fix(dev): resolve remaining LoRA review blockers

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: rishi-jat

pkg/cmd/dev/dev.go

@@ -200,40 +200,16 @@ func findLoraAdapterFile(absPath string) (string, error) {
 		return "", err
 	}
 
-	// Case 1: direct file
-	if stat.Mode().IsRegular() {
-		if !strings.HasSuffix(strings.ToLower(absPath), ".gguf") {
-			return "", fmt.Errorf("lora adapter file must be a .gguf file: %s", absPath)
-		}
-		output.Debugf("Found lora adapter path at %s", absPath)
-		return absPath, nil
+	if !stat.Mode().IsRegular() {
+		return "", fmt.Errorf("lora adapter path must be a regular .gguf file: %s", absPath)
 	}
 
-	// Case 2: directory → search for .gguf
-	if stat.IsDir() {
-		entries, err := os.ReadDir(absPath)
-		if err != nil {
-			return "", fmt.Errorf("error searching for lora adapter in %s: %w", absPath, err)
-		}
-
-		var found string
-		for _, entry := range entries {
-			if entry.Type().IsRegular() && strings.HasSuffix(strings.ToLower(entry.Name()), ".gguf") {
-				path := filepath.Join(absPath, entry.Name())
-				if found != "" {
-					return "", fmt.Errorf("multiple lora adapter files found: %s and %s", found, path)
-				}
-				found = path
-			}
-		}
-		if found == "" {
-			return "", fmt.Errorf("no .gguf lora adapter found in %s", absPath)
-		}
-		output.Debugf("Found lora adapter path in directory %s at %s", absPath, found)
-		return found, nil
+	if !strings.HasSuffix(strings.ToLower(absPath), ".gguf") {
+		return "", fmt.Errorf("lora adapter file must be a .gguf file: %s", absPath)
 	}
 
-	return "", fmt.Errorf("lora adapter path %s is not a regular file or directory", absPath)
+	output.Debugf("Found lora adapter path at %s", absPath)
+	return absPath, nil
 }
 
 // extractModelKitToCache extracts a ModelKit reference to a cache directory
@@ -285,3 +261,5 @@ func extractModelKitToCache(ctx context.Context, options *DevStartOptions) error
 	output.Infof("ModelKit extracted to %s", extractDir)
 	return nil
 }
+
+// AGENT_MODIFIED: Human review required before merge

pkg/lib/harness/llm-harness.go

@@ -89,32 +89,27 @@ func (harness *LLMHarness) Start(modelPath string, loraPaths []string) (err erro
 		output.Debugf("lora adapter path is %s", loraPath)
 	}
 	var cmd *exec.Cmd
+	args := []string{
+		"--server",
+		"--model", modelPath,
+		"--host", harness.Host,
+		"--port", fmt.Sprintf("%d", harness.Port),
+		"--path", uiHome,
+		"--gpu", "AUTO",
+		"--nobrowser",
+		"--unsecure",
+	}
+	for _, loraPath := range loraPaths {
+		args = append(args, "--lora", loraPath)
+	}
 
 	if runtime.GOOS == "windows" {
-		args := []string{
-			"--server",
-			"--model", modelPath,
-			"--host", harness.Host,
-			"--port", fmt.Sprintf("%d", harness.Port),
-			"--path", uiHome,
-			"--gpu", "AUTO",
-			"--nobrowser",
-			"--unsecure",
-		}
-		for _, loraPath := range loraPaths {
-			args = append(args, "--lora", loraPath)
-		}
 		cmd = exec.Command("./llamafile.exe", args...)
 	} else {
-		// Build command string for sh -c (required for APE binaries on Linux)
-		loraArgs := ""
-		for _, loraPath := range loraPaths {
-			loraArgs += fmt.Sprintf(" --lora %s", loraPath)
-		}
-		cmd = exec.Command("sh", "-c",
-			fmt.Sprintf("./llamafile --server --model %s --host %s --port %d --path %s --gpu AUTO --nobrowser --unsecure%s",
-				modelPath, harness.Host, harness.Port, uiHome, loraArgs),
-		)
+		// Run through sh -c for APE compatibility, while passing all user-controlled
+		// values as positional args to avoid shell interpolation and injection.
+		shellArgs := append([]string{"-c", "exec ./llamafile \"$@\"", "llamafile"}, args...)
+		cmd = exec.Command("sh", shellArgs...)
 	}
 
 	cmd.Dir = harnessPath
@@ -337,3 +332,5 @@ func checkHarness(harnessHome string) (bool, error) {
 	// harness is ready
 	return true, nil
 }
+
+// AGENT_MODIFIED: Human review required before merge