docs: address search entry review feedback

docs/guides/telegram-ai-agent.md

@@ -1,7 +1,7 @@
 # Build a Telegram AI Agent with nanobot
 
-This guide connects nanobot to Telegram so an allowed Telegram user can message
-a self-hosted AI agent backed by your normal nanobot config, tools, memory, and
+This guide connects nanobot to Telegram so a paired Telegram user can message a
+self-hosted AI agent backed by your normal nanobot config, tools, memory, and
 workspace.
 
 ## What this guide builds
@@ -9,7 +9,7 @@ workspace.
 - a Telegram bot created through BotFather
 - the `telegram` channel enabled in nanobot
 - a running nanobot gateway
-- one test message from an allowed Telegram account
+- one pairing-approved Telegram account
 
 ## Prerequisites
 
@@ -21,7 +21,6 @@ nanobot agent -m "Hello!"
 
 - A Telegram account.
 - A bot token from `@BotFather`.
-- Your Telegram user ID for `allowFrom`.
 
 ## Install nanobot
 
@@ -45,13 +44,15 @@ Merge this snippet into `~/.nanobot/config.json`:
   "channels": {
     "telegram": {
       "enabled": true,
-      "token": "YOUR_BOT_TOKEN",
-      "allowFrom": ["YOUR_USER_ID"]
+      "token": "YOUR_BOT_TOKEN"
     }
   }
 }
 ```
 
+Omitting `allowFrom` enables pairing-only mode. The first DM from a new user
+gets a pairing code instead of agent access.
+
 Telegram uses long polling by default. Webhook mode is available for public
 HTTPS deployments; start with long polling for the first test.
 
@@ -66,19 +67,27 @@ Leave the gateway running while you test messages.
 
 ## Test a message
 
-Open Telegram, message the bot from the user in `allowFrom`, and send:
+Open Telegram, DM the bot, and send:
 
 ```text
 Hello from Telegram
 ```
 
-The reply should use the same model and workspace as your local CLI check.
+The bot should reply with a pairing code. Approve it from an already trusted
+surface, such as the local CLI:
+
+```bash
+nanobot agent -m "/pairing approve ABCD-EFGH"
+```
+
+Send the message again after approval. The reply should use the same model and
+workspace as your local CLI check.
 
 ## Security notes
 
-- Keep `allowFrom` to your own user ID until the bot is stable.
-- Do not use `allowFrom: ["*"]` unless the bot is isolated or intentionally
-  public.
+- Prefer pairing-only mode for first setup. Add `allowFrom` only when you want a
+  static allowlist instead of code approval.
+- Do not use `allowFrom: ["*"]` unless the bot is isolated or intentionally public.
 - Rotate the BotFather token if it is pasted into logs or shared files.
 - Review tool access before adding group chats or more users.
 
@@ -87,7 +96,9 @@ The reply should use the same model and workspace as your local CLI check.
 - If the channel is not listed, run `nanobot plugins enable telegram` again in
   the same Python environment.
 - If messages do not arrive, run `nanobot gateway --verbose` and check the bot
-  token and allowed user ID.
+  token.
+- If a first DM returns a pairing code, that is expected. Approve the code before
+  testing normal agent replies.
 - If Telegram Web shows unsupported rich messages, keep `richMessages` disabled.
 
 ## Next: memory, automations, MCP tools