Support OpenAPI multipart form requests

[ernestoongaro]

Important

Stacked on #75 — this PR targets feat/body-file-input, not main. Merge #75 first; this base retargets to main automatically once it lands. The diff shown here is multipart-only.

Summary

• preserve the selected OpenAPI request media type through command generation and HTTP transport
• generate schema-driven multipart flags, including file-path handling for binary fields
• retain --body JSON compatibility and honor required fields, arrays, and per-part content types
• normalize camelCase query flags and path placeholders to kebab-case, with hidden deprecated aliases for released query flags
• document CSV uploads and cover both upload operations with regression tests

How it composes with #75

#75 added --body @file reading and client-side JSON validation, gated on a
BodyNonJSON flag it computed per operation. Rebased on top of it:

• BodyNonJSON is replaced by operationInfo.bodyFlagIsJSON(), derived from the
  media type this PR already resolves — one source of truth instead of two scans
  of the same request body.
• Multipart counts as JSON for that purpose: --body on an upload command is a
  JSON object of field values, so it gets feat(body): accept --body @file and validate JSON client-side #75's @file reading, validity check,
  and file-path hint before buildMultipartBody parses it.
• Multipart body-flag help mentions @path/to/file.json alongside the file-path
  semantics for binary fields.

Two tests cover the seam: --body @file on an upload command, and a bare path
--body producing #75's hint without calling the executor.

Verification

• go test ./...
• go vet ./...
• built the CLI and verified generated help for uploads create, uploads list, and uploads replace-data
• uploaded omni.csv end to end: 559 rows ingested and the upload was read back successfully

Example

omni uploads create \
  --file ./people.csv \
  --model-id MODEL_ID \
  --view-name people

Fixes #70

[dspangen]

I think maybe we should support @ args for the files (it's getting added here #75)

[ernestoongaro]

Awesome, I can wait until #75 merges!

[Copilot]

Pull request overview

Adds schema-driven OpenAPI multipart upload support while preserving JSON body compatibility and media types.

Changes:

• Generates multipart flags, file parts, arrays, and content types.
• Adds --body @file handling and JSON validation.
• Normalizes camelCase flags with deprecated aliases.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
README.md	Documents CSV uploads and body input.
cmd/omni/agent_help.go	Adds multipart usage guidance.
cmd/omni/main.go	Forwards request content types.
internal/auth/auth.go	Supports caller-provided content types.
internal/auth/auth_test.go	Tests multipart boundaries.
internal/openapi/body_input.go	Resolves and validates body input.
internal/openapi/body_input_test.go	Tests body sources and validation.
internal/openapi/generate.go	Generates multipart commands and normalized flags.
internal/openapi/generate_test.go	Tests normalized query flags.
internal/openapi/multipart.go	Builds schema-driven multipart requests.
internal/openapi/multipart_test.go	Tests multipart generation and uploads.

Suppressed comments (1)

internal/openapi/multipart.go:219

• Decoding into interface{} does not verify the declared flag type and does not check for trailing input. For example, an array field accepts {"x":1} and serializes it as one object part, while ["a"] trailing silently ignores the trailing text. Decode into the schema-appropriate array/object type and require EOF after the first JSON value.

	case "array", "object":
		var parsed interface{}
		decoder := json.NewDecoder(strings.NewReader(value))
		decoder.UseNumber()
		if err := decoder.Decode(&parsed); err != nil {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[n8agrin]

Claude's review pass. The plausible section doesn't seem critical but would be nice to get the other's closed:

Confirmed (live-reproduced):

--body "" on a multipart command (e.g. uploads create) fails with a confusing invalid multipart --body JSON: EOF even when --file/other flags fully supply the request.
Multipart binary-field file paths (--file, or "file" in --body JSON) never get ~ expanded, unlike --body @path, so ~/people.csv fails with "no such file or directory".

Plausible (real code-level regressions, not yet triggered by the current spec):

registerMultipartFlags's collision handling can panic the whole CLI at startup if a future spec has colliding field names — flagged independently by 5 of the 8 finder angles.
requestBodyMediaType dropped the old nil-schema guard, so it could silently prefer a schema-less application/json entry over a real multipart schema.
multipartFields's AllOf walk shares one cycle-guard map instead of cloning per branch (like schema.go's gatherObject does), so a diamond AllOf composition could silently drop properties.
readBodyFile duplicates readStdin's size-cap pattern with already-diverging error text.

[ernestoongaro]

Superseded — closing.

The multipart work already landed on feat/body-file-input as ffebcee, and #74, #77, #79 and a merge of main went on top, so this branch's base now contains a rewritten copy of its own commit. That's what the conflict here is.

@n8agrin's findings and the Copilot comments are handled in #82, which targets that branch:

• --body "" failing with invalid multipart --body JSON: EOF — fixed on the base branch by 3d9b0e1, which moved body-mode selection to cobra's Changed state. Same commit covers the shorthand --body '' case n8 found on feat(body): accept --body @file and validate JSON client-side #75.
• ~ never expanded for binary field paths — fixed in Close multipart review findings left open on #75's branch #82.
• registerMultipartFlags collision panic — fixed in Close multipart review findings left open on #75's branch #82.
• requestBodyMediaType nil-schema guard — fixed in Close multipart review findings left open on #75's branch #82.
• --body null nil-map panic (Copilot) — fixed in Close multipart review findings left open on #75's branch #82.
• array/object flag values decoded into interface{} (Copilot's suppressed comment) — fixed in Close multipart review findings left open on #75's branch #82; the declared type is pinned and trailing data is rejected.
• file-path hint rejecting values with whitespace (Copilot) — fixed on the base branch by 0827738.

Two I didn't take. The AllOf cycle-guard finding looks wrong: collect gathers every property on first visit and is idempotent, so a diamond re-reaching a schema via a second branch has nothing left to contribute — sharing the visited set is the correct DAG walk. And Copilot's note that the upload file is buffered in memory before the request needs an io.Reader threaded through APIRequest and internal/auth, which is wider than a review-fix pass; worth its own change if uploads are expected to get large.