@openclaw/matrix 2026.7.2-beta.5 → 2026.7.33

package/README.md

@@ -5,7 +5,7 @@ Official OpenClaw channel plugin for Matrix rooms and direct messages.
 Install from OpenClaw:
 
 ```bash
-openclaw plugins install @openclaw/matrix
+openclaw plugin add @openclaw/matrix
 ```
 
 Configure the Matrix homeserver and bot credentials in OpenClaw. The plugin lets agents join configured rooms, receive messages, and reply through Matrix.

package/dist/.setup/account-selection-BOQeTqax.mjs

@@ -0,0 +1,159 @@
+import { n as listMatrixEnvAccountIds, t as getMatrixScopedEnvVarNames } from "./env-vars-KzaYveuy.mjs";
+import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { listCombinedAccountIds, listConfiguredAccountIds, resolveListedDefaultAccountId, resolveNormalizedAccountEntry } from "openclaw/plugin-sdk/account-core";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
+import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input-runtime";
+//#region extensions/matrix/src/auth-precedence.ts
+const MATRIX_DEFAULT_ACCOUNT_AUTH_ONLY_FIELDS = /* @__PURE__ */ new Set([
+	"userId",
+	"accessToken",
+	"password",
+	"deviceId"
+]);
+function resolveMatrixStringSourceValue(value) {
+	return typeof value === "string" ? value : "";
+}
+function shouldAllowBaseAuthFallback(accountId, field) {
+	return normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID || !MATRIX_DEFAULT_ACCOUNT_AUTH_ONLY_FIELDS.has(field);
+}
+function resolveMatrixAccountStringValues(params) {
+	const fields = [
+		"homeserver",
+		"userId",
+		"accessToken",
+		"password",
+		"deviceId",
+		"deviceName"
+	];
+	const resolved = {};
+	for (const field of fields) resolved[field] = resolveMatrixStringSourceValue(params.account?.[field]) || resolveMatrixStringSourceValue(params.scopedEnv?.[field]) || (shouldAllowBaseAuthFallback(params.accountId, field) ? resolveMatrixStringSourceValue(params.channel?.[field]) || resolveMatrixStringSourceValue(params.globalEnv?.[field]) : "");
+	return resolved;
+}
+//#endregion
+//#region extensions/matrix/src/account-selection.ts
+function readConfiguredMatrixString(value) {
+	return normalizeOptionalString(value) ?? "";
+}
+function readConfiguredMatrixSecretSource(value) {
+	return hasConfiguredSecretInput(value) ? "configured" : "";
+}
+function resolveMatrixChannelStringSources(entry) {
+	if (!entry) return {};
+	return {
+		homeserver: readConfiguredMatrixString(entry.homeserver),
+		userId: readConfiguredMatrixString(entry.userId),
+		accessToken: readConfiguredMatrixSecretSource(entry.accessToken),
+		password: readConfiguredMatrixSecretSource(entry.password),
+		deviceId: readConfiguredMatrixString(entry.deviceId),
+		deviceName: readConfiguredMatrixString(entry.deviceName)
+	};
+}
+function readEnvMatrixString(env, key) {
+	return normalizeOptionalString(env[key]) ?? "";
+}
+function resolveScopedMatrixEnvStringSources(accountId, env) {
+	const keys = getMatrixScopedEnvVarNames(accountId);
+	return {
+		homeserver: readEnvMatrixString(env, keys.homeserver),
+		userId: readEnvMatrixString(env, keys.userId),
+		accessToken: readEnvMatrixString(env, keys.accessToken),
+		password: readEnvMatrixString(env, keys.password),
+		deviceId: readEnvMatrixString(env, keys.deviceId),
+		deviceName: readEnvMatrixString(env, keys.deviceName)
+	};
+}
+function resolveGlobalMatrixEnvStringSources(env) {
+	return {
+		homeserver: readEnvMatrixString(env, "MATRIX_HOMESERVER"),
+		userId: readEnvMatrixString(env, "MATRIX_USER_ID"),
