@openclaw/matrix 2026.9.1-beta.1 → 2026.9.2

package/dist/{account-config-BZWN9tGS.js → account-config-CRsKoMqJ.js}

@@ -1,5 +1,5 @@
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input-runtime";
+import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input";
 import { listConfiguredAccountIds, resolveMergedAccountConfig, resolveNormalizedAccountEntry } from "openclaw/plugin-sdk/account-resolution-runtime";
 //#region extensions/matrix/src/matrix/account-config.ts
 function resolveMatrixBaseConfig(cfg) {

package/dist/{account-selection-CWuhuFn1.js → account-selection-DA-jfx22.js}

@@ -30,6 +30,66 @@ function resolveMatrixAccountStringValues(params) {
 	return resolved;
 }
 //#endregion
+//#region extensions/matrix/src/matrix/client/env-auth.ts
+function cleanEnv(value) {
+	return normalizeOptionalString(value) ?? "";
+}
+function resolveGlobalMatrixEnvConfig(env) {
+	return {
+		homeserver: cleanEnv(env.MATRIX_HOMESERVER),
+		userId: cleanEnv(env.MATRIX_USER_ID),
+		accessToken: cleanEnv(env.MATRIX_ACCESS_TOKEN) || void 0,
+		password: cleanEnv(env.MATRIX_PASSWORD) || void 0,
+		deviceId: cleanEnv(env.MATRIX_DEVICE_ID) || void 0,
+		deviceName: cleanEnv(env.MATRIX_DEVICE_NAME) || void 0
+	};
+}
+function hasReadyMatrixEnvAuth(config) {
+	const homeserver = cleanEnv(config.homeserver);
+	const userId = cleanEnv(config.userId);
+	const accessToken = cleanEnv(config.accessToken);
+	const password = cleanEnv(config.password);
+	return Boolean(homeserver && (accessToken || userId && password));
+}
+function resolveScopedMatrixEnvConfig(accountId, env = process.env) {
+	const keys = getMatrixScopedEnvVarNames(accountId);
+	return {
+		homeserver: cleanEnv(env[keys.homeserver]),
+		userId: cleanEnv(env[keys.userId]),
+		accessToken: cleanEnv(env[keys.accessToken]) || void 0,
+		password: cleanEnv(env[keys.password]) || void 0,
+		deviceId: cleanEnv(env[keys.deviceId]) || void 0,
+		deviceName: cleanEnv(env[keys.deviceName]) || void 0
+	};
+}
+function resolveMatrixEnvAuthReadiness(accountId, env = process.env) {
+	const normalizedAccountId = normalizeAccountId(accountId);
+	const scoped = resolveScopedMatrixEnvConfig(normalizedAccountId, env);
+	const scopedReady = hasReadyMatrixEnvAuth(scoped);
+	if (normalizedAccountId !== DEFAULT_ACCOUNT_ID) {
+		const keys = getMatrixScopedEnvVarNames(normalizedAccountId);
+		return {
+			ready: scopedReady,
+			homeserver: scoped.homeserver || void 0,
+			userId: scoped.userId || void 0,
+			sourceHint: `${keys.homeserver} (+ auth vars)`,
+			missingMessage: `Set per-account env vars for "${normalizedAccountId}" (for example ${keys.homeserver} + ${keys.accessToken} or ${keys.userId} + ${keys.password}).`
+		};
+	}
+	const defaultScoped = resolveScopedMatrixEnvConfig(DEFAULT_ACCOUNT_ID, env);
+	const global = resolveGlobalMatrixEnvConfig(env);
+	const defaultScopedReady = hasReadyMatrixEnvAuth(defaultScoped);
+	const globalReady = hasReadyMatrixEnvAuth(global);
+	const defaultKeys = getMatrixScopedEnvVarNames(DEFAULT_ACCOUNT_ID);
+	return {
+		ready: defaultScopedReady || globalReady,
+		homeserver: defaultScoped.homeserver || global.homeserver || void 0,
+		userId: defaultScoped.userId || global.userId || void 0,
+		sourceHint: "MATRIX_* or MATRIX_DEFAULT_*",
+		missingMessage: `Set Matrix env vars for the default account (for example MATRIX_HOMESERVER + MATRIX_ACCESS_TOKEN, MATRIX_USER_ID + MATRIX_PASSWORD, or ${defaultKeys.homeserver} + ${defaultKeys.accessToken}).`
+	};
+}
+//#endregion
 //#region extensions/matrix/src/account-selection.ts
 function readConfiguredMatrixString(value) {
 	return normalizeOptionalString(value) ?? "";
@@ -48,30 +108,6 @@ function resolveMatrixChannelStringSources(entry) {
 		deviceName: readConfiguredMatrixString(entry.deviceName)
 	};
 }
-function readEnvMatrixString(env, key) {
-	return normalizeOptionalString(env[key]) ?? "";
-}
-function resolveScopedMatrixEnvStringSources(accountId, env) {
