@openclaw/matrix 2026.9.4 → 2026.9.6

package/dist/{channel.setup-DmS7m7aT.js → .setup/channel.setup-C6KvBV8l.mjs}

@@ -1,6 +1,6 @@
-import { a as resolveMatrixAccountConfig } from "./account-config-CRsKoMqJ.js";
-import { i as resolveMatrixAccount, r as resolveDefaultMatrixAccountId, t as listMatrixAccountIds } from "./accounts-GwSAk9vY.js";
-import { r as matrixSetupContract, t as createMatrixSetupWizardProxy } from "./setup-core-8keb-Yre.js";
+import { a as resolveMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
+import { i as resolveMatrixAccount, r as resolveDefaultMatrixAccountId, t as listMatrixAccountIds } from "./accounts-iThMol10.mjs";
+import { r as matrixSetupContract, t as createMatrixSetupWizardProxy } from "./setup-core-D2hMbIi3.mjs";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createChannelConfigUiHints } from "openclaw/plugin-sdk/channel-core";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
@@ -232,7 +232,11 @@ const MatrixConfigSchema = z.object({
 	configWrites: z.boolean().optional(),
 	joinIntro: z.boolean().optional(),
 	defaultAccount: z.string().optional(),
-	accounts: z.record(z.string(), z.object({ joinIntro: z.boolean().optional() }).passthrough().refine(hasCanonicalMatrixAccountStreaming, { message: "flat or scalar streaming values are no longer supported; use streaming.* and run \"openclaw doctor --fix\"" })).optional(),
+	accounts: z.record(z.string(), z.object({
+		joinIntro: z.boolean().optional(),
+		accessToken: buildSecretInputSchema().optional(),
+		password: buildSecretInputSchema().optional()
+	}).passthrough().refine(hasCanonicalMatrixAccountStreaming, { message: "flat or scalar streaming values are no longer supported; use streaming.* and run \"openclaw doctor --fix\"" })).optional(),
 	markdown: MarkdownConfigSchema,
 	homeserver: z.string().optional(),
 	network: matrixNetworkSchema,
@@ -314,7 +318,7 @@ const matrixPluginBase = {
 		order: 70,
 		quickstartAllowFrom: true
 	},
-	setupWizard: createMatrixSetupWizardProxy(async () => ({ matrixSetupWizard: (await import("./setup-surface-bcluelBI.js").then((n) => n.t)).matrixSetupWizard })),
+	setupWizard: createMatrixSetupWizardProxy(async () => ({ matrixSetupWizard: (await import("./setup-surface-BL3ha1l-.mjs").then((n) => n.t)).matrixSetupWizard })),
 	setupContract: matrixSetupContract,
 	capabilities: {
 		chatTypes: [

package/dist/{cli-CLexRrQw.js → .setup/cli-O196sg8g.mjs}

@@ -1,22 +1,22 @@
-import { a as resolveMatrixAccountConfig, n as hasExplicitMatrixAccountConfig } from "./account-config-CRsKoMqJ.js";
-import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import { i as resolveMatrixAccount } from "./accounts-GwSAk9vY.js";
-import { n as resolveMatrixConfigPath, r as updateMatrixAccountConfig } from "./config-update-BnX26jCO.js";
-import { n as matrixSetupAdapter } from "./setup-core-8keb-Yre.js";
-import { n as withResolvedActionClient } from "./client-C0nZFCTj.js";
-import { u as resolveMatrixAuthContext } from "./client-CPcRv6ab.js";
-import { t as resolveMatrixRoomKeyBackupIssue } from "./backup-health-Dm_YMVFT.js";
-import { i as setMatrixSdkLogMode, r as setMatrixSdkConsoleLogging } from "./logging-DRjvUOIh.js";
-import { n as isOpenClawManagedMatrixDevice, r as summarizeMatrixDeviceHealth } from "./device-health-B4-YXtJR.js";
-import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-vnhxwjEt.js";
-import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-BbG-VC9S.js";
+import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
+import { a as resolveMatrixAccountConfig, n as hasExplicitMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
+import { i as resolveMatrixAccount } from "./accounts-iThMol10.mjs";
+import { n as resolveMatrixConfigPath, r as updateMatrixAccountConfig } from "./config-update-B_4qZ5bV.mjs";
+import { n as matrixSetupAdapter } from "./setup-core-D2hMbIi3.mjs";
+import { n as withResolvedActionClient } from "./client-C2yVkVdw.mjs";
