WhatsApp channel fails on DGX Spark -- libsignal-node dependency missing from sandbox image #724

Description

Summary
The WhatsApp channel is non-functional on DGX Spark due to @whiskeysockets/libsignal-node@2.0.1 being entirely missing from the sandbox image. The module is declared as a git dependency (git+https://github.com/whiskeysockets/libsignal-node) by Baileys but was never resolved during the image build. OpenClaw detects the broken dependency and disables the channel entirely, reporting "Unsupported channel: whatsapp" despite the Baileys library and all WhatsApp channel code being present.
Environment

Hardware: NVIDIA DGX Spark
Architecture: aarch64 (GNU/Linux 6.14.0-1015-nvidia aarch64)
DGX Spark Version: 7.3.1
OpenClaw: 2026.3.11 (29dc654)
NemoClaw: installed via build.nvidia.com/spark/nemoclaw/instructions
OpenShell: openshell-cluster image ghcr.io/nvidia/openshell/cluster:0.0.6
Sandbox image: openshell/sandbox-from:1773703385
Baileys version: @whiskeysockets/baileys@7.0.0-rc.9
Node.js: 22.22.1
Inference: Ollama local (nemotron-3-nano via ollama-local provider)

Steps to Reproduce

Follow NemoClaw setup instructions at build.nvidia.com/spark/nemoclaw/instructions
Complete nemoclaw onboard wizard (all steps succeed including inference setup)
Connect to sandbox: openshell sandbox connect anton
Attempt to add WhatsApp channel via onboarding: openclaw onboard -> select WhatsApp
WebSocket handshake times out (408), but channel config is written (DM policy, allowFrom)
Attempt to login directly: openclaw channels login --channel whatsapp
Result: Channel login failed: Error: Unsupported channel: whatsapp

Root Cause
The WhatsApp channel code, Baileys library, and onboarding adapter are all present in the sandbox image:
/usr/local/lib/node_modules/openclaw/dist/channels/plugins/agent-tools/whatsapp-login.js
/usr/local/lib/node_modules/openclaw/dist/plugin-sdk/whatsapp.js
/usr/local/lib/node_modules/openclaw/dist/plugin-sdk/channels/plugins/onboarding/whatsapp.d.ts
/usr/local/lib/node_modules/openclaw/node_modules/@whiskeysockets/baileys
However, libsignal-node (a native crypto module required by Baileys for the Signal Protocol handshake) is not installed at all:
$ npm ls -g --all 2>/dev/null | grep -i "baileys|whatsapp"
+-- @whiskeysockets/baileys@7.0.0-rc.9
| +-- libsignal@npm:@whiskeysockets/libsignal-node@2.0.1 invalid: "git+https://github.com/whiskeysockets/libsignal-node" from node_modules/openclaw/node_modules/@whiskeysockets/baileys
Verification that the module is completely missing (not just a wrong-architecture binary):
$ node -e "try { require('@whiskeysockets/libsignal-node'); console.log('OK'); } catch(e) { console.log(e.message); }"
Cannot find module '@whiskeysockets/libsignal-node'

$ find /usr/local/lib/node_modules/openclaw/node_modules/@WhiskeySockets -name "*.node" -type f
(no output -- no native binary exists at all)
The invalid status in npm indicates the git URL dependency (git+https://github.com/whiskeysockets/libsignal-node) was never resolved during the sandbox image build. The module is entirely absent, not just incompatible.
What Was Tried

npm rebuild from within sandbox:

cd /usr/local/lib/node_modules/openclaw && npm rebuild
Reports "rebuilt dependencies successfully" but does not fix the missing module (nothing to rebuild since it was never installed)

npm install @whiskeysockets/libsignal-node --build-from-source:

Fails with 403 from registry -- the package is not published to npm (it's a git-only dependency)

Clone and build from source:

git clone https://github.com/whiskeysockets/libsignal-node.git succeeds (git binary is allowed by OpenShell policy)
npm install fails because node is not in the allowed binary list for registry.npmjs.org in the OpenShell network policy (only npm and openclaw binaries are allowed)
Even if npm install succeeded, the repo has no "build" script defined

Additional Context: OpenShell Network Policy
Even after adding WhatsApp domains (web.whatsapp.com:443, g.whatsapp.net:443, s.whatsapp.net:443/5222, etc.) to the OpenShell network policy, the channel cannot initialize because the libsignal-node dependency is broken before any network connection is attempted.
The OpenShell policy also contributes to the difficulty of rebuilding:

The npm_registry policy only allows npm and openclaw binaries, not node -- so npm install invoked by node scripts inside cloned repos gets blocked
The github policy only allows gh and git binaries, not npm or node

Suggested Fix

Resolve the libsignal-node git dependency during the sandbox image build -- the git+https://github.com/whiskeysockets/libsignal-node dependency declared by Baileys needs to be fetched and built when creating the OpenClaw sandbox image
Add node to the npm_registry binary allowlist in the default OpenShell policy so dependencies can be installed from within the sandbox as a workaround
Consider adding a WhatsApp network policy preset (similar to the existing telegram.yaml preset) that includes web.whatsapp.com, g.whatsapp.net, s.whatsapp.net, and related WhatsApp Web endpoints

Side Note: build.nvidia.com Docs Issues
The build.nvidia.com/spark/nemoclaw/instructions page has a stale repo URL in Step 5. It references:
git clone https://github.com/NVIDIA/openshell-openclaw-plugin.git
The actual public repo is:
git clone https://github.com/NVIDIA/NemoClaw.git
Labels
bug, dgx-spark, whatsapp, channels, sandbox-image

Reproduction Steps

Steps to Reproduce

Follow NemoClaw setup instructions at build.nvidia.com/spark/nemoclaw/instructions
Complete nemoclaw onboard wizard (all steps succeed including inference setup)
Connect to sandbox: openshell sandbox connect anton
Attempt to add WhatsApp channel via onboarding: openclaw onboard -> select WhatsApp
WebSocket handshake times out (408), but channel config is written (DM policy, allowFrom)
Attempt to login directly: openclaw channels login --channel whatsapp
Result: Channel login failed: Error: Unsupported channel: whatsapp

Environment

DGX spark

Debug Output

Logs

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate