From ac60c3a42d19dbfaa3c14c8a4047666e2a3d70cd Mon Sep 17 00:00:00 2001
From: Gracy769 <169199616+Gracy769@users.noreply.github.com>
Date: Sun, 30 Aug 2026 09:18:20 +0530
Subject: [PATCH] docs(test): document junction UNC limitation and add mocked
 UNC link escape test

---
 tests/test_security_scope.py | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tests/test_security_scope.py b/tests/test_security_scope.py
index b81242fe..ac56a384 100644
--- a/tests/test_security_scope.py
+++ b/tests/test_security_scope.py
@@ -152,6 +152,20 @@ class WorkspacePathScopeTests(unittest.TestCase):
                 self.assertFalse(decision.allowed)
                 self.assertIn('outside workspace scope', decision.reason)
 
+    def test_symlink_resolving_to_unc_escape_mocked(self) -> None:
+        """Verify containment check denies links resolving to remote/UNC targets."""
+        with tempfile.TemporaryDirectory() as tmp:
+            workspace = Path(tmp) / 'workspace'
+            workspace.mkdir()
+            scope = WorkspacePathScope.from_root(workspace)
+
+            from unittest.mock import patch
+            unc_target = Path(r'\\remote-server\share\secret.txt')
+            with patch.object(Path, 'resolve', return_value=unc_target):
+                decision = scope.validate_path(str(workspace / 'net-link' / 'secret.txt'))
+                self.assertFalse(decision.allowed)
+                self.assertIn('outside workspace scope', decision.reason)
+
     def test_glob_expansion_must_stay_inside_workspace(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             root = Path(tmp)