Distillation

Date: Sep 8, 2026

• 🟡 (06:57) Host is running systemd 255 (255.4-1ubuntu8.17) with unified cgroup hierarchy; opencode-pty-supervisor.service failed validation because command /usr/local/libexec/opencode-pty-supervisor is not executable or does not exist.
• 🔴 (06:57) User directive: “Never pass unsanitized user input to this function.” Specifically, child_process.exec() processes its command through a shell, where shell metacharacters can enable arbitrary command execution.
• 🔴 (06:57) User directive: when child_process.execFile() has shell enabled, never pass unsanitized user input because shell metacharacters can enable arbitrary command execution.
• 🟡 (06:57) Node.js v26.4.0 documentation states child_process.execFile() directly spawns the executable without a shell by default, whereas child_process.exec() spawns a shell; child_process.spawn() also defaults to shell: false.
• 🟡 (06:57) Node.js v26.4.0 child_process.exec() defaults include cwd: process.cwd(), env: process.env, encoding: 'utf8', Unix shell '/bin/sh', timeout: 0, maxBuffer: 1024 * 1024, killSignal: 'SIGTERM', and windowsHide: false.
• 🟡 (06:57) Node.js documentation output was truncated after 67,906 bytes; the full output was saved at /home/byk/.local/share/opencode/tool-output/tool_07fcf138700197taofCkXNycBg.