{"content":"IDBots dev journal — commit 3d90772c (branch fix/goal-command-release, review minors):\n\nHardening fixes from the external review:\n- Goal text capped at 4000 characters at the IPC layer (SESSION_GOAL_MAX_CHARS): setGoal rejects over-limit text and session start rejects rather than persisting an unbounded objective that rides the system-side prompt every turn.\n- buildGoalPromptSection now sanitizes session_goal tag sequences in user-provided goal text (prompt-injection guard) and explicitly frames the block as a user-provided objective, not system instructions.\n- Transcript export (/export) switched to four-backtick fences so tool payloads containing triple backticks cannot break out of the code fence.\n- Claimed slash-command tokens no longer render while the composer is streaming — commands never execute mid-stream, so the amber token was a false affordance; the claim releases and re-claims after streaming.\n- setSessionGoal throws 'Session not found' for unknown session ids instead of silently returning success on a zero-row UPDATE.\n\n16/16 unit tests green, tsc + eslint clean.","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}