@openclaw/matrix 2026.8.1-beta.3 → 2026.8.2

package/dist/{client-BBQdBG7t.js → client-DFsRJEgB.js}

@@ -1,32 +1,32 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { a as resolveMatrixDefaultOrOnlyAccountId, n as requiresExplicitMatrixDefaultAccount, o as resolveMatrixAccountStringValues } from "./account-selection-CWuhuFn1.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, c as resolveScopedMatrixEnvConfig, l as resolveMatrixAccountStringValues, n as requiresExplicitMatrixDefaultAccount, o as resolveGlobalMatrixEnvConfig } from "./account-selection-DA-jfx22.js";
 import { t as getMatrixScopedEnvVarNames } from "./env-vars-dGqak9dN.js";
-import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as findMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import { r as resolveScopedMatrixEnvConfig, t as resolveGlobalMatrixEnvConfig } from "./env-auth-MVS-Vv41.js";
+import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as findMatrixAccountConfig } from "./account-config-CRsKoMqJ.js";
 import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
-import { d as writeStorageMeta, l as resolveMatrixStoragePaths, r as maybeMigrateLegacyStorage, s as repairCurrentTokenStorageMetaDeviceId } from "./storage-BsGuHngK.js";
+import { d as writeStorageMeta, l as resolveMatrixStoragePaths, r as maybeMigrateLegacyStorage, s as repairCurrentTokenStorageMetaDeviceId } from "./storage-BVf4uucD.js";
 import { n as LogService } from "./logger-B_71hN6W.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1, normalizeOptionalAccountId, normalizeOptionalAccountId as normalizeOptionalAccountId$1 } from "openclaw/plugin-sdk/account-id";
-import { coerceSecretRef, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input-runtime";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
+import { coerceSecretRef, isBuiltInDefaultSecretProviderRef, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { formatErrorMessage, toErrorObject, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
 import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
-import { isPrivateNetworkOptInEnabled, ssrfPolicyFromDangerouslyAllowPrivateNetwork, ssrfPolicyFromDangerouslyAllowPrivateNetwork as ssrfPolicyFromDangerouslyAllowPrivateNetwork$1 } from "openclaw/plugin-sdk/ssrf-runtime";
+import { isPrivateNetworkOptInEnabled, ssrfPolicyFromDangerouslyAllowPrivateNetwork } from "openclaw/plugin-sdk/ssrf-runtime";
 import fs from "node:fs";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { AsyncLocalStorage } from "node:async_hooks";
 //#region extensions/matrix/src/matrix/client/config.ts
-const loadMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-NxK3vzMa.js"), import("./logging-DRjvUOIh.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
+const loadMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-Jl2CgAbJ.js").then((n) => n.t), import("./logging-DRjvUOIh.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
 	MatrixClient: sdkModule.MatrixClient,
 	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
 })));
 const MATRIX_AUTH_REQUEST_RETRY_RE = /\b(fetch failed|econnreset|econnrefused|enotfound|etimedout|ehostunreach|enetunreach|eai_again|und_err_|socket hang up|network|headers timeout|body timeout|connect timeout)\b/i;
-const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-B37cQknZ.js").then((n) => n.r));
-const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-write.runtime-nAV2-5uR.js"));
+const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-mexhw-Ur.js").then((n) => n.r));
+const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-write.runtime-DQt-kgJq.js"));
 const loadMatrixSecretInputDeps = createLazyRuntimeModule(() => import("./config-secret-input.runtime-CwsP3--c.js"));
 function shouldRetryMatrixAuthRequest(err) {
 	return MATRIX_AUTH_REQUEST_RETRY_RE.test(formatErrorMessage(err));
@@ -70,21 +70,21 @@ const MATRIX_CONFIG_STRING_FIELDS = [
 const MATRIX_AUTH_SECRET_FIELDS = ["accessToken", "password"];
 function readMatrixEnvSecretRef(params) {
 	const provider = params.cfg.secrets?.providers?.[params.ref.provider];
-	if (provider) {
-		if (provider.source !== "env") throw new Error(`Secret provider "${params.ref.provider}" has source "${provider.source}" but ref requests "env".`);
+	if (provider?.source === "env") {
 		if (provider.allowlist && !provider.allowlist.includes(params.ref.id)) throw new Error(`Environment variable "${params.ref.id}" is not allowlisted in secrets.providers.${params.ref.provider}.allowlist.`);
