@openclaw/matrix 2026.7.2-beta.1 → 2026.7.2-beta.3

package/dist/{account-selection-Bz00QTmQ.js → account-selection-kqquRzCf.js}

@@ -1,5 +1,5 @@
 import { n as listMatrixEnvAccountIds, t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
-import { t as isRecord } from "./record-shared-CvzjvHRn.js";
+import { t as isRecord$1 } from "./record-shared-CWWx6fvI.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { listCombinedAccountIds, listConfiguredAccountIds, resolveListedDefaultAccountId, resolveNormalizedAccountEntry } from "openclaw/plugin-sdk/account-core";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
@@ -102,20 +102,20 @@ function hasConfiguredDefaultMatrixAccountSource(params) {
 	});
 }
 function resolveMatrixChannelConfig(cfg) {
-	return isRecord(cfg.channels?.matrix) ? cfg.channels.matrix : null;
+	return isRecord$1(cfg.channels?.matrix) ? cfg.channels.matrix : null;
 }
 function findMatrixAccountEntry(cfg, accountId) {
 	const channel = resolveMatrixChannelConfig(cfg);
 	if (!channel) return null;
-	const accounts = isRecord(channel.accounts) ? channel.accounts : null;
+	const accounts = isRecord$1(channel.accounts) ? channel.accounts : null;
 	if (!accounts) return null;
 	const entry = resolveNormalizedAccountEntry(accounts, accountId, normalizeAccountId);
-	return isRecord(entry) ? entry : null;
+	return isRecord$1(entry) ? entry : null;
 }
 function resolveConfiguredMatrixAccountIds(cfg, env = process.env) {
 	const channel = resolveMatrixChannelConfig(cfg);
 	const configuredAccountIds = listConfiguredAccountIds({
-		accounts: channel && isRecord(channel.accounts) ? channel.accounts : void 0,
+		accounts: channel && isRecord$1(channel.accounts) ? channel.accounts : void 0,
 		normalizeAccountId
 	});
 	if (hasConfiguredDefaultMatrixAccountSource({

package/dist/api.js

@@ -1,11 +1,11 @@
-import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-Bz00QTmQ.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-kqquRzCf.js";
 import { n as listMatrixEnvAccountIds, r as resolveMatrixEnvAccountToken, t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
-import { a as resolveMatrixCredentialsPath, i as resolveMatrixCredentialsFilename, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as sanitizeMatrixPathSegment, t as hashMatrixAccessToken } from "./storage-paths-B4_I9iqO.js";
-import { n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-DlmTyIP0.js";
-import { t as matrixPlugin } from "./channel-CxqDh7mS.js";
+import { a as resolveMatrixCredentialsPath, i as resolveMatrixCredentialsFilename, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as sanitizeMatrixPathSegment, t as hashMatrixAccessToken } from "./storage-paths-gUmSydsW.js";
+import { n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-XCdAx1nY.js";
+import { t as matrixPlugin } from "./channel-j331Xd7b.js";
 import { d as setMatrixThreadBindingIdleTimeoutBySessionKey, n as getMatrixThreadBindingManager, p as setMatrixThreadBindingMaxAgeBySessionKey, s as resetMatrixThreadBindingsForTests } from "./thread-bindings-shared-CKnY4LSd.js";
-import { n as matrixOnboardingAdapter } from "./setup-surface-2SS94JV0.js";
-import { t as createMatrixThreadBindingManager } from "./thread-bindings-BI8MHWp9.js";
+import { n as matrixOnboardingAdapter } from "./setup-surface-CzUiTe_k.js";
+import { t as createMatrixThreadBindingManager } from "./thread-bindings-Cw194yEn.js";
 //#region extensions/matrix/api.ts
 const matrixSessionBindingAdapterChannels = ["matrix"];
 //#endregion

package/dist/{approval-handler.runtime--Ei44Vo2.js → approval-handler.runtime-BEa98wwG.js}

