Skip to content

feat(gmail): make inline attachment size limit configurable - #947

Merged
steipete merged 5 commits into
openclaw:mainfrom
ronny-rentner:feat/gmail-inline-max-bytes
Aug 2, 2026
Merged

feat(gmail): make inline attachment size limit configurable#947
steipete merged 5 commits into
openclaw:mainfrom
ronny-rentner:feat/gmail-inline-max-bytes

Conversation

@ronny-rentner

Copy link
Copy Markdown
Contributor

Summary

gmail attachment --inline embeds the attachment content as base64 (contentBase64) in the response, but the size it will embed is capped at a hardcoded 3 MiB. This makes that cap configurable while keeping the current default, so nothing changes unless you ask for it.

  • New flag --inline-max-bytes on gmail attachment (default 3145728, i.e. the current 3 MiB).
  • Also settable via GOG_GMAIL_INLINE_MAX_BYTES.
  • Attachments larger than the limit keep the existing behavior: they fall back to the file path with the same explanatory reason.

Motivation

Automation that consumes attachments only through --inline — for example a confined agent that cannot read gog's 0600 output files directly — needs to pull attachments larger than 3 MiB without a separate file read. A fixed 3 MiB cap forces those callers to give up on anything bigger.

User-facing changes

  • New flag: --inline-max-bytes <bytes> on gmail attachment.
  • New env var: GOG_GMAIL_INLINE_MAX_BYTES.
  • Default is unchanged (3 MiB), so existing behavior is preserved unless the limit is raised.

Testing

  • go test ./internal/cmd/ — the oversized-fallback test now drives the boundary crossing through the flag (--inline-max-bytes) rather than a hardcoded constant.
  • make lint — 0 issues.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f2fd7be807

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Output OutputPathFlag `embed:""`
Name string `name:"name" help:"Filename (used when --out is empty or points to a directory)"`
Inline bool `name:"inline" help:"Also return the attachment content base64-encoded (contentBase64) in the response; attachments over the inline size limit fall back to the file path with an explanatory reason"`
InlineMaxBytes int `name:"inline-max-bytes" default:"3145728" help:"Maximum attachment size --inline embeds (bytes)" env:"GOG_GMAIL_INLINE_MAX_BYTES"`

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject negative inline size limits

When --inline-max-bytes or GOG_GMAIL_INLINE_MAX_BYTES is negative, every attachment exceeds the limit, so the command succeeds without contentBase64 and reports a nonsensical negative size limit. Validate this value before authentication or downloading so an invalid flag or environment setting produces a usage error instead of silently changing the response.

Useful? React with 👍 / 👎.

Output OutputPathFlag `embed:""`
Name string `name:"name" help:"Filename (used when --out is empty or points to a directory)"`
Inline bool `name:"inline" help:"Also return the attachment content base64-encoded (contentBase64) in the response; attachments over the inline size limit fall back to the file path with an explanatory reason"`
InlineMaxBytes int `name:"inline-max-bytes" default:"3145728" help:"Maximum attachment size --inline embeds (bytes)" env:"GOG_GMAIL_INLINE_MAX_BYTES"`

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Regenerate the command reference for the new flag

The generated docs/commands/gog-gmail-attachment.md flag table and the usage in docs/spec.md still omit --inline-max-bytes, leaving the repository's published command reference out of sync with the CLI and making this user-facing option undiscoverable there. Run the command-reference generator and update the usage specification as part of this change.

Useful? React with 👍 / 👎.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal priority bug or improvement with limited blast radius. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. labels Jul 29, 2026
@clawsweeper

clawsweeper Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 5:30 AM ET / 09:30 UTC.

ClawSweeper review

What this changes

Adds --inline-max-bytes and GOG_GMAIL_INLINE_MAX_BYTES so gog gmail attachment --inline can use a caller-selected base64 attachment limit while retaining the current 3 MiB default and path fallback.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This active PR remains necessary: current main still hard-codes the 3 MiB inline attachment cap. The final head preserves that default, resolves the earlier validation and documentation feedback, and has maintainer-provided runtime proof; no blocking patch defect was found.

