{"record":{"id":"092a1ca005c2c0da","repo":"moeru-ai/airi","slug":"botcall-method-method-is-not-allowed","errorCode":null,"errorMessage":"botCall: method \"${method}\" is not allowed","messagePattern":"botCall: method \"(.+?)\" is not allowed","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"integrations/minecraft/src/cognitive/conscious/js-planner.ts","lineNumber":599,"sourceCode":"}\n\n/**\n * Invokes a method on the live mineflayer bot on behalf of sandboxed script code.\n *\n * Use when:\n * - A script needs a low-level bot action that has no dedicated tool (e.g. `lookAt`).\n *\n * Expects:\n * - `method` is not in {@link BOT_METHOD_DENYLIST} and resolves to a bot function.\n * - `rawArgs` are sandbox-serializable; position-shaped args are marshaled to `Vec3`.\n *\n * Returns:\n * - The method's result, defensively cloned to a sandbox-safe value (or `null` when\n *   the result is a live object that cannot be serialized back).\n */\nasync function callBotMethod(mineflayer: Mineflayer, method: string, rawArgs: unknown): Promise<unknown> {\n  if (BOT_METHOD_DENYLIST.has(method))\n    throw new Error(`botCall: method \"${method}\" is not allowed`)\n\n  const bot = mineflayer.bot as unknown as Record<string, unknown>\n  const fn = bot[method]\n  if (typeof fn !== 'function')\n    throw new TypeError(`botCall: bot.${method} is not a function`)\n\n  const callArgs = Array.isArray(rawArgs) ? rawArgs.map(marshalBotArg) : []\n  const result = await (fn as (...a: unknown[]) => unknown).apply(bot, callArgs)\n\n  try {\n    return cloneStructured(result)\n  }\n  catch {\n    // Live objects (Entity/Block/etc.) are not serializable back into the sandbox.\n    return null\n  }\n}\n","sourceCodeStart":581,"sourceCodeEnd":617,"githubUrl":"https://github.com/moeru-ai/airi/blob/27111382b4a79a7e983289d6e983a06af185ed0f/integrations/minecraft/src/cognitive/conscious/js-planner.ts#L581-L617","documentation":"Thrown by callBotMethod in the JS planner sandbox when the requested method name is in BOT_METHOD_DENYLIST: end, quit, on, once, off, addListener, removeListener, removeAllListeners, emit. This is a security/integrity guard — those methods could disconnect the bot or hijack its event bus from sandboxed script code. The bot is otherwise open-by-default.","triggerScenarios":"A sandboxed planner script calls botCall('end') or botCall('quit') to disconnect; a script tries botCall('on', 'spawn', ...) to attach a listener; a script attempts botCall('emit', ...) to fake an event.","commonSituations":"An adversarial or buggy generated script tries to tear down the connection; the LLM planner hallucinates using event methods instead of the dedicated tool API; a script confuses EventEmitter methods with action methods.","solutions":["Use the dedicated action tools (collectBlocks, chat, etc.) instead of raw bot event methods.","If a legitimate disconnect is needed, expose it through an explicit action, not botCall.","Regenerate the script avoiding the denylisted method names listed in the error.","Treat this as a sandbox boundary — do not remove methods from the denylist without a security review."],"exampleFix":"// before (sandboxed script)\nbotCall('quit')\n// after\n// use a dedicated stop/giveUp action instead of tearing down the socket","handlingStrategy":"validation","validationCode":"const BOT_METHOD_DENYLIST = new Set(['end','quit','on','once','off','addListener','removeListener','removeAllListeners','emit'])\nfunction isAllowedBotMethod(method) {\n  return !BOT_METHOD_DENYLIST.has(method)\n}\nif (!isAllowedBotMethod(method))\n  // route through a dedicated action tool instead","typeGuard":"function isAllowedBotMethod(method) {\n  return !BOT_METHOD_DENYLIST.has(method)\n}","tryCatchPattern":"try {\n  await callBotMethod(mineflayer, method, args)\n} catch (e) {\n  if (e.message.includes('is not allowed'))\n    // regenerate the script avoiding denylisted methods\n  throw e\n}","preventionTips":["Use dedicated action tools rather than raw event/disconnect methods.","Do not remove denylist entries without a security review.","Guide the script generator away from EventEmitter-style usage."],"tags":["minecraft","sandbox","security","js-planner","botcall"],"backgroundTag":null,"analyzedSha":"27111382b4a79a7e983289d6e983a06af185ed0f","analyzedAt":"2026-08-12T18:33:34.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}