin };

package/dist/{channel.runtime-BQu0hTih.js → channel.runtime-BnO9f0pR.js}

@@ -3,7 +3,7 @@ import { t as isBunRuntime } from "./runtime-C6X4h_SJ.js";
 import { n as resolveMatrixAuth } from "./config--5-S2Akv.js";
 import "./client-_hckQNGW.js";
 import { n as listMatrixDirectoryGroupsLive, r as listMatrixDirectoryPeersLive } from "./directory-live-DmOtMhyr.js";
-import { f as resolveOutboundSendDep, n as chunkTextForOutbound } from "./runtime-api-BXWBFIqm.js";
+import { f as resolveOutboundSendDep, n as chunkTextForOutbound } from "./runtime-api-DTKcXOhp.js";
 import { t as resolveMatrixTargets } from "./resolve-targets-YtJnw1Tb.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createReplyToFanout } from "openclaw/plugin-sdk/outbound-runtime";

package/dist/{cli-BmfTmg7x.js → cli-CYZ9yVcB.js}

@@ -9,7 +9,7 @@ import { i as setMatrixSdkLogMode, r as setMatrixSdkConsoleLogging } from "./log
 import { n as withResolvedActionClient } from "./client-DkcXnm0X.js";
 import { r as resolveMatrixAuthContext } from "./config--5-S2Akv.js";
 import "./client-_hckQNGW.js";
-import { i as formatZonedTimestamp } from "./runtime-api-BXWBFIqm.js";
+import { i as formatZonedTimestamp } from "./runtime-api-DTKcXOhp.js";
 import { isOpenClawManagedMatrixDevice, summarizeMatrixDeviceHealth } from "./device-health-UVYpbA_W.js";
 import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-DjeBNgIV.js";
 import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-CZ2rDeHL.js";

package/dist/{cli-metadata-B-PCEzrA.js → cli-metadata-DPIHnoa6.js}

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/matrix/src/cli-metadata.ts
 function registerMatrixCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerMatrixCli } = await import("./cli-BmfTmg7x.js");
+		const { registerMatrixCli } = await import("./cli-CYZ9yVcB.js");
 		registerMatrixCli({ program });
 	}, { descriptors: [{
 		name: "matrix",

package/dist/cli-metadata.js

@@ -1,2 +1,2 @@
-import { n as registerMatrixCliMetadata, t as cli_metadata_default } from "./cli-metadata-B-PCEzrA.js";
+import { n as registerMatrixCliMetadata, t as cli_metadata_default } from "./cli-metadata-DPIHnoa6.js";
 export { cli_metadata_default as default, registerMatrixCliMetadata };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { n as registerMatrixCliMetadata } from "./cli-metadata-B-PCEzrA.js";
+import { n as registerMatrixCliMetadata } from "./cli-metadata-DPIHnoa6.js";
 import { registerMatrixSubagentHooks } from "./subagent-hooks-api.js";
 import { defineBundledChannelEntry } from "openclaw/plugin-sdk/channel-entry-contract";
 //#region extensions/matrix/index.ts

