@openclaw/matrix 2026.7.2-beta.7 → 2026.7.34

package/dist/{deps-CcVJfvRM.js → .setup/deps-Dy6yreL4.mjs}

@@ -1,8 +1,8 @@
 import { createRequire } from "node:module";
+import fs from "node:fs";
 import path from "node:path";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import fs from "node:fs";
-import { runCommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
+import { spawn } from "node:child_process";
 //#region extensions/matrix/src/matrix/deps.ts
 const REQUIRED_MATRIX_PACKAGES = [
 	"matrix-js-sdk",
@@ -10,7 +10,8 @@ const REQUIRED_MATRIX_PACKAGES = [
 	"@matrix-org/matrix-sdk-crypto-wasm"
 ];
 const MIN_MATRIX_CRYPTO_NATIVE_BINDING_BYTES = 1e6;
-const MATRIX_COMMAND_OUTPUT_TAIL_BYTES = 64 * 1024;
+const MATRIX_COMMAND_OUTPUT_TAIL_BYTES = 65536;
+const MATRIX_STREAM_ERROR_KILL_GRACE_MS = 1e3;
 function resolveMissingMatrixPackages(resolveFn) {
 	const resolve = resolveFn ?? defaultResolveFn;
 	return REQUIRED_MATRIX_PACKAGES.filter((pkg) => {
@@ -29,33 +30,99 @@ function buildMatrixDepsMissingMessage(missing) {
 	return [`Matrix plugin dependencies are missing: ${missing.join(", ")}.`, "Repair this plugin with `openclaw plugins update matrix` or run `openclaw doctor --fix`."].join(" ");
 }
 let defaultMatrixCryptoRuntimeEnsurePromise = null;
+function appendBoundedOutputTail(current, chunk) {
+	const chunkBuffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+	if (chunkBuffer.byteLength >= 65536) return chunkBuffer.subarray(chunkBuffer.byteLength - MATRIX_COMMAND_OUTPUT_TAIL_BYTES).toString("utf8");
+	const currentBuffer = Buffer.from(current);
+	if (currentBuffer.byteLength + chunkBuffer.byteLength <= 65536) return `${current}${chunkBuffer.toString("utf8")}`;
+	const currentTailBytes = MATRIX_COMMAND_OUTPUT_TAIL_BYTES - chunkBuffer.byteLength;
+	const currentTail = currentBuffer.subarray(currentBuffer.byteLength - currentTailBytes);
+	return Buffer.concat([currentTail, chunkBuffer], MATRIX_COMMAND_OUTPUT_TAIL_BYTES).toString("utf8");
+}
 async function runFixedCommandWithTimeout(params) {
-	if (!params.argv[0]) return {
-		code: 1,
-		stdout: "",
-		stderr: "command is required"
-	};
-	try {
-		const result = await runCommandWithTimeout(params.argv, {
+	return await new Promise((resolve) => {
+		const [command, ...args] = params.argv;
+		if (!command) {
+			resolve({
+				code: 1,
+				stdout: "",
+				stderr: "command is required"
+			});
+			return;
+		}
+		const proc = spawn(command, args, {
 			cwd: params.cwd,
-			env: params.env,
-			killProcessTree: true,
-			maxOutputBytes: MATRIX_COMMAND_OUTPUT_TAIL_BYTES,
-			outputCapture: "tail",
-			timeoutMs: params.timeoutMs
+			env: {
+				...process.env,
+				...params.env
+			},
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
 		});
-		return {
-			code: result.termination === "timeout" ? 124 : result.code ?? 1,
-			stdout: result.stdout,
-			stderr: result.stderr || (result.termination === "timeout" ? `command timed out after ${params.timeoutMs}ms` : "")
+		let stdout = "";
+		let stderr = "";
+		let settled = false;
+		let timer = null;
+		let streamKillTimer = null;
+		let streamErrorMessage = null;
+		const killChildOnExit = () => {
+			if (!settled && proc.exitCode === null) proc.kill("SIGTERM");
 		};
-	} catch (error) {
-		return {
-			code: 1,
-			stdout: "",
-			stderr: error instanceof Error ? error.message : String(error)
+		const finalize = (result) => {
