fix(security): potential command injection on windows due to `she (#439)

The process is spawned with `shell: process.platform === 'win32'` while including dynamic values (e.g., `opts.sessionId`) in `args`. On Windows, shell invocation can introduce command parsing/injection risks if arguments are not strictly validated/escaped.

Affected files: opencodeLocal.ts

Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

cli/src/opencode/opencodeLocal.ts

@@ -9,6 +9,9 @@ export async function opencodeLocal(opts: {
 }): Promise<void> {
     const args: string[] = [];
     if (opts.sessionId) {
+        if (process.platform === 'win32' && /[&|<>^()%!"\r\n]/u.test(opts.sessionId)) {
+            throw new Error('Invalid sessionId');
+        }
         args.push('--session', opts.sessionId);
     }