+import { f as resolveMatrixAuthContext } from "./client-ChrXpxos.mjs";
+import { t as resolveMatrixRoomKeyBackupIssue } from "./backup-health-Dm_YMVFT.mjs";
+import { i as setMatrixSdkLogMode, r as setMatrixSdkConsoleLogging } from "./logging-rgm8ep9H.mjs";
+import { n as isOpenClawManagedMatrixDevice, r as summarizeMatrixDeviceHealth } from "./device-health-CWOuIirq.mjs";
+import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-DrblJttE.mjs";
+import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-0o8MOW9T.mjs";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { parseStrictInteger, timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import { formatZonedTimestamp } from "openclaw/plugin-sdk/time-runtime";
-import { isDeepStrictEqual } from "node:util";
 import { readByteStreamWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
+import { isDeepStrictEqual } from "node:util";
 import { getRuntimeConfigSnapshot, getRuntimeConfigSourceSnapshot } from "openclaw/plugin-sdk/runtime-config-snapshot";
 //#region extensions/matrix/src/cli-shared.ts
 let matrixCliExitScheduled = false;
@@ -448,7 +448,7 @@ async function addMatrixAccount(params) {
 			backupVersion: null
 		};
 		if (accountConfig.encryption === true) {
-			const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-sVqkwtSY.js");
+			const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-A_WGFq1Y.mjs");
 			verificationBootstrap = await maybeBootstrapNewEncryptedMatrixAccount({
 				previousCfg: cfg,
 				cfg: updated,
@@ -636,8 +636,8 @@ function registerMatrixDeviceCommands(root) {
 }
 //#endregion
 //#region extensions/matrix/src/cli-direct.ts
-const loadMatrixActionClientModule = createLazyRuntimeModule(() => import("./client-C0nZFCTj.js").then((n) => n.t));
-const loadMatrixDirectManagementModule = createLazyRuntimeModule(() => import("./send-UWLIQ0bG.js").then((n) => n.k));
+const loadMatrixActionClientModule = createLazyRuntimeModule(() => import("./client-C2yVkVdw.mjs").then((n) => n.t));
+const loadMatrixDirectManagementModule = createLazyRuntimeModule(() => import("./direct-management-B2Bno2xL.mjs").then((n) => n.t));
 function printDirectRoomCandidate(room) {
 	const members = room.joinedMembers === null ? "unavailable" : room.joinedMembers.map((member) => formatMatrixCliText(member)).join(", ") || "none";
 	console.log(`- ${formatMatrixCliText(room.roomId)} [${room.source}] strict=${room.strict ? "yes" : "no"} joined=${members}`);
@@ -678,7 +678,7 @@ async function inspectMatrixDirectRoom(params) {
 }
 async function repairMatrixDirectRoom(params) {
 	const cfg = getMatrixRuntime().config.current();
-	const account = resolveMatrixAccount({
+	const accountConfig = resolveMatrixAccountConfig({
 		cfg,
 		accountId: params.accountId
 	});
@@ -690,7 +690,7 @@ async function repairMatrixDirectRoom(params) {
 		const repaired = await repairMatrixDirectRooms({
 			client,
 			remoteUserId: params.userId,
-			encrypted: account.config.encryption === true
+			encrypted: accountConfig.encryption === true
 		});
 		return {
 			accountId: params.accountId,
@@ -700,7 +700,7 @@ async function repairMatrixDirectRoom(params) {
 			mappedRooms: repaired.mappedRooms.map(toCliDirectRoomCandidate),
 			discoveredStrictRoomIds: repaired.discoveredStrictRoomIds,
 			activeRoomId: repaired.activeRoomId,
-			encrypted: account.config.encryption === true,
+			encrypted: accountConfig.encryption === true,
 			createdRoomId: repaired.createdRoomId,
 			changed: repaired.changed,
 			directContentBefore: repaired.directContentBefore,

package/dist/{cli-metadata-zRyVmUOL.js → .setup/cli-metadata-DFHQj5XR.mjs}

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/matrix/src/cli-metadata.ts
 function registerMatrixCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerMatrixCli } = await import("./cli-CLexRrQw.js");
+		const { registerMatrixCli } = await import("./cli-O196sg8g.mjs");
