@spacebar_ai/moldclaw-core 2026.3.14 → 2026.3.16

package/dist/monitor-DZb5IJle.js

@@ -0,0 +1,777 @@
+import "./redact-fatrROh9.js";
+import "./errors-DOJWZqNo.js";
+import "./unhandled-rejections-CTvNvnT0.js";
+import "./logger-BFfIIIKH.js";
+import "./paths-D6AgsMTU.js";
+import "./tmp-moldclaw-dir-DWF-d8qD.js";
+import "./theme-BSXzMzAA.js";
+import "./globals-DESrFYmC.js";
+import "./subsystem-S4LNMNHd.js";
+import "./ansi-BPhP6LBZ.js";
+import "./boolean-D8Ha5nYV.js";
+import "./env-Dgex_t9p.js";
+import "./warning-filter-gJuwHM7C.js";
+import "./utils-rjVNXUns.js";
+import "./links-C5I443Xb.js";
+import "./setup-binary-Fw3cCSWL.js";
+import { Ah as createScopedPairingAccess, Nd as resolveDmGroupAccessWithLists, Od as DM_GROUP_ACCESS_REASON, Oh as issuePairingChallenge, Qg as buildPendingHistoryContextFromMap, ag as createTypingCallbacks, bs as resolveMentionGatingWithBypass, e_ as clearHistoryEntriesIfEnabled, r_ as recordPendingHistoryEntryIfEnabled, sT as mergeAllowlist, sg as createReplyPrefixOptions, tC as isDangerousNameMatchingEnabled, uT as summarizeMapping } from "./auth-profiles-9zZdaXJK.js";
+import "./model-selection-DfA4esOK.js";
+import "./agent-scope-DA7O8MVG.js";
+import "./boundary-file-read-Y1cMjPlu.js";
+import "./logger-wrbK9-ju.js";
+import "./exec-CoBTyh8B.js";
+import "./workspace-CxNKYS0V.js";
+import "./io-C6XifaT4.js";
+import "./host-env-security-xy11yVnm.js";
+import "./safe-text-BcUvBreN.js";
+import "./version-rW_3ob2o.js";
+import "./env-substitution-C9xZMTDL.js";
+import "./config-state-D1JkXt39.js";
+import "./network-mode-CE-ihBf6.js";
+import "./registry-DcDGl2X7.js";
+import "./manifest-registry-_0xclaVY.js";
+import "./ip-w605xvSx.js";
+import "./zod-schema.core-D5reNip6.js";
+import "./config-B2W1zTP1.js";
+import "./audit-fs-SjcfoPO7.js";
+import "./resolve-BbsCHGLY.js";
+import "./provider-web-search-BJhXD5dH.js";
+import "./text-runtime-CgEQ9Y9_.js";
+import "./workspace-dirs-d3Ms_ryk.js";
+import "./config-CMhKplgO.js";
+import "./tailnet-KyAU6tj_.js";
+import "./net-B_Iq_SVP.js";
+import "./credentials-yYt6VWCq.js";
+import "./routes-BZtqNrBf.js";
+import "./frontmatter-BTDAgsA3.js";
+import "./env-overrides-DYVIkuvN.js";
+import "./path-alias-guards-B3ZKrId1.js";
+import "./skills-4-r1mfJM.js";
+import "./ports-BVwQuCIR.js";
+import "./ports-lsof-DiY6GaAf.js";
+import "./ssh-tunnel-BaHTFPzH.js";
+import "./image-ops-Uw4rEShL.js";
+import "./fs-safe-Da4H0IOU.js";
+import "./mime-_IkgFMS2.js";
+import "./server-middleware-BPq4bu3A.js";
+import "./message-channel-CKeDAoOT.js";
+import "./resolve-route-IkBfMjBz.js";
+import "./internal-hooks-0x1JiQ5f.js";
+import { a as resolveSenderScopedGroupPolicy, f as warnMissingProviderGroupPolicyFallbackOnce, l as resolveDefaultGroupPolicy, t as evaluateGroupRouteAccessForPolicy, u as resolveOpenProviderRuntimeGroupPolicy } from "./group-access-BWGTPTwF.js";
+import "./lazy-runtime-DdzFA4b9.js";
+import "./config-schema-pPBCF4hz.js";
+import "./method-scopes-Du8ODGFW.js";
+import "./session-cost-usage-B-57mlS8.js";
+import "./paths-CDWV-9nX.js";
+import "./routing-3o2D0ix4.js";
+import "./send-BRRtHxyR.js";
+import "./node-resolve-CupmrA0Y.js";
+import "./provider-stream-gVymYPmd.js";
+import "./identity-file-DM4N5_7H.js";
+import "./provider-models-BA3hqqPq.js";
+import "./secret-file-Bjh19aoH.js";
+import "./logging-BdFqMomc.js";
+import "./runtime-env-CT-voxYE.js";
+import "./registry-Dgwc-7eS.js";
+import "./provider-onboard-CBC3kdk_.js";
+import "./model-definitions-DwehIMlw.js";
+import "./diagnostic-CkiYEGqt.js";
+import "./message-hook-mappers-DORrSLHM.js";
