Sanitize PromptKit profile fingerprint errors

internal/framework/llm/promptkit_client_test.go

@@ -431,6 +431,34 @@ func TestPromptKitClientCheckpointFingerprintTracksProfileSource(t *testing.T) {
 	}
 }
 
+func TestPromptKitProfileFingerprintReadErrorsDoNotExposeSourcePaths(t *testing.T) {
+	for _, source := range []struct {
+		name        string
+		profileDir  string
+		profileFile string
+	}{
+		{
+			name:        "file",
+			profileFile: filepath.Join(t.TempDir(), "missing-profile.yaml"),
+		},
+		{
+			name:       "directory",
+			profileDir: filepath.Join(t.TempDir(), "missing-profiles"),
+		},
+	} {
+		t.Run(source.name, func(t *testing.T) {
+			_, err := promptKitProfileFingerprint(source.profileDir, source.profileFile, "")
+			if err == nil {
+				t.Fatal("promptKitProfileFingerprint() error = nil, want source read failure")
+			}
+			if (source.profileDir != "" && strings.Contains(err.Error(), source.profileDir)) ||
+				(source.profileFile != "" && strings.Contains(err.Error(), source.profileFile)) {
+				t.Fatalf("fingerprint error exposes profile source path: %q", err)
+			}
+		})
+	}
+}
+
 func TestPromptKitClientUsesFallbackProfilesForExecutionAndInspection(t *testing.T) {
 	assets := newTestPromptKitAssets(t)
 	const profileID = "fallback-profile"

internal/framework/llm/promptkit_profile_fingerprint.go

@@ -29,7 +29,7 @@ func promptKitProfileFingerprint(profileDir, profileFile, fallbackProfileDigest
 	case strings.TrimSpace(profileFile) != "":
 		data, err := os.ReadFile(strings.TrimSpace(profileFile))
 		if err != nil {
-			return CheckpointFingerprint{}, fmt.Errorf("read PromptKit profile file for checkpoint identity: %w", err)
+			return CheckpointFingerprint{}, fmt.Errorf("read PromptKit profile file for checkpoint identity")
 		}
 		writeFingerprintPart(hasher, data)
 	case strings.TrimSpace(profileDir) != "":
@@ -80,7 +80,7 @@ func promptKitProfileFileDigests(root string) ([][]byte, error) {
 		return nil
 	})
 	if err != nil {
-		return nil, fmt.Errorf("read PromptKit profile directory for checkpoint identity: %w", err)
+		return nil, fmt.Errorf("read PromptKit profile directory for checkpoint identity")
 	}
 	sort.Slice(digests, func(i, j int) bool {
 		return string(digests[i]) < string(digests[j])