 		registerMatrixCli({ program });
 	}, { descriptors: [{
 		name: "matrix",

package/dist/{client-C0nZFCTj.js → .setup/client-C2yVkVdw.mjs}

@@ -1,13 +1,15 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { O as resolveMatrixRoomId } from "./send-UWLIQ0bG.js";
-import { n as withResolvedRuntimeMatrixClient } from "./client-bootstrap-DLN-K8Xb.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { E as resolveMatrixRoomId } from "./send-aVdC5NJO.mjs";
+import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 //#region extensions/matrix/src/matrix/actions/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
 	withResolvedActionClient: () => withResolvedActionClient,
 	withResolvedRoomAction: () => withResolvedRoomAction,
 	withStartedActionClient: () => withStartedActionClient
 });
+const loadMatrixActionClientRuntime = createLazyRuntimeModule(() => import("./client-bootstrap-BSnUAoz1.mjs"));
 async function withResolvedActionClient(opts, run, mode = "stop") {
+	const { withResolvedRuntimeMatrixClient } = await loadMatrixActionClientRuntime();
 	return await withResolvedRuntimeMatrixClient(opts, run, mode);
 }
 async function withStartedActionClient(opts, run) {

package/dist/{client-CPcRv6ab.js → .setup/client-ChrXpxos.mjs}

@@ -1,43 +1,32 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as resolveScopedMatrixEnvConfig, o as resolveMatrixDefaultOrOnlyAccountId, r as requiresExplicitMatrixDefaultAccount, s as resolveGlobalMatrixEnvConfig, u as resolveMatrixAccountStringValues } from "./account-selection-Bbtc483D.js";
-import { t as getMatrixScopedEnvVarNames } from "./env-vars-dGqak9dN.js";
-import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as findMatrixAccountConfig } from "./account-config-CRsKoMqJ.js";
-import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
-import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
-import { i as repairCurrentTokenStorageMetaDeviceId, n as maybeMigrateLegacyStorage, o as resolveMatrixStoragePaths, s as writeStorageMeta } from "./storage-CV-pfV_2.js";
-import { n as LogService } from "./logger-B_71hN6W.js";
-import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
-import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { n as getMatrixRuntimeLifecycle } from "./runtime-1kn1P6io.mjs";
+import { c as resolveGlobalMatrixEnvConfig, d as resolveMatrixAccountStringValues, i as requiresExplicitMatrixDefaultAccount, s as resolveMatrixDefaultOrOnlyAccountId, u as resolveScopedMatrixEnvConfig } from "./account-selection-BHkfU1eC.mjs";
+import { t as getMatrixScopedEnvVarNames } from "./env-vars-dGqak9dN.mjs";
+import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as findMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
+import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.mjs";
+import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.mjs";
+import { i as repairCurrentTokenStorageMetaDeviceId } from "./storage-BXaFc0S4.mjs";
+import { createLazyRuntimeMethod, createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
 import { coerceSecretRef, isBuiltInDefaultSecretProviderRef, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { formatErrorMessage, toErrorObject, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
 import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
 import { isPrivateNetworkOptInEnabled, ssrfPolicyFromDangerouslyAllowPrivateNetwork } from "openclaw/plugin-sdk/ssrf-runtime";
-import fs from "node:fs";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { AsyncLocalStorage } from "node:async_hooks";
-//#region extensions/matrix/src/matrix/client/config.ts
-const loadMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-B4By16Bt.js").then((n) => n.t), import("./logging-DRjvUOIh.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
+//#region extensions/matrix/src/matrix/client/auth-request.ts