-	} else if (params.ref.provider !== (params.cfg.secrets?.defaults?.env?.trim() || "default")) throw new Error(`Secret provider "${params.ref.provider}" is not configured (ref: env:${params.ref.provider}:${params.ref.id}).`);
+	} else if (!isBuiltInDefaultSecretProviderRef(params.cfg, params.ref)) throw new Error(provider ? `Secret provider "${params.ref.provider}" has source "${provider.source}" but ref requests "env".` : `Secret provider "${params.ref.provider}" is not configured (ref: env:${params.ref.provider}:${params.ref.id}).`);
 	return params.env[params.ref.id]?.trim() || void 0;
 }
 function readMatrixConfigString(params) {
 	const ref = coerceSecretRef(params.value, params.cfg.secrets?.defaults);
 	if (params.suppressSecretRef && ref) return "";
+	const value = params.allowEnvSecretRef ? ref?.source === "env" ? readMatrixEnvSecretRef({
+		ref,
+		cfg: params.cfg,
+		env: params.env
+	}) ?? params.value : ref ? "" : params.value : params.value;
 	return normalizeResolvedSecretInputString({
-		value: params.allowEnvSecretRef ? ref?.source === "env" ? readMatrixEnvSecretRef({
-			ref,
-			cfg: params.cfg,
-			env: params.env
-		}) ?? params.value : ref ? "" : params.value : params.value,
+		value,
 		path: params.path,
 		defaults: params.cfg.secrets?.defaults
 	}) ?? "";
@@ -126,7 +126,7 @@ function buildMatrixNetworkFields(params) {
 	return {
 		...params.allowPrivateNetwork ? {
 			allowPrivateNetwork: true,
-			ssrfPolicy: ssrfPolicyFromDangerouslyAllowPrivateNetwork$1(true)
+			ssrfPolicy: ssrfPolicyFromDangerouslyAllowPrivateNetwork(true)
 		} : {},
 		...dispatcherPolicy ? { dispatcherPolicy } : {}
 	};
@@ -158,7 +158,7 @@ function readMatrixConfigStrings(params) {
 	})]));
 }
 function resolveMatrixAccountConfigSnapshot(cfg, accountId, env) {
-	const normalizedAccountId = normalizeAccountId$1(accountId);
+	const normalizedAccountId = normalizeAccountId(accountId);
 	const matrix = resolveMatrixBaseConfig(cfg);
 	const account = findMatrixAccountConfig(cfg, normalizedAccountId) ?? {};
 	const scopedKeys = getMatrixScopedEnvVarNames(normalizedAccountId);
@@ -173,7 +173,7 @@ function resolveMatrixAccountConfigSnapshot(cfg, accountId, env) {
 			value: scopedEnv[field],
 			path: scopedKeys[field]
 		},
-		...normalizedAccountId === DEFAULT_ACCOUNT_ID$1 ? [{
+		...normalizedAccountId === DEFAULT_ACCOUNT_ID ? [{
 			value: matrix[field],
 			path: resolveMatrixBaseConfigFieldPath(field)
 		}, {
@@ -228,17 +228,17 @@ function resolveMatrixAccountConfigSnapshot(cfg, accountId, env) {
 }
 function resolveImplicitMatrixAccountId(cfg, env = process.env) {
 	if (requiresExplicitMatrixDefaultAccount(cfg, env)) return null;
-	return normalizeAccountId$1(resolveMatrixDefaultOrOnlyAccountId(cfg, env));
+	return normalizeAccountId(resolveMatrixDefaultOrOnlyAccountId(cfg, env));
 }
 function resolveMatrixAuthState(params) {
 	const cfg = requireRuntimeConfig(params.cfg, "Matrix auth context");
 	const env = params?.env ?? process.env;
 	const requestedAccountId = params?.accountId?.trim();
-	const explicitAccountId = normalizeOptionalAccountId$1(params?.accountId);
+	const explicitAccountId = normalizeOptionalAccountId(params?.accountId);
 	if (requestedAccountId && !explicitAccountId) throw new Error(`Matrix account id "${requestedAccountId}" is invalid.`);
 	const effectiveAccountId = explicitAccountId ?? resolveImplicitMatrixAccountId(cfg, env);
 	if (!effectiveAccountId) throw new Error("Multiple Matrix accounts are configured and channels.matrix.defaultAccount is not set. Set \"channels.matrix.defaultAccount\" to the intended account or pass --account <id>.");
-	if (explicitAccountId && explicitAccountId !== DEFAULT_ACCOUNT_ID$1 && !listNormalizedMatrixAccountIds(cfg).includes(explicitAccountId) && !hasScopedMatrixEnvConfig(explicitAccountId, env)) throw new Error(`Matrix account "${explicitAccountId}" is not configured. Add channels.matrix.accounts.${explicitAccountId} or define scoped ${getMatrixScopedEnvVarNames(explicitAccountId).accessToken.replace(/_ACCESS_TOKEN$/, "")}_* variables.`);
+	if (explicitAccountId && explicitAccountId !== DEFAULT_ACCOUNT_ID && !listNormalizedMatrixAccountIds(cfg).includes(explicitAccountId) && !hasScopedMatrixEnvConfig(explicitAccountId, env)) throw new Error(`Matrix account "${explicitAccountId}" is not configured. Add channels.matrix.accounts.${explicitAccountId} or define scoped ${getMatrixScopedEnvVarNames(explicitAccountId).accessToken.replace(/_ACCESS_TOKEN$/, "")}_* variables.`);