package/dist/{monitor-C_81r_Ck.js → monitor-BaRCKyLd.js}

@@ -4,7 +4,7 @@ import { t as getMatrixRuntime } from "./runtime-Dog86njy.js";
 import { n as resolveConfiguredMatrixBotUserIds } from "./accounts-Bm90Rzvp.js";
 import { n as normalizeMatrixUserId, r as resolveMatrixAllowListMatch, t as normalizeMatrixAllowList } from "./allowlist-sTzpCn5d.js";
 import { r as isMatrixNotFoundError, t as formatMatrixErrorMessage } from "./errors-CTcpEDq-.js";
-import { a as canonicalizeAllowlistWithResolvedIds, c as formatAllowlistMatchMeta, d as logInboundDrop, f as logTypingFailure, h as toLocationContext, i as buildAllowlistResolutionSummary, l as formatLocationText, m as summarizeMapping, n as resolveMatrixRoomConfig, o as createReplyPrefixOptions, p as patchAllowlistUsersInConfigEntries, r as addAllowlistUserEntriesFromConfigEntry, s as createTypingCallbacks, t as resolveMatrixStoredSessionMeta, u as getAgentScopedMediaLocalRoots } from "./session-store-metadata-DI5SCofx.js";
+import { a as canonicalizeAllowlistWithResolvedIds, c as formatLocationText, d as logTypingFailure, f as patchAllowlistUsersInConfigEntries, i as buildAllowlistResolutionSummary, l as getAgentScopedMediaLocalRoots, m as toLocationContext, n as resolveMatrixRoomConfig, o as createReplyPrefixOptions, p as summarizeMapping, r as addAllowlistUserEntriesFromConfigEntry, s as createTypingCallbacks, t as resolveMatrixStoredSessionMeta, u as logInboundDrop } from "./session-store-metadata-DQXjgNLt.js";
 import { i as resolveMatrixStateFilePath } from "./storage-tC3ujLiW.js";
 import { a as sendMessageMatrix, g as isPollStartType, h as isPollEventType, p as formatPollAsText, t as chunkMatrixText, v as parsePollStartContent } from "./send-Bo0DU1ca.js";
 import { i as promoteMatrixDirectRoomCandidate, s as MATRIX_OPENCLAW_FINALIZED_PREVIEW_KEY } from "./direct-management-DMMMgtTB.js";
@@ -21,14 +21,13 @@ import { t as isBunRuntime } from "./runtime-C6X4h_SJ.js";
 import { n as resolveMatrixAuth, r as resolveMatrixAuthContext, t as backfillMatrixAuthDeviceIdAfterStartup } from "./config--5-S2Akv.js";
 import { i as resolveSharedMatrixClient, n as releaseSharedClientInstance } from "./shared-CpMoYKm1.js";
 import "./client-_hckQNGW.js";
-import { d as resolveDefaultGroupPolicy, h as warnMissingProviderGroupPolicyFallbackOnce, m as resolveThreadBindingMaxAgeMsForChannel, p as resolveThreadBindingIdleTimeoutMsForChannel, t as GROUP_POLICY_BLOCKED_LABEL, u as resolveAllowlistProviderRuntimeGroupPolicy } from "./runtime-api-BXWBFIqm.js";
+import { d as resolveDefaultGroupPolicy, h as warnMissingProviderGroupPolicyFallbackOnce, m as resolveThreadBindingMaxAgeMsForChannel, p as resolveThreadBindingIdleTimeoutMsForChannel, t as GROUP_POLICY_BLOCKED_LABEL, u as resolveAllowlistProviderRuntimeGroupPolicy } from "./runtime-api-DTKcXOhp.js";
 import { t as resolveMatrixTargets } from "./resolve-targets-YtJnw1Tb.js";
 import { t as formatMatrixEncryptedEventDisabledWarning } from "./encryption-guidance-BPi3A_m3.js";
 import { a as EventType, i as resolveMatrixThreadRouting, n as resolveMatrixReplyToEventId, o as RelationType, r as resolveMatrixThreadRootId, t as resolveMatrixInboundRoute } from "./route-D6rg-iXN.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringifiedOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createPreviewMessageReceipt, defineFinalizableLivePreviewAdapter, deliverWithFinalizableLivePreviewAdapter } from "openclaw/plugin-sdk/channel-message";
 import { CHANNEL_APPROVAL_NATIVE_RUNTIME_CONTEXT_CAPABILITY } from "openclaw/plugin-sdk/approval-handler-adapter-runtime";
-import { mergeDmAllowFromSources } from "openclaw/plugin-sdk/allow-from";
 import { loadSessionStore, resolveSessionStoreEntry } from "openclaw/plugin-sdk/session-store-runtime";
 import { readJsonFileWithFallback, writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
 import { format } from "node:util";
@@ -36,8 +35,8 @@ import { resolveAckReaction } from "openclaw/plugin-sdk/channel-feedback";
