Adversarial review: close a credential leak, a path-traversal bypass, and three more

[ivanvyd]

A five-lens panel reviewed the shipped code. Stale findings (already fixed in #9) excluded; these reproduced.

Critical — the scrubber leaked the credential it exists to hide

DiagnosticRedaction captured only the first whitespace-delimited token after a key name, so Authorization: Bearer <token> redacted the word "Bearer" and passed the token through in full. Reachable from two live paths: Databricks CLI stderr scrubbing, and every GenieException message.

Twelve evasion tests added; seven failed before the fix. The pre-existing tests all used single-token values with no embedded space — exactly the shape the pattern handled. They confirmed it worked on convenient input rather than trying to defeat it.

High — a symlink/junction defeated the pack path guard

The containment check was purely lexical, so link/report.md passed every string comparison while the write followed a reparse point outside the pack directory — traversal with no .. at all. Each component between root and target is now resolved. Reproduced with a real Windows junction before and after.

High — YAML discarded the case-insensitive comparer

YamlDotNet assigns its own dictionary over the field initializer, so an alias written Finance: did not match --agent finance. Resolution then fell through to title matching, which can select a different Agent — the answer-against-the-wrong-data failure the resolver exists to prevent.

High — timestamps parsed as milliseconds unconditionally

The project's own API notes say the unit is undocumented and the one published example is seconds. On a seconds value that yields 1970 — a silent 55-year error on a public property. Now detected by magnitude.

Medium

EXTERNAL_LINKS results omit data_array entirely, which would have returned zero rows as a complete success; now refused loudly, because an empty-looking success is worse than a failure. The CSV formula guard missed a leading tab or carriage return, both OWASP-documented prefixes.

Two false claims corrected

--verbose was registered but never read, while its help text promised "credentials are always redacted". It now emits diagnostics through a stderr logger that scrubs every record — verified live against a real workspace by grepping the output for the token. And docs/compatibility.md asserted a live verification in one section while stating "no live workspace has been contacted" seventeen lines later.

Also dropped a dead ProjectReference from QuestionPacks to Application, which used nothing from it.

127 tests, up from 109.