@@ -1,9 +1,9 @@
-import { g as resolveMatrixAccount } from "./setup-core-DlmTyIP0.js";
-import { _ as shouldHandleMatrixApprovalRequest, g as isMatrixAnyApprovalClientEnabled } from "./channel-CxqDh7mS.js";
+import { g as resolveMatrixAccount } from "./setup-core-XCdAx1nY.js";
+import { _ as shouldHandleMatrixApprovalRequest, g as isMatrixAnyApprovalClientEnabled } from "./channel-j331Xd7b.js";
 import { a as resolveMatrixTargetIdentity } from "./target-ids-B-5aQxwn.js";
-import { a as sendMessageMatrix, i as reactMatrixMessage, p as repairMatrixDirectRooms, s as sendSingleTextMessageMatrix } from "./send-C7xuGWpv.js";
-import { a as unregisterMatrixApprovalReactionTarget, n as listMatrixApprovalReactionBindings, r as registerMatrixApprovalReactionTarget, t as buildMatrixApprovalReactionHint } from "./approval-reactions-BgU51JGd.js";
-import { n as editMatrixMessage, t as deleteMatrixMessage } from "./messages-Dm3K4ZvM.js";
+import { a as sendMessageMatrix, i as reactMatrixMessage, p as repairMatrixDirectRooms, s as sendSingleTextMessageMatrix } from "./send-BJbrdmNm.js";
+import { a as unregisterMatrixApprovalReactionTarget, n as listMatrixApprovalReactionBindings, r as registerMatrixApprovalReactionTarget, t as buildMatrixApprovalReactionHint } from "./approval-reactions-D-BxBK_L.js";
+import { n as editMatrixMessage, t as deleteMatrixMessage } from "./messages-3UBHfZrN.js";
 import { listMessageReceiptPlatformIds, resolveMessageReceiptPrimaryId } from "openclaw/plugin-sdk/channel-outbound";
 import { normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildChannelApprovalNativeTargetKey } from "openclaw/plugin-sdk/approval-native-runtime";

package/dist/{approval-ids-C_2kSMdJ.js → approval-ids-Dfn7oQAm.js}

@@ -1,4 +1,4 @@
-import { a as normalizeMatrixUserId } from "./config-schema-CG9goLWp.js";
+import { a as normalizeMatrixUserId } from "./config-schema-B5GRV8wL.js";
 //#region extensions/matrix/src/approval-ids.ts
 function normalizeMatrixApproverId(value) {
 	return normalizeMatrixUserId(String(value)) || void 0;

package/dist/{approval-reaction-auth-TdVPcgxP.js → approval-reaction-auth-kXkCJBGi.js}

@@ -1,5 +1,5 @@
-import { g as resolveMatrixAccount } from "./setup-core-DlmTyIP0.js";
-import { t as normalizeMatrixApproverId } from "./approval-ids-C_2kSMdJ.js";
+import { g as resolveMatrixAccount } from "./setup-core-XCdAx1nY.js";
+import { t as normalizeMatrixApproverId } from "./approval-ids-Dfn7oQAm.js";
 import { resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
 //#region extensions/matrix/src/approval-reaction-auth.ts
 function normalizeMatrixExecApproverId(value) {

package/dist/{approval-reactions-BgU51JGd.js → approval-reactions-D-BxBK_L.js}

@@ -1,4 +1,4 @@
-import { n as getOptionalMatrixRuntime } from "./runtime-CveSqMOP.js";
+import { n as getOptionalMatrixRuntime } from "./runtime-6S3DNFNv.js";
 import { normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/routing";
 import { createApprovalReactionTargetStore } from "openclaw/plugin-sdk/approval-reaction-runtime";
 //#region extensions/matrix/src/approval-reactions.ts

package/dist/auth-presence.js

@@ -1,26 +1,18 @@
-import { i as resolveMatrixCredentialsFilename, r as resolveMatrixCredentialsDir } from "./storage-paths-B4_I9iqO.js";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
+import { c as normalizeMatrixStoredCredentials, t as MATRIX_CREDENTIALS_NAMESPACE } from "./credentials-read-DVmFCm7X.js";
+import { createPluginStateSyncKeyedStore } from "openclaw/plugin-sdk/runtime-doctor";
 //#region extensions/matrix/auth-presence.ts
-function listMatrixCredentialPaths(_cfg, env = process.env) {
-	const credentialsDir = resolveMatrixCredentialsDir(resolveStateDir(env, os.homedir));
-	const paths = /* @__PURE__ */ new Set([resolveMatrixCredentialsFilename(), resolveMatrixCredentialsFilename("default")]);
-	try {
-		const entries = fs.readdirSync(credentialsDir, { withFileTypes: true });
-		for (const entry of entries) if (entry.isFile() && /^credentials(?:-[a-z0-9._-]+)?\.json$/i.test(entry.name)) paths.add(entry.name);
-	} catch {}
-	return [...paths].map((filename) => path.join(credentialsDir, filename));
-}
 function hasAnyMatrixAuth(params, env = process.env) {
-	return listMatrixCredentialPaths(params && typeof params === "object" && "cfg" in params ? params.cfg : params, params && typeof params === "object" && "cfg" in params ? params.env ?? env : env).some((filePath) => {
-		try {
-			return fs.existsSync(filePath);
-		} catch {
-			return false;
-		}
-	});
+	const resolvedEnv = params && typeof params === "object" && "cfg" in params ? params.env ?? env : env;
+	try {
+		return createPluginStateSyncKeyedStore("matrix", {
+			namespace: MATRIX_CREDENTIALS_NAMESPACE,
+			maxEntries: 256,
+			overflowPolicy: "reject-new",
+			env: resolvedEnv
+		}).entries().some((entry) => normalizeMatrixStoredCredentials(entry.value) !== null);
+	} catch {
+		return false;
+	}
 }
 //#endregion
 export { hasAnyMatrixAuth };

