fix: sanitize source slug + replace shell execSync with execFileSync (command injection)

[jgaddis99]

Security fix — command injection via unsanitized source parameter

Vulnerability

schedule_job's source parameter was concatenated into the job slug without sanitization:

// BEFORE (line 2585)
const slug = args.source ? `${args.source}-${slugify(args.name)}` : slugify(args.name)
//                          ^^^^^^^^^^^^ not passed through slugify()

The slug flows into plistPath/legacyPlistPath, which are then shell-interpolated:

execSync(`launchctl unload "${plistPath}" 2>/dev/null`, ...)

A crafted source value such as evil"$(touch /tmp/pwned)"x breaks out of the double-quoted string and executes arbitrary commands as the current user when schedule_job is called.

The same class of issue affects the systemctl calls on Linux — job.slug is interpolated into execSync shell strings without shell escaping.

Fix

Layer 1 — sanitize at input (line 2585): run args.source through slugify() so the slug is always [a-z0-9-] only.

Layer 2 — remove the shell entirely: replace every execSync(template-string) for launchctl and systemctl calls with execFileSync(binary, args[]). No shell spawned, no injection surface regardless of what slug content looks like.

execFileSync was already imported from child_process; no new dependencies.

Affected calls fixed

• installLaunchdJob: 3 execSync launchctl calls → execFileSync
• uninstallLaunchdJob: 1 execSync launchctl call → execFileSync
• installSystemdJob: 5 execSync systemctl calls → execFileSync
• uninstallSystemdJob: 3 execSync systemctl calls → execFileSync
• isSystemdUserAvailable: 1 execSync systemctl call → execFileSync
• schedule_job execute: args.source now passes through slugify() before slug construction