shellmcp: bwrap read-only sandbox with hidden paths

2026-11-05 10:17:15 +01:00
parent 95efaa5dfd
commit b95c3d662b
2 changed files with 26 additions and 0 deletions
@@ -30,3 +30,17 @@ class Run(unittest.TestCase):

    def test_no_stdin_and_no_pager(self):
        self.assertEqual(shellmcp.run("cat; echo $PAGER", HERE), "exit code 0\ncat\n")
+
+@unittest.skipUnless(shutil.which("bwrap"), "needs bwrap")
+class Sandbox(unittest.TestCase):
+    def test_readonly_cannot_write_and_hides_paths(self):
+        with tempfile.TemporaryDirectory(dir=HERE) as d:  # not /tmp: the sandbox replaces /tmp
+            os.mkdir(os.path.join(d, "secret"))
+            open(os.path.join(d, "secret", "key"), "w").close()
+            prefix = shellmcp.sandbox(d, [os.path.join(d, "secret")])
+            out = shellmcp.run("touch new; ls secret; echo > /tmp/x && echo tmp-ok", d,
+                               prefix=prefix)
+            self.assertIn("Read-only file system", out)
+            self.assertNotIn("key", out)
+            self.assertIn("tmp-ok", out)
+            self.assertFalse(os.path.exists(os.path.join(d, "new")))