 import { hasFinalInboundReplyDispatch } from "openclaw/plugin-sdk/inbound-reply-dispatch";
 import { waitUntilAbort } from "openclaw/plugin-sdk/channel-lifecycle";
 import { registerChannelRuntimeContext } from "openclaw/plugin-sdk/channel-runtime-context";
+import { createChannelIngressResolver, defineStableChannelIngressIdentity } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { createChannelProgressDraftGate, formatChannelProgressDraftLine, formatChannelProgressDraftLineForEntry, formatChannelProgressDraftText, isChannelProgressDraftWorkToolName, resolveChannelProgressDraftMaxLines } from "openclaw/plugin-sdk/channel-streaming";
-import { resolveControlCommandGate } from "openclaw/plugin-sdk/command-gating";
 import { evaluateSupplementalContextVisibility, resolveChannelContextVisibilityMode } from "openclaw/plugin-sdk/context-visibility-runtime";
 import { resolvePinnedMainDmOwnerFromAllowlist } from "openclaw/plugin-sdk/security-runtime";
 import { escapeRegExp } from "openclaw/plugin-sdk/text-runtime";
@@ -554,55 +553,107 @@ function createDirectRoomTracker(client, opts = {}) {
 }
 //#endregion
 //#region extensions/matrix/src/matrix/monitor/access-state.ts
-function resolveMatrixMonitorAccessState(params) {
-	const effectiveAllowFrom = normalizeMatrixAllowList(mergeDmAllowFromSources({
-		allowFrom: normalizeMatrixAllowList(params.allowFrom),
-		storeAllowFrom: params.storeAllowFrom,
-		dmPolicy: params.dmPolicy
-	}));
+function normalizeMatrixEntry(raw) {
+	return normalizeMatrixAllowList([raw ?? ""])[0] ?? null;
+}
+const matrixIngressIdentity = defineStableChannelIngressIdentity({
+	key: "sender-id",
+	normalize: normalizeMatrixEntry,
+	matchEntry({ subject, entry }) {
+		const senderId = subject.identifiers[0]?.value;
+		return entry.value === "*" || resolveMatrixAllowListMatch({
+			allowList: [entry.value],
+			userId: senderId ?? ""
+		}).allowed;
+	}
+});
+function resolveMatrixGroupIngress(params) {
+	if (params.groupPolicy === "disabled") return {
+		groupPolicy: "disabled",
+		groupAllowFrom: []
+	};
+	if (params.effectiveRoomUsers.length > 0) return {
+		groupPolicy: "allowlist",
+		groupAllowFrom: params.effectiveRoomUsers
+	};
+	if (params.groupPolicy === "allowlist" && params.effectiveGroupAllowFrom.length > 0) return {
+		groupPolicy: "allowlist",
+		groupAllowFrom: params.effectiveGroupAllowFrom
+	};
+	return {
+		groupPolicy: "open",
+		groupAllowFrom: []
+	};
+}
+async function resolveMatrixMonitorAccessState(params) {
+	const dmPolicy = params.dmPolicy ?? "pairing";
+	const groupPolicy = params.groupPolicy ?? "open";
 	const effectiveGroupAllowFrom = normalizeMatrixAllowList(params.groupAllowFrom);
 	const effectiveRoomUsers = normalizeMatrixAllowList(params.roomUsers);
-	const commandAllowFrom = params.isRoom ? [] : effectiveAllowFrom;
-	const directAllowMatch = resolveMatrixAllowListMatch({
-		allowList: effectiveAllowFrom,
-		userId: params.senderId
+	const groupIngress = resolveMatrixGroupIngress({
+		groupPolicy,
+		effectiveGroupAllowFrom,
+		effectiveRoomUsers
 	});
-	const roomUserMatch = params.isRoom && effectiveRoomUsers.length > 0 ? resolveMatrixAllowListMatch({
-		allowList: effectiveRoomUsers,
-		userId: params.senderId
-	}) : null;
-	const groupAllowMatch = effectiveGroupAllowFrom.length > 0 ? resolveMatrixAllowListMatch({
-		allowList: effectiveGroupAllowFrom,
-		userId: params.senderId
-	}) : null;
-	const commandAllowMatch = commandAllowFrom.length > 0 ? resolveMatrixAllowListMatch({
-		allowList: commandAllowFrom,
-		userId: params.senderId
-	}) : null;
+	const accountId = params.accountId ?? "default";
+	const eventKind = params.eventKind ?? "message";
 	return {
-		effectiveAllowFrom,
 		effectiveGroupAllowFrom,
 		effectiveRoomUsers,
-		groupAllowConfigured: effectiveGroupAllowFrom.length > 0,
-		directAllowMatch,
-		roomUserMatch,
-		groupAllowMatch,
-		commandAuthorizers: [
-			{
-				configured: commandAllowFrom.length > 0,
-				allowed: commandAllowMatch?.allowed ?? false
+		messageIngress: await createChannelIngressResolver({
