@openclaw/matrix 2026.7.2-beta.4 → 2026.7.2-beta.7

package/dist/session-binding-contract-api.js

@@ -1,4 +1,4 @@
 import { r as setMatrixRuntime } from "./runtime-6S3DNFNv.js";
 import { s as resetMatrixThreadBindingsForTests } from "./thread-bindings-shared-CKnY4LSd.js";
-import { t as createMatrixThreadBindingManager } from "./thread-bindings-BcYBELC7.js";
+import { t as createMatrixThreadBindingManager } from "./thread-bindings-DGbl3vDW.js";
 export { createMatrixThreadBindingManager, resetMatrixThreadBindingsForTests, setMatrixRuntime };

package/dist/{setup-bootstrap-C9w01xQK.js → setup-bootstrap-Deleiibz.js}

@@ -1,7 +1,7 @@
 import { a as resolveMatrixAccountConfig, n as hasExplicitMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import "./setup-core-D6gyoyeg.js";
+import "./accounts-DfngqebB.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { n as bootstrapMatrixVerification } from "./verification-DhMBWxOJ.js";
+import { n as bootstrapMatrixVerification } from "./verification-DYMQ1QpI.js";
 //#region extensions/matrix/src/setup-bootstrap.ts
 async function maybeBootstrapNewEncryptedMatrixAccount(params) {
 	const accountConfig = resolveMatrixAccountConfig({

package/dist/{setup-core-D6gyoyeg.js → setup-core-BVfBv2ai.js}

@@ -1,139 +1,16 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { a as resolveMatrixDefaultOrOnlyAccountId, o as resolveMatrixAccountStringValues, r as resolveConfiguredMatrixAccountIds } from "./account-selection-kqquRzCf.js";
-import { a as resolveMatrixAccountConfig, o as resolveMatrixBaseConfig, t as findMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import { i as resolveScopedMatrixEnvConfig, n as resolveGlobalMatrixEnvConfig, r as resolveMatrixEnvAuthReadiness } from "./env-auth-CQsYbz-p.js";
-import { o as loadMatrixCredentials, r as credentialsMatchConfig } from "./credentials-read-DVmFCm7X.js";
+import { a as resolveMatrixAccountConfig, t as findMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
+import { r as resolveMatrixEnvAuthReadiness } from "./env-auth-CQsYbz-p.js";
+import { r as resolveDefaultMatrixAccountId } from "./accounts-DfngqebB.js";
 import { n as resolveMatrixConfigPath$1, r as shouldStoreMatrixAccountAtTopLevel, t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
 import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2, addWildcardAllowFrom, applyAccountNameToChannelSection, normalizeAccountId as normalizeAccountId$2, normalizeAllowFromEntries, normalizeSecretInputString, prepareScopedSetupConfig } from "openclaw/plugin-sdk/setup";
 import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
-import { coerceSecretRef as coerceSecretRef$1 } from "openclaw/plugin-sdk/secret-ref-runtime";
-//#region extensions/matrix/src/matrix/accounts.ts
-function clean(value) {
-	return normalizeOptionalString(value) ?? "";
-}
-function resolveMatrixAccountAuthView(params) {
-	const normalizedAccountId = normalizeAccountId(params.accountId);
-	const matrix = resolveMatrixBaseConfig(params.cfg);
-	const account = findMatrixAccountConfig(params.cfg, normalizedAccountId) ?? {};
-	const resolvedStrings = resolveMatrixAccountStringValues({
-		accountId: normalizedAccountId,
-		account: {
-			homeserver: clean(account.homeserver),
-			userId: clean(account.userId),
-			accessToken: typeof account.accessToken === "string" ? clean(account.accessToken) : "",
-			password: typeof account.password === "string" ? clean(account.password) : "",
-			deviceId: clean(account.deviceId),
-			deviceName: clean(account.deviceName)
-		},
-		scopedEnv: resolveScopedMatrixEnvConfig(normalizedAccountId, params.env),
-		channel: {
-			homeserver: clean(matrix.homeserver),
