fix(tools): remove shell-based ranged file reads

src/google/adk/tools/environment/_tools.py

@@ -45,6 +45,11 @@ def _truncate(text: str, limit: int = MAX_OUTPUT_CHARS) -> str:
   return text[:limit] + f'\n... (truncated, {len(text)} total chars)'
 
 
+def _is_valid_line_number(value: Any) -> bool:
+  """Returns True when *value* is a non-bool integer."""
+  return isinstance(value, int) and not isinstance(value, bool)
+
+
 _EXECUTE_TOOL_DESCRIPTION = """
 Run a shell command in the environment. For running programs, tests, and build
 commands ONLY. WARNING: Do NOT use for file reading -- use the ReadFile tool
@@ -179,18 +184,12 @@ async def run_async(
       return {'status': 'error', 'error': '`path` is required.'}
     start_line = args.get('start_line')
     end_line = args.get('end_line')
-
-    # Use `sed` to read the file if start_line or end_line are specified.
-    if (start_line and start_line > 1) or end_line:
-      start = start_line or 1
-      if end_line:
-        sed_range = f'{start},{end_line}'
-      else:
-        sed_range = f'{start},$'
-      cmd = f"cat -n '{path}' | sed -n '{sed_range}p'"
-      res = await self._environment.execute(cmd)
-      if res.exit_code == 0:
-        return {'status': 'ok', 'content': _truncate(res.stdout)}
+    for name, value in (('start_line', start_line), ('end_line', end_line)):
+      if value is not None and not _is_valid_line_number(value):
+        return {
+            'status': 'error',
+            'error': f'`{name}` must be an integer if provided.',
+        }
 
     try:
       data_bytes = await self._environment.read_file(path)

tests/unittests/tools/test_environment_tools.py

@@ -0,0 +1,92 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Tests for environment tools."""
+
+from pathlib import Path
+
+from google.adk.environment._local_environment import LocalEnvironment
+from google.adk.tools.environment._tools import ReadFileTool
+import pytest
+import pytest_asyncio
+
+
+@pytest_asyncio.fixture(name='env')
+async def _env(tmp_path: Path):
+  """Create and initialize a LocalEnvironment backed by a temp directory."""
+  environment = LocalEnvironment(working_dir=tmp_path)
+  await environment.initialize()
+  yield environment
+  await environment.close()
+
+
+class TestReadFileTool:
+  """Verifies file reads stay within Python file I/O."""
+
+  @pytest.mark.asyncio
+  async def test_ranged_read_returns_selected_lines(
+      self, env: LocalEnvironment
+  ):
+    """Reads the requested line range and preserves line numbers."""
+    await env.write_file('sample.txt', 'line1\nline2\nline3\n')
+
+    tool = ReadFileTool(env)
+    result = await tool.run_async(
+        args={'path': 'sample.txt', 'start_line': 2, 'end_line': 3},
+        tool_context=None,
+    )
+
+    assert result == {
+        'status': 'ok',
+        'content': '     2\tline2\n     3\tline3\n',
+        'total_lines': 3,
+    }
+
+  @pytest.mark.asyncio
+  async def test_ranged_read_missing_file_returns_error(
+      self, env: LocalEnvironment
+  ):
+    """Returns a missing-file error for ranged reads."""
+    tool = ReadFileTool(env)
+
+    result = await tool.run_async(
+        args={'path': 'missing.txt', 'start_line': 2},
+        tool_context=None,
+    )
+
+    assert result == {
+        'status': 'error',
+        'error': 'File not found: missing.txt',
+    }
+
+  @pytest.mark.asyncio
+  async def test_ranged_read_rejects_non_integer_end_line(
+      self, env: LocalEnvironment
+  ):
+    """Rejects non-integer line numbers without executing shell syntax."""
+    await env.write_file('sample.txt', 'line1\nline2\n')
+    marker = env.working_dir / 'marker.txt'
+    injected_end_line = f"1'; touch {marker}; echo '"
+
+    tool = ReadFileTool(env)
+    result = await tool.run_async(
+        args={'path': 'sample.txt', 'end_line': injected_end_line},
+        tool_context=None,
+    )
+
+    assert result == {
+        'status': 'error',
+        'error': '`end_line` must be an integer if provided.',
+    }
+    assert not marker.exists()