create-openclaw-bot 5.11.1 → 5.13.0

package/dist/setup/data/channels.js

@@ -55,31 +55,30 @@
     },
     // 'telegram+zalo-personal' — Combo mode tạm ngưng, nghiên cứu thêm.
     'zalo-personal': {
-      name: 'Zalo Personal',
+      name: 'Zalo cá nhân — OpenClaw Zalo Connect',
       hasZaloPersonal: true,
       envKeys: [],
       envExtra: '',
       credSteps: [
-        { textVi: '⚠️ Zalo Personal dùng <strong>unofficial API (zca-js)</strong> — chỉ nên dùng tài khoản phụ', textEn: '⚠️ Zalo Personal uses <strong>unofficial API (zca-js)</strong> — use an alternate account' },
-        { textVi: 'Native setup sẽ tự chạy login và copy QR về thư mục project. Nếu cần chạy lại thủ công, dùng <code>openclaw channels login --channel zalouser --verbose</code>.', textEn: 'Native setup now auto-runs the login flow and copies the QR into the project folder. If needed, rerun it manually with <code>openclaw channels login --channel zalouser --verbose</code>.' },
+        { textVi: '⚠️ Zalo cá nhân chạy qua <strong>OpenClaw Zalo Connect (unofficial, zca-js)</strong> — tự động hoá tài khoản cá nhân có thể vi phạm điều khoản Zalo và khiến tài khoản bị hạn chế. <strong>Chỉ nên dùng tài khoản phụ.</strong>', textEn: '⚠️ Personal Zalo runs on <strong>OpenClaw Zalo Connect (unofficial, zca-js)</strong> — automating a personal account may violate Zalo terms and can get the account restricted. <strong>Use a secondary account.</strong>' },
+        { textVi: 'Sau khi tạo bot, bấm <strong>Đăng nhập Zalo</strong> để quét QR ngay trong giao diện. Nếu cần chạy thủ công: <code>openclaw channels login --channel zalo-connect --account default</code>.', textEn: 'After creating the bot, click <strong>Zalo Login</strong> to scan the QR right in the UI. Manual fallback: <code>openclaw channels login --channel zalo-connect --account default</code>.' },
+        { textVi: 'Mặc định an toàn: DM theo cơ chế pairing, group tắt hết — sau khi quét QR hãy tự chọn DM/nhóm được phép trong cấu hình.', textEn: 'Secure defaults: DM uses pairing, all groups start disabled — after the QR scan, explicitly choose the allowed DMs/groups in the config.' },
       ],
+      // Mirrors buildZaloConnectChannelConfig() in bot-config-gen.js — keys validated
+      // against OpenClaw Zalo Connect 3.0.0's strict channel schema.
       channelConfig: {
-        zalouser: {
+        'zalo-connect': {
           enabled: true,
           defaultAccount: 'default',
           accounts: {
-            default: {
-              dmPolicy: 'open',
-              allowFrom: ['*'],
-              groupPolicy: 'allowlist',
-              groupAllowFrom: ['*'],
-            },
+            default: { enabled: true },
           },
-          dmPolicy: 'open',
-          allowFrom: ['*'],
+          dmPolicy: 'pairing',
+          allowFrom: [],
           groupPolicy: 'allowlist',
-          groupAllowFrom: ['*'],
-          historyLimit: 50,
+          groups: {
+            '*': { enabled: false, requireMention: true },
+          },
         },
       },
       pluginInstall: '',

package/dist/setup/shared/bot-config-gen.js

@@ -248,14 +248,14 @@
     });
     cfg.plugins = pluginsConfig.plugins;
 
-    // ── bindings for zalouser ────────────────────────────────────────────────
+    // ── bindings for zalo-connect ────────────────────────────────────────────────
     if (agentMetas.length > 0 && isZaloPersonal(channelKey)) {
       cfg.bindings = cfg.bindings || [];
       const firstAgentId = agentMetas[0]?.agentId || 'bot';
-      if (!cfg.bindings.some(b => b.match && b.match.channel === 'zalouser')) {
-        // Account-specific from the start so a second Zalo account added later routes
-        // correctly (each zalouser account binds by accountId).
-        cfg.bindings.push({ agentId: firstAgentId, match: { channel: 'zalouser', accountId: 'default' } });
+      if (!cfg.bindings.some(b => b.match && b.match.channel === 'zalo-connect')) {
+        // Account-specific from day one (plan §5.2): each account needs its own
+        // binding + credential namespace even while zalo-connect 2.4.6 is single-account.
+        cfg.bindings.push({ agentId: firstAgentId, match: { channel: 'zalo-connect', accountId: 'default' } });
       }
     }
 
@@ -309,31 +309,15 @@
 
       channels.telegram = telegramConfig;
     } else if (isZaloPersonal(channelKey)) {
-      // Zalo Personal — matches live Mkt/Williams configs
-      channels.zalouser = {
-        enabled: true,
-        defaultAccount: 'default',
-        accounts: {
-          default: {
-            dmPolicy: 'open',
-            allowFrom: ['*'],
-            groupPolicy: 'allowlist',
-            groupAllowFrom: ['*'],
-          },
-        },
-        dmPolicy: 'open',
-        allowFrom: ['*'],
-        groupPolicy: 'allowlist',
-        groupAllowFrom: ['*'],
-        historyLimit: 50,
-        // NOTE: do NOT add `reactionLevel`/`actions` here — the zalouser plugin's config
-        // schema is strict and rejects them ("must not have additional properties"), which
-        // crashes the gateway on boot. zalouser already supports the `react` action by
-        // default; reaction behavior is driven by the prompt (TOOLS.md), not channel config.
-        groups: {
-          '*': { enabled: true, requireMention: false },
-        },
-      };
+      // Zalo Personal → OpenClaw Zalo Connect, the only personal-Zalo backend.
+      // Secure defaults: DM pairing, empty
+      // allowFrom, all groups disabled + requireMention until the owner explicitly
+      // enables them post-QR. Never default to `allowFrom: ["*"]` / open groups.
+      // Every key below is validated against OpenClaw Zalo Connect 3.0.0's schema
+      // (`additionalProperties: false`) — do NOT add keys (e.g. historyLimit,
+      // groupAllowFrom) without re-checking `openclaw.plugin.json` first, an unknown
+      // key crashes the gateway on boot.
+      channels['zalo-connect'] = buildZaloConnectChannelConfig();
     } else if (channelKey === 'zalo-bot') {
       channels.zalo = { enabled: true, provider: 'official_account' };
     }
@@ -342,6 +326,26 @@
   }
 
