More matrix setup

Author: RantsRoamer

README.md

@@ -237,12 +237,16 @@ echo "Summarize the last three messages" | node scripts/cli.js
 
 ### Matrix (Synapse / homeserver) bot
 
-1. On your homeserver, create a dedicated bot user (or use an existing account). Obtain an **access token** (e.g. sign in with [Element](https://element.io) and copy the token from **Help & About → Access Token**, or use `POST /_matrix/client/v3/login` against your Synapse URL).
-2. In Config → Channels, enable **Matrix bot**, set **Homeserver URL** to your client API base (e.g. `https://matrix.example.org`), and paste the **access token**. Restart the server.
+1. On your homeserver, create a dedicated bot user (or use an existing account).
+2. In Config → Channels, enable **Matrix bot** and set **Homeserver URL** to your client API base (e.g. `https://matrix.example.org`). Choose a **sign-in method**:
+   - **Access token** — paste a token (e.g. from Element **Help & About → Access Token**). Easiest if you already have a token.
+   - **Username and password (Client-Server login API)** — enter the bot’s Matrix user ID (local part or full `@user:server`) and password. On startup, ShadowAI calls `POST /_matrix/client/v3/login` (same API Element uses) and uses the returned access token for the session. The password is stored in `config.json` when you save; it is not returned in the config API response.
+   - If **Access token** is selected but the token field is empty, ShadowAI will still try **user ID + password** from config when both are set (fallback).
 3. Install the optional dependency: `npm install matrix-bot-sdk`
-4. Invite the bot to a room or start a direct message. The bot auto-accepts invites. Each Matrix user gets their own conversation history (unencrypted rooms work out of the box; encrypted rooms require extra crypto setup and are not covered here).
-5. **Restrict who can use the bot:** set **Allowed Matrix user IDs** to comma-separated full MXIDs (e.g. `@alice:example.org`). Leave empty to allow any user in rooms where the bot is present.
-6. Send `reset` or `!reset` in the room to clear that user’s stored conversation (same idea as Discord `/reset`).
+4. Restart the server after saving channel settings.
+5. Invite the bot to a room or start a direct message. The bot auto-accepts invites. Each Matrix user gets their own conversation history (unencrypted rooms work out of the box; encrypted rooms require extra crypto setup and are not covered here).
+6. **Restrict who can use the bot:** set **Allowed Matrix user IDs** to comma-separated full MXIDs (e.g. `@alice:example.org`). Leave empty to allow any user in rooms where the bot is present.
+7. Send `reset` or `!reset` in the room to clear that user’s stored conversation (same idea as Discord `/reset`).
 
 Channel conversations (CLI, Telegram, Discord, Matrix) are stored per synthetic user id (e.g. `channel_cli`, `telegram_<userId>`, `discord_<userId>`, `matrix_<localpart_homeserver>`) and appear in the web UI chat list so you can inspect or continue them from the browser. CLEAR in the web UI, or `/reset` in Discord / `reset` in Matrix, will clear that channel conversation.
 

config.default.json

@@ -1 +1 @@
-{"server":{"host":"0.0.0.0","port":9090},"auth":{"username":"admin","passwordHash":"admin"},"ollama":{"mainUrl":"http://localhost:11434","mainModel":"llama3.2","temperature":0.7,"num_predict":2048,"agents":[{"id":"coding","name":"Coding Agent","url":"http://localhost:11434","model":"codellama","enabled":true}]},"heartbeat":[],"skills":{"enabledIds":[]},"searxng":{"url":"","enabled":false},"email":{"host":"","port":25,"secure":false,"auth":{"user":"","pass":""},"from":"","defaultTo":"","enabled":false},"channels":{"apiKey":"","telegram":{"enabled":false,"botToken":""},"discord":{"enabled":false,"botToken":"","allowedUserIds":[]},"matrix":{"enabled":false,"homeserverUrl":"","accessToken":"","allowedUserIds":[]}}}
+{"server":{"host":"0.0.0.0","port":9090},"auth":{"username":"admin","passwordHash":"admin"},"ollama":{"mainUrl":"http://localhost:11434","mainModel":"llama3.2","temperature":0.7,"num_predict":2048,"agents":[{"id":"coding","name":"Coding Agent","url":"http://localhost:11434","model":"codellama","enabled":true}]},"heartbeat":[],"skills":{"enabledIds":[]},"searxng":{"url":"","enabled":false},"email":{"host":"","port":25,"secure":false,"auth":{"user":"","pass":""},"from":"","defaultTo":"","enabled":false},"channels":{"apiKey":"","telegram":{"enabled":false,"botToken":""},"discord":{"enabled":false,"botToken":"","allowedUserIds":[]},"matrix":{"enabled":false,"authMode":"token","homeserverUrl":"","userId":"","accessToken":"","password":"","allowedUserIds":[]}}}

