fix: default groupPolicy to allowlist

docs/providers/discord.md

@@ -193,7 +193,14 @@ Outbound Discord API calls retry on rate limits (429) using Discord `retry_after
   discord: {
     enabled: true,
     token: "abc.123",
-    groupPolicy: "open",
+    groupPolicy: "allowlist",
+    guilds: {
+      "*": {
+        channels: {
+          general: { allow: true }
+        }
+      }
+    },
     mediaMaxMb: 8,
     actions: {
       reactions: true,

docs/providers/imessage.md

@@ -170,7 +170,7 @@ Provider options:
 - `imessage.region`: SMS region.
 - `imessage.dmPolicy`: `pairing | allowlist | open | disabled` (default: pairing).
 - `imessage.allowFrom`: DM allowlist (handles or `chat_id:*`). `open` requires `"*"`.
-- `imessage.groupPolicy`: `open | allowlist | disabled` (default: open).
+- `imessage.groupPolicy`: `open | allowlist | disabled` (default: allowlist).
 - `imessage.groupAllowFrom`: group sender allowlist.
 - `imessage.historyLimit` / `imessage.accounts.*.historyLimit`: max group messages to include as context (0 disables).
 - `imessage.groups`: per-group defaults + allowlist (use `"*"` for global defaults).

docs/providers/signal.md

@@ -107,7 +107,7 @@ Provider options:
 - `signal.sendReadReceipts`: forward read receipts.
 - `signal.dmPolicy`: `pairing | allowlist | open | disabled` (default: pairing).
 - `signal.allowFrom`: DM allowlist (E.164 or `uuid:<id>`). `open` requires `"*"`.
-- `signal.groupPolicy`: `open | allowlist | disabled` (default: open).
+- `signal.groupPolicy`: `open | allowlist | disabled` (default: allowlist).
 - `signal.groupAllowFrom`: group sender allowlist.
 - `signal.historyLimit`: max group messages to include as context (0 disables).
 - `signal.textChunkLimit`: outbound chunk size (chars).

docs/providers/slack.md

@@ -185,7 +185,7 @@ Slack uses Socket Mode only (no HTTP webhook server). Provide both tokens:
     "enabled": true,
     "botToken": "xoxb-...",
     "appToken": "xapp-...",
-    "groupPolicy": "open",
+    "groupPolicy": "allowlist",
     "dm": {
       "enabled": true,
       "policy": "pairing",

docs/providers/telegram.md

@@ -186,11 +186,12 @@ Two independent controls:
 - Example: `"groups": { "-1001234567890": {}, "*": {} }` allows all groups
 
 **2. Which senders are allowed** (sender filtering via `telegram.groupPolicy`):
-- `"open"` (default) = all senders in allowed groups can message
+- `"open"` = all senders in allowed groups can message
 - `"allowlist"` = only senders in `telegram.groupAllowFrom` can message
 - `"disabled"` = no group messages accepted at all
+Default is `groupPolicy: "allowlist"` (blocked unless you add `groupAllowFrom`).
 
-Most users want: `groupPolicy: "open"` + specific groups listed in `telegram.groups`
+Most users want: `groupPolicy: "allowlist"` + `groupAllowFrom` + specific groups listed in `telegram.groups`
 
 ## Long-polling vs webhook
 - Default: long-polling (no public URL required).
@@ -289,7 +290,7 @@ Provider options:
 - `telegram.tokenFile`: read token from file path.
 - `telegram.dmPolicy`: `pairing | allowlist | open | disabled` (default: pairing).
 - `telegram.allowFrom`: DM allowlist (ids/usernames). `open` requires `"*"`.
-- `telegram.groupPolicy`: `open | allowlist | disabled` (default: open).
+- `telegram.groupPolicy`: `open | allowlist | disabled` (default: allowlist).
 - `telegram.groupAllowFrom`: group sender allowlist (ids/usernames).
 - `telegram.groups`: per-group defaults + allowlist (use `"*"` for global defaults).
   - `telegram.groups.<id>.requireMention`: mention gating default.

docs/providers/whatsapp.md

@@ -158,7 +158,7 @@ The wizard uses it to set your **allowlist/owner** so your own DMs are permitted
 
 ## Groups
 - Groups map to `agent:<agentId>:whatsapp:group:<jid>` sessions.
-- Group policy: `whatsapp.groupPolicy = open|disabled|allowlist` (default `open`).
+- Group policy: `whatsapp.groupPolicy = open|disabled|allowlist` (default `allowlist`).
 - Activation modes:
   - `mention` (default): requires @mention or regex match.
   - `always`: always triggers.