-			userId: clean(matrix.userId),
-			accessToken: typeof matrix.accessToken === "string" ? clean(matrix.accessToken) : "",
-			password: typeof matrix.password === "string" ? clean(matrix.password) : "",
-			deviceId: clean(matrix.deviceId),
-			deviceName: clean(matrix.deviceName)
-		},
-		globalEnv: resolveGlobalMatrixEnvConfig(params.env)
-	});
-	return {
-		homeserver: resolvedStrings.homeserver,
-		userId: resolvedStrings.userId,
-		accessToken: resolvedStrings.accessToken || void 0,
-		password: resolvedStrings.password || void 0
-	};
-}
-function resolveMatrixAccountUserId(params) {
-	const env = params.env ?? process.env;
-	const authView = resolveMatrixAccountAuthView({
-		cfg: params.cfg,
-		accountId: params.accountId,
-		env
-	});
-	const configuredUserId = authView.userId.trim();
-	if (configuredUserId) return configuredUserId;
-	const stored = loadMatrixCredentials(env, params.accountId);
-	if (!stored) return null;
-	if (authView.homeserver && stored.homeserver !== authView.homeserver) return null;
-	if (authView.accessToken && stored.accessToken !== authView.accessToken) return null;
-	return stored.userId.trim() || null;
-}
-function listMatrixAccountIds(cfg) {
-	const ids = resolveConfiguredMatrixAccountIds(cfg, process.env);
-	return ids.length > 0 ? ids : [DEFAULT_ACCOUNT_ID];
-}
-function resolveDefaultMatrixAccountId(cfg) {
-	return normalizeAccountId(resolveMatrixDefaultOrOnlyAccountId(cfg));
-}
-function resolveConfiguredMatrixBotUserIds(params) {
-	const env = params.env ?? process.env;
-	const currentAccountId = normalizeAccountId(params.accountId);
-	const accountIds = new Set(resolveConfiguredMatrixAccountIds(params.cfg, env));
-	if (resolveMatrixAccount({
-		cfg: params.cfg,
-		accountId: DEFAULT_ACCOUNT_ID,
-		env
-	}).configured) accountIds.add(DEFAULT_ACCOUNT_ID);
-	const ids = /* @__PURE__ */ new Set();
-	for (const accountId of accountIds) {
-		if (normalizeAccountId(accountId) === currentAccountId) continue;
-		if (!resolveMatrixAccount({
-			cfg: params.cfg,
-			accountId,
-			env
-		}).configured) continue;
-		const userId = resolveMatrixAccountUserId({
-			cfg: params.cfg,
-			accountId,
-			env
-		});
-		if (userId) ids.add(userId);
-	}
-	return ids;
-}
-function resolveMatrixAccount(params) {
-	const env = params.env ?? process.env;
-	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultMatrixAccountId(params.cfg));
-	const matrixBase = resolveMatrixBaseConfig(params.cfg);
-	const base = resolveMatrixAccountConfig({
-		cfg: params.cfg,
-		accountId,
-		env
-	});
-	const explicitAuthConfig = accountId === DEFAULT_ACCOUNT_ID ? base : findMatrixAccountConfig(params.cfg, accountId) ?? {};
-	const enabled = base.enabled !== false && matrixBase.enabled !== false;
-	const authView = resolveMatrixAccountAuthView({
-		cfg: params.cfg,
-		accountId,
-		env
-	});
-	const hasHomeserver = Boolean(authView.homeserver);
-	const hasUserId = Boolean(authView.userId);
-	const hasAccessToken = Boolean(authView.accessToken) || hasConfiguredSecretInput(explicitAuthConfig.accessToken);
-	const hasPassword = Boolean(authView.password);
-	const hasPasswordAuth = hasUserId && (hasPassword || hasConfiguredSecretInput(explicitAuthConfig.password));
-	const stored = loadMatrixCredentials(env, accountId);
-	const hasStored = stored && authView.homeserver ? credentialsMatchConfig(stored, {
-		homeserver: authView.homeserver,
-		userId: authView.userId || ""
-	}) : false;
-	const configured = hasHomeserver && (hasAccessToken || hasPasswordAuth || hasStored);
-	return {
-		accountId,
-		enabled,
-		name: normalizeOptionalString(base.name),
-		configured,
-		homeserver: authView.homeserver || void 0,
