@openclaw/matrix 2026.9.4 → 2026.9.5

package/dist/{crypto-runtime-DiyH4R3D.js → .setup/crypto-runtime-9oxuU30y.mjs}

@@ -1,7 +1,7 @@
-import { t as ensureMatrixCryptoRuntime } from "./deps-mtxF2mHI.js";
-import { n as LogService, r as noop } from "./logger-B_71hN6W.js";
-import { i as restoreIdbFromDisk, n as persistIdbToDisk } from "./idb-persistence-DBdwHSWg.js";
-import { n as isRepairableSecretStorageAccessError } from "./sdk-B4By16Bt.js";
+import { t as ensureMatrixCryptoRuntime } from "./deps-mtxF2mHI.mjs";
+import { n as LogService, r as noop } from "./logger-xBjiRIp1.mjs";
+import { i as restoreIdbFromDisk, n as persistIdbToDisk } from "./idb-persistence-CIfFUjP3.mjs";
+import { n as isRepairableSecretStorageAccessError } from "./sdk-BkKE4ANj.mjs";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { formatErrorMessage, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
 import { resolveDateTimestampMs, resolveTimestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
@@ -309,7 +309,7 @@ var MatrixCryptoBootstrapper = class {
 };
 //#endregion
 //#region extensions/matrix/src/matrix/sdk/crypto-facade.ts
-const matrixCryptoNodeRuntimeLoader = createLazyRuntimeModule(() => import("./crypto-node.runtime-6Aj_ltHQ.js"));
+const matrixCryptoNodeRuntimeLoader = createLazyRuntimeModule(() => import("./crypto-node.runtime-6Aj_ltHQ.mjs"));
 async function loadMatrixCryptoNodeRuntime() {
 	try {
 		return await matrixCryptoNodeRuntimeLoader();
@@ -330,7 +330,6 @@ function trackInProgressToDeviceVerifications(deps) {
 }
 function createMatrixCryptoFacade(deps) {
 	return {
-		prepare: async (_joinedRooms) => {},
 		updateSyncData: async (_toDeviceMessages, _otkCounts, _unusedFallbackKeyAlgs, _changedDeviceLists, _leftDeviceLists) => {},
 		isRoomEncrypted: deps.isRoomEncrypted,
 		requestOwnUserVerification: async () => {

package/dist/{crypto-snapshot-doctor.runtime-DxgUMXUy.js → .setup/crypto-snapshot-doctor.runtime-DXpLbQ7y.mjs}

@@ -1,6 +1,6 @@
-import { T as writeMatrixIdbSnapshotJsonToStore, m as openMatrixIdbSnapshotStoreOptions, o as MATRIX_IDB_SNAPSHOT_FILENAME, x as readMatrixIdbSnapshotJsonFromStore } from "./storage-metadata-DYArLcq1.js";
-import { n as MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS } from "./idb-persistence-lock-B3fZXyF_.js";
-import { r as readLegacyMatrixIdbSnapshotStateUnlocked, t as isValidMatrixIdbSnapshotJson } from "./idb-persistence-DBdwHSWg.js";
+import { T as writeMatrixIdbSnapshotJsonToStore, m as openMatrixIdbSnapshotStoreOptions, o as MATRIX_IDB_SNAPSHOT_FILENAME, x as readMatrixIdbSnapshotJsonFromStore } from "./storage-metadata-BQJjHC_i.mjs";
+import { n as MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS } from "./idb-persistence-lock-B3fZXyF_.mjs";
+import { r as readLegacyMatrixIdbSnapshotStateUnlocked, t as isValidMatrixIdbSnapshotJson } from "./idb-persistence-CIfFUjP3.mjs";
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 import fs from "node:fs";

package/dist/{device-health-B4-YXtJR.js → .setup/device-health-CWOuIirq.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 //#region extensions/matrix/src/matrix/device-health.ts
 var device_health_exports = /* @__PURE__ */ __exportAll({
 	isOpenClawManagedMatrixDevice: () => isOpenClawManagedMatrixDevice,

