Node ≥22 emits on every tools/council.mjs run (and would on doctor's live checks):
(node:37912) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
Pre-existing before PR #11 (council.mjs has used shell:true since the council layer landed); observed during PR #11 verification. Harmless today — argv is fixed flags only, prompts travel over stdin — but the deprecation means a future Node major may hard-break the spawn.
Fix direction when it bites: resolve the opencode shim path explicitly (e.g. where.exe opencode / process.env.PATHEXT walk, or spawn cmd.exe /c opencode … with args in the single command string) and drop shell:true. Applies to tools/council.mjs (runOnce) and tools/doctor.mjs (oc()).
Not urgent; kit works on Node 20/22. Revisit at the next Node LTS bump.
Node ≥22 emits on every
tools/council.mjsrun (and would on doctor's live checks):Pre-existing before PR #11 (council.mjs has used
shell:truesince the council layer landed); observed during PR #11 verification. Harmless today — argv is fixed flags only, prompts travel over stdin — but the deprecation means a future Node major may hard-break the spawn.Fix direction when it bites: resolve the
opencodeshim path explicitly (e.g.where.exe opencode/process.env.PATHEXTwalk, or spawncmd.exe /c opencode …with args in the single command string) and dropshell:true. Applies totools/council.mjs(runOnce) andtools/doctor.mjs(oc()).Not urgent; kit works on Node 20/22. Revisit at the next Node LTS bump.