@openclaw/matrix 2026.7.2-beta.4 → 2026.7.2-beta.7

package/dist/{cli-CcPuMyCk.js → cli-DMqfDE-q.js}

@@ -1,45 +1,24 @@
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import { _ as resolveMatrixAccount, l as resolveMatrixConfigPath, n as matrixSetupAdapter, u as updateMatrixAccountConfig } from "./setup-core-D6gyoyeg.js";
+import { i as resolveMatrixAccount } from "./accounts-DfngqebB.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { n as withResolvedActionClient } from "./client-BwX6rURh.js";
-import { p as resolveMatrixAuthContext } from "./shared-C7Vm9RxI.js";
-import "./client-Dg8dk8NW.js";
+import { l as resolveMatrixConfigPath, n as matrixSetupAdapter, u as updateMatrixAccountConfig } from "./setup-core-BVfBv2ai.js";
+import { n as withResolvedActionClient } from "./client-6eRENr7k.js";
+import { p as resolveMatrixAuthContext } from "./shared-CUMWxcMz.js";
+import "./client-Dbso3-0V.js";
 import { a as formatZonedTimestamp } from "./runtime-api-D1xI_cvh.js";
-import { isOpenClawManagedMatrixDevice, summarizeMatrixDeviceHealth } from "./device-health-D4LBxuPq.js";
-import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-C2My3TML.js";
-import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-DhMBWxOJ.js";
 import { t as resolveMatrixRoomKeyBackupIssue } from "./backup-health-Dm_YMVFT.js";
-import { setMatrixSdkConsoleLogging, setMatrixSdkLogMode } from "./logging-QH-48Gr6.js";
+import { i as setMatrixSdkLogMode, r as setMatrixSdkConsoleLogging } from "./logging-DV-p52N0.js";
+import { n as isOpenClawManagedMatrixDevice, r as summarizeMatrixDeviceHealth } from "./device-health-B4-YXtJR.js";
+import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-CffmyW_4.js";
+import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-DYMQ1QpI.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { parseStrictInteger, timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import { readByteStreamWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
-//#region extensions/matrix/src/matrix/actions/devices.ts
-async function listMatrixOwnDevices(opts = {}) {
-	return await withResolvedActionClient(opts, async (client) => await client.listOwnDevices());
-}
-async function pruneMatrixStaleGatewayDevices(opts = {}) {
-	return await withResolvedActionClient(opts, async (client) => {
-		const devices = await client.listOwnDevices();
-		const staleGatewayDeviceIds = summarizeMatrixDeviceHealth(devices).staleOpenClawDevices.map((device) => device.deviceId);
-		return {
-			before: devices,
-			staleGatewayDeviceIds,
-			...staleGatewayDeviceIds.length > 0 ? await client.deleteOwnDevices(staleGatewayDeviceIds) : {
-				currentDeviceId: devices.find((device) => device.current)?.deviceId ?? null,
-				deletedDeviceIds: [],
-				remainingDevices: devices
-			}
-		};
-	});
-}
-//#endregion
-//#region extensions/matrix/src/cli.ts
+//#region extensions/matrix/src/cli-shared.ts
 let matrixCliExitScheduled = false;
 const MATRIX_CLI_RECOVERY_KEY_STDIN_MAX_BYTES = 1024 * 1024;
-const loadMatrixActionClientModule = createLazyRuntimeModule(() => import("./client-BwX6rURh.js").then((n) => n.t));
-const loadMatrixDirectManagementModule = createLazyRuntimeModule(() => import("./send-CZCmDQu8.js").then((n) => n.d));
 function scheduleMatrixCliExit() {
 	if (matrixCliExitScheduled || process.env.VITEST) return;
 	matrixCliExitScheduled = true;
@@ -72,28 +51,18 @@ async function requireMatrixCliRecoveryKeyInput(options) {
 	if (!recoveryKey) throw new Error("Matrix recovery key is required. Pass --recovery-key-stdin to read it from stdin.");
 	return recoveryKey;
 }
-function toErrorMessage(err) {
-	return formatMatrixErrorMessage(err);
-}
 function printJson(payload) {
 	process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
 }
-function formatLocalTimestamp(value) {
-	if (!value) return null;
-	const parsed = new Date(value);
-	if (!Number.isFinite(parsed.getTime())) return value;
-	return formatZonedTimestamp(parsed, { displaySeconds: true }) ?? value;
-}
 function printTimestamp(label, value) {
-	const formatted = formatLocalTimestamp(value);
-	if (formatted) console.log(`${label}: ${formatMatrixCliText(formatted)}`);
+	if (!value) return;
+	const parsed = new Date(value);
+	const formatted = Number.isFinite(parsed.getTime()) ? formatZonedTimestamp(parsed, { displaySeconds: true }) ?? value : value;
+	console.log(`${label}: ${formatMatrixCliText(formatted)}`);
 }
 function printAccountLabel(accountId) {
 	console.log(`Account: ${formatMatrixCliText(normalizeAccountId(accountId))}`);
 }
-function resolveMatrixCliAccountId(accountId) {
-	return resolveMatrixCliAccountContext(accountId).accountId;
-}
 function resolveMatrixCliAccountContext(accountId) {
 	const cfg = getMatrixRuntime().config.current();
 	return {
@@ -132,19 +101,6 @@ function formatMatrixCliShellArg(value) {
 function formatMatrixCliText(value, fallback = "unknown") {
 	return sanitizeMatrixCliText(value ?? fallback);
 }
-function printMatrixOwnDevices(devices) {
-	if (devices.length === 0) {
-		console.log("Devices: none");
-		return;
-	}
-	for (const device of devices) {
-		const labels = [device.current ? "current" : null, device.displayName].filter((label) => Boolean(label)).map((label) => formatMatrixCliText(label));
-		console.log(`- ${formatMatrixCliText(device.deviceId)}${labels.length ? ` (${labels.join(", ")})` : ""}`);
-		const lastSeenAt = timestampMsToIsoString(device.lastSeenTs);
-		if (lastSeenAt) printTimestamp("  Last seen", lastSeenAt);
-		if (device.lastSeenIp) console.log(`  Last IP: ${formatMatrixCliText(device.lastSeenIp)}`);
-	}
-}
 function configureCliLogMode(verbose) {
 	setMatrixSdkLogMode(verbose ? "default" : "quiet");
 	setMatrixSdkConsoleLogging(verbose);
@@ -158,209 +114,6 @@ function parseOptionalInt(value, fieldName, opts = {}) {
 	if (opts.min !== void 0 && parsed < opts.min) throw new Error(opts.min === 1 ? `${fieldName} must be a positive integer` : `${fieldName} must be a non-negative integer`);
 	return parsed;
 }
-async function addMatrixAccount(params) {
-	const initialSyncLimit = parseOptionalInt(params.initialSyncLimit, "--initial-sync-limit", { min: 0 });
-	const runtime = getMatrixRuntime();
-	const cfg = runtime.config.current();
-	if (!matrixSetupAdapter.applyAccountConfig) throw new Error("Matrix account setup is unavailable.");
-	const input = {
-		name: params.name,
-		avatarUrl: params.avatarUrl,
-		homeserver: params.homeserver,
-		dangerouslyAllowPrivateNetwork: params.allowPrivateNetwork,
-		proxy: params.proxy,
-		userId: params.userId,
-		accessToken: params.accessToken,
-		password: params.password,
-		deviceName: params.deviceName,
-		initialSyncLimit,
-		useEnv: params.useEnv === true
-	};
-	const accountId = matrixSetupAdapter.resolveAccountId?.({
-		cfg,
-		accountId: params.account,
-		input
-	}) ?? normalizeAccountId(params.account?.trim() || params.name?.trim());
-	const validationError = matrixSetupAdapter.validateInput?.({
-		cfg,
-		accountId,
-		input
-	});
-	if (validationError) throw new Error(validationError);
-	let updated = matrixSetupAdapter.applyAccountConfig({
-		cfg,
-		accountId,
-		input
-	});
-	if (params.enableEncryption === true) updated = updateMatrixAccountConfig(updated, accountId, { encryption: true });
-	await runtime.config.replaceConfigFile({
-		nextConfig: updated,
-		afterWrite: { mode: "auto" }
-	});
-	const accountConfig = resolveMatrixAccountConfig({
-		cfg: updated,
-		accountId
-	});
-	let verificationBootstrap = {
-		attempted: false,
-		success: false,
-		recoveryKeyCreatedAt: null,
-		backupVersion: null
-	};
-	if (accountConfig.encryption === true) {
-		const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-C9w01xQK.js");
-		verificationBootstrap = await maybeBootstrapNewEncryptedMatrixAccount({
-			previousCfg: cfg,
-			cfg: updated,
-			accountId
-		});
-	}
-	const desiredDisplayName = input.name?.trim();
-	const desiredAvatarUrl = input.avatarUrl?.trim();
-	let profile = {
-		attempted: false,
-		displayNameUpdated: false,
-		avatarUpdated: false,
-		resolvedAvatarUrl: null,
-		convertedAvatarFromHttp: false
-	};
-	if (desiredDisplayName || desiredAvatarUrl) try {
-		const synced = await updateMatrixOwnProfile({
-			cfg: updated,
-			accountId,
-			displayName: desiredDisplayName,
-			avatarUrl: desiredAvatarUrl
-		});
-		let resolvedAvatarUrl = synced.resolvedAvatarUrl;
-		if (synced.convertedAvatarFromHttp && synced.resolvedAvatarUrl) {
-			const withAvatar = updateMatrixAccountConfig(runtime.config.current(), accountId, { avatarUrl: synced.resolvedAvatarUrl });
-			await runtime.config.replaceConfigFile({
-				nextConfig: withAvatar,
-				afterWrite: { mode: "auto" }
-			});
-			resolvedAvatarUrl = synced.resolvedAvatarUrl;
-		}
-		profile = {
-			attempted: true,
-			displayNameUpdated: synced.displayNameUpdated,
-			avatarUpdated: synced.avatarUpdated,
-			resolvedAvatarUrl,
-			convertedAvatarFromHttp: synced.convertedAvatarFromHttp
-		};
-	} catch (err) {
-		profile = {
-			attempted: true,
-			displayNameUpdated: false,
-			avatarUpdated: false,
-			resolvedAvatarUrl: null,
-			convertedAvatarFromHttp: false,
-			error: toErrorMessage(err)
-		};
-	}
-	let deviceHealth;
-	try {
-		const addedDevices = await listMatrixOwnDevices({
-			accountId,
-			cfg: updated
-		});
-		deviceHealth = {
-			currentDeviceId: addedDevices.find((device) => device.current)?.deviceId ?? null,
-			staleOpenClawDeviceIds: addedDevices.filter((device) => !device.current && isOpenClawManagedMatrixDevice(device.displayName)).map((device) => device.deviceId)
-		};
-	} catch (err) {
-		deviceHealth = {
-			currentDeviceId: null,
-			staleOpenClawDeviceIds: [],
-			error: toErrorMessage(err)
-		};
-	}
-	return {
-		accountId,
-		configPath: resolveMatrixConfigPath(updated, accountId),
-		useEnv: input.useEnv === true,
-		encryptionEnabled: accountConfig.encryption === true,
-		deviceHealth,
-		verificationBootstrap,
-		profile
-	};
-}
-function printDirectRoomCandidate(room) {
-	const members = room.joinedMembers === null ? "unavailable" : room.joinedMembers.map((member) => formatMatrixCliText(member)).join(", ") || "none";
-	console.log(`- ${formatMatrixCliText(room.roomId)} [${room.source}] strict=${room.strict ? "yes" : "no"} joined=${members}`);
-}
-function printDirectRoomInspection(result) {
-	printAccountLabel(result.accountId);
-	console.log(`Peer: ${formatMatrixCliText(result.remoteUserId)}`);
-	console.log(`Self: ${formatMatrixCliText(result.selfUserId)}`);
-	console.log(`Active direct room: ${formatMatrixCliText(result.activeRoomId, "none")}`);
-	console.log(`Mapped rooms: ${result.mappedRoomIds.length ? result.mappedRoomIds.map((roomId) => formatMatrixCliText(roomId)).join(", ") : "none"}`);
-	console.log(`Discovered strict rooms: ${result.discoveredStrictRoomIds.length ? result.discoveredStrictRoomIds.map((roomId) => formatMatrixCliText(roomId)).join(", ") : "none"}`);
-	if (result.mappedRooms.length > 0) {
-		console.log("Mapped room details:");
-		for (const room of result.mappedRooms) printDirectRoomCandidate(room);
-	}
-}
-async function inspectMatrixDirectRoom(params) {
