Inline or joking /goal mention can start a persistent goal without confirmation

What issue are you seeing?

Component: Codex App Server / Goal tool
Version: codex-cli 0.149.0
Platform: Linux

An ordinary user message sent through App Server turn/start contained an inline, joking mention of /goal. It was not a native slash-command invocation and the message did not consist solely of a goal command.

The model nevertheless called create_goal. The persistent goal became active immediately, with no user-visible confirmation step.

Sanitized example preserving the relevant shape:

haha, maybe I should /goal rebuild an imaginary demo project...

This appears to be a model-mediated tool call rather than the client slash-command parser. The tool contract requires an explicit user request, but an inline or joking mention was treated as explicit authorization.

The goal became active and the model began executing commands under it (read-only research in this instance). It was stopped only by manual user cancellation from the client; no confirmation step existed at any point.

What steps can reproduce the bug?

1. Enable Goals.
2. Send a normal user turn through Codex App Server turn/start.
3. Put /goal inside a larger joking or hypothetical sentence rather than invoking it as a standalone composer command.
4. Observe whether the model calls create_goal.
5. If it does, observe that persistent Goal mode starts immediately without a separate confirmation.

This was observed once in a real session. It may be model-dependent rather than deterministic.

What is the expected behavior?

At least one of the following should hold:

• Goal creation is accepted only from an exact, standalone top-level /goal <objective> command parsed by the client.
• Inline mentions, quotations, jokes, examples, and reported speech never authorize create_goal.
• If the model infers goal intent from ordinary natural-language text, the UI asks for explicit confirmation before creating persistent state.
• Goal provenance distinguishes a native slash command from a model-inferred tool call.

A durable multi-turn objective should not start solely because the model interprets an ambiguous inline string as explicit authorization.

Additional information

No private session logs, paths, identifiers, project names, or original conversation content are included here.

Official documentation describes /goal as a composer slash command and says to use it to start Goal mode. The observed input entered as an ordinary App Server user turn instead.

Trace App Server turn/start handling for ordinary user text into the Goal tool's create_goal call, and compare it with the native /goal composer command path. Check how goal provenance and confirmation are represented; done means inline, quoted, joking, or model-inferred mentions cannot activate persistent Goal mode without explicit confirmation.