Agency

Appearance

capabilities ​

Standard capability effect sets — named groups of the interrupt effects the standard library raises, for use in raises clauses.

A raises clause is an allowlist (an upper bound), so these sets are composable building blocks you union together to say what a function or node is permitted to do:

ts
import { FileRead, Network } from "std::capabilities"

// may read files and make network calls — nothing else
node main() raises <FileRead, Network> { ... }

// read-only inspection
node audit() raises <FileRead> { ... }

// guaranteed to perform no interrupting actions
def pure() raises <> { ... }

The sets are purely mechanical groupings by capability; they encode no security judgement (e.g. there is intentionally no "read-only" set that decides whether a network fetch counts as a read). Compose the pieces you need.

Note: these constrain callers. Individual functions should still declare the specific effect they raise (e.g. raises <std::read>), not a whole capability set.

Types ​

FileRead ​

Read-only filesystem access: reading files and listing/searching paths.

ts
/** Read-only filesystem access: reading files and listing/searching paths. */
export effectSet FileRead = <std::read, std::readBinary, std::ls, std::glob, std::grep>

(source)

FileWrite ​

Filesystem mutation: creating, editing, moving, copying, and deleting.

ts
/** Filesystem mutation: creating, editing, moving, copying, and deleting. */
export effectSet FileWrite = <std::write, std::writeBinary, std::edit, std::applyPatch, std::mkdir, std::move, std::copy, std::remove>

(source)

FileSystem ​

All filesystem access — reads and writes.

ts
/** All filesystem access — reads and writes. */
export effectSet FileSystem = <FileRead, FileWrite>

(source)

Shell ​

Arbitrary command / process execution. The sharpest edge — grant with care.

ts
/** Arbitrary command / process execution. The sharpest edge — grant with care. */
export effectSet Shell = <std::bash, std::exec, std::run>

(source)

Network ​

Anything that talks to the outside world over the network.

ts
/** Anything that talks to the outside world over the network. */
export effectSet Network = <std::http::fetch, std::http::fetchJSON, std::http::fetchMarkdown, std::search, std::tavilySearch, std::weather, std::browserUse, std::wikipedia::article, std::wikipedia::search, std::wikipedia::summary, std::gdelt, std::fred, std::dbnomics, std::edgar, std::littlesis, std::yc, std::hackernews, std::bluesky, std::wikidata, std::usaspending, std::aws::s3::get, std::aws::s3::getBinary, std::aws::s3::put, std::aws::s3::putBinary, std::aws::s3::createBucket>

(source)

AwsS3 ​

Amazon S3 access: reading and writing objects, creating buckets, and minting presigned download URLs. Presigning is deliberately NOT in Network — it sends nothing; it mints a bearer capability locally.

ts
/** Amazon S3 access: reading and writing objects, creating buckets, and minting presigned download URLs. Presigning is deliberately NOT in Network — it sends nothing; it mints a bearer capability locally. */
export effectSet AwsS3 = <std::aws::s3::get, std::aws::s3::getBinary, std::aws::s3::put, std::aws::s3::putBinary, std::aws::s3::createBucket, std::aws::s3::presignGet>

(source)

DataFinance ​

The std::data/finance connectors (macro + filings). Each also raises std::http::fetchJSON, which is covered by the broader Network set. GDELT (news) lives in std::data/news and is not part of this set.

ts
/** The std::data/finance connectors (macro + filings). Each also raises
    std::http::fetchJSON, which is covered by the broader Network set. GDELT
    (news) lives in std::data/news and is not part of this set. */
export effectSet DataFinance = <std::fred, std::edgar, std::dbnomics>

(source)

Messaging ​

Sending messages to people: email, SMS, and iMessage.

ts
/** Sending messages to people: email, SMS, and iMessage. */
export effectSet Messaging = <std::sendEmail, std::sendSms, std::sendIMessage>

(source)

Secrets ​

Reading and writing credentials in the system keyring.

ts
/** Reading and writing credentials in the system keyring. */
export effectSet Secrets = <std::getSecret, std::setSecret, std::deleteSecret>

(source)

Auth ​

OAuth-style authorization flows: granting, fetching, and revoking access.

ts
/** OAuth-style authorization flows: granting, fetching, and revoking access. */
export effectSet Auth = <std::authorize, std::getAccessToken, std::revokeAuth>

(source)

Calendar ​

Calendar access: listing and mutating events (incl. calendar authorization).

ts
/** Calendar access: listing and mutating events (incl. calendar authorization). */
export effectSet Calendar = <std::listEvents, std::createEvent, std::updateEvent, std::deleteEvent, std::authorizeCalendar>

(source)

Memory ​

Agent long-term memory: recall, remember, forget, and enable/disable.

ts
/** Agent long-term memory: recall, remember, forget, and enable/disable. */
export effectSet Memory = <std::memory::recall, std::memory::remember, std::memory::forget, std::memory::enableMemory, std::memory::disableMemory>

(source)

NotesRead ​

Read-only Notes access: reading, searching, and listing.

ts
/** Read-only Notes access: reading, searching, and listing. */
export effectSet NotesRead = <std::notes::read, std::notes::search, std::notes::list>

(source)

NotesWrite ​

Notes mutation: creating, appending, and deleting.

ts
/** Notes mutation: creating, appending, and deleting. */
export effectSet NotesWrite = <std::notes::create, std::notes::append, std::notes::delete>

(source)

Notes ​

All Notes access, reads and writes.

ts
/** All Notes access, reads and writes. */
export effectSet Notes = <NotesRead, NotesWrite>

(source)