opencode-goal-plugin 0.1.11 → 0.1.12

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+## 0.1.12 — 2026-06-08
+
+- Harden `escapeGoalText` to escape all XML closing tags (`</` → `<\/`) instead of only `</goal_objective>`, closing a prompt-injection path where user-supplied goal text could break structural framing in the continuation message.
+- Add unit tests for `outputTokensForMessage`, `budgetWrapupNeeded`, `getSessionID`, `stopReason`, `normalizeOptions` boundary inputs (zero, negative, NaN, null, `budgetWrapupRatio` at 0 and 1), and `escapeGoalText` covering all structural tags.
+
 ## 0.1.11 — 2026-06-04
 
 - Add `npm run smoke`, a package-export smoke test that exercises the `/goal` command hook without invoking a model.

package/CONTRIBUTING.md

@@ -17,6 +17,7 @@ npm test
 npm run test:coverage
 npm run smoke
 npm run check
+npm run smoke
 npm run pack:check
 ```
 
@@ -46,6 +47,10 @@ Before publishing or tagging a release:
 - perform at least one manual OpenCode smoke test if hook behavior changed
 - refresh compatibility notes if the tested OpenCode surface changed
 
+`npm run smoke` verifies the published package entrypoint and `/goal` command hook without
+invoking a model. It does not replace a manual OpenCode smoke test after hook or command
+behavior changes.
+
 ## Pull Requests
 
 Keep pull requests focused. Include:

package/README.md

@@ -226,12 +226,6 @@ Keep test files outside OpenCode's auto-loaded plugin directory — OpenCode wil
 6. Verify `/goal status`, `/goal pause`, `/goal resume`, and `/goal clear` behave as expected.
 7. If you changed hook payload handling or command behavior, repeat the smoke test against the exact OpenCode version and provider/backend combination you care about.
 
-### Release checklist
-
-- Confirm `npm test`, `npm run test:coverage`, `npm run check`, `npm run smoke`, and `npm run pack:check` all pass.
-- Re-test against a real OpenCode install when touching command hooks, idle-event handling, or system-prompt transforms.
-- Update compatibility notes and changelog entries when behavior or tested surfaces change.
-
 ## Development
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-goal-plugin",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Session-scoped /goal workflow for OpenCode.",
   "type": "module",
   "main": "./src/goal-plugin.js",

package/src/goal-plugin.js

@@ -686,7 +686,9 @@ function buildLimitWarning(goal) {
 }
 
 function escapeGoalText(text) {
-  return String(text).replaceAll("</goal_objective>", "<\\/goal_objective>")
+  // Escape every XML closing tag so user-supplied goal text cannot break the
+  // structural framing used in buildGoalBlock and buildContinueMessage.
+  return String(text).replaceAll("</", "<\\/")
 }
 
 function buildGoalBlock(goal) {