[Copilot]

This issue was caused by the native command dispatcher accepting any unrecognized command through a generic fallback path, which bypassed the JVM-side validation contract. That meant malformed or unsupported commands could be treated as valid and stored as the last command, creating inconsistent runtime state and hiding invalid input.

• Summary

  • Native validation now rejects unsupported command keywords instead of falling into the generic command branch.
  • The accepted command set remains aligned with the Kotlin/JVM bridge and the documented protocol surface.

• What changed

  • Native command dispatch in ClientState::dispatchCommand() now returns false for unrecognized commands, preserving the intended fail-fast behavior.
  • The valid-command canonicalization path is unchanged; only the fallback rejection path was tightened.
  • Added regression coverage in both the Kotlin bridge tests and native host tests to lock in the unsupported-command rejection behavior.

• Example

// before: unsupported commands fell through and were accepted
else {
    state_ = "command:" + sanitized;
    diagnostics_ = "Last JNI command: " + sanitized;
    return true;
}

// after: fail fast for unknown command keywords
else {
    return false;
}

• Why this matters
  • Prevents malformed input from mutating runtime state or masking bad commands as valid.
  • Keeps native and JVM validation semantics aligned, reducing drift between the two layers.