openclaw - 💡(How to fix) Fix Auto-flip channel DM defaults to allowlist:[owner] after first-owner bootstrap

Summary

Once commands.ownerAllowFrom is populated (first owner established via pairing), channel DM defaults should auto-flip from pairing to allowlist:[owner] + groupPolicy:disabled unless the user has explicitly set dmPolicy.

Motivation

Today's default (dmPolicy: pairing) is optimized for the first-run install path: a new user can text their bot from any number, receive a pairing code, approve it, and they're in. Zero config required. Defensible ergonomic choice.

The cost shows up after first-run: any number that texts the bot continues to receive the pairing-code template. This leaks the bot's existence to strangers, accumulates pending requests in the pairing store, and surprises operators who assumed "I'm the only one who can DM the bot."

Real-world trigger that prompted this: a random number (LA area code, unknown to the operator) texted an iMessage bridge and received the default pairing-code reply. Low-impact, but unnecessary — the operator had been the only intended sender all along.

Proposed behavior

Trigger: commands.ownerAllowFrom non-empty AND channels.<name>.dmPolicy not explicitly set.

Action: treat effective dmPolicy as allowlist, with allowFrom derived from the matching channel handles in commands.ownerAllowFrom. Treat effective groupPolicy as disabled unless explicitly set.

Opt-out: if user sets dmPolicy: "pairing" explicitly, respect it. No behavior change for anyone who actually wants pairing post-bootstrap.

Why this shape

• First-run install unchanged. Pairing still works for owner bootstrap.
• Triggers off existing state. No new config surface.
• Explicit setting wins. Power users keep full control.
• Closes the leak by default. Strangers texting the bridge get silence instead of a bot existence-disclosure.

Alternatives considered

1. Make allowlist the global default. Breaks first-run — owner doesn't yet know their own handle in the channel's format.
2. Prompt at first-owner-approval time. Adds an interactive step to a flow that's otherwise clean.
3. Document and leave to users. Current state. Quiet footgun.

Scope

Applies to DM-capable channels with a dmPolicy field: imessage, bluebubbles, discord, signal, telegram, whatsapp, slack, matrix, etc. (full list in docs/channels/pairing.md).

Notes

Happy to discuss the trigger condition (e.g. whether groupPolicy: disabled should also auto-flip, or stay opt-in). The core ask is just: post-bootstrap, the default shouldn't keep replying to strangers.