feat(reflex-hosting-cli): upload deploy archives straight to storage

[adhami3310]

Closes ENG-11230. Client half of the presigned upload work; the control-plane half is flexgen#5113.

reflex deploy posted both zips as multipart to POST /deployments, where the web process relayed them into a blocking boto3 upload_fileobj inside the request handler. The builder path stopped doing that in ENG-9725; the CLI path did not.

It now calls POST /deployments/reserve, PUTs both archives to the signed keys it gets back, and submits only the returned deployment id.

Touches packages/reflex-hosting-cli only — no reflex-base change, so this does not move the package's reflex-base floor.

Decisions worth a second look

Content-Length is set explicitly on each PUT. The exact byte count is part of the signature, and httpx would otherwise send a generator body chunked, which the signature does not match. Request._prepare skips Transfer-Encoding precisely when Content-Length is already set. Verified over a real socket rather than assumed — sized, not chunked, exact byte count.

A 404 from /deployments/reserve means the route is absent, not the app. Nothing the endpoint itself refuses with is a 404: an unknown app and an out-of-range size are 400, a missing permission is 403. So a 404 falls back to relaying, as does a caller with no app id to reserve against. The multipart path is otherwise unchanged and stays for the overlap.

A 403 on a PUT is a lapsed signature, and re-reserving is the recovery. A fresh reservation mints a fresh deployment id naming a fresh prefix, so both archives go up again under it — the one that already succeeded is not somewhere the new deployment will look. Budget is two windows; past that the link is the problem and the user is told so rather than looped.

The two uploads run concurrently, with a byte-oriented progress bar each. A silent multi-minute PUT is worse than the relay it replaces, which at least streamed. But neither archive is worth finishing alone — the build submits under one id — so the first failure abandons its sibling at the next chunk boundary rather than leaving the user watching a large upload complete into a deployment that cannot happen.

Both presigned upload paths now share one PUT. submit_security_review signed its own, and its comment claimed setting Content-Length manually breaks the signature — the opposite of what this path needs. Verified against httpx 0.28.1: for a bytes body an explicit length is byte-identical to the derived one; for a stream, omitting it yields a chunked body the signature rejects. presigned_put holds that invariant once and both callers use it, so the scan path also picks up the per-operation timeouts in place of a flat 120s covering connect and pool. Retry, progress and abandonment deliberately stay with the deploy path — they follow from having two large archives, not from the upload being presigned.

transfer_progress lives in this package, not beside progress in reflex-base. Only the deploy upload wants it, and a new name in reflex-base would raise this package's reflex-base floor for no benefit — the CLI releases on its own schedule. It uses nothing reflex-base does not already owe the CLI: is_json_mode is what the re-exported progress already calls to stay quiet under JSON output.

Known tradeoffs

• R2 answers 403 for both an expired signature and a genuinely bad one, so a permanently-broken signature costs one extra reservation before the user hears about it. Narrowing it means parsing the vendor's XML error vocabulary.
• Abandonment is checked between chunks, so on a link stalled mid-write it takes effect when that 256 KiB write completes — bounded by the write timeout rather than by the size of the archive.
• The "over 100MB" 413 message is now reachable only on the relay path. On the direct path an oversized archive gets the control plane's own ArchiveSizeError text, which is accurate but worded differently.

Testing

10 new tests in tests/units/reflex_cli/utils/test_hosting.py covering the reserve request shape, exact-bytes/exact-headers on both PUTs, expiry recovery re-uploading both archives under the new id, the retry budget, both relay fallbacks, a refused reservation, an unreachable control plane, and mid-stream abandonment. The two existing create_deployment tests moved onto real archives since they now traverse the upload path.

Full unit suite green (7656 passed, 17 skipped); ruff check, ruff format --check, pyright, and scripts/check_min_deps.py clean.

Not included, per the ticket: moving SUPPORTED_CLI_THRESHOLD server-side, which waits until enough of the fleet has upgraded.

[linear-code]

ENG-11230

[greptile-apps]

Greptile Summary

The PR changes managed deployments to reserve storage destinations, upload the frontend and backend archives concurrently, and submit the resulting deployment identifier while retaining the multipart fallback.

• Adds byte-oriented transfer progress and archive-upload error handling.
• Adds reservation, direct PUT, retry, cancellation, and legacy fallback behavior.
• Reuses the presigned PUT helper for security-review uploads.
• Expands deployment upload tests for request shape, retries, fallback, failures, and abandonment.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/reflex-hosting-cli/src/reflex_cli/utils/hosting.py	Implements the reserve-upload-submit workflow, concurrent archive transfers, one re-reservation attempt, multipart fallback, and shared presigned PUT handling; no eligible follow-up finding was established.
packages/reflex-hosting-cli/src/reflex_cli/utils/console.py	Adds a JSON-aware Rich progress display configured for byte transfers.
packages/reflex-hosting-cli/src/reflex_cli/utils/exceptions.py	Adds the dedicated user-facing archive upload exception.
tests/units/reflex_cli/utils/test_hosting.py	Covers direct uploads, exact headers and bytes, re-reservation, retry exhaustion, relay fallbacks, control-plane failures, and sibling-upload abandonment.

_{Reviews (4): Last reviewed commit: "refactor(reflex-hosting-cli): one presig..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 6 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[codspeed-hq]

Merging this PR will not alter performance

✅ 27 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing claude/reflex-hosting-cli-presigned-upload-06da70 (c776c07) with main (6b44604)}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>