fix: enhance prompt (#36)

* Enforce verbatim input buffer prefix and add few-shot examples in
system prompt
* Omit empty context fields and format recent commands line by line
* Wrap untrusted data (`GitStatus`, `RecentCmds`, `DynamicContext`, and
`PreviousCommand`) in an explicit security boundary to prevent prompt
injection vectors
* Optimize string formatting with direct `fmt.Fprintf` inside
`BuildCompletionPrompt` to resolve `QF1012` staticcheck warnings
* Restore exact character prefix in `NormalizeSuggestion` to keep
`ShouldOverwrite` logic accurate
* Auto-join all continuation suffix completions (flags, quotes, regular
word arguments, and filenames) and insert a separating space whenever
the buffer ends in an ordinary word character
* Replace byte-indexed slicing with rune-safe slices (`[]rune`) and
`strings.EqualFold` to guarantee valid UTF-8 boundaries and prevent
panics on multi-byte characters
* Update and verify all unit tests (`go test -race ./internal/ai/...`)
with zero impact on other branches

internal/ai/utils.go

@@ -38,6 +38,7 @@ func CleanSuggestion(raw string) string {
 }
 
 func NormalizeSuggestion(buf string, suggCmd string) string {
+	rawCmd := strings.TrimSpace(suggCmd)
 	suggCmd = CleanSuggestion(suggCmd)
 
 	if strings.Contains(buf, "-m \"") || strings.Contains(buf, "-am \"") || strings.Contains(buf, "--message \"") {
@@ -55,6 +56,28 @@ func NormalizeSuggestion(buf string, suggCmd string) string {
 		}
 	}
 
+	if buf != "" {
+		bufRunes := []rune(buf)
+		suggRunes := []rune(suggCmd)
+		if len(suggRunes) >= len(bufRunes) && strings.EqualFold(string(suggRunes[:len(bufRunes)]), buf) {
+			suggCmd = buf + string(suggRunes[len(bufRunes):])
+		} else if fields := strings.Fields(buf); len(fields) > 0 && len(suggCmd) > 0 {
+			firstWord := strings.ToLower(fields[0])
+			suggLow := strings.ToLower(suggCmd)
+			if !strings.HasPrefix(suggLow, firstWord) && !strings.HasPrefix(suggLow, "sudo ") {
+				delta := suggCmd
+				if strings.HasPrefix(rawCmd, "-") || strings.HasPrefix(rawCmd, "\"") || strings.HasPrefix(rawCmd, "'") {
+					delta = rawCmd
+				}
+				if strings.HasSuffix(buf, " ") || strings.HasSuffix(buf, "\"") || strings.HasSuffix(buf, "'") || strings.HasSuffix(buf, "=") || strings.HasSuffix(buf, "/") {
+					suggCmd = buf + delta
+				} else {
+					suggCmd = buf + " " + delta
+				}
+			}
+		}
+	}
+
 	return suggCmd
 }