-		userId: authView.userId || void 0,
-		config: base
-	};
-}
-//#endregion
+import { coerceSecretRef } from "openclaw/plugin-sdk/secret-ref-runtime";
+import { createChannelDmPolicy } from "openclaw/plugin-sdk/channel-dm-policy";
 //#region extensions/matrix/src/setup-contract.ts
 const matrixSingleAccountKeysToMove = [
 	"homeserver",
@@ -229,7 +106,7 @@ function applyNullableSecretInputField(target, key, value, defaults) {
 		else delete target[key];
 		return;
 	}
-	const ref = coerceSecretRef$1(value, defaults);
+	const ref = coerceSecretRef(value, defaults);
 	if (!ref) throw new Error(`Invalid Matrix ${key} SecretInput.`);
 	target[key] = ref;
 }
@@ -577,28 +454,48 @@ function resolveMatrixSetupDmAllowFrom(policy, allowFrom) {
 	if (policy === "open") return addWildcardAllowFrom(allowFrom);
 	return normalizeAllowFromEntries(allowFrom ?? []).filter((entry) => entry !== "*");
 }
+function createMatrixSetupDmPolicy(promptAllowFrom) {
+	return createChannelDmPolicy({
+		label: "Matrix",
+		channel: "matrix",
+		policyPath: "dm.policy",
+		allowFromPath: "dm.allowFrom",
+		resolveAccount: (cfg, accountId) => {
+			const resolvedCfg = cfg;
+			const resolvedAccountId = normalizeAccountId$2(accountId?.trim() || resolveDefaultMatrixAccountId(resolvedCfg) || DEFAULT_ACCOUNT_ID$2);
+			const config = resolveMatrixAccountConfig({
+				cfg: resolvedCfg,
+				accountId: resolvedAccountId
+			});
+			return {
+				accountId: resolvedAccountId,
+				config: {
+					dmPolicy: config.dm?.policy,
+					allowFrom: config.dm?.allowFrom,
+					dm: config.dm
+				}
+			};
+		},
+		resolveConfigKeys: ({ cfg, account }) => ({
+			policyKey: resolveMatrixConfigFieldPath(cfg, account.accountId, "dm.policy"),
+			allowFromKey: resolveMatrixConfigFieldPath(cfg, account.accountId, "dm.allowFrom")
+		}),
+		resolveAllowFrom: ({ policy, account }) => resolveMatrixSetupDmAllowFrom(policy, account.config.allowFrom),
+		buildPatch: ({ account, policy, allowFrom }) => ({ dm: {
+			...account.config.dm,
+			policy,
+			allowFrom
+		} }),
+		applyPatch: ({ cfg, account, patch }) => updateMatrixAccountConfig(cfg, account.accountId, patch),
+		promptAllowFrom
+	});
+}
 //#endregion
 //#region extensions/matrix/src/setup-core.ts
 const channel = "matrix";
 function resolveMatrixSetupAccountId(params) {
 	return normalizeAccountId$2(params.accountId?.trim() || params.name?.trim() || DEFAULT_ACCOUNT_ID$2);
 }
-function resolveMatrixSetupWizardAccountId(cfg, accountId) {
-	return normalizeAccountId$2(accountId?.trim() || resolveDefaultMatrixAccountId(cfg) || DEFAULT_ACCOUNT_ID$2);
-}
-function setMatrixDmPolicy(cfg, policy, accountId) {
-	const resolvedAccountId = resolveMatrixSetupWizardAccountId(cfg, accountId);
-	const existing = resolveMatrixAccountConfig({
-		cfg,
-		accountId: resolvedAccountId
-	});
-	const allowFrom = resolveMatrixSetupDmAllowFrom(policy, existing.dm?.allowFrom);
-	return updateMatrixAccountConfig(cfg, resolvedAccountId, { dm: {
-		...existing.dm,
-		policy,
-		allowFrom
-	} });
-}
 function createMatrixSetupWizardProxy(loadWizardModule) {
 	let wizardPromise = null;
 	const loadWizard = () => {
@@ -618,28 +515,10 @@ function createMatrixSetupWizardProxy(loadWizardModule) {
 			return await (wizard.configureWhenConfigured ?? wizard.configureInteractive ?? wizard.configure)(ctx);
 		},
 		afterConfigWritten: async (ctx) => await (await loadWizard()).afterConfigWritten?.(ctx),
-		dmPolicy: {
-			label: "Matrix",
-			channel,
-			policyKey: "channels.matrix.dm.policy",
-			allowFromKey: "channels.matrix.dm.allowFrom",
-			resolveConfigKeys: (cfg, accountId) => {
-				const resolvedAccountId = resolveMatrixSetupWizardAccountId(cfg, accountId);