 	const matrix = resolveMatrixBaseConfig(cfg);
 	const account = findMatrixAccountConfig(cfg, effectiveAccountId);
 	if (matrix.enabled === false || account?.enabled === false) throw new Error(`Matrix account "${effectiveAccountId}" is disabled.`);
@@ -416,7 +416,7 @@ async function backfillMatrixAuthDeviceIdAfterStartup(params) {
 //#endregion
 //#region extensions/matrix/src/matrix/client/create-client.ts
 var create_client_exports = /* @__PURE__ */ __exportAll({ createMatrixClient: () => createMatrixClient });
-const loadMatrixCreateClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-NxK3vzMa.js"), import("./logging-DRjvUOIh.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
+const loadMatrixCreateClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-Jl2CgAbJ.js").then((n) => n.t), import("./logging-DRjvUOIh.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
 	MatrixClient: sdkModule.MatrixClient,
 	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
 })));
@@ -466,6 +466,44 @@ async function createMatrixClient(params) {
 	});
 }
 //#endregion
+//#region extensions/matrix/src/matrix/monitor/task-runner.ts
+const monitorTaskSignal = new AsyncLocalStorage();
+function getMatrixMonitorTaskSignal() {
+	return monitorTaskSignal.getStore();
+}
+function createMatrixMonitorTaskRunner(params) {
+	const inFlight = /* @__PURE__ */ new Map();
+	let closed = false;
+	const runDetachedTask = (label, task) => {
+		if (closed) return Promise.resolve();
+		const controller = new AbortController();
+		const trackedTask = monitorTaskSignal.run(controller.signal, () => Promise.resolve().then(task)).catch((error) => {
+			const message = String(error);
+			params.logVerboseMessage(`matrix: ${label} failed (${message})`);
+			params.logger.warn("matrix background task failed", {
+				task: label,
+				error: message
+			});
+		}).finally(() => {
+			controller.abort();
+			inFlight.delete(trackedTask);
+		});
+		inFlight.set(trackedTask, controller);
+		return trackedTask;
+	};
+	const waitForIdle = async () => {
+		while (inFlight.size > 0) await Promise.allSettled(Array.from(inFlight.keys()));
+	};
+	return {
+		close: () => {
+			closed = true;
+			for (const controller of inFlight.values()) controller.abort();
+		},
+		runDetachedTask,
+		waitForIdle
+	};
+}
+//#endregion
 //#region extensions/matrix/src/matrix/startup-abort.ts
 function createMatrixStartupAbortError() {
 	const error = /* @__PURE__ */ new Error("Matrix startup aborted");
@@ -499,7 +537,7 @@ async function awaitMatrixStartupWithAbort(promise, abortSignal) {
 //#endregion
 //#region extensions/matrix/src/matrix/client/shared.ts
 const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => Promise.resolve().then(() => create_client_exports).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
-const MATRIX_TRANSIENT_LEASE_DRAIN_TIMEOUT_MS = 5e3;
+const MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS = 5e3;
 const sharedClientStates = /* @__PURE__ */ new Map();
 const sharedClientPromises = /* @__PURE__ */ new Map();
 function buildSharedClientKey(auth) {
@@ -549,9 +587,6 @@ function deleteSharedClientState(state) {
 	if (sharedClientStates.get(state.key) === state) sharedClientStates.delete(state.key);
 	sharedClientPromises.delete(state.key);
 }
-function deleteSharedClientStateAfterLateDrain(state) {
-	if (state.phase === "late-drain-stopped" && state.leases.size === 0) deleteSharedClientState(state);
-}
 async function ensureSharedClientStarted(state, abortSignal) {
 	if (state.started) return;
 	if (state.startPromise) {
@@ -568,7 +603,8 @@ async function ensureSharedClientStarted(state, abortSignal) {
 		} catch (err) {
 			LogService.warn("MatrixClientLite", "Failed to prepare crypto:", err);
 		}
-		await awaitMatrixStartupWithAbort(state.client.start({ abortSignal }), abortSignal);
+		await state.client.start({ abortSignal });
+		throwIfMatrixStartupAborted(abortSignal);
 		state.started = true;
 	})().finally(() => {
 		if (state.startPromise === guardedStart) state.startPromise = null;
@@ -594,6 +630,7 @@ async function resolveSharedMatrixAuth(params) {
 }
 async function resolveOpenSharedMatrixClientState(params) {
 	const auth = await resolveSharedMatrixAuth(params);
