capsule

A command for capturing, inspecting, replaying, and tracking lightweight failure bundles called capsules. A capsule records a failure source, replay command, expected check, and replay history; it is not a virtual-machine snapshot.

In plain words
What is it for?
Use it to capture failures from GitHub Actions, rerun them, inspect their evidence and history, or mark a capsule as a regression test.
Why use it?
It makes a failure portable and repeatable, so the same problem can be investigated again in an environment Crabbox can run.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/openclaw/crabbox/capsule
Clone the repo
git clone --depth 1 https://github.com/openclaw/crabbox
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,485 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01485
Opus 5 $0.00000 $0.00743
Sonnet 5 $0.00000 $0.00297
Haiku 4.5 $0.00000 $0.00148

Measured 2d ago against content hash 1bc68f12ce42, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

capsule scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

docs/commands/capsule.md · 156 lines

How it starts

The opening of the file, as written. The whole thing — 156 lines — stays where its author put it; the contents beside it link to each section on GitHub.

capsule

crabbox capsule captures, replays, and tracks lightweight failure capsules.

A capsule is a portable, replayable failure bundle. Today the capture path is Actions-first and local-first: crabbox capsule from-actions writes a capsule.yaml manifest plus bounded local evidence next to it, and the other subcommands replay, inspect, and annotate that manifest. Replay reuses crabbox run, so a capsule runs on any lease or environment Crabbox can drive.

A capsule is not a VM snapshot. Use crabbox checkpoint or crabbox image to save environment state; use crabbox capsule for the failure source, replay command, oracle, and replay history. See the Capsules feature guide for the manifest schema and broader concept.

Subcommands:

  • from-actions — capture a capsule from a GitHub Actions run.
  • replay — re-run the captured command and record the outcome.
  • inspect — print the source, replay command, oracle, and history.
  • promote — mark the capsule as a regression replay.

A manifest argument may be either the capsule.yaml file or the directory that contains it; the directory form resolves to capsule.yaml inside it.

from-actions

Capture a failing GitHub Actions run into a capsule.

crabbox capsule from-actions <run-url> --replay '<command>'
crabbox capsule from-actions 123456 --repo example-org/my-app --replay 'go test ./...'

The argument is a GitHub Actions run URL (https://github.com/owner/repo/actions/runs/123, optionally with /attempts/N) or a numeric run id. A bare run id requires --repo. --replay is required: the command is recorded verbatim and is not inferred from workflow YAML.

Flags:

--repo <owner/name>             repository; required when the argument is only a run id
--replay <command>              explicit replay command (required)
--output <dir>                  output directory (default capsules/<owner>-<repo>-actions-<run-id>)
--scenario <text>               human-readable scenario (default derived from the run)
--job <name>                    prefer a specific failed job when a run has several
--required-quality <quality>    required replay quality (default semantically_identical)
--max-log-bytes <n>             cap retained failed-log bytes (default 262144)
--no-logs                       skip fetching failed Actions logs

Read the full file on GitHub · 156 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 156 lines · 0 tokens per session scan A 1bc68f12ce42

Subscribe to this mod's changes

capsule is a command published in the GitHub repository openclaw/crabbox (1,343 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,485 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.