+		accessToken: readEnvMatrixString(env, "MATRIX_ACCESS_TOKEN"),
+		password: readEnvMatrixString(env, "MATRIX_PASSWORD"),
+		deviceId: readEnvMatrixString(env, "MATRIX_DEVICE_ID"),
+		deviceName: readEnvMatrixString(env, "MATRIX_DEVICE_NAME")
+	};
+}
+function hasUsableResolvedMatrixAuth(values) {
+	return Boolean(values.homeserver && (values.accessToken || values.userId));
+}
+function hasFreshResolvedMatrixAuth(values) {
+	return Boolean(values.homeserver && (values.accessToken || values.userId && values.password));
+}
+function resolveEffectiveMatrixAccountSources(params) {
+	const normalizedAccountId = normalizeAccountId(params.accountId);
+	return resolveMatrixAccountStringValues({
+		accountId: normalizedAccountId,
+		scopedEnv: resolveScopedMatrixEnvStringSources(normalizedAccountId, params.env),
+		channel: resolveMatrixChannelStringSources(params.channel),
+		globalEnv: resolveGlobalMatrixEnvStringSources(params.env)
+	});
+}
+function hasUsableEffectiveMatrixAccountSource(params) {
+	return hasUsableResolvedMatrixAuth(resolveEffectiveMatrixAccountSources(params));
+}
+function hasFreshEffectiveMatrixAccountSource(params) {
+	return hasFreshResolvedMatrixAuth(resolveEffectiveMatrixAccountSources(params));
+}
+function hasConfiguredDefaultMatrixAccountSource(params) {
+	return hasFreshEffectiveMatrixAccountSource({
+		channel: params.channel,
+		accountId: DEFAULT_ACCOUNT_ID,
+		env: params.env
+	});
+}
+function resolveMatrixChannelConfig(cfg) {
+	return isRecord(cfg.channels?.matrix) ? cfg.channels.matrix : null;
+}
+function findMatrixAccountEntry(cfg, accountId) {
+	const channel = resolveMatrixChannelConfig(cfg);
+	if (!channel) return null;
+	const accounts = isRecord(channel.accounts) ? channel.accounts : null;
+	if (!accounts) return null;
+	const entry = resolveNormalizedAccountEntry(accounts, accountId, normalizeAccountId);
+	return isRecord(entry) ? entry : null;
+}
+function resolveConfiguredMatrixAccountIds(cfg, env = process.env) {
+	const channel = resolveMatrixChannelConfig(cfg);
+	const configuredAccountIds = listConfiguredAccountIds({
+		accounts: channel && isRecord(channel.accounts) ? channel.accounts : void 0,
+		normalizeAccountId
+	});
+	if (hasConfiguredDefaultMatrixAccountSource({
+		channel,
+		env
+	})) configuredAccountIds.push(DEFAULT_ACCOUNT_ID);
+	const readyEnvAccountIds = listMatrixEnvAccountIds(env).filter((accountId) => normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID ? hasConfiguredDefaultMatrixAccountSource({
+		channel,
+		env
+	}) : hasUsableEffectiveMatrixAccountSource({
+		channel,
+		accountId,
+		env
+	}));
+	return listCombinedAccountIds({
+		configuredAccountIds,
+		additionalAccountIds: readyEnvAccountIds,
+		fallbackAccountIdWhenEmpty: channel ? DEFAULT_ACCOUNT_ID : void 0
+	});
+}
+function resolveMatrixDefaultOrOnlyAccountId(cfg, env = process.env) {
+	const channel = resolveMatrixChannelConfig(cfg);
+	if (!channel) return DEFAULT_ACCOUNT_ID;
+	const configuredDefault = normalizeOptionalAccountId(typeof channel.defaultAccount === "string" ? channel.defaultAccount : void 0);
+	const configuredAccountIds = resolveConfiguredMatrixAccountIds(cfg, env);
+	return resolveListedDefaultAccountId({
+		accountIds: configuredAccountIds,
+		configuredDefaultAccountId: configuredDefault,
+		ambiguousFallbackAccountId: DEFAULT_ACCOUNT_ID
+	});
+}
+function requiresExplicitMatrixDefaultAccount(cfg, env = process.env) {
