refactor(security): make empty allowlist behavior explicit

src/plugin-sdk/allow-from.ts

@@ -21,12 +21,15 @@ export function isAllowedParsedChatSender<TParsed extends ParsedChatAllowTarget>
   chatId?: number | null;
   chatGuid?: string | null;
   chatIdentifier?: string | null;
+  emptyAllowFrom?: "deny" | "allow";
   normalizeSender: (sender: string) => string;
   parseAllowTarget: (entry: string) => TParsed;
 }): boolean {
   const allowFrom = params.allowFrom.map((entry) => String(entry).trim());
   if (allowFrom.length === 0) {
-    return false;
+    // Fail closed by default. Callers can opt into legacy "empty = allow all"
+    // behavior explicitly when a surface intentionally treats an empty list as open.
+    return params.emptyAllowFrom === "allow";
   }
   if (allowFrom.includes("*")) {
     return true;