Frei Chat Index Bot (eng)
Frei Chat Index Bot – Help and Command Reference
In short: The Frei Chat Index Bot makes approved Matrix rooms searchable. It combines full-text search, typo-tolerant matching, and semantic similarity. It only shows content the requesting user is allowed to see according to their current membership and the historical visibility of each event.
Before publishing: Replace [BOT-MATRIX-ID] throughout this page with the Matrix ID of the production bot account, for example @frei-chat-index:example.org.
Bot account: [BOT-MATRIX-ID]
Command prefix: !fcib
Supported output languages: English and German
Suitable for: unencrypted and end-to-end encrypted Matrix rooms
Contents
- Quick start
- Basics and roles
- Searching and search filters
- Time zone and language
- Statistics
- Personal privacy
- Managing a room index
- Managing conversations
- Keyword blocks
- Global administration
- Data processing, security, and limitations
- Troubleshooting
- Quick reference
1. Quick start
Search the current room
!fcib search Project Phoenix
The bot searches only the room in which the command was sent.
Search for an exact phrase
!fcib search "Project Phoenix"
Quotation marks identify a phrase. Additional words outside the quotation marks are also used for full-text, typo-tolerant, and semantic matching.
Restrict results to a sender and date range
!fcib search -u @alice:example.org after:2026-01-01 before:2026-06-30 --limit 10 Migration
Show messages before and after a result
!fcib search -C 2 "Project Phoenix"
-C 2 shows up to two visible indexed messages before and after each result.
Search every room currently shared with the bot
!fcib search-all Migration
This command is available only in a securely verified two-person direct chat with the bot.
Show available help
!fcib help
The built-in help shows only commands the requester may use in the current room according to live authorization checks. Individual topics are available through commands such as !fcib help search, !fcib help privacy, and !fcib help index.
2. Basics and roles
Invitation and activation
- Invite
[BOT-MATRIX-ID]to the required Matrix room. - The bot checks its invitation policy. Invitations may be accepted or rejected according to server, room, and user rules.
- By default, a newly joined room waits for explicit opt-in.
- The stored bot room administrator enables indexing with
!fcib index enable. - The bot posts a visible privacy notice when indexing is enabled. Depending on configuration, it then starts a limited backfill of older messages visible to the bot.
Important: Inviting the bot does not necessarily enable indexing. Use !fcib index status to check the current state.
Command format
Every active command begins with !fcib. Legacy forms such as !search, !index, and !help are not executed. They are also excluded from the message index.
!fcib <subcommand> [options] [arguments]
Subcommands are case-insensitive. Values containing spaces must be quoted. Matrix user IDs, room IDs, and aliases must be supplied in full.
Roles and permissions
Role | Requirement | Typical permissions |
|---|---|---|
Room member | Currently joined and authorized for the room | Search the current room, read public room statistics, manage personal time zone, and request visible help |
Matrix room administrator | Configured Matrix power level, 50 by default | Claim a free or orphaned bot room administrator role with
|
Bot room administrator | Stored bot role and a sufficient Matrix power level at the time of every action | Enable, pause, resume, disable, or delete the room index; manage room keyword rules and conversations |
Global bot administrator | Authorized in deployment configuration or persistently delegated by a root administrator | Global privacy, server, configuration, statistics, and administrative functions; global commands are restricted to a verified bot DM |
Bootstrap/root administrator | Configured in
| Manage additional global administrators and restricted audit reviewers |
Audit reviewer | A time-limited and scope-limited audit grant | Read only the approved subset of the command audit |
What is a “verified bot DM”?
A verified bot DM is a room with exactly two current active members: the bot and the requester. If the bot has ever observed a third participant in the room, the room is conservatively disqualified from privileged DM functions. The installation may additionally require evidence from Matrix m.direct account data.
Responses and threads
- A command sent inside a thread is answered in that thread.
- In rooms with more than two currently joined members, an unthreaded command starts a new response thread.
- In a two-person DM, the bot responds normally in the room.
- Responses are safe plain text. Message content is never executed as HTML, code, SQL, a URL, or an instruction.