+const loadMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-rqFjgltR.mjs").then((n) => n.t), import("./logging-rgm8ep9H.mjs").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
 	MatrixClient: sdkModule.MatrixClient,
 	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
 })));
 const MATRIX_AUTH_REQUEST_RETRY_RE = /\b(fetch failed|econnreset|econnrefused|enotfound|etimedout|ehostunreach|enetunreach|eai_again|und_err_|socket hang up|network|headers timeout|body timeout|connect timeout)\b/i;
-const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-WWpqi88V.js").then((n) => n.r));
-const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-write.runtime-D22lPwRO.js"));
-const loadMatrixSecretInputDeps = createLazyRuntimeModule(() => import("./config-secret-input.runtime-CwsP3--c.js"));
 function shouldRetryMatrixAuthRequest(err) {
 	return MATRIX_AUTH_REQUEST_RETRY_RE.test(formatErrorMessage(err));
 }
-function isAbortSignalTriggered(signal) {
-	return signal?.aborted === true;
-}
-function credentialsMatchBackfillAuthLineage(params) {
-	if (!params.stored) return true;
-	return params.stored.homeserver === params.auth.homeserver && params.stored.userId === params.auth.userId && params.stored.accessToken === params.auth.accessToken;
-}
 async function retryMatrixAuthRequest(label, run, signal) {
 	return await retryAsync(run, {
 		attempts: 3,
@@ -49,15 +38,68 @@ async function retryMatrixAuthRequest(label, run, signal) {
 		sleep: (ms) => sleepWithAbort(ms, signal)
 	});
 }
+var MatrixWhoamiCleanupError = class extends AggregateError {};
 async function fetchMatrixWhoamiIdentity(params) {
 	const { MatrixClient, ensureMatrixSdkLoggingConfigured } = await loadMatrixAuthClientDeps();
+	params.signal?.throwIfAborted();
 	ensureMatrixSdkLoggingConfigured();
 	const tempClient = new MatrixClient(params.homeserver, params.accessToken, {
 		userId: params.userId,
 		ssrfPolicy: params.ssrfPolicy,
 		dispatcherPolicy: params.dispatcherPolicy
 	});
-	return await retryMatrixAuthRequest("matrix auth whoami", async () => await tempClient.doRequest("GET", "/_matrix/client/v3/account/whoami"), params.signal);
+	let stopping;
+	const stop = () => stopping ??= tempClient.stopWithoutPersist();
+	const onAbort = () => {
+		stop().catch(() => {});
+	};
+	params.signal?.addEventListener("abort", onAbort, { once: true });
+	let outcome;
+	let cleanupFailure;
+	try {
+		params.signal?.throwIfAborted();
+		outcome = {
+			ok: true,
+			value: await retryMatrixAuthRequest("matrix auth whoami", async () => {
+				const identity = await tempClient.doRequest("GET", "/_matrix/client/v3/account/whoami");
+				if (!isRecord(identity)) throw new Error("Matrix whoami returned an invalid identity");
+				const userId = identity.user_id ?? void 0;
+				const deviceId = identity.device_id ?? void 0;
+				if (userId !== void 0 && typeof userId !== "string" || deviceId !== void 0 && typeof deviceId !== "string") throw new Error("Matrix whoami returned an invalid identity");
+				return {
+					user_id: userId,
+					device_id: deviceId
+				};
+			}, params.signal)
+		};
+	} catch (error) {
+		outcome = {
+			ok: false,
+			error
+		};
+	} finally {
+		params.signal?.removeEventListener("abort", onAbort);
+		try {
+			await stop();
+		} catch (error) {
+			cleanupFailure = { error };
+		}
+	}
+	if (cleanupFailure) throw new MatrixWhoamiCleanupError(outcome.ok ? [cleanupFailure.error] : [outcome.error, cleanupFailure.error], "Matrix identity request cleanup failed", { cause: outcome.ok ? cleanupFailure.error : outcome.error });
+	if (!outcome.ok) throw outcome.error;
+	return outcome.value;
+}
+//#endregion
+//#region extensions/matrix/src/matrix/client/config.ts
+const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-Q5sHkkHv.mjs").then((n) => n.i));
+const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-write.runtime-DxbXh-pK.mjs"));
+const loadMatrixSecretInputDeps = createLazyRuntimeModule(() => import("./config-secret-input.runtime-CwsP3--c.mjs"));
+function isAbortSignalTriggered(signal) {
