#3177 fix(cli): guard undefined zip path and Buffer inputs

Summary (AI generated)

• Add early input validation for bundle encrypt and bundle decrypt before filesystem/crypto calls
• Throw CliUserError with clear messages when zip path, checksum, or ivSessionKey is missing or malformed
• Log validation errors before rethrow so users see messages (top-level handler skips CliUserError logging)
• Fix decrypt CLI positional arg docs ([ivSessionKey] instead of misleading [checksum])
• Add unit tests for missing zip path and undefined buffer-related inputs

Motivation (AI generated)

PostHog error tracking showed real CLI crashes from missing positional arguments:

• Zip not found at the path undefined — bundle encrypt/decrypt ran without a zip path, so existsSync(undefined) produced a confusing message and was tracked as an unhandled exception
• Buffer TypeError: Received undefined — bundle decrypt reached Buffer.from(undefined) when ivSessionKey was missing or not in IV:SESSION format (users often passed a checksum because the CLI help labeled the second arg [checksum])

These are expected user-input failures and should not surface as raw Node TypeErrors or open PostHog exception issues.

Business Impact (AI generated)

• Fewer false-positive CLI crash reports in error tracking
• Clearer CLI UX when required encrypt/decrypt arguments are omitted
• Lower support noise from cryptic undefined path / Buffer errors

Test Plan (AI generated)

• bun run lint (cli)
• bun run build (cli)
• bun test test/bundle/ — missing zip path, missing checksum, missing/malformed ivSessionKey
• CI green on PR

Generated with AI

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features

  • Added clearer validation for bundle encryption and decryption inputs, including ZIP paths, checksums, and IV/session-key values.
  • Updated bundle decryption usage to accept the IV/session-key format.

• Bug Fixes

  • Validation errors now preserve helpful CLI messages.
  • Improved handling of invalid encryption and decryption keys, formats, and files.
  • Checksums are now normalized when entered with surrounding whitespace.

• Tests

  • Added automated coverage for missing, malformed, and invalid bundle command inputs.