fix(matrix): route text-only send_message through adapter for E2EE support - #185
Merged
Conversation
|
Review Complete Risk: 🟢 Low (12/100) — no findings · 33 LOC across 2 files Routes all Matrix sends through the E2EE-capable adapter instead of the raw-HTTP standalone path, fixing cleartext text-only messages that showed a red padlock in encrypted rooms. Files Reviewed (2 files) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Text-only Matrix messages sent via the
send_messageengine (hermes send, crondeliver: matrix) now arrive encrypted in E2EE rooms instead of cleartext (red padlock).Root cause: media sends already routed through the mautrix adapter (
_send_matrix_via_adapter), which encrypts. Text-only sends took the raw-HTTPstandalone_sender_fnpath, which never encrypts — so text landed unencrypted in E2EE rooms.Changes
tools/send_message_tool.py: route all Matrix sends through_send_matrix_via_adapter(drop theand media_filesgate); remove the now-dead_registry_standalone_send("matrix", ...)branch from the text-only loop. The adapter reuses the live gateway's E2EE session when available ([Bug]: send_message Matrix (media) path reconnects + re-inits E2EE per message — exhausts recipient one-time keys and silently drops messages under burst NousResearch/hermes-agent#46310) and falls back to an encryption-aware ephemeral adapter for standalone/cron.tests/tools/test_send_message_tool.py: inverttest_matrix_text_only_*to assert the adapter path (was asserting the raw-HTTP path — the bug).The plugin's
standalone_sender_fnstays registered for the registry contract; it is simply no longer reached for Matrix.Validation
m.text→ cleartext (red padlock)_send_matrix_via_adapter, raw-HTTP bypassedSalvaged from NousResearch#20259 (@DanAsBjorn, first submitter) onto current
main. The original patched the pre-NousResearch#41112_send_matrixbranch, which had since moved to the plugin's standalone path — same fix direction, re-applied to the current structure. Duplicate NousResearch#23382 (@32r4) fixed the same routing layer with anencryption-flag gate; the unconditional route is simpler and correct since the adapter sends plaintext to unencrypted rooms fine.Infographic
Mirror-of: NousResearch#56106
NousResearch#56106