lib/matrixBot.js

@@ -16,20 +16,91 @@ function matrixUsernameForSender(sender) {
   return ('matrix_' + local).slice(0, 64);
 }
 
+/**
+ * Obtain an access token via Matrix Client-Server API (Synapse and spec-compliant servers).
+ * @param {string} homeserverUrl - e.g. https://matrix.example.org
+ * @param {string} userId - local part (alice) or full MXID (@alice:example.org)
+ * @param {string} password
+ */
+async function matrixLoginWithPassword(homeserverUrl, userId, password) {
+  const base = homeserverUrl.replace(/\/$/, '');
+  const url = `${base}/_matrix/client/v3/login`;
+  const body = {
+    type: 'm.login.password',
+    identifier: {
+      type: 'm.id.user',
+      user: userId.trim()
+    },
+    password: String(password),
+    initial_device_display_name: 'ShadowAI'
+  };
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const msg = data.error || data.errcode || res.statusText || 'login failed';
+    throw new Error(msg);
+  }
+  if (!data.access_token) {
+    throw new Error('Matrix login: no access_token in response');
+  }
+  return data.access_token;
+}
+
 /**
  * Matrix (Synapse / any Matrix homeserver) bot using matrix-bot-sdk.
- * Configure in CONFIG → Channels: homeserver URL, bot access token, optional allowlist.
- * Create a bot user on the server, log in once to obtain an access token (e.g. Element or curl).
+ * Configure in CONFIG → Channels: homeserver URL, and either an access token or username+password (login API).
  * Invite the bot to a room or DM; optional dependency: npm install matrix-bot-sdk
  */
-function startMatrixBot() {
+async function startMatrixBotAsync() {
   const channels = getConfig().channels || {};
   const mx = channels.matrix || {};
   if (!mx.enabled) return;
   const homeserverUrl = (mx.homeserverUrl || '').trim();
-  const accessToken = (mx.accessToken || '').trim();
-  if (!homeserverUrl || !accessToken) {
-    logger.warn('Matrix bot: enabled but homeserverUrl or accessToken is missing');
+  if (!homeserverUrl) {
+    logger.warn('Matrix bot: enabled but homeserverUrl is missing');
+    return;
+  }
+
+  const authMode = String(mx.authMode || 'token').toLowerCase() === 'password' ? 'password' : 'token';
+  let accessToken = (mx.accessToken || '').trim();
+
+  if (authMode === 'password') {
+    const userId = (mx.userId || '').trim();
+    const password = (mx.password || '').trim();
+    if (!userId || !password) {
+      logger.warn('Matrix bot: auth mode is password but userId or password is missing');
+      return;
+    }
+    try {
+      accessToken = await matrixLoginWithPassword(homeserverUrl, userId, password);
+      logger.info('Matrix bot: signed in via Client-Server login API');
+    } catch (e) {
+      logger.error('Matrix bot: login API failed:', e.message);
+      return;
+    }
+  } else if (!accessToken) {
+    const userId = (mx.userId || '').trim();
+    const password = (mx.password || '').trim();
+    if (userId && password) {
+      try {
+        accessToken = await matrixLoginWithPassword(homeserverUrl, userId, password);
+        logger.info('Matrix bot: no access token in config; signed in with stored userId and password');
+      } catch (e) {
+        logger.error('Matrix bot: login API failed:', e.message);
+        return;
+      }
+    } else {
+      logger.warn('Matrix bot: set an access token, or userId + password, or switch auth to password mode');
+      return;
+    }
+  }
+
+  if (!accessToken) {
+    logger.warn('Matrix bot: could not obtain access token');
     return;
   }
 