+import { t as KeyedAsyncQueue } from "./keyed-async-queue-BGC0Vi7n.js";
+import "./json-store-DlpyvQXN.js";
+import "./call-DYFR7oGy.js";
+import "./multimodal-BWF8MRkz.js";
+import "./memory-search-BBG2BKIh.js";
+import "./query-expansion-8R79qExs.js";
+import "./search-manager-DxkQvUrW.js";
+import "./core-EKuk2FxR.js";
+import "./issue-format-i6sEuV4a.js";
+import "./logging-BhqLWxTD.js";
+import "./note-z78_JyNp.js";
+import "./state-paths-C7dX__ql.js";
+import "./config-value-Dl3XEpA6.js";
+import "./command-secret-targets-CO_lZ_ZZ.js";
+import "./brave-CljenznH.js";
+import "./provider-usage-DzuzbNBv.js";
+import "./perplexity-Bw1u3CAF.js";
+import "./restart-stale-pids-CN9ElYwR.js";
+import "./delivery-queue-DLjFP-0C.js";
+import "./pairing-token-ANLRyJSu.js";
+import "./accounts-BCaV8MsT.js";
+import "./process-runtime-CicRKAFe.js";
+import "./audit-hdKa3D-u.js";
+import "./cli-runtime-DtIDS2w7.js";
+import "./cli-utils-FHeUZLsT.js";
+import "./help-format-1yV2Xzq7.js";
+import "./progress-BQSTKUhd.js";
+import "./gateway-runtime-D9FRZqKP.js";
+import "./channel-policy-c4_vurDT.js";
+import "./reply-history-D-Y_nSJn.js";
+import { a as sendMediaWithLeadingCaption, i as resolveOutboundMediaUrls } from "./reply-payload-CKw7gJdJ.js";
+import "./outbound-media-BiJscGlR.js";
+import { a as resolveSenderCommandAuthorization } from "./text-chunking-C8kmbNfa.js";
+import { S as startZaloListener, T as getZalouserRuntime, f as listZaloGroups, h as resolveZaloGroupContext, l as listZaloFriends } from "./zalouser-CuxRvztM.js";
+import "./json-bigint-DKYSyEOX.js";
+import "./form_data-CAqluYp-.js";
+import "./safe-buffer-Dypk2Sdv.js";
+import { c as formatZalouserMessageSidFull, d as buildZalouserGroupCandidates, f as findZalouserGroupEntry, i as sendMessageZalouser, l as resolveZalouserMessageSid, o as sendSeenZalouser, p as isZalouserGroupEntryAllowed, s as sendTypingZalouser, t as sendDeliveredZalouser } from "./send-B01Gvh9m.js";
+//#region extensions/shared/deferred.ts
+function createDeferred() {
+	let resolve;
+	let reject;
+	return {
+		promise: new Promise((res, rej) => {
+			resolve = res;
+			reject = rej;
+		}),
+		resolve,
+		reject
+	};
+}
+//#endregion
+//#region extensions/zalouser/src/monitor.ts
+const ZALOUSER_TEXT_LIMIT = 2e3;
+function normalizeZalouserEntry(entry) {
+	return entry.replace(/^(zalouser|zlu):/i, "").trim();
+}
+function buildNameIndex(items, nameFn) {
+	const index = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const name = nameFn(item)?.trim().toLowerCase();
+		if (!name) continue;
+		const list = index.get(name) ?? [];
+		list.push(item);
+		index.set(name, list);
+	}
+	return index;
+}
+function resolveUserAllowlistEntries(entries, byName) {
+	const additions = [];
+	const mapping = [];
+	const unresolved = [];
+	for (const entry of entries) {
+		if (/^\d+$/.test(entry)) {
+			additions.push(entry);
+			continue;
+		}
+		const match = (byName.get(entry.toLowerCase()) ?? [])[0];
+		const id = match?.userId ? String(match.userId) : void 0;
+		if (id) {
+			additions.push(id);
+			mapping.push(`${entry}->${id}`);
+		} else unresolved.push(entry);
+	}
+	return {
+		additions,
+		mapping,
+		unresolved
+	};
+}
+function resolveInboundQueueKey(message) {
+	const threadId = message.threadId?.trim() || "unknown";
+	if (message.isGroup) return `group:${threadId}`;
+	return `direct:${message.senderId?.trim() || threadId}`;
+}
+function resolveZalouserDmSessionScope(config) {
+	const configured = config.session?.dmScope;
+	return configured === "main" || !configured ? "per-channel-peer" : configured;
+}
+function resolveZalouserInboundSessionKey(params) {
+	if (params.isGroup) return params.route.sessionKey;