-	const keys = getMatrixScopedEnvVarNames(accountId);
-	return {
-		homeserver: readEnvMatrixString(env, keys.homeserver),
-		userId: readEnvMatrixString(env, keys.userId),
-		accessToken: readEnvMatrixString(env, keys.accessToken),
-		password: readEnvMatrixString(env, keys.password),
-		deviceId: readEnvMatrixString(env, keys.deviceId),
-		deviceName: readEnvMatrixString(env, keys.deviceName)
-	};
-}
-function resolveGlobalMatrixEnvStringSources(env) {
-	return {
-		homeserver: readEnvMatrixString(env, "MATRIX_HOMESERVER"),
-		userId: readEnvMatrixString(env, "MATRIX_USER_ID"),
-		accessToken: readEnvMatrixString(env, "MATRIX_ACCESS_TOKEN"),
-		password: readEnvMatrixString(env, "MATRIX_PASSWORD"),
-		deviceId: readEnvMatrixString(env, "MATRIX_DEVICE_ID"),
-		deviceName: readEnvMatrixString(env, "MATRIX_DEVICE_NAME")
-	};
-}
 function hasUsableResolvedMatrixAuth(values) {
 	return Boolean(values.homeserver && (values.accessToken || values.userId));
 }
@@ -82,9 +118,9 @@ function resolveEffectiveMatrixAccountSources(params) {
 	const normalizedAccountId = normalizeAccountId(params.accountId);
 	return resolveMatrixAccountStringValues({
 		accountId: normalizedAccountId,
-		scopedEnv: resolveScopedMatrixEnvStringSources(normalizedAccountId, params.env),
+		scopedEnv: resolveScopedMatrixEnvConfig(normalizedAccountId, params.env),
 		channel: resolveMatrixChannelStringSources(params.channel),
-		globalEnv: resolveGlobalMatrixEnvStringSources(params.env)
+		globalEnv: resolveGlobalMatrixEnvConfig(params.env)
 	});
 }
 function hasUsableEffectiveMatrixAccountSource(params) {
@@ -121,16 +157,17 @@ function resolveConfiguredMatrixAccountIds(cfg, env = process.env) {
 		channel,
 		env
 	})) configuredAccountIds.push(DEFAULT_ACCOUNT_ID);
+	const readyEnvAccountIds = listMatrixEnvAccountIds(env).filter((accountId) => normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID ? hasConfiguredDefaultMatrixAccountSource({
+		channel,
+		env
+	}) : hasUsableEffectiveMatrixAccountSource({
+		channel,
+		accountId,
+		env
+	}));
 	return listCombinedAccountIds({
 		configuredAccountIds,
-		additionalAccountIds: listMatrixEnvAccountIds(env).filter((accountId) => normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID ? hasConfiguredDefaultMatrixAccountSource({
-			channel,
-			env
-		}) : hasUsableEffectiveMatrixAccountSource({
-			channel,
-			accountId,
-			env
-		})),
+		additionalAccountIds: readyEnvAccountIds,
 		fallbackAccountIdWhenEmpty: channel ? DEFAULT_ACCOUNT_ID : void 0
 	});
 }
@@ -138,8 +175,9 @@ function resolveMatrixDefaultOrOnlyAccountId(cfg, env = process.env) {
 	const channel = resolveMatrixChannelConfig(cfg);
 	if (!channel) return DEFAULT_ACCOUNT_ID;
 	const configuredDefault = normalizeOptionalAccountId(typeof channel.defaultAccount === "string" ? channel.defaultAccount : void 0);
+	const configuredAccountIds = resolveConfiguredMatrixAccountIds(cfg, env);
 	return resolveListedDefaultAccountId({
-		accountIds: resolveConfiguredMatrixAccountIds(cfg, env),
+		accountIds: configuredAccountIds,
 		configuredDefaultAccountId: configuredDefault,
 		ambiguousFallbackAccountId: DEFAULT_ACCOUNT_ID
 	});
@@ -154,4 +192,4 @@ function requiresExplicitMatrixDefaultAccount(cfg, env = process.env) {
 	return !(configuredDefault && configuredAccountIds.includes(configuredDefault));
 }
 //#endregion
-export { resolveMatrixDefaultOrOnlyAccountId as a, resolveMatrixChannelConfig as i, requiresExplicitMatrixDefaultAccount as n, resolveMatrixAccountStringValues as o, resolveConfiguredMatrixAccountIds as r, findMatrixAccountEntry as t };
+export { resolveMatrixDefaultOrOnlyAccountId as a, resolveScopedMatrixEnvConfig as c, resolveMatrixChannelConfig as i, resolveMatrixAccountStringValues as l, requiresExplicitMatrixDefaultAccount as n, resolveGlobalMatrixEnvConfig as o, resolveConfiguredMatrixAccountIds as r, resolveMatrixEnvAuthReadiness as s, findMatrixAccountEntry as t };

package/dist/{accounts-BCzyubQt.js → accounts-DR1c4xF_.js}

@@ -1,10 +1,9 @@
-import { a as resolveMatrixDefaultOrOnlyAccountId, o as resolveMatrixAccountStringValues, r as resolveConfiguredMatrixAccountIds } from "./account-selection-CWuhuFn1.js";
-import { a as resolveMatrixAccountConfig, o as resolveMatrixBaseConfig, t as findMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import { r as resolveScopedMatrixEnvConfig, t as resolveGlobalMatrixEnvConfig } from "./env-auth-MVS-Vv41.js";
-import { i as loadMatrixCredentials, n as credentialsMatchConfig } from "./credentials-read-B37cQknZ.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, c as resolveScopedMatrixEnvConfig, l as resolveMatrixAccountStringValues, o as resolveGlobalMatrixEnvConfig, r as resolveConfiguredMatrixAccountIds } from "./account-selection-DA-jfx22.js";
+import { a as resolveMatrixAccountConfig, o as resolveMatrixBaseConfig, t as findMatrixAccountConfig } from "./account-config-CRsKoMqJ.js";
+import { i as loadMatrixCredentials, n as credentialsMatchConfig } from "./credentials-read-mexhw-Ur.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input-runtime";
+import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input";
 //#region extensions/matrix/src/matrix/accounts.ts
 function clean(value) {
 	return normalizeOptionalString(value) ?? "";

package/dist/api.js

@@ -1,9 +1,9 @@
-import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-CWuhuFn1.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-DA-jfx22.js";
 import { n as listMatrixEnvAccountIds, r as resolveMatrixEnvAccountToken, t as getMatrixScopedEnvVarNames } from "./env-vars-dGqak9dN.js";
 import { a as resolveMatrixCredentialsPath, i as resolveMatrixCredentialsFilename, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as sanitizeMatrixPathSegment, t as hashMatrixAccessToken } from "./storage-paths-gUmSydsW.js";
-import { t as matrixPlugin } from "./channel-CBEvelTE.js";
-import { n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-CyvaCOOr.js";
+import { t as matrixPlugin } from "./channel-Bs8VLb6q.js";
+import { n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-XkIfQ65J.js";
 import { f as setMatrixThreadBindingMaxAgeBySessionKey, n as getMatrixThreadBindingManager, u as setMatrixThreadBindingIdleTimeoutBySessionKey } from "./thread-bindings-shared-oNPiyMWY.js";
-import { n as matrixOnboardingAdapter } from "./setup-surface-DtRvRcCT.js";
-import { t as createMatrixThreadBindingManager } from "./thread-bindings-BvyU66kE.js";
+import { n as matrixOnboardingAdapter } from "./setup-surface-B2yZ8KGc.js";
+import { t as createMatrixThreadBindingManager } from "./thread-bindings-BkBnn4te.js";
 export { createMatrixSetupWizardProxy, createMatrixThreadBindingManager, findMatrixAccountEntry, getMatrixScopedEnvVarNames, getMatrixThreadBindingManager, hashMatrixAccessToken, listMatrixEnvAccountIds, matrixOnboardingAdapter, matrixOnboardingAdapter as matrixSetupWizard, matrixPlugin, matrixSetupAdapter, requiresExplicitMatrixDefaultAccount, resolveConfiguredMatrixAccountIds, resolveMatrixAccountStorageRoot, resolveMatrixChannelConfig, resolveMatrixCredentialsDir, resolveMatrixCredentialsFilename, resolveMatrixCredentialsPath, resolveMatrixDefaultOrOnlyAccountId, resolveMatrixEnvAccountToken, resolveMatrixHomeserverKey, sanitizeMatrixPathSegment, setMatrixThreadBindingIdleTimeoutBySessionKey, setMatrixThreadBindingMaxAgeBySessionKey };

package/dist/{approval-handler.runtime-G9fLHUWe.js → approval-handler.runtime-BJCD4dLf.js}

