charisma-cli 0.5.0__tar.gz → 0.5.2__tar.gz

{charisma_cli-0.5.0 → charisma_cli-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: charisma-cli
-Version: 0.5.0
+Version: 0.5.2
 Summary: CLI tool that watches allure-results and streams test results + attachments to Charisma.
 Author: Charisma Team
 License-Expression: MIT

{charisma_cli-0.5.0 → charisma_cli-0.5.2}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "charisma-cli"
-version = "0.5.0"
+version = "0.5.2"
 description = "CLI tool that watches allure-results and streams test results + attachments to Charisma."
 readme = "README.md"
 license = "MIT"

{charisma_cli-0.5.0 → charisma_cli-0.5.2}/src/charisma_cli/__init__.py

@@ -4,4 +4,4 @@
 # is generated from pyproject.toml [project].version, so keeping this literal
 # equal to pyproject guarantees `--version` reports the published version. The
 # prepare-commit step owns the PATCH bump — do not hand-bump here.
-__version__ = "0.5.0"
+__version__ = "0.5.2"

{charisma_cli-0.5.0 → charisma_cli-0.5.2}/src/charisma_cli/read_client.py

@@ -296,6 +296,7 @@ class CharismaReadClient:
         build_id: str | None = None,
         commit_sha: str | None = None,
         source_url: str | None = None,
+        component_id: str | None = None,
         started_at_from: str | None = None,
         started_at_to: str | None = None,
     ) -> PaginatedLaunchList:
@@ -317,6 +318,11 @@ class CharismaReadClient:
             build_id: Optional build id filter (wire name ``buildId``).
             commit_sha: Optional commit SHA filter (wire name ``commitSha``).
             source_url: Optional source URL filter (wire name ``sourceUrl``).
+            component_id: Optional component UUID filter (wire name ``componentId``).
+                Matches a launch by its primary component, its component set, or a
+                build-plan-linked component. The sentinel ``"_unassigned"`` selects
+                launches with no component. A non-UUID value (other than the
+                sentinel) makes the server reject the request with HTTP 400.
             started_at_from: Optional lower bound on ``startedAt`` (wire name ``startedAtFrom``).
             started_at_to: Optional upper bound on ``startedAt`` (wire name ``startedAtTo``).
 
@@ -336,6 +342,7 @@ class CharismaReadClient:
             "buildId": build_id,
             "commitSha": commit_sha,
             "sourceUrl": source_url,
+            "componentId": component_id,
             "startedAtFrom": started_at_from,
             "startedAtTo": started_at_to,
         }

{charisma_cli-0.5.0 → charisma_cli-0.5.2}/src/charisma_cli/uploader.py

@@ -2,8 +2,11 @@
 
 import json
 import logging
+import mimetypes
+import os
 import threading
 import time
+from collections.abc import Callable
 from pathlib import Path
 from queue import Empty, PriorityQueue
 from typing import Any
@@ -40,6 +43,45 @@ _CONTAINER_ASSOCIATION_TIMEOUT = 60.0
 # attachment: enough for an at-a-glance cause without approaching the field cap.
 _SPILL_INLINE_HEAD_BYTES = 2 * 1024
 
+# Attachment-transport routing threshold (NOT a truncation threshold). An
+# attachment whose content is at or below this size is sent via the existing
+# API-Gateway multipart route (cheap single request). Anything larger is routed
+# to the presigned-S3 path (presign -> PUT direct to S3 -> complete), so the
+# byte transport bypasses API Gateway's hard ~10MB REST payload ceiling
+# (effectively ~7.5MB after base64 + multipart envelope) and is bounded only by
+# S3 / the backend's single-attachment domain policy. 5MB is a conservative
+# floor well under that ceiling, leaving slack for base64 inflation (4/3) and
+# the multipart envelope. Env-overridable (CHARISMA_ATTACHMENT_APIGW_SAFE_BYTES)
+# for tuning without a code change; a non-positive / unparseable value falls
+# back to the 5MB default.
+_DEFAULT_ATTACHMENT_APIGW_SAFE_BYTES = 5 * 1024 * 1024
+
+
+def _resolve_apigw_safe_bytes() -> int:
+    """Resolve the API-GW attachment routing threshold from env, with a safe default.
+
+    Reads ``CHARISMA_ATTACHMENT_APIGW_SAFE_BYTES`` (bytes). A missing, empty,
+    unparseable, or non-positive value falls back to the 5MB default so the
+    threshold is always a sane positive size.
+
+    Returns:
+        The routing threshold in bytes.
+    """
+    raw = os.getenv("CHARISMA_ATTACHMENT_APIGW_SAFE_BYTES", "").strip()
+    if not raw:
+        return _DEFAULT_ATTACHMENT_APIGW_SAFE_BYTES
+    try:
+        value = int(raw)
+    except ValueError:
+        return _DEFAULT_ATTACHMENT_APIGW_SAFE_BYTES
+    return value if value > 0 else _DEFAULT_ATTACHMENT_APIGW_SAFE_BYTES
+
+
+# text/plain is the content type for spilled error_message / stack_trace fields
+# (safe_attachment_filename always yields a ``*.txt`` name). Fixed once so the
+# presign-signed Content-Type and the PUT Content-Type match byte-for-byte.
+_SPILL_CONTENT_TYPE = "text/plain; charset=utf-8"
+
 # Sentinel expectedTests for CLI launches: the total count is unknown at open
 # time (directory-watch streaming), so we send the backend maximum. This keeps
 # the launch in 'receiving' across all appends; close_launch() finalizes it.
@@ -112,6 +154,10 @@ class Uploader:
         # avoiding the 404 an early upload would hit (attachments are validated
         # against a stored test_results.id).
         self._pending_spills: list[tuple[str, bytes, str]] = []
+        # Attachment-transport routing threshold (bytes). Content at or below
+        # this goes via the API-GW multipart route; larger content goes via the
+        # presigned-S3 route. Resolved once (env-overridable) at construction.
+        self._attachment_apigw_safe_bytes = _resolve_apigw_safe_bytes()
 