+	const directSessionKey = params.core.channel.routing.buildAgentSessionKey({
+		agentId: params.route.agentId,
+		channel: "zalouser",
+		accountId: params.route.accountId,
+		peer: {
+			kind: "direct",
+			id: params.senderId
+		},
+		dmScope: resolveZalouserDmSessionScope(params.config),
+		identityLinks: params.config.session?.identityLinks
+	}).toLowerCase();
+	const legacySessionKey = params.core.channel.routing.buildAgentSessionKey({
+		agentId: params.route.agentId,
+		channel: "zalouser",
+		accountId: params.route.accountId,
+		peer: {
+			kind: "group",
+			id: params.senderId
+		}
+	}).toLowerCase();
+	const hasDirectSession = params.core.channel.session.readSessionUpdatedAt({
+		storePath: params.storePath,
+		sessionKey: directSessionKey
+	}) !== void 0;
+	return params.core.channel.session.readSessionUpdatedAt({
+		storePath: params.storePath,
+		sessionKey: legacySessionKey
+	}) !== void 0 && !hasDirectSession ? legacySessionKey : directSessionKey;
+}
+function logVerbose(core, runtime, message) {
+	if (core.logging.shouldLogVerbose()) runtime.log(`[zalouser] ${message}`);
+}
+function isSenderAllowed(senderId, allowFrom) {
+	if (allowFrom.includes("*")) return true;
+	const normalizedSenderId = senderId?.trim().toLowerCase();
+	if (!normalizedSenderId) return false;
+	return allowFrom.some((entry) => {
+		return entry.toLowerCase().replace(/^(zalouser|zlu):/i, "") === normalizedSenderId;
+	});
+}
+function resolveGroupRequireMention(params) {
+	const entry = findZalouserGroupEntry(params.groups ?? {}, buildZalouserGroupCandidates({
+		groupId: params.groupId,
+		groupName: params.groupName,
+		includeGroupIdAlias: true,
+		includeWildcard: true,
+		allowNameMatching: params.allowNameMatching
+	}));
+	if (typeof entry?.requireMention === "boolean") return entry.requireMention;
+	return true;
+}
+async function sendZalouserDeliveryAcks(params) {
+	await sendDeliveredZalouser({
+		profile: params.profile,
+		isGroup: params.isGroup,
+		message: params.message,
+		isSeen: true
+	});
+	await sendSeenZalouser({
+		profile: params.profile,
+		isGroup: params.isGroup,
+		message: params.message
+	});
+}
+async function processMessage(message, account, config, core, runtime, historyState, statusSink) {
+	const pairing = createScopedPairingAccess({
+		core,
+		channel: "zalouser",
+		accountId: account.accountId
+	});
+	const rawBody = message.content?.trim();
+	if (!rawBody) return;
+	const commandBody = message.commandContent?.trim() || rawBody;
+	const isGroup = message.isGroup;
+	const chatId = message.threadId;
+	const senderId = message.senderId?.trim();
+	if (!senderId) {
+		logVerbose(core, runtime, `zalouser: drop message ${chatId} (missing senderId)`);
+		return;
+	}
+	const senderName = message.senderName ?? "";
+	const configuredGroupName = message.groupName?.trim() || "";
+	const groupContext = isGroup && !configuredGroupName ? await resolveZaloGroupContext(account.profile, chatId).catch((err) => {
+		logVerbose(core, runtime, `zalouser: group context lookup failed for ${chatId}: ${String(err)}`);
+		return null;
+	}) : null;
+	const groupName = configuredGroupName || groupContext?.name?.trim() || "";
+	const groupMembers = groupContext?.members?.slice(0, 20).join(", ") || void 0;
+	if (message.eventMessage) try {
+		await sendZalouserDeliveryAcks({
+			profile: account.profile,
+			isGroup,
+			message: message.eventMessage
+		});
+	} catch (err) {
+		logVerbose(core, runtime, `zalouser: delivery/seen ack failed for ${chatId}: ${String(err)}`);
+	}
+	const defaultGroupPolicy = resolveDefaultGroupPolicy(config);
