Best possible solution:

Land one canonical fix that stages buffer-only sends through the shared outbound media store with existing byte caps and dry-run-safe behavior, then require redacted real runtime or channel proof before merging whichever PR maintainers choose.

Do we have a high-confidence way to reproduce the issue?

Yes by source inspection: current main exposes buffer input in the message tool schema, but normal send payload assembly only recognizes explicit media/path/mediaUrls hints. I did not run a live reproduction because this review is read-only.

Is this the best way to solve the issue?

No as submitted. Buffer-to-media staging is the right boundary, but this implementation needs valid media-core imports, shared media-store byte limits, dry-run-safe behavior, and real runtime/channel proof.

Full review comments:

• [P1] Fix the unresolved media helper imports — src/infra/outbound/message-action-runner.ts:39-43
  The new imports point at ../../media/base64.js, ../../media/file-name.js, and ../../media/mime.js, but those modules do not exist under src/media on current main. Neighboring code imports these helpers from @openclaw/media-core/*, so this patch will fail module resolution before message.send can run.
  Confidence: 0.95
• [P1] Bound staged buffer writes before decoding to disk — src/infra/outbound/message-action-runner.ts:517
buffer is tool/model input, but the new helper decodes it and writes it directly to a temp file without using the existing outbound media byte cap. A large base64 payload can allocate and persist unbounded data before the normal media loading limits have a chance to protect the send path.
  Confidence: 0.9
• [P2] Preserve no-write dry runs for buffer sends — src/infra/outbound/message-action-runner.ts:986-989
buildSendPayloadParts also runs for dry-run sends, and this new call materializes the buffer before dispatch. That makes a preview-only message.send create media files; gate staging on real sends or add a dry-run validation path that does not write to disk.
  Confidence: 0.84

Overall correctness: patch is incorrect
Overall confidence: 0.91

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against b1e4b6b65e2c.

Label changes:

• add P2: This is a focused outbound message-delivery bug fix with blocking implementation issues but no evidence of a core-wide outage.
• add merge-risk: 🚨 message-delivery: The patch changes the generic message.send attachment path and could still fail to deliver or preview attachments correctly without byte-cap and dry-run fixes.
• add merge-risk: 🚨 availability: The diff can break the build immediately and, after import repair, can write unbounded decoded buffers to disk before delivery.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body contains only a summary and a regression test claim; it does not include after-fix real runtime/channel proof for this external PR. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a focused outbound message-delivery bug fix with blocking implementation issues but no evidence of a core-wide outage.
• merge-risk: 🚨 availability: The diff can break the build immediately and, after import repair, can write unbounded decoded buffers to disk before delivery.
• merge-risk: 🚨 message-delivery: The patch changes the generic message.send attachment path and could still fail to deliver or preview attachments correctly without byte-cap and dry-run fixes.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body contains only a summary and a regression test claim; it does not include after-fix real runtime/channel proof for this external PR. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

PR surface:

Source +56, Tests +34. Total +90 across 2 files.

Security concerns:

• [medium] Unbounded buffer materialization — src/infra/outbound/message-action-runner.ts:517
  The new helper writes decoded buffer content to disk without enforcing MEDIA_MAX_BYTES or the channel/account media cap first, creating a resource-exhaustion path for large tool input.
  Confidence: 0.88

What I checked:

• Repository policy read: Root AGENTS.md and the scoped outbound guide were read; the outbound guide requires focused media/action tests and keeping standard send params from unnecessary discovery. (AGENTS.md:1, b1e4b6b65e2c)
• Scoped outbound policy read: The scoped outbound guide applies to both touched files and asks reviews to keep outbound tests narrow and verify shared helper changes with the closest media/action contract tests. (src/infra/outbound/AGENTS.md:1, b1e4b6b65e2c)
• PR patch evidence: The PR adds materializeBufferBackedSendMedia and imports helpers from ../../media/base64.js, ../../media/file-name.js, and ../../media/mime.js. (src/infra/outbound/message-action-runner.ts:39, 35ffe62ef06c)
• Missing import targets: Current main has the media-core helper files under packages/media-core/src/**; there are no matching src/media/base64.ts, src/media/file-name.ts, or src/media/mime.ts files for the PR's relative imports. (b1e4b6b65e2c)
• Current send schema exposes buffer: The existing message tool schema already exposes buffer, filename, contentType, and mimeType, so the requested fix is a bug fix to an existing surface rather than a new feature. (src/agents/tools/message-tool.ts:457, b1e4b6b65e2c)
• Current main source reproduction: buildSendPayloadParts collects explicit media/path/mediaUrls and structured attachment path hints, but it does not convert top-level buffer-only send params into a deliverable media path. (src/infra/outbound/message-action-runner.ts:937, b1e4b6b65e2c)

Likely related people:

• Ayaan Zaidi: Current blame for buildSendPayloadParts, collectActionMediaSourceHints, and the message-tool buffer schema points to commit 85343ea on main. (role: current implementation author; confidence: medium; commits: 85343ea54608; files: src/infra/outbound/message-action-runner.ts, src/infra/outbound/message-action-params.ts, src/agents/tools/message-tool.ts)
• Peter Steinberger: Recent history for the outbound/media access path includes commit 43ef8a5 centralizing outbound access plumbing, which is adjacent to the mediaAccess contract this fix must preserve. (role: adjacent media access refactor author; confidence: medium; commits: 43ef8a5a8657; files: src/infra/outbound/message-action-runner.ts, src/infra/outbound/outbound-send-service.ts, src/media/read-capability.ts)
• Agustin Rivera: Commit c949af9 changed host media sender policy in the same media read-capability path that staged send media must respect. (role: adjacent policy contributor; confidence: medium; commits: c949af9fabf3; files: src/media/read-capability.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.