Module embedded_python 

Available on crate features code and embedded-python only.

Embedded Python executors backed by the Pydantic Monty interpreter.

MontyExecutorBuilder configures OS-access grants, host functions, and resource limits once, then produces either executor product:

• build_one_shot → MontyOneShotExecutor — a fresh interpreter per execute call, no state persists;
• build_repl → MontyReplExecutor — interpreter state (variables, function definitions, imports) persists across calls.

Security Model

Isolation combines explicit policy with enforcement by omission:

• Explicit policy. Every OS call Monty can emit — filesystem reads/writes, os.getenv/os.environ, date.today()/datetime.now() — is serviced in place against the filesystem roots, environment variables, and clock the host grants at construction. Ungranted access raises a catchable Python OSError in-script.
• Enforcement by omission. Monty has no network or subprocess surface at all, so those remain impossible regardless of configuration.
• Grants vs. request policy. The builder’s grants are the maximum access any script can have; the per-request SandboxPolicy may only narrow within them. A grant covers its entire directory subtree, so a request for a granted mount or any subdirectory of one succeeds. A request exceeding the grants is rejected fail-closed with ExecutionError::UnsupportedPolicy naming the excess path or variable, before any code runs. FilesystemPolicy::None / EnvironmentPolicy::None simply grant nothing for that call.
• Boundary enforcement is delegated. The mount boundary (canonicalization + symlink-escape detection) is enforced by the monty-fs crate, pinned to an exact 0.0.x release in Cargo.toml. Bumping that pin is a security-relevant change and warrants re-review of its path-resolution behavior.
• Host functions run as host code. Registered HostFunctions are the user’s own trust boundary, not Monty’s — the interpreter sandbox does not contain their side effects.
• Timeouts. SandboxPolicy::timeout bounds interpreter time via Monty’s ResourceLimits::max_duration (real preemption). Host-function execution gets its own wall-clock bound (host_function_timeout).
• REPL memory accounting. The resource tracker is serialized with the session, so max_memory bounds the cumulative session heap, not per-call allocation. The per-call time budget is reset on every call.

Example

use std::sync::Arc;
use adk_code::{MontyExecutorBuilder, PathAccess};
use serde_json::json;

let builder = MontyExecutorBuilder::new()
    .allow_path("/data", "/srv/agent/data", PathAccess::ReadOnly)
    .allow_path("/out", "/srv/agent/out", PathAccess::ReadWrite)
    .environ_var("PROJECT", "acme")
    .system_clock()
    .function_fn("row_count", "Count rows in the loaded dataset.", |args, _kwargs| async move {
        Ok(json!(args.len()))
    })
    .max_memory(64 * 1024 * 1024);

let one_shot = builder.clone().build_one_shot()?;
let repl = builder.build_repl()?;

Modules

monty

monty

monty_fs

Filesystem mounting system for sandboxed execution.

monty_types

monty-types

Structs

HostFunctionError

Error raised by a HostFunction implementation.

MontyExecutorBuilder

Configures OS-access grants, host functions, and resource limits for the Monty executors, then produces either product with a terminal build method.

MontyOneShotExecutor

One-shot Monty executor: a fresh interpreter per execute call.

MontyReplExecutor

REPL Monty executor: interpreter state (variables, function definitions, imports) persists across execute calls.

Enums

MontyBuildError

Errors raised by MontyExecutorBuilder::build_one_shot() / build_repl() when the configuration is invalid — a bad host-function registry or a bad filesystem mount.

PathAccess

Access mode for a path made available to a script.

Constants

SUPPORTED_PATH_METHODS

The exact pathlib.Path surface Monty implements, listed for the model when any path is mounted (anything else raises AttributeError).

Traits

HostFunction

A Rust function callable from Python scripts executed by a Monty executor.

Functions

json_to_monty

Convert a host JSON value into a Monty value, to be injected into a script (an input binding, a host function result, a resolved name, …).

monty_to_json

Convert a Monty value produced by a script into host JSON.

resolve_os_call

Service one Monty OS call against a host-authored policy: an explicit environment map, a clock grant, and a MountTable for filesystem operations.