diff --git a/extensions/matrix/src/matrix/client/config-runtime-api.ts b/extensions/matrix/src/matrix/client/config-runtime-api.ts
new file mode 100644
index 00000000000..8d3bfbd6469
--- /dev/null
+++ b/extensions/matrix/src/matrix/client/config-runtime-api.ts
@@ -0,0 +1,12 @@
+export {
+  DEFAULT_ACCOUNT_ID,
+  normalizeAccountId,
+  normalizeOptionalAccountId,
+} from "openclaw/plugin-sdk/account-id";
+export { isPrivateOrLoopbackHost } from "openclaw/plugin-sdk/matrix";
+export {
+  assertHttpUrlTargetsPrivateNetwork,
+  ssrfPolicyFromAllowPrivateNetwork,
+  type LookupFn,
+  type SsrFPolicy,
+} from "openclaw/plugin-sdk/ssrf-runtime";
diff --git a/extensions/matrix/src/matrix/client/config.ts b/extensions/matrix/src/matrix/client/config.ts
index 13c381d0643..e22fb98a44c 100644
--- a/extensions/matrix/src/matrix/client/config.ts
+++ b/extensions/matrix/src/matrix/client/config.ts
@@ -9,16 +9,7 @@ import {
 } from "../../account-selection.js";
 import { resolveMatrixAccountStringValues } from "../../auth-precedence.js";
 import { getMatrixScopedEnvVarNames } from "../../env-vars.js";
-import {
-  DEFAULT_ACCOUNT_ID,
-  assertHttpUrlTargetsPrivateNetwork,
-  isPrivateOrLoopbackHost,
-  type LookupFn,
-  normalizeAccountId,
-  normalizeOptionalAccountId,
-  normalizeResolvedSecretInputString,
-  ssrfPolicyFromAllowPrivateNetwork,
-} from "../../runtime-api.js";
+import { normalizeResolvedSecretInputString } from "../../runtime-api.js";
 import { getMatrixRuntime } from "../../runtime.js";
 import type { CoreConfig } from "../../types.js";
 import {
@@ -26,7 +17,16 @@ import {
   resolveMatrixBaseConfig,
   listNormalizedMatrixAccountIds,
 } from "../account-config.js";
-import { resolveMatrixConfigFieldPath } from "../config-update.js";
+import { resolveMatrixConfigFieldPath } from "../config-paths.js";
+import {
+  DEFAULT_ACCOUNT_ID,
+  assertHttpUrlTargetsPrivateNetwork,
+  isPrivateOrLoopbackHost,
+  type LookupFn,
+  normalizeAccountId,
+  normalizeOptionalAccountId,
+  ssrfPolicyFromAllowPrivateNetwork,
+} from "./config-runtime-api.js";
 import type { MatrixAuth, MatrixResolvedConfig } from "./types.js";
 
 type MatrixAuthClientDeps = {
@@ -44,10 +44,12 @@ let matrixCredentialsReadDepsPromise: Promise<MatrixCredentialsReadDeps> | undef
 let matrixAuthClientDepsForTest: MatrixAuthClientDeps | undefined;
 
