fix: eliminate TOCTOU races in catalog_fetch() for file:// and bare path URLs

Remove exists() pre-checks and catch FileNotFoundError from read_text()
for both file:// and bare path catalog sources. Also catches
OSError/UnicodeError to preserve the decode-error wrapping contract.

Add regression test for the TOCTOU fix covering both file:// URLs and
bare paths: mocked Path is observable as present (exists() returns True)
but read_text() raises FileNotFoundError, proving the exists() removal
eliminates the race window.

Co-authored-by: GitHub Copilot (model: mimo-v2.5-free, supervised)

Author: Quratulain-bilal

src/specify_cli/bundler/services/adapters.py

@@ -147,13 +147,17 @@ def fetch(source: CatalogSource) -> dict:
                 return loads_json(path.read_text(encoding="utf-8"), origin=str(path))
             except FileNotFoundError:
                 raise BundlerError(f"Catalog file not found: {path}") from None
+            except (OSError, UnicodeError) as exc:
+                raise BundlerError(f"Could not read {path}: {exc}") from exc
 
         if scheme == "" or _is_windows_drive_path(url):
             path = Path(url)
             try:
                 return loads_json(path.read_text(encoding="utf-8"), origin=str(path))
             except FileNotFoundError:
                 raise BundlerError(f"Catalog file not found: {path}") from None
+            except (OSError, UnicodeError) as exc:
+                raise BundlerError(f"Could not read {path}: {exc}") from exc
 
         if scheme in ("http", "https"):
             if not allow_network:

tests/unit/test_bundler_adapters.py

@@ -1,6 +1,9 @@
 """Unit tests for catalog-fetch adapters (auth + redirect safety)."""
 from __future__ import annotations
 
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
 import pytest
 
 from specify_cli.bundler import BundlerError
@@ -201,3 +204,25 @@ def test_validate_remote_url_rejects_malformed_url_cleanly(url):
     caller. Bundler sibling of #3369."""
     with pytest.raises(BundlerError):
         adapters._validate_remote_url("team", url)
+
+
+@pytest.mark.parametrize("use_file_url", [False, True], ids=["path", "file-url"])
+def test_local_catalog_toctou_race(tmp_path, use_file_url):
+    """Regression guard: a file that disappears between the old exists() pre-check
+    and read_text() must raise BundlerError, not a raw FileNotFoundError.
+
+    The mocked Path is observable as present (exists() returns True) but
+    read_text() raises FileNotFoundError, simulating a deletion between the two
+    calls — the exact race window the exists() removal eliminates."""
+    catalog_path = tmp_path / "catalog.json"
+    url = catalog_path.as_uri() if use_file_url else str(catalog_path)
+
+    mock_path = MagicMock(spec=Path)
+    mock_path.exists.return_value = True
+    mock_path.read_text.side_effect = FileNotFoundError(str(catalog_path))
+
+    fetcher = adapters.make_catalog_fetcher(allow_network=False)
+
+    with patch.object(adapters.Path, "__new__", return_value=mock_path):
+        with pytest.raises(BundlerError, match="Catalog file not found"):
+            fetcher(_source(url))