fix(cli): validate uploads and align dry-run destinations

[altaywtf]

Problem

The CLI accepts oversized or unsupported upload files locally, reads them without a bound, and leaves rejection to the server. Dry-run can also report a different service than execution when credentials name a custom endpoint.

Solution

Check regular-file size, cap reads even when a file grows, and reuse the shared content validator before sending. Resolve the destination once for dry-run and execution, preserving the service binding of saved credentials.

Proof

Twelve regression cases failed before the fix; all 71 CLI tests pass afterward. A copied standalone CLI bundle also passed synthetic size/content and custom-destination cases with fetch intercepted. The full repository gate passed, and Astra/medium slopguard found no issues.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

🟢 Approval recommended

The changes are well-covered by new regression tests and the updated CLI logic appears consistent and correctly integrated with existing error handling paths.

Pull request overview

This PR hardens the CLI upload path by adding local preflight validation (size bounds, regular-file checks, and shared content sniffing) and ensuring dry-run reports the same destination that real execution will use when credentials are bound to a custom endpoint.

Changes:

• Add CLI-side upload preflight: reject directories/empty files/oversized files, cap reads even if the file grows, and validate content via @uinaf/attach-shared.
• Unify destination resolution for both dry-run and real put/delete using an effective API base derived from saved credentials.
• Add/adjust CLI tests to cover growth-after-stat, unsupported content, boundary sizes, and destination parity.

File summaries

File	Description
apps/cli/src/attach.ts	Adds bounded file reads + shared content validation, and aligns dry-run vs execution destinations via an effective API base.
apps/cli/test/preflight.test.ts	Adds regression coverage for local preflight rejection cases and for destination parity across dry-run and real requests.
apps/cli/test/help.test.ts	Updates the dry-run PNG fixture to use a full PNG signature so it passes content validation.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.