 
+  // ═══════════════════════════════════════════════════════════════════════════════
+  // buildZaloConnectChannelConfig — secure-default channels['zalo-connect'] block
+  // ═══════════════════════════════════════════════════════════════════════════════
+  function buildZaloConnectChannelConfig() {
+    return {
+      enabled: true,
+      defaultAccount: 'default',
+      accounts: {
+        default: { enabled: true },
+      },
+      dmPolicy: 'pairing',
+      allowFrom: [],
+      groupPolicy: 'allowlist',
+      groups: {
+        '*': { enabled: false, requireMention: true },
+      },
+    };
+  }
+
+
   // ═══════════════════════════════════════════════════════════════════════════════
   // buildPluginsConfig — returns { plugins: { ... } }
   // ═══════════════════════════════════════════════════════════════════════════════
@@ -361,9 +365,11 @@
 
     const allow = ['memory-core'];
 
-    // Zalo Personal channel is native; install openclaw-zalo-mod manually via ClawHub when needed.
+    // Zalo Personal → zalo-connect channel plugin (pinned install happens in the
+    // entrypoint / creation flow). openclaw-zalo-mod stays a separate opt-in plugin.
     if (isZaloPersonal(channelKey)) {
-      allow.push('zalouser');
+      entries['zalo-connect'] = { enabled: true };
+      allow.push('zalo-connect');
     }
 
     // DuckDuckGo search plugin for web-search
@@ -518,6 +524,7 @@
     generateToken,
     buildOpenclawJson,
     buildChannelConfig,
+    buildZaloConnectChannelConfig,
     buildPluginsConfig,
     buildSkillsEntries,
     buildExecApprovalsJson,

package/dist/setup/shared/common-gen.js

@@ -40,6 +40,13 @@
   const TELEGRAM_RELAY_PLUGIN_ID = 'telegram-multibot-relay';
   const TELEGRAM_SETUP_GUIDE_FILENAME = 'TELEGRAM-GROUP-SETUP.md';
 
+  // ── OpenClaw Zalo Connect — single source of truth ──────────────────────────
+  // Pin the maintained fork tag so setup never falls back to upstream/ClawHub.
+  const ZALO_CHANNEL_ID = 'zalo-connect';
+  const ZALO_PLUGIN_ID = 'zalo-connect';
+  const ZALO_CONNECT_VERSION = '3.0.0';
+  const ZALO_CONNECT_PLUGIN_SPEC = 'https://github.com/tuanminhhole/openclaw-zalo-connect.git#v3.0.0';
+
   function buildRelayPluginInstallCommand(prefix = 'openclaw') {
     return `if [ ! -d "$OPENCLAW_STATE_DIR/extensions/${TELEGRAM_RELAY_PLUGIN_ID}" ]; then ${prefix} plugins install ${TELEGRAM_RELAY_PLUGIN_SPEC} 2>/dev/null || true; fi`;
   }
@@ -298,6 +305,10 @@ If setup reported a plugin install error, run this after the bot is running:
     TELEGRAM_RELAY_PLUGIN_SPEC,
     TELEGRAM_RELAY_PLUGIN_ID,
     TELEGRAM_SETUP_GUIDE_FILENAME,
+    ZALO_CHANNEL_ID,
+    ZALO_PLUGIN_ID,
+    ZALO_CONNECT_VERSION,
+    ZALO_CONNECT_PLUGIN_SPEC,
     buildRelayPluginInstallCommand,
     buildRelayPluginInstallCommandWin,
     buildTelegramPostInstallChecklist,