package/dist/.setup/direct-management-B2Bno2xL.mjs

@@ -0,0 +1,346 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { t as isMatrixQualifiedUserId } from "./target-ids-Nwx7cMVE.mjs";
+import { a as MATRIX_REACTION_EVENT_TYPE, i as MATRIX_ANNOTATION_RELATION_TYPE } from "./send-currentness-BrGXL7b8.mjs";
+import { asOptionalRecord, normalizeNullableString, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
+//#region extensions/matrix/src/matrix/send/types.ts
+const MsgType = {
+	Text: "m.text",
+	Image: "m.image",
+	Audio: "m.audio",
+	Video: "m.video",
+	File: "m.file",
+	Notice: "m.notice"
+};
+const RelationType = {
+	Annotation: MATRIX_ANNOTATION_RELATION_TYPE,
+	Replace: "m.replace",
+	Thread: "m.thread"
+};
+const EventType = {
+	Direct: "m.direct",
+	Reaction: MATRIX_REACTION_EVENT_TYPE,
+	RoomMessage: "m.room.message"
+};
+const MATRIX_OPENCLAW_FINALIZED_PREVIEW_KEY = "com.openclaw.finalized_preview";
+/**
+* MSC4357 live marker key.
+* When present on event content, signals that the message is still being
+* streamed (e.g. an LLM generating a response). Supporting clients render
+* the message with a streaming animation until an edit without this marker
+* arrives, indicating the stream is complete.
+* @see https://github.com/matrix-org/matrix-spec-proposals/pull/4357
+*/
+const MSC4357_LIVE_KEY = "org.matrix.msc4357.live";
+//#endregion
+//#region extensions/matrix/src/matrix/relations.ts
+function relatedReplyEventId(relation) {
+	const reply = asOptionalRecord(relation?.["m.in_reply_to"]);
+	return typeof reply?.event_id === "string" ? reply.event_id : void 0;
+}
+function buildMatrixMessageRelation(params) {
+	const threadId = params.threadId?.trim();
+	const replyToId = params.replyToId?.trim();
+	const relatedId = replyToId || (threadId ? params.fallbackReplyToId?.trim() : void 0);
+	const reply = relatedId ? { "m.in_reply_to": { event_id: relatedId } } : void 0;
+	if (!threadId) return reply;
+	return {
+		rel_type: RelationType.Thread,
+		event_id: threadId,
+		...reply,
+		...relatedId && !replyToId ? { is_falling_back: true } : {}
+	};
+}
+function resolveMatrixReplyToEventId(content) {
+	const relation = asOptionalRecord(content["m.relates_to"]);
+	return relation?.rel_type === RelationType.Thread && relation.is_falling_back === true ? void 0 : relatedReplyEventId(relation);
+}
+function resolveMatrixThreadRootId(content) {
+	const relation = asOptionalRecord(content["m.relates_to"]);
+	if (relation?.rel_type !== RelationType.Thread) return;
+	return typeof relation.event_id === "string" ? relation.event_id : relatedReplyEventId(relation);
+}
+//#endregion
+//#region extensions/matrix/src/matrix/direct-room.ts
+var direct_room_exports = /* @__PURE__ */ __exportAll({
+	hasDirectMatrixMemberFlag: () => hasDirectMatrixMemberFlag,
+	inspectMatrixDirectRoomEvidence: () => inspectMatrixDirectRoomEvidence,
+	isStrictDirectMembership: () => isStrictDirectMembership,
+	isStrictDirectRoom: () => isStrictDirectRoom,
+	readJoinedMatrixMembers: () => readJoinedMatrixMembers
+});
+function normalizeJoinedMatrixMembers(joinedMembers) {
+	if (!Array.isArray(joinedMembers)) return [];
+	return joinedMembers.map((entry) => normalizeNullableString(entry)).filter((entry) => Boolean(entry));
+}
+function isStrictDirectMembership(params) {
+	const selfUserId = normalizeNullableString(params.selfUserId);
+	const remoteUserId = normalizeNullableString(params.remoteUserId);
+	const joinedMembers = params.joinedMembers ?? [];
+	return Boolean(selfUserId && remoteUserId && joinedMembers.length === 2 && joinedMembers.includes(selfUserId) && joinedMembers.includes(remoteUserId));
+}
+async function readJoinedMatrixMembers(client, roomId) {
+	try {
+		return normalizeJoinedMatrixMembers(await client.getJoinedRoomMembers(roomId));
+	} catch {
+		return null;
+	}
+}
+async function hasDirectMatrixMemberFlag(client, roomId, userId) {
+	const normalizedUserId = normalizeNullableString(userId);
+	if (!normalizedUserId) return null;
+	try {
+		const state = await client.getRoomStateEvent(roomId, "m.room.member", normalizedUserId);
+		if (state?.is_direct === true) return true;
+		if (state?.is_direct === false) return false;
+		return null;
+	} catch {
+		return null;
+	}
+}
+async function inspectMatrixDirectRoomEvidence(params) {
+	const selfUserId = params.selfUserId !== void 0 ? normalizeNullableString(params.selfUserId) : normalizeNullableString(await params.client.getUserId().catch(() => null));