+	const channel = resolveMatrixChannelConfig(cfg);
+	if (!channel) return false;
+	const configuredAccountIds = resolveConfiguredMatrixAccountIds(cfg, env);
+	if (configuredAccountIds.length <= 1) return false;
+	if (configuredAccountIds.includes(DEFAULT_ACCOUNT_ID)) return false;
+	const configuredDefault = normalizeOptionalAccountId(typeof channel.defaultAccount === "string" ? channel.defaultAccount : void 0);
+	return !(configuredDefault && configuredAccountIds.includes(configuredDefault));
+}
+//#endregion
+export { resolveMatrixDefaultOrOnlyAccountId as a, resolveMatrixChannelConfig as i, requiresExplicitMatrixDefaultAccount as n, isRecord as o, resolveConfiguredMatrixAccountIds as r, resolveMatrixAccountStringValues as s, findMatrixAccountEntry as t };

package/dist/.setup/approval-handler.runtime-CEXm9_-p.mjs

@@ -0,0 +1,378 @@
+import { g as resolveMatrixAccount } from "./setup-core-bhdcEo7v.mjs";
+import { _ as shouldHandleMatrixApprovalRequest, g as isMatrixAnyApprovalClientEnabled } from "./channel-an4umty1.mjs";
+import { a as resolveMatrixTargetIdentity } from "./target-ids-B-5aQxwn.mjs";
+import { a as sendMessageMatrix, i as reactMatrixMessage, p as repairMatrixDirectRooms, s as sendSingleTextMessageMatrix } from "./send-CGgl0uTn.mjs";
+import { a as unregisterMatrixApprovalReactionTarget, n as listMatrixApprovalReactionBindings, r as registerMatrixApprovalReactionTarget, t as buildMatrixApprovalReactionHint } from "./approval-reactions-Cltyp8nL.mjs";
+import { n as editMatrixMessage, t as deleteMatrixMessage } from "./messages-D4DYGHYX.mjs";
+import { listMessageReceiptPlatformIds, resolveMessageReceiptPrimaryId } from "openclaw/plugin-sdk/channel-outbound";
+import { normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { buildChannelApprovalNativeTargetKey } from "openclaw/plugin-sdk/approval-native-runtime";
+import { setTimeout } from "node:timers/promises";
+import { createChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-runtime";
+import { buildExecApprovalPendingReplyPayload, buildPluginApprovalPendingReplyPayload } from "openclaw/plugin-sdk/approval-reply-runtime";
+import { buildPluginApprovalResolvedReplyPayload } from "openclaw/plugin-sdk/approval-runtime";
+//#region extensions/matrix/src/approval-handler.runtime.ts
+const MATRIX_APPROVAL_METADATA_KEY = "com.openclaw.approval";
+const MATRIX_APPROVAL_DELIVERY_ATTEMPTS = 3;
+const MATRIX_APPROVAL_DELIVERY_RETRY_DELAY_MS = 250;
+function resolveHandlerContext(params) {
+	const context = params.context;
+	const accountId = params.accountId?.trim() || "";
+	if (!context?.client || !accountId) return null;
+	return {
+		accountId,
+		context
+	};
+}
+function normalizePendingMessageIds(entry) {
+	return normalizeUniqueStringEntries(entry.platformMessageIds);
+}
+function normalizeReactionTargetRef(params) {
+	const roomId = params.roomId.trim();
+	const eventId = params.eventId.trim();
+	if (!roomId || !eventId) return null;
+	return {
+		roomId,
+		eventId
+	};
+}
+function normalizeThreadId(value) {
+	return (value == null ? "" : String(value).trim()) || void 0;
+}
+function isSingleMatrixMessageLimitError(error) {
+	return error instanceof Error && error.message.includes("Matrix single-message text exceeds limit");
+}
+async function retryMatrixApprovalDelivery(operation, params = {}) {
+	let lastError;
+	for (let attempt = 1; attempt <= MATRIX_APPROVAL_DELIVERY_ATTEMPTS; attempt += 1) try {
+		return await operation();
