fix(whatsapp): sandbox chromium by default

src/channels/whatsapp/adapter.test.ts

@@ -564,6 +564,37 @@ describe('WhatsAppAdapter', () => {
     );
   });
 
+  it('uses sandboxed Chromium args by default', async () => {
+    const connectPromise = adapter.connect();
+    simulateEvent('ready');
+    await connectPromise;
+
+    const { Client } = await import('whatsapp-web.js');
+    expect(Client).toHaveBeenCalledWith(expect.objectContaining({
+      puppeteer: expect.objectContaining({
+        headless: true,
+        args: [],
+      }),
+    }));
+  });
+
+  it('allows opting into no-sandbox Chromium args via config', async () => {
+    const adapterNoSandbox = new WhatsAppAdapter({
+      allowNoSandbox: true,
+    });
+
+    const connectPromise = adapterNoSandbox.connect();
+    simulateEvent('ready');
+    await connectPromise;
+
+    const { Client } = await import('whatsapp-web.js');
+    expect(Client).toHaveBeenCalledWith(expect.objectContaining({
+      puppeteer: expect.objectContaining({
+        args: ['--no-sandbox', '--disable-setuid-sandbox'],
+      }),
+    }));
+  });
+
   it('connect sets error status when initialize() rejects', async () => {
     mockInitialize.mockRejectedValueOnce(new Error('Browser launch failed'));
 

src/channels/whatsapp/adapter.ts

@@ -32,6 +32,8 @@ export interface WhatsAppAdapterConfig {
   dataDir?: string;
   /** Optional pairing manager for DM pairing codes. */
   pairingManager?: PairingManager;
+  /** Allow launching Chromium without sandbox (unsafe; use only in high-trust/containerized setups). */
+  allowNoSandbox?: boolean;
 }
 
 /** Minimal shape of a whatsapp-web.js message. */
@@ -88,11 +90,18 @@ export class WhatsAppAdapter implements ChannelAdapter {
         dataPath: this.config.dataDir,
       });
 
+      const puppeteerArgs = this.config.allowNoSandbox
+        ? ['--no-sandbox', '--disable-setuid-sandbox']
+        : [];
+      if (this.config.allowNoSandbox) {
+        console.warn('WhatsApp adapter: Chromium sandbox disabled via config (unsafe).');
+      }
+
       this.client = new Client({
         authStrategy,
         puppeteer: {
           headless: true,
-          args: ['--no-sandbox', '--disable-setuid-sandbox'],
+          args: puppeteerArgs,
         },
       });