Description
The current implementation fails to propagate the ALLOWED_CHAT_IDS environment variable to the Telegram bridge child process. This results in a security bypass where any user can interact with the bot regardless of the whitelist settings.
Reproduction Steps
$ env | grep ALLOWED
ALLOWED_CHAT_IDS=<redacted>
$ nemoclaw start
[services] telegram-bridge started (PID 42541)
...
$ ps -wwp 42541 -E | grep ALLOWED || echo "missed"
missed
Environment
- OS: macOS 26.3.1
- Node.js: v25.2.1
- Docker: Docker Desktop 4.62.0, Engine 29.2.1
- NemoClaw: v0.1.0
Debug Output
Logs
Checklist
Description
The current implementation fails to propagate the
ALLOWED_CHAT_IDSenvironment variable to the Telegram bridge child process. This results in a security bypass where any user can interact with the bot regardless of the whitelist settings.Reproduction Steps
Environment
Debug Output
Logs
Checklist