-	const cfg = getMatrixRuntime().config.current();
-	const [{ withResolvedActionClient }, { inspectMatrixDirectRooms }] = await Promise.all([loadMatrixActionClientModule(), loadMatrixDirectManagementModule()]);
-	return await withResolvedActionClient({
-		accountId: params.accountId,
-		cfg
-	}, async (client) => {
-		const inspection = await inspectMatrixDirectRooms({
-			client,
-			remoteUserId: params.userId
-		});
-		return {
-			accountId: params.accountId,
-			remoteUserId: inspection.remoteUserId,
-			selfUserId: inspection.selfUserId,
-			mappedRoomIds: inspection.mappedRoomIds,
-			mappedRooms: inspection.mappedRooms.map(toCliDirectRoomCandidate),
-			discoveredStrictRoomIds: inspection.discoveredStrictRoomIds,
-			activeRoomId: inspection.activeRoomId
-		};
-	}, "persist");
-}
-async function repairMatrixDirectRoom(params) {
-	const cfg = getMatrixRuntime().config.current();
-	const account = resolveMatrixAccount({
-		cfg,
-		accountId: params.accountId
-	});
-	const [{ withStartedActionClient }, { repairMatrixDirectRooms }] = await Promise.all([loadMatrixActionClientModule(), loadMatrixDirectManagementModule()]);
-	return await withStartedActionClient({
-		accountId: params.accountId,
-		cfg
-	}, async (client) => {
-		const repaired = await repairMatrixDirectRooms({
-			client,
-			remoteUserId: params.userId,
-			encrypted: account.config.encryption === true
-		});
-		return {
-			accountId: params.accountId,
-			remoteUserId: repaired.remoteUserId,
-			selfUserId: repaired.selfUserId,
-			mappedRoomIds: repaired.mappedRoomIds,
-			mappedRooms: repaired.mappedRooms.map(toCliDirectRoomCandidate),
-			discoveredStrictRoomIds: repaired.discoveredStrictRoomIds,
-			activeRoomId: repaired.activeRoomId,
-			encrypted: account.config.encryption === true,
-			createdRoomId: repaired.createdRoomId,
-			changed: repaired.changed,
-			directContentBefore: repaired.directContentBefore,
-			directContentAfter: repaired.directContentAfter
-		};
-	});
-}
-async function setMatrixProfile(params) {
-	return await applyMatrixProfileUpdate({
-		account: params.account,
-		displayName: params.name,
-		avatarUrl: params.avatarUrl
-	});
-}
 async function runMatrixCliCommand(config) {
 	configureCliLogMode(config.verbose);
 	try {
@@ -369,7 +122,7 @@ async function runMatrixCliCommand(config) {
 		else config.onText(result, config.verbose);
 		if (config.shouldFail?.(result)) markCliFailure();
 	} catch (err) {
-		const message = toErrorMessage(err);
+		const message = formatMatrixErrorMessage(err);
 		if (config.json) printJson(config.onJsonError ? config.onJsonError(message) : { error: message });
 		else {
 			console.error(`${config.errorPrefix}: ${formatMatrixCliText(message)}`);
@@ -380,122 +133,6 @@ async function runMatrixCliCommand(config) {
 		scheduleMatrixCliExit();
 	}
 }
-function isMatrixVerificationSetupComplete(status) {
-	return status.encryptionEnabled && status.verified && status.crossSigningVerified && status.signedByOwner && status.serverDeviceKnown === true && resolveMatrixRoomKeyBackupIssue(resolveBackupStatus(status)).code === "ok";
-}
-function buildNoopMatrixVerificationBootstrap(status) {
-	return {
-		success: true,
-		verification: {
-			...status,
-			backup: resolveBackupStatus(status),
-			serverDeviceKnown: status.serverDeviceKnown ?? null
-		},
-		crossSigning: {
-			userId: status.userId,
-			masterKeyPublished: status.crossSigningVerified,
-			selfSigningKeyPublished: status.signedByOwner,
-			userSigningKeyPublished: status.signedByOwner,
-			published: status.crossSigningVerified && status.signedByOwner
-		},
-		pendingVerifications: status.pendingVerifications,
-		cryptoBootstrap: null
-	};
-}
-async function setupMatrixEncryption(params) {
-	const runtime = getMatrixRuntime();
-	const { accountId, cfg } = resolveMatrixCliAccountContext(params.account);
-	if (!resolveMatrixAccount({
-		cfg,
-		accountId
-	}).configured) throw new Error(`Matrix account "${accountId}" is not configured; run ${formatMatrixCliCommand("account add", accountId)} first.`);
-	const encryptionChanged = resolveMatrixAccountConfig({
-		cfg,
-		accountId
-	}).encryption !== true;
-	const updated = encryptionChanged ? updateMatrixAccountConfig(cfg, accountId, { encryption: true }) : cfg;
-	if (encryptionChanged) await runtime.config.replaceConfigFile({
-		nextConfig: updated,
-		afterWrite: { mode: "auto" }
-	});
-	const existingStatus = !encryptionChanged && !params.recoveryKey && params.forceResetCrossSigning !== true ? await getMatrixVerificationStatus({
-		accountId,
-		cfg: updated,
-		readiness: "none"
-	}) : null;
-	if (existingStatus && isMatrixVerificationSetupComplete(existingStatus)) return {
-		accountId,
-		configPath: resolveMatrixConfigPath(updated, accountId),
-		encryptionChanged,
-		bootstrap: buildNoopMatrixVerificationBootstrap(existingStatus),
-		status: existingStatus
-	};
-	const bootstrap = await bootstrapMatrixVerification({
-		accountId,
-		cfg: updated,
-		recoveryKey: params.recoveryKey,
-		forceResetCrossSigning: params.forceResetCrossSigning === true
-	});
-	const status = await getMatrixVerificationStatus({
-		accountId,
-		cfg: updated
-	});
-	return {
-		accountId,
-		configPath: resolveMatrixConfigPath(updated, accountId),
-		encryptionChanged,
-		bootstrap,
-		status
-	};
-}
-function toCliDirectRoomCandidate(room) {
-	return {
-		roomId: room.roomId,
-		source: room.source,
-		strict: room.strict,
-		joinedMembers: room.joinedMembers
-	};
-}
-function resolveBackupStatus(status) {
-	return {
-		serverVersion: status.backup?.serverVersion ?? status.backupVersion ?? null,
-		activeVersion: status.backup?.activeVersion ?? null,
-		trusted: status.backup?.trusted ?? null,
-		matchesDecryptionKey: status.backup?.matchesDecryptionKey ?? null,
-		decryptionKeyCached: status.backup?.decryptionKeyCached ?? null,
-		keyLoadAttempted: status.backup?.keyLoadAttempted ?? false,
-		keyLoadError: status.backup?.keyLoadError ?? null
-	};
-}
-function yesNoUnknown(value) {
-	if (value === true) return "yes";
-	if (value === false) return "no";
-	return "unknown";
-}
-function printBackupStatus(backup) {
-	console.log(`Backup server version: ${formatMatrixCliText(backup.serverVersion, "none")}`);
-	console.log(`Backup active on this device: ${formatMatrixCliText(backup.activeVersion, "no")}`);
-	console.log(`Backup trusted by this device: ${yesNoUnknown(backup.trusted)}`);
-	console.log(`Backup matches local decryption key: ${yesNoUnknown(backup.matchesDecryptionKey)}`);
-	console.log(`Backup key cached locally: ${yesNoUnknown(backup.decryptionKeyCached)}`);
-	console.log(`Backup key load attempted: ${yesNoUnknown(backup.keyLoadAttempted)}`);
-	if (backup.keyLoadError) console.log(`Backup key load error: ${formatMatrixCliText(backup.keyLoadError)}`);
-}
-function printVerificationIdentity(status) {
-	console.log(`User: ${formatMatrixCliText(status.userId)}`);
-	console.log(`Device: ${formatMatrixCliText(status.deviceId)}`);
-}
-function printVerificationBackupSummary(status) {
-	printBackupSummary(resolveBackupStatus(status));
-}
-function printVerificationBackupStatus(status) {
-	printBackupStatus(resolveBackupStatus(status));
-}
-function printVerificationTrustDiagnostics(status) {
-	console.log(`Locally trusted: ${status.localVerified ? "yes" : "no"}`);
-	console.log(`Cross-signing verified: ${status.crossSigningVerified ? "yes" : "no"}`);
-	console.log(`Signed by owner: ${status.signedByOwner ? "yes" : "no"}`);
-}
 function sanitizeMatrixCliText(value) {
 	let withoutAnsi = "";
 	for (let index = 0; index < value.length; index++) {
@@ -566,6 +203,46 @@ function isUnsafeMatrixCliTerminalCode(code) {
 function isAnsiFinalByte(code) {
 	return code >= 64 && code <= 126;
 }
+function resolveBackupStatus(status) {
+	return {
+		serverVersion: status.backup?.serverVersion ?? status.backupVersion ?? null,
+		activeVersion: status.backup?.activeVersion ?? null,
+		trusted: status.backup?.trusted ?? null,
+		matchesDecryptionKey: status.backup?.matchesDecryptionKey ?? null,
+		decryptionKeyCached: status.backup?.decryptionKeyCached ?? null,
+		keyLoadAttempted: status.backup?.keyLoadAttempted ?? false,
+		keyLoadError: status.backup?.keyLoadError ?? null
+	};
+}
+function yesNoUnknown(value) {
+	if (value === true) return "yes";
+	if (value === false) return "no";
+	return "unknown";
+}
+function printBackupStatus(backup) {
+	console.log(`Backup server version: ${formatMatrixCliText(backup.serverVersion, "none")}`);
+	console.log(`Backup active on this device: ${formatMatrixCliText(backup.activeVersion, "no")}`);
+	console.log(`Backup trusted by this device: ${yesNoUnknown(backup.trusted)}`);
+	console.log(`Backup matches local decryption key: ${yesNoUnknown(backup.matchesDecryptionKey)}`);
+	console.log(`Backup key cached locally: ${yesNoUnknown(backup.decryptionKeyCached)}`);
+	console.log(`Backup key load attempted: ${yesNoUnknown(backup.keyLoadAttempted)}`);
+	if (backup.keyLoadError) console.log(`Backup key load error: ${formatMatrixCliText(backup.keyLoadError)}`);
+}
+function printVerificationIdentity(status) {
+	console.log(`User: ${formatMatrixCliText(status.userId)}`);
+	console.log(`Device: ${formatMatrixCliText(status.deviceId)}`);
+}
+function printVerificationBackupSummary(status) {
+	printBackupSummary(resolveBackupStatus(status));
+}
+function printVerificationBackupStatus(status) {
+	printBackupStatus(resolveBackupStatus(status));
+}
+function printVerificationTrustDiagnostics(status) {
+	console.log(`Locally trusted: ${status.localVerified ? "yes" : "no"}`);
+	console.log(`Cross-signing verified: ${status.crossSigningVerified ? "yes" : "no"}`);
+	console.log(`Signed by owner: ${status.signedByOwner ? "yes" : "no"}`);
+}
 function formatMatrixCliSasEmoji(emoji) {
 	return emoji.map(([emojiValue, label]) => `${sanitizeMatrixCliText(emojiValue)} ${sanitizeMatrixCliText(label)}`).join(" | ");
 }
@@ -596,11 +273,775 @@ function printMatrixVerificationSummaries(summaries) {
 		printMatrixVerificationSummary(summary);
 	});
 }
-function printMatrixVerificationSas(sas) {
-	if (sas.emoji?.length) console.log(`SAS emoji: ${formatMatrixCliSasEmoji(sas.emoji)}`);
-	else if (sas.decimal) console.log(`SAS decimals: ${sas.decimal.join(" ")}`);
-	else console.log("SAS: unavailable");
-}
+function printMatrixVerificationSas(sas) {
+	if (sas.emoji?.length) console.log(`SAS emoji: ${formatMatrixCliSasEmoji(sas.emoji)}`);
+	else if (sas.decimal) console.log(`SAS decimals: ${sas.decimal.join(" ")}`);
+	else console.log("SAS: unavailable");
+}
+function printVerificationGuidance(status, accountId) {
+	printGuidance(buildVerificationGuidance(status, accountId));
+}
+function printBackupGuidance(backup, accountId, options = {}) {
+	printGuidance(buildBackupGuidance(backup, accountId, options));
+}
+function printBackupSummary(backup) {
+	const issue = resolveMatrixRoomKeyBackupIssue(backup);
+	console.log(`Backup: ${issue.summary}`);
+	if (backup.serverVersion) console.log(`Backup version: ${formatMatrixCliText(backup.serverVersion)}`);
+}
+function buildVerificationGuidance(status, accountId) {