Priority: P2
Reviewed head: 0335a9228904bfed0e13f8bf277eeb7dbf2477be

Review scores

Measure Result What it means
Overall readiness 🦞 diamond lobster (5/6) The focused patch preserves the default, incorporates the earlier review fixes, and has strong maintainer-provided CLI proof.
Proof confidence 🦞 diamond lobster (5/6) Sufficient (terminal): A collaborator reported a built-binary dry run showing inline_max_bytes: 42, plus focused command tests, a source-blind behavior contract, and full CI; this directly proves the newly observable credential-free runtime path.
Patch quality 🦞 diamond lobster (5/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Verified Sufficient (terminal): A collaborator reported a built-binary dry run showing inline_max_bytes: 42, plus focused command tests, a source-blind behavior contract, and full CI; this directly proves the newly observable credential-free runtime path.
Evidence reviewed 5 items Current-main gap: Current main still defines maxInlineAttachmentBytes = 3 << 20 and always passes that fixed value to the inline-content decision, so the requested configurable limit is not already implemented.
Implementation boundary: The PR head adds the flag and environment variable, rejects negative values before dry-run and authentication, reports the effective value in dry-run output, and applies it only when inline output is requested.
Regression coverage: The focused test drives an oversize fallback through the new flag, covers negative-value rejection, and verifies dry-run reports an explicit selected limit.
Findings None None.
Security None None.

How this fits together

The Gmail attachment command downloads an attachment to a local path and, when requested, adds a base64 copy to its structured output. This PR makes the size boundary for that optional inline payload configurable without changing ordinary attachment downloads.

flowchart LR
A[Gmail attachment request] --> B[Validate inline byte limit]
B --> C[Dry run or Gmail authentication]
C --> D[Fetch attachment]
D --> E[Write attachment file]
D --> F[Inline output requested]
F --> G[Base64 payload or fallback reason]
E --> H[Structured CLI response]
G --> H
Loading

Before merge

  • Resolve merge risk (P1) - An explicitly raised limit permits a larger base64 response and more caller-selected memory and output-consumer pressure; the preserved 3 MiB default and visible dry-run value make this an opt-in operational tradeoff.
  • Complete next step (P2) - This is an active PR with collaborator engagement, sufficient real behavior proof, and no actionable review finding; it is ready for normal maintainer landing review rather than automated repair.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Patch scope 43 added, 21 removed, 5 files affected The patch is limited to one Gmail command, focused tests, generated command documentation, specification text, and a release note.
Configuration surface 1 flag and 1 environment variable added Both inputs control the same optional inline-output decision while preserving the preexisting default.

Merge-risk options

Maintainer options:

  1. Land with the documented opt-in limit (recommended)
    Retain the 3 MiB default and inline_max_bytes dry-run disclosure so callers consciously select any larger output and memory boundary.

Technical review

Best possible solution:

Land the focused configuration support with the unchanged 3 MiB default, negative-value rejection, dry-run disclosure, documented command surface, and existing fallback-to-path behavior.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds an opt-in configuration capability rather than fixing a reported current-main failure. Its no-credential dry-run path is directly demonstrated by the maintainer-provided built-binary proof.

Is this the best way to solve the issue?

Yes. Applying a validated limit to the established inline fallback path is the narrowest maintainable solution: it preserves existing output by default and avoids a parallel attachment-delivery mode.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 455caec23623.

Labels

Label justifications:

  • P2: This is a bounded Gmail CLI enhancement with limited blast radius and no demonstrated regression for existing callers.
  • merge-risk: 🚨 availability: Opting into a higher inline limit can increase base64 response size and memory pressure for the invoking process and output consumer.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): A collaborator reported a built-binary dry run showing inline_max_bytes: 42, plus focused command tests, a source-blind behavior contract, and full CI; this directly proves the newly observable credential-free runtime path.
  • proof: sufficient: Contributor real behavior proof is sufficient. A collaborator reported a built-binary dry run showing inline_max_bytes: 42, plus focused command tests, a source-blind behavior contract, and full CI; this directly proves the newly observable credential-free runtime path.