+	} catch (error) {
+		lastError = error;
+		if (attempt === MATRIX_APPROVAL_DELIVERY_ATTEMPTS || params.shouldRetry?.(error) === false) break;
+		await setTimeout(MATRIX_APPROVAL_DELIVERY_RETRY_DELAY_MS * attempt);
+	}
+	throw lastError;
+}
+async function prepareTarget(params) {
+	const resolved = resolveHandlerContext(params);
+	if (!resolved) return null;
+	const target = resolveMatrixTargetIdentity(params.rawTarget.to);
+	if (!target) return null;
+	const threadId = normalizeThreadId(params.rawTarget.threadId);
+	if (target.kind === "user") {
+		const account = resolveMatrixAccount({
+			cfg: params.cfg,
+			accountId: resolved.accountId
+		});
+		const repairDirectRooms = resolved.context.deps?.repairDirectRooms ?? repairMatrixDirectRooms;
+		const repaired = await retryMatrixApprovalDelivery(async () => await repairDirectRooms({
+			client: resolved.context.client,
+			remoteUserId: target.id,
+			encrypted: account.config.encryption === true
+		}));
+		if (!repaired.activeRoomId) return null;
+		return {
+			to: `room:${repaired.activeRoomId}`,
+			roomId: repaired.activeRoomId,
+			threadId
+		};
+	}
+	return {
+		to: `room:${target.id}`,
+		roomId: target.id,
+		threadId
+	};
+}
+function buildMatrixApprovalMetadata(params) {
+	const base = {
+		version: 1,
+		type: "approval.request",
+		id: params.view.approvalId,
+		state: "pending",
+		kind: params.view.approvalKind,
+		phase: params.view.phase,
+		title: params.view.title,
+		expiresAtMs: params.view.expiresAtMs,
+		metadata: params.view.metadata,
+		allowedDecisions: Array.from(params.allowedDecisions),
+		actions: params.view.actions.map((action) => ({
+			decision: action.decision,
+			label: action.label,
+			style: action.style,
+			command: action.command
+		})),
+		...params.view.description != null ? { description: params.view.description } : {}
+	};
+	if (params.view.approvalKind === "plugin") return {
+		...base,
+		kind: "plugin",
+		severity: params.view.severity,
+		...params.view.agentId != null ? { agentId: params.view.agentId } : {},
+		...params.view.pluginId != null ? { pluginId: params.view.pluginId } : {},
+		...params.view.toolName != null ? { toolName: params.view.toolName } : {}
+	};
+	return {
+		...base,
+		kind: "exec",
+		commandText: params.view.commandText,
+		...params.view.ask != null ? { ask: params.view.ask } : {},
+		...params.view.agentId != null ? { agentId: params.view.agentId } : {},
+		...params.view.commandPreview != null ? { commandPreview: params.view.commandPreview } : {},
+		...params.view.cwd != null ? { cwd: params.view.cwd } : {},
+		...params.view.envKeys != null ? { envKeys: params.view.envKeys } : {},
+		...params.view.host != null ? { host: params.view.host } : {},
+		...params.view.nodeId != null ? { nodeId: params.view.nodeId } : {},
+		...params.view.sessionKey != null ? { sessionKey: params.view.sessionKey } : {}
+	};
+}
+function buildPendingApprovalContent(params) {
+	const allowedDecisions = params.view.actions.map((action) => action.decision);
+	const payload = params.view.approvalKind === "plugin" ? buildPluginApprovalPendingReplyPayload({
+		request: {
+			id: params.view.approvalId,
+			request: {
+				title: params.view.title,
+				description: params.view.description ?? "",
+				severity: params.view.severity,
+				toolName: params.view.toolName ?? void 0,
+				pluginId: params.view.pluginId ?? void 0,
+				agentId: params.view.agentId ?? void 0
+			},
+			createdAtMs: 0,
