Module read_paths 

The [read_paths] allowlist: how an agent is granted read access outside its workdir, and how each access is checked.

A blueprint’s [read_paths] allow array declares what the agent wants to read. Declaring is not granting: the user’s config must either name the same paths ([security] read_paths / [agent_read_paths.<name>]) or set allow_blueprint_read_paths = true. That keeps the manifest tighten-only - an agent.leviath someone downloaded cannot ship one TOML line that reads ~/.ssh. ReadPathPolicy::decide is that double check, applied per path at resolve time.

Three entry forms:

• an exact path: grants the whole subtree under it, checked with the same canonicalize-then-prefix containment as the workdir sandbox
• glob: - a glob pattern, * stays inside one path component, ** crosses them
• regex: - a regex, auto-anchored as ^(?:pattern)$ so regex:runs cannot quietly match /etc/runs-anything

Patterns match the symlink-resolved real path of the file, never the path the agent asked for. That is what makes them safe: a symlink planted inside an allowlisted directory resolves to its real target, and the real target must itself match an entry. The matched string uses / separators on every OS and, on Windows, has the \\?\ verbatim prefix stripped and is compared case-insensitively (see normalize_match_str).

Portability: ~/ expands to the home directory (honoring LEVIATH_HOME), and a bare relative entry resolves against the run’s workdir. A relative regex: is refused - there is no way to splice a workdir into a regex safely, and glob: covers that case.

Structs

ReadPathPolicy

Everything read-path enforcement needs, resolved once at spawn.

ReadPathSet

A compiled set of allowlist entries, bound to the run they were compiled for (tilde and relative entries were resolved at compile time).

Enums

ReadPathDecision

The outcome of checking one path against a ReadPathPolicy.

ReadPathEntry

One compiled allowlist entry. Only ReadPathSet constructs these; the enum is public so a set’s contents are inspectable, not so callers build entries by hand (compilation is where ~/relative resolution and anchoring happen).

Functions

normalize_match_str

Normalize a canonicalized path string for glob/regex matching.

validate_entry_syntax

Validate one entry’s syntax without binding it to a run: bad glob/regex, a relative regex:, an empty entry. Called from manifest parsing so a broken entry fails lev validate/lev add/spawn loudly instead of degrading the agent at its first out-of-workdir read.