fix: name the model in the flashAttn refusal so the message is not a constant

[bernardladenthin]

Summary

Fixes main, which went red on run 33479921629 right after #194 merged.

• Both failing jobs have the same single cause. The job named Code style (spotless) did not fail on Spotless, and the Test job did not fail on a test — its own run was Tests run: 639, Failures: 0, Errors: 0, Skipped: 0. Both hit the same SpotBugs finding, because the test job runs verify and spotbugs:check is bound there:

  [ERROR] Low: Method LlamaCppJniAiGenerationProvider.model() throws exception with
  static message string — WEM_WEAK_EXCEPTION_MESSAGING  at line 178
  

• Not suppressed, because the finding points at something real. This guard runs on the direct-API path, where there is no aiDefinition key to name — the plan-time guard in EngineSupport already prefixes that one, which is exactly why it was not flagged. So a caller running several models was told what is wrong but not which configuration to change. The message now leads with the model path, matching the shape EngineSupport already uses.

• The knob-sweep assertion moves from equality to containsString, and additionally pins that the model path is present — so the prefix cannot be dropped again without a test noticing.

Test plan

• mvn -pl srcmorph,srcmorph-cli,srcmorph-maven-plugin spotless:check — BUILD SUCCESS (the exact command the job runs)
• mvn -DskipTests -Denforcer.skip=true -pl srcmorph,srcmorph-cli,srcmorph-maven-plugin compile spotbugs:check — BUILD SUCCESS, BugInstance size is 0 in all three modules (the exact command that failed)
• LlamaCppJniKnobSweepTest, EngineSupportTest, LlamaCppJniAiGenerationProviderTest — 81 tests, 0 failures
• CI is green on this branch
• Docs / CHANGELOG updated where applicable — not applicable; the 1.2.0 entry already describes the refusal, and its wording does not quote the message

Why it escaped the pre-merge checks, stated plainly: spotbugs:check is bound to verify, and what I ran locally was mvn test and mvn -P release package -DskipTests, both of which stop before it. The gate existed; I did not run it. This time the two failing commands were run verbatim before pushing.

Related issues / PRs

Follows #194.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes

---

Generated by Claude Code

[claude]

Review Summary

This is a well-executed fix that addresses both the SpotBugs finding and improves user experience. ✅

Strengths:

1. Root Cause Fix — Rather than suppressing the warning, the fix improves the underlying issue by including the model path in the error message, making it actionable for users running multiple models.

2. Consistency — The message format matches the pattern already established in EngineSupport's plan-time guard, ensuring consistent error messages across both code paths.

3. Clear Rationale — The comment explaining why the model path is necessary (not decoration) is precise and documents the SpotBugs finding context.

4. Defensive Testing — The test change from equality to containsString is the right approach, and additionally verifying the model path is present prevents silent regression.

5. Low Risk — Changes are minimal and focused. String concatenation is safe (single throw, not in a loop; config.modelPath() guaranteed non-null at this point).

Minor observation:

The PR description's explanation of why this wasn't caught earlier (spotbugs:check bound to verify, not test or package) is helpful context for future preventative measures. The reminder to run the full verification lifecycle is noted.

Looks good to merge. 👍

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud