fix(tlon): expose group invite allowlist

docs/.generated/config-baseline.sha256

@@ -1,4 +1,4 @@
-5603f93164f1bed3b39714b813c7597e188321fff07cfbb6980d7198a69da162  config-baseline.json
+e56c45e488ccd3a5849d170b3c696358f0c04c39d0d15b0a4ca47892e6eee0d0  config-baseline.json
 5b5ebd95939d75496597d9858a375e27544812d0f79dc3b4bf87c794ada2ba08  config-baseline.core.json
-c83a29196d34b4aff4849f63ae8850298441c367811d928e1ab2efe787eae520  config-baseline.channel.json
+c2b5883fe161cd97b2787c92cf71726840de84d097d85d741791f523bd55a865  config-baseline.channel.json
 055fae0d0067a751dc10125af7421da45633f73519c94c982d02b0c4eb2bdf67  config-baseline.plugin.json

docs/channels/tlon.md

@@ -190,18 +190,22 @@ Auto-accept DM invites (for ships in dmAllowlist):
 }
 ```
 
-Auto-accept group invites:
+Auto-accept group invites from trusted ships:
 
 ```json5
 {
   channels: {
     tlon: {
       autoAcceptGroupInvites: true,
+      groupInviteAllowlist: ["~zod"],
     },
   },
 }
 ```
 
+`autoAcceptGroupInvites` fails closed when `groupInviteAllowlist` is empty. Set the
+allowlist to the ships whose group invites should be accepted automatically.
+
 ## Delivery targets (CLI/cron)
 
 Use these with `openclaw message send` or cron delivery:
@@ -268,7 +272,8 @@ Provider options:
 - `channels.tlon.ownerShip`: owner ship for approval system (always authorized).
 - `channels.tlon.dmAllowlist`: ships allowed to DM (empty = none).
 - `channels.tlon.autoAcceptDmInvites`: auto-accept DMs from allowlisted ships.
-- `channels.tlon.autoAcceptGroupInvites`: auto-accept all group invites.
+- `channels.tlon.autoAcceptGroupInvites`: auto-accept group invites from allowlisted ships.
+- `channels.tlon.groupInviteAllowlist`: ships whose group invites may be auto-accepted.
 - `channels.tlon.autoDiscoverChannels`: auto-discover group channels (default: true).
 - `channels.tlon.groupChannels`: manually pinned channel nests.
 - `channels.tlon.defaultAuthorizedShips`: ships authorized for all channels.