fix: harden sessions_spawn attachment schema landing (#33648) (thanks @anisoptera)

CHANGELOG.md

@@ -14,6 +14,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Sessions/subagent attachments: remove `attachments[].content.maxLength` from `sessions_spawn` schema to avoid llama.cpp GBNF repetition overflow, and preflight UTF-8 byte size before buffer allocation while keeping runtime file-size enforcement unchanged. (#33648) Thanks @anisoptera.
 - Runtime/tool-state stability: recover from dangling Anthropic `tool_use` after compaction, serialize long-running Discord handler runs without blocking new inbound events, and prevent stale busy snapshots from suppressing stuck-channel recovery. (from #33630, #33583) Thanks @kevinWangSheng and @theotarr.
 - Extensions/media local-root propagation: consistently forward `mediaLocalRoots` through extension `sendMedia` adapters (Google Chat, Slack, iMessage, Signal, WhatsApp), preserving non-local media behavior while restoring local attachment resolution from configured roots. Synthesis of #33581, #33545, #33540, #33536, #33528. Thanks @bmendonca3.
 - Gateway/security default response headers: add `Permissions-Policy: camera=(), microphone=(), geolocation=()` to baseline gateway HTTP security headers for all responses. (#30186) thanks @habakan.

src/agents/subagent-spawn.ts

@@ -611,13 +611,14 @@ export async function spawnSubagentDirect(
           }
           buf = strictBuf;
         } else {
-          buf = Buffer.from(contentVal, "utf8");
+          // Avoid allocating oversized UTF-8 buffers before enforcing file limits.
-          const estimatedBytes = buf.byteLength;
+          const estimatedBytes = Buffer.byteLength(contentVal, "utf8");
           if (estimatedBytes > maxFileBytes) {
             fail(
               `attachments_file_bytes_exceeded (name=${name} bytes=${estimatedBytes} maxFileBytes=${maxFileBytes})`,
             );
           }
+          buf = Buffer.from(contentVal, "utf8");
         }
 
         const bytes = buf.byteLength;

src/agents/tools/sessions-spawn-tool.test.ts

@@ -164,4 +164,26 @@ describe("sessions_spawn tool", () => {
     expect(hoisted.spawnAcpDirectMock).not.toHaveBeenCalled();
     expect(hoisted.spawnSubagentDirectMock).not.toHaveBeenCalled();
   });
+
+  it("keeps attachment content schema unconstrained for llama.cpp grammar safety", () => {
+    const tool = createSessionsSpawnTool();
+    const schema = tool.parameters as {
+      properties?: {
+        attachments?: {
+          items?: {
+            properties?: {
+              content?: {
+                type?: string;
+                maxLength?: number;
+              };
+            };
+          };
+        };
+      };
+    };
+
+    const contentSchema = schema.properties?.attachments?.items?.properties?.content;
+    expect(contentSchema?.type).toBe("string");
+    expect(contentSchema?.maxLength).toBeUndefined();
+  });
 });