fix(messaging): add WhatsApp channel diagnostics (#4386)

docs/reference/commands.mdx

@@ -759,6 +759,21 @@ $ nemoclaw my-assistant channels start telegram
 |------|-------------|
 | `--dry-run` | Report the channel that would be re-enabled without updating the registry or rebuilding |
 
+### `nemoclaw <name> channels status`
+
+Run channel-specific runtime diagnostics. For WhatsApp the command probes the sandbox to separately report pairing/session state, the Noise WebSocket connection, inbound event delivery, and policy/config coverage; a paired channel with no observed inbound delivery exits non-zero with verdict `idle` so an unhealthy bridge cannot pass as healthy.
+
+```bash
+nemoclaw my-assistant channels status --channel whatsapp
+```
+
+| Flag | Description |
+|------|-------------|
+| `--channel <channel>` | Channel to inspect; defaults to `whatsapp` when registered |
+| `--json` | Emit the diagnostic report as JSON (exit non-zero when the verdict is not `healthy` or `unknown`) |
+
+The probe is bounded by an in-sandbox `openshell sandbox exec` with a hard timeout, captures only short matched bridge log signals (e.g. `connection.open`, `401 unauthorized`, `qr expired`), and never forwards message bodies to the host diagnostic output.
+
 ### `nemoclaw <name> skill install <path>`
 
 Deploy a skill directory to a running sandbox.

src/commands/sandbox/channels/status.ts

@@ -0,0 +1,49 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { Flags } from "@oclif/core";
+
+import { showSandboxChannelStatus } from "../../../lib/actions/sandbox/channel-status";
+import { NemoClawCommand } from "../../../lib/cli/nemoclaw-oclif-command";
+import { sandboxNameArg } from "../../../lib/sandbox/command-support";
+
+export default class SandboxChannelsStatusCommand extends NemoClawCommand {
+  static id = "sandbox:channels:status";
+  static strict = true;
+  static enableJsonFlag = true;
+  static summary = "Inspect a messaging channel's runtime diagnostics";
+  static description =
+    "Report channel-specific runtime diagnostics — for WhatsApp, separately reports QR/session state, Noise WebSocket state, inbound event delivery, and policy coverage so a paired-but-idle channel does not appear healthy.";
+  static usage = ["<name> [--channel <channel>] [--json]"];
+  static examples = [
+    "<%= config.bin %> sandbox channels status alpha --channel whatsapp",
+    "<%= config.bin %> sandbox channels status alpha --json",
+  ];
+  static args = {
+    sandboxName: sandboxNameArg,
+  };
+  static flags = {
+    channel: Flags.string({
+      description: "Messaging channel to inspect (defaults to whatsapp when registered)",
+      required: false,
+    }),
+  };
+
+  public async run(): Promise<unknown> {
+    const { args, flags } = await this.parse(SandboxChannelsStatusCommand);
+    const report = await showSandboxChannelStatus(args.sandboxName, {
+      channel: flags.channel,
+      asJson: this.jsonEnabled(),
+      quietJson: this.jsonEnabled(),
+    });
+    if (this.jsonEnabled()) {
+      if (report && "report" in report) {
+        const verdict = report.report.verdict;
+        if (verdict !== "healthy" && verdict !== "unknown") {
+          process.exitCode = 1;
+        }
+      }
+      return report;
+    }
+  }
+}