+	const joinedMembers = await readJoinedMatrixMembers(params.client, params.roomId);
+	const strict = isStrictDirectMembership({
+		selfUserId,
+		remoteUserId: params.remoteUserId,
+		joinedMembers
+	});
+	if (!strict) return {
+		joinedMembers,
+		strict: false,
+		viaMemberState: false,
+		memberStateFlag: null
+	};
+	const memberStateFlag = await hasDirectMatrixMemberFlag(params.client, params.roomId, selfUserId);
+	return {
+		joinedMembers,
+		strict,
+		viaMemberState: memberStateFlag === true,
+		memberStateFlag
+	};
+}
+async function isStrictDirectRoom(params) {
+	return (await inspectMatrixDirectRoomEvidence({
+		client: params.client,
+		roomId: params.roomId,
+		remoteUserId: params.remoteUserId,
+		selfUserId: params.selfUserId
+	})).strict;
+}
+//#endregion
+//#region extensions/matrix/src/matrix/direct-management.ts
+var direct_management_exports = /* @__PURE__ */ __exportAll({
+	inspectMatrixDirectRooms: () => inspectMatrixDirectRooms,
+	persistMatrixDirectRoomMapping: () => persistMatrixDirectRoomMapping,
+	promoteMatrixDirectRoomCandidate: () => promoteMatrixDirectRoomCandidate,
+	repairMatrixDirectRooms: () => repairMatrixDirectRooms
+});
+const DIRECT_ACCOUNT_DATA_QUEUE_KEY = EventType.Direct;
+const directAccountDataWriteQueues = /* @__PURE__ */ new WeakMap();
+async function readMatrixDirectAccountData(client) {
+	try {
+		const direct = await client.getAccountData(EventType.Direct);
+		return direct && typeof direct === "object" && !Array.isArray(direct) ? direct : {};
+	} catch {
+		return {};
+	}
+}
+function normalizeRemoteUserId(remoteUserId) {
+	const normalized = normalizeOptionalString(remoteUserId) ?? "";
+	if (!isMatrixQualifiedUserId(normalized)) throw new Error(`Matrix user IDs must be fully qualified (got "${remoteUserId}")`);
+	return normalized;
+}
+function normalizeMappedRoomIds(direct, remoteUserId) {
+	const current = direct[remoteUserId];
+	if (!Array.isArray(current)) return [];
+	const seen = /* @__PURE__ */ new Set();
+	const normalized = [];
+	for (const value of current) {
+		const roomId = normalizeOptionalString(value) ?? "";
+		if (!roomId || seen.has(roomId)) continue;
+		seen.add(roomId);
+		normalized.push(roomId);
+	}
+	return normalized;
+}
+function normalizeRoomIdList(values) {
+	const seen = /* @__PURE__ */ new Set();
+	const normalized = [];
+	for (const value of values) {
+		const roomId = value.trim();
+		if (!roomId || seen.has(roomId)) continue;
+		seen.add(roomId);
+		normalized.push(roomId);
+	}
+	return normalized;
+}
+function hasMatrixDirectRoomMappings(params) {
+	const current = normalizeMappedRoomIds(params.directContent, params.remoteUserId);
+	const next = normalizeRoomIdList([...params.roomIds, ...current]);
+	return current.length === next.length && current.every((roomId, index) => roomId === next[index]);
+}
+function resolveDirectAccountDataWriteQueue(client) {
+	const existing = directAccountDataWriteQueues.get(client);
+	if (existing) return existing;
+	const created = new KeyedAsyncQueue();
+	directAccountDataWriteQueues.set(client, created);
+	return created;
+}
+async function writeMatrixDirectRoomMappings(params) {
+	return await resolveDirectAccountDataWriteQueue(params.client).enqueue(DIRECT_ACCOUNT_DATA_QUEUE_KEY, async () => {
+		const directContentBefore = await readMatrixDirectAccountData(params.client);
+		const directContentAfter = buildNextDirectContent({
+			directContent: directContentBefore,
+			remoteUserId: params.remoteUserId,
+			roomIds: params.roomIds
+		});
+		const changed = !hasMatrixDirectRoomMappings({
+			directContent: directContentBefore,
+			remoteUserId: params.remoteUserId,
+			roomIds: params.roomIds
+		});
+		if (changed) await params.client.setAccountData(EventType.Direct, directContentAfter);
+		return {
+			changed,
+			directContentBefore,
+			directContentAfter
+		};
+	});
+}
+async function classifyDirectRoomCandidate(params) {
+	const evidence = await inspectMatrixDirectRoomEvidence({
+		client: params.client,
+		roomId: params.roomId,
+		remoteUserId: params.remoteUserId,
+		selfUserId: params.selfUserId
+	});
+	return {
+		roomId: params.roomId,
+		joinedMembers: evidence.joinedMembers,
+		strict: evidence.strict && (params.source === "account-data" || evidence.memberStateFlag !== false),
+		explicit: evidence.strict && (params.source === "account-data" || evidence.memberStateFlag !== false) && (params.source === "account-data" || evidence.viaMemberState),
+		source: params.source
+	};
+}