@@ -1,16 +1,16 @@
-import { i as resolveMatrixAccount } from "./accounts-BCzyubQt.js";
-import { C as shouldHandleMatrixApprovalRequest, S as isMatrixAnyApprovalClientEnabled } from "./channel-CBEvelTE.js";
+import { i as resolveMatrixAccount } from "./accounts-DR1c4xF_.js";
+import { C as shouldHandleMatrixApprovalRequest, S as isMatrixAnyApprovalClientEnabled } from "./channel-Bs8VLb6q.js";
 import { o as resolveMatrixTargetIdentity } from "./target-ids-Nwx7cMVE.js";
-import { a as sendSingleTextMessageMatrix, n as reactMatrixMessage, r as sendMessageMatrix, w as repairMatrixDirectRooms } from "./send-BKu9Ghi4.js";
-import { a as unregisterMatrixApprovalReactionTarget, n as listMatrixApprovalReactionBindings, r as registerMatrixApprovalReactionTarget, t as buildMatrixApprovalReactionHint } from "./approval-reactions-tXh9KYrW.js";
-import { n as editMatrixMessage, t as deleteMatrixMessage } from "./messages-Dow9EOoJ.js";
+import { C as repairMatrixDirectRooms, a as sendSingleTextMessageMatrix, n as reactMatrixMessage, r as sendMessageMatrix } from "./send-B5XChnvB.js";
+import { a as unregisterMatrixApprovalReactionTarget, n as listMatrixApprovalReactionBindings, r as registerMatrixApprovalReactionTarget, t as buildMatrixApprovalReactionHint } from "./approval-reactions-1fwEhoK9.js";
+import { n as editMatrixMessage, t as deleteMatrixMessage } from "./messages-Czn8lNEh.js";
 import { listMessageReceiptPlatformIds, resolveMessageReceiptPrimaryId } from "openclaw/plugin-sdk/channel-outbound";
 import { normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildChannelApprovalNativeTargetKey } from "openclaw/plugin-sdk/approval-native-runtime";
 import { normalizeAccountId } from "openclaw/plugin-sdk/routing";
 import { createChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-runtime";
 import { buildExecApprovalPendingReplyPayload, buildPluginApprovalPendingReplyPayload } from "openclaw/plugin-sdk/approval-reply-runtime";
-import { buildPluginApprovalResolvedReplyPayload } from "openclaw/plugin-sdk/approval-runtime";
+import { buildApprovalPendingReplyPayload, buildPluginApprovalResolvedReplyPayload } from "openclaw/plugin-sdk/approval-runtime";
 import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 //#region extensions/matrix/src/approval-handler.runtime.ts
 const MATRIX_APPROVAL_METADATA_KEY = "com.openclaw.approval";
@@ -110,6 +110,13 @@ function buildMatrixApprovalMetadata(params) {
 		...params.view.pluginId != null ? { pluginId: params.view.pluginId } : {},
 		...params.view.toolName != null ? { toolName: params.view.toolName } : {}
 	};
+	if (params.view.approvalKind === "system-agent") return {
+		...base,
+		kind: "system-agent",
+		commandText: params.view.commandText,
+		operationSummary: params.view.operationSummary,
+		...params.view.agentId != null ? { agentId: params.view.agentId } : {}
+	};
 	return {
 		...base,
 		kind: "exec",
@@ -126,7 +133,8 @@ function buildMatrixApprovalMetadata(params) {
 }
 function buildPendingApprovalContent(params) {
 	const allowedDecisions = params.view.actions.map((action) => action.decision);
-	const payload = params.view.approvalKind === "plugin" ? buildPluginApprovalPendingReplyPayload({
+	let payload;
+	if (params.view.approvalKind === "plugin") payload = buildPluginApprovalPendingReplyPayload({
 		request: {
 			approvalKind: "plugin",
 			id: params.view.approvalId,
@@ -144,7 +152,17 @@ function buildPendingApprovalContent(params) {
 		},
 		nowMs: params.nowMs,
 		allowedDecisions
-	}) : buildExecApprovalPendingReplyPayload({
+	});
+	else if (params.view.approvalKind === "system-agent") payload = buildApprovalPendingReplyPayload({
+		approvalKind: "system-agent",
+		approvalId: params.view.approvalId,
+		approvalSlug: params.view.approvalId.slice(0, 8),
+		text: `OpenClaw change requires approval:\n${params.view.operationSummary}`,
+		agentId: params.view.agentId,
+		allowedDecisions,
+		sessionKey: params.view.sessionKey
+	});
+	else payload = buildExecApprovalPendingReplyPayload({
 		approvalId: params.view.approvalId,
 		approvalSlug: params.view.approvalId.slice(0, 8),
 		approvalCommandId: params.view.approvalId,
@@ -179,10 +197,11 @@ function buildResolvedApprovalText(view) {
 		resolvedBy: view.resolvedBy ?? void 0,
 		ts: 0
 	} }).text ?? "";
+	const decisionLabel = view.approvalKind === "system-agent" && view.terminalStatus === "cancelled" ? "Cancelled" : view.approvalKind === "system-agent" && view.applicationStatus === "applied" ? "Applied" : view.approvalKind === "system-agent" && view.applicationStatus === "not-applied" ? "Not applied" : view.decision === "allow-once" ? "Allowed once" : view.decision === "allow-always" ? "Allowed always" : "Denied";
 	return [
-		`Exec approval: ${view.decision === "allow-once" ? "Allowed once" : view.decision === "allow-always" ? "Allowed always" : "Denied"}`,
+		`${view.approvalKind === "system-agent" ? "OpenClaw change" : "Exec approval"}: ${decisionLabel}`,
 		"",
-		"Command",
+		view.approvalKind === "system-agent" ? "Change" : "Command",
 		buildMarkdownCodeBlock(view.commandText)
 	].join("\n");
 }
@@ -196,7 +215,11 @@ function buildMarkdownCodeBlock(text) {
 	].join("\n");
 }
 const matrixApprovalNativeRuntime = createChannelApprovalNativeRuntimeAdapter({
-	eventKinds: ["exec", "plugin"],
+	eventKinds: [
+		"exec",
+		"plugin",
+		"system-agent"
+	],
 	availability: {
 		isConfigured: ({ cfg, accountId, context }) => {
 			const resolved = resolveHandlerContext({

package/dist/{approval-ids-C6FD3pVY.js → approval-ids-Bst7HM_o.js}

@@ -1,4 +1,4 @@
-import { a as normalizeMatrixUserId } from "./channel.setup-sWPOGyQG.js";
+import { a as normalizeMatrixUserId } from "./channel.setup-DhmDXwPp.js";
 //#region extensions/matrix/src/approval-ids.ts
 function normalizeMatrixApproverId(value) {
 	return normalizeMatrixUserId(String(value)) || void 0;

package/dist/{approval-reaction-auth-60xHiDtQ.js → approval-reaction-auth-DhH8QOSe.js}

@@ -1,5 +1,5 @@
-import { i as resolveMatrixAccount } from "./accounts-BCzyubQt.js";
-import { t as normalizeMatrixApproverId } from "./approval-ids-C6FD3pVY.js";
+import { i as resolveMatrixAccount } from "./accounts-DR1c4xF_.js";
+import { t as normalizeMatrixApproverId } from "./approval-ids-Bst7HM_o.js";
 import { resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
 //#region extensions/matrix/src/approval-reaction-auth.ts
 function normalizeMatrixExecApproverId(value) {

package/dist/{approval-reactions-tXh9KYrW.js → approval-reactions-1fwEhoK9.js}

@@ -24,7 +24,7 @@ const MATRIX_APPROVAL_REACTION_ORDER = [
 ];
 const PERSISTENT_NAMESPACE = "matrix.approval-reactions";
 const PERSISTENT_MAX_ENTRIES = 1e3;
-const DEFAULT_REACTION_TARGET_TTL_MS = 1440 * 60 * 1e3;
+const DEFAULT_REACTION_TARGET_TTL_MS = 864e5;
 const reportPersistentApprovalReactionError = createPluginStateErrorReporter(getOptionalMatrixRuntime, "matrix", "approval-reaction-state", "Matrix persistent approval reaction state failed");
 function readPersistedTarget(target) {
 	const value = target;

