Bug type

Crash (gateway returns INVALID_REQUEST, WebSocket disconnects)

Beta release blocker

No

Summary

Sending a photo from a mobile browser (iOS Safari) via the webchat UI causes a hard crash on chat.send with RangeError: Maximum call stack size exceeded. The error originates inside isValidBase64() in attachment-normalize-B8Ooqwet.js when running RegExp.test() against a large base64-encoded image payload (iPhone JPEG, ~3–5MB raw → ~4–7MB base64). The gateway returns INVALID_REQUEST and the WebSocket disconnects with code 1006.

A secondary error also surfaces in the same pipeline when sharp is not installed: Error: Optional dependency sharp is required for image attachment processing. Both errors originate from the same attachment normalization code path.

Steps to reproduce

1. Open the OpenClaw webchat in a mobile browser (tested: iOS Safari)
2. Tap the attachment button and select a photo from your camera roll (standard iPhone JPEG)
3. Send the message

Result: WebSocket disconnects immediately, client shows RangeError: Maximum call stack size exceeded

Expected: Image is staged and delivered to the agent normally

OpenClaw version

2026.5.7 (eeef486)

Operating system

Ubuntu 24.04 LTS — kernel 6.8.0-88-generic x86_64

Install method

npm global (fnm-managed Node 22.22.2)

Logs and evidence

Gateway log (exact):

ERROR chat.send attachment parse/stage failed
RangeError: Maximum call stack size exceeded
    at RegExp.test (<anonymous>)
    at isValidBase64 (attachment-normalize-B8Ooqwet.js:43:34)
    at parseMessageWithAttachments (attachment-normalize-B8Ooqwet.js:108:9)
    at async chat.send (chat-3xUbD00m.js:1716:20)
    at async handleGatewayRequest (server-methods-DStUV8Sh.js:11785:2)
    at async message-handler-Cc2t2lqw.js:1458:5

⇄ res ✗ chat.send 180ms errorCode=INVALID_REQUEST errorMessage=RangeError: Maximum call stack size exceeded
webchat disconnected code=1006 reason=n/a

This error fires twice per send attempt — once before offload staging and once after — indicating isValidBase64 runs at multiple points in the attachment pipeline.

Secondary error (same pipeline, sharp not installed):

Error: Optional dependency sharp is required for image attachment processing

Root cause analysis

isValidBase64() at line 43 of attachment-normalize-B8Ooqwet.js calls RegExp.test() against the full raw base64 string of the image. For large payloads (multi-MB iPhone JPEGs), V8's regex engine hits its internal recursion limit, throwing RangeError: Maximum call stack size exceeded.

This is a known V8 behavior: certain regex patterns applied to strings in the multi-megabyte range can exhaust the engine's recursion stack. The validation just needs to be size-aware.

Suggested fix

Option A — Skip regex validation above a size threshold (least invasive):

function isValidBase64(str) {
  // Regex-based validation is unsafe for large payloads in V8.
  // Skip full validation for strings over 1MB — trust the data URL prefix instead.
  if (str.length > 1_000_000) return true;
  return /^[A-Za-z0-9+/]+=*$/.test(str);
}

Option B — Node built-in round-trip check (most correct, zero regex):

function isValidBase64(str) {
  try {
    return Buffer.from(str, 'base64').toString('base64') === str.replace(/\s/g, '');
  } catch {
    return false;
  }
}

Option C — Validate a prefix sample only (fast and safe):

function isValidBase64(str) {
  const sample = str.slice(0, 1024);
  return /^[A-Za-z0-9+/\s]+=*$/.test(sample);
}

Option B is the most correct. Option A is the least invasive patch.

Secondary issue: sharp listed as optional but required

The attachment pipeline emits Error: Optional dependency sharp is required for image attachment processing. If sharp is truly optional, the pipeline should degrade gracefully rather than hard-error. If it is actually required for image attachments, it should be a proper dependency in package.json so it installs by default.

Impact and severity

• Affected: Any user sending images from a mobile browser via webchat (confirmed on iOS Safari with standard iPhone JPEG)
• Severity: High — complete failure of image attachment from mobile; gateway returns INVALID_REQUEST and drops the WebSocket connection
• Frequency: Always — 100% reproducible with an iPhone photo
• Consequence: Mobile users cannot send any image attachments via webchat

Workaround

Text-only messages work fine. Do not attach images from a mobile browser until patched. Desktop browsers are unaffected.

Additional information

Related prior issue filed by same reporter: #72366 (Bonjour crash-loop on startup)