-				return {
-					policyKey: resolveMatrixConfigFieldPath(cfg, resolvedAccountId, "dm.policy"),
-					allowFromKey: resolveMatrixConfigFieldPath(cfg, resolvedAccountId, "dm.allowFrom")
-				};
-			},
-			getCurrent: (cfg, accountId) => resolveMatrixAccountConfig({
-				cfg,
-				accountId: resolveMatrixSetupWizardAccountId(cfg, accountId)
-			}).dm?.policy ?? "pairing",
-			setPolicy: (cfg, policy, accountId) => setMatrixDmPolicy(cfg, policy, accountId),
-			promptAllowFrom: async (params) => {
-				const promptAllowFrom = (await loadWizard()).dmPolicy?.promptAllowFrom;
-				return promptAllowFrom ? await promptAllowFrom(params) : params.cfg;
-			}
-		},
+		dmPolicy: createMatrixSetupDmPolicy(async (params) => {
+			const promptAllowFrom = (await loadWizard()).dmPolicy?.promptAllowFrom;
+			return promptAllowFrom ? await promptAllowFrom(params) : params.cfg;
+		}),
 		disable: (cfg) => ({
 			...cfg,
 			channels: {
@@ -680,7 +559,7 @@ const matrixSetupAdapter = {
 		input
 	}),
 	afterAccountConfigWritten: async ({ previousCfg, cfg, accountId, runtime }) => {
-		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-C9w01xQK.js");
+		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-Deleiibz.js");
 		await runMatrixSetupBootstrapAfterConfigWrite({
 			previousCfg,
 			cfg,
@@ -767,4 +646,4 @@ const matrixSetupContract = defineChannelSetupContract({
 	legacyAdapter: matrixSetupAdapter
 });
 //#endregion
-export { resolveMatrixAccount as _, moveSingleMatrixAccountConfigToNamedAccount as a, config_update_exports as c, namedAccountPromotionKeys as d, resolveSingleAccountPromotionTarget as f, resolveDefaultMatrixAccountId as g, resolveConfiguredMatrixBotUserIds as h, resolveMatrixSetupDmAllowFrom as i, resolveMatrixConfigPath as l, listMatrixAccountIds as m, matrixSetupAdapter as n, profile_exports as o, singleAccountKeysToMove as p, matrixSetupContract as r, syncMatrixOwnProfile as s, createMatrixSetupWizardProxy as t, updateMatrixAccountConfig as u };
+export { moveSingleMatrixAccountConfigToNamedAccount as a, config_update_exports as c, namedAccountPromotionKeys as d, resolveSingleAccountPromotionTarget as f, createMatrixSetupDmPolicy as i, resolveMatrixConfigPath as l, matrixSetupAdapter as n, profile_exports as o, singleAccountKeysToMove as p, matrixSetupContract as r, syncMatrixOwnProfile as s, createMatrixSetupWizardProxy as t, updateMatrixAccountConfig as u };

package/dist/setup-plugin-api.js

@@ -1,5 +1,6 @@
-import { _ as resolveMatrixAccount, n as matrixSetupAdapter, r as matrixSetupContract, t as createMatrixSetupWizardProxy } from "./setup-core-D6gyoyeg.js";
-import { r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-CggnuwnJ.js";
+import { i as resolveMatrixAccount } from "./accounts-DfngqebB.js";
+import { r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-Djxw3C6b.js";
+import { n as matrixSetupAdapter, r as matrixSetupContract, t as createMatrixSetupWizardProxy } from "./setup-core-BVfBv2ai.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 const matrixSetupPlugin = {
 	id: "matrix",
@@ -13,7 +14,7 @@ const matrixSetupPlugin = {
 		order: 70,
 		quickstartAllowFrom: true
 	},
-	setupWizard: createMatrixSetupWizardProxy(async () => ({ matrixSetupWizard: (await import("./setup-surface-DZIEWtQC.js").then((n) => n.t)).matrixSetupWizard })),
+	setupWizard: createMatrixSetupWizardProxy(async () => ({ matrixSetupWizard: (await import("./setup-surface-BBq3WeqX.js").then((n) => n.t)).matrixSetupWizard })),
 	setup: matrixSetupAdapter,
 	setupContract: matrixSetupContract,
 	capabilities: {

package/dist/{setup-surface-DZIEWtQC.js → setup-surface-BBq3WeqX.js}

