fix(bundle): wrap local .zip errors in BundlerError instead of raw crash

[jawwad-ali]

Problem

The local .zip branch of _local_manifest_source opens the archive and parses its embedded bundle.yml with no error handling:

with zipfile.ZipFile(candidate) as archive:      # raw BadZipFile
    ...
data = _yaml.safe_load(io.BytesIO(raw))           # raw YAMLError

• A .zip-suffixed file that isn't a valid archive → zipfile.BadZipFile.
• A valid zip whose embedded bundle.yml is malformed → yaml.YAMLError.

Neither is a BundlerError, and bundle_install only does except BundlerError, so both escape to an unhandled traceback instead of the intended clean Error: … + exit 1. Reproduced both on main (4d3a428).

This is a parity gap: the directory and bundle.yml branches go through BundleManifest.from_file → load_yaml, which wraps failures in BundlerError; and the remote sibling _download_remote_manifest explicitly wraps its _local_manifest_source call in try/except → BundlerError. Only the direct local .zip branch is unguarded.

Fix

Wrap both failure modes in BundlerError (hardening the source function, so every caller benefits):

try:
    archive = zipfile.ZipFile(candidate)
except (zipfile.BadZipFile, OSError) as exc:
    raise BundlerError(f"Artifact '{candidate}' is not a valid .zip bundle: {exc}") from exc
with archive:
    ... # existing KeyError guard for missing bundle.yml
try:
    data = _yaml.safe_load(io.BytesIO(raw))
except _yaml.YAMLError as exc:
    raise BundlerError(f"Artifact '{candidate}' contains an invalid bundle.yml: {exc}") from exc

Valid archives are unaffected — no behaviour change for correct input.

Verification

• New test_local_source_corrupt_zip_raises_clean_error and test_local_source_zip_with_malformed_bundle_yml_raises_clean_error: fail before (raw BadZipFile / YAMLError), pass after (clean BundlerError).
• Full test_bundler_local_install.py: 12 passed. ruff clean.

---

AI-assisted: authored with Claude Code. I reproduced both raw crashes on main via a direct _local_manifest_source call and mirrored the remote-download path's existing error wrapping.

[Copilot]

Pull request overview

Hardens local bundle ZIP parsing by translating archive and YAML failures into BundlerError.

Changes:

• Wraps invalid ZIP and malformed YAML errors.
• Adds regression tests for both cases.

Show a summary per file

File	Description
src/specify_cli/commands/bundle/__init__.py	Adds error translation for local ZIP manifests.
tests/integration/test_bundler_local_install.py	Tests corrupt ZIP and malformed YAML handling.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Medium

[jawwad-ali]

Confirmed and fixed in 6d5f8d2 — you're right that ZipFile() only validates the central directory.

I reproduced both corruption modes on a directory-intact archive:

• flipped byte in a stored member → zipfile.BadZipFile: Bad CRC-32 for file 'bundle.yml' (exactly your example)
• mangled deflate stream → zlib.error: Error -3 while decompressing data

Since neither is an OSError subclass, an OSError-only clause would still have leaked the second one, so the read boundary lists (BadZipFile, OSError, zlib.error, EOFError) explicitly. The KeyError → "does not contain a bundle.yml" case is unchanged, and the new test asserts both modes now surface as BundlerError (the CRC case fails before this commit with a raw traceback).