+	throwIfMatrixStartupAborted(params.abortSignal);
 	const key = buildSharedClientKey(auth);
 	while (true) {
 		const existing = sharedClientStates.get(key);
@@ -648,16 +685,16 @@ function mergeReleaseMode(current, requested) {
 function abortTransientLeases(state) {
 	for (const lease of state.leases) if (lease.role === "transient") lease.abortController.abort();
 }
-async function waitForLeaseDrain(state) {
-	if (state.leases.size === 0) return;
+async function waitForRetirementDrain(state, task, isPending, timeoutMessage) {
+	if (!isPending()) return;
 	let deadline;
 	try {
-		await Promise.race([state.noLeases.promise, new Promise((_, reject) => {
+		await Promise.race([task, new Promise((_, reject) => {
 			deadline = setTimeout(() => {
-				if (state.leases.size === 0) return;
+				if (!isPending()) return;
 				state.phase = "late-drain";
-				reject(/* @__PURE__ */ new Error(`Matrix transient leases did not drain within ${MATRIX_TRANSIENT_LEASE_DRAIN_TIMEOUT_MS}ms`));
-			}, MATRIX_TRANSIENT_LEASE_DRAIN_TIMEOUT_MS);
+				reject(new Error(timeoutMessage));
+			}, MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS);
 			deadline.unref?.();
 		})]);
 	} finally {
@@ -668,8 +705,27 @@ function beginGenerationRetirement(params) {
 	const { state } = params;
 	if (state.retirementPromise) return state.retirementPromise;
 	state.phase = "quiescing";
-	state.retirementPromise = Promise.resolve().then(async () => {
-		let poisonDisposition = "replace-after-stop";
+	const result = createDeferred();
+	state.retirementPromise = result.promise;
+	Promise.resolve().then(async () => {
+		const startup = state.startPromise;
+		if (startup) try {
+			await waitForRetirementDrain(state, startup.catch(() => void 0), () => state.startPromise === startup, `Matrix client startup did not settle within ${MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS}ms during retirement`);
+		} catch (error) {
+			state.poisonError = toStringifiedError(error);
+			result.reject(state.poisonError);
+			const failure = (await Promise.allSettled([
+				startup.catch(() => void 0).then(async () => {
+					state.started = false;
+					await state.client.stopWithoutPersist();
+				}),
+				retireMonitorLeases(state, params.monitorLeases ?? []),
+				state.noLeases.promise
+			])).find((outcome) => outcome.status === "rejected");
+			if (failure) state.poisonError = toStringifiedError(failure.reason);
+			else deleteSharedClientState(state);
+			throw state.poisonError;
+		}
 		try {
 			await state.client.quiesceSync();
 			state.started = false;
@@ -677,50 +733,45 @@ function beginGenerationRetirement(params) {
 		} catch (error) {
 			state.poisonError = toStringifiedError(error);
 		}
+		let monitorRetired = true;
 		try {
 			await retireMonitorLeases(state, params.monitorLeases ?? []);
 		} catch (error) {
 			state.poisonError ??= toStringifiedError(error);
-			poisonDisposition = "retain";
+			monitorRetired = false;
 		}
 		state.phase = "closing";
+		let lateLeaseDrain = null;
 		try {
-			await waitForLeaseDrain(state);
+			await waitForRetirementDrain(state, state.noLeases.promise, () => state.leases.size > 0, `Matrix transient leases did not drain within ${MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS}ms`);
 		} catch (error) {
 			state.poisonError ??= toStringifiedError(error);
-			if (poisonDisposition !== "retain") poisonDisposition = "replace-after-late-drain";
+			result.reject(state.poisonError);
+			lateLeaseDrain = state.noLeases.promise;
 		}
-		if (state.poisonError) {
-			const decryptionsDrained = await state.client.drainPendingDecryptions("matrix poisoned client shutdown").then(() => true, () => false);
-			state.client.stopWithoutPersist();
-			if (decryptionsDrained) {
-				if (poisonDisposition === "replace-after-stop") deleteSharedClientState(state);
-				else if (poisonDisposition === "replace-after-late-drain") {
-					state.phase = "late-drain-stopped";
-					deleteSharedClientStateAfterLateDrain(state);
-				}
-			}
-			throw state.poisonError;
-		}
-		try {
+		let failure = state.poisonError;
+		let canDelete = monitorRetired;
+		if (failure) canDelete = await state.client.drainPendingDecryptions("matrix poisoned client shutdown").then(() => true, () => false) && canDelete;
+		else try {
 			await state.client.drainPendingDecryptions("matrix shared client final shutdown");
 		} catch (error) {