package/dist/{channel-CxqDh7mS.js → channel-j331Xd7b.js}

@@ -1,13 +1,13 @@
-import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-Bz00QTmQ.js";
+import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-kqquRzCf.js";
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import { d as resolveSingleAccountPromotionTarget, f as singleAccountKeysToMove, g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, n as matrixSetupAdapter, p as listMatrixAccountIds, t as createMatrixSetupWizardProxy, u as namedAccountPromotionKeys } from "./setup-core-DlmTyIP0.js";
-import { a as normalizeMatrixUserId, n as DEFAULT_ACCOUNT_ID$2, r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-CG9goLWp.js";
-import { t as normalizeMatrixApproverId } from "./approval-ids-C_2kSMdJ.js";
+import { d as resolveSingleAccountPromotionTarget, f as singleAccountKeysToMove, g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, n as matrixSetupAdapter, p as listMatrixAccountIds, t as createMatrixSetupWizardProxy, u as namedAccountPromotionKeys } from "./setup-core-XCdAx1nY.js";
+import { a as normalizeMatrixUserId, n as DEFAULT_ACCOUNT_ID$2, r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-B5GRV8wL.js";
+import { t as normalizeMatrixApproverId } from "./approval-ids-Dfn7oQAm.js";
 import { a as resolveMatrixTargetIdentity, i as resolveMatrixDirectUserId, n as normalizeMatrixMessagingTarget, r as normalizeMatrixResolvableTarget, t as isMatrixQualifiedUserId } from "./target-ids-B-5aQxwn.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-D2qTLe-C.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BA2Y6Crx.js";
 import { d as setMatrixThreadBindingIdleTimeoutBySessionKey, p as setMatrixThreadBindingMaxAgeBySessionKey } from "./thread-bindings-shared-CKnY4LSd.js";
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-OZoQf0kI.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-M3hRmGO-.js";
 import { n as resolveMatrixInboundConversation, t as defaultTopLevelPlacement } from "./thread-binding-api-DRbBZlhS.js";
 import { createLazyRuntimeModule, createLazyRuntimeNamedExport } from "openclaw/plugin-sdk/lazy-runtime";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
@@ -127,7 +127,7 @@ const matrixMessageActions = {
 		return extractToolSend(args, "sendMessage");
 	},
 	handleAction: async (ctx) => {
-		const { handleMatrixAction } = await import("./tool-actions.runtime-CnyhVPoY.js");
+		const { handleMatrixAction } = await import("./tool-actions.runtime-C0jgWYhX.js");
 		const { action, params, cfg, accountId, mediaLocalRoots } = ctx;
 		const dispatch = async (actionParams) => await handleMatrixAction({
 			...actionParams,
@@ -601,7 +601,7 @@ const matrixNativeApprovalCapability = createApproverRestrictedNativeApprovalCap
 			approvalKind,
 			request
 		}),
-		load: async () => (await import("./approval-handler.runtime--Ei44Vo2.js")).matrixApprovalNativeRuntime
+		load: async () => (await import("./approval-handler.runtime-BEa98wwG.js")).matrixApprovalNativeRuntime
 	})
 });
 const splitMatrixApprovalCapability = splitChannelApprovalCapability(matrixNativeApprovalCapability);
@@ -780,7 +780,7 @@ function resolveMatrixGroupToolPolicy(params) {
 }
 //#endregion
 //#region extensions/matrix/src/resolver.ts
-const loadMatrixChannelRuntime$1 = createLazyRuntimeNamedExport(() => import("./resolver.runtime-MeaT1zXx.js"), "matrixResolverRuntime");
+const loadMatrixChannelRuntime$1 = createLazyRuntimeNamedExport(() => import("./resolver.runtime-CC0VVsAt.js"), "matrixResolverRuntime");
 const matrixResolverAdapter = { resolveTargets: async ({ cfg, accountId, inputs, kind, runtime }) => (await loadMatrixChannelRuntime$1()).resolveMatrixTargets({
 	cfg,
 	accountId,
@@ -906,9 +906,9 @@ function resolveMatrixOutboundSessionRoute(params) {
 //#endregion
 //#region extensions/matrix/src/channel.ts
 let matrixStartupLock = Promise.resolve();
-const loadMatrixSetupWizard = createLazyRuntimeNamedExport(() => import("./setup-surface-2SS94JV0.js").then((n) => n.t), "matrixSetupWizard");
-const loadMatrixChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-wNfJc57I.js"), "matrixChannelRuntime");
-const loadMatrixDoctorModule = createLazyRuntimeModule(() => import("./doctor-BGTs609f.js"));
+const loadMatrixSetupWizard = createLazyRuntimeNamedExport(() => import("./setup-surface-CzUiTe_k.js").then((n) => n.t), "matrixSetupWizard");
+const loadMatrixChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-BIwlVfQw.js"), "matrixChannelRuntime");
+const loadMatrixDoctorModule = createLazyRuntimeModule(() => import("./doctor-DwUVm5Lw.js"));
 const meta = {
 	id: "matrix",
 	label: "Matrix",
@@ -1176,6 +1176,7 @@ const matrixPlugin = createChatChannelPlugin({
 		messaging: {
 			defaultMarkdownTableMode: "bullets",
 			targetPrefixes: ["matrix"],
+			targetIdComparison: "case-sensitive",
 			normalizeTarget: normalizeMatrixMessagingTarget,
 			resolveInboundConversation: ({ to, conversationId, threadId }) => resolveMatrixInboundConversation({
 				to,
@@ -1280,7 +1281,7 @@ const matrixPlugin = createChatChannelPlugin({
 			await previousLock;
 			let monitorMatrixProvider;
 			try {
-				monitorMatrixProvider = (await import("./monitor-C_kgPPeV.js")).monitorMatrixProvider;
+				monitorMatrixProvider = (await import("./monitor-BtUIds8T.js")).monitorMatrixProvider;
 			} finally {
 				releaseLock();
 			}