package/dist/setup/shared/docker-gen.js

@@ -197,7 +197,7 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
   function buildDockerArtifacts(options) {
     const {
       openClawNpmSpec,
-      openClawRuntimePackages,
+      openClawRuntimePackages = '',
       is9Router,
       isLocal,
       isMultiBot,
@@ -223,6 +223,8 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       gatewayPort = 18789,
       routerPort = 20128,
       osChoice = '',
+      // Personal-Zalo backend: empty or the single supported `zalo-connect` channel.
+      zaloBackend = '',
     } = options;
     // Windows bind-mounts give ClawHub-installed plugins world-writable perms (which openclaw
     // blocks), so on Windows we isolate extensions in a named volume. On macOS/Linux bind-mounts
@@ -278,21 +280,23 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       '    return 0',
       '  fi',
       '  echo "[entrypoint] plugin $id missing; installing $spec"',
-      '  openclaw plugins install "$spec" 2>/dev/null || echo "[entrypoint] warning: failed to install plugin $spec"',
-      '}',
-      'ensure_zalouser() {',
-      '  NPM_DIR="$OPENCLAW_HOME/npm"',
-      '  PKG_DIR="$NPM_DIR/node_modules/@openclaw/zalouser"',
-      '  if [ -d "$PKG_DIR" ] || [ -d "$OPENCLAW_HOME/extensions/zalouser" ]; then',
-      '    echo "[entrypoint] zalouser plugin already installed (npm or extensions) — skipping"',
-      '  else',
-      '    echo "[entrypoint] zalouser plugin missing; installing via npm"',
-      '    mkdir -p "$NPM_DIR"',
-      '    cd "$NPM_DIR"',
-      '    npm init -y 2>/dev/null || true',
-      '    npm install @openclaw/zalouser@latest 2>/dev/null || echo "[entrypoint] warning: failed to install @openclaw/zalouser"',
-      '    cd /home/node/project',
-      '  fi',
+      '  case "$spec" in',
+      '    https://*.git#*)',
+      '      repo="${spec%%#*}"',
+      '      ref="${spec##*#}"',
+      '      tmp="/tmp/openclaw-plugin-$id-$ref"',
+      '      rm -rf "$tmp"',
+      '      if git clone --depth 1 --branch "$ref" "$repo" "$tmp" 2>/dev/null; then',
+      '        # Docker Desktop bind mounts can reject chmod on packed .git objects (EACCES).',
+      '        # OpenClaw only needs the plugin payload, never the clone metadata.',
+      '        rm -rf "$tmp/.git"',
+      '        openclaw plugins install "$tmp" 2>/dev/null || echo "[entrypoint] warning: failed to install cloned plugin $id"',
+      '      else',
+      '        echo "[entrypoint] warning: failed to clone plugin $spec"',
+      '      fi',
+      '      ;;',
+      '    *) openclaw plugins install "$spec" 2>/dev/null || echo "[entrypoint] warning: failed to install plugin $spec" ;;',
+      '  esac',
       '}',
       'ensure_skill() {',
       '  id="$1"',
@@ -311,52 +315,14 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     // Restore config AFTER plugin installs (which may clobber openclaw.json)
     runtimeParts.push(`node - <<'NODE'\n${restoreConfigScript}\nNODE`);
     runtimeParts.push(`node - <<'NODE'\n${securityCompatScript}\nNODE`);
-    // Zalouser stability: patch watchdog tolerance and add auto-restart monitor
-    runtimeParts.push([
-      '# Patch zalouser watchdog tolerance (35s -> 90s) to survive provider auth pre-warming',
-      'ZALO_JS=$(find "$OPENCLAW_HOME" -path "*/zalouser/dist/zalo-js-*.js" -type f 2>/dev/null | head -1)',
-      'if [ -n "$ZALO_JS" ] && grep -q "35e3" "$ZALO_JS" 2>/dev/null; then',
-      '  sed -i "s/LISTENER_WATCHDOG_MAX_GAP_MS\\\\s*=\\\\s*35e3/LISTENER_WATCHDOG_MAX_GAP_MS = 90e3/" "$ZALO_JS"',
-      '  echo "[entrypoint] patched zalouser watchdog gap: 35s -> 90s"',
-      'fi',
-      '# Automatically run Zalo sticker-mention patch if skill is present',
-      'for MENTIONS_JS in $(find "$OPENCLAW_HOME" -maxdepth 5 -path "*/skills/*/mentions.js" -type f 2>/dev/null); do',
-      '  if [ -f "$MENTIONS_JS" ]; then',
-      '    echo "[entrypoint] Running patch: $MENTIONS_JS"',
-      '    node "$MENTIONS_JS" || echo "[entrypoint] Warning: failed to run patch $MENTIONS_JS"',
-      '  fi',
-      'done',
-    ].join('\n'));
-    // Expose zalouser's ZCA API map (globalThis.__zcaApiByProfile) BEFORE the gateway imports
-    // zalouser, so openclaw-zalo-mod can reach the live Zalo API (dashboard Sync Account, group
-    // admin lookups, …). zalo-mod's own runtime patch lands AFTER zalouser is already imported,
-    // so it never takes effect on the running module — patching here (post sticker-mention restore,
-    // pre gateway-run) is the reliable fix.
-    {
-      const exposeZcaScript = [
-        "const fs=require('fs'),cp=require('child_process');",
-        "let files=[];",
-        "try{ files=cp.execSync('find \"'+(process.env.OPENCLAW_HOME||'')+'/npm\" -path \"*/@openclaw/zalouser/dist/zalo-js-*.js\" -type f 2>/dev/null',{encoding:'utf8'}).split('\\n').filter(Boolean); }catch(e){}",
-        "const reps=[['const apiByProfile = /* @__PURE__ */ new Map();','const apiByProfile = globalThis.__zcaApiByProfile || (globalThis.__zcaApiByProfile = /* @__PURE__ */ new Map());'],['const apiByProfile = new Map();','const apiByProfile = globalThis.__zcaApiByProfile || (globalThis.__zcaApiByProfile = new Map());']];",
-        "for(const f of files){ try{ let s=fs.readFileSync(f,'utf8'); if(s.includes('globalThis.__zcaApiByProfile')) continue; for(const pair of reps){ if(s.includes(pair[0])){ s=s.replace(pair[0],pair[1]); fs.writeFileSync(f,s); console.log('[entrypoint] exposed __zcaApiByProfile for zalo-mod in '+f); break; } } }catch(e){} }",
-      ].join('\n');
-      runtimeParts.push(`# Expose zalouser ZCA API map for openclaw-zalo-mod (before gateway imports zalouser)\nnode - <<'NODE'\n${exposeZcaScript}\nNODE`);
+    if (zaloBackend === 'zalo-connect') {
+      // Pinned ZaloConnect install (never `latest` — plan §4.1). ensure_plugin skips the
+      // install when extensions/zalo-connect already exists, so restarts never re-download
+      // and a reconnect never reinstalls. No dist patching, no mentions.js, no watchdog
+      // hacks: sticker/mention/reaction are native ZaloConnect actions.
+      const zaloConnectSpec = common.ZALO_CONNECT_PLUGIN_SPEC || 'https://github.com/tuanminhhole/openclaw-zalo-connect.git#v3.0.0';
+      runtimeParts.push(`ensure_plugin zalo-connect "${zaloConnectSpec}"`);
     }
-    runtimeParts.push([
-      '# Zalo channel auto-restart monitor (background)',
-      '(',
-      '  sleep 180',
-      '  while true; do',
-      '    sleep 60',
-      '    STATUS=$(openclaw channels status 2>/dev/null | grep -i "Zalo Personal" || true)',
-      '    if echo "$STATUS" | grep -qi "stopped"; then',
-      '      echo "[zalo-monitor] Zalo channel stopped - restarting container in 5s"',
-'      sleep 5',
-      '      kill 1 2>/dev/null || true',
-      '    fi',
-      '  done',
-      ') &',
-    ].join('\n'));
     runtimeParts.push('openclaw gateway run');
     const runtimeScript = ['#!/bin/sh', 'set -e', ...runtimeParts].join('\n');
     let browserInstall = '';
@@ -609,5 +575,3 @@ ${appEnvironmentBlock}${plainSingleExtraHosts ? `${extraHostsBlock}\n` : ''}
 if (typeof exports !== 'undefined' && typeof globalThis !== 'undefined' && globalThis.__openclawDockerGen) {
   Object.assign(exports, globalThis.__openclawDockerGen);
 }
-
-

package/dist/setup/shared/workspace-gen.js

@@ -73,9 +73,9 @@ Notes:
   function buildZaloSoulSection(isVi, botName) {
     const name = botName || 'Bot';
     if (isVi) {
-      return `\n\n**RULE — Zalo Group: Phản hồi theo chế độ Silent Mode:**\nKhi nhận tin từ \`channel: zalouser\` và \`group_id\` có giá trị:\n\n- Nếu tin nhắn chứa \`@${name}\` → **LUÔN reply** (bất kể silent mode).\n- Nếu tin nhắn bắt đầu bằng \`/\` (slash command) → KHÔNG reply, plugin đã xử lý rồi.\n- Tin thường trong group (không mention, không slash):\n  - Nếu **Silent Mode BẬT** → tin này KHÔNG đến được bot (plugin đã chặn).\n  - Nếu **Silent Mode TẮT** → tin này ĐẾN ĐƯỢC bot → **reply bình thường** như DM.\n- DM (không có group_id) → reply bình thường.`;
+      return `\n\n**RULE — Zalo Group: Phản hồi theo chế độ Silent Mode:**\nKhi nhận tin từ \`channel: zalo-connect\` và \`group_id\` có giá trị:\n\n- Nếu tin nhắn chứa \`@${name}\` → **LUÔN reply** (bất kể silent mode).\n- Nếu tin nhắn bắt đầu bằng \`/\` (slash command) → KHÔNG reply, plugin đã xử lý rồi.\n- Tin thường trong group (không mention, không slash):\n  - Nếu **Silent Mode BẬT** → tin này KHÔNG đến được bot (plugin đã chặn).\n  - Nếu **Silent Mode TẮT** → tin này ĐẾN ĐƯỢC bot → **reply bình thường** như DM.\n- DM (không có group_id) → reply bình thường.`;
     }
-    return `\n\n**RULE — Zalo Group: Reply based on Silent Mode:**\nWhen receiving messages from \`channel: zalouser\` with a \`group_id\`:\n\n- If the message contains \`@${name}\` → **ALWAYS reply** (regardless of silent mode).\n- If the message starts with \`/\` (slash command) → DO NOT reply, the plugin already handled it.\n- Regular group messages (no mention, no slash):\n  - If **Silent Mode is ON** → this message does NOT reach the bot (plugin blocks it).\n  - If **Silent Mode is OFF** → this message DOES reach the bot → **reply normally** like DM.\n- DM (no group_id) → reply normally.`;
+    return `\n\n**RULE — Zalo Group: Reply based on Silent Mode:**\nWhen receiving messages from \`channel: zalo-connect\` with a \`group_id\`:\n\n- If the message contains \`@${name}\` → **ALWAYS reply** (regardless of silent mode).\n- If the message starts with \`/\` (slash command) → DO NOT reply, the plugin already handled it.\n- Regular group messages (no mention, no slash):\n  - If **Silent Mode is ON** → this message does NOT reach the bot (plugin blocks it).\n  - If **Silent Mode is OFF** → this message DOES reach the bot → **reply normally** like DM.\n- DM (no group_id) → reply normally.`;
   }
 
   // Structure mirrors OpenClaw's default SOUL.md (Core Truths / Boundaries / Vibe / Continuity);
@@ -547,7 +547,7 @@ _Good luck out there. Make it count._
 - [Operating Manual](./AGENTS.md)`;
   }
 
-        function buildCronjobSkillMd(isVi = true) {
+  function buildCronjobSkillMd(isVi = true, zaloDeliveryChannel = 'zalo-connect') {
     return `---
 name: cronjob
 description: Lên lịch tác vụ định kỳ sử dụng công cụ cron.
@@ -571,7 +571,7 @@ Truyền tham số \`job\` (object) gồm:
   - \`message\`: Nội dung tin nhắn nhắc nhở.
 - **\`delivery\`**:
   - \`mode\`: \`"announce"\`.
-  - \`channel\`: \`"zalouser"\`.
+  - \`channel\`: \`"${zaloDeliveryChannel}"\`.
   - \`to\`: ID người nhận hoặc ID nhóm.
     - ⚠️ **QUAN TRỌNG:** Nếu gửi tới Group Zalo, ID nhóm bắt buộc phải thêm tiền tố **\`g:\`** ở đầu (Ví dụ: \`g:1925989252066183028\`). Nếu thiếu \`g:\`, tin nhắn sẽ bị gửi nhầm thành tin cá nhân (DM) hoặc lỗi.
 
@@ -594,14 +594,6 @@ Truyền tham số \`job\` (object) gồm:
     return '';
   }
 
-  function buildStickerMentionSkillMd(botName = 'Williams') {
-    return '';
-  }
-
-  function buildStickerMentionJs() {
-    return '';
-  }
-
   function buildSecurityRules(isVi = true) {
     if (isVi) {
       return `\n\n## 🔐 Quy Tắc Bảo Mật — BẮT BUỘC (Red Lines)\n\n**GIỚI HẠN FILE & HỆ THỐNG:**\n- ✅ Được phép đọc/ghi trong: (1) workspace của bạn, và (2) các thư mục/ổ đĩa được CHỦ cấp quyền — mount tại \`/mnt/...\` (xem mục "💽 Thư mục/ổ đĩa được cấp quyền" ở trên nếu có). Mặc định quyền theo PROJECT: mọi bot dùng chung các mount này, trừ khi mục đó ghi giới hạn riêng cho từng bot.\n- ❌ KHÔNG truy cập file/thư mục NGOÀI workspace và các mount \`/mnt/...\` đã được cấp.\n- ❌ KHÔNG tiết lộ file nội bộ \`.openclaw\` (config.json, credentials, registry.json, token...).\n- ❌ KHÔNG tự ý quét/liệt kê thư mục hệ thống (Documents, Desktop, Downloads, AppData, registry, system32, Program Files) khi chưa được mount.\n- ❌ KHÔNG cài đặt phần mềm, driver, hoặc service ngoài Docker\n\n**API KEY & CREDENTIALS:**\n- ❌ KHÔNG BAO GIỜ hiển thị API key, token, hoặc mật khẩu trong chat\n- ❌ KHÔNG viết API key trực tiếp vào mã nguồn\n- ❌ KHÔNG commit file credentials lên Git\n- ✅ LUÔN lưu credentials trong file .env riêng\n- ✅ LUÔN dùng biến môi trường thay vì hardcode\n\n**VÍ CRYPTO & TÀI SẢN SỐ:**\n- ❌ TUYỆT ĐỐI KHÔNG truy cập, đọc, hoặc quét các thư mục ví crypto\n- ❌ KHÔNG quét clipboard (có thể chứa seed phrases)\n- ❌ KHÔNG truy cập browser profile, cookie, hoặc mật khẩu đã lưu\n- ❌ KHÔNG cài đặt npm package lạ (chỉ openclaw và plugin chính thức)\n\n**DOCKER:**\n- ✅ Việc cấp thêm ổ đĩa/thư mục cho bot là do CHỦ chủ động làm qua dashboard (nút "Cấp quyền ổ đĩa") — khi đó mount xuất hiện ở \`/mnt/...\` và bot ĐƯỢC PHÉP dùng. Đây là hợp lệ.\n- ❌ KHÔNG tự thêm/sửa mount trong docker-compose.yml; KHÔNG đề nghị mount nguyên ổ đĩa nếu chủ không yêu cầu.\n- ❌ KHÔNG chạy container với \`--privileged\`.\n- ✅ Chỉ expose cổng thật sự cần thiết.`;
@@ -1065,11 +1057,10 @@ This is a starting point. Add your own conventions, style, and rules as you figu
       hasBrowser = false,
       hasScheduler = false,
       hasZaloMod = false,
-      hasZaloSticker = false,
       browserDocVariant = '',
     } = options;
 