+			channelId: "matrix",
+			accountId,
+			identity: matrixIngressIdentity,
+			readStoreAllowFrom: async () => params.storeAllowFrom
+		}).message({
+			subject: { stableId: params.senderId },
+			conversation: {
+				kind: params.isRoom ? "group" : "direct",
+				id: params.isRoom ? "matrix-room" : "matrix-dm"
 			},
-			{
-				configured: effectiveRoomUsers.length > 0,
-				allowed: roomUserMatch?.allowed ?? false
+			event: {
+				kind: eventKind,
+				authMode: "inbound",
+				mayPair: params.isRoom ? false : eventKind === "message"
 			},
-			{
-				configured: effectiveGroupAllowFrom.length > 0,
-				allowed: groupAllowMatch?.allowed ?? false
-			}
-		]
+			dmPolicy,
+			groupPolicy: params.isRoom ? groupIngress.groupPolicy : "disabled",
+			policy: { groupAllowFromFallbackToAllowFrom: false },
+			allowFrom: params.allowFrom,
+			...params.isRoom ? { groupAllowFrom: groupIngress.groupAllowFrom } : {}
+		}),
+		accountId,
+		senderId: params.senderId,
+		isRoom: params.isRoom
 	};
 }
+async function resolveMatrixMonitorCommandAccess(state, params) {
+	const commandAllowFrom = state.isRoom ? [] : state.messageIngress.senderAccess.effectiveAllowFrom;
+	const commandGroupAllowFrom = state.effectiveRoomUsers.length > 0 ? state.effectiveRoomUsers : state.effectiveGroupAllowFrom;
+	return (await createChannelIngressResolver({
+		channelId: "matrix",
+		accountId: state.accountId,
+		identity: matrixIngressIdentity
+	}).command({
+		subject: { stableId: state.senderId },
+		conversation: {
+			kind: state.isRoom ? "group" : "direct",
+			id: state.isRoom ? "matrix-room" : "matrix-dm"
+		},
+		dmPolicy: "allowlist",
+		groupPolicy: "allowlist",
+		policy: { groupAllowFromFallbackToAllowFrom: false },
+		allowFrom: commandAllowFrom,
+		groupAllowFrom: commandGroupAllowFrom,
+		command: {
+			useAccessGroups: params.useAccessGroups,
+			allowTextCommands: params.allowTextCommands,
+			hasControlCommand: params.hasControlCommand,
+			groupOwnerAllowFrom: "none",
+			commandGroupAllowFromFallbackToAllowFrom: false
+		}
+	})).commandAccess;
+}
 //#endregion
 //#region extensions/matrix/src/matrix/monitor/verification-utils.ts
 const VERIFICATION_EVENT_PREFIX = "m.key.verification.";
@@ -818,15 +869,16 @@ async function isVerificationNoticeAuthorized(params) {
 		return false;
 	}
 	const storeAllowFrom = params.dmPolicy !== "allowlist" && params.dmPolicy !== "open" ? await params.readStoreAllowFrom() : [];
-	if (resolveMatrixMonitorAccessState({
+	if ((await resolveMatrixMonitorAccessState({
 		allowFrom: params.allowFrom,
 		storeAllowFrom,
 		dmPolicy: params.dmPolicy,
+		groupPolicy: "open",
 		groupAllowFrom: [],
 		roomUsers: [],
 		senderId: params.senderId,
 		isRoom: false
-	}).directAllowMatch.allowed) return true;
+	})).messageIngress.senderAccess.decision === "allow") return true;
 	params.logVerboseMessage(`matrix: blocked verification sender ${params.senderId} (dmPolicy=${params.dmPolicy})`);
 	return false;
 }
@@ -2173,7 +2225,7 @@ function createMatrixRoomMessageHandler(params) {
 					cfg: liveCfg,
 					accountId
 				});
-				const { effectiveAllowFrom, effectiveGroupAllowFrom, effectiveRoomUsers, groupAllowConfigured, directAllowMatch, roomUserMatch, groupAllowMatch, commandAuthorizers } = resolveMatrixMonitorAccessState({
+				const accessState = await resolveMatrixMonitorAccessState({
 					allowFrom: await resolveCachedLiveAllowlist({
 						cfg: liveCfg,
 						entries: liveAccountAllowlists.dmAllowFrom,
@@ -2185,6 +2237,7 @@ function createMatrixRoomMessageHandler(params) {
 					}),
 					storeAllowFrom,
 					dmPolicy,
+					groupPolicy,
 					groupAllowFrom: await resolveCachedLiveAllowlist({
 						cfg: liveCfg,
 						entries: liveAccountAllowlists.groupAllowFrom,
@@ -2196,16 +2249,20 @@ function createMatrixRoomMessageHandler(params) {
 					}),
 					roomUsers,
 					senderId,
-					isRoom
+					isRoom,
+					accountId,
+					eventKind: isReactionEvent ? "reaction" : "message"
 				});
+				const { effectiveGroupAllowFrom, effectiveRoomUsers, messageIngress } = accessState;