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as matrixPlugin } from "./channel-CxqDh7mS.js";
+import { t as matrixPlugin } from "./channel-j331Xd7b.js";
 export { matrixPlugin };

package/dist/{channel.runtime-wNfJc57I.js → channel.runtime-BIwlVfQw.js}

@@ -1,18 +1,18 @@
-import { a as sendMessageMatrix, c as sendTypingMatrix, o as sendPollMatrix } from "./send-C7xuGWpv.js";
+import { a as sendMessageMatrix, c as sendTypingMatrix, o as sendPollMatrix } from "./send-BJbrdmNm.js";
 import { t as isBunRuntime } from "./runtime-BefyhPWv.js";
-import { f as resolveMatrixAuth } from "./shared-DgvN5rBx.js";
-import "./client-DP0nmFxK.js";
-import { n as listMatrixDirectoryGroupsLive, r as listMatrixDirectoryPeersLive } from "./directory-live-DPy2aaPF.js";
+import { f as resolveMatrixAuth } from "./shared-DquM1oz6.js";
+import "./client-CA0PULls.js";
+import { n as listMatrixDirectoryGroupsLive, r as listMatrixDirectoryPeersLive } from "./directory-live-DiC-0XBC.js";
 import { p as resolveOutboundSendDep, r as chunkTextForOutbound } from "./runtime-api-D1xI_cvh.js";
-import { t as resolveMatrixTargets } from "./resolve-targets-DlLrfWDy.js";
+import { t as resolveMatrixTargets } from "./resolve-targets-DVoj-YxB.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { createReplyToFanout } from "openclaw/plugin-sdk/channel-outbound";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { renderMessagePresentationFallbackText } from "openclaw/plugin-sdk/interactive-runtime";
-import { resolvePayloadMediaUrls } from "openclaw/plugin-sdk/reply-payload";
+import { resolvePayloadMediaUrls, sendPayloadMediaSequence } from "openclaw/plugin-sdk/reply-payload";
 //#region extensions/matrix/src/matrix/probe.ts
-const loadMatrixProbeRuntimeDeps = createLazyRuntimeModule(() => import("./probe.runtime-Dry8PTWC.js").then((runtimeModule) => ({ createMatrixClient: runtimeModule.createMatrixClient })));
+const loadMatrixProbeRuntimeDeps = createLazyRuntimeModule(() => import("./probe.runtime-sBV-Govx.js").then((runtimeModule) => ({ createMatrixClient: runtimeModule.createMatrixClient })));
 async function probeMatrix(params) {
 	const started = Date.now();
 	const result = {
@@ -160,12 +160,12 @@ const matrixChannelRuntime = {
 			const urls = resolvePayloadMediaUrls(payload);
 			const payloadText = resolveMatrixPayloadText(payload);
 			if (urls.length > 0) {
-				let lastResult;
-				for (let i = 0; i < urls.length; i++) {
-					const isFirst = i === 0;
-					lastResult = await send(to, isFirst ? payloadText : "", {
+				const lastResult = await sendPayloadMediaSequence({
+					text: payloadText,
+					mediaUrls: urls,
+					send: async ({ text, mediaUrl, isFirst }) => await send(to, text, {
 						cfg,
-						mediaUrl: urls[i],
+						mediaUrl,
 						mediaAccess,
 						mediaLocalRoots,
 						mediaReadFile,
@@ -175,9 +175,9 @@ const matrixChannelRuntime = {
 						audioAsVoice: payload.audioAsVoice ?? audioAsVoice,
 						extraContent: isFirst ? resolveMatrixExtraContent(payload) : void 0,
 						onDeliveryResult: resolveMatrixDeliveryProgress(onDeliveryResult)
-					});
-				}
-				return {
+					})
+				});
+				if (lastResult !== void 0) return {
 					channel: "matrix",
 					messageId: lastResult.messageId,
 					roomId: lastResult.roomId
@@ -185,7 +185,6 @@ const matrixChannelRuntime = {
 			}
 			const result = await send(to, payloadText, {
 				cfg,
-				mediaUrl: payload.mediaUrl,
 				mediaAccess,
 				mediaLocalRoots,
 				mediaReadFile,