-    const isZalo = !!(hasZaloMod || hasZaloSticker);
+    const isZalo = !!hasZaloMod;
 
     const frontmatter = isVi
       ? `---
@@ -1091,7 +1082,7 @@ description: Guide for utilizing tools and skills
 
     // Reaction guide (DM only). Detailed: lists the emoji palette + concrete examples + the
     // exact tool-call shape, to maximize the model's adherence (it's prompt-driven — there is
-    // no config gate for zalouser reactions).
+    // no separate config gate for Zalo reactions).
     // Zalo reactions = EXACTLY the 6 native codes (Zalo renders them as icons). Telegram uses
     // unicode. `emoji` value sent to the react action MUST be one of these codes on Zalo.
     const reactList = isVi
@@ -1277,7 +1268,6 @@ Add whatever helps you do your job. This is your cheat sheet.
    * @property {boolean} [hasScheduler]
    * @property {boolean} [hasImageGen]
    * @property {boolean} [hasZaloMod]
-   * @property {boolean} [hasZaloSticker]
    */
 
   /**
@@ -1313,7 +1303,7 @@ Add whatever helps you do your job. This is your cheat sheet.
       hasScheduler = false,
       hasImageGen = false,
       hasZaloMod = false,
-      hasZaloSticker = false,
+      zaloBackend = 'zalo-connect',
     } = opts;
 
     const isMultiBot = variant === 'relay';
@@ -1327,7 +1317,7 @@ Add whatever helps you do your job. This is your cheat sheet.
       }),
       'USER.md': buildUserDoc({ isVi, userInfo, variant: userVariant || (isMultiBot ? 'cli-multi' : 'wizard') }),
       'TOOLS.md': buildToolsDoc({
-        isVi, skillListStr, workspacePath, variant, agentWorkspaceDir, hasBrowser, hasScheduler, hasZaloMod, hasZaloSticker, browserDocVariant,
+        isVi, skillListStr, workspacePath, variant, agentWorkspaceDir, hasBrowser, hasScheduler, hasZaloMod, browserDocVariant,
       }),
       'MEMORY.md': buildMemoryDoc({ isVi, variant: memoryVariant }),
       'HEARTBEAT.md': buildHeartbeatDoc({ isVi }),
@@ -1340,7 +1330,7 @@ Add whatever helps you do your job. This is your cheat sheet.
     }
 
     if (hasScheduler) {
-      files['skills/cronjob/SKILL.md'] = buildCronjobSkillMd(isVi);
+      files['skills/cronjob/SKILL.md'] = buildCronjobSkillMd(isVi, 'zalo-connect');
     }
 
     if (hasImageGen) {
@@ -1348,11 +1338,6 @@ Add whatever helps you do your job. This is your cheat sheet.
       files['skills/infographic-generator/image-generator.js'] = buildInfographicGeneratorJs();
     }
 
-    if (hasZaloSticker) {
-      files['skills/sticker-mention/SKILL.md'] = buildStickerMentionSkillMd(botName);
-      files['skills/sticker-mention/mentions.js'] = buildStickerMentionJs();
-    }
-
     return files;
   }
 
@@ -1372,8 +1357,6 @@ Add whatever helps you do your job. This is your cheat sheet.
     buildCronjobSkillMd,
     buildInfographicGeneratorSkillMd,
     buildInfographicGeneratorJs,
-    buildStickerMentionSkillMd,
-    buildStickerMentionJs,
     buildWorkspaceFileMap,
   };
 