+			if (settled) return;
+			settled = true;
+			if (timer) clearTimeout(timer);
+			if (streamKillTimer) clearTimeout(streamKillTimer);
+			process.off("exit", killChildOnExit);
+			resolve(result);
 		};
-	}
+		process.once("exit", killChildOnExit);
+		proc.stdout?.on("data", (chunk) => {
+			stdout = appendBoundedOutputTail(stdout, chunk);
+		});
+		proc.stderr?.on("data", (chunk) => {
+			stderr = appendBoundedOutputTail(stderr, chunk);
+		});
+		const failReadableStream = (streamName) => (error) => {
+			if (settled || streamErrorMessage) return;
+			streamErrorMessage = `${streamName} stream failed: ${formatErrorMessage(error)}`;
+			if (proc.exitCode === null) proc.kill("SIGTERM");
+			streamKillTimer = setTimeout(() => {
+				if (!settled && proc.exitCode === null) proc.kill("SIGKILL");
+			}, MATRIX_STREAM_ERROR_KILL_GRACE_MS);
+			streamKillTimer.unref?.();
+		};
+		proc.stdout?.on("error", failReadableStream("stdout"));
+		proc.stderr?.on("error", failReadableStream("stderr"));
+		timer = setTimeout(() => {
+			proc.kill("SIGKILL");
+			if (streamErrorMessage) return;
+			finalize({
+				code: 124,
+				stdout,
+				stderr: stderr || `command timed out after ${params.timeoutMs}ms`
+			});
+		}, params.timeoutMs);
+		proc.on("error", (err) => {
+			if (streamErrorMessage) return;
+			finalize({
+				code: 1,
+				stdout,
+				stderr: err.message
+			});
+		});
+		proc.on("close", (code) => {
+			const streamErrorStderr = streamErrorMessage ? stderr ? appendBoundedOutputTail(stderr, `\n${streamErrorMessage}`) : streamErrorMessage : stderr;
+			finalize({
+				code: streamErrorMessage ? 1 : code ?? 1,
+				stdout,
+				stderr: streamErrorStderr
+			});
+		});
+	});
 }
 function defaultRequireFn(id) {
 	return createRequire(import.meta.url)(id);

package/dist/{device-health-B4-YXtJR.js → .setup/device-health-D4LBxuPq.mjs}

@@ -1,9 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 //#region extensions/matrix/src/matrix/device-health.ts
-var device_health_exports = /* @__PURE__ */ __exportAll({
-	isOpenClawManagedMatrixDevice: () => isOpenClawManagedMatrixDevice,
-	summarizeMatrixDeviceHealth: () => summarizeMatrixDeviceHealth
-});
 const OPENCLAW_DEVICE_NAME_PREFIX = "OpenClaw ";
 function isOpenClawManagedMatrixDevice(displayName) {
 	return displayName?.startsWith(OPENCLAW_DEVICE_NAME_PREFIX) === true;
@@ -18,4 +13,4 @@ function summarizeMatrixDeviceHealth(devices) {
 	};
 }
 //#endregion
-export { isOpenClawManagedMatrixDevice as n, summarizeMatrixDeviceHealth as r, device_health_exports as t };
+export { isOpenClawManagedMatrixDevice, summarizeMatrixDeviceHealth };

package/dist/{directory-live-C8dVBiCc.js → .setup/directory-live-BTEYxMwy.mjs}

@@ -1,8 +1,7 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as normalizeMatrixMessagingTarget, t as isMatrixQualifiedUserId } from "./target-ids-B-5aQxwn.js";
-import { f as resolveMatrixAuth } from "./shared-CUMWxcMz.js";
-import "./client-Dbso3-0V.js";
-import { t as MatrixAuthedHttpClient } from "./http-client-CycYxU9-.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { n as normalizeMatrixMessagingTarget, t as isMatrixQualifiedUserId } from "./target-ids-B-5aQxwn.mjs";
+import { l as resolveMatrixAuth } from "./client-DFBQtzCe.mjs";
+import { t as MatrixAuthedHttpClient } from "./http-client-C954In2D.mjs";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/matrix/src/directory-live.ts
