fix(matrix): harden allowlists

extensions/matrix/src/resolve-targets.ts

@@ -28,6 +28,52 @@ function pickBestGroupMatch(
   return matches[0];
 }
 
+function pickBestUserMatch(
+  matches: ChannelDirectoryEntry[],
+  query: string,
+): ChannelDirectoryEntry | undefined {
+  if (matches.length === 0) {
+    return undefined;
+  }
+  const normalized = query.trim().toLowerCase();
+  if (!normalized) {
+    return undefined;
+  }
+  const exact = matches.filter((match) => {
+    const id = match.id.trim().toLowerCase();
+    const name = match.name?.trim().toLowerCase();
+    const handle = match.handle?.trim().toLowerCase();
+    return normalized === id || normalized === name || normalized === handle;
+  });
+  if (exact.length === 1) {
+    return exact[0];
+  }
+  return undefined;
+}
+
+function describeUserMatchFailure(matches: ChannelDirectoryEntry[], query: string): string {
+  if (matches.length === 0) {
+    return "no matches";
+  }
+  const normalized = query.trim().toLowerCase();
+  if (!normalized) {
+    return "empty input";
+  }
+  const exact = matches.filter((match) => {
+    const id = match.id.trim().toLowerCase();
+    const name = match.name?.trim().toLowerCase();
+    const handle = match.handle?.trim().toLowerCase();
+    return normalized === id || normalized === name || normalized === handle;
+  });
+  if (exact.length === 0) {
+    return "no exact match; use full Matrix ID";
+  }
+  if (exact.length > 1) {
+    return "multiple exact matches; use full Matrix ID";
+  }
+  return "no exact match; use full Matrix ID";
+}
+
 export async function resolveMatrixTargets(params: {
   cfg: unknown;
   inputs: string[];
@@ -52,13 +98,13 @@ export async function resolveMatrixTargets(params: {
           query: trimmed,
           limit: 5,
         });
-        const best = matches[0];
+        const best = pickBestUserMatch(matches, trimmed);
         results.push({
           input,
           resolved: Boolean(best?.id),
           id: best?.id,
           name: best?.name,
-          note: matches.length > 1 ? "multiple matches; chose first" : undefined,
+          note: best ? undefined : describeUserMatchFailure(matches, trimmed),
         });
       } catch (err) {
         params.runtime?.error?.(`matrix resolve failed: ${String(err)}`);