     @property
     def summary(self) -> UploadSummary:
@@ -740,31 +786,65 @@ class Uploader:
             return
 
         # The no-open-launch guard lives in _post_attachment (single owner).
-        self._post_attachment(path.name, content, result_id)
-
-    def _post_attachment(self, filename: str, content: bytes, result_id: str) -> None:
-        """POST attachment bytes to the Charisma attachment API with retry.
-
-        Shared HTTP core for both file-backed attachments (``_upload_attachment``)
-        and in-memory field spills (``_flush_pending_spills``). ``result_id`` is
-        the backend-assigned ``test_results.id`` from the append-results response
-        (ADR-031), sent as the ``resultId`` form field and matched exactly by the
-        backend. Transient failures (5xx, 429, connect/timeout) are retried with
-        exponential backoff; terminal failures count the attachment skipped and
-        log at WARNING (a silent DEBUG-only skip is what hid the original
-        attachments-skipped bug).
+        # Coerce the content type to a concrete MIME string ONCE here (never
+        # None): guess_type returns None for an unrecognized extension, and None
+        # cannot be signed/sent as a Content-Type on the presigned-S3 path (it
+        # would diverge from the signature). Same fallback the backend's own
+        # handle_upload_attachment uses.
+        content_type = mimetypes.guess_type(path.name)[0] or "application/octet-stream"
+        self._post_attachment(path.name, content, result_id, content_type)
+
+    def _post_attachment(
+        self, filename: str, content: bytes, result_id: str, content_type: str
+    ) -> None:
+        """POST attachment bytes to Charisma, routing by size.
+
+        Shared entry point for both file-backed attachments (``_upload_attachment``)
+        and in-memory field spills (``_flush_pending_spills``). Content at or below
+        the API-GW routing threshold is sent via the multipart API-GW route
+        (``_post_attachment_apigw`` — unchanged behavior for today's normal case).
+        Larger content is routed to the presigned-S3 path
+        (``_post_attachment_via_s3``) so its byte transport bypasses the API
+        Gateway payload ceiling and is bounded only by S3 / the backend's
+        single-attachment domain policy.
+
+        ``result_id`` is the backend-assigned ``test_results.id`` from the
+        append-results response (ADR-031), matched exactly by the backend.
+        ``content_type`` is the already-coerced concrete MIME string (never None),
+        fixed by the caller so the presign-signed and PUT Content-Type match.
 
         Args:
-            filename: Attachment filename sent in the multipart body.
+            filename: Attachment filename.
             content: Raw attachment bytes.
-            result_id: Backend-assigned ``test_results.id`` for the owning result
-                (from the append-results response), sent as ``resultId``.
+            result_id: Backend-assigned ``test_results.id`` for the owning result.
+            content_type: Concrete MIME type (never None).
         """
         if self._client is None or not self._launch_id:
             self._summary.attachments_skipped += 1
             logger.warning("Cannot upload attachment %s: no open launch", filename)
             return
 
+        if len(content) > self._attachment_apigw_safe_bytes:
+            self._post_attachment_via_s3(filename, content, result_id, content_type)
+        else:
+            self._post_attachment_apigw(filename, content, result_id)
+
+    def _post_attachment_apigw(self, filename: str, content: bytes, result_id: str) -> None:
+        """POST attachment bytes via the API-Gateway multipart route, with retry.
+
+        The original (and still default, for content at or below the routing
+        threshold) attachment transport: a single multipart request to
+        ``/api/v1/launches/{launchId}/attachments``. Transient failures (5xx,
+        429, connect/timeout) are retried with exponential backoff; terminal
+        failures count the attachment skipped and log at WARNING (a silent
+        DEBUG-only skip is what hid the original attachments-skipped bug).
+
+        Args:
+            filename: Attachment filename sent in the multipart body.
+            content: Raw attachment bytes.
+            result_id: Backend-assigned ``test_results.id`` for the owning result
+                (from the append-results response), sent as ``resultId``.
+        """
         files = {"file": (filename, content)}
         data = {"name": filename, "resultId": result_id}
 
@@ -807,6 +887,172 @@ class Uploader:
                 logger.warning("Attachment upload unexpected error for %s", filename, exc_info=True)
                 return
 
+    def _request_with_retry(
+        self,
+        describe: str,
+        filename: str,
+        send: Callable[[], httpx.Response],
+    ) -> httpx.Response | None:
+        """Run one attachment-step request with the shared retry policy.
+
+        Centralizes the retry/backoff/terminal-skip contract used by every step
+        of the presigned-S3 path (presign, PUT, complete) so the three steps
+        cannot drift from each other or from the API-GW route. ``send`` performs
+        a single HTTP attempt and returns its ``httpx.Response``. Transient
+        failures (status in ``RETRYABLE_STATUS_CODES``, or ``ConnectError`` /
+        ``TimeoutException``) are retried with exponential backoff; on a terminal
+        outcome the attachment is counted skipped, a WARNING is logged, and
+        ``None`` is returned so the caller aborts the remaining steps.
+
+        Args:
+            describe: Short step label for the WARNING message (e.g. "presign").
+            filename: Attachment filename, for the WARNING message.
+            send: Zero-arg callable performing one HTTP attempt.
+
+        Returns:
+            The successful ``httpx.Response`` (status not retryable and not an
+            error the caller rejects), or ``None`` when the step terminally
+            failed (already counted skipped + logged).
+        """
+        for attempt in range(MAX_RETRIES + 1):
+            try:
+                response = send()
+                if response.status_code in RETRYABLE_STATUS_CODES and attempt < MAX_RETRIES:
+                    time.sleep(exponential_backoff(attempt))
+                    continue
+                return response
+            except (httpx.ConnectError, httpx.TimeoutException) as e:
+                if attempt < MAX_RETRIES:
+                    time.sleep(exponential_backoff(attempt))
+                    continue
+                self._summary.attachments_skipped += 1
+                logger.warning(
+                    "Attachment %s step failed after %d retries: %s for %s",
+                    describe,
+                    MAX_RETRIES,
+                    e,
+                    filename,
+                )
+                return None
+        return None
+
+    def _post_attachment_via_s3(
+        self, filename: str, content: bytes, result_id: str, content_type: str
+    ) -> None:
+        """Upload a large attachment via presign -> direct S3 PUT -> complete.
+
+        Used for content larger than the API-GW routing threshold. The bytes go
+        straight to S3 over a presigned PUT, bypassing API Gateway's payload
+        ceiling; only two small JSON requests (presign, complete) traverse the
+        API. This is the path that makes the attachment size bounded by S3 /
+        the backend single-attachment policy rather than by API Gateway.
+
+        Contract matched to ``_post_attachment_apigw``: a fully successful
+        round-trip increments ``attachments_sent``; any terminal step failure
+        increments ``attachments_skipped`` (once) with a WARNING. Each step uses
+        the shared retry/backoff policy.
+
+        Two hard requirements on the S3 PUT (see design):
+        - The PUT ``Content-Type`` header equals ``content_type`` byte-for-byte
+          (the string the backend signed into the URL), else S3 returns 403
+          SignatureDoesNotMatch.
+        - The PUT goes through a SEPARATE httpx client with NO ``Authorization``
+          header. ``self._client`` carries a client-level Bearer that httpx
+          merges into every request (a per-request override does not remove it),
+          which must never be sent to S3 — the presigned URL is self-authorizing.
+
+        Args:
+            filename: Attachment filename.
+            content: Raw attachment bytes.
+            result_id: Backend-assigned ``test_results.id`` for the owning result.
+            content_type: Concrete MIME type, signed into the presigned URL and
+                echoed verbatim on the PUT and complete steps.
+        """
+        presign_body = {
+            "resultId": result_id,
+            "name": filename,
+            "contentType": content_type,
+            "size": len(content),
+        }
+        presign_resp = self._request_with_retry(
+            "presign",
+            filename,
+            lambda: self._client.post(
+                f"/api/v1/launches/{self._launch_id}/attachments/presign",
+                json=presign_body,
+            ),
+        )
+        if presign_resp is None:
+            return
+        if presign_resp.status_code != 201:
+            self._summary.attachments_skipped += 1
+            logger.warning(
+                "Attachment presign failed: HTTP %d for %s",
+                presign_resp.status_code,
+                filename,
+            )
+            return
+
+        try:
+            presign_data = presign_resp.json()
+            upload_url = presign_data["uploadUrl"]
+            attachment_id = presign_data["attachmentId"]
+            s3_key = presign_data["s3Key"]
+        except (ValueError, json.JSONDecodeError, KeyError, TypeError):
+            self._summary.attachments_skipped += 1
+            logger.warning("Attachment presign returned a malformed body for %s", filename)
+            return
+
+        # Direct S3 PUT: separate client, NO Authorization, Content-Type must
+        # match the signed value exactly.
+        put_resp = self._request_with_retry(
+            "S3 PUT",
+            filename,
+            lambda: httpx.put(
+                upload_url,
+                content=content,
+                headers={"Content-Type": content_type},
+                timeout=60.0,
+            ),
+        )
+        if put_resp is None:
+            return
+        if put_resp.status_code not in (200, 201):
+            self._summary.attachments_skipped += 1
+            logger.warning(
+                "Attachment S3 PUT failed: HTTP %d for %s",
+                put_resp.status_code,
+                filename,
+            )
+            return
+
+        complete_body = {
+            "attachmentId": attachment_id,
+            "resultId": result_id,
+            "name": filename,
+            "contentType": content_type,
+            "s3Key": s3_key,
+        }
+        complete_resp = self._request_with_retry(
+            "complete",
+            filename,
+            lambda: self._client.post(
+                f"/api/v1/launches/{self._launch_id}/attachments/complete",
+                json=complete_body,
+            ),
+        )
+        if complete_resp is None:
+            return
+        if complete_resp.status_code == 201:
+            self._summary.attachments_sent += 1
+            return
+        self._summary.attachments_skipped += 1
+        logger.warning(
+            "Attachment complete failed: HTTP %d for %s",
+            complete_resp.status_code,
+            filename,
+        )
+
     def _flush_pending_spills(self) -> None:
         """Upload buffered oversized-field spills after results are persisted.
 
