Codex CLI emits unescaped paths; zsh globbing breaks on `()`/`[]`

What version of Codex is running?

0.72.0 (Homebrew)

What subscription do you have?

Which model were you using?

N/A (shell command generation issue, affects all models)

What platform is your computer?

macOS Tahoe v26.1

What issue are you seeing?

Codex emits unquoted paths containing glob metacharacters ((), [], *, ?). zsh interprets these as glob patterns and fails:

sed -n '1,220p' portal/app/(home)/_ui/ActivityList.tsx
# zsh:1: no matches found: portal/app/(home)/_ui/ActivityList.tsx

What steps can reproduce the bug?

1. Have a file with parentheses in path (e.g., Next.js route group): app/(home)/page.tsx
2. Let Codex try to read it
3. zsh fails on the unquoted glob pattern

What is the expected behavior?

Paths should be quoted or escaped:

sed -n '1,220p' 'portal/app/(home)/_ui/ActivityList.tsx'

Additional information

Impact: Breaks Next.js App Router projects (route groups use (), dynamic routes use []).

Fix: Either shell-escape paths or avoid shell execution for file reads (use argv arrays instead).

Workarounds: Add AGENTS.md rule to quote paths, or change zsh config—neither acceptable as default UX.