Fix mask_secret panic on multi-byte UTF-8 secrets

src/auth_commands.rs

@@ -22,17 +22,19 @@ use crate::error::GwsError;
 
 /// Mask a secret string by showing only the first 4 and last 4 characters.
 /// Strings with 8 or fewer characters are fully replaced with "***".
+///
+/// Uses char-based indexing (not byte offsets) so multi-byte UTF-8 secrets
+/// never cause a panic.
 fn mask_secret(s: &str) -> String {
     const MASK_PREFIX_LEN: usize = 4;
     const MASK_SUFFIX_LEN: usize = 4;
     const MIN_LEN_FOR_PARTIAL_MASK: usize = MASK_PREFIX_LEN + MASK_SUFFIX_LEN;
 
-    if s.len() > MIN_LEN_FOR_PARTIAL_MASK {
-        format!(
-            "{}...{}",
-            &s[..MASK_PREFIX_LEN],
-            &s[s.len() - MASK_SUFFIX_LEN..]
-        )
+    let char_count = s.chars().count();
+    if char_count > MIN_LEN_FOR_PARTIAL_MASK {
+        let prefix: String = s.chars().take(MASK_PREFIX_LEN).collect();
+        let suffix: String = s.chars().skip(char_count - MASK_SUFFIX_LEN).collect();
+        format!("{prefix}...{suffix}")
     } else {
         "***".to_string()
     }
@@ -2124,6 +2126,17 @@ mod tests {
         assert_eq!(mask_secret("123456789"), "1234...6789");
     }
 
+    #[test]
+    fn mask_secret_multibyte_utf8() {
+        // Multi-byte chars must not panic (previously used byte slicing)
+        // "áéíóúñüÁÉÍÓÚ" = 12 chars, last 4 = ÉÍÓÚ
+        assert_eq!(mask_secret("áéíóúñüÁÉÍÓÚ"), "áéíó...ÉÍÓÚ");
+        // Short multi-byte — should fully mask
+        assert_eq!(mask_secret("café"), "***");
+        // Exactly at boundary with multi-byte (9 Greek chars)
+        assert_eq!(mask_secret("αβγδεζηθι"), "αβγδ...ζηθι");
+    }
+
     #[test]
     fn find_unmatched_services_identifies_missing() {
         let scopes = vec![

src/discovery.rs

@@ -243,8 +243,8 @@ pub async fn fetch_discovery_document(
         alt_resp.text().await?
     };
 
-    // Write to cache
-    if let Err(e) = std::fs::write(&cache_file, &body) {
+    // Write to cache atomically to prevent race conditions (M-03)
+    if let Err(e) = crate::fs_util::atomic_write(&cache_file, body.as_bytes()) {
         // Non-fatal: just warn via stderr-safe approach
         let _ = e;
     }

src/helpers/script.rs

@@ -140,11 +140,20 @@ TIPS:
 }
 
 fn visit_dirs(dir: &Path, files: &mut Vec<serde_json::Value>) -> Result<(), GwsError> {
+    if dir.is_symlink() {
+        return Ok(());
+    }
     if dir.is_dir() {
         for entry in fs::read_dir(dir).context("Failed to read dir")? {
             let entry = entry.context("Failed to read entry")?;
+            let ft = entry.file_type().context("Failed to get file type")?;
+
+            if ft.is_symlink() {
+                continue; // Skip symlinks to prevent traversal attacks/infinite loops (M-04)
+            }
+
             let path = entry.path();
-            if path.is_dir() {
+            if ft.is_dir() {
                 visit_dirs(&path, files)?;
             } else if let Some(file_obj) = process_file(&path)? {
                 files.push(file_obj);