package/dist/{channel-CBEvelTE.js → channel-Bs8VLb6q.js}

@@ -1,10 +1,10 @@
-import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-CWuhuFn1.js";
-import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import { i as resolveMatrixAccount, r as resolveDefaultMatrixAccountId, t as listMatrixAccountIds } from "./accounts-BCzyubQt.js";
-import { a as normalizeMatrixUserId, r as DEFAULT_ACCOUNT_ID$2, t as matrixPluginBase } from "./channel.setup-sWPOGyQG.js";
-import { t as normalizeMatrixApproverId } from "./approval-ids-C6FD3pVY.js";
+import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-DA-jfx22.js";
+import { a as resolveMatrixAccountConfig } from "./account-config-CRsKoMqJ.js";
+import { i as resolveMatrixAccount, r as resolveDefaultMatrixAccountId, t as listMatrixAccountIds } from "./accounts-DR1c4xF_.js";
+import { a as normalizeMatrixUserId, r as DEFAULT_ACCOUNT_ID$2, t as matrixPluginBase } from "./channel.setup-DhmDXwPp.js";
+import { t as normalizeMatrixApproverId } from "./approval-ids-Bst7HM_o.js";
 import { a as resolveMatrixDirectUserId, i as normalizeMatrixResolvableTarget, n as isMatrixRoomId, o as resolveMatrixTargetIdentity, r as normalizeMatrixMessagingTarget, t as isMatrixQualifiedUserId } from "./target-ids-Nwx7cMVE.js";
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-DEt4O4Zt.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-HyWFZQVG.js";
 import { n as MATRIX_REACTION_EVENT_TYPE } from "./reaction-common-DkrQdBSZ.js";
 import { f as setMatrixThreadBindingMaxAgeBySessionKey, u as setMatrixThreadBindingIdleTimeoutBySessionKey } from "./thread-bindings-shared-oNPiyMWY.js";
 import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-CufozuyJ.js";
@@ -32,12 +32,12 @@ import { createChannelExecApprovalProfile, getExecApprovalReplyMetadata, isChann
 import { createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
 import { PAIRING_APPROVED_MESSAGE } from "openclaw/plugin-sdk/channel-status";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { buildAgentSessionKey, deriveLastRoutePolicy, parseAgentSessionKey, parseThreadSessionSuffix, resolveAgentIdFromSessionKey, resolveAgentRoute, resolveThreadSessionKeys } from "openclaw/plugin-sdk/routing";
+import { buildAgentSessionKey, deriveLastRoutePolicy, parseThreadSessionSuffix, resolveAgentIdFromSessionKey, resolveAgentRoute, resolveThreadSessionKeys } from "openclaw/plugin-sdk/routing";
 import { formatLocationText, logInboundDrop, toLocationContext } from "openclaw/plugin-sdk/channel-inbound";
 import { getAgentScopedMediaLocalRoots } from "openclaw/plugin-sdk/media-local-roots";
 import { buildChannelKeyCandidates } from "openclaw/plugin-sdk/channel-targets";
 import { resolveConfiguredAcpBindingRecord } from "openclaw/plugin-sdk/acp-binding-resolve-runtime";
-import { inspectSessionBindingByConversation } from "openclaw/plugin-sdk/session-binding-runtime";
+import { resolveRuntimeConversationBindingRoute } from "openclaw/plugin-sdk/conversation-binding-runtime";
 import { deliveryContextFromSession, getSessionEntry, resolveStorePath, sessionDeliveryOrigin } from "openclaw/plugin-sdk/session-store-runtime";
 //#region extensions/matrix/src/actions.ts
 const MATRIX_PLUGIN_HANDLED_ACTIONS = /* @__PURE__ */ new Set([
@@ -149,7 +149,7 @@ const matrixMessageActions = {
 		return account && createActionGate(account.config.actions)("messages") ? payload : null;
 	},
 	handleAction: async (ctx) => {
-		const { handleMatrixAction } = await import("./tool-actions.runtime-DD6jUxFK.js");
+		const { handleMatrixAction } = await import("./tool-actions.runtime-a5L5xGSP.js");
 		const { action, params, cfg, accountId, mediaLocalRoots } = ctx;
 		const dispatch = async (actionParams) => await handleMatrixAction({
 			...actionParams,
@@ -412,9 +412,10 @@ const isMatrixExecApprovalClientEnabled = matrixExecApprovalProfile.isClientEnab
 const isMatrixExecApprovalAuthorizedSender = matrixExecApprovalProfile.isAuthorizedSender;
 const resolveMatrixExecApprovalTarget = matrixExecApprovalProfile.resolveTarget;
 function isMatrixApprovalClientEnabled(params) {
-	if (params.approvalKind === "exec") return isMatrixExecApprovalClientEnabled(params);
+	if (params.approvalKind === "exec" || params.approvalKind === "system-agent") return isMatrixExecApprovalClientEnabled(params);
+	const config = resolveMatrixExecApprovalConfig(params);
 	return isChannelExecApprovalClientEnabledFromConfig({
-		enabled: resolveMatrixExecApprovalConfig(params)?.enabled,
+		enabled: config?.enabled,
 		approverCount: getMatrixApprovalApprovers(params).length
 	});
 }
@@ -425,10 +426,13 @@ function isMatrixAnyApprovalClientEnabled(params) {
 	}) || isMatrixApprovalClientEnabled({
 		...params,
 		approvalKind: "plugin"
