[Bug] Readonly whitelist commands (find/fd, sed, rg, sort) have unguarded exec/delete arguments

[Prodesire]

Bug Description

Several commands in the readonly whitelist have arguments that execute arbitrary commands or delete files, but the permission engine does not check for these dangerous arguments.

1. find / fd — delete and exec arguments bypass permission

Files: src/iac_code/tools/bash/readonly_commands.py:38-39, src/iac_code/tools/bash/path_validation.py:16

find and fd are in _READONLY_BASE_COMMANDS, but there is no check for -delete, -exec, -execdir, -ok (find) or -x, -X, --exec (fd). Path constraints and sensitive path checks only cover _PATH_COMMANDS / _WRITE_COMMANDS, not these search commands.

Verified: find . -delete, find . -exec sh -c 'echo marker' \;, and fd . -x sh -c 'echo marker' all return allow.

2. sed — GNU e command executes shell

Files: src/iac_code/tools/bash/readonly_commands.py:74, src/iac_code/tools/bash/readonly_commands.py:111-119

The code only detects sed -i (in-place edit), but not sed -n '1e cmd' file or sed 's/.*/cmd/e' file. On GNU sed, the e command/flag executes shell commands, and the permission engine still returns allow.

Verified: sed -n '1e echo marker' file.txt and sed 's/.*/echo marker/e' file.txt both return allow.

3. rg and sort — execution via --pre and --compress-program

Files: src/iac_code/tools/bash/readonly_commands.py:47-75

ripgrep's --pre / --pre=... runs a preprocessor command for each searched file. GNU sort's --compress-program=... executes the specified program for external sort temp files.

Verified: rg --pre 'sh -c echo-marker' needle . and sort --compress-program=sh file.txt both return allow.

Expected Behavior

The readonly whitelist should be "command + safe argument subset", not just basename. Commands with execution, deletion, or write-back arguments should require user confirmation.

Actual Behavior

All of the above commands are auto-approved as read-only regardless of dangerous arguments.

Suggested Fix

• For find/fd: Add argument-level deny/ask rules for -delete, -exec, -execdir, -ok, -x, -X, --exec. Only allow safe subsets like -name, -type, -maxdepth.
• For sed: Detect e command and s///e flag; conservatively ask for non-simple sed scripts.
• For rg: Deny/ask when --pre is present.
• For sort: Deny/ask when --compress-program is present.
• Consider a general approach: for each whitelisted command, maintain an explicit list of allowed flags, and ask for anything else.