@@ -830,7 +1076,7 @@ class Uploader:
                     history_id,
                 )
                 continue
-            self._post_attachment(filename, content, result_id)
+            self._post_attachment(filename, content, result_id, _SPILL_CONTENT_TYPE)
 
     def _try_associate_containers(self) -> None:
         """Try to associate buffered containers with known results."""

{charisma_cli-0.5.0 → charisma_cli-0.5.2}/tests/test_read_client_launches.py

@@ -5,8 +5,9 @@ contract (per design.md "Client" + "Path & transport", requirements.md FR-2, and
 contract in `.agents/tasks/charisma-cli-read-endpoint-contracts.md`):
 
 - ``list_launches`` → ``GET /api/v1/projects/{pid}/launches`` with camelCase query params. Forwards
-  ALL 9 exact-match filters with their camelCase wire names (``name, status, branch, environment,
-  buildId, commitSha, sourceUrl, startedAtFrom, startedAtTo``) plus ``offset``/``limit``. Exposes
+  ALL exact-match filters with their camelCase wire names (``name, status, branch, environment,
+  buildId, commitSha, sourceUrl, componentId, startedAtFrom, startedAtTo``) plus ``offset``/``limit``.
+  Exposes
   NO ``sortBy``/``sortOrder`` param — the server sort is FIXED newest-first. ``None``-valued filters
   are omitted from the query (not sent as empty). Returns the ``{items, total}`` envelope verbatim
   (camelCase ``BaseLaunch`` items).
@@ -230,7 +231,7 @@ class TestListLaunchesFiltersForwarded:
     """ALL 9 exact-match filters are forwarded with the correct camelCase wire names."""
 
     @respx.mock
-    def test_all_nine_filters_forwarded_with_camelcase_wire_names(self) -> None:
+    def test_all_filters_forwarded_with_camelcase_wire_names(self) -> None:
         """Every filter maps to its camelCase query key with the provided value."""
         route = respx.get(LAUNCHES_URL).mock(
             return_value=httpx.Response(200, json=LAUNCHES_ENVELOPE)
@@ -244,6 +245,7 @@ class TestListLaunchesFiltersForwarded:
             build_id="build-4823",
             commit_sha="a1b2c3d4",
             source_url="https://ci.example.com/build/4823",
+            component_id="22222222-2222-2222-2222-222222222222",
             started_at_from="2026-06-01T00:00:00+00:00",
             started_at_to="2026-06-30T23:59:59+00:00",
         )
@@ -255,6 +257,7 @@ class TestListLaunchesFiltersForwarded:
         assert params["buildId"] == "build-4823"
         assert params["commitSha"] == "a1b2c3d4"
         assert params["sourceUrl"] == "https://ci.example.com/build/4823"
+        assert params["componentId"] == "22222222-2222-2222-2222-222222222222"
         assert params["startedAtFrom"] == "2026-06-01T00:00:00+00:00"
         assert params["startedAtTo"] == "2026-06-30T23:59:59+00:00"
 
@@ -269,6 +272,7 @@ class TestListLaunchesFiltersForwarded:
             build_id="build-4823",
             commit_sha="a1b2c3d4",
             source_url="https://ci.example.com/build/4823",
+            component_id="22222222-2222-2222-2222-222222222222",
             started_at_from="2026-06-01T00:00:00+00:00",
             started_at_to="2026-06-30T23:59:59+00:00",
         )
@@ -277,6 +281,7 @@ class TestListLaunchesFiltersForwarded:
             "build_id",
             "commit_sha",
             "source_url",
+            "component_id",
             "started_at_from",
             "started_at_to",
         ):
@@ -299,6 +304,7 @@ class TestListLaunchesFiltersForwarded:
             "buildId",
             "commitSha",
             "sourceUrl",
+            "componentId",
             "startedAtFrom",
             "startedAtTo",
         ):