@@ -2,11 +2,11 @@ import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-kqquRzCf.js";
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
 import { r as resolveMatrixEnvAuthReadiness } from "./env-auth-CQsYbz-p.js";
-import { _ as resolveMatrixAccount, a as moveSingleMatrixAccountConfigToNamedAccount, g as resolveDefaultMatrixAccountId, i as resolveMatrixSetupDmAllowFrom, m as listMatrixAccountIds, u as updateMatrixAccountConfig } from "./setup-core-D6gyoyeg.js";
-import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
+import { i as resolveMatrixAccount, r as resolveDefaultMatrixAccountId, t as listMatrixAccountIds } from "./accounts-DfngqebB.js";
+import { a as moveSingleMatrixAccountConfigToNamedAccount, i as createMatrixSetupDmPolicy, u as updateMatrixAccountConfig } from "./setup-core-BVfBv2ai.js";
 import { n as validateMatrixHomeserverUrl, r as isPrivateOrLoopbackHost, t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
 import { n as ensureMatrixSdkInstalled, r as isMatrixSdkAvailable } from "./deps-CcVJfvRM.js";
-import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringifiedOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringifiedOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
 import { formatDocsLink, hasConfiguredSecretInput, mergeAllowFromEntries, normalizeAccountId as normalizeAccountId$1, promptAccountId, promptChannelAccessConfig, splitSetupEntries } from "openclaw/plugin-sdk/setup";
 import { isPrivateNetworkOptInEnabled } from "openclaw/plugin-sdk/ssrf-policy";
@@ -32,25 +32,9 @@ function isMatrixInviteAutoJoinPolicy(value) {
 function isMatrixInviteAutoJoinTarget(entry) {
 	return entry === "*" || entry.startsWith("!") && entry.includes(":") || entry.startsWith("#") && entry.includes(":");
 }
-function normalizeMatrixInviteAutoJoinTargets(entries) {
-	return [...new Set(entries.map((entry) => normalizeOptionalString(entry)).filter((entry) => Boolean(entry)))];
-}
 function resolveMatrixOnboardingAccountId(cfg, accountId) {
 	return normalizeAccountId$1(normalizeOptionalString(accountId) || resolveDefaultMatrixAccountId(cfg) || DEFAULT_ACCOUNT_ID);
 }
-function setMatrixDmPolicy(cfg, policy, accountId) {
-	const resolvedAccountId = resolveMatrixOnboardingAccountId(cfg, accountId);
-	const existing = resolveMatrixAccountConfig({
-		cfg,
-		accountId: resolvedAccountId
-	});
-	const allowFrom = resolveMatrixSetupDmAllowFrom(policy, existing.dm?.allowFrom);
-	return updateMatrixAccountConfig(cfg, resolvedAccountId, { dm: {
-		...existing.dm,
-		policy,
-		allowFrom
-	} });
-}
 async function noteMatrixAuthHelp(prompter) {
 	await prompter.note([
 		"Matrix requires a homeserver URL.",
@@ -105,7 +89,7 @@ async function promptMatrixAllowFrom(params) {
 			pending.push(part);
 		}
 		if (pending.length > 0) {
-			const { resolveMatrixTargets } = await import("./resolve-targets-Dn11HT76.js").then((n) => n.n);
+			const { resolveMatrixTargets } = await import("./resolve-targets-nm2L48sh.js").then((n) => n.n);
 			const results = await resolveMatrixTargets({
 				cfg,
 				accountId,
@@ -136,16 +120,6 @@ async function promptMatrixAllowFrom(params) {
 		} });
 	}
 }
-function setMatrixGroupPolicy(cfg, groupPolicy, accountId) {
-	return updateMatrixAccountConfig(cfg, resolveMatrixOnboardingAccountId(cfg, accountId), { groupPolicy });
-}
-function setMatrixGroupRooms(cfg, roomKeys, accountId) {
-	const groups = Object.fromEntries(roomKeys.map((key) => [key, { enabled: true }]));
-	return updateMatrixAccountConfig(cfg, resolveMatrixOnboardingAccountId(cfg, accountId), {
-		groups,
-		rooms: null
-	});
-}
 function setMatrixAutoJoin(cfg, autoJoin, autoJoinAllowlist, accountId) {