+	const backup = resolveBackupStatus(status);
+	const nextSteps = /* @__PURE__ */ new Set();
+	if (!status.verified) if (status.recoveryKeyAccepted === true && status.backupUsable === true) {
+		nextSteps.add(`Recovery key can unlock the room-key backup, but full Matrix identity trust is still incomplete. Run ${formatMatrixCliCommand("verify self", accountId)}, accept the request in another verified Matrix client, and confirm the SAS only if it matches.`);
+		nextSteps.add(`If you intend to replace the current cross-signing identity, run the shown printf pipeline with the Matrix recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify bootstrap --recovery-key-stdin --force-reset-cross-signing", accountId)}.`);
+	} else nextSteps.add(`Run the shown printf pipeline with the Matrix recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify device --recovery-key-stdin", accountId)}. If you do not have the recovery key but still have another verified Matrix client, run ${formatMatrixCliCommand("verify self", accountId)} instead.`);
+	if (status.serverDeviceKnown === false) nextSteps.add(`This Matrix device is no longer listed on the homeserver. Create a new OpenClaw Matrix device with ${formatMatrixCliCommand("account add --homeserver <url> --user-id <@user:server> --password <password> --device-name OpenClaw-Gateway", accountId)}. If you use token auth, create a fresh Matrix access token in your Matrix client or admin UI, then run ${formatMatrixCliCommand("account add --homeserver <url> --access-token <token>", accountId)}.`);
+	for (const step of buildBackupGuidance(backup, accountId, { recoveryKeyStored: status.recoveryKeyStored })) nextSteps.add(step);
+	if (status.pendingVerifications > 0) nextSteps.add(`Review pending verification requests with ${formatMatrixCliCommand("verify list", accountId)}. Complete each active request with ${formatMatrixCliCommand("verify sas <id>", accountId)} and ${formatMatrixCliCommand("verify confirm-sas <id>", accountId)}, or cancel stale requests with ${formatMatrixCliCommand("verify cancel <id>", accountId)}.`);
+	return Array.from(nextSteps);
+}
+function buildBackupGuidance(backup, accountId, options = {}) {
+	const backupIssue = resolveMatrixRoomKeyBackupIssue(backup);
+	const nextSteps = /* @__PURE__ */ new Set();
+	if (backupIssue.code === "missing-server-backup") nextSteps.add(`Run ${formatMatrixCliCommand("verify bootstrap", accountId)} to create a room key backup.`);
+	else if (backupIssue.code === "key-load-failed" || backupIssue.code === "key-not-loaded" || backupIssue.code === "inactive") if (options.recoveryKeyStored) nextSteps.add(`Backup key is not loaded on this device. Run ${formatMatrixCliCommand("verify backup restore", accountId)} to load it and restore old room keys. If restore still cannot load the key, run the shown printf pipeline with the Matrix recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify backup restore --recovery-key-stdin", accountId)}.`);
+	else nextSteps.add(`Run the shown printf pipeline with the Matrix recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify backup restore --recovery-key-stdin", accountId)} to load the server backup and store the key for future restores.`);
+	else if (backupIssue.code === "key-mismatch") {
+		nextSteps.add(`Backup key mismatch on this device. Run the shown printf pipeline with the active server backup recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify backup restore --recovery-key-stdin", accountId)}.`);
+		nextSteps.add(`If you want a fresh backup baseline and accept losing unrecoverable history, run ${formatMatrixCliCommand("verify backup reset --yes", accountId)}. Add --rotate-recovery-key only when the old recovery key should stop unlocking the fresh backup.`);
+	} else if (backupIssue.code === "untrusted-signature") {
+		nextSteps.add(`Backup trust chain is not verified on this device. Run the shown printf pipeline with the correct recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify device --recovery-key-stdin", accountId)}.`);
+		nextSteps.add(`If device identity trust remains incomplete after that, run ${formatMatrixCliCommand("verify self", accountId)} from another verified Matrix client.`);
+		nextSteps.add(`If you want a fresh backup baseline and accept losing unrecoverable history, run ${formatMatrixCliCommand("verify backup reset --yes", accountId)}. Add --rotate-recovery-key only when the old recovery key should stop unlocking the fresh backup.`);
+	} else if (backupIssue.code === "indeterminate") nextSteps.add(`Run ${formatMatrixCliCommand("verify status --verbose", accountId)} to inspect backup trust diagnostics.`);
+	return Array.from(nextSteps);
+}
+function printGuidance(lines) {
+	if (lines.length === 0) return;
+	console.log("Next steps:");
+	for (const line of lines) console.log(`- ${line}`);
+}
+function printVerificationStatus(status, verbose = false, accountId) {
+	console.log(`Verified by owner: ${status.verified ? "yes" : "no"}`);
+	if (status.serverDeviceKnown === false) console.log("Device issue: current Matrix device is missing from the homeserver device list");
+	const backupIssue = resolveMatrixRoomKeyBackupIssue(resolveBackupStatus(status));
+	printVerificationBackupSummary(status);
+	if (backupIssue.message) console.log(`Backup issue: ${backupIssue.message}`);
+	if (verbose) {
+		console.log("Diagnostics:");
+		printVerificationIdentity(status);
+		if (status.serverDeviceKnown !== void 0) console.log(`Device present on server: ${yesNoUnknown(status.serverDeviceKnown ?? null)}`);
+		printVerificationTrustDiagnostics(status);
+		printVerificationBackupStatus(status);
+		console.log(`Recovery key stored: ${status.recoveryKeyStored ? "yes" : "no"}`);
+		printTimestamp("Recovery key created at", status.recoveryKeyCreatedAt);
+		console.log(`Pending verifications: ${status.pendingVerifications}`);
+	} else console.log(`Recovery key stored: ${status.recoveryKeyStored ? "yes" : "no"}`);
+	printVerificationGuidance(status, accountId);
+}
+//#endregion
+//#region extensions/matrix/src/matrix/actions/devices.ts
+async function listMatrixOwnDevices(opts = {}) {
+	return await withResolvedActionClient(opts, async (client) => await client.listOwnDevices());
+}
+async function pruneMatrixStaleGatewayDevices(opts = {}) {
+	return await withResolvedActionClient(opts, async (client) => {
+		const devices = await client.listOwnDevices();
+		const staleGatewayDeviceIds = summarizeMatrixDeviceHealth(devices).staleOpenClawDevices.map((device) => device.deviceId);
+		return {
+			before: devices,
+			staleGatewayDeviceIds,
+			...staleGatewayDeviceIds.length > 0 ? await client.deleteOwnDevices(staleGatewayDeviceIds) : {
+				currentDeviceId: devices.find((device) => device.current)?.deviceId ?? null,
+				deletedDeviceIds: [],
+				remainingDevices: devices
+			}
+		};
+	});
+}
+//#endregion
+//#region extensions/matrix/src/cli-account.ts
+async function addMatrixAccount(params) {
+	const initialSyncLimit = parseOptionalInt(params.initialSyncLimit, "--initial-sync-limit", { min: 0 });
+	const runtime = getMatrixRuntime();
+	const cfg = runtime.config.current();
+	if (!matrixSetupAdapter.applyAccountConfig) throw new Error("Matrix account setup is unavailable.");
+	const input = {
+		name: params.name,
+		avatarUrl: params.avatarUrl,
+		homeserver: params.homeserver,
+		dangerouslyAllowPrivateNetwork: params.allowPrivateNetwork,
+		proxy: params.proxy,
+		userId: params.userId,
+		accessToken: params.accessToken,
+		password: params.password,
+		deviceName: params.deviceName,
+		initialSyncLimit,
+		useEnv: params.useEnv === true
+	};
+	const accountId = matrixSetupAdapter.resolveAccountId?.({
+		cfg,
+		accountId: params.account,
+		input
+	}) ?? normalizeAccountId(params.account?.trim() || params.name?.trim());
+	const validationError = matrixSetupAdapter.validateInput?.({
+		cfg,
+		accountId,
+		input
+	});
+	if (validationError) throw new Error(validationError);
+	let updated = matrixSetupAdapter.applyAccountConfig({
+		cfg,
+		accountId,
+		input
+	});
+	if (params.enableEncryption === true) updated = updateMatrixAccountConfig(updated, accountId, { encryption: true });
+	await runtime.config.replaceConfigFile({
+		nextConfig: updated,
+		afterWrite: { mode: "auto" }
+	});
+	const accountConfig = resolveMatrixAccountConfig({
+		cfg: updated,
+		accountId
+	});
+	let verificationBootstrap = {
+		attempted: false,
+		success: false,
+		recoveryKeyCreatedAt: null,
+		backupVersion: null
+	};
+	if (accountConfig.encryption === true) {
+		const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-Deleiibz.js");
+		verificationBootstrap = await maybeBootstrapNewEncryptedMatrixAccount({
+			previousCfg: cfg,
+			cfg: updated,
+			accountId
+		});
+	}
+	const desiredDisplayName = input.name?.trim();
+	const desiredAvatarUrl = input.avatarUrl?.trim();
+	let profile = {
+		attempted: false,
+		displayNameUpdated: false,
+		avatarUpdated: false,
+		resolvedAvatarUrl: null,
+		convertedAvatarFromHttp: false
+	};
+	if (desiredDisplayName || desiredAvatarUrl) try {
+		const synced = await updateMatrixOwnProfile({
+			cfg: updated,
+			accountId,
+			displayName: desiredDisplayName,
+			avatarUrl: desiredAvatarUrl
+		});
+		let resolvedAvatarUrl = synced.resolvedAvatarUrl;
+		if (synced.convertedAvatarFromHttp && synced.resolvedAvatarUrl) {
+			const withAvatar = updateMatrixAccountConfig(runtime.config.current(), accountId, { avatarUrl: synced.resolvedAvatarUrl });
+			await runtime.config.replaceConfigFile({
+				nextConfig: withAvatar,
+				afterWrite: { mode: "auto" }
+			});
+			resolvedAvatarUrl = synced.resolvedAvatarUrl;
+		}
+		profile = {
+			attempted: true,
+			displayNameUpdated: synced.displayNameUpdated,
+			avatarUpdated: synced.avatarUpdated,
+			resolvedAvatarUrl,
+			convertedAvatarFromHttp: synced.convertedAvatarFromHttp
+		};
+	} catch (err) {
+		profile = {
+			attempted: true,
+			displayNameUpdated: false,
+			avatarUpdated: false,
+			resolvedAvatarUrl: null,
+			convertedAvatarFromHttp: false,
+			error: formatMatrixErrorMessage(err)
+		};
+	}
+	let deviceHealth;
+	try {
+		const addedDevices = await listMatrixOwnDevices({
+			accountId,
+			cfg: updated
+		});
+		deviceHealth = {
+			currentDeviceId: addedDevices.find((device) => device.current)?.deviceId ?? null,
+			staleOpenClawDeviceIds: addedDevices.filter((device) => !device.current && isOpenClawManagedMatrixDevice(device.displayName)).map((device) => device.deviceId)
+		};
+	} catch (err) {
+		deviceHealth = {
+			currentDeviceId: null,
+			staleOpenClawDeviceIds: [],
+			error: formatMatrixErrorMessage(err)
+		};
+	}
+	return {
+		accountId,
+		configPath: resolveMatrixConfigPath(updated, accountId),
+		useEnv: input.useEnv === true,
+		encryptionEnabled: accountConfig.encryption === true,
+		deviceHealth,
+		verificationBootstrap,
+		profile
+	};
+}
+function registerMatrixAccountCommands(root) {