@@ -129,6 +200,12 @@ function startMatrixBot() {
   });
 }
 
+function startMatrixBot() {
+  startMatrixBotAsync().catch((e) => {
+    logger.error('Matrix bot:', e.message);
+  });
+}
+
 function stopMatrixBot() {
   if (clientInstance && typeof clientInstance.stop === 'function') {
     clientInstance.stop();

public/config.html

@@ -214,9 +214,29 @@ <h2>Channels (CLI, Telegram, Discord, Matrix)</h2>
             <span class="section-desc">Client API base (same host you use in Element; no trailing path).</span>
           </div>
           <div class="form-group">
+            <label>Matrix sign-in method</label>
+            <select id="matrixAuthMode" aria-label="Matrix sign-in method">
+              <option value="token">Access token</option>
+              <option value="password">Username and password (Client-Server login API)</option>
+            </select>
+            <span class="section-desc">Use a token you paste, or store the bot’s Matrix ID and password and let the server call <code>POST /_matrix/client/v3/login</code> on startup.</span>
+          </div>
+          <div class="form-group" id="matrixAuthTokenGroup">
             <label>Matrix access token</label>
             <input type="password" id="matrixAccessToken" placeholder="Bot user access token" autocomplete="off" />
-            <span class="section-desc">Create a bot user on the server, then obtain a token (e.g. login via Element or <code>/_matrix/client/v3/login</code>).</span>
+            <span class="section-desc">From Element (Help → Access Token) or any client; used when sign-in method is Access token.</span>
+          </div>
+          <div id="matrixAuthPasswordWrap" hidden>
+            <div class="form-group">
+              <label>Matrix user ID</label>
+              <input type="text" id="matrixUserId" placeholder="localpart or @user:server" autocomplete="off" />
+              <span class="section-desc">Bot account: local username or full MXID for this homeserver.</span>
+            </div>
+            <div class="form-group">
+              <label>Matrix password</label>
+              <input type="password" id="matrixPassword" placeholder="Leave blank after saving to keep unchanged" autocomplete="new-password" />
+              <span class="section-desc">Stored in <code>config.json</code> on save. Shown empty when you reload; type again only to change it.</span>
+            </div>
           </div>
           <div class="form-group">
             <label>Allowed Matrix user IDs</label>

public/config.js

@@ -38,6 +38,16 @@
     statusEl.style.color = isError ? 'var(--red)' : 'var(--text-dim)';
   }
 