{charisma_cli-0.5.0 → charisma_cli-0.5.2}/tests/test_uploader.py

@@ -1349,3 +1349,431 @@ class TestUploaderDrainProgressBased:
         assert fully_drained is False, (
             "drain reported success despite a stalled consumer with items queued"
         )
+
+
+class TestAttachmentTransportRouting:
+    """Attachments route by size: small -> API-GW multipart, large -> presigned S3.
+
+    The oversized-field overflow fix: a result field (error_message / stack_trace)
+    too large to carry inline is already spilled to an attachment, but that spill
+    (and any file attachment) larger than the API-Gateway payload ceiling (~7.5MB
+    effective) used to 413 on the multipart route and be lost. Content above the
+    routing threshold is now uploaded straight to S3 over a presigned PUT
+    (presign -> PUT -> complete), bypassing API Gateway so the size is bounded by
+    S3 / the backend single-attachment policy, not by API Gateway.
+
+    These tests drive the uploader with a small threshold (set via env, resolved
+    at construction) so the large-content path is exercised without allocating
+    7.5MB+ buffers, plus one true >10MB end-to-end case for the acceptance
+    criterion.
+    """
+
+    LAUNCH = "launch-1"
+    PRESIGN_URL = f"https://charisma.test/api/v1/launches/{LAUNCH}/attachments/presign"
+    COMPLETE_URL = f"https://charisma.test/api/v1/launches/{LAUNCH}/attachments/complete"
+    APIGW_URL = f"https://charisma.test/api/v1/launches/{LAUNCH}/attachments"
+    RESULTS_URL = f"https://charisma.test/api/v1/launches/{LAUNCH}/results"
+    S3_PUT_URL = "https://s3.amazonaws.com/charisma-bucket/attachments/p/l/r/obj.txt?sig=abc"
+
+    def _write_json(self, path: Path, data: dict) -> None:
+        import json
+        path.write_text(json.dumps(data), encoding="utf-8")
+
+    def _config_with_threshold(self, monkeypatch, threshold_bytes: int) -> Config:
+        """Build a config and set the env-driven routing threshold.
+
+        The threshold is read at Uploader construction, so the env var must be
+        set before the Uploader is created.
+        """
+        monkeypatch.setenv(
+            "CHARISMA_ATTACHMENT_APIGW_SAFE_BYTES", str(threshold_bytes)
+        )
+        return _make_config()
+
+    def _presign_response(self) -> httpx.Response:
+        return httpx.Response(
+            201,
+            json={
+                "uploadUrl": self.S3_PUT_URL,
+                "attachmentId": "att-presigned-1",
+                "s3Key": "attachments/p/l/r/obj.txt",
+            },
+        )
+
+    def _no_backoff(self, monkeypatch) -> None:
+        monkeypatch.setattr("charisma_cli.uploader.exponential_backoff", lambda attempt: 0.0)
+
+    @respx.mock
+    def test_small_attachment_uses_apigw_route(self, tmp_path: Path, monkeypatch) -> None:
+        """Content at/below the threshold takes the unchanged API-GW multipart route."""
+        config = self._config_with_threshold(monkeypatch, threshold_bytes=1024)
+        queue: PriorityQueue = PriorityQueue()
+
+        respx.post(self.RESULTS_URL).mock(
+            return_value=httpx.Response(200, json={
+                "accepted": 1,
+                "results": [{"testId": "hist-s", "resultId": "rid-s"}],
+            })
+        )
+        apigw_route = respx.post(self.APIGW_URL).mock(
+            return_value=httpx.Response(201, json={"id": "att-apigw"})
+        )
+        presign_route = respx.post(self.PRESIGN_URL).mock(
+            return_value=self._presign_response()
+        )
+
+        result_file = tmp_path / "s-result.json"
+        self._write_json(result_file, {
+            "uuid": "s", "historyId": "hist-s", "fullName": "t.s",
+            "status": "passed", "start": 1000, "stop": 2000,
+            "attachments": [{"source": "small.png", "name": "small", "type": "image/png"}],
+        })
+        attach_file = tmp_path / "small.png"
+        attach_file.write_bytes(b"x" * 512)  # below 1024 threshold
+
+        uploader = Uploader(config, queue)
+        uploader._launch_id = self.LAUNCH
+        queue.put(FileEvent(path=result_file, category=FileCategory.RESULT))
+        queue.put(FileEvent(path=attach_file, category=FileCategory.ATTACHMENT))
+
+        uploader.start()
+        uploader.drain(timeout=5.0)
+        uploader.stop()
+
+        assert uploader.summary.attachments_sent == 1
+        assert apigw_route.called
+        assert not presign_route.called, "small attachment must NOT use the S3 path"
+
+    @respx.mock
+    def test_large_attachment_uses_presigned_s3_route_in_order(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        """Content above the threshold goes presign -> PUT S3 -> complete, in order."""
+        self._no_backoff(monkeypatch)
+        config = self._config_with_threshold(monkeypatch, threshold_bytes=1024)