 var directory_live_exports = /* @__PURE__ */ __exportAll({
@@ -86,20 +85,22 @@ async function listMatrixDirectoryPeersLive(params) {
 }
 async function resolveMatrixRoomAlias(client, alias) {
 	try {
-		return normalizeOptionalString((await requestMatrixJson(client, {
+		const res = await requestMatrixJson(client, {
 			method: "GET",
 			endpoint: `/_matrix/client/v3/directory/room/${encodeURIComponent(alias)}`
-		})).room_id) ?? null;
+		});
+		return normalizeOptionalString(res.room_id) ?? null;
 	} catch {
 		return null;
 	}
 }
 async function fetchMatrixRoomName(client, roomId) {
 	try {
-		return normalizeOptionalString((await requestMatrixJson(client, {
+		const res = await requestMatrixJson(client, {
 			method: "GET",
 			endpoint: `/_matrix/client/v3/rooms/${encodeURIComponent(roomId)}/state/m.room.name`
-		})).name) ?? null;
+		});
+		return normalizeOptionalString(res.name) ?? null;
 	} catch {
 		return null;
 	}

package/dist/.setup/doctor-BGnvMzOR.mjs

@@ -0,0 +1,169 @@
+import { o as isRecord } from "./account-selection-BOQeTqax.mjs";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-DNJw0fdq.mjs";
+import { i as autoPrepareLegacyMatrixCrypto, o as autoMigrateLegacyMatrixState, r as resolveMatrixMigrationStatus } from "./matrix-migration.runtime-BDH5c3fN.mjs";
+import { t as maybeCreateMatrixMigrationSnapshot } from "./migration-snapshot-backup-CpgYhiUp.mjs";
+import { detectPluginInstallPathIssue, formatPluginInstallPathIssue, removePluginFromConfig } from "openclaw/plugin-sdk/runtime-doctor";
+//#region extensions/matrix/src/doctor.ts
+function hasConfiguredMatrixChannel(cfg) {
+	const channels = cfg.channels;
+	return isRecord(channels?.matrix);
+}
+function hasConfiguredMatrixPluginSurface(cfg) {
+	return Boolean(cfg.plugins?.installs?.matrix || cfg.plugins?.entries?.matrix || cfg.plugins?.allow?.includes("matrix") || cfg.plugins?.deny?.includes("matrix"));
+}
+function hasConfiguredMatrixEnv(env) {
+	return Object.entries(env).some(([key, value]) => key.startsWith("MATRIX_") && typeof value === "string" && value.trim());
+}
+function configMayNeedMatrixDoctorSequence(cfg, env) {
+	return hasConfiguredMatrixChannel(cfg) || hasConfiguredMatrixPluginSurface(cfg) || hasConfiguredMatrixEnv(env);
+}
+function formatMatrixLegacyStatePreview(detection) {
+	return [
+		"- Matrix plugin upgraded in place.",
+		`- Legacy sync store: ${detection.legacyStoragePath} -> ${detection.targetStoragePath}`,
+		`- Legacy crypto store: ${detection.legacyCryptoPath} -> ${detection.targetCryptoPath}`,
+		...detection.selectionNote ? [`- ${detection.selectionNote}`] : [],
+		"- Run \"openclaw doctor --fix\" to migrate this Matrix state now."
+	].join("\n");
+}
+function formatMatrixLegacyCryptoPreview(detection) {
+	const notes = [];
+	for (const warning of detection.warnings) notes.push(`- ${warning}`);
+	for (const plan of detection.plans) notes.push([
+		`- Matrix encrypted-state migration is pending for account "${plan.accountId}".`,
+		`- Legacy crypto store: ${plan.legacyCryptoPath}`,
+		`- Recovery key state: Matrix SQLite state (imports ${plan.recoveryKeyPath} if present)`,
+		`- Migration state: Matrix SQLite state (imports ${plan.statePath} if present)`,
+		"- Run \"openclaw doctor --fix\" to extract any saved backup key now. Backed-up room keys will restore automatically on next gateway start."
+	].join("\n"));
+	return notes;
+}
+async function collectMatrixInstallPathWarnings(cfg) {
+	const issue = await detectPluginInstallPathIssue({
+		pluginId: "matrix",
+		install: cfg.plugins?.installs?.matrix
+	});
+	if (!issue) return [];
+	return formatPluginInstallPathIssue({
+		issue,
+		pluginLabel: "Matrix",
+		defaultInstallCommand: "openclaw plugins install @openclaw/matrix"
+	}).map((entry) => `- ${entry}`);
+}
+async function cleanStaleMatrixPluginConfig(cfg) {
+	const issue = await detectPluginInstallPathIssue({
+		pluginId: "matrix",
+		install: cfg.plugins?.installs?.matrix
+	});
+	if (!issue || issue.kind !== "missing-path") return {
+		config: cfg,
+		changes: []
+	};
+	const { config, actions } = removePluginFromConfig(cfg, "matrix");
+	const removed = [];
+	if (actions.install) removed.push("install record");
+	if (actions.loadPath) removed.push("load path");
+	if (actions.entry) removed.push("plugin entry");
+	if (actions.allowlist) removed.push("allowlist entry");
+	if (removed.length === 0) return {
+		config: cfg,
+		changes: []
+	};
+	return {
+		config,
+		changes: [`Removed stale Matrix plugin references (${removed.join(", ")}). The previous install path no longer exists: ${issue.path}`]
+	};
+}
+async function applyMatrixDoctorRepair(params) {
+	const changes = [];
+	const warnings = [];
+	const migrationStatus = resolveMatrixMigrationStatus({
+		cfg: params.cfg,
+		env: params.env
+	});
+	let matrixSnapshotReady = true;
+	if (migrationStatus.actionable) try {
+		const snapshot = await maybeCreateMatrixMigrationSnapshot({
+			trigger: "doctor-fix",
+			env: params.env
+		});
+		changes.push(`Matrix migration snapshot ${snapshot.created ? "created" : "reused"} before applying Matrix upgrades.\n- ${snapshot.archivePath}`);
+	} catch (error) {
+		matrixSnapshotReady = false;
+		warnings.push(`- Failed creating a Matrix migration snapshot before repair: ${String(error)}`);
+		warnings.push("- Skipping Matrix migration changes for now. Resolve the snapshot failure, then rerun \"openclaw doctor --fix\".");
+	}
+	else if (migrationStatus.pending) warnings.push("- Matrix migration warnings are present, but no on-disk Matrix mutation is actionable yet. No pre-migration snapshot was needed.");
+	if (!matrixSnapshotReady) return {
+		changes,
+		warnings
+	};
+	const matrixStateRepair = await autoMigrateLegacyMatrixState({
+		cfg: params.cfg,
+		env: params.env
+	});
+	if (matrixStateRepair.changes.length > 0) changes.push([
+		"Matrix plugin upgraded in place.",
+		...matrixStateRepair.changes.map((entry) => `- ${entry}`),
+		"- No user action required."