+				const ingressDecision = messageIngress.ingress;
 				if (isDirectMessage) {
 					if (!dmEnabled || dmPolicy === "disabled") {
 						await commitInboundEventIfClaimed();
 						return;
 					}
-					const allowMatchMeta = formatAllowlistMatchMeta(directAllowMatch);
-					if (!directAllowMatch.allowed) {
-						if (!isReactionEvent && dmPolicy === "pairing") {
+					const senderReason = messageIngress.senderAccess.reasonCode;
+					if (ingressDecision.decision !== "allow") {
+						if (ingressDecision.admission === "pairing-required") {
 							const senderName = await getSenderName();
 							const { code, created } = await core.channel.pairing.upsertPairingRequest({
 								channel: "matrix",
@@ -2219,7 +2276,7 @@ function createMatrixRoomMessageHandler(params) {
 									idLine: `Your Matrix user id: ${senderId}`,
 									code
 								});
-								logVerboseMessage(created ? `matrix pairing request sender=${senderId} name=${senderName ?? "unknown"} (${allowMatchMeta})` : `matrix pairing reminder sender=${senderId} name=${senderName ?? "unknown"} (${allowMatchMeta})`);
+								logVerboseMessage(created ? `matrix pairing request sender=${senderId} name=${senderName ?? "unknown"} (reason=${senderReason})` : `matrix pairing reminder sender=${senderId} name=${senderName ?? "unknown"} (reason=${senderReason})`);
 								try {
 									const { sendMessageMatrix } = await loadMatrixSendModule();
 									await sendMessageMatrix(`room:${roomId}`, created ? pairingReply : `${pairingReply}\n\nPairing request is still pending approval. Reusing existing code.`, {
@@ -2238,19 +2295,14 @@ function createMatrixRoomMessageHandler(params) {
 							}
 						}
 						if (isReactionEvent || dmPolicy !== "pairing") {
-							logVerboseMessage(`matrix: blocked ${isReactionEvent ? "reaction" : "dm"} sender ${senderId} (dmPolicy=${dmPolicy}, ${allowMatchMeta})`);
+							logVerboseMessage(`matrix: blocked ${isReactionEvent ? "reaction" : "dm"} sender ${senderId} (dmPolicy=${dmPolicy}, reason=${senderReason})`);
 							await commitInboundEventIfClaimed();
 						}
 						return;
 					}
 				}
-				if (isRoom && roomUserMatch && !roomUserMatch.allowed) {
-					logVerboseMessage(`matrix: blocked sender ${senderId} (room users allowlist, ${roomMatchMeta}, ${formatAllowlistMatchMeta(roomUserMatch)})`);
-					await commitInboundEventIfClaimed();
-					return;
-				}
-				if (isRoom && groupPolicy === "allowlist" && effectiveRoomUsers.length === 0 && groupAllowConfigured && groupAllowMatch && !groupAllowMatch.allowed) {
-					logVerboseMessage(`matrix: blocked sender ${senderId} (groupAllowFrom, ${roomMatchMeta}, ${formatAllowlistMatchMeta(groupAllowMatch)})`);
+				if (isRoom && ingressDecision.decision !== "allow") {
+					logVerboseMessage(`matrix: blocked sender ${senderId} (ingress=${ingressDecision.reasonCode}, ${roomMatchMeta})`);
 					await commitInboundEventIfClaimed();
 					return;
 				}
@@ -2351,14 +2403,13 @@ function createMatrixRoomMessageHandler(params) {
 					mentionRegexes: agentMentionRegexes
 				});
 				const hasControlCommandInMessage = core.channel.text.hasControlCommand(commandCheckText, cfg);
-				const commandGate = resolveControlCommandGate({
+				const commandAccess = await resolveMatrixMonitorCommandAccess(accessState, {
 					useAccessGroups,
-					authorizers: commandAuthorizers,
 					allowTextCommands,
 					hasControlCommand: hasControlCommandInMessage
 				});
-				const commandAuthorized = commandGate.commandAuthorized;
-				if (isRoom && commandGate.shouldBlock) {
+				const commandAuthorized = commandAccess.authorized;
+				if (isRoom && commandAccess.shouldBlockControlCommand) {
 					logInboundDrop({
 						log: logVerboseMessage,
 						channel: "matrix",
@@ -2492,7 +2543,6 @@ function createMatrixRoomMessageHandler(params) {
 					triggerSnapshot: preparedTrigger,
 					threadRootId,
 					thread,
-					effectiveAllowFrom,
 					effectiveGroupAllowFrom,
 					effectiveRoomUsers
 				};

