fix(telegram): default fresh setups to mention-gated groups

CHANGELOG.md

@@ -67,6 +67,7 @@ Docs: https://docs.openclaw.ai
 - CLI/Ollama onboarding: keep the interactive model picker for explicit `openclaw onboard --auth-choice ollama` runs so setup still selects a default model without reintroducing pre-picker auto-pulls. (#49249) Thanks @BruceMacD.
 - Plugins/bundler TDZ: fix `RESERVED_COMMANDS` temporal dead zone error that prevented device-pair, phone-control, and talk-voice plugins from registering when the bundler placed the commands module after call sites in the same output chunk. Thanks @BunsDev.
 - Plugins/imports: fix stale googlechat runtime-api import paths and signal SDK circular re-exports broken by recent plugin-sdk refactors. Thanks @BunsDev.
+- Telegram/setup: seed fresh setups with `channels.telegram.groups["*"].requireMention=true` so new bots stay mention-gated in groups unless you explicitly open them up. Thanks @vincentkoc.
 - Google auth/Node 25: patch `gaxios` to use native fetch without injecting `globalThis.window`, while translating proxy and mTLS transport settings so Google Vertex and Google Chat auth keep working on Node 25. (#47914) Thanks @pdd-cli.
 - Gateway/startup: load bundled channel plugins from compiled `dist/extensions` entries in built installs, so gateway boot no longer recompiles bundled extension TypeScript on every startup and WhatsApp-class cold starts drop back to seconds instead of tens of seconds or worse. (#47560) Thanks @ngutman.
 - Agents/openai-responses: strip `prompt_cache_key` and `prompt_cache_retention` for non-OpenAI-compatible Responses endpoints while keeping them on direct OpenAI and Azure OpenAI paths, so third-party OpenAI-compatible providers no longer reject those requests with HTTP 400. (#49877) Thanks @ShaunTsai.

extensions/telegram/src/setup-surface.test.ts

@@ -3,6 +3,17 @@ import { describe, expect, it, vi } from "vitest";
 import type { OpenClawConfig } from "../../../src/config/config.js";
 import { telegramSetupWizard } from "./setup-surface.js";
 
+async function runPrepare(cfg: OpenClawConfig, accountId: string) {
+  return await telegramSetupWizard.prepare?.({
+    cfg,
+    accountId,
+    credentialValues: {},
+    runtime: {} as never,
+    prompter: {} as never,
+    options: {},
+  });
+}
+
 async function runFinalize(cfg: OpenClawConfig, accountId: string) {
   const prompter = {
     note: vi.fn(async () => undefined),
@@ -20,6 +31,45 @@ async function runFinalize(cfg: OpenClawConfig, accountId: string) {
   return prompter.note;
 }
 
+describe("telegramSetupWizard.prepare", () => {
+  it('adds groups["*"].requireMention=true for fresh setups', async () => {
+    const prepared = await runPrepare(
+      {
+        channels: {
+          telegram: {
+            botToken: "tok",
+          },
+        },
+      },
+      DEFAULT_ACCOUNT_ID,
+    );
+
+    expect(prepared?.cfg.channels?.telegram?.groups).toEqual({
+      "*": { requireMention: true },
+    });
+  });
+
+  it("preserves an explicit wildcard group mention setting", async () => {
+    const prepared = await runPrepare(
+      {
+        channels: {
+          telegram: {
+            botToken: "tok",
+            groups: {
+              "*": { requireMention: false },
+            },
+          },
+        },
+      },
+      DEFAULT_ACCOUNT_ID,
+    );
+
+    expect(prepared?.cfg.channels?.telegram?.groups).toEqual({
+      "*": { requireMention: false },
+    });
+  });
+});
+
 describe("telegramSetupWizard.finalize", () => {
   it("shows global config commands for the default account", async () => {
     const note = await runFinalize(

extensions/telegram/src/setup-surface.ts

@@ -27,6 +27,31 @@ import {
 
 const channel = "telegram" as const;
 
+function ensureTelegramDefaultGroupMentionGate(
+  cfg: OpenClawConfig,
+  accountId: string,
+): OpenClawConfig {
+  const resolved = resolveTelegramAccount({ cfg, accountId });
+  const wildcardGroup = resolved.config.groups?.["*"];
+  if (wildcardGroup?.requireMention !== undefined) {
+    return cfg;
+  }
+  return patchChannelConfigForAccount({
+    cfg,
+    channel,
+    accountId,
+    patch: {
+      groups: {
+        ...resolved.config.groups,
+        "*": {
+          ...wildcardGroup,
+          requireMention: true,
+        },
+      },
+    },
+  });
+}
+
 function shouldShowTelegramDmAccessWarning(cfg: OpenClawConfig, accountId: string): boolean {
   const merged = mergeTelegramAccountConfig(cfg, accountId);
   const policy = merged.dmPolicy ?? "pairing";
@@ -80,6 +105,10 @@ export const telegramSetupWizard: ChannelSetupWizard = {
         return account.configured;
       }),
   },
+  prepare: async ({ cfg, accountId, credentialValues }) => ({
+    cfg: ensureTelegramDefaultGroupMentionGate(cfg, accountId),
+    credentialValues,
+  }),
   credentials: [
     {
       inputKey: "token",