+			expiresAtMs: params.view.expiresAtMs
+		},
+		nowMs: params.nowMs,
+		allowedDecisions
+	}) : buildExecApprovalPendingReplyPayload({
+		approvalId: params.view.approvalId,
+		approvalSlug: params.view.approvalId.slice(0, 8),
+		approvalCommandId: params.view.approvalId,
+		ask: params.view.ask ?? void 0,
+		agentId: params.view.agentId ?? void 0,
+		allowedDecisions,
+		command: params.view.commandText,
+		cwd: params.view.cwd ?? void 0,
+		host: params.view.host === "node" ? "node" : "gateway",
+		nodeId: params.view.nodeId ?? void 0,
+		sessionKey: params.view.sessionKey ?? void 0,
+		expiresAtMs: params.view.expiresAtMs,
+		nowMs: params.nowMs
+	});
+	const hint = buildMatrixApprovalReactionHint(allowedDecisions);
+	const text = payload.text ?? "";
+	return {
+		approvalId: params.view.approvalId,
+		text: hint ? text ? `${hint}\n\n${text}` : hint : text,
+		allowedDecisions,
+		extraContent: { [MATRIX_APPROVAL_METADATA_KEY]: buildMatrixApprovalMetadata({
+			view: params.view,
+			allowedDecisions
+		}) }
+	};
+}
+function buildResolvedApprovalText(view) {
+	if (view.approvalKind === "plugin") return buildPluginApprovalResolvedReplyPayload({ resolved: {
+		id: view.approvalId,
+		decision: view.decision,
+		resolvedBy: view.resolvedBy ?? void 0,
+		ts: 0
+	} }).text ?? "";
+	return [
+		`Exec approval: ${view.decision === "allow-once" ? "Allowed once" : view.decision === "allow-always" ? "Allowed always" : "Denied"}`,
+		"",
+		"Command",
+		buildMarkdownCodeBlock(view.commandText)
+	].join("\n");
+}
+function buildMarkdownCodeBlock(text) {
+	const longestFence = Math.max(...Array.from(text.matchAll(/`+/g), (match) => match[0].length), 0);
+	const fence = "`".repeat(Math.max(3, longestFence + 1));
+	return [
+		fence,
+		text,
+		fence
+	].join("\n");
+}
+const matrixApprovalNativeRuntime = createChannelApprovalNativeRuntimeAdapter({
+	eventKinds: ["exec", "plugin"],
+	availability: {
+		isConfigured: ({ cfg, accountId, context }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return false;
+			return isMatrixAnyApprovalClientEnabled({
+				cfg,
+				accountId: resolved.accountId
+			});
+		},
+		shouldHandle: ({ cfg, accountId, request, context }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return false;
+			return shouldHandleMatrixApprovalRequest({
+				cfg,
+				accountId: resolved.accountId,
+				request
+			});
+		}
+	},
+	presentation: {
+		buildPendingPayload: ({ view, nowMs }) => buildPendingApprovalContent({
+			view,
+			nowMs
+		}),
+		buildResolvedResult: ({ view }) => ({
+			kind: "update",
+			payload: buildResolvedApprovalText(view)
+		}),
+		buildExpiredResult: () => ({ kind: "delete" })
+	},
+	transport: {
+		prepareTarget: ({ cfg, accountId, context, plannedTarget }) => {
+			return prepareTarget({
+				cfg,
+				accountId,
+				context,
+				rawTarget: plannedTarget.target
+			}).then((preparedTarget) => preparedTarget ? {
+				dedupeKey: buildChannelApprovalNativeTargetKey({
+					to: preparedTarget.roomId,
+					threadId: preparedTarget.threadId
+				}),
+				target: preparedTarget
+			} : null);
+		},
+		deliverPending: async ({ cfg, accountId, context, preparedTarget, pendingPayload, view }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return null;
+			const sendSingleTextMessage = resolved.context.deps?.sendSingleTextMessage ?? sendSingleTextMessageMatrix;
+			const reactMessage = resolved.context.deps?.reactMessage ?? reactMatrixMessage;
+			let result;
