Why should imported code inherit all your permissions?

Koschei Lang is an independent programming language centered on explicit capability values. In Koschei source, a function must be given authority before it can read the disk, access the network, inspect the environment or launch a process.

Many development workflows make it easy for a dependency to perform operations with the ambient permissions of its host process. Koschei takes a more explicit approach for code compiled by its own toolchain: access must appear in the program's authority flow, and unauthorized operations can be rejected before execution.

1. See an unauthorized import fail

The packaged example examples/supply_chain/analytics.ks deliberately attempts to access disk content without a disk capability in scope. Run the checker locally:

$ ks check examples/supply_chain/main.ks

KOSCHEI ERROR: KS2401
Required capability is unavailable in this scope.
# Expected exit status: 1

This is a compile-time authority check, not a runtime sandbox that waits for a forbidden call. The example should not be executed, and the referenced secret file is not read by this check.

2. Inspect reach across your module graph

Use ks caps to inspect which capabilities the imported Koschei code can reach. A policy gate can reject a build that gains unapproved network authority:

$ ks caps examples/apps/secretscan/main.ks

$ ks caps --deny net examples/apps/secretscan/main.ks
# Expected: no forbidden network reach, exit 0

The --deny option is useful in CI: if a future change requests a forbidden capability, the policy gate can fail the build. This is an explicit, checkable property of the Koschei program, not a promise that all software in its host operating system is safe.

3. Write code with narrow authority

A function that receives only a narrowed network capability cannot automatically access the disk or another network origin:

fn fetch_data(net: NetCaps, url: String) -> String or Error {
    let response = net.get(url) or return Error("request failed")
    return response.text()
}

fn main(caps: SystemCaps) {
    let api_net = caps.net.allow("https://api.example.com")
    let response = fetch_data(api_net, "https://api.example.com/v1")
    println(response)
}

The snippet illustrates the capability model; the URL is an example endpoint, not an offered public API. The language also supports typed values, Option<T>, Result<T,E>, and a Core Library authored in Koschei source.

4. Know what this does not claim

Koschei Lang 0.10.0 is pre-1.0. Its capability rules apply to the supported Koschei language/toolchain boundary. They do not make arbitrary third-party executables safe, secure a compromised endpoint, prevent stolen credentials or unauthorized wallet signing, or provide independent banking-system certification. Native builds currently use a Go-based adapter rather than a self-hosted compiler.

5. Try the included examples

The Individual commercial license includes the toolchain ZIP, Core Library, security examples, English/Turkish guides and a 12-month window of subsequent releases. One named developer can use acquired releases perpetually for commercial development, under the included license.

$ ./install.sh
$ ks version
$ ks run examples/hello.ks
$ ks check examples/supply_chain/main.ks

Price: $49 USD, one-time. Checkout and ZIP fulfillment are provided through Polar. Personal non-commercial use is free under the license, and businesses have a 30-day evaluation allowance.