-			state.poisonError = toStringifiedError(error);
-			try {
-				state.client.stopWithoutPersist();
-			} finally {
-				deleteSharedClientState(state);
-			}
-			throw state.poisonError;
+			failure = state.poisonError = toStringifiedError(error);
 		}
-		try {
-			if (state.releaseMode === "persist") await state.client.stopAndPersist();
-			else if (state.releaseMode === "discard") state.client.stopWithoutPersist();
-			else await state.client.stopAndPersist().catch(() => state.client.stopWithoutPersist());
-		} finally {
-			deleteSharedClientState(state);
+		let discard = failure !== null || state.releaseMode === "discard";
+		if (!discard) try {
+			await state.client.stopAndPersist();
+		} catch (error) {
+			discard = true;
+			if (state.releaseMode === "persist") failure = state.poisonError = toStringifiedError(error);
 		}
-	});
+		if (discard) await state.client.stopWithoutPersist().catch((error) => {
+			failure = state.poisonError = toStringifiedError(error);
+			canDelete = false;
+		});
+		await lateLeaseDrain;
+		if (canDelete) deleteSharedClientState(state);
+		if (failure) throw failure;
+	}).then(result.resolve, result.reject);
 	abortTransientLeases(state);
 	return state.retirementPromise;
 }
@@ -754,9 +805,8 @@ function createSharedMatrixClientLease(state, role) {
 			state.releaseMode = mergeReleaseMode(state.releaseMode, releaseParams.mode ?? "stop");
 			state.leases.delete(leaseState);
 			if (state.leases.size === 0) state.noLeases.resolve();
-			if (state.phase === "late-drain" || state.phase === "late-drain-stopped") {
+			if (state.phase === "late-drain") {
 				leaseState.releasePromise = Promise.resolve();
-				deleteSharedClientStateAfterLateDrain(state);
 				return leaseState.releasePromise;
 			}
 			const finalMonitor = role === "monitor" && !Array.from(state.leases).some((lease) => lease.role === "monitor");
@@ -764,8 +814,8 @@ function createSharedMatrixClientLease(state, role) {
 				leaseState.releasePromise = retireMonitorLease(state, leaseState);
 				return leaseState.releasePromise;
 			}
-			if (!(finalMonitor || state.leases.size === 0)) {
-				leaseState.releasePromise = Promise.resolve();
+			if (!(state.phase === "open" && (finalMonitor || state.leases.size === 0))) {
+				leaseState.releasePromise = state.poisonError ? Promise.reject(state.poisonError) : Promise.resolve();
 				return leaseState.releasePromise;
 			}
 			leaseState.releasePromise = beginGenerationRetirement({
@@ -777,11 +827,23 @@ function createSharedMatrixClientLease(state, role) {
 	};
 }
 async function acquireSharedMatrixClient(params = {}) {
+	const taskSignal = getMatrixMonitorTaskSignal();
+	const abortSignal = taskSignal && params.abortSignal ? AbortSignal.any([taskSignal, params.abortSignal]) : taskSignal ?? params.abortSignal;
+	const acquisition = {
+		...params,
+		abortSignal
+	};
 	while (true) {
-		const lease = createSharedMatrixClientLease(await resolveOpenSharedMatrixClientState(params), params.role ?? "transient");
+		throwIfMatrixStartupAborted(abortSignal);
+		const state = await resolveOpenSharedMatrixClientState(acquisition);
+		if (abortSignal?.aborted) {
+			if (state.phase === "open" && state.leases.size === 0) await beginGenerationRetirement({ state });
+			throwIfMatrixStartupAborted(abortSignal);
+		}
+		const lease = createSharedMatrixClientLease(state, params.role ?? "transient");
 		if (!lease) continue;
 		if (params.startClient !== false) try {
-			await lease.start(params.abortSignal);
+			await lease.start(abortSignal);
 		} catch (error) {
 			await lease.release({ mode: "stop" }).catch(() => void 0);
 			throw error;
@@ -796,4 +858,4 @@ var client_exports = /* @__PURE__ */ __exportAll({
 	resolveMatrixAuthContext: () => resolveMatrixAuthContext
 });
 //#endregion
-export { throwIfMatrixStartupAborted as a, resolveMatrixAuth as c, isMatrixStartupAbortError as i, resolveMatrixAuthContext as l, acquireSharedMatrixClient as n, createMatrixClient as o, createMatrixStartupAbortError as r, backfillMatrixAuthDeviceIdAfterStartup as s, client_exports as t };
+export { throwIfMatrixStartupAborted as a, backfillMatrixAuthDeviceIdAfterStartup as c, isMatrixStartupAbortError as i, resolveMatrixAuth as l, acquireSharedMatrixClient as n, createMatrixMonitorTaskRunner as o, createMatrixStartupAbortError as r, createMatrixClient as s, client_exports as t, resolveMatrixAuthContext as u };

