fix(cli): align local paths and SQLite selection validation (#9882)

fix(cli): batch of small fixes for #9714, #9718, #9759, #9856 and #9809

#9714: replace bare z.string().min(1) local paths in ADB CLI commands with localPathStringSchema so NUL bytes are rejected at the CLI boundary.
#9718: decode-android-resources path uses localPathStringSchema, matching apktoolInputSchemas.
#9759: inspect-sqlite-database CLI options now reject an empty column array and reject rowLimit/rowOffset/column/schemaScope=selected_table without --table via superRefine, mirroring inspectSqliteDatabaseInputSchema.
#9856 and #9809: shared snapshotSelectionOption is now localPathStringSchema.optional(), so every analyze/inspect/decompile/xrefs/trace/function/instructions/search --snapshot rejects NUL bytes.

Tests: tests/boundary/cli/overnightBatch1CliSchemas.test.ts (15 tests) proves empty/NUL input returns VALIDATION_ERROR before any provider runs and valid input is admitted.

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

src/cli/sqliteCommands.ts

@@ -10,7 +10,19 @@ import { localPathStringSchema } from "../domain/localPath.js";
 import { absoluteCallerPath } from "../filesystem/callerPath.js";
 import { finishCliEvidenceCommand } from "./cliEvidenceCallerPath.js";
 import { cliDecimalField } from "./options.js";
-import { inspectSqliteDatabaseInputSchema } from "../domain/sqlite/sqliteDatabase.js";
+import {
+  inspectSqliteDatabaseInputSchema,
+  sqliteTableSelectionSchema,
+  SQLITE_TABLE_REQUIRED_SELECTION_FIELDS,
+} from "../domain/sqlite/sqliteDatabase.js";
+
+const selectionAliases = {
+  table: "table",
+  columns: "column",
+  schema_scope: "schemaScope",
+  row_limit: "rowLimit",
+  row_offset: "rowOffset",
+} as const;
 
 /** Resolve an operator-selected SQLite snapshot through the shared inspection workflow. */
 export const registerSqliteCommands = (
@@ -25,35 +37,62 @@ export const registerSqliteCommands = (
     args: z.object({
       path: localPathStringSchema.describe("Local SQLite database snapshot"),
     }),
-    options: z.object({
-      workerTimeoutMs: cliDecimalField(
-        inspectSqliteDatabaseInputSchema.shape.worker_timeout_ms,
-      ),
-      table: z
-        .string()
-        .optional()
-        .describe("Exact ordinary table name to read"),
-      column: z
-        .array(z.string())
-        .optional()
-        .describe(
+    options: z
+      .object({
+        workerTimeoutMs: cliDecimalField(
+          inspectSqliteDatabaseInputSchema.shape.worker_timeout_ms,
+        ),
+        table: sqliteTableSelectionSchema.shape.table.describe(
+          "Exact ordinary table name to read",
+        ),
+        column: sqliteTableSelectionSchema.shape.columns.describe(
           "Repeat to select exact row columns in the requested order; requires table",
         ),
-      schemaScope: z
-        .enum(["inventory", "selected_table", "database"])
-        .optional()
-        .describe(
+        schemaScope: sqliteTableSelectionSchema.shape.schema_scope.describe(
           "Compact inventory by default, or selected-table details when table is supplied; database requests full schema",
         ),
-      rowLimit: cliDecimalField(
-        inspectSqliteDatabaseInputSchema.shape.row_limit,
-      ).describe("Positive safe integer row count; default 20; requires table"),
-      rowOffset: cliDecimalField(
-        inspectSqliteDatabaseInputSchema.shape.row_offset,
-      ).describe(
-        "Non-negative safe integer rows to skip before the window; default 0; requires table",
-      ),
-    }),
+        rowLimit: cliDecimalField(
+          inspectSqliteDatabaseInputSchema.shape.row_limit,
+        ).describe(
+          "Positive safe integer row count; default 20; requires table",
+        ),
+        rowOffset: cliDecimalField(
+          inspectSqliteDatabaseInputSchema.shape.row_offset,
+        ).describe(
+          "Non-negative safe integer rows to skip before the window; default 0; requires table",
+        ),
+      })
+      .superRefine((options, context) => {
+        const selection = sqliteTableSelectionSchema.safeParse({
+          table: options.table,
+          columns: options.column,
+          schema_scope: options.schemaScope,
+          row_limit: options.rowLimit,
+          row_offset: options.rowOffset,
+        });
+        if (selection.success) return;
+        for (const issue of selection.error.issues) {
+          const path = issue.path.map((field) =>
+            typeof field === "string" && field in selectionAliases
+              ? selectionAliases[field as keyof typeof selectionAliases]
+              : field,
+          );
+          context.addIssue({ ...issue, path });
+        }
+      })
+      .meta({
+        dependentRequired: Object.fromEntries(
+          SQLITE_TABLE_REQUIRED_SELECTION_FIELDS.map((field) => [
+            selectionAliases[field],
+            ["table"],
+          ]),
+        ),
+        if: {
+          properties: { schemaScope: { const: "selected_table" } },
+          required: ["schemaScope"],
+        },
+        then: { required: ["table"] },
+      }),
     run: ({ args, options }) =>
       withCommandCancellation((signal) =>
         logCliCommand(logger, CLI_COMMANDS.inspectSqliteDatabase, () =>