fix(cli): align local paths and SQLite selection validation (#9882)

fix(cli): batch of small fixes for #9714, #9718, #9759, #9856 and #9809

#9714: replace bare z.string().min(1) local paths in ADB CLI commands with localPathStringSchema so NUL bytes are rejected at the CLI boundary.
#9718: decode-android-resources path uses localPathStringSchema, matching apktoolInputSchemas.
#9759: inspect-sqlite-database CLI options now reject an empty column array and reject rowLimit/rowOffset/column/schemaScope=selected_table without --table via superRefine, mirroring inspectSqliteDatabaseInputSchema.
#9856 and #9809: shared snapshotSelectionOption is now localPathStringSchema.optional(), so every analyze/inspect/decompile/xrefs/trace/function/instructions/search --snapshot rejects NUL bytes.

Tests: tests/boundary/cli/overnightBatch1CliSchemas.test.ts (15 tests) proves empty/NUL input returns VALIDATION_ERROR before any provider runs and valid input is admitted.

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

src/cli/adbCommands.ts

@@ -11,6 +11,7 @@ import {
   MAX_ADB_ACTIVITY_EXTRAS,
   type AdbOperation,
 } from "../domain/adb/adbDeviceAnalysis.js";
+import { localPathStringSchema } from "../domain/localPath.js";
 import type { Logger } from "pino";
 import { cliDecimalField } from "./options.js";
 import type { CliInstance } from "./types.js";
@@ -88,12 +89,9 @@ export const registerAdbCommands = (
       package: packageName.describe("Installed package name"),
     }),
     options: z.object({
-      "output-directory": z
-        .string()
-        .min(1)
-        .describe(
-          "Local directory for the pulled APK set; a package-named subdirectory is created inside",
-        ),
+      "output-directory": localPathStringSchema.describe(
+        "Local directory for the pulled APK set; a package-named subdirectory is created inside",
+      ),
     }),
     run: ({ args, options }) =>
       execute(CLI_COMMANDS.pullAdbPackage, "pull_adb_package", {
@@ -142,10 +140,9 @@ export const registerAdbCommands = (
       "device-path": adbInputSchemas.pull_adb_file.shape.device_path,
     }),
     options: z.object({
-      "output-directory": z
-        .string()
-        .min(1)
-        .describe("Local directory for the pulled file"),
+      "output-directory": localPathStringSchema.describe(
+        "Local directory for the pulled file",
+      ),
     }),
     run: ({ args, options }) =>
       execute(CLI_COMMANDS.pullAdbFile, "pull_adb_file", {
@@ -159,7 +156,7 @@ export const registerAdbCommands = (
       "Push one local file to the device; refuses existing targets without --overwrite",
     args: z.object({
       serial,
-      "local-path": z.string().min(1).describe("Existing local file"),
+      "local-path": localPathStringSchema.describe("Existing local file"),
       "device-path": adbInputSchemas.push_adb_file.shape.device_path,
     }),
     options: z.object({
@@ -180,10 +177,9 @@ export const registerAdbCommands = (
     description: "Capture one screen frame as a digested PNG",
     args: z.object({ serial }),
     options: z.object({
-      "output-directory": z
-        .string()
-        .min(1)
-        .describe("Local directory for screen.png"),
+      "output-directory": localPathStringSchema.describe(
+        "Local directory for screen.png",
+      ),
     }),
     run: ({ args, options }) =>
       execute(CLI_COMMANDS.captureAdbScreen, "capture_adb_screen", {
@@ -251,10 +247,9 @@ export const registerAdbCommands = (
     description: "Collect and digest one device-generated bugreport archive",
     args: z.object({ serial }),
     options: z.object({
-      "output-directory": z
-        .string()
-        .min(1)
-        .describe("Local directory for the bugreport zip"),
+      "output-directory": localPathStringSchema.describe(
+        "Local directory for the bugreport zip",
+      ),
     }),
     run: ({ args, options }) =>
       execute(CLI_COMMANDS.collectAdbBugreport, "collect_adb_bugreport", {
@@ -273,7 +268,7 @@ export const registerAdbCommands = (
       "Install one local APK; --replace requests reinstall mode to keep existing app data",
     args: z.object({
       serial,
-      "apk-path": z.string().min(1).describe("Local APK file to install"),
+      "apk-path": localPathStringSchema.describe("Local APK file to install"),
     }),
     options: z.object({
       replace: z

src/cli/apktoolCommands.ts

@@ -9,6 +9,7 @@ import {
   apktoolInputSchemas,
   type ApktoolOperation,
 } from "../domain/apktool/apktoolResourceAnalysis.js";
+import { localPathStringSchema } from "../domain/localPath.js";
 import type { Logger } from "pino";
 import { cliDecimalField } from "./options.js";
 import type { CliInstance } from "./types.js";
@@ -59,7 +60,7 @@ export const registerApktoolCommands = (
     description:
       "Decode one APK's manifest, metadata, and string resources with apktool",
     args: z.object({
-      path: z.string().min(1).describe("Local APK file to decode"),
+      path: localPathStringSchema.describe("Local APK file to decode"),
     }),
     // The locale grammar and the string-projection default belong to the
     // apktool input owner. Read them from that schema rather than restating a