package/dist/{client-bootstrap-Co3RlItb.js → client-bootstrap-DjXCKEtg.js}

@@ -7,7 +7,7 @@ var client_bootstrap_exports = /* @__PURE__ */ __exportAll({
 	resolveRuntimeMatrixClientWithReadiness: () => resolveRuntimeMatrixClientWithReadiness,
 	withResolvedRuntimeMatrixClient: () => withResolvedRuntimeMatrixClient
 });
-const loadMatrixSharedClientRuntimeDeps = createLazyRuntimeModule(() => import("./client-BBQdBG7t.js").then((n) => n.t).then((clientModule) => ({
+const loadMatrixSharedClientRuntimeDeps = createLazyRuntimeModule(() => import("./client-DFsRJEgB.js").then((n) => n.t).then((clientModule) => ({
 	acquireSharedMatrixClient: clientModule.acquireSharedMatrixClient,
 	resolveMatrixAuthContext: clientModule.resolveMatrixAuthContext
 })));

package/dist/{config-update-Bor_Pjsv.js → config-update-BnX26jCO.js}

@@ -1,10 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { t as findMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
+import { t as findMatrixAccountConfig } from "./account-config-CRsKoMqJ.js";
 import { n as resolveMatrixConfigPath$1, r as shouldStoreMatrixAccountAtTopLevel, t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { normalizeSecretInputString } from "openclaw/plugin-sdk/setup";
+import { coerceSecretRef, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
-import { coerceSecretRef } from "openclaw/plugin-sdk/secret-ref-runtime";
 //#region extensions/matrix/src/matrix/config-update.ts
 var config_update_exports = /* @__PURE__ */ __exportAll({
 	resolveMatrixConfigFieldPath: () => resolveMatrixConfigFieldPath,
@@ -67,11 +66,13 @@ function updateMatrixAccountConfig(cfg, accountId, patch) {
 	const matrix = cfg.channels?.matrix ?? {};
 	const normalizedAccountId = normalizeAccountId(accountId);
 	const nextAccount = { ...findMatrixAccountConfig(cfg, normalizedAccountId) ?? (normalizedAccountId === DEFAULT_ACCOUNT_ID ? matrix : {}) };
-	if (patch.name !== void 0) if (patch.name === null) delete nextAccount.name;
-	else {
-		const trimmed = patch.name.trim();
-		if (trimmed) nextAccount.name = trimmed;
-		else delete nextAccount.name;
+	if (patch.name !== void 0) {
+		if (patch.name === null) delete nextAccount.name;
+		else {
+			const trimmed = patch.name.trim();
+			if (trimmed) nextAccount.name = trimmed;
+			else delete nextAccount.name;
+		}
 	}
 	if (typeof patch.enabled === "boolean") nextAccount.enabled = patch.enabled;
 	else if (typeof nextAccount.enabled !== "boolean") nextAccount.enabled = true;
@@ -90,31 +91,47 @@ function updateMatrixAccountConfig(cfg, accountId, patch) {
 		if (Object.keys(nextNetwork).length > 0) nextAccount.network = nextNetwork;
 		else delete nextAccount.network;
 	}
-	if (patch.initialSyncLimit !== void 0) if (patch.initialSyncLimit === null) delete nextAccount.initialSyncLimit;
-	else {
-		const initialSyncLimit = resolveOptionalIntegerOption(patch.initialSyncLimit, { min: 0 });
-		if (initialSyncLimit === void 0) delete nextAccount.initialSyncLimit;
-		else nextAccount.initialSyncLimit = initialSyncLimit;
-	}
-	if (patch.encryption !== void 0) if (patch.encryption === null) delete nextAccount.encryption;
-	else nextAccount.encryption = patch.encryption;
-	if (patch.allowBots !== void 0) if (patch.allowBots === null) delete nextAccount.allowBots;
-	else nextAccount.allowBots = patch.allowBots;
-	if (patch.autoJoin !== void 0) if (patch.autoJoin === null) delete nextAccount.autoJoin;
-	else nextAccount.autoJoin = patch.autoJoin;
+	if (patch.initialSyncLimit !== void 0) {
+		if (patch.initialSyncLimit === null) delete nextAccount.initialSyncLimit;
+		else {
+			const initialSyncLimit = resolveOptionalIntegerOption(patch.initialSyncLimit, { min: 0 });
+			if (initialSyncLimit === void 0) delete nextAccount.initialSyncLimit;
+			else nextAccount.initialSyncLimit = initialSyncLimit;
+		}
+	}
+	if (patch.encryption !== void 0) {
+		if (patch.encryption === null) delete nextAccount.encryption;
+		else nextAccount.encryption = patch.encryption;
+	}
+	if (patch.allowBots !== void 0) {
+		if (patch.allowBots === null) delete nextAccount.allowBots;
+		else nextAccount.allowBots = patch.allowBots;
+	}
+	if (patch.autoJoin !== void 0) {
+		if (patch.autoJoin === null) delete nextAccount.autoJoin;
+		else nextAccount.autoJoin = patch.autoJoin;
+	}
 	applyNullableArrayField(nextAccount, "autoJoinAllowlist", patch.autoJoinAllowlist);
-	if (patch.dm !== void 0) if (patch.dm === null) delete nextAccount.dm;
-	else nextAccount.dm = cloneMatrixDmConfig({
-		...nextAccount.dm,
-		...patch.dm
-	});
-	if (patch.groupPolicy !== void 0) if (patch.groupPolicy === null) delete nextAccount.groupPolicy;
-	else nextAccount.groupPolicy = patch.groupPolicy;
+	if (patch.dm !== void 0) {
+		if (patch.dm === null) delete nextAccount.dm;
+		else nextAccount.dm = cloneMatrixDmConfig({
+			...nextAccount.dm,
+			...patch.dm
+		});
+	}
+	if (patch.groupPolicy !== void 0) {
+		if (patch.groupPolicy === null) delete nextAccount.groupPolicy;
+		else nextAccount.groupPolicy = patch.groupPolicy;
+	}
 	applyNullableArrayField(nextAccount, "groupAllowFrom", patch.groupAllowFrom);
-	if (patch.groups !== void 0) if (patch.groups === null) delete nextAccount.groups;
-	else nextAccount.groups = cloneMatrixRoomMap(patch.groups);
-	if (patch.rooms !== void 0) if (patch.rooms === null) delete nextAccount.rooms;
-	else nextAccount.rooms = cloneMatrixRoomMap(patch.rooms);
+	if (patch.groups !== void 0) {
+		if (patch.groups === null) delete nextAccount.groups;
+		else nextAccount.groups = cloneMatrixRoomMap(patch.groups);
+	}
+	if (patch.rooms !== void 0) {
+		if (patch.rooms === null) delete nextAccount.rooms;
+		else nextAccount.rooms = cloneMatrixRoomMap(patch.rooms);
+	}
 	const nextAccounts = Object.fromEntries(Object.entries(matrix.accounts ?? {}).filter(([rawAccountId]) => rawAccountId === normalizedAccountId || normalizeAccountId(rawAccountId) !== normalizedAccountId));
 	if (shouldStoreMatrixAccountAtTopLevel(cfg, normalizedAccountId)) {
 		const { accounts: _ignoredAccounts, defaultAccount } = matrix;