3. Searching and search filters
Search commands
Command | Scope | Requirement |
|---|---|---|
| Current room | Current authorization for that room |
| Current room | Alias for
|
| Current room | Default German alias; it may be configured differently by the installation |
| One specified room | Run from a verified bot DM; the requester must currently be allowed to search the target room |
| All currently shared, actively indexed rooms | Verified bot DM only |
A target room is accepted only in the form -r <room-ID|room-alias>. The forms --room, -r=…, and an unmarked room ID are deliberately rejected.
Supported room IDs
- Classic:
!localpart:server.example - Matrix room version 12:
!followed by 43 Base64url characters without a server part - Room alias:
#alias:server.example
Search filters
Filter | Meaning | Example |
|---|---|---|
| Only messages from this sender |
|
| Long form of
|
|
| Long form using an equals sign |
|
| Compact sender filter |
|
| From the beginning of this local calendar day |
|
| Through the end of this local calendar day |
|
or
| Maximum result count. The shipped defaults are 5 results and a maximum of 20; the installation may change them. |
|
or
| Up to N visible indexed messages after each result |
or
|
or
| Up to N visible indexed messages before each result |
or
|
or
| Up to N messages on each side |
or
|
| Requires the specified phrase |
|
By default, up to five context messages are allowed on each side and at most 100 context messages across the complete response. The effective limits may differ by installation or room.
Examples
!fcib search Migration
!fcib search "Project Phoenix"
!fcib search -u @alice:example.org -C 2 "Project Phoenix"
!fcib search after:2026-01-01 before:2026-06-01 --limit 10 Migration
!fcib search -r #project:example.org Migration
!fcib search -r !project:example.org --limit=8 "Release planning"
!fcib search-all from:@alice:example.org after:2026-01-01 Privacy
How search results are ranked
The bot combines three methods:
- Full-text search for words and phrases,
- trigram/typo-tolerant search for similarly spelled terms,
- semantic search using multilingual embeddings for content with similar meaning.
The three result rankings are fused. Semantic candidates below the configured similarity threshold are discarded. Matching automatically detected conversations may be suggested without an additional search option.
Result visibility
- Current Matrix membership is checked again before and after the search.
- Historical visibility is evaluated at the timestamp of every message.
- For an edited message, both the original and the valid edit must be visible.
- Incomplete historical evidence results in fewer results, not broader access.
- Results, context messages, and conversation suggestions use the same authorization checks.
- Each result contains a safe excerpt and a Matrix permalink.
Search output limitations
--limitrestricts the result count; there is currently no cursor for paging through further search results.- Context means adjacent indexed messages, not necessarily the complete Matrix timeline.
- Redacted, undecryptable, blocked, or expired events do not appear in context.
- The safe output formatter may omit context lines or additional results when a response becomes too large.
4. Time zone and language
Personal time zone
Command | Function |
|---|---|
| Shows the effective personal or default time zone. |
| Same as above. |
| Stores a personal IANA time zone. |
| Removes the personal value and returns to the bot default. |
The time zone controls result timestamps and the local day boundaries used by after: and before:. Matrix does not provide a standardized user time zone.
Room language
Command | Function | Permission |
|---|---|---|
or
| Shows the effective room language and the source of that value. | Authorized room member |
| Sets English for this room. | Bot room administrator with sufficient power level, or global administrator |
| Sets German for this room. | Bot room administrator with sufficient power level, or global administrator |
| Removes the room value and returns to the bot default. | Bot room administrator with sufficient power level, or global administrator |
5. Statistics
For regular users
Command | Output |
|---|---|
or
| Index state, encryption state, count, first timestamp, and last timestamp for messages historically visible to every current member of the room. |
| Your own stored message, redaction, media, edit, room, and embedding aggregates; verified bot DM only. |
For global administrators in a verified bot DM
Command | Output |
|---|---|
| Global bot, index, job, failure, conversation, and sync aggregates. |
| Server aggregates, up to 25 entries per page. |
| Rooms with state
,
,
,
, or
. |
| Aggregates for one Matrix server. |
| Complete stored aggregates for one room. |
| Stored aggregates for one user. |
Statistics commands return aggregates and operational state, never message content, search terms, or event IDs.