+			try {
+				result = await retryMatrixApprovalDelivery(async () => await sendSingleTextMessage(preparedTarget.to, pendingPayload.text, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client,
+					threadId: preparedTarget.threadId,
+					extraContent: pendingPayload.extraContent
+				}), { shouldRetry: (error) => !isSingleMatrixMessageLimitError(error) });
+			} catch (error) {
+				if (!isSingleMatrixMessageLimitError(error)) throw error;
+				const sendMessage = resolved.context.deps?.sendMessage ?? sendMessageMatrix;
+				result = await retryMatrixApprovalDelivery(async () => await sendMessage(preparedTarget.to, pendingPayload.text, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client,
+					threadId: preparedTarget.threadId,
+					extraContent: pendingPayload.extraContent
+				}));
+			}
+			const receiptMessageIds = listMessageReceiptPlatformIds(result.receipt);
+			const platformMessageIds = receiptMessageIds.length ? receiptMessageIds : [result.messageId.trim()].filter(Boolean);
+			const reactionEventId = resolveMessageReceiptPrimaryId(result.receipt) || result.primaryMessageId?.trim() || platformMessageIds[0] || result.messageId.trim();
+			registerMatrixApprovalReactionTarget({
+				roomId: result.roomId,
+				eventId: reactionEventId,
+				approvalId: pendingPayload.approvalId,
+				allowedDecisions: pendingPayload.allowedDecisions,
+				ttlMs: view.expiresAtMs - Date.now()
+			});
+			await Promise.allSettled(listMatrixApprovalReactionBindings(pendingPayload.allowedDecisions).map(async ({ emoji }) => {
+				await reactMessage(result.roomId, reactionEventId, emoji, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client
+				});
+			}));
+			return {
+				roomId: result.roomId,
+				platformMessageIds,
+				reactionEventId
+			};
+		},
+		updateEntry: async ({ cfg, accountId, context, entry, payload }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return;
+			const editMessage = resolved.context.deps?.editMessage ?? editMatrixMessage;
+			const deleteMessage = resolved.context.deps?.deleteMessage ?? deleteMatrixMessage;
+			const [primaryMessageId, ...staleMessageIds] = normalizePendingMessageIds(entry);
+			if (!primaryMessageId) return;
+			const text = payload;
+			await Promise.allSettled([editMessage(entry.roomId, primaryMessageId, text, {
+				cfg,
+				accountId: resolved.accountId,
+				client: resolved.context.client
+			}), ...staleMessageIds.map(async (messageId) => {
+				await deleteMessage(entry.roomId, messageId, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client,
+					reason: "approval resolved"
+				});
+			})]);
+		},
+		deleteEntry: async ({ cfg, accountId, context, entry, phase }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return;
+			const deleteMessage = resolved.context.deps?.deleteMessage ?? deleteMatrixMessage;
+			await Promise.allSettled(normalizePendingMessageIds(entry).map(async (messageId) => {
+				await deleteMessage(entry.roomId, messageId, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client,
+					reason: phase === "expired" ? "approval expired" : "approval resolved"
+				});
+			}));
+		}
+	},
+	interactions: {
+		bindPending: (params) => {
+			const target = normalizeReactionTargetRef({
+				roomId: params.entry.roomId,
+				eventId: params.entry.reactionEventId
+			});
+			if (!target) return null;
+			registerMatrixApprovalReactionTarget({
+				roomId: target.roomId,
+				eventId: target.eventId,
