fix(bundle): wrap local .zip errors in BundlerError instead of raw crash

[jawwad-ali]

Problem

The local .zip branch of _local_manifest_source opens the archive and parses its embedded bundle.yml with no error handling:

with zipfile.ZipFile(candidate) as archive:      # raw BadZipFile
    ...
data = _yaml.safe_load(io.BytesIO(raw))           # raw YAMLError

• A .zip-suffixed file that isn't a valid archive → zipfile.BadZipFile.
• A valid zip whose embedded bundle.yml is malformed → yaml.YAMLError.

Neither is a BundlerError, and bundle_install only does except BundlerError, so both escape to an unhandled traceback instead of the intended clean Error: … + exit 1. Reproduced both on main (4d3a428).

This is a parity gap: the directory and bundle.yml branches go through BundleManifest.from_file → load_yaml, which wraps failures in BundlerError; and the remote sibling _download_remote_manifest explicitly wraps its _local_manifest_source call in try/except → BundlerError. Only the direct local .zip branch is unguarded.

Fix

Wrap both failure modes in BundlerError (hardening the source function, so every caller benefits):

try:
    archive = zipfile.ZipFile(candidate)
except (zipfile.BadZipFile, OSError) as exc:
    raise BundlerError(f"Artifact '{candidate}' is not a valid .zip bundle: {exc}") from exc
with archive:
    ... # existing KeyError guard for missing bundle.yml
try:
    data = _yaml.safe_load(io.BytesIO(raw))
except _yaml.YAMLError as exc:
    raise BundlerError(f"Artifact '{candidate}' contains an invalid bundle.yml: {exc}") from exc

Valid archives are unaffected — no behaviour change for correct input.

Verification

• New test_local_source_corrupt_zip_raises_clean_error and test_local_source_zip_with_malformed_bundle_yml_raises_clean_error: fail before (raw BadZipFile / YAMLError), pass after (clean BundlerError).
• Full test_bundler_local_install.py: 12 passed. ruff clean.

---

AI-assisted: authored with Claude Code. I reproduced both raw crashes on main via a direct _local_manifest_source call and mirrored the remote-download path's existing error wrapping.

[Copilot]

Pull request overview

Hardens local bundle ZIP parsing by translating archive and YAML failures into BundlerError.

Changes:

• Wraps invalid ZIP and malformed YAML errors.
• Adds regression tests for both cases.

Show a summary per file

File	Description
src/specify_cli/commands/bundle/__init__.py	Adds error translation for local ZIP manifests.
tests/integration/test_bundler_local_install.py	Tests corrupt ZIP and malformed YAML handling.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Medium

[jawwad-ali]

Confirmed and fixed in 6d5f8d2 — you're right that ZipFile() only validates the central directory.

I reproduced both corruption modes on a directory-intact archive:

• flipped byte in a stored member → zipfile.BadZipFile: Bad CRC-32 for file 'bundle.yml' (exactly your example)
• mangled deflate stream → zlib.error: Error -3 while decompressing data

Since neither is an OSError subclass, an OSError-only clause would still have leaked the second one, so the read boundary lists (BadZipFile, OSError, zlib.error, EOFError) explicitly. The KeyError → "does not contain a bundle.yml" case is unchanged, and the new test asserts both modes now surface as BundlerError (the CRC case fails before this commit with a raw traceback).

[Copilot]

Review details

Comments suppressed due to low confidence (2)

src/specify_cli/commands/bundle/init.py:764

• This path is rendered as Rich markup by _fail(), so a valid archive with no manifest and a path containing markup (such as [/red].zip) can still crash with MarkupError instead of returning the intended BundlerError. Escape the interpolated path.

            raise BundlerError(
                f"Artifact '{candidate}' does not contain a bundle.yml."

src/specify_cli/commands/bundle/init.py:777

• The malformed-YAML error still inserts the archive path into Rich markup without escaping it. A path containing an unmatched tag can therefore turn this handled YAMLError back into an unhandled MarkupError; escape candidate here as well.

            raise BundlerError(
                f"Artifact '{candidate}' contains an invalid bundle.yml: "
                f"{_escape_markup(str(exc))}"

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Medium

[mnriem]

Please address Copilot feedback

[jawwad-ali]

Right again — fixed in aedb9e2. Confirmed the vector: rendering Artifact '/tmp/x/[/red].zip' is not a valid .zip bundle: ... raises MarkupError: closing tag '[/red]' ... doesn't match any open tag, and escaping it renders fine. Reachable in practice via a directory named [ containing red].zip.

The path is now escaped once into safe_path and used at all three sites (open, missing-bundle.yml, read). One note for the record: the vector is POSIX-specific in practice — on Windows Path() normalizes the forward slash to a backslash ([\red]), which is inert markup — so the new test builds the POSIX-style path explicitly rather than relying on the host.