+        queue: PriorityQueue = PriorityQueue()
+
+        call_order: list[str] = []
+
+        respx.post(self.RESULTS_URL).mock(
+            return_value=httpx.Response(200, json={
+                "accepted": 1,
+                "results": [{"testId": "hist-l", "resultId": "rid-l"}],
+            })
+        )
+
+        def _presign(request: httpx.Request) -> httpx.Response:
+            call_order.append("presign")
+            return self._presign_response()
+
+        def _put(request: httpx.Request) -> httpx.Response:
+            call_order.append("put")
+            return httpx.Response(200)
+
+        def _complete(request: httpx.Request) -> httpx.Response:
+            call_order.append("complete")
+            return httpx.Response(201, json={"attachmentId": "att-presigned-1"})
+
+        presign_route = respx.post(self.PRESIGN_URL).mock(side_effect=_presign)
+        put_route = respx.put(self.S3_PUT_URL).mock(side_effect=_put)
+        complete_route = respx.post(self.COMPLETE_URL).mock(side_effect=_complete)
+        apigw_route = respx.post(self.APIGW_URL).mock(
+            return_value=httpx.Response(201, json={"id": "att-apigw"})
+        )
+
+        result_file = tmp_path / "l-result.json"
+        self._write_json(result_file, {
+            "uuid": "l", "historyId": "hist-l", "fullName": "t.l",
+            "status": "passed", "start": 1000, "stop": 2000,
+            "attachments": [{"source": "big.bin", "name": "big", "type": "application/octet-stream"}],
+        })
+        attach_file = tmp_path / "big.bin"
+        attach_file.write_bytes(b"y" * 4096)  # above 1024 threshold
+
+        uploader = Uploader(config, queue)
+        uploader._launch_id = self.LAUNCH
+        queue.put(FileEvent(path=result_file, category=FileCategory.RESULT))
+        queue.put(FileEvent(path=attach_file, category=FileCategory.ATTACHMENT))
+
+        uploader.start()
+        uploader.drain(timeout=5.0)
+        uploader.stop()
+
+        assert uploader.summary.attachments_sent == 1
+        assert uploader.summary.attachments_skipped == 0
+        assert call_order == ["presign", "put", "complete"]
+        assert presign_route.called and put_route.called and complete_route.called
+        assert not apigw_route.called, "large attachment must NOT use the API-GW route"
+
+    @respx.mock
+    def test_s3_put_carries_no_authorization_and_signed_content_type(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        """The direct S3 PUT must not leak the Bearer token and must echo the signed Content-Type.
+
+        The shared client carries a client-level Authorization header that httpx
+        merges into every request; the PUT must go through a separate client so
+        the token never reaches S3. The PUT Content-Type must equal the string
+        sent to presign byte-for-byte (else S3 returns 403 SignatureDoesNotMatch).
+        """
+        self._no_backoff(monkeypatch)
+        config = self._config_with_threshold(monkeypatch, threshold_bytes=1024)
+        queue: PriorityQueue = PriorityQueue()
+
+        respx.post(self.RESULTS_URL).mock(
+            return_value=httpx.Response(200, json={
+                "accepted": 1,
+                "results": [{"testId": "hist-a", "resultId": "rid-a"}],
+            })
+        )
+        presign_route = respx.post(self.PRESIGN_URL).mock(
+            return_value=self._presign_response()
+        )
+        put_route = respx.put(self.S3_PUT_URL).mock(return_value=httpx.Response(200))
+        respx.post(self.COMPLETE_URL).mock(
+            return_value=httpx.Response(201, json={"attachmentId": "att-presigned-1"})
+        )
+
+        result_file = tmp_path / "a-result.json"
+        self._write_json(result_file, {
+            "uuid": "a", "historyId": "hist-a", "fullName": "t.a",
+            "status": "failed", "start": 1000, "stop": 2000,
+            "statusDetails": {"message": "Z" * (12 * 1024), "trace": None},
+        })
+
+        uploader = Uploader(config, queue)
+        uploader._launch_id = self.LAUNCH
+        queue.put(FileEvent(path=result_file, category=FileCategory.RESULT))
+
+        uploader.start()
+        uploader.drain(timeout=5.0)
+        uploader.stop()
+
+        assert uploader.summary.attachments_sent == 1
+
+        # The spill content type the client fixed and sent to presign.
+        presign_body = __import__("json").loads(presign_route.calls[0].request.content)
+        signed_ct = presign_body["contentType"]
+
+        put_request = put_route.calls[0].request
+        assert "authorization" not in {k.lower() for k in put_request.headers.keys()}, (
+            "Bearer token leaked to S3 on the presigned PUT"
+        )
+        assert put_request.headers["content-type"] == signed_ct, (
