fix(doctor): suppress telegram fresh-install group warning

src/commands/doctor-config-flow.test.ts

@@ -109,6 +109,48 @@ describe("doctor config flow", () => {
     ).toBe(false);
   });
 
+  it("does not warn for fresh Telegram baseline without configured groups", async () => {
+    const doctorWarnings = await collectDoctorWarnings({
+      channels: {
+        telegram: {
+          botToken: "123:abc",
+          groupPolicy: "allowlist",
+        },
+      },
+    });
+
+    expect(
+      doctorWarnings.some(
+        (line) =>
+          line.includes('channels.telegram.groupPolicy is "allowlist"') &&
+          line.includes("groupAllowFrom"),
+      ),
+    ).toBe(false);
+  });
+
+  it("does not warn for account-scoped Telegram baseline without configured groups", async () => {
+    const doctorWarnings = await collectDoctorWarnings({
+      channels: {
+        telegram: {
+          accounts: {
+            default: {
+              botToken: "123:abc",
+              groupPolicy: "allowlist",
+            },
+          },
+        },
+      },
+    });
+
+    expect(
+      doctorWarnings.some(
+        (line) =>
+          line.includes('channels.telegram.accounts.default.groupPolicy is "allowlist"') &&
+          line.includes("groupAllowFrom"),
+      ),
+    ).toBe(false);
+  });
+
   it("warns on mutable Zalouser group entries when dangerous name matching is disabled", async () => {
     const doctorWarnings = await collectDoctorWarnings({
       channels: {

src/commands/doctor-config-flow.ts

@@ -1330,6 +1330,16 @@ function detectEmptyAllowlistPolicy(cfg: OpenClawConfig): string[] {
     );
   };
 
+  const hasConfiguredGroups = (
+    account: Record<string, unknown>,
+    parent?: Record<string, unknown>,
+  ): boolean => {
+    const groups =
+      (account.groups as Record<string, unknown> | undefined) ??
+      (parent?.groups as Record<string, unknown> | undefined);
+    return Boolean(groups) && Object.keys(groups ?? {}).length > 0;
+  };
+
   const checkAccount = (
     account: Record<string, unknown>,
     prefix: string,
@@ -1372,6 +1382,11 @@ function detectEmptyAllowlistPolicy(cfg: OpenClawConfig): string[] {
       undefined;
 
     if (groupPolicy === "allowlist" && usesSenderBasedGroupAllowlist(channelName)) {
+      if (channelName === "telegram" && !hasConfiguredGroups(account, parent)) {
+        // Fresh Telegram installs default to fail-closed group access until the
+        // operator explicitly configures allowed groups or sender filters.
+        return;
+      }
       const rawGroupAllowFrom =
         (account.groupAllowFrom as Array<string | number> | undefined) ??
         (parent?.groupAllowFrom as Array<string | number> | undefined);