package/dist/web/app.js

@@ -1,5 +1,5 @@
 const $ = (sel) => document.querySelector(sel);
-const state = { tab: 'dashboard', system: null, install: null, files: [], catalog: { skills: [], plugins: [] }, logs: [], zaloLoginOpen: false, zaloLoginLines: [], zaloQrDataUrl: '', lang: localStorage.getItem('openclaw-lang') || 'vi', theme: localStorage.getItem('openclaw-theme') || 'dark', navCollapsed: localStorage.getItem('openclaw-nav')==='1', os: null, mode: null, donateOpen: false, botModalOpen: false, botEditId: '', installModalOpen: false, fbPluginModalOpen: false, installTab: 'docker', installDraft: null, pathModal: null, confirmModal: null, botChannel: 'telegram', botPane: 'list', activeBotId: '', selectedFile: '', botMessage: '', projectConnectMessage: '', pendingProjectDir: '', selectedProjectDir: '', featureFlags: {}, featureInstalled: {}, featureLoading: {}, openDirs: {} };
+const state = { tab: 'dashboard', system: null, install: null, files: [], catalog: { skills: [], plugins: [] }, logs: [], zaloLoginOpen: false, zaloLoginLines: [], zaloQrDataUrl: '', lang: localStorage.getItem('openclaw-lang') || 'vi', theme: localStorage.getItem('openclaw-theme') || 'dark', navCollapsed: localStorage.getItem('openclaw-nav')==='1', os: null, mode: null, donateOpen: false, botModalOpen: false, botEditId: '', installModalOpen: false, fbPluginModalOpen: false, installTab: 'docker', installDraft: null, pathModal: null, confirmModal: null, botChannel: 'telegram', botPane: 'list', activeBotId: '', selectedFile: '', botMessage: '', projectConnectMessage: '', pendingProjectDir: '', selectedProjectDir: '', featureFlags: {}, featureInstalled: {}, featureLoading: {}, zaloBackend: '', zaloHealth: null, openDirs: {} };
 const SVG_CDN = 'https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons';
 const OS_OPTIONS = [
   { id: 'win', title: 'Windows', subtitle: 'Auto-detected desktop', icon: `${SVG_CDN}/windows/default.svg`, badge: 'Desktop' },
@@ -13,7 +13,7 @@ const MODE_OPTIONS = [
 ];
 const BOT_CHANNELS = [
   { id: 'telegram', title: 'Telegram', subtitle: 'Bot API', icon: `${SVG_CDN}/telegram/default.svg`, badge: 'Tele' },
-  { id: 'zalo-personal', title: 'Zalo User', subtitle: 'Personal account', icon: `${SVG_CDN}/zalo/default.svg`, badge: 'User' },
+  { id: 'zalo-personal', title: 'Zalo cá nhân', subtitle: 'OpenClaw Zalo Connect', icon: `${SVG_CDN}/zalo/default.svg`, badge: 'User' },
   { id: 'zalo-bot', title: 'Zalo API', subtitle: 'Official Account', icon: `${SVG_CDN}/zalo/default.svg`, badge: 'API' },
   { id: 'fb-messenger', title: 'Facebook', subtitle: 'Messenger', icon: `${SVG_CDN}/messenger/default.svg`, badge: 'FB' },
   { id: 'discord', title: 'Discord', subtitle: 'Bot', icon: `${SVG_CDN}/discord/default.svg`, badge: 'Discord', comingSoon: true },
@@ -194,7 +194,7 @@ function zaloLoginModal() {
   return `<div class="modal-backdrop zalo-login-backdrop" data-zalo-login="close">
     <section class="donate-modal zalo-login-modal" role="dialog" aria-modal="true" aria-label="Zalo login" onclick="event.stopPropagation()">
       <button class="modal-x" data-zalo-login="close" aria-label="Close"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round"><path d="M6 6l12 12M18 6L6 18"/></svg></button>
-      <div class="donate-head"><span aria-hidden="true">Z</span><div><p>Zalo User</p><h2>${t('Quét mã QR đăng nhập','Scan login QR')}</h2><small>${t('Mở Zalo trên điện thoại → quét QR trong khung dưới. Nếu QR chưa hiện, đợi vài giây.', 'Open Zalo on your phone → scan the QR below. If it is not visible yet, wait a few seconds.')}</small></div></div>
+      <div class="donate-head"><span aria-hidden="true">Z</span><div><p>${t('Zalo cá nhân','Zalo personal')}</p><h2>${t('Quét mã QR đăng nhập','Scan login QR')}</h2><small>${t('Mở Zalo trên điện thoại → quét QR trong khung dưới. Nếu QR chưa hiện, đợi vài giây.', 'Open Zalo on your phone → scan the QR below. If it is not visible yet, wait a few seconds.')}</small></div></div>
       ${state.zaloQrDataUrl ? `<div class="zalo-qr-image-wrap"><img class="zalo-qr-image" src="${state.zaloQrDataUrl}" alt="Zalo login QR"/></div>` : ''}
       <pre class="zalo-qr-log" data-zalo-qr-log>${escapeHtml(lines)}</pre>
       <div class="zalo-login-actions"><button class="secondary" data-zalo-login="close" type="button">${t('\u0110óng','Close')}</button></div>
@@ -799,7 +799,7 @@ function botView() {
         <div class="bot-main-content" style="margin-top: 14px;">
           <div class="card-head" style="margin-bottom: 14px; display: flex; justify-content: space-between; align-items: center;">
             <h3 style="margin: 0; font-size: 16px;">${t('Danh sách bot','Bot list')}</h3>
-            ${(ch === 'zalo-personal' && channelBots.length > 0) ? `<button class="secondary btn-inline" data-zalo-login-trigger type="button" style="min-height: 36px; padding: 6px 12px; font-size: 13px;">🔑 ${t('Đăng nhập Zalo','Zalo Login')}</button>` : ''}
+            ${(ch === 'zalo-personal' && channelBots.length > 0) ? zaloToolbar(channelBots) : ''}
           </div>
           <div class="channel-tabs" style="margin-bottom: 16px;">${BOT_CHANNELS.map(c => c.comingSoon
             ? `<button class="is-coming-soon" disabled title="${t('Sắp ra mắt','Coming soon')}"><img src="${c.icon}" onerror="this.style.display='none'"/>${c.title}<span>${t('Sắp','Soon')}</span></button>`
@@ -825,6 +825,8 @@ function botView() {
         <div class="dash-version-list" style="margin-top: 18px;">
           <div><span>OpenClaw</span><b>${escapeHtml(openclawVer || '-')}</b></div>
           <div><span>9Router</span><b>${escapeHtml(routerVer || '-')}</b></div>
+          ${ch === 'zalo-personal' ? `<div><span>Zalo Connect</span><b>${escapeHtml(state.zaloHealth?.installedVersion || '-')}</b></div>
+          <div><span>Zalo Mod</span><b>${state.zaloHealth ? escapeHtml(state.zaloHealth.zaloModVersion || (state.zaloHealth.zaloModInstalled ? '-' : t('Chưa cài','Not installed'))) : '…'}</b></div>` : ''}
         </div>
       </section>
       </div>
@@ -895,7 +897,14 @@ function botCreateModal() {
 function botListPanel(bots) {
   const listItems = bots.map(b => {
     const role = (b.role || b.desc || b.description || '').trim() || t('Tr\u1ee3 l\u00fd OpenClaw','OpenClaw assistant');
-    return `<article class="bot-item ${state.activeBotId===b.id?'active':''}" data-bot-id="${escapeHtml(b.id)}"><div class="bot-item-actions"><button class="bot-edit" data-edit-bot="${escapeHtml(b.id)}" title="${t('Sửa bot','Edit bot')}" aria-label="${t('Sửa bot','Edit bot')}">${actionIcon('edit')}</button><button class="bot-delete" data-delete-bot="${escapeHtml(b.id)}" title="${t('X\u00f3a bot','Delete bot')}" aria-label="${t('X\u00f3a bot','Delete bot')}">&times;</button></div><b>${escapeHtml(b.name)}</b><small title="${escapeHtml(role)}">${escapeHtml(role)}</small></article>`;
+    const isZalo = b.channel === 'zalo-personal';
+    const health = isZalo ? zaloAccountHealth(b) : null;
+    const quickBadge = health?.running ? `<span class="zalo-quick-badge">${t('Đã kết nối','Connected')}</span>` : '';
+    const connection = !health ? t('Chưa rõ','Unknown') : health.running ? t('Hoạt động','Active') : health.lastError ? t('Mất kết nối','Disconnected') : t('Đang kết nối','Connecting');
+    const login = !health ? t('Chưa rõ','Unknown') : health.sessionSaved ? t('Đã đăng nhập','Logged in') : t('Chưa đăng nhập','Not logged in');
+    const connectionTone = health?.running ? 'ok' : health?.lastError ? 'bad' : 'warn';
+    const loginTone = health?.sessionSaved ? 'ok' : health ? 'bad' : 'warn';
+    return `<article class="bot-item ${state.activeBotId===b.id?'active':''}" data-bot-id="${escapeHtml(b.id)}"><div class="bot-item-actions"><button class="bot-edit" data-edit-bot="${escapeHtml(b.id)}" title="${t('Sửa bot','Edit bot')}" aria-label="${t('Sửa bot','Edit bot')}">${actionIcon('edit')}</button><button class="bot-delete" data-delete-bot="${escapeHtml(b.id)}" title="${t('X\u00f3a bot','Delete bot')}" aria-label="${t('X\u00f3a bot','Delete bot')}">&times;</button></div><div class="bot-item-title"><b>${escapeHtml(b.name)}</b>${quickBadge}</div><small title="${escapeHtml(role)}">${escapeHtml(role)}</small>${isZalo ? `<div class="zalo-bot-health"><div><span>${t('Kết nối','Connection')}</span><em class="${connectionTone}">${connection}</em></div><div><span>${t('Đăng nhập','Login')}</span><em class="${loginTone}">${login}</em></div></div>` : ''}</article>`;
   });
   listItems.push(`
     <article class="bot-item bot-create-card" data-bot-modal="open">
@@ -999,7 +1008,6 @@ function botSkillsPanel() {
     { id: 'cron', title: 'Cron', desc: 'Native scheduler (SQLite) — cron guide in TOOLS.md' },
     { id: 'image-gen', title: 'Tạo ảnh Infographic', desc: 'Tạo ảnh infographic, poster tự động qua 9Router' },
     { id: 'web-search', title: 'Web Search', desc: 'Tìm kiếm web thời gian thực (DuckDuckGo)' },
-    { id: 'sticker-mention', title: 'Sticker & Auto-Tag (Zalo)', desc: 'Tự động tag người gửi và gửi sticker Zalo theo từ khóa', channels: ['zalo-personal'] },
     { id: 'learning-memory', title: 'Siêu Trí Nhớ Dài Hạn (learning-memory)', desc: 'Tự động ghi nhớ bài học vào MEMORY.md, tự đóng gói và tiến hóa kỹ năng mới vào skills/' },
   ];
   const plugins = [
@@ -1015,12 +1023,14 @@ function botSkillsPanel() {
   // channels (e.g. Zalo helpers won't appear on Telegram/FB bots). Items without a
   // `channels` field are universal.
   const activeChannel = bot?.channel || state.botChannel || 'telegram';
-  const forChannel = (item) => !item.channels || item.channels.includes(activeChannel);
+  const forChannel = (item) => {
+    return !item.channels || item.channels.includes(activeChannel);
+  };
   const scope = `${state.install?.projectDir || '-'} ? ${bot?.id || '-'}`;
   const row = (item, group) => {
     const key = `${group}:${item.id}`;
     const loading = !!state.featureLoading[key];
-    const requiresInstall = group === 'plugin' || (group === 'skill' && (item.id === 'image-gen' || item.id === 'sticker-mention' || item.id === 'learning-memory'));
+    const requiresInstall = group === 'plugin' || (group === 'skill' && (item.id === 'image-gen' || item.id === 'learning-memory'));
     const isInstalled = !requiresInstall || !!state.featureInstalled?.[key];
     