package/dist/{cli-o00oTJhx.js → cli-0EcKfqFw.js}

@@ -1,16 +1,16 @@
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import { t as getMatrixRuntime } from "./runtime-CveSqMOP.js";
-import { c as resolveMatrixConfigPath, g as resolveMatrixAccount, l as updateMatrixAccountConfig, n as matrixSetupAdapter } from "./setup-core-DlmTyIP0.js";
+import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
+import { c as resolveMatrixConfigPath, g as resolveMatrixAccount, l as updateMatrixAccountConfig, n as matrixSetupAdapter } from "./setup-core-XCdAx1nY.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { n as withResolvedActionClient } from "./client-ClHisZbf.js";
-import { p as resolveMatrixAuthContext } from "./shared-DgvN5rBx.js";
-import "./client-DP0nmFxK.js";
+import { n as withResolvedActionClient } from "./client-BtG4quUl.js";
+import { p as resolveMatrixAuthContext } from "./shared-DquM1oz6.js";
+import "./client-CA0PULls.js";
 import { a as formatZonedTimestamp } from "./runtime-api-D1xI_cvh.js";
 import { isOpenClawManagedMatrixDevice, summarizeMatrixDeviceHealth } from "./device-health-D4LBxuPq.js";
-import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-iUHCoks3.js";
-import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-DLSe3sP7.js";
+import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-Bh2XtJwN.js";
+import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-DjxyWTNP.js";
 import { t as resolveMatrixRoomKeyBackupIssue } from "./backup-health-Dm_YMVFT.js";
-import { setMatrixSdkConsoleLogging, setMatrixSdkLogMode } from "./logging-CFJrbDAN.js";
+import { setMatrixSdkConsoleLogging, setMatrixSdkLogMode } from "./logging-QH-48Gr6.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { parseStrictInteger, timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
@@ -36,8 +36,9 @@ async function pruneMatrixStaleGatewayDevices(opts = {}) {
 //#endregion
 //#region extensions/matrix/src/cli.ts
 let matrixCliExitScheduled = false;
-const loadMatrixActionClientModule = createLazyRuntimeModule(() => import("./client-ClHisZbf.js").then((n) => n.t));
-const loadMatrixDirectManagementModule = createLazyRuntimeModule(() => import("./send-C7xuGWpv.js").then((n) => n.d));
+const MATRIX_CLI_RECOVERY_KEY_STDIN_MAX_BYTES = 1024 * 1024;
+const loadMatrixActionClientModule = createLazyRuntimeModule(() => import("./client-BtG4quUl.js").then((n) => n.t));
+const loadMatrixDirectManagementModule = createLazyRuntimeModule(() => import("./send-BJbrdmNm.js").then((n) => n.d));
 function scheduleMatrixCliExit() {
 	if (matrixCliExitScheduled || process.env.VITEST) return;
 	matrixCliExitScheduled = true;
@@ -54,8 +55,14 @@ function markCliFailure() {
 }
 async function readMatrixCliRecoveryKeyFromStdin() {
 	const chunks = [];
-	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-	const recoveryKey = Buffer.concat(chunks).toString("utf8").trim();
+	let totalBytes = 0;
+	for await (const chunk of process.stdin) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+		totalBytes += buffer.byteLength;
+		if (totalBytes > MATRIX_CLI_RECOVERY_KEY_STDIN_MAX_BYTES) throw new Error(`Matrix recovery key stdin exceeds ${MATRIX_CLI_RECOVERY_KEY_STDIN_MAX_BYTES} bytes.`);
+		chunks.push(buffer);
+	}
+	const recoveryKey = Buffer.concat(chunks, totalBytes).toString("utf8").trim();
 	if (!recoveryKey) throw new Error("Matrix recovery key was requested from stdin, but stdin was empty.");
 	return recoveryKey;
 }
@@ -205,7 +212,7 @@ async function addMatrixAccount(params) {
 		backupVersion: null
 	};
 	if (accountConfig.encryption === true) {
-		const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-CCsexWTZ.js");
+		const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-DGPOOdz-.js");
 		verificationBootstrap = await maybeBootstrapNewEncryptedMatrixAccount({
 			previousCfg: cfg,
 			cfg: updated,
@@ -936,13 +943,16 @@ function registerMatrixCli(params) {
 			errorPrefix: "Direct room repair failed"
 		});
 	});
-	root.command("encryption").description("Set up Matrix end-to-end encryption").command("setup").description("Enable Matrix E2EE, bootstrap verification, and print next steps").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key <key>", "Recovery key to apply before bootstrap").option("--force-reset-cross-signing", "Force reset cross-signing identity before bootstrap (requires active recovery key)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+	root.command("encryption").description("Set up Matrix end-to-end encryption").command("setup").description("Enable Matrix E2EE, bootstrap verification, and print next steps").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key <key>", "Recovery key to apply before bootstrap (prefer --recovery-key-stdin)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--force-reset-cross-signing", "Force reset cross-signing identity before bootstrap (requires active recovery key)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
 		await runMatrixCliCommand({
 			verbose: options.verbose === true,
 			json: options.json === true,
 			run: async () => await setupMatrixEncryption({
 				account: options.account,
-				recoveryKey: options.recoveryKey,
+				recoveryKey: await resolveMatrixCliRecoveryKeyInput({
+					recoveryKey: options.recoveryKey,
+					recoveryKeyStdin: options.recoveryKeyStdin
+				}),
 				forceResetCrossSigning: options.forceResetCrossSigning === true
 			}),
 			onText: (result, verbose) => {

