Telegram text can contain newlines; /model and /fallback wrote their argument into .env verbatim, letting an allow-listed chat inject arbitrary env lines (e.g. CLAUDE_BIN=..., executed on the next restart). Validate model names against a strict pattern, collapse CR/LF in set_env_var() as a backstop, and collapse CR/LF in persona values in persona_set_env() (reached via ogmactl set-persona). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>