Avoid disclosing config file contents in parse error messages

[jiafatom]

Description

When genai_config.json fails to parse, ParseConfig (in src/config.cpp) rethrew the raw JSON parser message. That message can embed verbatim content from the file being parsed — for example, a JSON key name (Unknown value "<key>"). If the config path is influenced by untrusted input, this echoes contents of the targeted file back through the error string.

Change

• In ParseConfig, on a JSON parse failure, keep the file path in the error message (so the failing file can still be identified) but no longer append the parser's raw message content.
• Added CAPITests.ConfigParseErrorDoesNotLeakContent (no model required): writes a genai_config.json containing an unknown key, calls OgaConfig::Create, and asserts the resulting error names genai_config.json but does not contain the key from the file.

Scope / non-goals

This intentionally does not alter path handling. Accepting an arbitrary filesystem path is the intended behavior of OgaCreateConfig / OgaCreateModel; validating which paths are permissible is the responsibility of the calling application, and adding path/..//UNC restrictions here would break legitimate use cases (relative paths, models on network shares).

Testing

Built and ran the affected tests:

[ RUN      ] CAPITests.Config
[       OK ] CAPITests.Config
[ RUN      ] CAPITests.ConfigParseErrorDoesNotLeakContent
[       OK ] CAPITests.ConfigParseErrorDoesNotLeakContent
[  PASSED  ] 2 tests.

[Copilot]

Pull request overview

This PR hardens config parsing error handling to avoid leaking genai_config.json contents through exception messages (e.g., unknown JSON key names), while still identifying which file failed to parse. This fits into the core model/config loading path in src/config.cpp and adds a C API regression test to ensure the error string does not echo config content.

Changes:

• Sanitizes ParseConfig JSON parse failures by rethrowing a fixed error string that includes only the config file path (not the parser’s raw message).
• Adds a new C API test that writes a config containing a “secret” key and asserts the thrown message mentions genai_config.json but not the key.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/config.cpp	Replaces rethrow-on-parse-failure message to omit raw JSON parser details that could echo file contents.
test/c_api_tests.cpp	Adds a regression test asserting config parse errors do not leak key names from the config file.

[jiafatom]

Superseded by #2261, recreated as a non-fork branch in this repo so CI can access the internal build registry. Same commits and review fixes.