Module script_host 

The daemon’s real ScriptHost for Rhai script tools (permission Layer 3).

A registered script tool reaches the outside world only through the host functions on leviath_scripting::ScriptHost. This module supplies the real implementation: it enforces the per-function [tool_script_permissions] (allow / deny / inherit) resolved at agent spawn, confines read_file / write_file to the agent workdir, routes shell() through the agent’s per-stage sandbox with a wall-clock timeout, and performs the actual I/O.

The I/O itself lives behind the ScriptIo seam so the permission and path-confinement logic is unit-testable with a fake, and the real network/process/filesystem/env behavior (RealScriptIo) is exercised with hermetic, local resources (a mock HTTP server, echo, temp files, scoped env vars) - the same approach the MCP and package-registry tests use.

Structs

DaemonScriptHost

The daemon’s script host: enforces permissions + workdir confinement, then delegates the actual work to a ScriptIo.

RealScriptIo

The real I/O backend: blocking HTTP, host shell, filesystem, and env access.

ScriptAllow

The resolved allow/deny decision for each of the five side-effecting host functions, computed once at spawn from the config’s [tool_script_permissions] and the agent’s own tool permissions (for the inherit cases).

Traits

ScriptIo

The raw I/O a DaemonScriptHost performs, behind a seam so the host’s permission/confinement logic is testable without real side effects.

Functions

effective_script_permissions

The effective [tool_script_permissions] for an agent: the user’s global config with the agent’s own blueprint [tool_script_permissions] overlaid per field - but only where the manifest is more restrictive.

resolve_script_permissions

Resolve [tool_script_permissions] into concrete allow/deny booleans.

set_local_network_allowed

Apply [security] allow_local_network to redirect following for this process.