+	].join("\n"));
+	if (matrixStateRepair.warnings.length > 0) warnings.push(matrixStateRepair.warnings.map((entry) => `- ${entry}`).join("\n"));
+	const matrixCryptoRepair = await autoPrepareLegacyMatrixCrypto({
+		cfg: params.cfg,
+		env: params.env
+	});
+	if (matrixCryptoRepair.changes.length > 0) changes.push(["Matrix encrypted-state migration prepared.", ...matrixCryptoRepair.changes.map((entry) => `- ${entry}`)].join("\n"));
+	if (matrixCryptoRepair.warnings.length > 0) warnings.push(matrixCryptoRepair.warnings.map((entry) => `- ${entry}`).join("\n"));
+	return {
+		changes,
+		warnings
+	};
+}
+async function runMatrixDoctorSequence(params) {
+	const warningNotes = [];
+	const changeNotes = [];
+	const installWarnings = await collectMatrixInstallPathWarnings(params.cfg);
+	if (installWarnings.length > 0) warningNotes.push(installWarnings.join("\n"));
+	if (!configMayNeedMatrixDoctorSequence(params.cfg, params.env)) return {
+		changeNotes,
+		warningNotes
+	};
+	if (params.shouldRepair) {
+		const repair = await applyMatrixDoctorRepair({
+			cfg: params.cfg,
+			env: params.env
+		});
+		changeNotes.push(...repair.changes);
+		warningNotes.push(...repair.warnings);
+	} else {
+		const migrationStatus = resolveMatrixMigrationStatus({
+			cfg: params.cfg,
+			env: params.env
+		});
+		if (migrationStatus.legacyState) {
+			if ("warning" in migrationStatus.legacyState) warningNotes.push(`- ${migrationStatus.legacyState.warning}`);
+			else warningNotes.push(formatMatrixLegacyStatePreview(migrationStatus.legacyState));
+		}
+		if (migrationStatus.legacyCrypto.warnings.length > 0 || migrationStatus.legacyCrypto.plans.length > 0) warningNotes.push(...formatMatrixLegacyCryptoPreview(migrationStatus.legacyCrypto));
+	}
+	return {
+		changeNotes,
+		warningNotes
+	};
+}
+const matrixDoctor = {
+	dmAllowFromMode: "nestedOnly",
+	groupModel: "sender",
+	groupAllowFromFallbackToAllowFrom: false,
+	warnOnEmptyGroupSenderAllowlist: true,
+	legacyConfigRules,
+	normalizeCompatibilityConfig,
+	runConfigSequence: async ({ cfg, env, shouldRepair }) => await runMatrixDoctorSequence({
+		cfg,
+		env,
+		shouldRepair
+	}),
+	cleanStaleConfig: async ({ cfg }) => await cleanStaleMatrixPluginConfig(cfg)
+};
+//#endregion
+export { applyMatrixDoctorRepair, cleanStaleMatrixPluginConfig, collectMatrixInstallPathWarnings, formatMatrixLegacyCryptoPreview, formatMatrixLegacyStatePreview, matrixDoctor, runMatrixDoctorSequence };

package/dist/.setup/doctor-contract-DNJw0fdq.mjs

@@ -0,0 +1,246 @@
+import { o as isRecord } from "./account-selection-BOQeTqax.mjs";
+import { hasLegacyFlatAllowPrivateNetworkAlias, migrateLegacyFlatAllowPrivateNetworkAlias } from "openclaw/plugin-sdk/ssrf-runtime";
+//#region extensions/matrix/src/doctor-contract.ts
+function hasLegacyMatrixRoomAllowAlias(value) {
+	const room = isRecord(value) ? value : null;
+	return Boolean(room && typeof room.allow === "boolean");
+}
+function hasLegacyMatrixRoomMapAllowAliases(value) {
+	const rooms = isRecord(value) ? value : null;
+	return Boolean(rooms && Object.values(rooms).some((room) => hasLegacyMatrixRoomAllowAlias(room)));
+}
+function hasLegacyMatrixAccountRoomAllowAliases(value) {
+	const accounts = isRecord(value) ? value : null;
+	if (!accounts) return false;
+	return Object.values(accounts).some((account) => {
+		if (!isRecord(account)) return false;
+		return hasLegacyMatrixRoomMapAllowAliases(account.groups) || hasLegacyMatrixRoomMapAllowAliases(account.rooms);
+	});
+}
+function hasLegacyMatrixAccountPrivateNetworkAliases(value) {
