docs: update all docs for security hardening, respawn fix, and test fixes

- CLAUDE.md: idle detection cancellation on substantial output, API input
  limits table, configure() method on RalphTracker, tighter completion
  pattern description
- ralph-wiggum-guide: add configure() to tracker methods table
- Both docs: update Last Updated date to 2026-01-24

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CLAUDE.md

@@ -385,12 +385,12 @@ curl -X POST localhost:3000/api/sessions/:id/input \
 ### Idle Detection
 
 **RespawnController (Claude Code 2024+)**: Multi-layer detection with confidence scoring:
-1. **Completion message**: Primary signal - detects "for Xm Xs" time patterns (e.g., "Worked for 2m 46s")
+1. **Completion message**: Primary signal - detects "Worked for Xm Xs" time patterns (requires "Worked" prefix to avoid false positives)
 2. **Output silence**: Confirms idle after `completionConfirmMs` (10s) of no new output
 3. **Token stability**: Tokens haven't changed
 4. **Working patterns absent**: No `Thinking`, `Writing`, spinner chars
 
-Uses `confirming_idle` state to prevent false positives. Fallback: `noOutputTimeoutMs` (30s) if no output at all.
+Uses `confirming_idle` state to prevent false positives. Cancels idle confirmation if substantial output (>2 chars after ANSI stripping) arrives during the wait. Fallback: `noOutputTimeoutMs` (30s) if no output at all.
 
 **Step Confirmation**: After sending each respawn step (update, init, kickstart), the controller waits for the same `completionConfirmMs` silence before proceeding. This ensures Claude finishes processing each prompt before the next command is sent.
 
@@ -455,6 +455,7 @@ See `src/ralph-config.ts` for parsing logic.
 - Switch tabs → Panel shows tracker for active session
 - `tracker.reset()` → Clears todos/state, keeps enabled status
 - `tracker.fullReset()` → Complete reset to initial state
+- `tracker.configure({ enabled?, completionPhrase?, maxIterations? })` → Partial config update from external state
 
 **API**:
 - `GET /api/sessions/:id/ralph-state` - Get loop state and todos
@@ -716,6 +717,16 @@ Long-running sessions are supported with automatic trimming:
 | POST | `/api/spawn/trigger` | Programmatic spawn (bypass terminal detection) |
 | POST | `/api/hook-event` | Receive Claude Code hook callbacks. Body: `{event, sessionId, data?}`. Data fields forwarded to SSE broadcast |
 
+### API Input Limits
+
+| Limit | Value | Endpoint |
+|-------|-------|----------|
+| Input length | 64KB | `/api/sessions/:id/input` |
+| Terminal cols | 500 | `/api/sessions/:id/resize` |
+| Terminal rows | 200 | `/api/sessions/:id/resize` |
+| Session name | 128 chars | Session rename |
+| Hook data | 8KB | `/api/hook-event` (sanitized + truncated) |
+
 ## Keyboard Shortcuts (Web UI)
 
 | Shortcut | Action |

docs/claude-code-hooks-reference.md

@@ -2,7 +2,7 @@
 
 > Official documentation for Claude Code hooks system, extracted from [code.claude.com](https://code.claude.com/docs/en/hooks).
 
-**Last Updated**: 2026-01-23
+**Last Updated**: 2026-01-24
 **Source**: [Claude Code Hooks Documentation](https://code.claude.com/docs/en/hooks)
 
 ---

docs/ralph-wiggum-guide.md

@@ -2,7 +2,7 @@
 
 > This document consolidates official Anthropic documentation, community best practices, and implementation details for autonomous Claude Code loops.
 
-**Last Updated**: 2026-01-23
+**Last Updated**: 2026-01-24
 **Sources**: [Official Anthropic Plugin](https://github.com/anthropics/claude-code/tree/main/plugins/ralph-wiggum), [Claude Code Docs](https://code.claude.com/docs/en/hooks), [Claude Code Best Practices](https://www.anthropic.com/engineering/claude-code-best-practices)
 
 ---
@@ -670,6 +670,7 @@ Each session has its **own independent tracker**:
 | Switch tabs | Panel shows tracker for active session |
 | `tracker.reset()` | Clears todos/state, keeps enabled status |
 | `tracker.fullReset()` | Complete reset to initial state |
+| `tracker.configure({...})` | Partial config update (enabled, completionPhrase, maxIterations) |
 
 ### State Structure