package/dist/{runtime-api-BXWBFIqm.js → runtime-api-DTKcXOhp.js}

@@ -2,7 +2,6 @@ import "./timeout-abort-signal-CtaIaP1v.js";
 import "openclaw/plugin-sdk/account-id";
 import { resolveThreadBindingIdleTimeoutMsForChannel, resolveThreadBindingMaxAgeMsForChannel } from "openclaw/plugin-sdk/conversation-runtime";
 import "openclaw/plugin-sdk/channel-message";
-import "openclaw/plugin-sdk/channel-policy";
 import { chunkTextForOutbound as chunkTextForOutbound$1 } from "openclaw/plugin-sdk/text-chunking";
 import { createActionGate as createActionGate$1, jsonResult, readNumberParam as readNumberParam$1, readReactionParams, readStringArrayParam, readStringParam as readStringParam$1 } from "openclaw/plugin-sdk/channel-actions";
 import "openclaw/plugin-sdk/routing";

package/dist/{session-store-metadata-DI5SCofx.js → session-store-metadata-DQXjgNLt.js}

@@ -1,6 +1,6 @@
 import { a as resolveMatrixTargetIdentity, i as resolveMatrixDirectUserId } from "./target-ids-80nQ2gql.js";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { addAllowlistUserEntriesFromConfigEntry, buildAllowlistResolutionSummary, canonicalizeAllowlistWithResolvedIds, formatAllowlistMatchMeta, patchAllowlistUsersInConfigEntries, summarizeMapping } from "openclaw/plugin-sdk/allow-from";
+import { addAllowlistUserEntriesFromConfigEntry, buildAllowlistResolutionSummary, canonicalizeAllowlistWithResolvedIds, patchAllowlistUsersInConfigEntries, summarizeMapping } from "openclaw/plugin-sdk/allow-from";
 import { createReplyPrefixOptions, createTypingCallbacks } from "openclaw/plugin-sdk/channel-reply-options-runtime";
 import { formatLocationText, toLocationContext } from "openclaw/plugin-sdk/channel-location";
 import { getAgentScopedMediaLocalRoots } from "openclaw/plugin-sdk/agent-media-payload";
@@ -74,4 +74,4 @@ function resolveMatrixStoredSessionMeta(entry) {
 	};
 }
 //#endregion
-export { canonicalizeAllowlistWithResolvedIds as a, formatAllowlistMatchMeta as c, logInboundDrop as d, logTypingFailure as f, toLocationContext as h, buildAllowlistResolutionSummary as i, formatLocationText as l, summarizeMapping as m, resolveMatrixRoomConfig as n, createReplyPrefixOptions as o, patchAllowlistUsersInConfigEntries as p, addAllowlistUserEntriesFromConfigEntry as r, createTypingCallbacks as s, resolveMatrixStoredSessionMeta as t, getAgentScopedMediaLocalRoots as u };
+export { canonicalizeAllowlistWithResolvedIds as a, formatLocationText as c, logTypingFailure as d, patchAllowlistUsersInConfigEntries as f, buildAllowlistResolutionSummary as i, getAgentScopedMediaLocalRoots as l, toLocationContext as m, resolveMatrixRoomConfig as n, createReplyPrefixOptions as o, summarizeMapping as p, addAllowlistUserEntriesFromConfigEntry as r, createTypingCallbacks as s, resolveMatrixStoredSessionMeta as t, logInboundDrop as u };

