Docs: merge remaining channel support notes

README.md

@@ -77,6 +77,17 @@ It helps with three things that become painful fast in raw JSON / terminal workf
 - **Built-in CLI terminal**: run OpenClaw commands from any page with streaming output, presets, favorites, and Tab completion.
 - **Ops actions**: restart gateway, view logs, health check, backups (local + NAS), and cron management.
 - **Telegram-first workflow**: safer sub-agent setup flow + allowlist helper + warnings for group privacy.
+## Channel Support
+
+OCM is a local UI for OpenClaw. Core features like agent trees, routing, models/auth, ops, backups, and the built-in CLI are channel-agnostic.
+
+Current channel positioning:
+
+- **Telegram** — best supported and most documented today
+- **Discord** — supported; recommended for private channels/threads with strict allowlist
+- **Feishu / Lark** — supported in broader OpenClaw ecosystems, but not a primary OCM workflow today
+- **WhatsApp** — not recommended for sub-agent topology workflows
+
 ## Recommended Workflows
 
 OCM is **Telegram-first, not Telegram-only**. Telegram is the smoothest path today, but OCM is also useful for local ops, Discord routing, model/auth management, and backups.

docs/FAQ.md

@@ -51,3 +51,12 @@ That said, your local OpenClaw config contains sensitive information. Follow the
 - don't share raw screenshots without redaction
 
 See: `docs/SECURITY.md`.
+
+
+## Q: 为什么 OCM 暂时不推荐 WhatsApp 的 sub-agent 工作流？
+
+WhatsApp 在 bot / group 自动化、权限边界和稳定路由上限制更多。
+
+OCM 的 sub-agent 模式依赖清晰的会话边界、独立路由和可控权限，因此目前更推荐 Telegram / Discord 这类更容易做隔离的渠道。
+
+如果未来支持 WhatsApp，更可能先从通知或轻量交互开始，而不是多 sub-agent 群聊拓扑。

docs/SECURITY.md

@@ -28,3 +28,25 @@ If you share screenshots publicly:
 - blur any tokens/keys if visible
 
 This repo contains **redacted + annotated** screenshots under `docs/annotated-screenshots/`.
+
+
+## Discord safety
+
+Recommended defaults (especially for shared/community servers):
+
+- Prefer **private channels / private threads** as agent boundaries
+- Use a strict **allowlist** of channels/threads the bot may respond in
+- Avoid giving memory-enabled or high-privilege agents broad public exposure
+- Prefer least-privilege Discord permissions for the bot
+
+## Feishu / Lark safety
+
+Feishu is more enterprise-oriented and usually needs stricter permission design:
+
+- Request the smallest permission scope possible
+- Treat chat/group visibility as a security boundary
+- Prefer separate chats/spaces for different agents to reduce context bleed
+
+## WhatsApp note
+
+WhatsApp is not a recommended target for sub-agent topology workflows. Constraints in bot/group automation make reliable multi-agent isolation and routing harder.