+	root.command("account").description("Manage matrix channel accounts").command("add").description("Add or update a matrix account (wrapper around channel setup)").option("--account <id>", "Account ID (default: normalized --name, else default)").option("--name <name>", "Optional display name for this account").option("--avatar-url <url>", "Optional Matrix avatar URL (mxc:// or http(s) URL)").option("--homeserver <url>", "Matrix homeserver URL").option("--proxy <url>", "Optional HTTP(S) proxy URL for Matrix requests").option("--allow-private-network", "Allow Matrix homeserver traffic to private/internal hosts for this account").option("--user-id <id>", "Matrix user ID").option("--access-token <token>", "Matrix access token").option("--password <password>", "Matrix password").option("--device-name <name>", "Matrix device display name").option("--initial-sync-limit <n>", "Matrix initial sync limit").option("--enable-e2ee", "Enable Matrix end-to-end encryption and bootstrap verification").option("--encryption", "Alias for --enable-e2ee").option("--use-env", "Use MATRIX_* env vars (or MATRIX_<ACCOUNT_ID>_* for non-default accounts)").option("--verbose", "Show setup details").option("--json", "Output as JSON").action(async (options) => {
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await addMatrixAccount({
+				account: options.account,
+				name: options.name,
+				avatarUrl: options.avatarUrl,
+				homeserver: options.homeserver,
+				proxy: options.proxy,
+				allowPrivateNetwork: options.allowPrivateNetwork === true,
+				userId: options.userId,
+				accessToken: options.accessToken,
+				password: options.password,
+				deviceName: options.deviceName,
+				initialSyncLimit: options.initialSyncLimit,
+				enableEncryption: options.enableE2ee === true || options.encryption === true,
+				useEnv: options.useEnv === true
+			}),
+			onText: (result) => {
+				console.log(`Saved matrix account: ${formatMatrixCliText(result.accountId)}`);
+				console.log(`Config path: ${formatMatrixCliText(result.configPath)}`);
+				console.log(`Credentials source: ${result.useEnv ? "MATRIX_* / MATRIX_<ACCOUNT_ID>_* env vars" : "inline config"}`);
+				console.log(`Encryption: ${result.encryptionEnabled ? "enabled" : "disabled"}`);
+				if (result.verificationBootstrap.attempted) if (result.verificationBootstrap.success) {
+					console.log("Matrix verification bootstrap: complete");
+					printTimestamp("Recovery key created at", result.verificationBootstrap.recoveryKeyCreatedAt);
+					if (result.verificationBootstrap.backupVersion) console.log(`Backup version: ${formatMatrixCliText(result.verificationBootstrap.backupVersion)}`);
+				} else console.error(`Matrix verification bootstrap warning: ${formatMatrixCliText(result.verificationBootstrap.error)}`);
+				if (result.deviceHealth.error) console.error(`Matrix device health warning: ${formatMatrixCliText(result.deviceHealth.error)}`);
+				else if (result.deviceHealth.staleOpenClawDeviceIds.length > 0) {
+					const staleDeviceIds = result.deviceHealth.staleOpenClawDeviceIds.map((deviceId) => formatMatrixCliText(deviceId)).join(", ");
+					console.log(`Matrix device hygiene warning: stale OpenClaw devices detected (${staleDeviceIds}). Run ${formatMatrixCliCommand("devices prune-stale", result.accountId)}.`);
+				}
+				if (result.profile.attempted) if (result.profile.error) console.error(`Profile sync warning: ${formatMatrixCliText(result.profile.error)}`);
+				else {
+					console.log(`Profile sync: name ${result.profile.displayNameUpdated ? "updated" : "unchanged"}, avatar ${result.profile.avatarUpdated ? "updated" : "unchanged"}`);
+					if (result.profile.convertedAvatarFromHttp && result.profile.resolvedAvatarUrl) console.log(`Avatar converted and saved as: ${formatMatrixCliText(result.profile.resolvedAvatarUrl)}`);
+				}
+				const bindHint = `openclaw agents bind --agent <id> --bind matrix:${result.accountId}`;
+				console.log(`Bind this account to an agent: ${bindHint}`);
+			},
+			errorPrefix: "Account setup failed"
+		});
+	});
+}
+//#endregion
+//#region extensions/matrix/src/cli-devices.ts
+function printMatrixOwnDevices(devices) {
+	if (devices.length === 0) {
+		console.log("Devices: none");
+		return;
+	}
+	for (const device of devices) {
+		const labels = [device.current ? "current" : null, device.displayName].filter((label) => Boolean(label)).map((label) => formatMatrixCliText(label));
+		console.log(`- ${formatMatrixCliText(device.deviceId)}${labels.length ? ` (${labels.join(", ")})` : ""}`);
+		const lastSeenAt = timestampMsToIsoString(device.lastSeenTs);
+		if (lastSeenAt) printTimestamp("  Last seen", lastSeenAt);
+		if (device.lastSeenIp) console.log(`  Last IP: ${formatMatrixCliText(device.lastSeenIp)}`);
+	}
+}
+function registerMatrixDeviceCommands(root) {
+	const devices = root.command("devices").description("Inspect and clean up Matrix devices");
+	devices.command("list").description("List server-side Matrix devices for this account").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await listMatrixOwnDevices({
+				accountId,
+				cfg
+			}),
+			onText: (result) => {
+				printAccountLabel(accountId);
+				printMatrixOwnDevices(result);
+			},
+			errorPrefix: "Device listing failed"
+		});
+	});
+	devices.command("prune-stale").description("Delete stale OpenClaw-managed devices for this account").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await pruneMatrixStaleGatewayDevices({
+				accountId,
+				cfg
+			}),
+			onText: (result, verbose) => {
+				printAccountLabel(accountId);
+				console.log(`Deleted stale OpenClaw devices: ${result.deletedDeviceIds.length ? result.deletedDeviceIds.map((deviceId) => formatMatrixCliText(deviceId)).join(", ") : "none"}`);
+				console.log(`Current device: ${formatMatrixCliText(result.currentDeviceId)}`);
+				console.log(`Remaining devices: ${result.remainingDevices.length}`);
+				if (verbose) {
+					console.log("Devices before cleanup:");
+					printMatrixOwnDevices(result.before);
+					console.log("Devices after cleanup:");
+					printMatrixOwnDevices(result.remainingDevices);
+				}
+			},
+			errorPrefix: "Device cleanup failed"
+		});
+	});
+}
+//#endregion
+//#region extensions/matrix/src/cli-direct.ts
+const loadMatrixActionClientModule = createLazyRuntimeModule(() => import("./client-6eRENr7k.js").then((n) => n.t));
+const loadMatrixDirectManagementModule = createLazyRuntimeModule(() => import("./send-BldGYG8g.js").then((n) => n.l));
+function printDirectRoomCandidate(room) {
+	const members = room.joinedMembers === null ? "unavailable" : room.joinedMembers.map((member) => formatMatrixCliText(member)).join(", ") || "none";
+	console.log(`- ${formatMatrixCliText(room.roomId)} [${room.source}] strict=${room.strict ? "yes" : "no"} joined=${members}`);
+}
+function printDirectRoomInspection(result) {
+	printAccountLabel(result.accountId);
+	console.log(`Peer: ${formatMatrixCliText(result.remoteUserId)}`);
+	console.log(`Self: ${formatMatrixCliText(result.selfUserId)}`);
+	console.log(`Active direct room: ${formatMatrixCliText(result.activeRoomId, "none")}`);
+	console.log(`Mapped rooms: ${result.mappedRoomIds.length ? result.mappedRoomIds.map((roomId) => formatMatrixCliText(roomId)).join(", ") : "none"}`);
+	console.log(`Discovered strict rooms: ${result.discoveredStrictRoomIds.length ? result.discoveredStrictRoomIds.map((roomId) => formatMatrixCliText(roomId)).join(", ") : "none"}`);
+	if (result.mappedRooms.length > 0) {
+		console.log("Mapped room details:");
+		for (const room of result.mappedRooms) printDirectRoomCandidate(room);
+	}
+}
+async function inspectMatrixDirectRoom(params) {
+	const cfg = getMatrixRuntime().config.current();
+	const [{ withResolvedActionClient }, { inspectMatrixDirectRooms }] = await Promise.all([loadMatrixActionClientModule(), loadMatrixDirectManagementModule()]);
+	return await withResolvedActionClient({
+		accountId: params.accountId,
+		cfg
+	}, async (client) => {
+		const inspection = await inspectMatrixDirectRooms({
+			client,
+			remoteUserId: params.userId
+		});
+		return {
+			accountId: params.accountId,
+			remoteUserId: inspection.remoteUserId,
+			selfUserId: inspection.selfUserId,
+			mappedRoomIds: inspection.mappedRoomIds,
+			mappedRooms: inspection.mappedRooms.map(toCliDirectRoomCandidate),
+			discoveredStrictRoomIds: inspection.discoveredStrictRoomIds,
+			activeRoomId: inspection.activeRoomId
+		};
+	}, "persist");
+}
+async function repairMatrixDirectRoom(params) {
+	const cfg = getMatrixRuntime().config.current();
+	const account = resolveMatrixAccount({
+		cfg,
+		accountId: params.accountId
+	});
+	const [{ withStartedActionClient }, { repairMatrixDirectRooms }] = await Promise.all([loadMatrixActionClientModule(), loadMatrixDirectManagementModule()]);
+	return await withStartedActionClient({
+		accountId: params.accountId,
+		cfg
+	}, async (client) => {
+		const repaired = await repairMatrixDirectRooms({
+			client,
+			remoteUserId: params.userId,
+			encrypted: account.config.encryption === true
+		});
+		return {
+			accountId: params.accountId,
+			remoteUserId: repaired.remoteUserId,
+			selfUserId: repaired.selfUserId,
+			mappedRoomIds: repaired.mappedRoomIds,
+			mappedRooms: repaired.mappedRooms.map(toCliDirectRoomCandidate),
+			discoveredStrictRoomIds: repaired.discoveredStrictRoomIds,
+			activeRoomId: repaired.activeRoomId,
+			encrypted: account.config.encryption === true,
+			createdRoomId: repaired.createdRoomId,
+			changed: repaired.changed,
+			directContentBefore: repaired.directContentBefore,
+			directContentAfter: repaired.directContentAfter
+		};
+	});
+}
+function toCliDirectRoomCandidate(room) {
+	return {
+		roomId: room.roomId,
+		source: room.source,
+		strict: room.strict,
+		joinedMembers: room.joinedMembers
+	};
+}
+function registerMatrixDirectCommands(root) {
+	const direct = root.command("direct").description("Inspect and repair Matrix direct-room state");
+	direct.command("inspect").description("Inspect direct-room mappings for a Matrix user").requiredOption("--user-id <id>", "Peer Matrix user ID").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		const accountId = resolveMatrixCliAccountContext(options.account).accountId;
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await inspectMatrixDirectRoom({
+				accountId,
+				userId: options.userId
+			}),
+			onText: (result) => {
+				printDirectRoomInspection(result);
+			},
+			errorPrefix: "Direct room inspection failed"
+		});
+	});
+	direct.command("repair").description("Repair Matrix direct-room mappings for a Matrix user").requiredOption("--user-id <id>", "Peer Matrix user ID").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		const accountId = resolveMatrixCliAccountContext(options.account).accountId;
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await repairMatrixDirectRoom({
+				accountId,
+				userId: options.userId
+			}),
+			onText: (result, verbose) => {
+				printDirectRoomInspection(result);
+				console.log(`Encrypted room creation: ${result.encrypted ? "enabled" : "disabled"}`);
+				console.log(`Created room: ${formatMatrixCliText(result.createdRoomId, "none")}`);
+				console.log(`m.direct updated: ${result.changed ? "yes" : "no"}`);
+				if (verbose) {
+					console.log(`m.direct before: ${formatMatrixCliText(JSON.stringify(result.directContentBefore[result.remoteUserId] ?? []))}`);
