fix(contracts): reject NUL bytes in keyed archive and extraction paths (#3606)

Co-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>

src/contracts/artifactToolContracts.ts

@@ -9,6 +9,7 @@ import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
 import { appleAssetCatalogInputSchema } from "../domain/apple/appleAssetCatalog.js";
 import { dylibResolutionInputSchema } from "../domain/apple/dylibResolution.js";
 import { keyedArchiveInputSchema } from "../domain/apple/keyedArchive.js";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { analysisDetailSchema } from "./analysisDetail.js";
 /** Exact caller boundary for deterministic artifact inventory. */
 export const artifactInventoryInputSchema = z.strictObject({
@@ -34,7 +35,7 @@ export const artifactExtractionInputSchema = z.strictObject({
 /** Provider input containing the destination chosen by the local adapter. */
 export const artifactExtractionExecutionSchema =
   artifactExtractionInputSchema.extend({
-    output_root: z.string().min(1),
+    output_root: localPathStringSchema,
   });
 
 const exampleInputSchema = z.record(z.string(), jsonValueSchema);

src/domain/apple/keyedArchive.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { AnalysisInputError } from "../analysisErrorCore.js";
 import { jsonValueSchema, type JsonValue } from "../jsonValue.js";
+import { localPathStringSchema } from "../localPath.js";
 
 /**
  * The selected file is intact but is another kind of file, so another tool
@@ -20,7 +21,7 @@ export class KeyedArchiveKindError extends TypeError {
 
 /** Select one archive within the active bundle and optionally one named root. */
 export const keyedArchiveInputSchema = z.strictObject({
-  path: z.string().min(1).default("."),
+  path: localPathStringSchema.default("."),
   root: z.string().optional(),
   offset: z.number().int().min(0).default(0),
   limit: z.number().int().min(1).max(20_000).default(20_000),