package/dist/{cli-metadata-Gf3HSJ2c.js → cli-metadata-Xq1Xb15R.js}

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/matrix/src/cli-metadata.ts
 function registerMatrixCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerMatrixCli } = await import("./cli-o00oTJhx.js");
+		const { registerMatrixCli } = await import("./cli-0EcKfqFw.js");
 		registerMatrixCli({ program });
 	}, { descriptors: [{
 		name: "matrix",

package/dist/cli-metadata.js

@@ -1,2 +1,2 @@
-import { n as registerMatrixCliMetadata, t as cli_metadata_default } from "./cli-metadata-Gf3HSJ2c.js";
+import { n as registerMatrixCliMetadata, t as cli_metadata_default } from "./cli-metadata-Xq1Xb15R.js";
 export { cli_metadata_default as default, registerMatrixCliMetadata };

package/dist/{client-ClHisZbf.js → client-BtG4quUl.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { u as resolveMatrixRoomId } from "./send-C7xuGWpv.js";
-import { n as withResolvedRuntimeMatrixClient } from "./client-bootstrap-PqYOS-mO.js";
+import { u as resolveMatrixRoomId } from "./send-BJbrdmNm.js";
+import { n as withResolvedRuntimeMatrixClient } from "./client-bootstrap-Dk5EAn3n.js";
 //#region extensions/matrix/src/matrix/actions/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
 	withResolvedActionClient: () => withResolvedActionClient,

package/dist/{client-DP0nmFxK.js → client-CA0PULls.js}

@@ -3,8 +3,8 @@ import { t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
 import { i as resolveScopedMatrixEnvConfig, r as resolveMatrixEnvAuthReadiness, t as hasReadyMatrixEnvAuth } from "./env-auth-CQsYbz-p.js";
 import { n as validateMatrixHomeserverUrl, t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
 import { t as isBunRuntime } from "./runtime-BefyhPWv.js";
-import { d as backfillMatrixAuthDeviceIdAfterStartup, f as resolveMatrixAuth, i as resolveSharedMatrixClient, m as resolveMatrixConfigForAccount, n as releaseSharedClientInstance, o as stopSharedClientForAccount, p as resolveMatrixAuthContext, r as removeSharedClientInstance, s as stopSharedClientInstance, t as acquireSharedMatrixClient } from "./shared-DgvN5rBx.js";
-import { t as createMatrixClient } from "./create-client-D9z9RjCM.js";
+import { d as backfillMatrixAuthDeviceIdAfterStartup, f as resolveMatrixAuth, i as resolveSharedMatrixClient, m as resolveMatrixConfigForAccount, n as releaseSharedClientInstance, o as stopSharedClientForAccount, p as resolveMatrixAuthContext, r as removeSharedClientInstance, s as stopSharedClientInstance, t as acquireSharedMatrixClient } from "./shared-DquM1oz6.js";
+import { t as createMatrixClient } from "./create-client-WQExaby_.js";
 //#region extensions/matrix/src/matrix/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
 	acquireSharedMatrixClient: () => acquireSharedMatrixClient,