+	const accounts = isRecord(value) ? value : null;
+	if (!accounts) return false;
+	return Object.values(accounts).some((account) => hasLegacyFlatAllowPrivateNetworkAlias(isRecord(account) ? account : {}));
+}
+function hasLegacyTrustedDmPolicy(value) {
+	const root = isRecord(value) ? value : null;
+	if (!root) return false;
+	return (isRecord(root.dm) ? root.dm : null)?.policy === "trusted";
+}
+function hasLegacyMatrixAccountTrustedDmPolicies(value) {
+	const accounts = isRecord(value) ? value : null;
+	if (!accounts) return false;
+	return Object.values(accounts).some((account) => hasLegacyTrustedDmPolicy(account));
+}
+function migrateLegacyTrustedDmPolicy(params) {
+	const dm = isRecord(params.entry.dm) ? params.entry.dm : null;
+	if (!dm || dm.policy !== "trusted") return {
+		entry: params.entry,
+		changed: false
+	};
+	const allowFromRaw = dm.allowFrom;
+	const allowFromEntries = Array.isArray(allowFromRaw) ? allowFromRaw.filter((entry) => typeof entry === "string" && entry.trim().length > 0).length : 0;
+	const nextPolicy = allowFromEntries > 0 ? "allowlist" : "pairing";
+	const nextDm = {
+		...dm,
+		policy: nextPolicy
+	};
+	params.changes.push(`Migrated ${params.pathPrefix}.dm.policy "trusted" → "${nextPolicy}" (legacy alias removed; ${allowFromEntries > 0 ? `preserved ${allowFromEntries} ${params.pathPrefix}.dm.allowFrom ${allowFromEntries === 1 ? "entry" : "entries"}` : "no allowFrom entries present, defaulting to pairing for safety"}).`);
+	return {
+		entry: {
+			...params.entry,
+			dm: nextDm
+		},
+		changed: true
+	};
+}
+function normalizeMatrixRoomAllowAliases(params) {
+	let changed = false;
+	const nextRooms = { ...params.rooms };
+	for (const [roomId, roomValue] of Object.entries(params.rooms)) {
+		const room = isRecord(roomValue) ? roomValue : null;
+		if (!room || typeof room.allow !== "boolean") continue;
+		const nextRoom = { ...room };
+		if (typeof nextRoom.enabled !== "boolean") nextRoom.enabled = room.allow;
+		delete nextRoom.allow;
+		nextRooms[roomId] = nextRoom;
+		changed = true;
+		params.changes.push(`Moved ${params.pathPrefix}.${roomId}.allow → ${params.pathPrefix}.${roomId}.enabled (${String(nextRoom.enabled)}).`);
+	}
+	return {
+		rooms: nextRooms,
+		changed
+	};
+}
+const legacyConfigRules = [
+	{
+		path: ["channels", "matrix"],
+		message: "channels.matrix.allowPrivateNetwork is legacy; use channels.matrix.network.dangerouslyAllowPrivateNetwork instead. Run \"openclaw doctor --fix\".",
+		match: (value) => hasLegacyFlatAllowPrivateNetworkAlias(isRecord(value) ? value : {})
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"accounts"
+		],
+		message: "channels.matrix.accounts.<id>.allowPrivateNetwork is legacy; use channels.matrix.accounts.<id>.network.dangerouslyAllowPrivateNetwork instead. Run \"openclaw doctor --fix\".",
+		match: hasLegacyMatrixAccountPrivateNetworkAliases
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"groups"
+		],
+		message: "channels.matrix.groups.<room>.allow is legacy; use channels.matrix.groups.<room>.enabled instead. Run \"openclaw doctor --fix\".",
+		match: hasLegacyMatrixRoomMapAllowAliases
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"rooms"
+		],
+		message: "channels.matrix.rooms.<room>.allow is legacy; use channels.matrix.rooms.<room>.enabled instead. Run \"openclaw doctor --fix\".",
+		match: hasLegacyMatrixRoomMapAllowAliases
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"accounts"
+		],