+function buildNextDirectContent(params) {
+	const current = normalizeMappedRoomIds(params.directContent, params.remoteUserId);
+	const nextRooms = normalizeRoomIdList([...params.roomIds, ...current]);
+	return {
+		...params.directContent,
+		[params.remoteUserId]: nextRooms
+	};
+}
+async function persistMatrixDirectRoomMapping(params) {
+	const remoteUserId = normalizeRemoteUserId(params.remoteUserId);
+	return (await writeMatrixDirectRoomMappings({
+		client: params.client,
+		remoteUserId,
+		roomIds: [params.roomId]
+	})).changed;
+}
+async function promoteMatrixDirectRoomCandidate(params) {
+	const remoteUserId = normalizeRemoteUserId(params.remoteUserId);
+	const evidence = await inspectMatrixDirectRoomEvidence({
+		client: params.client,
+		roomId: params.roomId,
+		remoteUserId,
+		selfUserId: params.selfUserId
+	});
+	if (!evidence.strict) return {
+		classifyAsDirect: false,
+		repaired: false,
+		reason: "not-strict"
+	};
+	if (evidence.memberStateFlag === false) return {
+		classifyAsDirect: false,
+		repaired: false,
+		reason: "local-explicit-false"
+	};
+	try {
+		const repaired = await persistMatrixDirectRoomMapping({
+			client: params.client,
+			remoteUserId,
+			roomId: params.roomId
+		});
+		return {
+			classifyAsDirect: true,
+			repaired,
+			roomId: params.roomId,
+			reason: repaired ? "promoted" : "already-mapped"
+		};
+	} catch {
+		return {
+			classifyAsDirect: true,
+			repaired: false,
+			roomId: params.roomId,
+			reason: "repair-failed"
+		};
+	}
+}
+async function inspectMatrixDirectRooms(params) {
+	const remoteUserId = normalizeRemoteUserId(params.remoteUserId);
+	const selfUserId = normalizeOptionalString(await params.client.getUserId().catch(() => null)) ?? null;
+	const mappedRoomIds = normalizeMappedRoomIds(await readMatrixDirectAccountData(params.client), remoteUserId);
+	const mappedRooms = await Promise.all(mappedRoomIds.map(async (roomId) => await classifyDirectRoomCandidate({
+		client: params.client,
+		roomId,
+		remoteUserId,
+		selfUserId,
+		source: "account-data"
+	})));
+	const mappedStrict = mappedRooms.find((room) => room.strict);
+	let joinedRooms = [];
+	if (typeof params.client.getJoinedRooms === "function") try {
+		const resolved = await params.client.getJoinedRooms();
+		joinedRooms = Array.isArray(resolved) ? resolved : [];
+	} catch {
+		joinedRooms = [];
+	}
+	const discoveredStrictRooms = [];
+	for (const roomId of normalizeRoomIdList(joinedRooms)) {
+		if (mappedRoomIds.includes(roomId)) continue;
+		const candidate = await classifyDirectRoomCandidate({
+			client: params.client,
+			roomId,
+			remoteUserId,
+			selfUserId,
+			source: "joined"
+		});
+		if (candidate.strict) discoveredStrictRooms.push(candidate);
+	}
+	const discoveredStrictRoomIds = discoveredStrictRooms.map((room) => room.roomId);
+	const discoveredExplicit = discoveredStrictRooms.find((room) => room.explicit);
+	return {
+		selfUserId,
+		remoteUserId,
+		mappedRoomIds,
+		mappedRooms,
+		discoveredStrictRoomIds,
+		activeRoomId: mappedStrict?.roomId ?? discoveredExplicit?.roomId ?? discoveredStrictRoomIds[0] ?? null
+	};
+}
+async function repairMatrixDirectRooms(params) {
+	const remoteUserId = normalizeRemoteUserId(params.remoteUserId);
+	const inspected = await inspectMatrixDirectRooms({
+		client: params.client,
+		remoteUserId
+	});
+	const activeRoomId = inspected.activeRoomId ?? await params.client.createDirectRoom(remoteUserId, { encrypted: params.encrypted === true });
+	const createdRoomId = inspected.activeRoomId ? null : activeRoomId;
+	const mappingWrite = await writeMatrixDirectRoomMappings({
+		client: params.client,
+		remoteUserId,
+		roomIds: [activeRoomId, ...inspected.discoveredStrictRoomIds]
+	});
+	return {
+		...inspected,
+		activeRoomId,
+		createdRoomId,
+		changed: mappingWrite.changed,
+		directContentBefore: mappingWrite.directContentBefore,
+		directContentAfter: mappingWrite.directContentAfter
+	};
+}
+//#endregion
+export { MsgType as _, repairMatrixDirectRooms as a, isStrictDirectMembership as c, buildMatrixMessageRelation as d, resolveMatrixReplyToEventId as f, MSC4357_LIVE_KEY as g, MATRIX_OPENCLAW_FINALIZED_PREVIEW_KEY as h, promoteMatrixDirectRoomCandidate as i, isStrictDirectRoom as l, EventType as m, inspectMatrixDirectRooms as n, direct_room_exports as o, resolveMatrixThreadRootId as p, persistMatrixDirectRoomMapping as r, hasDirectMatrixMemberFlag as s, direct_management_exports as t, readJoinedMatrixMembers as u, RelationType as v };