 	return updateMatrixAccountConfig(cfg, resolveMatrixOnboardingAccountId(cfg, accountId), {
 		autoJoin,
@@ -183,7 +157,7 @@ async function configureMatrixInviteAutoJoin(params) {
 	}
 	if (policy === "always") return setMatrixAutoJoin(params.cfg, policy, [], accountId);
 	while (true) {
-		const allowlist = normalizeMatrixInviteAutoJoinTargets(splitSetupEntries(await params.prompter.text({
+		const allowlist = normalizeUniqueStringEntries(splitSetupEntries(await params.prompter.text({
 			message: "Matrix invite auto-join allowlist (comma-separated)",
 			placeholder: "!roomId:server, #alias:server, *",
 			initialValue: currentAllowlist[0] ? currentAllowlist.join(", ") : void 0,
@@ -219,7 +193,7 @@ async function configureMatrixAccessPrompts(params) {
 		placeholder: "!roomId:server, #alias:server, Project Room",
 		updatePrompt: Boolean(existingGroups)
 	});
-	if (accessConfig) if (accessConfig.policy !== "allowlist") next = setMatrixGroupPolicy(next, accessConfig.policy, params.accountId);
+	if (accessConfig) if (accessConfig.policy !== "allowlist") next = updateMatrixAccountConfig(next, params.accountId, { groupPolicy: accessConfig.policy });
 	else {
 		let roomKeys = accessConfig.entries;
 		if (accessConfig.entries.length > 0) try {
@@ -233,7 +207,7 @@ async function configureMatrixAccessPrompts(params) {
 					resolvedIds.push(cleaned);
 					continue;
 				}
-				const { listMatrixDirectoryGroupsLive } = await import("./directory-live-B6fbX6jf.js").then((n) => n.t);
+				const { listMatrixDirectoryGroupsLive } = await import("./directory-live-C8dVBiCc.js").then((n) => n.t);
 				const matches = await listMatrixDirectoryGroupsLive({
 					cfg: next,
 					accountId: params.accountId,
@@ -249,8 +223,11 @@ async function configureMatrixAccessPrompts(params) {
 		} catch (err) {
 			await params.prompter.note(`Room lookup failed; keeping entries as typed. ${String(err)}`, "Matrix rooms");
 		}
-		next = setMatrixGroupPolicy(next, "allowlist", params.accountId);
-		next = setMatrixGroupRooms(next, roomKeys, params.accountId);
+		next = updateMatrixAccountConfig(next, params.accountId, {
+			groupPolicy: "allowlist",
+			groups: Object.fromEntries(roomKeys.map((key) => [key, { enabled: true }])),
+			rooms: null
+		});
 	}
 	return await configureMatrixInviteAutoJoin({
 		cfg: next,
@@ -258,25 +235,7 @@ async function configureMatrixAccessPrompts(params) {
 		accountId: params.accountId
 	});
 }
-const dmPolicy = {
-	label: "Matrix",
-	channel,
-	policyKey: "channels.matrix.dm.policy",
-	allowFromKey: "channels.matrix.dm.allowFrom",
-	resolveConfigKeys: (cfg, accountId) => {
-		const effectiveAccountId = resolveMatrixOnboardingAccountId(cfg, accountId);
-		return {
-			policyKey: resolveMatrixConfigFieldPath(cfg, effectiveAccountId, "dm.policy"),
-			allowFromKey: resolveMatrixConfigFieldPath(cfg, effectiveAccountId, "dm.allowFrom")
-		};
-	},
-	getCurrent: (cfg, accountId) => resolveMatrixAccountConfig({
-		cfg,
-		accountId: resolveMatrixOnboardingAccountId(cfg, accountId)
-	}).dm?.policy ?? "pairing",
-	setPolicy: (cfg, policy, accountId) => setMatrixDmPolicy(cfg, policy, accountId),
-	promptAllowFrom: promptMatrixAllowFrom
-};
+const dmPolicy = createMatrixSetupDmPolicy(promptMatrixAllowFrom);
 async function runMatrixConfigure(params) {
 	let next = params.cfg;
 	await ensureMatrixSdkInstalled({
@@ -461,26 +420,18 @@ const matrixOnboardingAdapter = {
 			selectionHint: !sdkReady ? "install Matrix deps" : configured ? "configured" : "needs auth"
 		};
 	},
-	configure: async ({ cfg, runtime, prompter, forceAllowFrom, accountOverrides, shouldPromptAccountIds }) => await runMatrixConfigure({
-		cfg,
-		runtime,
-		prompter,
-		forceAllowFrom,
-		accountOverrides,
