Fix security issues in find-wild and temp file handling

[merefield]

Summary

• remove eval from the find-wild tool and validate the search path
• move persistent history into the CLAI state directory instead of fixed /tmp files
• replace fixed payload/response/tool log files with secure mktemp session files and clean them up on exit
• add Bats coverage for the find-wild fix and session-file cleanup behavior

Verification

• make lint
• make test

Fixes #1
Fixes #2

[Copilot]

Pull request overview

This PR hardens CLAI’s tool execution and on-disk data handling by removing eval from find-wild, moving persistent history into an XDG state directory, and switching predictable /tmp artifacts to per-session mktemp files with cleanup.

Changes:

• Remove eval from tools/find-wild.sh and add basic directory validation before running find.
• Store persistent history under ${XDG_STATE_HOME:-~/.local/state}/clai/ and write payload/response/tool logs to secure mktemp files tracked for cleanup on exit.
• Add Bats coverage for find-wild behavior and for transient temp-file cleanup on transport failures.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/find-wild.sh	Replaces eval-based find invocation with direct execution and directory validation.
clai.sh	Introduces XDG state dir, secure temp session files, and EXIT cleanup hook; updates logging/payload/response/history paths.
test/smoke.bats	Ensures CLAI creates state dir and cleans up temp session files after failures.
test/find_wild.bats	Adds regression tests for the updated find-wild behavior.
README.md	Documents new state/temp-file behavior and updates credits/test descriptions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.