+	return signal?.aborted === true;
+}
+function credentialsMatchBackfillAuthLineage(params) {
+	if (!params.stored) return true;
+	return params.stored.homeserver === params.auth.homeserver && params.stored.userId === params.auth.userId && params.stored.accessToken === params.auth.accessToken;
 }
 const MATRIX_CONFIG_STRING_FIELDS = [
 	"homeserver",
@@ -271,8 +313,8 @@ async function resolveMatrixAuth(params) {
 	}) ?? resolved.accessToken;
 	const tokenAuthPassword = resolved.password;
 	const homeserver = await resolveValidatedMatrixHomeserverUrl(resolved.homeserver, { dangerouslyAllowPrivateNetwork: resolved.allowPrivateNetwork });
-	const { loadMatrixCredentials, credentialsMatchConfig } = await loadMatrixCredentialsReadDeps();
-	const cached = loadMatrixCredentials(env, accountId);
+	const { loadMatrixCredentialsAsync, credentialsMatchConfig } = await loadMatrixCredentialsReadDeps();
+	const cached = await loadMatrixCredentialsAsync(env, accountId);
 	const cachedCredentials = cached && credentialsMatchConfig(cached, {
 		homeserver,
 		userId: resolved.userId || "",
@@ -385,19 +427,20 @@ async function backfillMatrixAuthDeviceIdAfterStartup(params) {
 			signal: params.abortSignal
 		});
 	} catch (err) {
-		if (isAbortSignalTriggered(params.abortSignal)) return;
+		if (isAbortSignalTriggered(params.abortSignal) && !(err instanceof MatrixWhoamiCleanupError)) return;
 		throw err;
 	}
 	const deviceId = whoami.device_id?.trim();
 	if (!deviceId) return;
 	if (isAbortSignalTriggered(params.abortSignal)) return;
 	const env = params.env ?? process.env;
-	const { loadMatrixCredentials } = await loadMatrixCredentialsReadDeps();
+	const { loadMatrixCredentialsAsync } = await loadMatrixCredentialsReadDeps();
 	if (!credentialsMatchBackfillAuthLineage({
-		stored: loadMatrixCredentials(env, params.auth.accountId),
+		stored: await loadMatrixCredentialsAsync(env, params.auth.accountId),
 		auth: params.auth
 	})) return;
-	if (!repairCurrentTokenStorageMetaDeviceId({
+	if (isAbortSignalTriggered(params.abortSignal)) return;
+	if (!await repairCurrentTokenStorageMetaDeviceId({
 		homeserver: params.auth.homeserver,
 		userId: params.auth.userId,
 		accessToken: params.auth.accessToken,
@@ -406,7 +449,13 @@ async function backfillMatrixAuthDeviceIdAfterStartup(params) {
 		env: params.env
 	})) throw new Error("Matrix deviceId backfill failed to repair current-token storage metadata");
 	if (isAbortSignalTriggered(params.abortSignal)) return;
-	return await (await loadMatrixCredentialsWriteRuntime()).saveBackfilledMatrixDeviceId({
+	const credentialsWriter = await loadMatrixCredentialsWriteRuntime();
+	const currentCredentials = await loadMatrixCredentialsAsync(env, params.auth.accountId);
+	if (isAbortSignalTriggered(params.abortSignal) || !credentialsMatchBackfillAuthLineage({
+		stored: currentCredentials,
+		auth: params.auth
+	})) return;
+	return await credentialsWriter.saveBackfilledMatrixDeviceId({
 		homeserver: params.auth.homeserver,
 		userId: params.auth.userId,
 		accessToken: params.auth.accessToken,
@@ -414,70 +463,26 @@ async function backfillMatrixAuthDeviceIdAfterStartup(params) {
 	}, env, params.auth.accountId) === "saved" ? deviceId : void 0;
 }
 //#endregion
-//#region extensions/matrix/src/matrix/client/create-client.ts
-var create_client_exports = /* @__PURE__ */ __exportAll({ createMatrixClient: () => createMatrixClient });
-const loadMatrixCreateClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-B4By16Bt.js").then((n) => n.t), import("./logging-DRjvUOIh.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
-	MatrixClient: sdkModule.MatrixClient,
-	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
-})));
-async function createMatrixClient(params) {
-	const { MatrixClient, ensureMatrixSdkLoggingConfigured } = await loadMatrixCreateClientRuntimeDeps();
-	ensureMatrixSdkLoggingConfigured();