     const version = requiresInstall && isInstalled ? (state.featureVersions?.[key] || '') : '';
@@ -1091,7 +1101,8 @@ function wireTab() {
   document.querySelectorAll('[data-fbplugin]').forEach(el => el.onclick = () => { state.fbPluginModalOpen = false; render(); });
   document.querySelectorAll('[data-bot-modal]').forEach(el => el.onclick = () => { state.botModalOpen = el.dataset.botModal === 'open'; if (el.dataset.botModal === 'open') state.botEditId = ''; state.botMessage = ''; render(); });
   document.querySelectorAll('[data-edit-bot]').forEach(btn => btn.onclick = (ev) => { ev.stopPropagation(); state.botEditId = btn.dataset.editBot; state.botChannel = (state.install?.bots || []).find((b) => b.id === state.botEditId)?.channel || state.botChannel; state.botModalOpen = true; state.botMessage = ''; render(); });
-  document.querySelectorAll('[data-zalo-login]').forEach(el => el.onclick = () => { state.zaloLoginOpen = el.dataset.zaloLogin === 'open'; render(); });
+  document.querySelectorAll('[data-zalo-login]').forEach(el => el.onclick = () => { const opening = el.dataset.zaloLogin === 'open'; if (!opening && state.zaloLoginOpen) api('/api/zalo/login/cancel', { method: 'POST' }).catch(() => {}); state.zaloLoginOpen = opening; render(); });
+  document.querySelectorAll('[data-zalo-health-refresh]').forEach(btn => btn.onclick = () => withButtonLoading(btn, async () => { await loadZaloHealth(); }));
   document.querySelectorAll('[data-zalo-login-trigger]').forEach(btn => btn.onclick = () => withButtonLoading(btn, async () => {
     state.zaloLoginOpen = true;
     state.zaloQrDataUrl = '';
@@ -1508,6 +1519,23 @@ async function loadFiles(silent=false){
   if (!silent) render();
 }
 async function loadCatalog(silent=false){ state.catalog = await api('/api/catalog'); if (!silent) render(); }
+function zaloAccountHealth(bot) {
+  const accounts = state.zaloHealth?.accounts || [];
+  return accounts.find((account) => account.agentId === bot?.id)
+    || accounts.find((account) => account.accountId === (bot?.accountId || 'default'))
+    || null;
+}
+function zaloToolbar(channelBots = []) {
+  const active = channelBots.find((bot) => bot.id === state.activeBotId) || channelBots[0];
+  const health = zaloAccountHealth(active);
+  const loginLabel = health?.sessionSaved ? t('Đăng nhập lại','Log in again') : t('Đăng nhập Zalo','Zalo Login');
+  return `<div class="zalo-toolbar"><button class="secondary btn-inline" data-zalo-health-refresh type="button">${actionIcon('refresh')}<span>${t('Làm mới','Refresh')}</span></button><button class="secondary btn-inline" data-zalo-login-trigger type="button">🔑 <span>${loginLabel}</span></button></div>`;
+}
+async function loadZaloHealth(silent=false){
+  if (!activeProjectDir()) { state.zaloHealth = null; return; }
+  try { state.zaloHealth = await api('/api/zalo/health' + projectQuery()); } catch (_) { state.zaloHealth = null; }
+  if (!silent) render();
+}
 async function loadFeatureFlags(silent=false){
   const botId=currentBotId();
   if (!activeProjectDir()) { state.featureFlags = {}; state.featureInstalled = {}; state.featureVersions = {}; if (!silent) render(); return; }
@@ -1516,6 +1544,8 @@ async function loadFeatureFlags(silent=false){
     state.featureFlags = data.flags || {};
     state.featureInstalled = data.installed || {};
     state.featureVersions = data.versions || {};
+    state.zaloBackend = data.zaloBackend || '';
+    if (state.zaloBackend === 'zalo-connect') await loadZaloHealth(true).catch(() => {});
   } catch (_) {
     state.featureFlags = {};
     state.featureInstalled = {};
@@ -1547,7 +1577,7 @@ function appendLogLine(line) {
     }, 2000);
   }
 