+            "PUT Content-Type must match the presign-signed value byte-for-byte"
+        )
+
+    @respx.mock
+    def test_file_attachment_unknown_extension_coerces_content_type_before_presign(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        """A file with no recognizable extension is signed/sent as application/octet-stream.
+
+        guess_type returns None for an unknown extension; the client must coerce
+        to a concrete MIME BEFORE presign so the signed and PUT Content-Type match.
+        """
+        self._no_backoff(monkeypatch)
+        config = self._config_with_threshold(monkeypatch, threshold_bytes=1024)
+        queue: PriorityQueue = PriorityQueue()
+
+        respx.post(self.RESULTS_URL).mock(
+            return_value=httpx.Response(200, json={
+                "accepted": 1,
+                "results": [{"testId": "hist-u", "resultId": "rid-u"}],
+            })
+        )
+        presign_route = respx.post(self.PRESIGN_URL).mock(
+            return_value=self._presign_response()
+        )
+        put_route = respx.put(self.S3_PUT_URL).mock(return_value=httpx.Response(200))
+        respx.post(self.COMPLETE_URL).mock(
+            return_value=httpx.Response(201, json={"attachmentId": "att-presigned-1"})
+        )
+
+        result_file = tmp_path / "u-result.json"
+        self._write_json(result_file, {
+            "uuid": "u", "historyId": "hist-u", "fullName": "t.u",
+            "status": "passed", "start": 1000, "stop": 2000,
+            "attachments": [{"source": "blob.weirdext", "name": "blob", "type": "x/y"}],
+        })
+        attach_file = tmp_path / "blob.weirdext"
+        attach_file.write_bytes(b"z" * 4096)
+
+        uploader = Uploader(config, queue)
+        uploader._launch_id = self.LAUNCH
+        queue.put(FileEvent(path=result_file, category=FileCategory.RESULT))
+        queue.put(FileEvent(path=attach_file, category=FileCategory.ATTACHMENT))
+
+        uploader.start()
+        uploader.drain(timeout=5.0)
+        uploader.stop()
+
+        assert uploader.summary.attachments_sent == 1
+        presign_body = __import__("json").loads(presign_route.calls[0].request.content)
+        assert presign_body["contentType"] == "application/octet-stream"
+        put_request = put_route.calls[0].request
+        assert put_request.headers["content-type"] == "application/octet-stream"
+
+    @respx.mock
+    def test_presign_terminal_failure_counts_skipped(self, tmp_path: Path, monkeypatch) -> None:
+        """A non-retryable presign failure (e.g. 413) counts the attachment skipped, warns."""
+        self._no_backoff(monkeypatch)
+        config = self._config_with_threshold(monkeypatch, threshold_bytes=1024)
+        queue: PriorityQueue = PriorityQueue()
+
+        respx.post(self.RESULTS_URL).mock(
+            return_value=httpx.Response(200, json={
+                "accepted": 1,
+                "results": [{"testId": "hist-p", "resultId": "rid-p"}],
+            })
+        )
+        presign_route = respx.post(self.PRESIGN_URL).mock(
+            return_value=httpx.Response(413, json={"error": "too large"})
+        )
+        put_route = respx.put(self.S3_PUT_URL).mock(return_value=httpx.Response(200))
+
+        result_file = tmp_path / "p-result.json"
+        self._write_json(result_file, {
+            "uuid": "p", "historyId": "hist-p", "fullName": "t.p",
+            "status": "failed", "start": 1000, "stop": 2000,
+            "statusDetails": {"message": "Z" * (12 * 1024), "trace": None},
+        })
+
+        uploader = Uploader(config, queue)
+        uploader._launch_id = self.LAUNCH
+        queue.put(FileEvent(path=result_file, category=FileCategory.RESULT))
+
+        uploader.start()
+        uploader.drain(timeout=5.0)
+        uploader.stop()
+
+        assert uploader.summary.attachments_sent == 0
+        assert uploader.summary.attachments_skipped == 1
+        assert presign_route.called
+        assert not put_route.called, "no PUT should happen after presign fails"
+
+    @respx.mock
+    def test_s3_put_retries_transient_then_succeeds(self, tmp_path: Path, monkeypatch) -> None:
+        """A transient 503 on the S3 PUT is retried with the shared backoff, then succeeds."""
+        self._no_backoff(monkeypatch)
+        config = self._config_with_threshold(monkeypatch, threshold_bytes=1024)
+        queue: PriorityQueue = PriorityQueue()
+
+        respx.post(self.RESULTS_URL).mock(
+            return_value=httpx.Response(200, json={
+                "accepted": 1,
+                "results": [{"testId": "hist-r", "resultId": "rid-r"}],
+            })
+        )
+        respx.post(self.PRESIGN_URL).mock(return_value=self._presign_response())
+        put_route = respx.put(self.S3_PUT_URL).mock(side_effect=[
+            httpx.Response(503),