-	const homeserver = await resolveValidatedMatrixHomeserverUrl(params.homeserver, { dangerouslyAllowPrivateNetwork: params.allowPrivateNetwork });
-	const matrixClientUserId = normalizeOptionalString(params.userId);
-	const userId = matrixClientUserId ?? "unknown";
-	const storagePaths = params.persistStorage !== false ? resolveMatrixStoragePaths({
-		homeserver,
-		userId,
-		accessToken: params.accessToken,
-		accountId: params.accountId,
-		deviceId: params.deviceId,
-		env: process.env
-	}) : null;
-	if (storagePaths) {
-		await maybeMigrateLegacyStorage({
-			storagePaths,
-			env: process.env
-		});
-		fs.mkdirSync(storagePaths.rootDir, { recursive: true });
-		writeStorageMeta({
-			storagePaths,
-			homeserver,
-			userId,
-			accountId: params.accountId,
-			deviceId: params.deviceId
-		});
-	}
-	const cryptoDatabasePrefix = storagePaths ? `openclaw-matrix-${storagePaths.accountKey}-${storagePaths.tokenHash}` : void 0;
-	return new MatrixClient(homeserver, params.accessToken, {
-		userId: matrixClientUserId,
-		password: params.password,
-		deviceId: params.deviceId,
-		encryption: params.encryption,
-		localTimeoutMs: params.localTimeoutMs,
-		initialSyncLimit: params.initialSyncLimit,
-		storageRootDir: storagePaths?.rootDir,
-		recoveryKeyPath: storagePaths?.recoveryKeyPath,
-		idbSnapshotPath: storagePaths?.idbSnapshotPath,
-		cryptoDatabasePrefix,
-		autoBootstrapCrypto: params.autoBootstrapCrypto,
-		ssrfPolicy: params.ssrfPolicy ?? ssrfPolicyFromDangerouslyAllowPrivateNetwork(params.allowPrivateNetwork),
-		dispatcherPolicy: params.dispatcherPolicy
-	});
-}
-//#endregion
 //#region extensions/matrix/src/matrix/monitor/task-runner.ts
-const monitorTaskSignal = new AsyncLocalStorage();
+const monitorTaskContext = new AsyncLocalStorage();
 function getMatrixMonitorTaskSignal() {
-	return monitorTaskSignal.getStore();
+	const context = monitorTaskContext.getStore();
+	return context?.settled ? context.runner.shutdownSignal : context?.signal;
 }
 function createMatrixMonitorTaskRunner(params) {
 	const inFlight = /* @__PURE__ */ new Map();
+	const shutdownController = new AbortController();
+	const runner = { shutdownSignal: shutdownController.signal };
 	let closed = false;
 	const runDetachedTask = (label, task) => {
 		if (closed) return Promise.resolve();
 		const controller = new AbortController();
-		const trackedTask = monitorTaskSignal.run(controller.signal, () => Promise.resolve().then(task)).catch((error) => {
+		const context = {
+			runner,
+			settled: false,
+			signal: AbortSignal.any([controller.signal, runner.shutdownSignal])
+		};
+		const trackedTask = monitorTaskContext.run(context, () => Promise.resolve().then(task)).catch((error) => {
 			const message = String(error);
 			params.logVerboseMessage(`matrix: ${label} failed (${message})`);
 			params.logger.warn("matrix background task failed", {
@@ -485,7 +490,7 @@ function createMatrixMonitorTaskRunner(params) {
 				error: message
 			});
 		}).finally(() => {
-			controller.abort();
+			context.settled = true;
 			inFlight.delete(trackedTask);
 		});
 		inFlight.set(trackedTask, controller);
@@ -497,6 +502,7 @@ function createMatrixMonitorTaskRunner(params) {
 	return {
 		close: () => {
 			closed = true;
+			shutdownController.abort();
 			for (const controller of inFlight.values()) controller.abort();
 		},
 		runDetachedTask,
@@ -536,7 +542,7 @@ async function awaitMatrixStartupWithAbort(promise, abortSignal) {
 }
 //#endregion
 //#region extensions/matrix/src/matrix/client/shared.ts
-const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => Promise.resolve().then(() => create_client_exports).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
+const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => import("./create-client-CHxcron_.mjs").then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
 const MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS = 5e3;
 const sharedClientStates = /* @__PURE__ */ new Map();
 const sharedClientPromises = /* @__PURE__ */ new Map();
@@ -572,7 +578,6 @@ async function createSharedMatrixClient(params) {
 		client,
 		key: buildSharedClientKey(params.auth),
 		started: false,
-		cryptoReady: false,
 		startPromise: null,
 		phase: "open",
 		leases: /* @__PURE__ */ new Set(),
@@ -580,12 +585,35 @@ async function createSharedMatrixClient(params) {
 		noLeases: createDeferred(),
 		retirementPromise: null,
 		poisonError: null,
-		releaseMode: "discard"
+		releaseMode: "discard",
+		ownerSignal: params.lifecycle?.signal
 	};
 }
 function deleteSharedClientState(state) {
 	if (sharedClientStates.get(state.key) === state) sharedClientStates.delete(state.key);
-	sharedClientPromises.delete(state.key);
+	const detachLifecycle = state.detachLifecycle;
+	state.detachLifecycle = void 0;
+	detachLifecycle?.();
+}
+function bindSharedClientLifecycle(state, lifecycle) {
+	if (!lifecycle) return;
+	const retire = () => forceRetireState(state);
+	const onAbort = () => {
+		retire().catch(() => void 0);
+	};
+	lifecycle.signal.addEventListener("abort", onAbort, { once: true });
+	let removeDisposer;
+	try {
+		removeDisposer = lifecycle.onDispose(retire);
+	} catch (error) {
+		lifecycle.signal.removeEventListener("abort", onAbort);
+		throw error;
+	}
+	state.detachLifecycle = () => {
+		lifecycle.signal.removeEventListener("abort", onAbort);
+		removeDisposer();
+	};
+	if (lifecycle.signal.aborted) onAbort();
 }
 async function ensureSharedClientStarted(state, abortSignal) {
 	if (state.started) return;
@@ -594,15 +622,6 @@ async function ensureSharedClientStarted(state, abortSignal) {
 		return;
 	}
 	const guardedStart = (async () => {
-		if (state.auth.encryption && !state.cryptoReady) try {
-			const joinedRooms = await state.client.getJoinedRooms();
-			if (state.client.crypto) {
-				await state.client.crypto.prepare(joinedRooms);
-				state.cryptoReady = true;
-			}
-		} catch (err) {
-			LogService.warn("MatrixClientLite", "Failed to prepare crypto:", err);
-		}
 		await state.client.start({ abortSignal });
 		throwIfMatrixStartupAborted(abortSignal);
 		state.started = true;
@@ -628,18 +647,22 @@ async function resolveSharedMatrixAuth(params) {
 		accountId: authContext.accountId
 	});
 }
-async function resolveOpenSharedMatrixClientState(params) {
+async function resolveOpenSharedMatrixClientState(params, lifecycle) {
 	const auth = await resolveSharedMatrixAuth(params);
 	throwIfMatrixStartupAborted(params.abortSignal);
 	const key = buildSharedClientKey(auth);
 	while (true) {
 		const existing = sharedClientStates.get(key);
 		if (existing?.poisonError) throw existing.poisonError;
-		if (existing?.phase === "open") return existing;
+		if (existing?.phase === "open" && existing.ownerSignal === lifecycle?.signal) return existing;
 		if (existing?.retirementPromise) {
 			await awaitMatrixStartupWithAbort(existing.retirementPromise, params.abortSignal);
 			continue;
 		}
+		if (existing) {
+			await awaitMatrixStartupWithAbort(existing.noLeases.promise, params.abortSignal);
+			continue;
+		}
 		const pending = sharedClientPromises.get(key);
 		if (pending) {
 			await awaitMatrixStartupWithAbort(pending, params.abortSignal);
@@ -647,15 +670,22 @@ async function resolveOpenSharedMatrixClientState(params) {
 		}
 		const creationPromise = createSharedMatrixClient({
 			auth,
-			timeoutMs: params.timeoutMs
+			timeoutMs: params.timeoutMs,
+			lifecycle
 		});
 		sharedClientPromises.set(key, creationPromise);
 		try {
 			const created = await creationPromise;
 			sharedClientStates.set(key, created);
+			try {
+				bindSharedClientLifecycle(created, lifecycle);
+			} catch (error) {
+				await forceRetireState(created);
+				throw error;
+			}
 			return created;
 		} finally {
-			sharedClientPromises.delete(key);
+			if (sharedClientPromises.get(key) === creationPromise) sharedClientPromises.delete(key);
 		}
 	}
 }