package/dist/{directory-live-B8-GAVcc.js → .setup/directory-live-CatwztQc.mjs}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { r as normalizeMatrixMessagingTarget, t as isMatrixQualifiedUserId } from "./target-ids-Nwx7cMVE.js";
-import { l as resolveMatrixAuth } from "./client-CPcRv6ab.js";
-import { t as MatrixAuthedHttpClient } from "./http-client-BfPeF4CE.js";
-import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { r as normalizeMatrixMessagingTarget, t as isMatrixQualifiedUserId } from "./target-ids-Nwx7cMVE.mjs";
+import { u as resolveMatrixAuth } from "./client-DsJUnWlV.mjs";
+import { t as MatrixAuthedHttpClient } from "./http-client-BJjo-iw5.mjs";
+import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/matrix/src/directory-live.ts
 var directory_live_exports = /* @__PURE__ */ __exportAll({
 	listMatrixDirectoryGroupsLive: () => listMatrixDirectoryGroupsLive,
@@ -43,12 +43,14 @@ function createGroupDirectoryEntry(params) {
 	};
 }
 async function requestMatrixJson(client, params) {
-	return await client.requestJson({
+	const result = await client.requestJson({
 		method: params.method,
 		endpoint: params.endpoint,
 		body: params.body,
 		timeoutMs: MATRIX_DIRECTORY_TIMEOUT_MS
 	});
+	if (!isRecord(result)) throw new Error(`Matrix homeserver returned a non-object JSON response for ${params.endpoint}`);
+	return result;
 }
 async function listMatrixDirectoryPeersLive(params) {
 	const query = normalizeOptionalString(params.query) ?? "";