+					console.log(`m.direct after: ${formatMatrixCliText(JSON.stringify(result.directContentAfter[result.remoteUserId] ?? []))}`);
+				}
+			},
+			errorPrefix: "Direct room repair failed"
+		});
+	});
+}
+//#endregion
+//#region extensions/matrix/src/cli-encryption.ts
+function isMatrixVerificationSetupComplete(status) {
+	return status.encryptionEnabled && status.verified && status.crossSigningVerified && status.signedByOwner && status.serverDeviceKnown === true && resolveMatrixRoomKeyBackupIssue(resolveBackupStatus(status)).code === "ok";
+}
+function buildNoopMatrixVerificationBootstrap(status) {
+	return {
+		success: true,
+		verification: {
+			...status,
+			backup: resolveBackupStatus(status),
+			serverDeviceKnown: status.serverDeviceKnown ?? null
+		},
+		crossSigning: {
+			userId: status.userId,
+			masterKeyPublished: status.crossSigningVerified,
+			selfSigningKeyPublished: status.signedByOwner,
+			userSigningKeyPublished: status.signedByOwner,
+			published: status.crossSigningVerified && status.signedByOwner
+		},
+		pendingVerifications: status.pendingVerifications,
+		cryptoBootstrap: null
+	};
+}
+async function setupMatrixEncryption(params) {
+	const runtime = getMatrixRuntime();
+	const { accountId, cfg } = resolveMatrixCliAccountContext(params.account);
+	if (!resolveMatrixAccount({
+		cfg,
+		accountId
+	}).configured) throw new Error(`Matrix account "${accountId}" is not configured; run ${formatMatrixCliCommand("account add", accountId)} first.`);
+	const encryptionChanged = resolveMatrixAccountConfig({
+		cfg,
+		accountId
+	}).encryption !== true;
+	const updated = encryptionChanged ? updateMatrixAccountConfig(cfg, accountId, { encryption: true }) : cfg;
+	if (encryptionChanged) await runtime.config.replaceConfigFile({
+		nextConfig: updated,
+		afterWrite: { mode: "auto" }
+	});
+	const existingStatus = !encryptionChanged && !params.recoveryKey && params.forceResetCrossSigning !== true ? await getMatrixVerificationStatus({
+		accountId,
+		cfg: updated,
+		readiness: "none"
+	}) : null;
+	if (existingStatus && isMatrixVerificationSetupComplete(existingStatus)) return {
+		accountId,
+		configPath: resolveMatrixConfigPath(updated, accountId),
+		encryptionChanged,
+		bootstrap: buildNoopMatrixVerificationBootstrap(existingStatus),
+		status: existingStatus
+	};
+	const bootstrap = await bootstrapMatrixVerification({
+		accountId,
+		cfg: updated,
+		recoveryKey: params.recoveryKey,
+		forceResetCrossSigning: params.forceResetCrossSigning === true
+	});
+	const status = await getMatrixVerificationStatus({
+		accountId,
+		cfg: updated
+	});
+	return {
+		accountId,
+		configPath: resolveMatrixConfigPath(updated, accountId),
+		encryptionChanged,
+		bootstrap,
+		status
+	};
+}
+function printMatrixEncryptionSetupResult(result, verbose = false) {
+	printAccountLabel(result.accountId);
+	console.log(`Encryption config: ${result.encryptionChanged ? "enabled" : "already enabled"} at ${formatMatrixCliText(result.configPath)}`);
+	console.log(`Bootstrap success: ${result.bootstrap.success ? "yes" : "no"}`);
+	if (result.bootstrap.error) console.log(`Bootstrap error: ${formatMatrixCliText(result.bootstrap.error)}`);
+	console.log(`Verified by owner: ${result.status.verified ? "yes" : "no"}`);
+	printVerificationBackupSummary(result.status);
+	if (verbose) {
+		printVerificationIdentity(result.status);
+		printVerificationTrustDiagnostics(result.status);
+		printVerificationBackupStatus(result.status);
+		console.log(`Recovery key stored: ${result.status.recoveryKeyStored ? "yes" : "no"}`);
+		printTimestamp("Recovery key created at", result.status.recoveryKeyCreatedAt);
+		console.log(`Pending verifications: ${result.status.pendingVerifications}`);
+	}
+	printVerificationGuidance(result.status, result.accountId);
+}
+function registerMatrixEncryptionCommands(root) {
+	root.command("encryption").description("Set up Matrix end-to-end encryption").command("setup").description("Enable Matrix E2EE, bootstrap verification, and print next steps").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key <key>", "Recovery key to apply before bootstrap (prefer --recovery-key-stdin)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--force-reset-cross-signing", "Force reset cross-signing identity before bootstrap (requires active recovery key)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await setupMatrixEncryption({
+				account: options.account,
+				recoveryKey: await resolveMatrixCliRecoveryKeyInput({
+					recoveryKey: options.recoveryKey,
+					recoveryKeyStdin: options.recoveryKeyStdin
+				}),
+				forceResetCrossSigning: options.forceResetCrossSigning === true
+			}),
+			onText: (result, verbose) => {
+				printMatrixEncryptionSetupResult(result, verbose);
+			},
+			onJson: (result) => ({
+				success: result.bootstrap.success,
+				...result
+			}),
+			shouldFail: (result) => !result.bootstrap.success,
+			errorPrefix: "Encryption setup failed",
+			onJsonError: (message) => ({
+				success: false,
+				error: message
+			})
+		});
+	});
+}
+//#endregion
+//#region extensions/matrix/src/cli-profile.ts
+function registerMatrixProfileCommands(root) {
+	root.command("profile").description("Manage Matrix bot profile").command("set").description("Update Matrix profile display name and/or avatar").option("--account <id>", "Account ID (for multi-account setups)").option("--name <name>", "Profile display name").option("--avatar-url <url>", "Profile avatar URL (mxc:// or http(s) URL)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await applyMatrixProfileUpdate({
+				account: options.account,
+				displayName: options.name,
+				avatarUrl: options.avatarUrl
+			}),
+			onText: (result) => {
+				printAccountLabel(result.accountId);
+				console.log(`Config path: ${result.configPath}`);
+				console.log(`Profile update: name ${result.profile.displayNameUpdated ? "updated" : "unchanged"}, avatar ${result.profile.avatarUpdated ? "updated" : "unchanged"}`);
+				if (result.profile.convertedAvatarFromHttp && result.avatarUrl) console.log(`Avatar converted and saved as: ${formatMatrixCliText(result.avatarUrl)}`);
+			},
+			errorPrefix: "Profile update failed"
+		});
+	});
+}
+//#endregion
+//#region extensions/matrix/src/cli-verification-backup.ts
+function registerMatrixVerificationBackupCommands(verify) {
+	const backup = verify.command("backup").description("Matrix room-key backup health and restore");
+	backup.command("status").description("Show Matrix room-key backup status for this device").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await getMatrixRoomKeyBackupStatus({
+				accountId,
+				cfg
+			}),
+			onText: (status, verbose) => {
+				printAccountLabel(accountId);
+				printBackupSummary(status);
+				if (verbose) printBackupStatus(status);
+				printBackupGuidance(status, accountId);
+			},
+			errorPrefix: "Backup status failed"
+		});
+	});
+	backup.command("reset").description("Delete the current server backup and create a fresh room-key backup baseline, repairing secret storage if needed for a durable reset").option("--account <id>", "Account ID (for multi-account setups)").option("--yes", "Confirm destructive backup reset", false).option("--rotate-recovery-key", "Create a new Matrix recovery key for the fresh backup").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => {
+				if (options.yes !== true) throw new Error(`Refusing to reset Matrix room-key backup without --yes. If you accept losing unrecoverable history, re-run ${formatMatrixCliCommand("verify backup reset --yes", accountId)}.`);
+				return await resetMatrixRoomKeyBackup({
+					accountId,
+					cfg,
+					rotateRecoveryKey: options.rotateRecoveryKey === true
+				});
+			},
+			onText: (result, verbose) => {
+				printAccountLabel(accountId);
+				console.log(`Reset success: ${result.success ? "yes" : "no"}`);
+				if (result.error) console.log(`Error: ${formatMatrixCliText(result.error)}`);
+				console.log(`Previous backup version: ${formatMatrixCliText(result.previousVersion, "none")}`);
+				console.log(`Deleted backup version: ${formatMatrixCliText(result.deletedVersion, "none")}`);
+				console.log(`Current backup version: ${formatMatrixCliText(result.createdVersion, "none")}`);
+				printBackupSummary(result.backup);
+				if (verbose) {
+					printTimestamp("Reset at", result.resetAt);
+					printBackupStatus(result.backup);
+				}
+				printBackupGuidance(result.backup, accountId);
+			},
+			shouldFail: (result) => !result.success,
+			errorPrefix: "Backup reset failed",
+			onJsonError: (message) => ({
+				success: false,
+				error: message
+			})
+		});
+	});
+	backup.command("restore").description("Restore encrypted room keys from server backup").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key <key>", "Optional recovery key to load before restoring (prefer --recovery-key-stdin)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await restoreMatrixRoomKeyBackup({
+				accountId,
+				cfg,
+				recoveryKey: await resolveMatrixCliRecoveryKeyInput(options)
+			}),
+			onText: (result, verbose) => {
+				printAccountLabel(accountId);
+				console.log(`Restore success: ${result.success ? "yes" : "no"}`);
+				if (result.error) console.log(`Error: ${formatMatrixCliText(result.error)}`);
+				console.log(`Backup version: ${formatMatrixCliText(result.backupVersion, "none")}`);
+				console.log(`Imported keys: ${result.imported}/${result.total}`);
+				printBackupSummary(result.backup);
+				if (verbose) {
+					console.log(`Loaded key from secret storage: ${result.loadedFromSecretStorage ? "yes" : "no"}`);
+					printTimestamp("Restored at", result.restoredAt);
+					printBackupStatus(result.backup);
+				}
+				printBackupGuidance(result.backup, accountId, { recoveryKeyStored: result.loadedFromSecretStorage });
+			},
+			shouldFail: (result) => !result.success,
+			errorPrefix: "Backup restore failed",
+			onJsonError: (message) => ({
+				success: false,
+				error: message
+			})
+		});
+	});
+	verify.command("bootstrap").description("Bootstrap Matrix cross-signing and device verification state").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key <key>", "Recovery key to apply before bootstrap (prefer --recovery-key-stdin)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--force-reset-cross-signing", "Force reset cross-signing identity before bootstrap (requires active recovery key)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
+		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await bootstrapMatrixVerification({
+				accountId,
+				cfg,
+				recoveryKey: await resolveMatrixCliRecoveryKeyInput(options),
+				forceResetCrossSigning: options.forceResetCrossSigning === true
+			}),
+			onText: (result, verbose) => {
+				printAccountLabel(accountId);
+				console.log(`Bootstrap success: ${result.success ? "yes" : "no"}`);
+				if (result.error) console.log(`Error: ${formatMatrixCliText(result.error)}`);
+				console.log(`Verified by owner: ${result.verification.verified ? "yes" : "no"}`);