@@ -685,6 +715,14 @@ function mergeReleaseMode(current, requested) {
 function abortTransientLeases(state) {
 	for (const lease of state.leases) if (lease.role === "transient") lease.abortController.abort();
 }
+function forceReleaseLeases(state, releasePromise) {
+	for (const lease of state.leases) {
+		lease.releasePromise ??= lease.role === "monitor" ? releasePromise : Promise.resolve();
+		lease.abortController.abort();
+	}
+	state.leases.clear();
+	state.noLeases.resolve();
+}
 async function waitForRetirementDrain(state, task, isPending, timeoutMessage) {
 	if (!isPending()) return;
 	let deadline;
@@ -705,6 +743,7 @@ function beginGenerationRetirement(params) {
 	const { state } = params;
 	if (state.retirementPromise) return state.retirementPromise;
 	state.phase = "quiescing";
+	if (state.leases.size === 0) state.noLeases.resolve();
 	const result = createDeferred();
 	state.retirementPromise = result.promise;
 	Promise.resolve().then(async () => {
@@ -827,15 +866,20 @@ function createSharedMatrixClientLease(state, role) {
 	};
 }
 async function acquireSharedMatrixClient(params = {}) {
-	const taskSignal = getMatrixMonitorTaskSignal();
-	const abortSignal = taskSignal && params.abortSignal ? AbortSignal.any([taskSignal, params.abortSignal]) : taskSignal ?? params.abortSignal;
+	const lifecycle = getMatrixRuntimeLifecycle();
+	const signals = [
+		getMatrixMonitorTaskSignal(),
+		params.abortSignal,
+		lifecycle?.signal
+	].filter((signal) => signal !== void 0);
+	const abortSignal = signals.length > 1 ? AbortSignal.any(signals) : signals[0];
 	const acquisition = {
 		...params,
 		abortSignal
 	};
 	while (true) {
 		throwIfMatrixStartupAborted(abortSignal);
-		const state = await resolveOpenSharedMatrixClientState(acquisition);
+		const state = await resolveOpenSharedMatrixClientState(acquisition, lifecycle);
 		if (abortSignal?.aborted) {
 			if (state.phase === "open" && state.leases.size === 0) await beginGenerationRetirement({ state });
 			throwIfMatrixStartupAborted(abortSignal);
@@ -851,11 +895,28 @@ async function acquireSharedMatrixClient(params = {}) {
 		return lease;
 	}
 }
+async function forceRetireState(state) {
+	if (state.phase === "late-drain") throw state.poisonError ?? /* @__PURE__ */ new Error("Matrix client generation is still retiring");
+	state.releaseMode = mergeReleaseMode(state.releaseMode, "stop");
+	const retirementPromise = beginGenerationRetirement({
+		state,
+		monitorLeases: Array.from(state.leases).filter((lease) => lease.role === "monitor")
+	});
+	forceReleaseLeases(state, retirementPromise);
+	try {
+		await retirementPromise;
+	} catch (error) {
+		if (sharedClientStates.get(state.key) === state) throw state.poisonError ?? error;
+	}
+}
 //#endregion
 //#region extensions/matrix/src/matrix/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
 	acquireSharedMatrixClient: () => acquireSharedMatrixClient,
+	createMatrixClient: () => createMatrixClient,
 	resolveMatrixAuthContext: () => resolveMatrixAuthContext
 });
+const loadMatrixClientRuntime = createLazyRuntimeModule(() => import("./create-client-CHxcron_.mjs"));
+const createMatrixClient = createLazyRuntimeMethod(loadMatrixClientRuntime, (runtime) => runtime.createMatrixClient);
 //#endregion
-export { throwIfMatrixStartupAborted as a, backfillMatrixAuthDeviceIdAfterStartup as c, isMatrixStartupAbortError as i, resolveMatrixAuth as l, acquireSharedMatrixClient as n, createMatrixMonitorTaskRunner as o, createMatrixStartupAbortError as r, createMatrixClient as s, client_exports as t, resolveMatrixAuthContext as u };
+export { createMatrixStartupAbortError as a, createMatrixMonitorTaskRunner as c, resolveMatrixAuth as d, resolveMatrixAuthContext as f, awaitMatrixStartupWithAbort as i, getMatrixMonitorTaskSignal as l, createMatrixClient as n, isMatrixStartupAbortError as o, acquireSharedMatrixClient as r, throwIfMatrixStartupAborted as s, client_exports as t, backfillMatrixAuthDeviceIdAfterStartup as u };