+		message: "channels.matrix.accounts.<id>.{groups,rooms}.<room>.allow is legacy; use channels.matrix.accounts.<id>.{groups,rooms}.<room>.enabled instead. Run \"openclaw doctor --fix\".",
+		match: hasLegacyMatrixAccountRoomAllowAliases
+	},
+	{
+		path: ["channels", "matrix"],
+		message: "channels.matrix.dm.policy \"trusted\" is legacy; use \"allowlist\" (with allowFrom entries) or \"pairing\" instead. Run \"openclaw doctor --fix\".",
+		match: hasLegacyTrustedDmPolicy
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"accounts"
+		],
+		message: "channels.matrix.accounts.<id>.dm.policy \"trusted\" is legacy; use \"allowlist\" (with allowFrom entries) or \"pairing\" instead. Run \"openclaw doctor --fix\".",
+		match: hasLegacyMatrixAccountTrustedDmPolicies
+	}
+];
+function normalizeCompatibilityConfig({ cfg }) {
+	const channels = isRecord(cfg.channels) ? cfg.channels : null;
+	const matrix = isRecord(channels?.matrix) ? channels.matrix : null;
+	if (!matrix) return {
+		config: cfg,
+		changes: []
+	};
+	const changes = [];
+	let updatedMatrix = matrix;
+	let changed = false;
+	const topLevelPrivateNetwork = migrateLegacyFlatAllowPrivateNetworkAlias({
+		entry: updatedMatrix,
+		pathPrefix: "channels.matrix",
+		changes
+	});
+	updatedMatrix = topLevelPrivateNetwork.entry;
+	changed = changed || topLevelPrivateNetwork.changed;
+	const topLevelTrustedDmPolicy = migrateLegacyTrustedDmPolicy({
+		entry: updatedMatrix,
+		pathPrefix: "channels.matrix",
+		changes
+	});
+	updatedMatrix = topLevelTrustedDmPolicy.entry;
+	changed = changed || topLevelTrustedDmPolicy.changed;
+	const normalizeTopLevelRoomScope = (key) => {
+		const rooms = isRecord(updatedMatrix[key]) ? updatedMatrix[key] : null;
+		if (!rooms) return;
+		const normalized = normalizeMatrixRoomAllowAliases({
+			rooms,
+			pathPrefix: `channels.matrix.${key}`,
+			changes
+		});
+		if (normalized.changed) {
+			updatedMatrix = {
+				...updatedMatrix,
+				[key]: normalized.rooms
+			};
+			changed = true;
+		}
+	};
+	normalizeTopLevelRoomScope("groups");
+	normalizeTopLevelRoomScope("rooms");
+	const accounts = isRecord(updatedMatrix.accounts) ? updatedMatrix.accounts : null;
+	if (accounts) {
+		let accountsChanged = false;
+		const nextAccounts = { ...accounts };
+		for (const [accountId, accountValue] of Object.entries(accounts)) {
+			const account = isRecord(accountValue) ? accountValue : null;
+			if (!account) continue;
+			let nextAccount = account;
+			let accountChanged = false;
+			const privateNetworkMigration = migrateLegacyFlatAllowPrivateNetworkAlias({
+				entry: nextAccount,
+				pathPrefix: `channels.matrix.accounts.${accountId}`,
+				changes
+			});
+			if (privateNetworkMigration.changed) {
+				nextAccount = privateNetworkMigration.entry;
+				accountChanged = true;
+			}
+			const accountTrustedDmPolicy = migrateLegacyTrustedDmPolicy({
+				entry: nextAccount,
+				pathPrefix: `channels.matrix.accounts.${accountId}`,
+				changes
+			});
+			if (accountTrustedDmPolicy.changed) {
+				nextAccount = accountTrustedDmPolicy.entry;
+				accountChanged = true;
+			}
+			for (const key of ["groups", "rooms"]) {
+				const rooms = isRecord(nextAccount[key]) ? nextAccount[key] : null;
+				if (!rooms) continue;
+				const normalized = normalizeMatrixRoomAllowAliases({
+					rooms,
+					pathPrefix: `channels.matrix.accounts.${accountId}.${key}`,
+					changes
+				});
+				if (normalized.changed) {
+					nextAccount = {
+						...nextAccount,
+						[key]: normalized.rooms
+					};
+					accountChanged = true;
+				}
+			}
+			if (accountChanged) {
