Safety model

Mantou treats diagram source as untrusted. The expression evaluator and the expansion endpoint are both deliberately constrained.

Expression sandbox#

• Hand-written lexer + recursive-descent parser — no Function or eval.
• Member access only reads own properties of plain objects.
• proto, constructor, prototype, call, apply, bind are blocked.
• No assignment, loops, function calls (beyond any/all), or imports.

Filesystem#

• Only files named package.json can be read.
• Absolute paths are rejected.
• Paths that resolve outside the project directory are rejected.
• No network access of any kind.