package/dist/{client-bootstrap-PqYOS-mO.js → client-bootstrap-Dk5EAn3n.js}

@@ -8,7 +8,7 @@ var client_bootstrap_exports = /* @__PURE__ */ __exportAll({
 	resolveRuntimeMatrixClientWithReadiness: () => resolveRuntimeMatrixClientWithReadiness,
 	withResolvedRuntimeMatrixClient: () => withResolvedRuntimeMatrixClient
 });
-const loadMatrixSharedClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./client-DP0nmFxK.js").then((n) => n.t), import("./shared-DgvN5rBx.js").then((n) => n.a)]).then(([clientModule, sharedModule]) => ({
+const loadMatrixSharedClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./client-CA0PULls.js").then((n) => n.t), import("./shared-DquM1oz6.js").then((n) => n.a)]).then(([clientModule, sharedModule]) => ({
 	acquireSharedMatrixClient: clientModule.acquireSharedMatrixClient,
 	resolveMatrixAuthContext: clientModule.resolveMatrixAuthContext,
 	releaseSharedClientInstance: sharedModule.releaseSharedClientInstance

package/dist/{config-schema-CG9goLWp.js → config-schema-B5GRV8wL.js}

@@ -1,12 +1,12 @@
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import { g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, p as listMatrixAccountIds } from "./setup-core-DlmTyIP0.js";
+import { g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, p as listMatrixAccountIds } from "./setup-core-XCdAx1nY.js";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createChannelConfigUiHints } from "openclaw/plugin-sdk/channel-core";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1 } from "openclaw/plugin-sdk/account-id";
 import { resolveAllowlistMatchByCandidates } from "openclaw/plugin-sdk/allow-from";
 import { normalizeStringEntries as normalizeStringEntries$1 } from "openclaw/plugin-sdk/string-normalization-runtime";
-import { AllowFromListSchema, BlockStreamingCoalesceSchema, ContextVisibilityModeSchema, GroupPolicySchema, MarkdownConfigSchema, MentionPatternsPolicySchema, ToolPolicySchema, buildChannelConfigSchema, buildNestedDmConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
+import { AllowFromListSchema, BlockStreamingCoalesceSchema, ContextVisibilityModeSchema, GroupPolicySchema, MarkdownConfigSchema, MentionPatternsPolicySchema, buildChannelConfigSchema, buildGroupEntrySchema, buildNestedDmConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
 import { buildSecretInputSchema } from "openclaw/plugin-sdk/secret-input";
 import { z } from "zod";
 //#region extensions/matrix/src/matrix/monitor/allowlist.ts
@@ -180,18 +180,16 @@ const botLoopProtectionSchema = z.object({
 	windowSeconds: z.number().int().positive().optional(),
 	cooldownSeconds: z.number().int().positive().optional()
 }).strict().optional();
-const matrixRoomSchema = z.object({
+const matrixRoomSchema = buildGroupEntrySchema({
 	account: z.string().optional(),
-	enabled: z.boolean().optional(),
-	requireMention: z.boolean().optional(),
 	allowBots: z.union([z.boolean(), z.literal("mentions")]).optional(),
 	botLoopProtection: botLoopProtectionSchema,
-	tools: ToolPolicySchema,
 	autoReply: z.boolean().optional(),
-	users: AllowFromListSchema,
-	skills: z.array(z.string()).optional(),
-	systemPrompt: z.string().optional()
-}).optional();
+	users: AllowFromListSchema
+}).omit({
+	toolsBySender: true,
+	allowFrom: true
+}).strict().optional();
 const matrixNetworkSchema = z.object({ dangerouslyAllowPrivateNetwork: z.boolean().optional() }).strict().optional();
 const matrixStreamingSchema = z.object({
 	mode: z.enum([

package/dist/contract-api.js

@@ -1,3 +1,3 @@
-import { d as resolveSingleAccountPromotionTarget, f as singleAccountKeysToMove, n as matrixSetupAdapter, u as namedAccountPromotionKeys } from "./setup-core-DlmTyIP0.js";
-import { n as matrixOnboardingAdapter } from "./setup-surface-2SS94JV0.js";
+import { d as resolveSingleAccountPromotionTarget, f as singleAccountKeysToMove, n as matrixSetupAdapter, u as namedAccountPromotionKeys } from "./setup-core-XCdAx1nY.js";
+import { n as matrixOnboardingAdapter } from "./setup-surface-CzUiTe_k.js";
 export { matrixSetupAdapter, matrixOnboardingAdapter as matrixSetupWizard, namedAccountPromotionKeys, resolveSingleAccountPromotionTarget, singleAccountKeysToMove };