-		shouldPromptAccountIds,
+	configure: async (params) => await runMatrixConfigure({
+		...params,
+		cfg: params.cfg,
 		intent: "update"
 	}),
-	configureInteractive: async ({ cfg, runtime, prompter, forceAllowFrom, accountOverrides, shouldPromptAccountIds, configured }) => {
-		if (!configured) return await runMatrixConfigure({
-			cfg,
-			runtime,
-			prompter,
-			forceAllowFrom,
-			accountOverrides,
-			shouldPromptAccountIds,
+	configureInteractive: async (params) => {
+		if (!params.configured) return await runMatrixConfigure({
+			...params,
+			cfg: params.cfg,
 			intent: "update"
 		});
-		const action = await prompter.select({
+		const action = await params.prompter.select({
 			message: "Matrix already configured. What do you want to do?",
 			options: [
 				{
@@ -500,17 +451,13 @@ const matrixOnboardingAdapter = {
 		});
 		if (action === "skip") return "skip";
 		return await runMatrixConfigure({
-			cfg,
-			runtime,
-			prompter,
-			forceAllowFrom,
-			accountOverrides,
-			shouldPromptAccountIds,
+			...params,
+			cfg: params.cfg,
 			intent: action === "add-account" ? "add-account" : "update"
 		});
 	},
 	afterConfigWritten: async ({ previousCfg, cfg, accountId, runtime }) => {
-		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-C9w01xQK.js");
+		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-Deleiibz.js");
 		await runMatrixSetupBootstrapAfterConfigWrite({
 			previousCfg,
 			cfg,

package/dist/{shared-C7Vm9RxI.js → shared-CUMWxcMz.js}

@@ -5,18 +5,19 @@ import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as
 import { i as resolveScopedMatrixEnvConfig, n as resolveGlobalMatrixEnvConfig } from "./env-auth-CQsYbz-p.js";
 import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
-import { s as repairCurrentTokenStorageMetaDeviceId } from "./storage-BrkTJZov.js";
+import { s as repairCurrentTokenStorageMetaDeviceId } from "./storage-BvAkgzvT.js";
 import { n as LogService } from "./logger-D0GCSDQq.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1, normalizeOptionalAccountId, normalizeOptionalAccountId as normalizeOptionalAccountId$1 } from "openclaw/plugin-sdk/account-id";
 import { coerceSecretRef, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input-runtime";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { formatErrorMessage, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
 import { isPrivateNetworkOptInEnabled, ssrfPolicyFromDangerouslyAllowPrivateNetwork as ssrfPolicyFromDangerouslyAllowPrivateNetwork$1 } from "openclaw/plugin-sdk/ssrf-runtime";
 import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
+import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 //#region extensions/matrix/src/matrix/client/config.ts
-const loadDefaultMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-DiRXiRRf.js"), import("./logging-QH-48Gr6.js")]).then(([sdkModule, loggingModule]) => ({
+const loadDefaultMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-bUytQHx7.js"), import("./logging-DV-p52N0.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
 	MatrixClient: sdkModule.MatrixClient,
 	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
 })));
@@ -40,14 +41,15 @@ function credentialsMatchBackfillAuthLineage(params) {
 	if (!params.stored) return true;
 	return params.stored.homeserver === params.auth.homeserver && params.stored.userId === params.auth.userId && params.stored.accessToken === params.auth.accessToken;
 }
-async function retryMatrixAuthRequest(label, run) {
+async function retryMatrixAuthRequest(label, run, signal) {
 	return await retryAsync(run, {
 		attempts: 3,
 		minDelayMs: 250,
 		maxDelayMs: 1500,
 		jitter: .1,
 		label,