 export function setMatrixAuthClientDepsForTest(
-  deps?: {
-    MatrixClient: typeof import("../sdk.js").MatrixClient;
-    ensureMatrixSdkLoggingConfigured: typeof import("./logging.js").ensureMatrixSdkLoggingConfigured;
-  } | undefined,
+  deps?:
+    | {
+        MatrixClient: typeof import("../sdk.js").MatrixClient;
+        ensureMatrixSdkLoggingConfigured: typeof import("./logging.js").ensureMatrixSdkLoggingConfigured;
+      }
+    | undefined,
 ): void {
   matrixAuthClientDepsForTest = deps;
 }
diff --git a/extensions/matrix/src/matrix/config-paths.ts b/extensions/matrix/src/matrix/config-paths.ts
new file mode 100644
index 00000000000..56b34f5a19b
--- /dev/null
+++ b/extensions/matrix/src/matrix/config-paths.ts
@@ -0,0 +1,31 @@
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+import type { CoreConfig } from "../types.js";
+
+export function shouldStoreMatrixAccountAtTopLevel(cfg: CoreConfig, accountId: string): boolean {
+  const normalizedAccountId = normalizeAccountId(accountId);
+  if (normalizedAccountId !== DEFAULT_ACCOUNT_ID) {
+    return false;
+  }
+  const accounts = cfg.channels?.matrix?.accounts;
+  return !accounts || Object.keys(accounts).length === 0;
+}
+
+export function resolveMatrixConfigPath(cfg: CoreConfig, accountId: string): string {
+  const normalizedAccountId = normalizeAccountId(accountId);
+  if (shouldStoreMatrixAccountAtTopLevel(cfg, normalizedAccountId)) {
+    return "channels.matrix";
+  }
+  return `channels.matrix.accounts.${normalizedAccountId}`;
+}
+
+export function resolveMatrixConfigFieldPath(
+  cfg: CoreConfig,
+  accountId: string,
+  fieldPath: string,
+): string {
+  const suffix = fieldPath.trim().replace(/^\.+/, "");
+  if (!suffix) {
+    return resolveMatrixConfigPath(cfg, accountId);
+  }
+  return `${resolveMatrixConfigPath(cfg, accountId)}.${suffix}`;
+}
diff --git a/extensions/matrix/src/matrix/config-update.ts b/extensions/matrix/src/matrix/config-update.ts
index d9318b66f3e..79f278b606a 100644
--- a/extensions/matrix/src/matrix/config-update.ts
+++ b/extensions/matrix/src/matrix/config-update.ts
@@ -1,9 +1,19 @@
-import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
-import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { coerceSecretRef } from "openclaw/plugin-sdk/config-runtime";
 import { normalizeSecretInputString } from "openclaw/plugin-sdk/setup";
 import type { CoreConfig, MatrixConfig } from "../types.js";
 import { findMatrixAccountConfig } from "./account-config.js";
+import {
+  resolveMatrixConfigFieldPath,
+  resolveMatrixConfigPath,
+  shouldStoreMatrixAccountAtTopLevel,
+} from "./config-paths.js";
+
+export {
+  resolveMatrixConfigFieldPath,
+  resolveMatrixConfigPath,
+  shouldStoreMatrixAccountAtTopLevel,
+} from "./config-paths.js";
 
 export type MatrixAccountPatch = {
   name?: string | null;
@@ -113,35 +123,6 @@ function applyNullableArrayField(
   target[key] = [...value];
 }
 
-export function shouldStoreMatrixAccountAtTopLevel(cfg: CoreConfig, accountId: string): boolean {
-  const normalizedAccountId = normalizeAccountId(accountId);
-  if (normalizedAccountId !== DEFAULT_ACCOUNT_ID) {
-    return false;
-  }
-  const accounts = cfg.channels?.matrix?.accounts;
-  return !accounts || Object.keys(accounts).length === 0;
-}
-
-export function resolveMatrixConfigPath(cfg: CoreConfig, accountId: string): string {
-  const normalizedAccountId = normalizeAccountId(accountId);
-  if (shouldStoreMatrixAccountAtTopLevel(cfg, normalizedAccountId)) {
-    return "channels.matrix";
-  }
-  return `channels.matrix.accounts.${normalizedAccountId}`;
-}
-
-export function resolveMatrixConfigFieldPath(
-  cfg: CoreConfig,
-  accountId: string,
-  fieldPath: string,
-): string {
-  const suffix = fieldPath.trim().replace(/^\.+/, "");
-  if (!suffix) {
-    return resolveMatrixConfigPath(cfg, accountId);
-  }
-  return `${resolveMatrixConfigPath(cfg, accountId)}.${suffix}`;
-}
-
 export function updateMatrixAccountConfig(
   cfg: CoreConfig,
   accountId: string,