+	}) || isMatrixApprovalClientEnabled({
+		...params,
+		approvalKind: "system-agent"
 	});
 }
 function shouldHandleMatrixApprovalRequest(params) {
-	if (params.approvalKind !== "exec" && params.approvalKind !== "plugin") return false;
+	if (params.approvalKind !== "exec" && params.approvalKind !== "plugin" && params.approvalKind !== "system-agent") return false;
 	if (!matchesMatrixRequestAccount({
 		...params,
 		approvalKind: params.approvalKind
@@ -547,7 +551,7 @@ function resolveSuppressionAccountId(params) {
 const resolveMatrixOriginTarget = createChannelNativeOriginTargetResolver({
 	channel: "matrix",
 	shouldHandleRequest: ({ cfg, accountId, approvalKind, request }) => {
-		if (approvalKind !== "exec" && approvalKind !== "plugin") return false;
+		if (approvalKind !== "exec" && approvalKind !== "plugin" && approvalKind !== "system-agent") return false;
 		return shouldHandleMatrixApprovalRequest({
 			cfg,
 			accountId,
@@ -615,7 +619,11 @@ const matrixNativeApprovalCapability = createApproverRestrictedNativeApprovalCap
 	resolveApproverDmTargets: resolveMatrixApproverDmTargets,
 	notifyOriginWhenDmOnly: true,
 	nativeRuntime: createLazyChannelApprovalNativeRuntimeAdapter({
-		eventKinds: ["exec", "plugin"],
+		eventKinds: [
+			"exec",
+			"plugin",
+			"system-agent"
+		],
 		isConfigured: ({ cfg, accountId }) => isMatrixAnyApprovalClientEnabled({
 			cfg,
 			accountId
@@ -626,7 +634,7 @@ const matrixNativeApprovalCapability = createApproverRestrictedNativeApprovalCap
 			approvalKind,
 			request
 		}),
-		load: async () => (await import("./approval-handler.runtime-G9fLHUWe.js")).matrixApprovalNativeRuntime
+		load: async () => (await import("./approval-handler.runtime-BJCD4dLf.js")).matrixApprovalNativeRuntime
 	})
 });
 const splitMatrixApprovalCapability = splitChannelApprovalCapability(matrixNativeApprovalCapability);
@@ -907,9 +915,6 @@ function resolveMatrixDmSessionKey(params) {
 		}
 	});
 }
-function shouldApplyMatrixPerRoomDmSessionScope(params) {
-	return params.isDirectMessage && !params.configuredSessionKey;
-}
 function resolveMatrixInboundRoute(params) {
 	const baseRoute = params.resolveAgentRoute({
 		cfg: params.cfg,
@@ -926,25 +931,20 @@ function resolveMatrixInboundRoute(params) {
 	});
 	const bindingConversationId = params.threadId ?? params.roomId;
 	const bindingParentConversationId = params.threadId ? params.roomId : void 0;
-	const bindingInspection = inspectSessionBindingByConversation({
+	const bindingRef = {
 		channel: "matrix",
 		accountId: params.accountId,
 		conversationId: bindingConversationId,
 		parentConversationId: bindingParentConversationId
+	};
+	const runtimeRoute = resolveRuntimeConversationBindingRoute({
+		route: baseRoute,
+		conversation: bindingRef,
+		touchBinding: false
 	});
-	const runtimeBinding = bindingInspection.status === "available" ? bindingInspection.binding : null;
-	const boundSessionKey = runtimeBinding?.targetSessionKey?.trim();
-	if (runtimeBinding && boundSessionKey) return {
-		route: {
-			...baseRoute,
-			sessionKey: boundSessionKey,
-			agentId: resolveAgentIdFromSessionKey(boundSessionKey) || baseRoute.agentId,
-			lastRoutePolicy: deriveLastRoutePolicy({
-				sessionKey: boundSessionKey,
-				mainSessionKey: baseRoute.mainSessionKey
-			}),
-			matchedBy: "binding.channel"
-		},
+	const runtimeBinding = runtimeRoute.bindingRecord;
+	if (runtimeBinding && runtimeRoute.boundSessionKey) return {
+		route: runtimeRoute.route,
 		configuredBinding: null,
 		bindingOwnerAvailable: true,
 		runtimeBindingId: runtimeBinding.bindingId
@@ -960,17 +960,14 @@ function resolveMatrixInboundRoute(params) {
 	const effectiveRoute = configuredBinding && configuredSessionKey ? {
 		...baseRoute,
 		sessionKey: configuredSessionKey,
-		agentId: resolveAgentIdFromSessionKey(configuredSessionKey) || configuredBinding.spec.agentId || baseRoute.agentId,
+		agentId: resolveAgentIdFromSessionKey(configuredSessionKey, configuredBinding.spec.agentId),
 		lastRoutePolicy: deriveLastRoutePolicy({
 			sessionKey: configuredSessionKey,
 			mainSessionKey: baseRoute.mainSessionKey
 		}),
 		matchedBy: "binding.channel"
 	} : baseRoute;
-	const dmSessionKey = shouldApplyMatrixPerRoomDmSessionScope({
-		isDirectMessage: params.isDirectMessage,
-		configuredSessionKey
-	}) ? resolveMatrixDmSessionKey({
+	const dmSessionKey = params.isDirectMessage && !configuredSessionKey ? resolveMatrixDmSessionKey({
 		accountId: params.accountId,
 		agentId: effectiveRoute.agentId,
 		roomId: params.roomId,
@@ -999,15 +996,17 @@ function resolveMatrixInboundRoute(params) {
 				})
 			},
 			configuredBinding,
-			bindingOwnerAvailable: bindingInspection.status === "available",
