From bfa561b1a78ddadb0b2046cbc3e83735e82827e4 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Thu, 2 Apr 2026 13:46:06 +0900
Subject: [PATCH] perf(memory): lazy-load matrix secret config input

---
 .../client/config-secret-input.runtime.ts     |  1 +
 extensions/matrix/src/matrix/client/config.ts | 20 ++++++++++++++-----
 2 files changed, 16 insertions(+), 5 deletions(-)
 create mode 100644 extensions/matrix/src/matrix/client/config-secret-input.runtime.ts

diff --git a/extensions/matrix/src/matrix/client/config-secret-input.runtime.ts b/extensions/matrix/src/matrix/client/config-secret-input.runtime.ts
new file mode 100644
index 00000000000..27aac7c4690
--- /dev/null
+++ b/extensions/matrix/src/matrix/client/config-secret-input.runtime.ts
@@ -0,0 +1 @@
+export { resolveConfiguredSecretInputString } from "openclaw/plugin-sdk/config-runtime";
diff --git a/extensions/matrix/src/matrix/client/config.ts b/extensions/matrix/src/matrix/client/config.ts
index e22fb98a44c..ee6f44e4605 100644
--- a/extensions/matrix/src/matrix/client/config.ts
+++ b/extensions/matrix/src/matrix/client/config.ts
@@ -1,15 +1,12 @@
-import {
-  coerceSecretRef,
-  resolveConfiguredSecretInputString,
-} from "openclaw/plugin-sdk/config-runtime";
 import type { PinnedDispatcherPolicy } from "openclaw/plugin-sdk/infra-runtime";
+import { coerceSecretRef } from "openclaw/plugin-sdk/provider-auth";
+import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import {
   requiresExplicitMatrixDefaultAccount,
   resolveMatrixDefaultOrOnlyAccountId,
 } from "../../account-selection.js";
 import { resolveMatrixAccountStringValues } from "../../auth-precedence.js";
 import { getMatrixScopedEnvVarNames } from "../../env-vars.js";
-import { normalizeResolvedSecretInputString } from "../../runtime-api.js";
 import { getMatrixRuntime } from "../../runtime.js";
 import type { CoreConfig } from "../../types.js";
 import {
@@ -39,8 +36,13 @@ type MatrixCredentialsReadDeps = {
   credentialsMatchConfig: typeof import("../credentials-read.js").credentialsMatchConfig;
 };
 
+type MatrixSecretInputDeps = {
+  resolveConfiguredSecretInputString: typeof import("./config-secret-input.runtime.js").resolveConfiguredSecretInputString;
+};
+
 let matrixAuthClientDepsPromise: Promise<MatrixAuthClientDeps> | undefined;
 let matrixCredentialsReadDepsPromise: Promise<MatrixCredentialsReadDeps> | undefined;
+let matrixSecretInputDepsPromise: Promise<MatrixSecretInputDeps> | undefined;
 let matrixAuthClientDepsForTest: MatrixAuthClientDeps | undefined;
 
 export function setMatrixAuthClientDepsForTest(
@@ -77,6 +79,13 @@ async function loadMatrixCredentialsReadDeps(): Promise<MatrixCredentialsReadDep
   return await matrixCredentialsReadDepsPromise;
 }
 
+async function loadMatrixSecretInputDeps(): Promise<MatrixSecretInputDeps> {
+  matrixSecretInputDepsPromise ??= import("./config-secret-input.runtime.js").then((runtime) => ({
+    resolveConfiguredSecretInputString: runtime.resolveConfiguredSecretInputString,
+  }));
+  return await matrixSecretInputDepsPromise;
+}
+
 function readEnvSecretRefFallback(params: {
   value: unknown;
   env?: NodeJS.ProcessEnv;
@@ -273,6 +282,7 @@ async function resolveConfiguredMatrixAuthSecretInput(params: {
     return undefined;
   }
 
+  const { resolveConfiguredSecretInputString } = await loadMatrixSecretInputDeps();
   const resolved = await resolveConfiguredSecretInputString({
     config: params.cfg,
     env: params.env,