Awesome, thanks! I take over. Some notes from codex review:

• BLOCKER: ESM require() in "type":"module" package → runtime crash.
  resolveCryptoStorePath/resolveStoragePath call require("node:os")/
  ("node:path"). extensions/matrix/src/matrix/client.ts:142.
• MAJOR: Thread replies dropped. sendMessageMatrix computes threadId
  then never uses it / no m.relates_to thread relation. Replies will
  post in main room. extensions/matrix/src/matrix/send.ts:502.
• MAJOR: Encrypted inbound media ignored. Only content.url handled;
  content.file never passed to downloadMatrixMedia, so E2EE
  attachments become text-only. extensions/matrix/src/matrix/monitor/
  index.ts:590.
• MEDIUM: Auto-join allowlist regression: alt_aliases no longer
  checked (only canonical alias). extensions/matrix/src/matrix/
  monitor/auto-join.ts:34.
• MEDIUM (risk): One-off clients (sendMessageMatrix w/o shared
  client) don’t crypto.prepare; E2EE rooms may look unencrypted or
  fail media encryption. extensions/matrix/src/matrix/send.ts:466.

Missing tests:

• E2EE inbound media via content.file decryption.
• Thread reply path (threadId → threaded send).

Landed via temp rebase onto main.

• Gate: pnpm lint && pnpm build && pnpm test
• Land commit: 627fa30
• Merge commit: 627fa30

Thanks @sibbl!

Landed follow-up fixes on main after rebase.

• Gate: pnpm lint && pnpm build && pnpm test
• Land commit: ${land_sha}
• Merge commit: ${merge_sha}

Thanks @sibbl!