package/dist/contract-api.js

@@ -1,3 +1,3 @@
-import { c as singleAccountKeysToMove, n as matrixSetupAdapter, o as namedAccountPromotionKeys, s as resolveSingleAccountPromotionTarget } from "./setup-core-DigrLebY.js";
-import { n as matrixOnboardingAdapter } from "./setup-surface-Dtn8sAWs.js";
+import { c as singleAccountKeysToMove, n as matrixSetupAdapter, o as namedAccountPromotionKeys, s as resolveSingleAccountPromotionTarget } from "./setup-core-CZM496H-.js";
+import { n as matrixOnboardingAdapter } from "./setup-surface-DSZtOsWK.js";
 export { matrixSetupAdapter, matrixOnboardingAdapter as matrixSetupWizard, namedAccountPromotionKeys, resolveSingleAccountPromotionTarget, singleAccountKeysToMove };

package/dist/{credentials-BdAaWuiR.js → credentials-DJj2xs3q.js}

@@ -1,17 +1,13 @@
 import { i as normalizeMatrixStoredCredentials, n as isMatrixCredentialRevocation, r as matrixCredentialsStoreKey } from "./credentials-state-B3cuUFwZ.js";
 import { a as resolveMatrixCredentialsPath, r as resolveMatrixCredentialsDir } from "./storage-paths-gUmSydsW.js";
-import { a as openMatrixCredentialsStore, i as loadMatrixCredentials, n as credentialsMatchConfig, t as clearMatrixCredentials } from "./credentials-read-B37cQknZ.js";
+import { a as openMatrixCredentialsStore, i as loadMatrixCredentials, n as credentialsMatchConfig, t as clearMatrixCredentials } from "./credentials-read-mexhw-Ur.js";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 //#region extensions/matrix/src/matrix/credentials.ts
-function requireCredentialStoreUpdate(store) {
-	if (!store.update) throw new Error("Matrix credentials require atomic plugin-state updates");
-	return store.update;
-}
 async function saveMatrixCredentials(credentials, env = process.env, accountId) {
 	const normalizedAccountId = normalizeAccountId(accountId);
 	const store = openMatrixCredentialsStore(env);
 	const now = (/* @__PURE__ */ new Date()).toISOString();
-	requireCredentialStoreUpdate(store)(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
+	store.update(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
 		const existing = normalizeMatrixStoredCredentials(current, normalizedAccountId);
 		return {
 			accountId: normalizedAccountId,
@@ -29,7 +25,7 @@ async function saveBackfilledMatrixDeviceId(credentials, env = process.env, acco
 	const store = openMatrixCredentialsStore(env);
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	let result = "saved";
-	requireCredentialStoreUpdate(store)(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
+	store.update(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
 		if (isMatrixCredentialRevocation(current, normalizedAccountId)) {
 			result = "skipped";
 			return current;
@@ -53,7 +49,7 @@ async function saveBackfilledMatrixDeviceId(credentials, env = process.env, acco
 }
 async function touchMatrixCredentials(env = process.env, accountId) {
 	const normalizedAccountId = normalizeAccountId(accountId);
-	requireCredentialStoreUpdate(openMatrixCredentialsStore(env))(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
+	openMatrixCredentialsStore(env).update(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
 		if (isMatrixCredentialRevocation(current, normalizedAccountId)) return current;
 		const existing = normalizeMatrixStoredCredentials(current, normalizedAccountId);
 		return existing ? {

package/dist/{credentials-read-B37cQknZ.js → credentials-read-mexhw-Ur.js}

@@ -15,19 +15,21 @@ var credentials_read_exports = /* @__PURE__ */ __exportAll({
 });
 function openMatrixCredentialsStore(env = process.env) {
 	const runtime = getOptionalMatrixRuntime();
+	const resolvedEnv = env.OPENCLAW_STATE_DIR?.trim() || !runtime ? env : {
+		...env,
+		OPENCLAW_STATE_DIR: runtime.state.resolveStateDir(env)
+	};
 	return createPluginStateSyncKeyedStore("matrix", {
 		namespace: MATRIX_CREDENTIALS_NAMESPACE,
 		maxEntries: 256,
 		overflowPolicy: "reject-new",
-		env: env.OPENCLAW_STATE_DIR?.trim() || !runtime ? env : {
-			...env,
-			OPENCLAW_STATE_DIR: runtime.state.resolveStateDir(env)
-		}
+		env: resolvedEnv
 	});
 }
 function loadMatrixCredentials(env = process.env, accountId) {
 	const normalizedAccountId = normalizeAccountId(accountId);
-	const parsed = normalizeMatrixStoredCredentials(openMatrixCredentialsStore(env).lookup(matrixCredentialsStoreKey(accountId)), normalizedAccountId);
+	const stored = openMatrixCredentialsStore(env).lookup(matrixCredentialsStoreKey(accountId));
+	const parsed = normalizeMatrixStoredCredentials(stored, normalizedAccountId);
 	if (!parsed || parsed.accountId !== normalizedAccountId) return null;
 	const { accountId: _accountId, ...credentials } = parsed;
 	return credentials;

