Feature Request

Problem

When using WhatsApp with groupPolicy: allowlist and groupAllowFrom, unauthorized groups are blocked from triggering agent sessions — but the bot remains a member of those groups. This creates a security/privacy concern: the bot is still technically present and visible to group members.

Proposed Solutions

1. Auto-leave on unauthorized group add

When the bot is added to a group not in groupAllowFrom, automatically leave the group.

{
  "channels": {
    "whatsapp": {
      "groupPolicy": "allowlist",
      "groupAllowFrom": ["123@g.us"],
      "autoLeaveUnauthorized": true  // new option
    }
  }
}

2. Group-join webhook/event

Expose a hook when the bot is added to a new group, allowing custom logic:

{
  "hooks": {
    "whatsapp.groupJoin": {
      "enabled": true,
      "action": "leave" | "notify" | "custom"
    }
  }
}

Or fire a system event to the main session:

[System] You were added to WhatsApp group "Spam Group" (456@g.us) by +1234567890

This would allow the agent to decide whether to stay, leave, or alert the owner.

3. Manual leave action

Add action: leave to the message tool:

message action=leave channel=whatsapp groupId=456@g.us

Use Case

• Security-conscious deployments where the bot should only exist in pre-approved groups
• Preventing reconnaissance (bad actors adding the bot to groups to probe its behavior)
• Clean group membership hygiene

Current Workaround

groupAllowFrom blocks messages but doesn't remove the bot from unauthorized groups. Manual cleanup required via WhatsApp app.

Environment

• OpenClaw 2026.2.1
• WhatsApp channel enabled