+				printVerificationIdentity(result.verification);
+				if (verbose) {
+					printVerificationTrustDiagnostics(result.verification);
+					console.log(`Cross-signing published: ${result.crossSigning.published ? "yes" : "no"} (master=${result.crossSigning.masterKeyPublished ? "yes" : "no"}, self=${result.crossSigning.selfSigningKeyPublished ? "yes" : "no"}, user=${result.crossSigning.userSigningKeyPublished ? "yes" : "no"})`);
+					printVerificationBackupStatus(result.verification);
+					printTimestamp("Recovery key created at", result.verification.recoveryKeyCreatedAt);
+					console.log(`Pending verifications: ${result.pendingVerifications}`);
+				} else {
+					console.log(`Cross-signing published: ${result.crossSigning.published ? "yes" : "no"}`);
+					printVerificationBackupSummary(result.verification);
+				}
+				printVerificationGuidance({
+					...result.verification,
+					pendingVerifications: result.pendingVerifications
+				}, accountId);
+			},
+			shouldFail: (result) => !result.success,
+			errorPrefix: "Verification bootstrap failed",
+			onJsonError: (message) => ({
+				success: false,
+				error: message
+			})
+		});
+	});
+	verify.command("device [key]").description("Verify device using a Matrix recovery key").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (key, options) => {
+		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
+		await runMatrixCliCommand({
+			verbose: options.verbose === true,
+			json: options.json === true,
+			run: async () => await verifyMatrixRecoveryKey(await requireMatrixCliRecoveryKeyInput({
+				recoveryKey: key,
+				recoveryKeyStdin: options.recoveryKeyStdin
+			}), {
+				accountId,
+				cfg
+			}),
+			onText: (result, verbose) => {
+				printAccountLabel(accountId);
+				if (!result.success) {
+					console.error(`Verification failed: ${formatMatrixCliText(result.error)}`);
+					printVerificationIdentity(result);
+					console.log(`Recovery key accepted: ${result.recoveryKeyAccepted ? "yes" : "no"}`);
+					console.log(`Backup usable: ${result.backupUsable ? "yes" : "no"}`);
+					console.log(`Device verified by owner: ${result.deviceOwnerVerified ? "yes" : "no"}`);
+					printVerificationBackupSummary(result);
+					if (verbose) {
+						printVerificationTrustDiagnostics(result);
+						printVerificationBackupStatus(result);
+						printTimestamp("Recovery key created at", result.recoveryKeyCreatedAt);
+					}
+					printVerificationGuidance({
+						...result,
+						pendingVerifications: 0
+					}, accountId);
+					return;
+				}
+				console.log("Device verification completed successfully.");
+				printVerificationIdentity(result);
+				console.log(`Recovery key accepted: ${result.recoveryKeyAccepted ? "yes" : "no"}`);
+				console.log(`Backup usable: ${result.backupUsable ? "yes" : "no"}`);
+				console.log(`Device verified by owner: ${result.deviceOwnerVerified ? "yes" : "no"}`);
+				printVerificationBackupSummary(result);
+				if (verbose) {
+					printVerificationTrustDiagnostics(result);
+					printVerificationBackupStatus(result);
+					printTimestamp("Recovery key created at", result.recoveryKeyCreatedAt);
+					printTimestamp("Verified at", result.verifiedAt);
+				}
+				printVerificationGuidance({
+					...result,
+					pendingVerifications: 0
+				}, accountId);
+			},
+			shouldFail: (result) => !result.success,
+			errorPrefix: "Verification failed",
+			onJsonError: (message) => ({
+				success: false,
+				error: message
+			})
+		});
+	});
+}
+//#endregion
+//#region extensions/matrix/src/cli-verification.ts
 function matrixCliVerificationDmLookupOptions(options) {
 	const lookup = {};
 	if (options.roomId !== void 0) lookup.verificationDmRoomId = options.roomId;
@@ -729,243 +1170,35 @@ async function runMatrixCliSelfVerificationCommand(options) {
 				onRequested: (summary) => {
 					printAccountLabel(accountId);
 					printMatrixVerificationSummary(summary);
-					console.log("Accept this verification request in another Matrix client.");
-				},
-				onReady: (summary) => {
-					console.log("Verification request accepted.");
-					if (!summary.hasSas) console.log("Starting SAS verification...");
-				},
-				onSas: (summary) => {
-					printMatrixVerificationSas(summary.sas ?? {});
-					console.log("Compare this SAS with the other Matrix client.");
-				},
-				confirmSas: async () => await promptMatrixVerificationSasMatch()
-			});
-		},
-		onText: (summary, verbose) => {
-			printMatrixVerificationSummary(summary);
-			console.log(`Device verified by owner: ${summary.deviceOwnerVerified ? "yes" : "no"}`);
-			printVerificationTrustDiagnostics(summary.ownerVerification);
-			printVerificationBackupSummary(summary.ownerVerification);
-			if (verbose) printVerificationBackupStatus(summary.ownerVerification);
-			console.log("Self-verification complete.");
-		},
-		onTextError: () => {
-			const accountId = resolvedAccountId ?? options.account;
-			printGuidance([`Run ${formatMatrixCliCommand("verify self", accountId)} again and accept the request in another verified Matrix client for this account.`, `Then run ${formatMatrixCliCommand("verify status --verbose", accountId)} to confirm Cross-signing verified: yes and Signed by owner: yes.`]);
-		},
-		errorPrefix: "Self-verification failed"
-	});
-}
-function printVerificationGuidance(status, accountId) {
-	printGuidance(buildVerificationGuidance(status, accountId));
-}
-function printBackupGuidance(backup, accountId, options = {}) {
-	printGuidance(buildBackupGuidance(backup, accountId, options));
-}
-function printBackupSummary(backup) {
-	const issue = resolveMatrixRoomKeyBackupIssue(backup);
-	console.log(`Backup: ${issue.summary}`);
-	if (backup.serverVersion) console.log(`Backup version: ${formatMatrixCliText(backup.serverVersion)}`);
-}
-function buildVerificationGuidance(status, accountId) {
-	const backup = resolveBackupStatus(status);
-	const nextSteps = /* @__PURE__ */ new Set();
-	if (!status.verified) if (status.recoveryKeyAccepted === true && status.backupUsable === true) {
-		nextSteps.add(`Recovery key can unlock the room-key backup, but full Matrix identity trust is still incomplete. Run ${formatMatrixCliCommand("verify self", accountId)}, accept the request in another verified Matrix client, and confirm the SAS only if it matches.`);
-		nextSteps.add(`If you intend to replace the current cross-signing identity, run the shown printf pipeline with the Matrix recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify bootstrap --recovery-key-stdin --force-reset-cross-signing", accountId)}.`);
-	} else nextSteps.add(`Run the shown printf pipeline with the Matrix recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify device --recovery-key-stdin", accountId)}. If you do not have the recovery key but still have another verified Matrix client, run ${formatMatrixCliCommand("verify self", accountId)} instead.`);
-	if (status.serverDeviceKnown === false) nextSteps.add(`This Matrix device is no longer listed on the homeserver. Create a new OpenClaw Matrix device with ${formatMatrixCliCommand("account add --homeserver <url> --user-id <@user:server> --password <password> --device-name OpenClaw-Gateway", accountId)}. If you use token auth, create a fresh Matrix access token in your Matrix client or admin UI, then run ${formatMatrixCliCommand("account add --homeserver <url> --access-token <token>", accountId)}.`);
-	for (const step of buildBackupGuidance(backup, accountId, { recoveryKeyStored: status.recoveryKeyStored })) nextSteps.add(step);
-	if (status.pendingVerifications > 0) nextSteps.add(`Review pending verification requests with ${formatMatrixCliCommand("verify list", accountId)}. Complete each active request with ${formatMatrixCliCommand("verify sas <id>", accountId)} and ${formatMatrixCliCommand("verify confirm-sas <id>", accountId)}, or cancel stale requests with ${formatMatrixCliCommand("verify cancel <id>", accountId)}.`);
-	return Array.from(nextSteps);
-}
-function buildBackupGuidance(backup, accountId, options = {}) {
-	const backupIssue = resolveMatrixRoomKeyBackupIssue(backup);
-	const nextSteps = /* @__PURE__ */ new Set();
-	if (backupIssue.code === "missing-server-backup") nextSteps.add(`Run ${formatMatrixCliCommand("verify bootstrap", accountId)} to create a room key backup.`);
-	else if (backupIssue.code === "key-load-failed" || backupIssue.code === "key-not-loaded" || backupIssue.code === "inactive") if (options.recoveryKeyStored) nextSteps.add(`Backup key is not loaded on this device. Run ${formatMatrixCliCommand("verify backup restore", accountId)} to load it and restore old room keys. If restore still cannot load the key, run the shown printf pipeline with the Matrix recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify backup restore --recovery-key-stdin", accountId)}.`);
-	else nextSteps.add(`Run the shown printf pipeline with the Matrix recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify backup restore --recovery-key-stdin", accountId)} to load the server backup and store the key for future restores.`);
-	else if (backupIssue.code === "key-mismatch") {
-		nextSteps.add(`Backup key mismatch on this device. Run the shown printf pipeline with the active server backup recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify backup restore --recovery-key-stdin", accountId)}.`);
-		nextSteps.add(`If you want a fresh backup baseline and accept losing unrecoverable history, run ${formatMatrixCliCommand("verify backup reset --yes", accountId)}. Add --rotate-recovery-key only when the old recovery key should stop unlocking the fresh backup.`);
-	} else if (backupIssue.code === "untrusted-signature") {
-		nextSteps.add(`Backup trust chain is not verified on this device. Run the shown printf pipeline with the correct recovery key env var for this account: ${formatMatrixCliRecoveryKeyStdinCommand("verify device --recovery-key-stdin", accountId)}.`);
-		nextSteps.add(`If device identity trust remains incomplete after that, run ${formatMatrixCliCommand("verify self", accountId)} from another verified Matrix client.`);
-		nextSteps.add(`If you want a fresh backup baseline and accept losing unrecoverable history, run ${formatMatrixCliCommand("verify backup reset --yes", accountId)}. Add --rotate-recovery-key only when the old recovery key should stop unlocking the fresh backup.`);
-	} else if (backupIssue.code === "indeterminate") nextSteps.add(`Run ${formatMatrixCliCommand("verify status --verbose", accountId)} to inspect backup trust diagnostics.`);
-	return Array.from(nextSteps);
-}
-function printGuidance(lines) {
-	if (lines.length === 0) return;
-	console.log("Next steps:");
-	for (const line of lines) console.log(`- ${line}`);
-}
-function printVerificationStatus(status, verbose = false, accountId) {
-	console.log(`Verified by owner: ${status.verified ? "yes" : "no"}`);
-	if (status.serverDeviceKnown === false) console.log("Device issue: current Matrix device is missing from the homeserver device list");
-	const backupIssue = resolveMatrixRoomKeyBackupIssue(resolveBackupStatus(status));
-	printVerificationBackupSummary(status);