6. Personal privacy
The following self-service commands are available only in a verified bot DM.
Command | Effect |
|---|---|
| Shows whether future personal indexing is active or persistently blocked. |
| Requests a five-minute confirmation token. After confirmation, your sender ID and message text in every bot index are replaced with
, search derivatives are removed, and future content is excluded from indexing. |
| Short form of
. |
| Requests a second confirmation and then permits indexing of future content again. |
Example confirmation flow
!fcib privacy erase-all
# The bot responds with a time-limited token.
!fcib privacy erase-all confirm <TOKEN>
Cannot be restored: privacy resume does not restore previously redacted data. It only lifts the block for new content.
Event ID, room, timestamp, and relations remain as a non-searchable structural shell. The minimally required Matrix ID remains in the opt-out list. Membership intervals and the time-limited command audit remain stored separately for security and accountability.
7. Managing a room index
Index states
State | New content | Search | Stored data |
|---|---|---|---|
| Not indexed | Unavailable | The room is waiting for explicit activation |
| Indexed | Active | Index and derivatives are present |
| Not newly indexed | Existing data remains searchable | Retained |
| Not indexed | Unavailable | Retained until deleted or expired |
| Not indexed | Unavailable | The content index has been purged |
Status and room administrator
Command | Function | Permission |
|---|---|---|
| Shows index and encryption state for the current room. | Authorized member |
| Shows the stored bot room administrator and assignment source. | Authorized member |
| Claims a free or orphaned bot room administrator role. | Current Matrix room administrator with sufficient power level |
An existing room administrator can be replaced only when the bot can reliably establish that the person has left or no longer has the required power level. The claim is rejected if the state cannot be verified.
Index controls for bot room administrators
Command | Function |
|---|---|
| Enables indexing and, when configured, starts a limited backfill. |
| Stops indexing new content; existing data remains searchable. |
| Resumes a paused index and schedules conversation detection. |
| Disables indexing and search. Data remains stored until deleted or expired. |
| Requests confirmation, then deletes messages, search vectors, embeddings, and derived room data from the bot index. |
| After confirmation, deletes one user's content from the current room index. |
Warning: delete-room removes the room's PostgreSQL content index. It does not delete original events from the Matrix homeserver or selectively remove Olm/Megolm keys from the separate crypto store.
8. Managing conversations
The bot uses messages, replies, threads, time gaps, participants, and semantic similarity to detect topical conversations automatically. Detection is heuristic. Bot room administrators can correct derived metadata without modifying original Matrix events.
Viewing and rebuilding conversations
Command | Function |
|---|---|
| Lists visible conversations in the current room. |
| Shows safe details for a visible conversation. |
| Lists visible assigned events. |
| Shows an auditable history of manual changes. |
| Shows detection state and any open job for the current room. |
| Schedules a complete recalculation for the current room. |
Supported status filters are forming, active, dormant, closed, reopened, and ignored.
Editing metadata and state
Command | Function |
|---|---|
| Sets a manual title of up to 100 characters. |
| Sets a manual description of up to 500 characters. |
| Removes the manual title. |
| Removes the manual description. |
| Closes a conversation manually. |
| Reopens a closed conversation. |
| Marks a conversation as ignored. |
Tags and event assignments
Command | Function |
|---|---|
| Adds a manual keyword. |
| Removes a manual keyword. |
| Shows manual keywords. |
| Removes all manual keywords. |
| Excludes an event from automatic assignment. |
| Reverses an exclusion. |
| After confirmation, permanently removes an event from the bot index. |
Merging and splitting
Command | Function |
|---|---|
| After confirmation, permanently merges two conversations. |
| After confirmation, creates a new conversation beginning at the specified event. |
Manual merge and split assignments for existing events take precedence during later rebuilds. New events are still assigned heuristically.