package/dist/{doctor-CJE8wO6y.js → .setup/doctor-BLCvdOFo.mjs}

@@ -1,4 +1,4 @@
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-HyWFZQVG.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-HyWFZQVG.mjs";
 import { detectPluginInstallPathIssue, formatPluginInstallPathIssue, removePluginFromConfig } from "openclaw/plugin-sdk/doctor-repair-runtime";
 //#region extensions/matrix/src/doctor.ts
 async function collectMatrixInstallPathWarnings(cfg) {

package/dist/{draft-stream--NdEtnZ8.js → .setup/draft-stream-DIFZDNrb.mjs}

@@ -1,5 +1,5 @@
-import { a as sendSingleTextMessageMatrix, m as prepareMatrixSingleText, t as editMessageMatrix } from "./send-UWLIQ0bG.js";
-import { i as MsgType } from "./types-DzSc7Sqm.js";
+import { _ as MsgType } from "./direct-management-B2Bno2xL.mjs";
+import { a as sendSingleTextMessageMatrix, m as prepareMatrixSingleText, t as editMessageMatrix } from "./send-h0gZ_-qk.mjs";
 import { createFinalizableDraftStreamControlsForState } from "openclaw/plugin-sdk/channel-outbound";
 //#region extensions/matrix/src/matrix/draft-stream.ts
 const DEFAULT_THROTTLE_MS = 1e3;

package/dist/{encryption-guidance-mDyxJV9U.js → .setup/encryption-guidance-DYEbeYj-.mjs}

@@ -1,5 +1,5 @@
-import { o as resolveMatrixDefaultOrOnlyAccountId } from "./account-selection-Bbtc483D.js";
-import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
+import { o as resolveMatrixDefaultOrOnlyAccountId } from "./account-selection-5koohRSQ.mjs";
+import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.mjs";
 import { normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
 //#region extensions/matrix/src/matrix/encryption-guidance.ts
 function resolveMatrixEncryptionConfigPath(cfg, accountId) {