+	const { groupPolicy, providerMissingFallbackApplied } = resolveOpenProviderRuntimeGroupPolicy({
+		providerConfigPresent: config.channels?.zalouser !== void 0,
+		groupPolicy: account.config.groupPolicy,
+		defaultGroupPolicy
+	});
+	warnMissingProviderGroupPolicyFallbackOnce({
+		providerMissingFallbackApplied,
+		providerKey: "zalouser",
+		accountId: account.accountId,
+		log: (entry) => logVerbose(core, runtime, entry)
+	});
+	const groups = account.config.groups ?? {};
+	const allowNameMatching = isDangerousNameMatchingEnabled(account.config);
+	if (isGroup) {
+		const groupEntry = findZalouserGroupEntry(groups, buildZalouserGroupCandidates({
+			groupId: chatId,
+			groupName,
+			includeGroupIdAlias: true,
+			includeWildcard: true,
+			allowNameMatching
+		}));
+		const routeAccess = evaluateGroupRouteAccessForPolicy({
+			groupPolicy,
+			routeAllowlistConfigured: Object.keys(groups).length > 0,
+			routeMatched: Boolean(groupEntry),
+			routeEnabled: isZalouserGroupEntryAllowed(groupEntry)
+		});
+		if (!routeAccess.allowed) {
+			if (routeAccess.reason === "disabled") logVerbose(core, runtime, `zalouser: drop group ${chatId} (groupPolicy=disabled)`);
+			else if (routeAccess.reason === "empty_allowlist") logVerbose(core, runtime, `zalouser: drop group ${chatId} (groupPolicy=allowlist, no allowlist)`);
+			else if (routeAccess.reason === "route_not_allowlisted") logVerbose(core, runtime, `zalouser: drop group ${chatId} (not allowlisted)`);
+			else if (routeAccess.reason === "route_disabled") logVerbose(core, runtime, `zalouser: drop group ${chatId} (group disabled)`);
+			return;
+		}
+	}
+	const dmPolicy = account.config.dmPolicy ?? "pairing";
+	const configAllowFrom = (account.config.allowFrom ?? []).map((v) => String(v));
+	const configGroupAllowFrom = (account.config.groupAllowFrom ?? []).map((v) => String(v));
+	const senderGroupPolicy = resolveSenderScopedGroupPolicy({
+		groupPolicy,
+		groupAllowFrom: configGroupAllowFrom
+	});
+	const shouldComputeCommandAuth = core.channel.commands.shouldComputeCommandAuthorized(commandBody, config);
+	const storeAllowFrom = !isGroup && dmPolicy !== "allowlist" && (dmPolicy !== "open" || shouldComputeCommandAuth) ? await pairing.readAllowFromStore().catch(() => []) : [];
+	const accessDecision = resolveDmGroupAccessWithLists({
+		isGroup,
+		dmPolicy,
+		groupPolicy: senderGroupPolicy,
+		allowFrom: configAllowFrom,
+		groupAllowFrom: configGroupAllowFrom,
+		storeAllowFrom,
+		groupAllowFromFallbackToAllowFrom: false,
+		isSenderAllowed: (allowFrom) => isSenderAllowed(senderId, allowFrom)
+	});
+	if (isGroup && accessDecision.decision !== "allow") {
+		if (accessDecision.reasonCode === DM_GROUP_ACCESS_REASON.GROUP_POLICY_EMPTY_ALLOWLIST) logVerbose(core, runtime, "Blocked zalouser group message (no group allowlist)");
+		else if (accessDecision.reasonCode === DM_GROUP_ACCESS_REASON.GROUP_POLICY_NOT_ALLOWLISTED) logVerbose(core, runtime, `Blocked zalouser sender ${senderId} (not in groupAllowFrom/allowFrom)`);
+		return;
+	}
+	if (!isGroup && accessDecision.decision !== "allow") {
+		if (accessDecision.decision === "pairing") {
+			await issuePairingChallenge({
+				channel: "zalouser",
+				senderId,
+				senderIdLine: `Your Zalo user id: ${senderId}`,
+				meta: { name: senderName || void 0 },
+				upsertPairingRequest: pairing.upsertPairingRequest,
+				onCreated: () => {
+					logVerbose(core, runtime, `zalouser pairing request sender=${senderId}`);
+				},
+				sendPairingReply: async (text) => {
+					await sendMessageZalouser(chatId, text, { profile: account.profile });
+					statusSink?.({ lastOutboundAt: Date.now() });
+				},
+				onReplyError: (err) => {