Additional global conversation commands
Global administrators use these commands only in a verified bot DM:
!fcib conversation list -r <ROOM-ID> [--status STATUS] [--page N]
!fcib conversation show -r <ROOM-ID> <UUID>
!fcib conversation events -r <ROOM-ID> <UUID> [--page N]
!fcib conversation history -r <ROOM-ID> <UUID> [--page N]
!fcib conversation list-all [--server SERVER] [--status STATUS] [--page N]
!fcib conversation status -r <ROOM-ID>
!fcib conversation rebuild -r <ROOM-ID>
!fcib conversation jobs [--status pending|failed] [--page N]
!fcib conversation rebuild-all
rebuild-all requires a second confirmation.
9. Keyword blocks
Keyword blocks are Unicode-normalized, case-insensitive literal substrings. They are not regular expressions and have no linguistic word boundaries. Adding a rule requires confirmation and deletes existing matching plain text, edits, and optional filename metadata together with their search derivatives.
Current room
!fcib index keyword add room "literal phrase"
!fcib index keyword list room [page]
!fcib index keyword remove room <RULE-UUID>
The bot room administrator role and a sufficient current Matrix power level are required.
One user across all indexes
!fcib index keyword add user @user:server "literal phrase"
!fcib index keyword list user @user:server [page]
!fcib index keyword remove user @user:server <RULE-UUID>
Global administrator rights in a verified bot DM are required.
Bot-wide
!fcib index keyword add global "literal phrase"
!fcib index keyword list global [page]
!fcib index keyword remove global <RULE-UUID>
Global administrator rights in a verified bot DM are required. Each page contains at most 25 rules.
No automatic restoration: Removing a keyword rule does not restore data previously deleted by that rule. Restoration would require an explicitly controlled backfill.
10. Global administration
Every command in this section is restricted to a verified two-person DM with the bot.
Global bot administrators
!fcib admin list [page]
!fcib admin status @user:server
Only bootstrap/root administrators from FREI_CHAT_GLOBAL_ADMINS may grant or revoke persistent administrator rights:
!fcib admin add @user:server
!fcib admin remove @user:server
Configured bootstrap administrators cannot be removed through chat. Configured and persistent global administrators are exempt from bot rate limits.
Global user deletion
!fcib index delete-user-all @user:server
After confirmation, this command deletes the user's existing messages, edits, media metadata, search vectors, and embeddings from every known bot index. It does not prevent future indexing. The personal privacy erase-all command provides a persistent future opt-out.
Invitation servers and rules
By default, the bot accepts invitations only from its own homeserver. Global administrators can approve additional servers and allow either every user or only full regular-expression matches on those servers.
Command | Function |
|---|---|
| Lists approved invitation servers. |
| Shows approval, mode, rules, and revoke state. |
| Approves the server and lifts an active server revoke. |
| Removes the normal approval. |
| Allows every user or only full rule matches. |
| Adds a time-limited full-match regular expression. |
| Lists server rules page by page. |
| Removes a server rule. |
| After confirmation, blocks users and room IDs from this server and removes related index data. |
| After confirmation, blocks exactly one room. |
| After a revoke and a further confirmation, deletes all affected server room indexes and user contributions. |
| After a revoke and confirmation, deletes exactly this room index. |
Static deny lists and active revokes always take precedence. server allow removes an active server revoke but does not restore deleted data.
Persistent bot configuration
!fcib config global list [page]
!fcib config global get <KEY>
!fcib config global set <KEY> <VALUE>
!fcib config global reset <KEY>
!fcib config global history [page]
!fcib config room list [page]
!fcib config room <ROOM-ID> effective
!fcib config room <ROOM-ID> get <KEY>
!fcib config room <ROOM-ID> set <KEY> <VALUE>
!fcib config room <ROOM-ID> reset <KEY>
!fcib config room <ROOM-ID> history [page]
Value precedence is room override, then global database value, then deployment default. Setting and resetting values requires a five-minute confirmation token. Boolean values are written as true or false.
