File reads via `sed` vulnerable to shell interpolation.

What version of Codex is running?

0.42.0

Which model were you using?

gpt-5-codex

What platform is your computer?

Linux 6.12.46 x86_64 unknown

What steps can reproduce the bug?

Add a file like routes/dynamic.$parameter.ts, ask codex to read the file.

What is the expected behavior?

File name should be properly quoted / escaped.

What do you see instead?

$parameter gets interpolated, sed command errors out.

Additional information

_No response_