feat: Zalo Personal messenger channel integration

[aecs4u]

Summary

Add Zalo Personal account integration to enable RustyClaw agents to communicate via personal Zalo accounts (not Official Accounts).

Background

Unlike Zalo Official Accounts (business/public accounts), Zalo Personal refers to regular user accounts. This integration would use:

• Web scraping / automation (Selenium, Playwright)
• Or third-party unofficial APIs (ZaloPy, etc.)

⚠️ Warning: Zalo does not provide an official Personal Account API. This integration requires reverse-engineering or unofficial methods.

Motivation

• Personal account integration for individual users
• Group chat participation
• Friend-to-friend communication
• Smaller deployments without business account requirements

Proposed Design

Option 1: Browser Automation (More reliable)

[[messengers]]
name = "zalo_personal"
type = "zalo_personal"
enabled = true
phone_number = "+84901234567"
password = "$ZALO_PASSWORD"
browser = "chromium"  # or "firefox"
headless = true

Option 2: Unofficial API (Faster, but risky)

// Using unofficial ZaloPy-style API
pub struct ZaloPersonalMessenger {
    session: ZaloSession,
    client: reqwest::Client,
}

Challenges

Challenge	Mitigation
No official API	Use browser automation or reverse-engineered protocol
Account bans	Rate limiting, human-like behavior simulation
CAPTCHA	Manual intervention or CAPTCHA solving service
Session management	Cookie persistence, periodic re-auth
Protocol changes	Regular maintenance required

Acceptance Criteria

• Zalo Personal account login (phone + password or QR code)
• Send messages to friends and groups
• Receive messages
• Handle session expiry and re-auth
• CAPTCHA handling strategy
• Rate limiting to avoid bans
• Documentation with disclaimer about unofficial status

Security Considerations

⚠️ Important: This is an unofficial integration with risks:

• Account suspension/ban possible
• Violates Zalo Terms of Service
• Password/credentials stored locally
• Session hijacking risks

Recommendations:

• Use a dedicated Zalo account, not personal account
• Encrypt all credentials
• Implement aggressive rate limiting
• Monitor for ban indicators
• Provide clear warnings to users

Related Issues

• feat: Twitch messenger channel integration #99 (Zalo Official Account) - official alternative
• feat: Secure credential memory with zeroize/secrecy crate #86 (Secure credential memory)
• feat: Per-IP rate limiting with token bucket algorithm #69 (Rate limiting)

References

• ZaloPy (Unofficial Python Library)
• Zalo Web Client (inspect network traffic): https://chat.zalo.me
• ⚠️ No official API exists for personal accounts

Recommendation

Consider using Zalo Official Account (#99) instead, which provides:

• Official API with documentation
• No ban risk
• Better reliability
• Business features

Only implement Zalo Personal if Official Account is insufficient for the use case.