package/dist/{credentials-write.runtime-nAV2-5uR.js → credentials-write.runtime-DQt-kgJq.js}

@@ -1,6 +1,6 @@
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 //#region extensions/matrix/src/matrix/credentials-write.runtime.ts
-const loadMatrixCredentialsRuntime = createLazyRuntimeModule(() => import("./credentials-BdAaWuiR.js"));
+const loadMatrixCredentialsRuntime = createLazyRuntimeModule(() => import("./credentials-DJj2xs3q.js"));
 async function saveMatrixCredentials(...args) {
 	return (await loadMatrixCredentialsRuntime()).saveMatrixCredentials(...args);
 }

package/dist/{crypto-runtime-Bnz3zEcS.js → crypto-runtime-QvlgyCkj.js}

@@ -1,13 +1,13 @@
-import { t as ensureMatrixCryptoRuntime } from "./deps-CcVJfvRM.js";
+import { t as ensureMatrixCryptoRuntime } from "./deps-mtxF2mHI.js";
 import { n as LogService, r as noop } from "./logger-B_71hN6W.js";
-import { i as restoreIdbFromDisk, n as persistIdbToDisk } from "./idb-persistence-BM0P27Zg.js";
-import { n as isRepairableSecretStorageAccessError } from "./recovery-key-store-CognuDys.js";
+import { i as restoreIdbFromDisk, n as persistIdbToDisk } from "./idb-persistence-D4NGNQxt.js";
+import { n as isRepairableSecretStorageAccessError } from "./sdk-Jl2CgAbJ.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { formatErrorMessage, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
 import { resolveDateTimestampMs, resolveTimestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
-import { MatrixEventEvent } from "matrix-js-sdk/lib/matrix.js";
 import { IDBDatabase } from "fake-indexeddb";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { MatrixEventEvent } from "matrix-js-sdk/lib/matrix.js";
 import { VerificationMethod } from "matrix-js-sdk/lib/types.js";
 import "fake-indexeddb/auto";
 import { CryptoEvent } from "matrix-js-sdk/lib/crypto-api/CryptoEvent.js";
@@ -450,7 +450,7 @@ const MATRIX_DECRYPT_RETRY_BASE_DELAY_MS = 1500;
 const MATRIX_DECRYPT_RETRY_MAX_DELAY_MS = 3e4;
 const MATRIX_DECRYPT_RETRY_MAX_ATTEMPTS = 8;
 const MATRIX_DECRYPT_DRAIN_TIMEOUT_MS = 5e3;
-const MATRIX_DECRYPT_EXHAUSTED_RETRY_TTL_MS = 60 * 6e4;
+const MATRIX_DECRYPT_EXHAUSTED_RETRY_TTL_MS = 36e5;
 const MATRIX_DECRYPT_EXHAUSTED_RETRY_MAX_ENTRIES = 512;
 function resolveDecryptRetryKey(roomId, eventId) {
 	if (!roomId || !eventId) return null;
@@ -770,7 +770,7 @@ function isMatrixVerificationPhase(value) {
 	return typeof value === "number" && MATRIX_VERIFICATION_PHASES.has(value);
 }
 const MAX_TRACKED_VERIFICATION_SESSIONS = 256;
-const TERMINAL_SESSION_RETENTION_MS = 1440 * 60 * 1e3;
+const TERMINAL_SESSION_RETENTION_MS = 864e5;
 const SAS_AUTO_CONFIRM_DELAY_MS = 3e4;
 var MatrixVerificationManager = class {
 	constructor(opts = {}) {

package/dist/{deps-CcVJfvRM.js → deps-mtxF2mHI.js}

@@ -10,7 +10,7 @@ const REQUIRED_MATRIX_PACKAGES = [
 	"@matrix-org/matrix-sdk-crypto-wasm"
 ];
 const MIN_MATRIX_CRYPTO_NATIVE_BINDING_BYTES = 1e6;
-const MATRIX_COMMAND_OUTPUT_TAIL_BYTES = 64 * 1024;
+const MATRIX_COMMAND_OUTPUT_TAIL_BYTES = 65536;
 function resolveMissingMatrixPackages(resolveFn) {
 	const resolve = resolveFn ?? defaultResolveFn;
 	return REQUIRED_MATRIX_PACKAGES.filter((pkg) => {