fix(cli): refuse extra prompt arguments instead of dropping them

[dennisonbertram]

Closes #1435

The bug

$ go-code "explain this repo" "and also this"
harnesscli got: ... -prompt explain this repo

and also this is gone. No warning, exit 0. And the unquoted form — the
natural thing to type — loses almost everything:

$ go-code explain this repo      # ran as -prompt explain

Why it hid for so long

The run looks successful, and a truncated prompt often still produces plausible
output, so nothing signals the loss. No test covered multi-argument prompt mode.

Cause

The prompt branch of the argument case took only the first positional:

    *)
      mode="prompt"
      prompt="$1"
      ;;

The CLI branch immediately above captures the rest with cli_args=("$@"), and
the flag branches die on anything unknown. Prompt mode was the only path that
accepted input and then threw part of it away.

Fix

Refuse, and name the fix:

[go-code] ERROR: unexpected extra argument: this. Quote the whole prompt as one
argument, e.g. go-code "explain this repo"

The message reconstructs the correct command rather than only complaining.

Joining the arguments was considered and rejected. Joining guesses at intent
and silently reinterprets a shell-splitting mistake; refusing teaches the rule
once. It also matches the wrapper's existing style, which rejects unknown flags
rather than ignoring them.

Verification

Red first — the wrapper exited 0 with harnesscli invoked on the truncated
prompt:

--- FAIL: TestGoCodeScriptRejectsExtraPromptArguments/extra_positional_arguments_are_refused
    expected a non-zero exit when extra prompt arguments are given, got success

The test asserts the user-visible consequence — either the whole prompt reaches
harnesscli, or the wrapper refuses and says why — not an internal variable. It
carries a control asserting a single quoted prompt still passes through whole,
so a fix that refused everything would fail.

All wrapper tests green. The refusal was read in a real terminal, not just
asserted, since the wording is the deliverable here.

How it was found

By the untrusted external reviewer (gpt-6-astra via the Surplus proxy) reading
only the script, with no tools — then confirmed by running the stub
reproduction rather than by reading.

Honest hit rate on that review: six findings on this file, of which two
confirmed (this, plus a narrow spawn-to-trap orphan window), three
legitimate low-severity hardening (PID reuse in stop_server, predictable tmp
paths, unvalidated HARNESS_ADDR), and one rejected as speculative (a
--server ownership race with no concrete failure, already covered by
STARTED_BY_US). The remaining five are tracked separately rather than bundled
in here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WJGxhoFhA8JjkwZFcLGdS5

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.