+  function toggleMatrixAuthFields() {
+    const modeEl = document.getElementById('matrixAuthMode');
+    if (!modeEl) return;
+    const mode = modeEl.value || 'token';
+    const tokenGr = document.getElementById('matrixAuthTokenGroup');
+    const pwdWrap = document.getElementById('matrixAuthPasswordWrap');
+    if (tokenGr) tokenGr.hidden = mode === 'password';
+    if (pwdWrap) pwdWrap.hidden = mode !== 'password';
+  }
+
   function refreshAvatarPreview() {
     if (!avatarImg) return;
     const url = '/static/ai-avatar?ts=' + Date.now();
@@ -84,8 +94,14 @@
     document.getElementById('discordAllowedUserIds').value = Array.isArray(ch.discord?.allowedUserIds) ? ch.discord.allowedUserIds.join(', ') : (ch.discord?.allowedUserIds ?? '');
     document.getElementById('matrixEnabled').checked = ch.matrix?.enabled === true;
     document.getElementById('matrixHomeserverUrl').value = ch.matrix?.homeserverUrl ?? '';
+    const matrixModeEl = document.getElementById('matrixAuthMode');
+    if (matrixModeEl) matrixModeEl.value = ch.matrix?.authMode === 'password' ? 'password' : 'token';
+    document.getElementById('matrixUserId').value = ch.matrix?.userId ?? '';
     document.getElementById('matrixAccessToken').value = ch.matrix?.accessToken ?? '';
+    const mp = document.getElementById('matrixPassword');
+    if (mp) mp.value = '';
     document.getElementById('matrixAllowedUserIds').value = Array.isArray(ch.matrix?.allowedUserIds) ? ch.matrix.allowedUserIds.join(', ') : (ch.matrix?.allowedUserIds ?? '');
+    toggleMatrixAuthFields();
     const ui = c.ui || {};
     document.getElementById('appName').value = ui.appName ?? 'SHADOW_AI';
     document.getElementById('showToolCalls').checked = ui.showToolCalls !== false;
@@ -139,12 +155,22 @@
         botToken: document.getElementById('discordBotToken').value.trim(),
         allowedUserIds: document.getElementById('discordAllowedUserIds').value.split(',').map(s => s.trim()).filter(Boolean)
       },
-      matrix: {
-        enabled: document.getElementById('matrixEnabled').checked,
-        homeserverUrl: document.getElementById('matrixHomeserverUrl').value.trim(),
-        accessToken: document.getElementById('matrixAccessToken').value.trim(),
-        allowedUserIds: document.getElementById('matrixAllowedUserIds').value.split(',').map(s => s.trim()).filter(Boolean)
-      }
+      matrix: (() => {
+        const authMode = (document.getElementById('matrixAuthMode') && document.getElementById('matrixAuthMode').value) || 'token';
+        const row = {
+          enabled: document.getElementById('matrixEnabled').checked,
+          authMode,
+          homeserverUrl: document.getElementById('matrixHomeserverUrl').value.trim(),
+          userId: document.getElementById('matrixUserId').value.trim(),
+          accessToken: document.getElementById('matrixAccessToken').value.trim(),
+          allowedUserIds: document.getElementById('matrixAllowedUserIds').value.split(',').map(s => s.trim()).filter(Boolean)
+        };
+        const pwdEl = document.getElementById('matrixPassword');
+        const pwdVal = pwdEl ? pwdEl.value : '';
+        if (pwdVal) row.password = pwdVal;
+        else if (authMode === 'token') row.password = '';
+        return row;
+      })()
     };
   }
 
@@ -379,8 +405,14 @@
         document.getElementById('discordAllowedUserIds').value = Array.isArray(ch.discord?.allowedUserIds) ? ch.discord.allowedUserIds.join(', ') : (ch.discord?.allowedUserIds ?? '');
         document.getElementById('matrixEnabled').checked = ch.matrix?.enabled === true;
         document.getElementById('matrixHomeserverUrl').value = ch.matrix?.homeserverUrl ?? '';
+        const matrixModeEl2 = document.getElementById('matrixAuthMode');
+        if (matrixModeEl2) matrixModeEl2.value = ch.matrix?.authMode === 'password' ? 'password' : 'token';
+        document.getElementById('matrixUserId').value = ch.matrix?.userId ?? '';
         document.getElementById('matrixAccessToken').value = ch.matrix?.accessToken ?? '';
+        const mp2 = document.getElementById('matrixPassword');
+        if (mp2) mp2.value = '';
         document.getElementById('matrixAllowedUserIds').value = Array.isArray(ch.matrix?.allowedUserIds) ? ch.matrix.allowedUserIds.join(', ') : (ch.matrix?.allowedUserIds ?? '');
+        toggleMatrixAuthFields();
         const ui = c.ui || {};
         document.getElementById('appName').value = ui.appName ?? 'SHADOW_AI';
         document.getElementById('showToolCalls').checked = ui.showToolCalls !== false;
@@ -392,5 +424,8 @@
     }
   });
 
+  const matrixAuthModeEl = document.getElementById('matrixAuthMode');
+  if (matrixAuthModeEl) matrixAuthModeEl.addEventListener('change', toggleMatrixAuthFields);
+
   loadConfig();
 })();