Evidence

What I checked:

  • Current-main gap: Current main still defines maxInlineAttachmentBytes = 3 << 20 and always passes that fixed value to the inline-content decision, so the requested configurable limit is not already implemented. (internal/cmd/gmail_attachment.go:31, 455caec23623)
  • Implementation boundary: The PR head adds the flag and environment variable, rejects negative values before dry-run and authentication, reports the effective value in dry-run output, and applies it only when inline output is requested. (internal/cmd/gmail_attachment.go:27, 0335a9228904)
  • Regression coverage: The focused test drives an oversize fallback through the new flag, covers negative-value rejection, and verifies dry-run reports an explicit selected limit. (internal/cmd/execute_gmail_attachment_inline_test.go:99, 0335a9228904)
  • Maintainer validation and follow-up: A collaborator added the dry-run observability fix on the branch and reported a built-binary dry run with limit 42, focused command tests, a source-blind behavior contract, and a passing full CI run. (internal/cmd/gmail_attachment.go:79, 94a4431de1a3)
  • Feature-history routing: The current fixed-cap implementation traces to the v0.34.1 source snapshot; the same contributor later authored the PR-head dry-run and changelog follow-ups. (internal/cmd/gmail_attachment.go:31, 4747fb05a429)

Likely related people:

  • steipete: The current-main inline-cap code traces to Peter Steinberger's release snapshot, and he authored the PR-head dry-run observability and changelog follow-ups. (role: recent area contributor; confidence: high; commits: 4747fb05a429, 94a4431de1a3, 0335a9228904; files: internal/cmd/gmail_attachment.go, internal/cmd/execute_gmail_attachment_inline_test.go, CHANGELOG.md)

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (23 earlier review cycles; latest 8 shown)
  • reviewed 2026-08-01T11:54:17.908Z sha 08abe36 :: needs real behavior proof before merge. :: none
  • reviewed 2026-08-01T13:11:52.779Z sha 08abe36 :: needs real behavior proof before merge. :: none
  • reviewed 2026-08-01T14:52:41.382Z sha 08abe36 :: needs real behavior proof before merge. :: none
  • reviewed 2026-08-01T15:45:29.308Z sha 08abe36 :: needs real behavior proof before merge. :: none
  • reviewed 2026-08-02T02:41:14.339Z sha 08abe36 :: needs real behavior proof before merge. :: none
  • reviewed 2026-08-02T05:58:35.903Z sha 94a4431 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-02T07:13:55.561Z sha 94a4431 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-02T09:23:38.747Z sha c63f4fa :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. and removed merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. labels Jul 29, 2026
@ronny-rentner
ronny-rentner force-pushed the feat/gmail-inline-max-bytes branch from f2fd7be to 6f39a0d Compare August 1, 2026 05:20
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Aug 1, 2026
@steipete

steipete commented Aug 2, 2026

Copy link
Copy Markdown
Collaborator

Maintainer follow-up: I fixed the dry-run observability gap on the contributor branch in 94a4431.

gmail attachment --inline --inline-max-bytes N --dry-run now reports inline_max_bytes: N, so automation can audit the caller-selected output/memory boundary before authentication or download. The unchanged default (3145728), explicit values, changed values, and negative rejection are all covered.

Proof:

  • go test ./internal/cmd -run 'TestExecute_GmailAttachment_Inline' — pass
  • Built CLI with limit 42 — exit 0 and dry-run JSON reports inline_max_bytes: 42
  • Source-blind behavior contract — explicit 42, default 3145728, changed 17, and negative exit-2 clauses all pass
  • make ci — pass (format, lint, deadcode, all Go/Node tests, docs, generated skills)
  • Autoreview — clean, no accepted/actionable findings

My recommendation is LAND. The default remains byte-for-byte compatible, the configurable decision is entirely local after the normal Gmail attachment fetch, and the real binary now makes the new boundary inspectable without credentials.

@clawsweeper clawsweeper Bot added proof: sufficient Contributor real behavior proof is sufficient. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels Aug 2, 2026
@steipete
steipete merged commit c7d66df into openclaw:main Aug 2, 2026
7 checks passed
@ronny-rentner
ronny-rentner deleted the feat/gmail-inline-max-bytes branch August 6, 2026 13:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. P2 Normal priority bug or improvement with limited blast radius. proof: sufficient Contributor real behavior proof is sufficient. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants