feat(messaging): add WeChat as a first-class provider for NemoClaw agents

[ericksoa]

Problem Statement

NemoClaw should support WeChat as a first-class messaging provider for NemoClaw-created agents.

Today NemoClaw documents and wires messaging channels such as Telegram, Discord, and Slack through onboarding, channel commands, OpenShell-managed credential providers, policy presets, and sandbox rebuilds. WeChat is not available as an equivalent supported channel, which leaves China-focused teams and customers building their own bridge layer outside NemoClaw. That adds operational risk, increases security-review burden, and makes demos or deployments harder in environments where WeChat is the expected user-facing collaboration surface.

This issue narrows the broader Chinese IM request in #2213 to a concrete WeChat implementation target. The goal is not to enable WeChat automatically for every sandbox; the goal is that every NemoClaw agent can opt into WeChat through the same supported messaging-provider path as the existing channels.

Requested Implementation

Build wechat as a supported NemoClaw messaging channel across the same surfaces that already handle Telegram, Discord, and Slack.

The implementation should cover:

• Channel registry and CLI support:
  • nemoclaw <sandbox> channels list shows wechat with a concise description.
  • nemoclaw <sandbox> channels add wechat, remove wechat, start wechat, and stop wechat are supported, or the first implementation clearly documents any narrower supported workflow.
  • Onboarding can select WeChat alongside the existing messaging providers.
• Credential and secret handling:
  • WeChat credentials are collected through onboarding/channel commands and stored as OpenShell providers, not baked directly into the sandbox image or leaked through build args.
  • Provider naming, registry state, and cleanup follow the per-sandbox messaging-provider model.
• Runtime behavior:
  • NemoClaw bakes the selected WeChat channel config into the sandbox during onboard/rebuild, matching the current messaging-channel model.
  • A WeChat-enabled agent can receive messages and send replies through the configured WeChat integration.
  • nemoclaw status, logs, and diagnostics surface actionable health information for the WeChat channel.
• Policy/networking:
  • Add the required WeChat/WeCom egress policy preset(s) and document exactly which endpoints are required.
  • The default/balanced tier should not silently enable messaging access; WeChat should become available as a supported provider when the user selects it or uses an open/messaging-capable policy.
• Product/API decision to settle in the PR:
  • Identify the first supported WeChat target: WeChat Official Account, WeCom/Enterprise WeChat, QR-code personal WeChat bridge, or another maintainable mode.
  • Document any compliance, terms-of-service, or enterprise-auth constraints that affect which mode NemoClaw can support publicly.

Acceptance Criteria

• wechat is listed as a supported messaging channel in CLI help/docs and channel listing output.
• A new or existing NemoClaw sandbox can be configured for WeChat without custom user-maintained bridge code.
• WeChat credentials are handled through OpenShell provider plumbing with the same secret-redaction guarantees as other messaging integrations.
• Onboard/rebuild preserves and applies WeChat channel configuration consistently.
• Channel add/remove/start/stop behavior is implemented or the first-supported limitations are explicitly documented.
• Required WeChat network policy presets are added and covered by tests.
• Docs include setup steps, credential requirements, supported WeChat mode, troubleshooting notes, and any known limitations.
• Tests cover provider registration, config generation, policy inclusion, credential redaction, channel persistence, and at least one mocked or integration-safe send/receive path.

Alternatives Considered

• Leave WeChat to user-maintained bridge processes outside NemoClaw. This does not meet the product goal because customers still need custom host services, custom secret handling, and separate security review.
• Keep only the broad Weak Chinese IM integration #2213 umbrella issue. That is useful for prioritization, but WeChat needs its own concrete tracking issue because the API/auth model and acceptance criteria are different from Feishu or DingTalk.
• Make WeChat enabled by default for every sandbox. This should not be the default behavior because messaging access requires explicit credentials and network policy expansion.

Category

enhancement: integration

Contributor Notes

This is a high-impact integration area for contributors familiar with WeChat, WeCom, and China-focused developer workflows. A good first PR should start by choosing the supported WeChat mode, documenting that choice, and wiring the provider through NemoClaw's existing messaging-channel architecture rather than introducing a separate host-side bridge.