Common room-overridable settings
language,include_notices,store_media_metadatadefault_limit,max_limit,max_context_per_side,max_context_messages_totalmax_query_chars,max_message_charsbackfill_on_enable,backfill_page_size,backfill_max_eventsretention_days,retention_max_events,redaction_audit_days,delete_on_bot_leave- Room command and search rate limits
- Most
conversation_*detection and output limits exceptconversation_workers
Global-only settings
auto_join,require_room_opt_in,index_on_joindefault_timezone,admin_power_level- Bot-wide and per-user rate limits, and search concurrency
semantic_similarity_threshold_percent,conversation_workers- DM, sync, decryption, worker, and housekeeping limits
command_audit_retention_days
!fcib config global set retention_days 365
!fcib config room !room:server set backfill_max_events 5000
Secrets, database connections, Matrix tokens, device/E2EE keys, and embedding model or provider changes cannot be configured through chat. Some global service values become fully effective only after a controlled bot restart.
Command audit
!fcib audit list [--room <ROOM-ID>] [--user <USER-ID>]
[--after <DATE|ISO-TIME>] [--before <DATE|ISO-TIME>]
[--command <COMMAND>] [--outcome <STATUS>] [--page N]
Global administrators can see all entries, including safely structured parameters. Confirmation tokens are redacted in the audit. Delegated reviewers see only the intersection of their active room, actor, and time scopes; parameters are visible only when explicitly approved.
Only bootstrap/root administrators manage grants:
!fcib audit grant @user:server [--room <ROOM-ID>] [--actor <USER-ID>]
[--after <DATE|ISO-TIME>] [--before <DATE|ISO-TIME>]
[--expires-hours 1..168] [--parameters]
!fcib audit grants [--user <USER-ID>] [--page N]
!fcib audit revoke <GRANT-ID>
Grant creation and revocation require confirmation. The internal bot audit is not an immutable external audit trail; homeserver and database auditing must be added where such assurance is required.
11. Data processing, security, and limitations
What is indexed
- Supported text messages from unencrypted rooms
- Successfully locally decrypted text messages from E2EE rooms
- Sender, timestamp, event ID, room association, reply/thread relations, and valid edits
- Canonical plain text, full-text index, typo-tolerant index, and sensitive semantic embeddings
- Optionally, safe media metadata such as filename and MIME type when enabled by the installation
- Derived conversations, episodes, titles, tags, and assignments
- Membership and history-visibility intervals required for historical authorization
What is not indexed as searchable content
- Undecryptable E2EE events and ciphertext
- Bot commands and bot messages
- Reply fallback quotations
- Reactions, receipts, and typing notifications
- Media content, OCR, and audio/video transcription
- Redacted content or content blocked by keyword, user, or room rules
Edits and redactions
- An edit may replace only an older message by the same sender in the same room.
- Edits arriving out of order are retained for later application.
- Invalid edits lose their content and do not trigger a new embedding.
- A redaction removes original text, current text, search vector, and embedding.
- Tombstones prevent an event that arrives again later from reappearing in the index.
End-to-end encryption
Decryption occurs locally in the bot device's persistent Matrix crypto context. An event cannot be indexed without the correct room key. Historical completeness is therefore not guaranteed, especially for messages sent before the bot joined. A recovery key restores cross-signing trust but does not automatically import a complete Matrix key backup.
Embeddings
By default, the bot locally runs the multilingual paraphrase-multilingual-MiniLM-L12-v2 model and stores 384-dimensional embeddings. An external OpenAI-compatible embedding endpoint is technically supported, but disabled by default and protected by explicit double opt-in. The operator should clearly state whether the deployed instance sends content beyond the local security boundary.
Retention and deletion
- The shipped time-based content retention default is 365 days; global or room configuration may differ.
- The number of indexed root events per room may also be limited.
- Retention runs periodically and is not a synchronous insert quota.
- The command audit has separate retention, 90 days in the shipped configuration.
- Deletion commands remove bot index data, not original messages from the Matrix homeserver.
Security principles
- Fail closed: incomplete membership or visibility evidence never broadens access.
- Live checks: membership and permission are checked again for every sensitive request.
- Minimal disclosure: unauthorized users do not learn room names, result counts, or whether results exist.
- Plain-text output: message content is never interpreted as executable content.
- Parameterized database queries: search terms and message content are never executed as SQL.
- Second confirmation: destructive and highly privileged actions require a scope-bound token valid for five minutes.
- Rate limits: global, user, command-room, search, and target-room limits protect the service from abuse.
Important known limitations
- The bot knows only rooms in which its own account is or was a member.
