Sanitize PromptKit profile fingerprint errors

internal/framework/llm/promptkit_client_test.go

@@ -431,6 +431,34 @@ func TestPromptKitClientCheckpointFingerprintTracksProfileSource(t *testing.T) {
 	}
 }
 
+func TestPromptKitProfileFingerprintReadErrorsDoNotExposeSourcePaths(t *testing.T) {
+	for _, source := range []struct {
+		name        string
+		profileDir  string
+		profileFile string
+	}{
+		{
+			name:        "file",
+			profileFile: filepath.Join(t.TempDir(), "missing-profile.yaml"),
+		},
+		{
+			name:       "directory",
+			profileDir: filepath.Join(t.TempDir(), "missing-profiles"),
+		},
+	} {
+		t.Run(source.name, func(t *testing.T) {
+			_, err := promptKitProfileFingerprint(source.profileDir, source.profileFile, "")
+			if err == nil {
+				t.Fatal("promptKitProfileFingerprint() error = nil, want source read failure")
+			}
+			if (source.profileDir != "" && strings.Contains(err.Error(), source.profileDir)) ||
+				(source.profileFile != "" && strings.Contains(err.Error(), source.profileFile)) {
+				t.Fatalf("fingerprint error exposes profile source path: %q", err)
+			}
+		})
+	}
+}
+
 func TestPromptKitClientUsesFallbackProfilesForExecutionAndInspection(t *testing.T) {
 	assets := newTestPromptKitAssets(t)
 	const profileID = "fallback-profile"