- Changed omitted safety limits to starter-sized defaults: 1 group, 100 members
per group, 3 conversations per type, and 200 messages per conversation.
Existing API callers can keep their previous volume by sending explicit
limits.
- Replaced stale QR action links with terminal failure statuses after QR expiry
or rejection, so a failed run tells the user to start a fresh QR flow.
- Added a conversion hero, direct Run link, adjacent KazKN tools, and a copyable
AI-assistant prompt to the README.
- Added value-based paid events for profiles, groups, group members,
conversation summaries, and messages so each successful Dataset row maps to
the result delivered.
- Kept owner-exempt Apify test runs in Dataset and OUTPUT counts while stopping
cleanly when a customer's maximum run charge blocks another result.
- Redesigned the input form with visual export presets, focused sections,
clearer cost controls, and consistent emoji shortcuts.
- Reworked the README into an outcome-first landing page with colored badges,
a preset guide, quick start, price examples, focused outputs, and compact
technical details.
- Replaced the technical scope picker with four user-facing export presets:
group roster, contacts and profiles, conversation backup, and complete
snapshot. The obsolete
scopes field is no longer published in the input
schema; existing API inputs that explicitly send it remain compatible.
- Added focused Dataset views for group members, groups, profiles,
conversations, and messages.
- Removed the obsolete duplicate passphrase-era input schema.
- Standardized deployment language on the single
latest build tag, with no
intermediate build tags.
- Added message type, message text, and attachment details to the default
Dataset table view.
- Kept the underlying Dataset records unchanged; the view now exposes the
message fields users expect without requiring a raw JSON or CSV export.
- Raised the single user-facing message limit to 10,000 per direct or
joined-group conversation.
- Added automatic sequential direct and group-history pagination with a 250 ms
inter-page delay, cursor/message deduplication, and hard page/time anti-ban
ceilings.
- Added precise completion metadata for message, date, real-start, time, page,
cursor, and socket boundaries.
- Removed the obsolete 50-message group-history setting from the public form;
no new technical input or authentication step is required.
- Corrected self-cloud history discovery to use Zalo's dedicated
send2me_id thread instead of assuming the account user ID is the cloud
conversation ID.
- Reads only that one thread reference from the authenticated in-memory
context; cookies and all other context fields remain outside Actor output.
- Enabled read-only self-listening so the optional bounded listener exports
messages sent by the authenticated account as well as messages it receives.
- This adds no Zalo write API and allows private verification through the
account's own cloud conversation.
- Excluded local tests, smoke scripts, build artifacts, and the obsolete
passphrase-era schema copy from the private Apify source bundle.
- Kept the active input schema unchanged: standard runs still require no
passphrase, cookie, token, or other technical authentication input.
- Expanded direct-conversation discovery beyond the visible friend list to
include the account's self/cloud thread plus pinned, hidden, archived, and
unread conversation references returned by authenticated read-only APIs.
- Added strict thread-ID validation, user/group separation, deduplication, and
graceful fallback when an optional conversation list is unavailable.
- Kept explicit
conversationIds authoritative and capped automatic candidate
discovery before bounded history pagination.
- Fixed direct-message history requests to include the targeted Zalo user
thread instead of issuing an untargeted old-message synchronization.
- Added sequential per-thread pagination, cursor-loop protection, per-thread
message limits, and a global synchronization timeout.
- Added joined-group conversation records through Zalo's authenticated group
history endpoint and bounded them separately from direct conversations.
- Kept message text and attachment metadata optional for privacy-safe checks.
- Replaced the unauthenticated Playwright conversation path with Zalo's
authenticated read-only old-message listener for direct and group history.
- Added bounded pagination, cipher-handshake readiness, deterministic listener
cleanup, partial-history reporting, and content-redaction regressions.
- Saved the encrypted reusable session immediately after authentication, before
any optional extraction can fail.
- Kept the Actor private and limited-permission while conversation, group, and
member verification continues.
- Removed the user-managed session passphrase from Actor input.
- Added operator-managed secret derivation scoped by Actor, Apify user, and
saved Zalo account.
- Made the standard form runnable with no required fields and added
plain-language data, date, privacy, and QR recovery controls.
- Kept multi-account labels, filters, and safety limits as advanced settings.
- Fixed limited-permission detection when
apify@3.7.2 exposes the platform
value only through the raw ACTOR_PERMISSION_LEVEL environment variable.
- Added a regression test that keeps full-permission runs fail-closed.
- Fixed alias-lock requests so Crawlee can attach its internal request metadata
without weakening tenant or account isolation.
- Fixed session and restart-checkpoint keys to comply with Apify key-value store
naming rules.
- Added hybrid run-local QR authentication with encrypted session reuse.
- Added per-Apify-user, per-alias, and per-Zalo-account isolation.
- Added read-only export of friends, accessible profiles, joined groups, visible
members, recent group messages, Zalo Web history, and a bounded listener.
- Added strict input/output/Dataset schemas and limited-permission runtime guard.
- Added fail-closed selector checks, secret-redaction regressions, 80% coverage
gates, and an offline smoke test.
The Actor remains private and requires record-level conversation, group, and
member canaries before any public Store launch claim.