package/dist/{http-client-BfPeF4CE.js → .setup/http-client-BJjo-iw5.mjs}

@@ -1,6 +1,8 @@
-import { t as buildHttpError } from "./event-helpers-CspuhE9k.js";
+import { t as buildHttpError } from "./event-helpers-CspuhE9k.mjs";
+import { PlatformMessageNotDispatchedError } from "openclaw/plugin-sdk/error-runtime";
 import { parseMediaContentLength } from "openclaw/plugin-sdk/media-runtime";
 import { buildTimeoutAbortSignal } from "openclaw/plugin-sdk/extension-shared";
+import { captureChannelReadAuthority } from "openclaw/plugin-sdk/fetch-runtime";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 import { fetchWithRuntimeDispatcherOrMockedGlobal } from "openclaw/plugin-sdk/runtime-fetch";
 import { closeDispatcher, createPinnedDispatcher, resolvePinnedHostnameWithPolicy } from "openclaw/plugin-sdk/ssrf-dispatcher";
@@ -98,9 +100,17 @@ async function enforceDeclaredResponseSize(params) {
 	throw error;
 }
 async function fetchWithMatrixDispatcher(params) {
+	params.assertCurrent?.();
+	params.init.signal?.throwIfAborted();
+	params.onDispatch?.();
 	return await fetchWithRuntimeDispatcherOrMockedGlobal(params.url, params.init);
 }
 async function fetchWithMatrixGuardedRedirects(params) {
+	const assertDispatchCurrent = () => {
+		params.assertCurrent?.();
+		params.assertSendCurrent?.();
+	};
+	assertDispatchCurrent();
 	let currentUrl = new URL(params.url);
 	let method = (params.init?.method ?? "GET").toUpperCase();
 	let body = params.init?.body;
@@ -113,13 +123,26 @@ async function fetchWithMatrixGuardedRedirects(params) {
 		operation: "matrix.guarded-redirect-fetch",
 		url: params.url
 	});
+	let dispatched = false;
 	for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount += 1) {
 		let dispatcher;
 		try {
-			const pinned = await resolvePinnedHostnameWithPolicy(currentUrl.hostname, { policy: params.ssrfPolicy });
+			assertDispatchCurrent();
+			signal?.throwIfAborted();
+			const pinned = await resolvePinnedHostnameWithPolicy(currentUrl.hostname, {
+				policy: params.ssrfPolicy,
+				signal
+			});
 			dispatcher = createPinnedDispatcher(pinned, params.dispatcherPolicy, params.ssrfPolicy);
+			assertDispatchCurrent();
+			signal?.throwIfAborted();
+			await params.beforeDispatch?.();
 			const response = await fetchWithMatrixDispatcher({
 				url: currentUrl.toString(),
+				assertCurrent: assertDispatchCurrent,
+				onDispatch: () => {
+					dispatched = true;
+				},
 				init: {
 					...params.init,
 					method,
@@ -174,6 +197,11 @@ async function fetchWithMatrixGuardedRedirects(params) {
 		} catch (error) {
 			cleanup();
 			await closeDispatcher(dispatcher);
+			if (!dispatched) {
+				if (error instanceof PlatformMessageNotDispatchedError) throw error;
+				throw new PlatformMessageNotDispatchedError(error instanceof Error ? error.message : "Matrix request rejected before dispatch", { cause: error });
+			}
+			if (error instanceof PlatformMessageNotDispatchedError) throw new AggregateError([error, /* @__PURE__ */ new Error("An earlier Matrix request crossed the fetch boundary")], error.message, { cause: error });
 			throw error;
 		}
 	}
@@ -182,14 +210,27 @@ async function fetchWithMatrixGuardedRedirects(params) {
 }
 function createMatrixGuardedFetch(params) {
 	return (async (resource, init) => {
+		const assertCurrent = params.captureRequestAuthority?.() ?? captureChannelReadAuthority();
+		const assertSendCurrent = params.captureSendCurrentness?.(resource, init);
+		assertCurrent?.();
 		const url = withoutMatrixStateAfterSyncParam(toFetchUrl(resource));
 		const { signal, ...requestInit } = init ?? {};
+		const signals = [
+			params.signal,
+			signal,
+			params.captureRequestSignal?.()
+		].filter((candidate) => candidate != null);
+		const requestSignal = signals.length > 0 ? AbortSignal.any(signals) : void 0;
+		const beforeRequest = params.beforeRequest;
 		const { response, release } = await fetchWithMatrixGuardedRedirects({
 			url,
 			init: requestInit,
-			signal: signal ?? void 0,
+			signal: requestSignal,
+			assertCurrent,
+			assertSendCurrent,
 			ssrfPolicy: params.ssrfPolicy,
-			dispatcherPolicy: params.dispatcherPolicy
+			dispatcherPolicy: params.dispatcherPolicy,