-  const qrMatch = String(line).match(/^\[zalouser:qr\]\s+(data:image\/[a-zA-Z0-9.+-]+;base64,\S+)/);
+  const qrMatch = String(line).match(/^\[zalo-connect:qr\]\s+(data:image\/[a-zA-Z0-9.+-]+;base64,\S+)/);
   if (qrMatch) {
     state.zaloQrDataUrl = qrMatch[1];
     state.zaloLoginOpen = true;
@@ -1561,11 +1591,11 @@ function appendLogLine(line) {
     return;
   }
   const html = `<p>${escapeHtml(line)}</p>`;
-  if (state.zaloLoginOpen || /\[zalouser\]|zalo|qr|login|scan/i.test(line)) {
+  if (state.zaloLoginOpen || /\[zalo-connect\]|zalo|qr|login|scan/i.test(line)) {
     state.zaloLoginLines.push(cleanTerminalLine(line));
     const qr = document.querySelector('[data-zalo-qr-log]');
     if (qr) { qr.textContent = state.zaloLoginLines.slice(-120).join('\n'); qr.scrollTop = qr.scrollHeight; }
-    if (/\[zalouser\].*scan.*qr/i.test(line) && state.zaloQrDataUrl) {
+    if (/\[zalo-connect\].*scan.*qr/i.test(line) && state.zaloQrDataUrl) {
       render();
       requestAnimationFrame(() => document.querySelector('.zalo-login-modal')?.scrollTo({ top: 0, behavior: 'smooth' }));
     }
@@ -1629,6 +1659,3 @@ render();
 Promise.allSettled([loadSystem(true), loadStatus(true), loadCatalog(true)])
   .then(() => loadFeatureFlags(true).catch(() => {}))
   .finally(() => { render(); connectLogs(); });
-
-
-

package/dist/web/styles.css

@@ -1790,6 +1790,9 @@ html[data-theme="light"] .bottom .nav.active {
   text-align: right !important;
 }
 
+/* Compact per-account Zalo health — shared versions stay in the right status column. */
+.zalo-toolbar{display:flex;gap:8px;align-items:center}.zalo-toolbar .btn-inline{min-height:36px;padding:6px 12px;font-size:13px}.zalo-toolbar svg{width:14px;height:14px}.bot-item-title{display:flex;align-items:center;gap:8px;min-width:0;padding-right:58px}.bot-item-title b{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.zalo-quick-badge{display:inline-flex;align-items:center;padding:2px 7px;border-radius:999px;border:1px solid rgba(24,194,156,.35);background:rgba(24,194,156,.12);color:#25d6ad;font-size:10px;font-weight:800;white-space:nowrap}.zalo-bot-health{display:grid;gap:6px;margin-top:4px;padding-top:10px;border-top:1px solid rgba(255,255,255,.07)}.zalo-bot-health>div{display:flex;align-items:center;justify-content:space-between;gap:10px}.zalo-bot-health span{color:var(--muted);font-size:11px;font-weight:700}.zalo-bot-health em{font-size:11px;font-style:normal;font-weight:800;text-align:right}.zalo-bot-health em.ok{color:#25d6ad}.zalo-bot-health em.warn{color:#f7bf48}.zalo-bot-health em.bad{color:#ff6574}html[data-theme="light"] .zalo-bot-health{border-top-color:rgba(15,23,42,.08)}@media(max-width:640px){.zalo-toolbar{display:grid;grid-template-columns:1fr 1fr;width:100%}.zalo-toolbar .btn-inline{justify-content:center;padding:6px 8px}.bot-item-title{padding-right:54px}}
+
 /* Ensure bottom navigation bar is visible on tablet and mobile (under 1180px) */
 @media (max-width: 1180px) {
   .bottom {