ROADMAP-03 — P0 — read_file byte cap checked on stat but enforced by a second open (TOCTOU) #95

Series: ROADMAP — filed from the 2026-10-27 whole-project assessment · Backlog task: M14-T03 · Priority: P0 · Effort: extra small

Problem

read_file checks the byte cap with stat().st_size, then re-opens the file with read_text(). Between the check and the read, the file can grow — the grown portion is read unbounded (time-of-check / time-of-use gap). Everything else about the sandbox (path containment, symlink defense, FIFO/device blocking) is solid.

Evidence

• agentkit/tools/builtin/read_file.py:53–57 — the stat size check
• agentkit/tools/builtin/read_file.py:60 — the second open() / read_text() call

Suggested fix / acceptance criteria

• Enforce the cap on the actual read: one open, read(max_bytes + 1), then truncate/validate
• Unit test covers the grow-between-check-and-read path (mock or two-stage write)

Suggested branch / commit

fix/read-file-post-read-bound · fix(tools): enforce read_file byte cap on the actual read