+				approvalId: params.pendingPayload.approvalId,
+				allowedDecisions: params.pendingPayload.allowedDecisions,
+				ttlMs: params.view.expiresAtMs - Date.now()
+			});
+			return target;
+		},
+		unbindPending: (params) => {
+			const target = normalizeReactionTargetRef(params.binding);
+			if (!target) return;
+			unregisterMatrixApprovalReactionTarget(target);
+		},
+		cancelDelivered: (params) => {
+			const target = normalizeReactionTargetRef({
+				roomId: params.entry.roomId,
+				eventId: params.entry.reactionEventId
+			});
+			if (!target) return;
+			unregisterMatrixApprovalReactionTarget(target);
+		}
+	}
+});
+//#endregion
+export { matrixApprovalNativeRuntime };

package/dist/.setup/approval-ids-DdFnDB3h.mjs

@@ -0,0 +1,7 @@
+import { a as normalizeMatrixUserId } from "./config-schema-D9J_vUF6.mjs";
+//#region extensions/matrix/src/approval-ids.ts
+function normalizeMatrixApproverId(value) {
+	return normalizeMatrixUserId(String(value)) || void 0;
+}
+//#endregion
+export { normalizeMatrixApproverId as t };

package/dist/.setup/approval-reaction-auth-CREvd7S7.mjs

@@ -0,0 +1,27 @@
+import { g as resolveMatrixAccount } from "./setup-core-bhdcEo7v.mjs";
+import { t as normalizeMatrixApproverId } from "./approval-ids-DdFnDB3h.mjs";
+import { resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
+//#region extensions/matrix/src/approval-reaction-auth.ts
+function normalizeMatrixExecApproverId(value) {
+	const normalized = normalizeMatrixApproverId(value);
+	return normalized === "*" ? void 0 : normalized;
+}
+function getMatrixApprovalReactionApprovers(params) {
+	const account = resolveMatrixAccount(params).config;
+	if (params.approvalKind === "plugin") return resolveApprovalApprovers({
+		allowFrom: account.dm?.allowFrom,
+		normalizeApprover: normalizeMatrixApproverId
+	});
+	return resolveApprovalApprovers({
+		explicit: account.execApprovals?.approvers,
+		allowFrom: account.dm?.allowFrom,
+		normalizeApprover: normalizeMatrixExecApproverId
+	});
+}
+function isMatrixApprovalReactionAuthorizedSender(params) {
+	const normalizedSenderId = params.senderId ? normalizeMatrixApproverId(params.senderId) : void 0;
+	if (!normalizedSenderId) return false;
+	return getMatrixApprovalReactionApprovers(params).includes(normalizedSenderId);
+}
+//#endregion
+export { isMatrixApprovalReactionAuthorizedSender };

package/dist/.setup/approval-reactions-Cltyp8nL.mjs

@@ -0,0 +1,113 @@
+import { n as getOptionalMatrixRuntime } from "./runtime-6S3DNFNv.mjs";
+import { createApprovalReactionTargetStore } from "openclaw/plugin-sdk/approval-reaction-runtime";
+//#region extensions/matrix/src/approval-reactions.ts
+const MATRIX_APPROVAL_REACTION_META = {
+	"allow-once": {
+		emoji: "✅",
+		label: "Allow once"
+	},
+	"allow-always": {
+		emoji: "♾️",
+		label: "Allow always"
+	},
+	deny: {
+		emoji: "❌",
+		label: "Deny"
+	}
+};
+const MATRIX_APPROVAL_REACTION_ORDER = [
+	"allow-once",
+	"allow-always",
+	"deny"
+];
+const PERSISTENT_NAMESPACE = "matrix.approval-reactions";
+const PERSISTENT_MAX_ENTRIES = 1e3;
+const DEFAULT_REACTION_TARGET_TTL_MS = 864e5;
+function reportPersistentApprovalReactionError(error) {
+	try {
+		getOptionalMatrixRuntime()?.logging.getChildLogger({
+			plugin: "matrix",
+			feature: "approval-reaction-state"
+		}).warn("Matrix persistent approval reaction state failed", { error: String(error) });
+	} catch {}
+}
+function readPersistedTarget(target) {
+	const value = target;
