Summary

A local code audit found that merging an encoded export-trajectory request can overwrite an explicitly supplied session key with an empty placeholder when the encoded request omits sessionKey.

Affected area

• src/commands/export-trajectory.ts
• decodeExportTrajectoryRequest
• resolveExportTrajectoryOptions

Repro

Call the trajectory export command with a direct sessionKey and a base64url request that only supplies another option such as output. The resolved options can lose the direct session key and fail with the --session-key is required path.

Expected

Decoded request values should not overwrite already-defined CLI options with empty placeholders.

Suggested fix

Only include sessionKey in decoded partial options when the encoded request contains a non-empty string, or merge decoded values without replacing defined direct options with empty values.

Source: local code audit.