-	if (backupIssue.message) console.log(`Backup issue: ${backupIssue.message}`);
-	if (verbose) {
-		console.log("Diagnostics:");
-		printVerificationIdentity(status);
-		if (status.serverDeviceKnown !== void 0) console.log(`Device present on server: ${yesNoUnknown(status.serverDeviceKnown ?? null)}`);
-		printVerificationTrustDiagnostics(status);
-		printVerificationBackupStatus(status);
-		console.log(`Recovery key stored: ${status.recoveryKeyStored ? "yes" : "no"}`);
-		printTimestamp("Recovery key created at", status.recoveryKeyCreatedAt);
-		console.log(`Pending verifications: ${status.pendingVerifications}`);
-	} else console.log(`Recovery key stored: ${status.recoveryKeyStored ? "yes" : "no"}`);
-	printVerificationGuidance(status, accountId);
-}
-function printMatrixEncryptionSetupResult(result, verbose = false) {
-	printAccountLabel(result.accountId);
-	console.log(`Encryption config: ${result.encryptionChanged ? "enabled" : "already enabled"} at ${formatMatrixCliText(result.configPath)}`);
-	console.log(`Bootstrap success: ${result.bootstrap.success ? "yes" : "no"}`);
-	if (result.bootstrap.error) console.log(`Bootstrap error: ${formatMatrixCliText(result.bootstrap.error)}`);
-	console.log(`Verified by owner: ${result.status.verified ? "yes" : "no"}`);
-	printVerificationBackupSummary(result.status);
-	if (verbose) {
-		printVerificationIdentity(result.status);
-		printVerificationTrustDiagnostics(result.status);
-		printVerificationBackupStatus(result.status);
-		console.log(`Recovery key stored: ${result.status.recoveryKeyStored ? "yes" : "no"}`);
-		printTimestamp("Recovery key created at", result.status.recoveryKeyCreatedAt);
-		console.log(`Pending verifications: ${result.status.pendingVerifications}`);
-	}
-	printVerificationGuidance(result.status, result.accountId);
-}
-function registerMatrixCli(params) {
-	const root = params.program.command("matrix").description("Matrix channel utilities").addHelpText("after", () => "\nDocs: https://docs.openclaw.ai/channels/matrix\n");
-	root.command("account").description("Manage matrix channel accounts").command("add").description("Add or update a matrix account (wrapper around channel setup)").option("--account <id>", "Account ID (default: normalized --name, else default)").option("--name <name>", "Optional display name for this account").option("--avatar-url <url>", "Optional Matrix avatar URL (mxc:// or http(s) URL)").option("--homeserver <url>", "Matrix homeserver URL").option("--proxy <url>", "Optional HTTP(S) proxy URL for Matrix requests").option("--allow-private-network", "Allow Matrix homeserver traffic to private/internal hosts for this account").option("--user-id <id>", "Matrix user ID").option("--access-token <token>", "Matrix access token").option("--password <password>", "Matrix password").option("--device-name <name>", "Matrix device display name").option("--initial-sync-limit <n>", "Matrix initial sync limit").option("--enable-e2ee", "Enable Matrix end-to-end encryption and bootstrap verification").option("--encryption", "Alias for --enable-e2ee").option("--use-env", "Use MATRIX_* env vars (or MATRIX_<ACCOUNT_ID>_* for non-default accounts)").option("--verbose", "Show setup details").option("--json", "Output as JSON").action(async (options) => {
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await addMatrixAccount({
-				account: options.account,
-				name: options.name,
-				avatarUrl: options.avatarUrl,
-				homeserver: options.homeserver,
-				proxy: options.proxy,
-				allowPrivateNetwork: options.allowPrivateNetwork === true,
-				userId: options.userId,
-				accessToken: options.accessToken,
-				password: options.password,
-				deviceName: options.deviceName,
-				initialSyncLimit: options.initialSyncLimit,
-				enableEncryption: options.enableE2ee === true || options.encryption === true,
-				useEnv: options.useEnv === true
-			}),
-			onText: (result) => {
-				console.log(`Saved matrix account: ${formatMatrixCliText(result.accountId)}`);
-				console.log(`Config path: ${formatMatrixCliText(result.configPath)}`);
-				console.log(`Credentials source: ${result.useEnv ? "MATRIX_* / MATRIX_<ACCOUNT_ID>_* env vars" : "inline config"}`);
-				console.log(`Encryption: ${result.encryptionEnabled ? "enabled" : "disabled"}`);
-				if (result.verificationBootstrap.attempted) if (result.verificationBootstrap.success) {
-					console.log("Matrix verification bootstrap: complete");
-					printTimestamp("Recovery key created at", result.verificationBootstrap.recoveryKeyCreatedAt);
-					if (result.verificationBootstrap.backupVersion) console.log(`Backup version: ${formatMatrixCliText(result.verificationBootstrap.backupVersion)}`);
-				} else console.error(`Matrix verification bootstrap warning: ${formatMatrixCliText(result.verificationBootstrap.error)}`);
-				if (result.deviceHealth.error) console.error(`Matrix device health warning: ${formatMatrixCliText(result.deviceHealth.error)}`);
-				else if (result.deviceHealth.staleOpenClawDeviceIds.length > 0) {
-					const staleDeviceIds = result.deviceHealth.staleOpenClawDeviceIds.map((deviceId) => formatMatrixCliText(deviceId)).join(", ");
-					console.log(`Matrix device hygiene warning: stale OpenClaw devices detected (${staleDeviceIds}). Run ${formatMatrixCliCommand("devices prune-stale", result.accountId)}.`);
-				}
-				if (result.profile.attempted) if (result.profile.error) console.error(`Profile sync warning: ${formatMatrixCliText(result.profile.error)}`);
-				else {
-					console.log(`Profile sync: name ${result.profile.displayNameUpdated ? "updated" : "unchanged"}, avatar ${result.profile.avatarUpdated ? "updated" : "unchanged"}`);
-					if (result.profile.convertedAvatarFromHttp && result.profile.resolvedAvatarUrl) console.log(`Avatar converted and saved as: ${formatMatrixCliText(result.profile.resolvedAvatarUrl)}`);
-				}
-				const bindHint = `openclaw agents bind --agent <id> --bind matrix:${result.accountId}`;
-				console.log(`Bind this account to an agent: ${bindHint}`);
-			},
-			errorPrefix: "Account setup failed"
-		});
-	});
-	root.command("profile").description("Manage Matrix bot profile").command("set").description("Update Matrix profile display name and/or avatar").option("--account <id>", "Account ID (for multi-account setups)").option("--name <name>", "Profile display name").option("--avatar-url <url>", "Profile avatar URL (mxc:// or http(s) URL)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await setMatrixProfile({
-				account: options.account,
-				name: options.name,
-				avatarUrl: options.avatarUrl
-			}),
-			onText: (result) => {
-				printAccountLabel(result.accountId);
-				console.log(`Config path: ${result.configPath}`);
-				console.log(`Profile update: name ${result.profile.displayNameUpdated ? "updated" : "unchanged"}, avatar ${result.profile.avatarUpdated ? "updated" : "unchanged"}`);
-				if (result.profile.convertedAvatarFromHttp && result.avatarUrl) console.log(`Avatar converted and saved as: ${formatMatrixCliText(result.avatarUrl)}`);
-			},
-			errorPrefix: "Profile update failed"
-		});
-	});
-	const direct = root.command("direct").description("Inspect and repair Matrix direct-room state");
-	direct.command("inspect").description("Inspect direct-room mappings for a Matrix user").requiredOption("--user-id <id>", "Peer Matrix user ID").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		const accountId = resolveMatrixCliAccountId(options.account);
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await inspectMatrixDirectRoom({
-				accountId,
-				userId: options.userId
-			}),
-			onText: (result) => {
-				printDirectRoomInspection(result);
-			},
-			errorPrefix: "Direct room inspection failed"
-		});
-	});
-	direct.command("repair").description("Repair Matrix direct-room mappings for a Matrix user").requiredOption("--user-id <id>", "Peer Matrix user ID").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		const accountId = resolveMatrixCliAccountId(options.account);
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await repairMatrixDirectRoom({
-				accountId,
-				userId: options.userId
-			}),
-			onText: (result, verbose) => {
-				printDirectRoomInspection(result);
-				console.log(`Encrypted room creation: ${result.encrypted ? "enabled" : "disabled"}`);
-				console.log(`Created room: ${formatMatrixCliText(result.createdRoomId, "none")}`);
-				console.log(`m.direct updated: ${result.changed ? "yes" : "no"}`);
-				if (verbose) {
-					console.log(`m.direct before: ${formatMatrixCliText(JSON.stringify(result.directContentBefore[result.remoteUserId] ?? []))}`);
-					console.log(`m.direct after: ${formatMatrixCliText(JSON.stringify(result.directContentAfter[result.remoteUserId] ?? []))}`);
-				}
-			},
-			errorPrefix: "Direct room repair failed"
-		});
-	});
-	root.command("encryption").description("Set up Matrix end-to-end encryption").command("setup").description("Enable Matrix E2EE, bootstrap verification, and print next steps").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key <key>", "Recovery key to apply before bootstrap (prefer --recovery-key-stdin)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--force-reset-cross-signing", "Force reset cross-signing identity before bootstrap (requires active recovery key)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await setupMatrixEncryption({
-				account: options.account,
-				recoveryKey: await resolveMatrixCliRecoveryKeyInput({
-					recoveryKey: options.recoveryKey,
-					recoveryKeyStdin: options.recoveryKeyStdin
-				}),
-				forceResetCrossSigning: options.forceResetCrossSigning === true
-			}),
-			onText: (result, verbose) => {
-				printMatrixEncryptionSetupResult(result, verbose);
-			},
-			onJson: (result) => ({
-				success: result.bootstrap.success,
-				...result
-			}),
-			shouldFail: (result) => !result.bootstrap.success,
-			errorPrefix: "Encryption setup failed",
-			onJsonError: (message) => ({
-				success: false,
-				error: message
-			})
-		});
+					console.log("Accept this verification request in another Matrix client.");
+				},
+				onReady: (summary) => {
+					console.log("Verification request accepted.");
+					if (!summary.hasSas) console.log("Starting SAS verification...");
+				},
+				onSas: (summary) => {
+					printMatrixVerificationSas(summary.sas ?? {});
+					console.log("Compare this SAS with the other Matrix client.");
+				},
+				confirmSas: async () => await promptMatrixVerificationSasMatch()
+			});
+		},
+		onText: (summary, verbose) => {
+			printMatrixVerificationSummary(summary);
+			console.log(`Device verified by owner: ${summary.deviceOwnerVerified ? "yes" : "no"}`);
+			printVerificationTrustDiagnostics(summary.ownerVerification);
+			printVerificationBackupSummary(summary.ownerVerification);
+			if (verbose) printVerificationBackupStatus(summary.ownerVerification);
+			console.log("Self-verification complete.");
+		},
+		onTextError: () => {
+			const accountId = resolvedAccountId ?? options.account;
