ALPHA · runs entirely in your browser

Crush Capsules

A capsule is a compiled Crush program that says which capabilities it needs, down to the directory. You decide which of those to grant. Only what you grant is reachable, and only inside its scope. The files below are an in-memory filesystem; nothing leaves your browser.

It asks for

Files (in-memory)

Capsule source (CASM) 

                    

                

            


            

                

                    Result
                    
                    loading runtime…
                

                
                
Pick what to grant, then press Run.

                
            

        


        

            

                
One enforcement path

                
This runs exo-light's own capsule runner, compiled to WebAssembly. Grants become the same capability set exo-light enforces natively; only the filesystem behind it is in memory here.

            

            

                
Narrow, never widen

                
You can grant less than a capsule asks for. Granting more is refused before it runs. A granted directory is a boundary: paths that escape it are refused even if the file exists.

            

            

                
Why CASM?

                
These capsules are written in CASM, Crush's assembly. Crush source can't yet name a directory-scoped capability like io.file.read:/data/in; that's on the roadmap.