package/dist/{create-client-D9z9RjCM.js → create-client-WQExaby_.js}

@@ -1,14 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
-import { d as writeStorageMeta, l as resolveMatrixStoragePaths, r as maybeMigrateLegacyStorage } from "./storage-BtSOar8T.js";
-import "./shared-DgvN5rBx.js";
+import { d as writeStorageMeta, l as resolveMatrixStoragePaths, r as maybeMigrateLegacyStorage } from "./storage-CzHxeF5E.js";
+import "./shared-DquM1oz6.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import fs from "node:fs";
 import { ssrfPolicyFromDangerouslyAllowPrivateNetwork } from "openclaw/plugin-sdk/ssrf-runtime";
+import fs from "node:fs";
 //#region extensions/matrix/src/matrix/client/create-client.ts
 var create_client_exports = /* @__PURE__ */ __exportAll({ createMatrixClient: () => createMatrixClient });
-const loadMatrixCreateClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-CI8E2TKg.js"), import("./logging-CFJrbDAN.js")]).then(([sdkModule, loggingModule]) => ({
+const loadMatrixCreateClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-CIDZXWpZ.js"), import("./logging-QH-48Gr6.js")]).then(([sdkModule, loggingModule]) => ({
 	MatrixClient: sdkModule.MatrixClient,
 	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
 })));

package/dist/credentials-W2EmwRhu.js

@@ -0,0 +1,65 @@
+import { a as resolveMatrixCredentialsPath, r as resolveMatrixCredentialsDir } from "./storage-paths-gUmSydsW.js";
+import { a as isMatrixCredentialRevocation, c as normalizeMatrixStoredCredentials, l as openMatrixCredentialsStore, n as clearMatrixCredentials, o as loadMatrixCredentials, r as credentialsMatchConfig, s as matrixCredentialsStoreKey } from "./credentials-read-DVmFCm7X.js";
+import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+//#region extensions/matrix/src/matrix/credentials.ts
+function requireCredentialStoreUpdate(store) {
+	if (!store.update) throw new Error("Matrix credentials require atomic plugin-state updates");
+	return store.update;
+}
+async function saveMatrixCredentials(credentials, env = process.env, accountId) {
+	const normalizedAccountId = normalizeAccountId(accountId);
+	const store = openMatrixCredentialsStore(env);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	requireCredentialStoreUpdate(store)(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
+		const existing = normalizeMatrixStoredCredentials(current, normalizedAccountId);
+		return {
+			accountId: normalizedAccountId,
+			homeserver: credentials.homeserver,
+			userId: credentials.userId,
+			accessToken: credentials.accessToken,
+			...typeof credentials.deviceId === "string" ? { deviceId: credentials.deviceId } : {},
+			createdAt: existing?.createdAt ?? now,
+			lastUsedAt: now
+		};
+	});
+}
+async function saveBackfilledMatrixDeviceId(credentials, env = process.env, accountId) {
+	const normalizedAccountId = normalizeAccountId(accountId);
+	const store = openMatrixCredentialsStore(env);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	let result = "saved";
+	requireCredentialStoreUpdate(store)(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
+		if (isMatrixCredentialRevocation(current, normalizedAccountId)) {
+			result = "skipped";
+			return current;
+		}
+		const existing = normalizeMatrixStoredCredentials(current, normalizedAccountId);
+		if (existing && (existing.homeserver !== credentials.homeserver || existing.userId !== credentials.userId || existing.accessToken !== credentials.accessToken)) {
+			result = "skipped";
+			return existing;
+		}
+		return {
+			accountId: normalizedAccountId,
+			homeserver: credentials.homeserver,
+			userId: credentials.userId,
+			accessToken: credentials.accessToken,
+			...typeof credentials.deviceId === "string" ? { deviceId: credentials.deviceId } : {},
+			createdAt: existing?.createdAt ?? now,
+			lastUsedAt: now
+		};
+	});
+	return result;
+}
+async function touchMatrixCredentials(env = process.env, accountId) {
+	const normalizedAccountId = normalizeAccountId(accountId);
+	requireCredentialStoreUpdate(openMatrixCredentialsStore(env))(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
+		if (isMatrixCredentialRevocation(current, normalizedAccountId)) return current;
+		const existing = normalizeMatrixStoredCredentials(current, normalizedAccountId);
+		return existing ? {
+			...existing,
+			lastUsedAt: (/* @__PURE__ */ new Date()).toISOString()
+		} : void 0;
+	});
+}
+//#endregion
+export { clearMatrixCredentials, credentialsMatchConfig, loadMatrixCredentials, resolveMatrixCredentialsDir, resolveMatrixCredentialsPath, saveBackfilledMatrixDeviceId, saveMatrixCredentials, touchMatrixCredentials };