- Missing historical E2EE keys and missing server-side history cannot be reconstructed.
- Historical authorization depends on observed membership and history-visibility events; missing history reduces results.
- Conversation detection is heuristic and may merge or split simultaneous topics.
- The first sync without a saved checkpoint suppresses old timeline commands. A command sent during this startup window must be repeated after the bot is ready.
- Authorization is a point-in-time snapshot in a distributed system. The bot checks immediately before and after a search, but cannot atomically coordinate a leave occurring in the milliseconds between the final check and sending the response.
- Complex HTML formatting and links in messages are deliberately reduced to safe plain text.
- A malicious or compromised homeserver is inside the trust boundary for events and membership data.
12. Troubleshooting
Symptom or message | Likely cause | Resolution |
|---|---|---|
The bot does not respond to
. | Direct legacy commands are disabled. | Use
. |
“Permission denied. Membership, room type and authorization were checked live.” | Missing membership, wrong role, insufficient power level, or the command was run outside its permitted DM/room context. | Check membership and role; run global commands in a verified bot DM. |
“This room is not a securely verified bot DM.” | The room does not contain exactly the bot and requester as current members, or the bot previously observed a third member. | Create a new genuine two-person DM with the bot. In strict deployments, also check the direct-chat marker. |
“No visible results found.” | No match, inactive index, expired content, missing historical visibility, or a missing E2EE key. | Check
, loosen the search filters, or contact the room administrator or bot operator. |
The confirmation token is invalid or expired. | The token is older than five minutes, belongs to another room/scope, or the command arguments were changed. | Send the initial command again and use the confirmation line returned by the bot without modifying it. |
“Too many commands.” | A persistent rate limit was reached. | Wait until the UTC timestamp shown in the response.
normally costs more than a single-room search. |
Date filters appear shifted by one day. | The personal or default time zone is incorrect. | Check
and set an appropriate zone, for example
. |
Older encrypted messages are missing. | The bot does not have the relevant Megolm session or was not allowed to see the event. | Ask the operator to check device trust and key sharing. History from before the bot joined is not guaranteed. |
is rejected. | The stored administrator is still authorized, or their current state could not be verified. | Check membership and power levels; retry later if Matrix state could not be read reliably. |
The bot cannot answer in an E2EE room. | One or more room devices may not meet the configured trust threshold for secure outbound messages. | Verify devices and repeat the command. |
“Internal database error” or “Internal processing error.” | A safely contained internal error occurred. | Tell the bot operator the time, room, and command used. Do not share secrets or confirmation tokens. |
13. Quick reference
Regular use
!fcib help [TOPIC]
!fcib search <QUERY>
!fcib find <QUERY>
!fcib search -r <ROOM-ID|ROOM-ALIAS> <QUERY>
!fcib search-all <QUERY>
!fcib timezone status|reset|<IANA-TIMEZONE>
!fcib language status
!fcib stats room
!fcib stats user
!fcib privacy status|erase-all|resume
!fcib forget-me
!fcib index status
!fcib index admin status
Bot room administrator
!fcib index enable|pause|resume|disable
!fcib index delete-room
!fcib index delete-user @user:server
!fcib index keyword add|list|remove room …
!fcib language en|de|reset
!fcib conversation …
Global administration in the bot DM
!fcib admin …
!fcib audit …
!fcib config global …
!fcib config room …
!fcib server …
!fcib stats global|servers|rooms|server|room|user …
!fcib index delete-user-all @user:server
!fcib index keyword add|list|remove user|global …
!fcib conversation list-all|jobs|rebuild-all …
Built-in help topics
!fcib help help
!fcib help search
!fcib help timezone
!fcib help language
!fcib help stats
!fcib help index
!fcib help privacy
!fcib help keywords
!fcib help conversations
!fcib help admins
!fcib help servers
!fcib help config
!fcib help audit
!fcib help security
This help page describes the Frei Chat Index Bot feature set as of July 20, 2026. Effective limits, language, retention, and enabled features may differ in the deployed instance. When in doubt, !fcib help shows the currently available commands, while !fcib config … get|effective shows effective configuration.