src/cli/decompileDirectoryCommand.ts

@@ -9,6 +9,7 @@ import {
   cliDecimalField,
   directAnalysisOptionsFromCli,
   nativeOpenOptionFields,
+  snapshotSelectionOption,
 } from "./options.js";
 import { decompileDirectoryInputSchema } from "../contracts/decompileDirectory.js";
 import type { CliInstance } from "./types.js";
@@ -72,13 +73,9 @@ export const registerDecompileDirectoryCommand = (
       ).describe(
         "Maximum functions to attempt after skipping verified files and recorded external functions",
       ),
-      snapshot: z
-        .string()
-        .min(1)
-        .optional()
-        .describe(
-          "Load a local analysis snapshot. decompile-all does not update it.",
-        ),
+      snapshot: snapshotSelectionOption.describe(
+        "Load a local analysis snapshot. decompile-all does not update it.",
+      ),
       ...nativeOpenOptionFields,
     }),
     run: ({ args, options }) =>

src/cli/sqliteCommands.ts

@@ -10,7 +10,19 @@ import { localPathStringSchema } from "../domain/localPath.js";
 import { absoluteCallerPath } from "../filesystem/callerPath.js";
 import { finishCliEvidenceCommand } from "./cliEvidenceCallerPath.js";
 import { cliDecimalField } from "./options.js";
-import { inspectSqliteDatabaseInputSchema } from "../domain/sqlite/sqliteDatabase.js";
+import {
+  inspectSqliteDatabaseInputSchema,
+  sqliteTableSelectionSchema,
+  SQLITE_TABLE_REQUIRED_SELECTION_FIELDS,
+} from "../domain/sqlite/sqliteDatabase.js";
+
+const selectionAliases = {
+  table: "table",
+  columns: "column",
+  schema_scope: "schemaScope",
+  row_limit: "rowLimit",
+  row_offset: "rowOffset",
+} as const;
 
 /** Resolve an operator-selected SQLite snapshot through the shared inspection workflow. */
 export const registerSqliteCommands = (
@@ -25,35 +37,62 @@ export const registerSqliteCommands = (
     args: z.object({
       path: localPathStringSchema.describe("Local SQLite database snapshot"),
     }),
-    options: z.object({
-      workerTimeoutMs: cliDecimalField(
-        inspectSqliteDatabaseInputSchema.shape.worker_timeout_ms,
-      ),
-      table: z
-        .string()
-        .optional()
-        .describe("Exact ordinary table name to read"),
-      column: z
-        .array(z.string())
-        .optional()
-        .describe(
+    options: z
+      .object({
+        workerTimeoutMs: cliDecimalField(
+          inspectSqliteDatabaseInputSchema.shape.worker_timeout_ms,
+        ),
+        table: sqliteTableSelectionSchema.shape.table.describe(
+          "Exact ordinary table name to read",
+        ),
+        column: sqliteTableSelectionSchema.shape.columns.describe(
           "Repeat to select exact row columns in the requested order; requires table",
         ),
-      schemaScope: z
-        .enum(["inventory", "selected_table", "database"])
-        .optional()
-        .describe(
+        schemaScope: sqliteTableSelectionSchema.shape.schema_scope.describe(
           "Compact inventory by default, or selected-table details when table is supplied; database requests full schema",
         ),
-      rowLimit: cliDecimalField(
-        inspectSqliteDatabaseInputSchema.shape.row_limit,
-      ).describe("Positive safe integer row count; default 20; requires table"),
-      rowOffset: cliDecimalField(
-        inspectSqliteDatabaseInputSchema.shape.row_offset,
-      ).describe(
-        "Non-negative safe integer rows to skip before the window; default 0; requires table",
-      ),
-    }),
+        rowLimit: cliDecimalField(
+          inspectSqliteDatabaseInputSchema.shape.row_limit,
+        ).describe(
+          "Positive safe integer row count; default 20; requires table",
+        ),
+        rowOffset: cliDecimalField(
+          inspectSqliteDatabaseInputSchema.shape.row_offset,
+        ).describe(
+          "Non-negative safe integer rows to skip before the window; default 0; requires table",
+        ),
+      })
+      .superRefine((options, context) => {
+        const selection = sqliteTableSelectionSchema.safeParse({
+          table: options.table,
+          columns: options.column,
+          schema_scope: options.schemaScope,
+          row_limit: options.rowLimit,
+          row_offset: options.rowOffset,
+        });
+        if (selection.success) return;
+        for (const issue of selection.error.issues) {
+          const path = issue.path.map((field) =>
+            typeof field === "string" && field in selectionAliases
+              ? selectionAliases[field as keyof typeof selectionAliases]
+              : field,
+          );
+          context.addIssue({ ...issue, path });
+        }
+      })
+      .meta({
+        dependentRequired: Object.fromEntries(
+          SQLITE_TABLE_REQUIRED_SELECTION_FIELDS.map((field) => [
+            selectionAliases[field],
+            ["table"],
+          ]),
+        ),
+        if: {
+          properties: { schemaScope: { const: "selected_table" } },
+          required: ["schemaScope"],
+        },
+        then: { required: ["table"] },
+      }),
     run: ({ args, options }) =>
       withCommandCancellation((signal) =>
         logCliCommand(logger, CLI_COMMANDS.inspectSqliteDatabase, () =>