package/dist/test-api.js

@@ -1,4 +1,4 @@
 import { r as setMatrixRuntime } from "./runtime-Dog86njy.js";
-import { t as matrixPlugin } from "./channel-DJNir3Rb.js";
+import { t as matrixPlugin } from "./channel-H_6lMgwf.js";
 import { t as MatrixClient } from "./sdk-B2vZA27-.js";
 export { MatrixClient, matrixPlugin, setMatrixRuntime };

package/dist/{tool-actions.runtime-BIH49vRr.js → tool-actions.runtime-ThYhfHtZ.js}

@@ -4,7 +4,7 @@ import { _ as parsePollStart, d as buildPollResponseContent, g as isPollStartTyp
 import { i as buildMatrixReactionRelationsPath, o as selectOwnMatrixReactionEventIds, s as summarizeMatrixReactionEvents } from "./reaction-common-ejrL19w-.js";
 import { n as withResolvedActionClient, r as withResolvedRoomAction } from "./client-DkcXnm0X.js";
 import { a as fetchEventSummary, c as resolveMatrixActionLimit, i as sendMatrixMessage, n as editMatrixMessage, o as readPinnedEvents, r as readMatrixMessages, s as EventType, t as deleteMatrixMessage } from "./messages-BpihMh82.js";
-import { a as jsonResult, c as readStringArrayParam, l as readStringParam, o as readNumberParam, r as createActionGate, s as readReactionParams } from "./runtime-api-BXWBFIqm.js";
+import { a as jsonResult, c as readStringArrayParam, l as readStringParam, o as readNumberParam, r as createActionGate, s as readReactionParams } from "./runtime-api-DTKcXOhp.js";
 import { t as applyMatrixProfileUpdate } from "./profile-update-DjeBNgIV.js";
 import { _ as scanMatrixVerificationQr, a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, h as restoreMatrixRoomKeyBackup, i as confirmMatrixVerificationReciprocateQr, l as getMatrixVerificationSas, n as bootstrapMatrixVerification, o as generateMatrixVerificationQr, p as requestMatrixVerification, r as cancelMatrixVerification, s as getMatrixEncryptionStatus, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-CZ2rDeHL.js";
 import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";

package/openclaw.plugin.json

@@ -1,7 +1,15 @@
 {
   "id": "matrix",
+  "commandAliases": [
+    {
+      "name": "matrix"
+    }
+  ],
   "activation": {
-    "onStartup": false
+    "onStartup": false,
+    "onCommands": [
+      "matrix"
+    ]
   },
   "channels": [
     "matrix"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/matrix",
-  "version": "2026.5.9-beta.1",
+  "version": "2026.5.10-beta.1",
   "description": "OpenClaw Matrix channel plugin",
   "repository": {
     "type": "git",
@@ -21,7 +21,7 @@
     "openclaw": "workspace:*"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.9-beta.1"
+    "openclaw": ">=2026.5.10-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -86,10 +86,10 @@
       "allowInvalidConfigRecovery": true
     },
     "compat": {
-      "pluginApi": ">=2026.5.9-beta.1"
+      "pluginApi": ">=2026.5.10-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.9-beta.1"
+      "openclawVersion": "2026.5.10-beta.1"
     },
     "release": {
       "publishToClawHub": true,