Summary
The library's "deterministic, structured" config report uses raw tab-delimited output without escaping tabs/newlines in the values themselves.
Details
lib/bash/app/lib_app.sh:487-504, specifically printf '%s\t%s\t%s\n' "$key" "$source" "$value" at line 502.
Impact
If a configured value (from a project/user config file, CLI --cli key=value, or environment) contains a literal tab character, the emitted record silently gains an extra field, corrupting any machine parsing of this report — despite its own doc comment describing it as deterministic, structured output.
Suggested fix
Reject/escape tab and newline characters in config values, or switch the report format to something field-safe (e.g. NUL-delimited or quoted).
Summary
The library's "deterministic, structured" config report uses raw tab-delimited output without escaping tabs/newlines in the values themselves.
Details
lib/bash/app/lib_app.sh:487-504, specificallyprintf '%s\t%s\t%s\n' "$key" "$source" "$value"at line 502.Impact
If a configured value (from a project/user config file, CLI
--cli key=value, or environment) contains a literal tab character, the emitted record silently gains an extra field, corrupting any machine parsing of this report — despite its own doc comment describing it as deterministic, structured output.Suggested fix
Reject/escape tab and newline characters in config values, or switch the report format to something field-safe (e.g. NUL-delimited or quoted).