+	if (!value || typeof value.approvalId !== "string" || !Array.isArray(value.allowedDecisions)) return null;
+	return {
+		approvalId: value.approvalId,
+		allowedDecisions: value.allowedDecisions
+	};
+}
+const matrixApprovalReactionTargets = createApprovalReactionTargetStore({
+	namespace: PERSISTENT_NAMESPACE,
+	maxEntries: PERSISTENT_MAX_ENTRIES,
+	defaultTtlMs: DEFAULT_REACTION_TARGET_TTL_MS,
+	openStore: (storeParams) => getOptionalMatrixRuntime()?.state.openKeyedStore(storeParams),
+	logPersistentError: reportPersistentApprovalReactionError,
+	readPersistedTarget
+});
+function buildReactionTargetKey(roomId, eventId) {
+	const normalizedRoomId = roomId.trim();
+	const normalizedEventId = eventId.trim();
+	if (!normalizedRoomId || !normalizedEventId) return null;
+	return `${normalizedRoomId}:${normalizedEventId}`;
+}
+function listMatrixApprovalReactionBindings(allowedDecisions) {
+	const allowed = new Set(allowedDecisions);
+	return MATRIX_APPROVAL_REACTION_ORDER.filter((decision) => allowed.has(decision)).map((decision) => ({
+		decision,
+		emoji: MATRIX_APPROVAL_REACTION_META[decision].emoji,
+		label: MATRIX_APPROVAL_REACTION_META[decision].label
+	}));
+}
+function buildMatrixApprovalReactionHint(allowedDecisions) {
+	const bindings = listMatrixApprovalReactionBindings(allowedDecisions);
+	if (bindings.length === 0) return null;
+	return `React here: ${bindings.map((binding) => `${binding.emoji} ${binding.label}`).join(", ")}`;
+}
+function resolveMatrixApprovalReactionDecision(reactionKey, allowedDecisions) {
+	const normalizedReaction = reactionKey.trim();
+	if (!normalizedReaction) return null;
+	const allowed = new Set(allowedDecisions);
+	for (const decision of MATRIX_APPROVAL_REACTION_ORDER) {
+		if (!allowed.has(decision)) continue;
+		if (MATRIX_APPROVAL_REACTION_META[decision].emoji === normalizedReaction) return decision;
+	}
+	return null;
+}
+function registerMatrixApprovalReactionTarget(params) {
+	const key = buildReactionTargetKey(params.roomId, params.eventId);
+	const approvalId = params.approvalId.trim();
+	const allowedDecisions = Array.from(new Set(params.allowedDecisions.filter((decision) => decision === "allow-once" || decision === "allow-always" || decision === "deny")));
+	if (!key || !approvalId || allowedDecisions.length === 0) return;
+	matrixApprovalReactionTargets.register(key, {
+		approvalId,
+		allowedDecisions
+	}, { ttlMs: params.ttlMs });
+}
+function unregisterMatrixApprovalReactionTarget(params) {
+	const key = buildReactionTargetKey(params.roomId, params.eventId);
+	if (!key) return;
+	matrixApprovalReactionTargets.delete(key);
+}
+function resolveTarget(params) {
+	const target = params.target;
+	if (!target) return null;
+	const decision = resolveMatrixApprovalReactionDecision(params.reactionKey, target.allowedDecisions);
+	if (!decision) return null;
+	return {
+		approvalId: target.approvalId,
+		decision
+	};
+}
+async function resolveMatrixApprovalReactionTargetWithPersistence(params) {
+	const key = buildReactionTargetKey(params.roomId, params.eventId);
+	if (!key) return null;
+	return resolveTarget({
+		target: await matrixApprovalReactionTargets.lookup(key),
+		reactionKey: params.reactionKey
+	});
+}
+//#endregion
+export { unregisterMatrixApprovalReactionTarget as a, resolveMatrixApprovalReactionTargetWithPersistence as i, listMatrixApprovalReactionBindings as n, registerMatrixApprovalReactionTarget as r, buildMatrixApprovalReactionHint as t };