+			printGuidance([`Run ${formatMatrixCliCommand("verify self", accountId)} again and accept the request in another verified Matrix client for this account.`, `Then run ${formatMatrixCliCommand("verify status --verbose", accountId)} to confirm Cross-signing verified: yes and Signed by owner: yes.`]);
+		},
+		errorPrefix: "Self-verification failed"
 	});
+}
+function registerMatrixVerificationCommands(root) {
 	const verify = root.command("verify").description("Device verification for Matrix E2EE");
 	verify.command("list").description("List pending Matrix verification requests").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
 		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
@@ -1116,230 +1349,18 @@ function registerMatrixCli(params) {
 			errorPrefix: "Error"
 		});
 	});
-	const backup = verify.command("backup").description("Matrix room-key backup health and restore");
-	backup.command("status").description("Show Matrix room-key backup status for this device").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await getMatrixRoomKeyBackupStatus({
-				accountId,
-				cfg
-			}),
-			onText: (status, verbose) => {
-				printAccountLabel(accountId);
-				printBackupSummary(status);
-				if (verbose) printBackupStatus(status);
-				printBackupGuidance(status, accountId);
-			},
-			errorPrefix: "Backup status failed"
-		});
-	});
-	backup.command("reset").description("Delete the current server backup and create a fresh room-key backup baseline, repairing secret storage if needed for a durable reset").option("--account <id>", "Account ID (for multi-account setups)").option("--yes", "Confirm destructive backup reset", false).option("--rotate-recovery-key", "Create a new Matrix recovery key for the fresh backup").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => {
-				if (options.yes !== true) throw new Error(`Refusing to reset Matrix room-key backup without --yes. If you accept losing unrecoverable history, re-run ${formatMatrixCliCommand("verify backup reset --yes", accountId)}.`);
-				return await resetMatrixRoomKeyBackup({
-					accountId,
-					cfg,
-					rotateRecoveryKey: options.rotateRecoveryKey === true
-				});
-			},
-			onText: (result, verbose) => {
-				printAccountLabel(accountId);
-				console.log(`Reset success: ${result.success ? "yes" : "no"}`);
-				if (result.error) console.log(`Error: ${formatMatrixCliText(result.error)}`);
-				console.log(`Previous backup version: ${formatMatrixCliText(result.previousVersion, "none")}`);
-				console.log(`Deleted backup version: ${formatMatrixCliText(result.deletedVersion, "none")}`);
-				console.log(`Current backup version: ${formatMatrixCliText(result.createdVersion, "none")}`);
-				printBackupSummary(result.backup);
-				if (verbose) {
-					printTimestamp("Reset at", result.resetAt);
-					printBackupStatus(result.backup);
-				}
-				printBackupGuidance(result.backup, accountId);
-			},
-			shouldFail: (result) => !result.success,
-			errorPrefix: "Backup reset failed",
-			onJsonError: (message) => ({
-				success: false,
-				error: message
-			})
-		});
-	});
-	backup.command("restore").description("Restore encrypted room keys from server backup").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key <key>", "Optional recovery key to load before restoring (prefer --recovery-key-stdin)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await restoreMatrixRoomKeyBackup({
-				accountId,
-				cfg,
-				recoveryKey: await resolveMatrixCliRecoveryKeyInput(options)
-			}),
-			onText: (result, verbose) => {
-				printAccountLabel(accountId);
-				console.log(`Restore success: ${result.success ? "yes" : "no"}`);
-				if (result.error) console.log(`Error: ${formatMatrixCliText(result.error)}`);
-				console.log(`Backup version: ${formatMatrixCliText(result.backupVersion, "none")}`);
-				console.log(`Imported keys: ${result.imported}/${result.total}`);
-				printBackupSummary(result.backup);
-				if (verbose) {
-					console.log(`Loaded key from secret storage: ${result.loadedFromSecretStorage ? "yes" : "no"}`);
-					printTimestamp("Restored at", result.restoredAt);
-					printBackupStatus(result.backup);
-				}
-				printBackupGuidance(result.backup, accountId, { recoveryKeyStored: result.loadedFromSecretStorage });
-			},
-			shouldFail: (result) => !result.success,
-			errorPrefix: "Backup restore failed",
-			onJsonError: (message) => ({
-				success: false,
-				error: message
-			})
-		});
-	});
-	verify.command("bootstrap").description("Bootstrap Matrix cross-signing and device verification state").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key <key>", "Recovery key to apply before bootstrap (prefer --recovery-key-stdin)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--force-reset-cross-signing", "Force reset cross-signing identity before bootstrap (requires active recovery key)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await bootstrapMatrixVerification({
-				accountId,
-				cfg,
-				recoveryKey: await resolveMatrixCliRecoveryKeyInput(options),
-				forceResetCrossSigning: options.forceResetCrossSigning === true
-			}),
-			onText: (result, verbose) => {
-				printAccountLabel(accountId);
-				console.log(`Bootstrap success: ${result.success ? "yes" : "no"}`);
-				if (result.error) console.log(`Error: ${formatMatrixCliText(result.error)}`);
-				console.log(`Verified by owner: ${result.verification.verified ? "yes" : "no"}`);
-				printVerificationIdentity(result.verification);
-				if (verbose) {
-					printVerificationTrustDiagnostics(result.verification);
-					console.log(`Cross-signing published: ${result.crossSigning.published ? "yes" : "no"} (master=${result.crossSigning.masterKeyPublished ? "yes" : "no"}, self=${result.crossSigning.selfSigningKeyPublished ? "yes" : "no"}, user=${result.crossSigning.userSigningKeyPublished ? "yes" : "no"})`);
-					printVerificationBackupStatus(result.verification);
-					printTimestamp("Recovery key created at", result.verification.recoveryKeyCreatedAt);
-					console.log(`Pending verifications: ${result.pendingVerifications}`);
-				} else {
-					console.log(`Cross-signing published: ${result.crossSigning.published ? "yes" : "no"}`);
-					printVerificationBackupSummary(result.verification);
-				}
-				printVerificationGuidance({
-					...result.verification,
-					pendingVerifications: result.pendingVerifications
-				}, accountId);
-			},
-			shouldFail: (result) => !result.success,
-			errorPrefix: "Verification bootstrap failed",
-			onJsonError: (message) => ({
-				success: false,
-				error: message
-			})
-		});
-	});
-	verify.command("device [key]").description("Verify device using a Matrix recovery key").option("--account <id>", "Account ID (for multi-account setups)").option("--recovery-key-stdin", "Read the Matrix recovery key from stdin").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (key, options) => {
-		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await verifyMatrixRecoveryKey(await requireMatrixCliRecoveryKeyInput({
-				recoveryKey: key,
-				recoveryKeyStdin: options.recoveryKeyStdin
-			}), {
-				accountId,
-				cfg
-			}),
-			onText: (result, verbose) => {
-				printAccountLabel(accountId);
-				if (!result.success) {
-					console.error(`Verification failed: ${formatMatrixCliText(result.error)}`);
-					printVerificationIdentity(result);
-					console.log(`Recovery key accepted: ${result.recoveryKeyAccepted ? "yes" : "no"}`);
-					console.log(`Backup usable: ${result.backupUsable ? "yes" : "no"}`);
-					console.log(`Device verified by owner: ${result.deviceOwnerVerified ? "yes" : "no"}`);
-					printVerificationBackupSummary(result);
-					if (verbose) {
-						printVerificationTrustDiagnostics(result);
-						printVerificationBackupStatus(result);
-						printTimestamp("Recovery key created at", result.recoveryKeyCreatedAt);
-					}
-					printVerificationGuidance({
-						...result,
-						pendingVerifications: 0
-					}, accountId);
-					return;
-				}
-				console.log("Device verification completed successfully.");
-				printVerificationIdentity(result);
-				console.log(`Recovery key accepted: ${result.recoveryKeyAccepted ? "yes" : "no"}`);
-				console.log(`Backup usable: ${result.backupUsable ? "yes" : "no"}`);
-				console.log(`Device verified by owner: ${result.deviceOwnerVerified ? "yes" : "no"}`);
-				printVerificationBackupSummary(result);
-				if (verbose) {
-					printVerificationTrustDiagnostics(result);
-					printVerificationBackupStatus(result);
-					printTimestamp("Recovery key created at", result.recoveryKeyCreatedAt);
-					printTimestamp("Verified at", result.verifiedAt);
-				}
-				printVerificationGuidance({
-					...result,
-					pendingVerifications: 0
-				}, accountId);
-			},
-			shouldFail: (result) => !result.success,
-			errorPrefix: "Verification failed",
-			onJsonError: (message) => ({
-				success: false,
-				error: message
-			})
-		});
-	});
-	const devices = root.command("devices").description("Inspect and clean up Matrix devices");
-	devices.command("list").description("List server-side Matrix devices for this account").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await listMatrixOwnDevices({
-				accountId,
-				cfg
-			}),
-			onText: (result) => {
-				printAccountLabel(accountId);
-				printMatrixOwnDevices(result);
-			},
-			errorPrefix: "Device listing failed"
-		});
-	});
-	devices.command("prune-stale").description("Delete stale OpenClaw-managed devices for this account").option("--account <id>", "Account ID (for multi-account setups)").option("--verbose", "Show detailed diagnostics").option("--json", "Output as JSON").action(async (options) => {
-		const { accountId, cfg } = resolveMatrixCliAccountContext(options.account);
-		await runMatrixCliCommand({
-			verbose: options.verbose === true,
-			json: options.json === true,
-			run: async () => await pruneMatrixStaleGatewayDevices({
-				accountId,
-				cfg
-			}),
-			onText: (result, verbose) => {
-				printAccountLabel(accountId);
-				console.log(`Deleted stale OpenClaw devices: ${result.deletedDeviceIds.length ? result.deletedDeviceIds.map((deviceId) => formatMatrixCliText(deviceId)).join(", ") : "none"}`);
-				console.log(`Current device: ${formatMatrixCliText(result.currentDeviceId)}`);
-				console.log(`Remaining devices: ${result.remainingDevices.length}`);
-				if (verbose) {
-					console.log("Devices before cleanup:");
-					printMatrixOwnDevices(result.before);
-					console.log("Devices after cleanup:");
-					printMatrixOwnDevices(result.remainingDevices);
-				}
-			},
-			errorPrefix: "Device cleanup failed"
-		});
-	});
+	registerMatrixVerificationBackupCommands(verify);
+}
+//#endregion
+//#region extensions/matrix/src/cli.ts
+function registerMatrixCli(params) {
+	const root = params.program.command("matrix").description("Matrix channel utilities").addHelpText("after", () => "\nDocs: https://docs.openclaw.ai/channels/matrix\n");
+	registerMatrixAccountCommands(root);
+	registerMatrixProfileCommands(root);
+	registerMatrixDirectCommands(root);
+	registerMatrixEncryptionCommands(root);
+	registerMatrixVerificationCommands(root);
+	registerMatrixDeviceCommands(root);
 }
 //#endregion
 export { registerMatrixCli };