Allow max-length on custom safe-output job inputs (SM-IS-01 10 KB cap cannot be raised) #69888

Problem

String inputs of custom safe-output jobs (safe-outputs.jobs.<name>.inputs) are always subject to the global SM-IS-01 cap of 10 KB (MAX_STRING_INPUT_BYTES in actions/setup/js/schema-validation.cjs). Built-in tools can opt out with an explicit schema maxLength. That was added for create_issue, create_discussion, update_issue and others in #43867, #44842 and #45787. Custom jobs cannot opt out: InputDefinition (pkg/types/input_definition.go) only supports description, required, default, type and options, so the generated tool schema never has a maxLength.

Impact

We use a custom safe-output job to receive a structured JSON analysis from the agent. The job then validates the analysis and runs deterministic scripts that create issues. As the payload grew, the call failed:

E006: Input string parameter(s) exceed maximum length for tool 'publish_run': 'analysis' exceeds maximum length of 10240 bytes (got 11678 bytes)

The agent then silently degraded its output to fit, cutting most of the useful content. Nothing failed, so the quality loss was hard to notice.

Our workaround is to set max: 20 on the job, have the agent split the JSON into chunks under 10 KB, and merge the chunks in the job. It works, but every custom job that carries structured data has to reimplement this.

Proposal

Support an optional max-length (characters, like the built-in exemptions) on custom job inputs. The compiler would emit it as maxLength in the dynamic tool schema, so the existing logic in validateStringInputLengths applies it instead of the 10 KB default:

safe-outputs:
  jobs:
    publish-run:
      inputs:
        analysis:
          type: string
          required: true
          max-length: 65000

The upper bound could match the built-in body fields (65000) so the payload stays bounded for sanitization and threat detection.

Environment

gh-aw v0.89.21, engine copilot.