+					logVerbose(core, runtime, `zalouser pairing reply failed for ${senderId}: ${String(err)}`);
+				}
+			});
+			return;
+		}
+		if (accessDecision.reasonCode === DM_GROUP_ACCESS_REASON.DM_POLICY_DISABLED) logVerbose(core, runtime, `Blocked zalouser DM from ${senderId} (dmPolicy=disabled)`);
+		else logVerbose(core, runtime, `Blocked unauthorized zalouser sender ${senderId} (dmPolicy=${dmPolicy})`);
+		return;
+	}
+	const { commandAuthorized } = await resolveSenderCommandAuthorization({
+		cfg: config,
+		rawBody: commandBody,
+		isGroup,
+		dmPolicy,
+		configuredAllowFrom: configAllowFrom,
+		configuredGroupAllowFrom: configGroupAllowFrom,
+		senderId,
+		isSenderAllowed,
+		readAllowFromStore: async () => storeAllowFrom,
+		shouldComputeCommandAuthorized: (body, cfg) => core.channel.commands.shouldComputeCommandAuthorized(body, cfg),
+		resolveCommandAuthorizedFromAuthorizers: (params) => core.channel.commands.resolveCommandAuthorizedFromAuthorizers(params)
+	});
+	const hasControlCommand = core.channel.commands.isControlCommandMessage(commandBody, config);
+	if (isGroup && hasControlCommand && commandAuthorized !== true) {
+		logVerbose(core, runtime, `zalouser: drop control command from unauthorized sender ${senderId}`);
+		return;
+	}
+	const peer = isGroup ? {
+		kind: "group",
+		id: chatId
+	} : {
+		kind: "direct",
+		id: senderId
+	};
+	const route = core.channel.routing.resolveAgentRoute({
+		cfg: config,
+		channel: "zalouser",
+		accountId: account.accountId,
+		peer: {
+			kind: peer.kind,
+			id: peer.id
+		}
+	});
+	const historyKey = isGroup ? route.sessionKey : void 0;
+	const requireMention = isGroup ? resolveGroupRequireMention({
+		groupId: chatId,
+		groupName,
+		groups,
+		allowNameMatching
+	}) : false;
+	const mentionRegexes = core.channel.mentions.buildMentionRegexes(config, route.agentId);
+	const explicitMention = {
+		hasAnyMention: message.hasAnyMention === true,
+		isExplicitlyMentioned: message.wasExplicitlyMentioned === true,
+		canResolveExplicit: message.canResolveExplicitMention === true
+	};
+	const wasMentioned = isGroup ? core.channel.mentions.matchesMentionWithExplicit({
+		text: rawBody,
+		mentionRegexes,
+		explicit: explicitMention
+	}) : true;
+	const canDetectMention = mentionRegexes.length > 0 || explicitMention.canResolveExplicit;
+	const mentionGate = resolveMentionGatingWithBypass({
+		isGroup,
+		requireMention,
+		canDetectMention,
+		wasMentioned,
+		implicitMention: message.implicitMention === true,
+		hasAnyMention: explicitMention.hasAnyMention,
+		allowTextCommands: core.channel.commands.shouldHandleTextCommands({
+			cfg: config,
+			surface: "zalouser"
+		}),
+		hasControlCommand,
+		commandAuthorized: commandAuthorized === true
+	});
+	if (isGroup && requireMention && !canDetectMention && !mentionGate.effectiveWasMentioned) {
+		runtime.error?.(`[${account.accountId}] zalouser mention required but detection unavailable (missing mention regexes and bot self id); dropping group ${chatId}`);
+		return;
+	}
+	if (isGroup && mentionGate.shouldSkip) {
+		recordPendingHistoryEntryIfEnabled({
+			historyMap: historyState.groupHistories,
+			historyKey: historyKey ?? "",
+			limit: historyState.historyLimit,
+			entry: historyKey && rawBody ? {
+				sender: senderName || senderId,
+				body: rawBody,
+				timestamp: message.timestampMs,
+				messageId: resolveZalouserMessageSid({
+					msgId: message.msgId,
+					cliMsgId: message.cliMsgId,
+					fallback: `${message.timestampMs}`
+				})
+			} : null
+		});
+		logVerbose(core, runtime, `zalouser: skip group ${chatId} (mention required, not mentioned)`);
+		return;
+	}
+	const fromLabel = isGroup ? groupName || `group:${chatId}` : senderName || `user:${senderId}`;
+	const storePath = core.channel.session.resolveStorePath(config.session?.store, { agentId: route.agentId });
+	const inboundSessionKey = resolveZalouserInboundSessionKey({
+		core,
+		config,
+		route,
+		storePath,
+		isGroup,
+		senderId
+	});
+	const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(config);
+	const previousTimestamp = core.channel.session.readSessionUpdatedAt({
+		storePath,
+		sessionKey: inboundSessionKey
+	});
+	const body = core.channel.reply.formatAgentEnvelope({
+		channel: "Zalo Personal",
+		from: fromLabel,
+		timestamp: message.timestampMs,
+		previousTimestamp,
+		envelope: envelopeOptions,
+		body: rawBody
+	});
+	const combinedBody = isGroup && historyKey ? buildPendingHistoryContextFromMap({
+		historyMap: historyState.groupHistories,
+		historyKey,
+		limit: historyState.historyLimit,
+		currentMessage: body,
+		formatEntry: (entry) => core.channel.reply.formatAgentEnvelope({
+			channel: "Zalo Personal",
+			from: fromLabel,
+			timestamp: entry.timestamp,
+			envelope: envelopeOptions,
+			body: `${entry.sender}: ${entry.body}${entry.messageId ? ` [id:${entry.messageId}]` : ""}`
+		})
+	}) : body;
+	const inboundHistory = isGroup && historyKey && historyState.historyLimit > 0 ? (historyState.groupHistories.get(historyKey) ?? []).map((entry) => ({
+		sender: entry.sender,
+		body: entry.body,
+		timestamp: entry.timestamp
+	})) : void 0;
+	const normalizedTo = isGroup ? `zalouser:group:${chatId}` : `zalouser:${chatId}`;
+	const ctxPayload = core.channel.reply.finalizeInboundContext({
+		Body: combinedBody,
+		BodyForAgent: rawBody,
+		InboundHistory: inboundHistory,
+		RawBody: rawBody,
+		CommandBody: commandBody,
+		BodyForCommands: commandBody,
+		From: isGroup ? `zalouser:group:${chatId}` : `zalouser:${senderId}`,
+		To: normalizedTo,
+		SessionKey: inboundSessionKey,
+		AccountId: route.accountId,
+		ChatType: isGroup ? "group" : "direct",
+		ConversationLabel: fromLabel,
+		GroupSubject: isGroup ? groupName || void 0 : void 0,
+		GroupChannel: isGroup ? groupName || void 0 : void 0,
+		GroupMembers: isGroup ? groupMembers : void 0,
+		SenderName: senderName || void 0,
+		SenderId: senderId,
+		WasMentioned: isGroup ? mentionGate.effectiveWasMentioned : void 0,
+		CommandAuthorized: commandAuthorized,
+		Provider: "zalouser",
+		Surface: "zalouser",
+		MessageSid: resolveZalouserMessageSid({
+			msgId: message.msgId,
+			cliMsgId: message.cliMsgId,
+			fallback: `${message.timestampMs}`
+		}),
+		MessageSidFull: formatZalouserMessageSidFull({
+			msgId: message.msgId,
+			cliMsgId: message.cliMsgId
+		}),
+		OriginatingChannel: "zalouser",
+		OriginatingTo: normalizedTo
+	});
+	await core.channel.session.recordInboundSession({
+		storePath,
+		sessionKey: ctxPayload.SessionKey ?? route.sessionKey,
+		ctx: ctxPayload,
+		onRecordError: (err) => {
+			runtime.error?.(`zalouser: failed updating session meta: ${String(err)}`);
+		}
+	});
+	const { onModelSelected, ...prefixOptions } = createReplyPrefixOptions({
+		cfg: config,
+		agentId: route.agentId,
+		channel: "zalouser",
+		accountId: account.accountId
+	});
+	const typingCallbacks = createTypingCallbacks({
+		start: async () => {
+			await sendTypingZalouser(chatId, {
+				profile: account.profile,
+				isGroup
+			});
+		},
+		onStartError: (err) => {
+			runtime.error?.(`[${account.accountId}] zalouser typing start failed for ${chatId}: ${String(err)}`);
+			logVerbose(core, runtime, `zalouser typing failed for ${chatId}: ${String(err)}`);
+		}
+	});
+	await core.channel.reply.dispatchReplyWithBufferedBlockDispatcher({
+		ctx: ctxPayload,
+		cfg: config,
+		dispatcherOptions: {
+			...prefixOptions,
+			typingCallbacks,
+			deliver: async (payload) => {
+				await deliverZalouserReply({
+					payload,
+					profile: account.profile,
+					chatId,
+					isGroup,
+					runtime,
+					core,
+					config,
+					accountId: account.accountId,
+					statusSink,
+					tableMode: core.channel.text.resolveMarkdownTableMode({
+						cfg: config,
+						channel: "zalouser",
+						accountId: account.accountId
+					})
+				});
+			},
+			onError: (err, info) => {
+				runtime.error(`[${account.accountId}] Zalouser ${info.kind} reply failed: ${String(err)}`);
+			}
+		},
+		replyOptions: { onModelSelected }
+	});
+	if (isGroup && historyKey) clearHistoryEntriesIfEnabled({
+		historyMap: historyState.groupHistories,
+		historyKey,
+		limit: historyState.historyLimit
+	});
+}
+async function deliverZalouserReply(params) {
+	const { payload, profile, chatId, isGroup, runtime, core, config, accountId, statusSink } = params;
+	const tableMode = params.tableMode ?? "code";
+	const text = core.channel.text.convertMarkdownTables(payload.text ?? "", tableMode);
+	const chunkMode = core.channel.text.resolveChunkMode(config, "zalouser", accountId);
+	const textChunkLimit = core.channel.text.resolveTextChunkLimit(config, "zalouser", accountId, { fallbackLimit: ZALOUSER_TEXT_LIMIT });
+	if (await sendMediaWithLeadingCaption({
+		mediaUrls: resolveOutboundMediaUrls(payload),
+		caption: text,
+		send: async ({ mediaUrl, caption }) => {
+			logVerbose(core, runtime, `Sending media to ${chatId}`);
+			await sendMessageZalouser(chatId, caption ?? "", {
+				profile,
+				mediaUrl,
+				isGroup,
+				textMode: "markdown",
+				textChunkMode: chunkMode,
+				textChunkLimit
+			});
+			statusSink?.({ lastOutboundAt: Date.now() });
+		},
+		onError: (error) => {
+			runtime.error(`Zalouser media send failed: ${String(error)}`);
+		}
+	})) return;
+	if (text) try {
+		await sendMessageZalouser(chatId, text, {
+			profile,
+			isGroup,
+			textMode: "markdown",
+			textChunkMode: chunkMode,
+			textChunkLimit
+		});
+		statusSink?.({ lastOutboundAt: Date.now() });
+	} catch (err) {
+		runtime.error(`Zalouser message send failed: ${String(err)}`);
+	}
+}
+async function monitorZalouserProvider(options) {
+	let { account, config } = options;
+	const { abortSignal, statusSink, runtime } = options;
+	const core = getZalouserRuntime();
+	const inboundQueue = new KeyedAsyncQueue();
+	const historyLimit = Math.max(0, account.config.historyLimit ?? config.messages?.groupChat?.historyLimit ?? 50);
+	const groupHistories = /* @__PURE__ */ new Map();
+	try {
+		const profile = account.profile;
+		const allowFromEntries = (account.config.allowFrom ?? []).map((entry) => normalizeZalouserEntry(String(entry))).filter((entry) => entry && entry !== "*");
+		const groupAllowFromEntries = (account.config.groupAllowFrom ?? []).map((entry) => normalizeZalouserEntry(String(entry))).filter((entry) => entry && entry !== "*");
+		if (allowFromEntries.length > 0 || groupAllowFromEntries.length > 0) {
+			const byName = buildNameIndex(await listZaloFriends(profile), (friend) => friend.displayName);
+			if (allowFromEntries.length > 0) {
+				const { additions, mapping, unresolved } = resolveUserAllowlistEntries(allowFromEntries, byName);
+				const allowFrom = mergeAllowlist({
+					existing: account.config.allowFrom,
+					additions
+				});
+				account = {
+					...account,
+					config: {
+						...account.config,
+						allowFrom
+					}
+				};
+				summarizeMapping("zalouser users", mapping, unresolved, runtime);
+			}
+			if (groupAllowFromEntries.length > 0) {
+				const { additions, mapping, unresolved } = resolveUserAllowlistEntries(groupAllowFromEntries, byName);
+				const groupAllowFrom = mergeAllowlist({
+					existing: account.config.groupAllowFrom,
+					additions
+				});
+				account = {
+					...account,
+					config: {
+						...account.config,
+						groupAllowFrom
+					}
+				};
+				summarizeMapping("zalouser group users", mapping, unresolved, runtime);
+			}
+		}
+		const groupsConfig = account.config.groups ?? {};
+		const groupKeys = Object.keys(groupsConfig).filter((key) => key !== "*");
+		if (groupKeys.length > 0) {
+			const byName = buildNameIndex(await listZaloGroups(profile), (group) => group.name);
+			const mapping = [];
+			const unresolved = [];
+			const nextGroups = { ...groupsConfig };
+			for (const entry of groupKeys) {
+				const cleaned = normalizeZalouserEntry(entry);
+				if (/^\d+$/.test(cleaned)) {
+					if (!nextGroups[cleaned]) nextGroups[cleaned] = groupsConfig[entry];
+					mapping.push(`${entry}→${cleaned}`);
+					continue;
+				}
+				const match = (byName.get(cleaned.toLowerCase()) ?? [])[0];
+				const id = match?.groupId ? String(match.groupId) : void 0;
+				if (id) {
+					if (!nextGroups[id]) nextGroups[id] = groupsConfig[entry];
+					mapping.push(`${entry}→${id}`);
+				} else unresolved.push(entry);
+			}
+			account = {
+				...account,
+				config: {
+					...account.config,
+					groups: nextGroups
+				}
+			};
+			summarizeMapping("zalouser groups", mapping, unresolved, runtime);
+		}
+	} catch (err) {
+		runtime.log?.(`zalouser resolve failed; using config entries. ${String(err)}`);
+	}
+	let listenerStop = null;
+	let stopped = false;
+	const stop = () => {
+		if (stopped) return;
+		stopped = true;
+		listenerStop?.();
+		listenerStop = null;
+	};
+	let settled = false;
+	const { promise: waitForExit, resolve: resolveRun, reject: rejectRun } = createDeferred();
+	const settleSuccess = () => {
+		if (settled) return;
+		settled = true;
+		stop();
+		resolveRun();
+	};
+	const settleFailure = (error) => {
+		if (settled) return;
+		settled = true;
+		stop();
+		rejectRun(error instanceof Error ? error : new Error(String(error)));
+	};
+	const onAbort = () => {
+		settleSuccess();
+	};
+	abortSignal.addEventListener("abort", onAbort, { once: true });
+	let listener;
+	try {
+		listener = await startZaloListener({
+			accountId: account.accountId,
+			profile: account.profile,
+			abortSignal,
+			onMessage: (msg) => {
+				if (stopped) return;
+				logVerbose(core, runtime, `[${account.accountId}] inbound message`);
+				statusSink?.({ lastInboundAt: Date.now() });
+				const queueKey = resolveInboundQueueKey(msg);
+				inboundQueue.enqueue(queueKey, async () => {
+					if (stopped || abortSignal.aborted) return;
+					await processMessage(msg, account, config, core, runtime, {
+						historyLimit,
+						groupHistories
+					}, statusSink);
+				}).catch((err) => {
+					runtime.error(`[${account.accountId}] Failed to process message: ${String(err)}`);
+				});
+			},
+			onError: (err) => {
+				if (stopped || abortSignal.aborted) return;
+				runtime.error(`[${account.accountId}] Zalo listener error: ${String(err)}`);
+				settleFailure(err);
+			}
+		});
+	} catch (error) {
+		abortSignal.removeEventListener("abort", onAbort);
+		throw error;
+	}
+	listenerStop = listener.stop;
+	if (stopped) {
+		listenerStop();
+		listenerStop = null;
+	}
+	if (abortSignal.aborted) settleSuccess();
+	try {
+		await waitForExit;
+	} finally {
+		abortSignal.removeEventListener("abort", onAbort);
+	}
+	return { stop };
+}
+//#endregion
+export { monitorZalouserProvider };