+            httpx.Response(200),
+        ])
+        complete_route = respx.post(self.COMPLETE_URL).mock(
+            return_value=httpx.Response(201, json={"attachmentId": "att-presigned-1"})
+        )
+
+        result_file = tmp_path / "r-result.json"
+        self._write_json(result_file, {
+            "uuid": "r", "historyId": "hist-r", "fullName": "t.r",
+            "status": "failed", "start": 1000, "stop": 2000,
+            "statusDetails": {"message": "Z" * (12 * 1024), "trace": None},
+        })
+
+        uploader = Uploader(config, queue)
+        uploader._launch_id = self.LAUNCH
+        queue.put(FileEvent(path=result_file, category=FileCategory.RESULT))
+
+        uploader.start()
+        uploader.drain(timeout=5.0)
+        uploader.stop()
+
+        assert uploader.summary.attachments_sent == 1
+        assert uploader.summary.attachments_skipped == 0
+        assert put_route.call_count == 2  # retried once
+        assert complete_route.called
+
+    @respx.mock
+    def test_oversized_10mb_field_truncates_results_and_sends_full_attachment_via_s3(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        """Acceptance: a >10MB stdout-like field reaches Charisma end-to-end.
+
+        - The core result still lands via /results (inline field truncated below
+          the backend contract, so the batch is NOT rejected and the circuit
+          breaker never trips on size).
+        - The FULL >10MB content is uploaded as an attachment over the presigned
+          S3 path (bounded by S3, not API Gateway).
+        """
+        import json as _json
+        # Use the real default threshold (5MB) — the 10MB field must exceed it
+        # and therefore take the S3 path. Do NOT override the env here.
+        monkeypatch.delenv("CHARISMA_ATTACHMENT_APIGW_SAFE_BYTES", raising=False)
+        self._no_backoff(monkeypatch)
+        config = _make_config()
+        queue: PriorityQueue = PriorityQueue()
+
+        from charisma_cli.models import MAX_ERROR_MESSAGE_BYTES
+
+        big_field = "S" * (10 * 1024 * 1024 + 7)  # > 10 MB
+
+        results_route = respx.post(self.RESULTS_URL).mock(
+            return_value=httpx.Response(200, json={
+                "accepted": 1,
+                "results": [{"testId": "hist-10mb", "resultId": "rid-10mb"}],
+            })
+        )
+        presign_route = respx.post(self.PRESIGN_URL).mock(
+            return_value=self._presign_response()
+        )
+        put_bodies: list[bytes] = []
+
+        def _put(request: httpx.Request) -> httpx.Response:
+            put_bodies.append(request.content)
+            return httpx.Response(200)
+
+        put_route = respx.put(self.S3_PUT_URL).mock(side_effect=_put)
+        complete_route = respx.post(self.COMPLETE_URL).mock(
+            return_value=httpx.Response(201, json={"attachmentId": "att-presigned-1"})
+        )
+        apigw_route = respx.post(self.APIGW_URL).mock(
+            return_value=httpx.Response(201, json={"id": "att-apigw"})
+        )
+
+        result_file = tmp_path / "huge-result.json"
+        self._write_json(result_file, {
+            "uuid": "u10", "historyId": "hist-10mb", "fullName": "t.huge",
+            "status": "failed", "start": 1000, "stop": 2000,
+            "statusDetails": {"message": big_field, "trace": None},
+        })
+
+        uploader = Uploader(config, queue)
+        uploader._launch_id = self.LAUNCH
+        queue.put(FileEvent(path=result_file, category=FileCategory.RESULT))
+
+        uploader.start()
+        uploader.drain(timeout=10.0)
+        uploader.stop()
+
+        # Core result landed: /results was accepted with a truncated inline field.
+        assert uploader.summary.results_sent == 1
+        assert uploader.summary.results_failed == 0
+        assert not uploader._disabled, "circuit breaker must not trip on an oversized field"
+
+        sent = _json.loads(results_route.calls[0].request.content)["results"][0]
+        assert len(sent["error_message"].encode("utf-8")) <= MAX_ERROR_MESSAGE_BYTES
+        assert "attachment" in sent["error_message"].lower()
+
+        # Full content delivered over S3, not the API-GW route.
+        assert uploader.summary.attachments_sent == 1
+        assert uploader.summary.attachments_skipped == 0
+        assert presign_route.called and put_route.called and complete_route.called
+        assert not apigw_route.called
+        assert put_bodies and put_bodies[0] == big_field.encode("utf-8"), (
+            "the full >10MB field content must be the S3 PUT body"
+        )
+        # presign declared the true size so the backend bounds it against the
+        # S3/domain policy.
+        presign_body = _json.loads(presign_route.calls[0].request.content)
+        assert presign_body["size"] == len(big_field.encode("utf-8"))