-		shouldRetry: (err) => shouldRetryMatrixAuthRequest(err)
+		shouldRetry: (err) => shouldRetryMatrixAuthRequest(err),
+		sleep: (ms) => sleepWithAbort(ms, signal)
 	});
 }
 async function fetchMatrixWhoamiIdentity(params) {
@@ -60,7 +62,7 @@ async function fetchMatrixWhoamiIdentity(params) {
 	});
 	return await retryMatrixAuthRequest("matrix auth whoami", async () => {
 		return await tempClient.doRequest("GET", "/_matrix/client/v3/account/whoami");
-	});
+	}, params.signal);
 }
 function readEnvSecretRefFallback(params) {
 	const ref = coerceSecretRef(params.value, params.config?.secrets?.defaults);
@@ -412,13 +414,21 @@ async function backfillMatrixAuthDeviceIdAfterStartup(params) {
 	const knownDeviceId = params.auth.deviceId?.trim();
 	if (knownDeviceId) return knownDeviceId;
 	if (isAbortSignalTriggered(params.abortSignal)) return;
-	const deviceId = (await fetchMatrixWhoamiIdentity({
-		homeserver: params.auth.homeserver,
-		accessToken: params.auth.accessToken,
-		userId: params.auth.userId,
-		ssrfPolicy: params.auth.ssrfPolicy,
-		dispatcherPolicy: params.auth.dispatcherPolicy
-	})).device_id?.trim();
+	let whoami;
+	try {
+		whoami = await fetchMatrixWhoamiIdentity({
+			homeserver: params.auth.homeserver,
+			accessToken: params.auth.accessToken,
+			userId: params.auth.userId,
+			ssrfPolicy: params.auth.ssrfPolicy,
+			dispatcherPolicy: params.auth.dispatcherPolicy,
+			signal: params.abortSignal
+		});
+	} catch (err) {
+		if (isAbortSignalTriggered(params.abortSignal)) return;
+		throw err;
+	}
+	const deviceId = whoami.device_id?.trim();
 	if (!deviceId) return;
 	if (isAbortSignalTriggered(params.abortSignal)) return;
 	const env = params.env ?? process.env;
@@ -470,17 +480,10 @@ async function awaitMatrixStartupWithAbort(promise, abortSignal) {
 			resolve(value);
 		}, (error) => {
 			abortSignal.removeEventListener("abort", onAbort);
-			reject(toLintErrorObject(error, "Non-Error rejection"));
+			reject(toErrorObject(error, "Non-Error rejection"));
 		});
 	});
 }
-function toLintErrorObject(value, fallbackMessage) {
-	if (value instanceof Error) return value;
-	if (typeof value === "string") return new Error(value);
-	const error = new Error(fallbackMessage, { cause: value });
-	if (typeof value === "object" && value !== null || typeof value === "function") Object.assign(error, value);
-	return error;
-}
 //#endregion
 //#region extensions/matrix/src/matrix/client/shared.ts
 var shared_exports = /* @__PURE__ */ __exportAll({
@@ -492,7 +495,7 @@ var shared_exports = /* @__PURE__ */ __exportAll({
 	stopSharedClientForAccount: () => stopSharedClientForAccount,
 	stopSharedClientInstance: () => stopSharedClientInstance
 });
-const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => import("./create-client-Und1YmJ2.js").then((n) => n.n).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
+const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => import("./create-client-BmSU-q-D.js").then((n) => n.n).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
 const sharedClientStates = /* @__PURE__ */ new Map();
 const sharedClientPromises = /* @__PURE__ */ new Map();
 function serializeDispatcherPolicyKey(auth) {

package/dist/{startup-verification-D1nscMh8.js → startup-verification-wm3_i88s.js}

@@ -1,6 +1,6 @@
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { M as resolveMatrixSqliteStateEnv, l as resolveMatrixStoragePaths, o as recordCurrentStorageMetaDeviceId } from "./storage-BrkTJZov.js";
+import { M as resolveMatrixSqliteStateEnv, l as resolveMatrixStoragePaths, o as recordCurrentStorageMetaDeviceId } from "./storage-BvAkgzvT.js";
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";