+			beforeDispatch: beforeRequest ? () => beforeRequest(resource, init) : void 0
 		});
 		try {
 			await enforceDeclaredResponseSize({
@@ -198,17 +239,24 @@ function createMatrixGuardedFetch(params) {
 				createError: (length) => /* @__PURE__ */ new Error(`Matrix SDK response exceeds size limit (${length} bytes > ${MATRIX_SDK_RESPONSE_MAX_BYTES} bytes)`)
 			});
 			const body = await readResponseWithLimit$1(response, MATRIX_SDK_RESPONSE_MAX_BYTES, { onOverflow: ({ maxBytes, size }) => /* @__PURE__ */ new Error(`Matrix SDK response exceeds size limit (${size} bytes > ${maxBytes} bytes)`) });
+			assertCurrent?.();
 			return buildBufferedResponse({
 				source: response,
 				body: Uint8Array.from(body),
 				url
 			});
 		} finally {
-			await release();
+			try {
+				await release();
+			} finally {
+				assertCurrent?.();
+			}
 		}
 	});
 }
 async function performMatrixRequest(params) {
+	const assertCurrent = params.assertCurrent ?? captureChannelReadAuthority();
+	assertCurrent?.();
 	const isAbsoluteEndpoint = params.endpoint.startsWith("http://") || params.endpoint.startsWith("https://");
 	if (isAbsoluteEndpoint && params.allowAbsoluteEndpoint !== true) throw new Error(`Absolute Matrix endpoint is blocked by default: ${params.endpoint}. Set allowAbsoluteEndpoint=true to opt in.`);
 	const baseUrl = isAbsoluteEndpoint ? new URL(params.endpoint) : new URL(`${params.homeserver.replace(/\/+$/u, "")}${normalizeEndpoint(params.endpoint)}`);
@@ -233,7 +281,10 @@ async function performMatrixRequest(params) {
 		},
 		timeoutMs: params.timeoutMs,
 		ssrfPolicy: params.ssrfPolicy,
-		dispatcherPolicy: params.dispatcherPolicy
+		dispatcherPolicy: params.dispatcherPolicy,
+		assertCurrent,
+		assertSendCurrent: params.assertSendCurrent,
+		signal: params.signal
 	});
 	try {
 		if (params.raw) {
@@ -247,6 +298,7 @@ async function performMatrixRequest(params) {
 				onOverflow: ({ maxBytes, size }) => new MatrixMediaSizeLimitError(`Matrix media exceeds configured size limit (${size} bytes > ${maxBytes} bytes)`),
 				chunkTimeoutMs: params.readIdleTimeoutMs
 			});
+			assertCurrent?.();
 			return {
 				response,
 				text: bytes.toString("utf8"),
@@ -264,13 +316,18 @@ async function performMatrixRequest(params) {
 			chunkTimeoutMs: params.readIdleTimeoutMs,
 			onIdleTimeout: ({ chunkTimeoutMs }) => /* @__PURE__ */ new Error(`Matrix JSON response stalled: no data received for ${chunkTimeoutMs}ms`)
 		});
+		assertCurrent?.();
 		return {
 			response,
 			text: buffer.toString("utf8"),
 			buffer
 		};
 	} finally {
-		await release();
+		try {
+			await release();
+		} finally {
+			assertCurrent?.();
+		}
 	}
 }
 //#endregion
@@ -281,6 +338,9 @@ var MatrixAuthedHttpClient = class {
 		this.accessToken = params.accessToken;
 		this.ssrfPolicy = params.ssrfPolicy;
 		this.dispatcherPolicy = params.dispatcherPolicy;
+		this.captureRequestAuthority = params.captureRequestAuthority;
+		this.captureSendCurrentness = params.captureSendCurrentness;
+		this.signal = params.signal;
 	}
 	async requestJson(params) {
 		const { response, text } = await performMatrixRequest({
@@ -293,7 +353,10 @@ var MatrixAuthedHttpClient = class {
 			timeoutMs: params.timeoutMs,
 			ssrfPolicy: this.ssrfPolicy,
 			dispatcherPolicy: this.dispatcherPolicy,
-			allowAbsoluteEndpoint: params.allowAbsoluteEndpoint
+			allowAbsoluteEndpoint: params.allowAbsoluteEndpoint,
+			assertCurrent: this.captureRequestAuthority?.(),
+			assertSendCurrent: this.captureSendCurrentness?.(),
+			signal: this.signal
 		});
 		if (!response.ok) throw buildHttpError(response.status, text);
 		if ((response.headers.get("content-type") ?? "").split(";", 1)[0]?.trim().toLowerCase() === "application/json") {
@@ -319,7 +382,10 @@ var MatrixAuthedHttpClient = class {
 			readIdleTimeoutMs: params.readIdleTimeoutMs,
 			ssrfPolicy: this.ssrfPolicy,
 			dispatcherPolicy: this.dispatcherPolicy,
-			allowAbsoluteEndpoint: params.allowAbsoluteEndpoint
+			allowAbsoluteEndpoint: params.allowAbsoluteEndpoint,
+			assertCurrent: this.captureRequestAuthority?.(),
+			assertSendCurrent: this.captureSendCurrentness?.(),
+			signal: this.signal
 		});
 		if (!response.ok) throw buildHttpError(response.status, buffer.toString("utf8"));
 		return buffer;