-			runtimeBindingId: runtimeBinding?.bindingId ?? null
+			bindingOwnerAvailable: runtimeRoute.bindingOwnerAvailable ?? true,
+			runtimeBindingId: runtimeBinding?.bindingId ?? null,
+			pluginId: runtimeRoute.pluginId
 		};
 	}
 	return {
 		route: routeWithDmScope,
 		configuredBinding,
-		bindingOwnerAvailable: bindingInspection.status === "available",
-		runtimeBindingId: runtimeBinding?.bindingId ?? null
+		bindingOwnerAvailable: runtimeRoute.bindingOwnerAvailable ?? true,
+		runtimeBindingId: runtimeBinding?.bindingId ?? null,
+		pluginId: runtimeRoute.pluginId
 	};
 }
 //#endregion
@@ -1031,7 +1030,11 @@ function resolveMatrixConversationRouteOwner(params) {
 		resolveAgentRoute
 	});
 	if (!result.bindingOwnerAvailable) return { kind: "unavailable" };
-	if (result.runtimeBindingId && !parseAgentSessionKey(result.route.sessionKey)?.agentId) return null;
+	if (result.pluginId) return {
+		kind: "plugin",
+		pluginId: result.pluginId,
+		fallbackAgentId: result.route.agentId
+	};
 	return {
 		kind: "agent",
 		agentId: result.route.agentId
@@ -1039,7 +1042,7 @@ function resolveMatrixConversationRouteOwner(params) {
 }
 //#endregion
 //#region extensions/matrix/src/resolver.ts
-const loadMatrixChannelRuntime$1 = createLazyRuntimeNamedExport(() => import("./resolver.runtime-p5qJ3Kst.js"), "matrixResolverRuntime");
+const loadMatrixChannelRuntime$1 = createLazyRuntimeNamedExport(() => import("./resolver.runtime-TRmePJDV.js"), "matrixResolverRuntime");
 const matrixResolverAdapter = { resolveTargets: async ({ cfg, accountId, inputs, kind, runtime }) => (await loadMatrixChannelRuntime$1()).resolveMatrixTargets({
 	cfg,
 	accountId,
@@ -1102,8 +1105,9 @@ function resolveMatrixCurrentDmRoomId(params) {
 	const sessionKey = parseThreadSessionSuffix(params.currentSessionKey).baseSessionKey ?? params.currentSessionKey?.trim();
 	if (!sessionKey) return;
 	try {
+		const storePath = resolveStorePath(params.cfg.session?.store, { agentId: params.agentId });
 		const currentSession = resolveMatrixStoredSessionMeta(getSessionEntry({
-			storePath: resolveStorePath(params.cfg.session?.store, { agentId: params.agentId }),
+			storePath,
 			sessionKey
 		}));
 		if (!currentSession) return;
@@ -1139,18 +1143,19 @@ function resolveMatrixOutboundSessionRoute(params) {
 	const chatType = target.kind === "user" ? "direct" : "channel";
 	const from = target.kind === "user" ? `matrix:${target.id}` : `matrix:channel:${target.id}`;
 	const to = `room:${roomScopedDmId ?? target.id}`;
+	const baseRoute = buildChannelOutboundSessionRoute({
+		cfg: params.cfg,
+		agentId: params.agentId,
+		channel: "matrix",
+		accountId: effectiveAccountId,
+		recipientSessionExact: target.kind === "room" ? dmSessionScope === "per-room" && isMatrixRoomId(target.id) : dmSessionScope === "per-user" ? isMatrixQualifiedUserId(target.id) : roomScopedDmId !== void 0,
+		peer,
+		chatType,
+		from,
+		to
+	});
 	return buildThreadAwareOutboundSessionRoute({
-		route: buildChannelOutboundSessionRoute({
-			cfg: params.cfg,
-			agentId: params.agentId,
-			channel: "matrix",
-			accountId: effectiveAccountId,
-			recipientSessionExact: target.kind === "room" ? dmSessionScope === "per-room" && isMatrixRoomId(target.id) : dmSessionScope === "per-user" ? isMatrixQualifiedUserId(target.id) : roomScopedDmId !== void 0,
-			peer,
-			chatType,
-			from,
-			to
-		}),
+		route: baseRoute,
 		replyToId: params.replyToId,
 		threadId: params.threadId,
 		currentSessionKey: params.currentSessionKey,
@@ -1166,8 +1171,8 @@ function resolveMatrixOutboundSessionRoute(params) {
 //#endregion
 //#region extensions/matrix/src/channel.ts
 let matrixStartupLock = Promise.resolve();
-const loadMatrixChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-CiDl9deX.js"), "matrixChannelRuntime");
-const loadMatrixDoctorModule = createLazyRuntimeModule(() => import("./doctor-EWf9CDso.js"));
+const loadMatrixChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-CCJRhdH5.js"), "matrixChannelRuntime");
+const loadMatrixDoctorModule = createLazyRuntimeModule(() => import("./doctor-CJE8wO6y.js"));
 function buildMatrixTrafficStatusSummary(snapshot) {
 	return {
 		lastInboundAt: snapshot?.lastInboundAt ?? null,
@@ -1517,7 +1522,7 @@ const matrixPlugin = createChatChannelPlugin({
 			await previousLock;
 			let monitorMatrixProvider;
 			try {
-				monitorMatrixProvider = (await import("./monitor-DBB47wTy.js")).monitorMatrixProvider;
+				monitorMatrixProvider = (await import("./monitor-DouG43FJ.js")).monitorMatrixProvider;
 			} finally {
 				releaseLock();
 			}

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as matrixPlugin } from "./channel-CBEvelTE.js";
+import { t as matrixPlugin } from "./channel-Bs8VLb6q.js";
 export { matrixPlugin };