capsule-fs

Why we included this project

capsule-fs gives AI agents a small, deliberate set of filesystem operations instead of raw shell access. Every read, write, replace, grep, list, create, delete, or move goes through the VFS airlock, where the kernel enforces path boundaries, copy-on-write isolation, and capability checks before touching the host filesystem. That matters for anyone running autonomous agents on user machines, because it converts a normally dangerous primitive into a bounded, auditable interface. The replace tool refuses to act when it finds zero or multiple matches, which prevents accidental corruption, and the move operation's 10MB limit with rollback on failure shows the same caution. If you are building an agent runtime or a coding assistant that must touch local files without letting a model wander outside its sandbox, this is a clean reference for structuring those permissions.