+				nextAccounts[accountId] = nextAccount;
+				accountsChanged = true;
+			}
+		}
+		if (accountsChanged) {
+			updatedMatrix = {
+				...updatedMatrix,
+				accounts: nextAccounts
+			};
+			changed = true;
+		}
+	}
+	if (!changed) return {
+		config: cfg,
+		changes: []
+	};
+	return {
+		config: {
+			...cfg,
+			channels: {
+				...cfg.channels,
+				matrix: updatedMatrix
+			}
+		},
+		changes
+	};
+}
+//#endregion
+export { normalizeCompatibilityConfig as n, legacyConfigRules as t };

package/dist/{draft-stream-CtvOXq0Z.js → .setup/draft-stream-C-_OhpE8.mjs}

@@ -1,4 +1,4 @@
-import { _ as MsgType, a as sendSingleTextMessageMatrix, t as editMessageMatrix, y as prepareMatrixSingleText } from "./send-BldGYG8g.js";
+import { n as editMessageMatrix, r as prepareMatrixSingleText, s as sendSingleTextMessageMatrix, y as MsgType } from "./send-CGgl0uTn.mjs";
 import { createDraftStreamLoop } from "openclaw/plugin-sdk/channel-outbound";
 //#region extensions/matrix/src/matrix/draft-stream.ts
 const DEFAULT_THROTTLE_MS = 1e3;
@@ -18,7 +18,6 @@ function createMatrixDraftStream(params) {
 	const useLive = params.mode !== "quiet";
 	let currentEventId;
 	let lastSentText = "";
-	let lastSentContent = "";
 	let stopped = false;
 	let sendFailed = false;
 	let finalizeInPlaceBlocked = false;
@@ -53,7 +52,6 @@ function createMatrixDraftStream(params) {
 					live: useLive
 				})).messageId;
 				lastSentText = preparedText.trimmedText;
-				lastSentContent = preparedText.convertedText;
 				log?.(`draft-stream: created message ${currentEventId}${useLive ? " (MSC4357 live)" : ""}`);
 			} else {
 				await editMessageMatrix(roomId, currentEventId, preparedText.trimmedText, {
@@ -66,7 +64,6 @@ function createMatrixDraftStream(params) {
 					live: useLive
 				});
 				lastSentText = preparedText.trimmedText;
-				lastSentContent = preparedText.convertedText;
 			}
 			return true;
 		} catch (err) {
@@ -120,7 +117,6 @@ function createMatrixDraftStream(params) {
 		replyToId = params.preserveReplyId ? params.replyToId : void 0;
 		currentEventId = void 0;
 		lastSentText = "";
-		lastSentContent = "";
 		stopped = false;
 		sendFailed = false;
 		finalizeInPlaceBlocked = false;
@@ -139,7 +135,6 @@ function createMatrixDraftStream(params) {
 		finalizeLive,
 		reset,
 		eventId: () => currentEventId,
-		content: () => lastSentContent || void 0,
 		matchesPreparedText: (text) => prepareMatrixSingleText(text, {
 			cfg,
 			accountId

package/dist/{encryption-guidance-CbEFe38F.js → .setup/encryption-guidance-CpuuwmjL.mjs}

@@ -1,9 +1,10 @@
-import { a as resolveMatrixDefaultOrOnlyAccountId } from "./account-selection-kqquRzCf.js";
-import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId } from "./account-selection-BOQeTqax.mjs";
+import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.mjs";
 import { normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
 //#region extensions/matrix/src/matrix/encryption-guidance.ts
 function resolveMatrixEncryptionConfigPath(cfg, accountId) {
-	return resolveMatrixConfigFieldPath(cfg, normalizeOptionalAccountId(accountId) ?? resolveMatrixDefaultOrOnlyAccountId(cfg), "encryption");
+	const effectiveAccountId = normalizeOptionalAccountId(accountId) ?? resolveMatrixDefaultOrOnlyAccountId(cfg);
+	return resolveMatrixConfigFieldPath(cfg, effectiveAccountId, "encryption");
 }
 function formatMatrixEncryptionUnavailableError(cfg, accountId) {
 	return `Matrix encryption is not available (enable ${resolveMatrixEncryptionConfigPath(cfg, accountId)}=true)`;