{"record":{"id":"207e2c3e08dccef6","repo":"paperclipai/paperclip","slug":"failed-to-read-sandbox-module-modulepath-e","errorCode":null,"errorMessage":"Failed to read sandbox module '${modulePath}': ${error instanceof Error ? error.message : String(error)}","messagePattern":"Failed to read sandbox module '(.+?)': (.+?)","errorType":"exception","errorClass":"PluginSandboxError","httpStatus":null,"severity":"error","filePath":"server/src/services/plugin-runtime-sandbox.ts","lineNumber":202,"sourceCode":"  }\n\n  throw new PluginSandboxError(`Unable to resolve module import at path '${candidatePath}'`);\n}\n\n/**\n * True when `targetPath` is inside `rootPath` (or equals rootPath), false otherwise.\n * Uses `path.relative` so sibling-prefix paths (e.g. `/root-a` vs `/root`) cannot bypass checks.\n */\nfunction isWithinRoot(targetPath: string, rootPath: string): boolean {\n  const relative = path.relative(rootPath, targetPath);\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n\nfunction readModuleSourceSync(modulePath: string): string {\n  try {\n    return readFileSync(modulePath, \"utf8\");\n  } catch (error) {\n    throw new PluginSandboxError(\n      `Failed to read sandbox module '${modulePath}': ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nfunction normalizeModuleExports(exportsValue: unknown): Record<string, unknown> {\n  if (typeof exportsValue === \"object\" && exportsValue !== null) {\n    return exportsValue as Record<string, unknown>;\n  }\n\n  return { default: exportsValue };\n}\n\n/**\n * Lightweight guard to reject ESM syntax in the VM CommonJS loader.\n */\nfunction looksLikeEsm(code: string): boolean {\n  return /(^|\\n)\\s*import\\s+/m.test(code) || /(^|\\n)\\s*export\\s+/m.test(code);","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/services/plugin-runtime-sandbox.ts#L184-L220","documentation":"I/O guard in readModuleSourceSync: reading the resolved module file threw (permissions, vanished file, encoding issue); the raw error is wrapped with the module path. The unreadable module file is at fault.","triggerScenarios":"Thrown at server/src/services/plugin-runtime-sandbox.ts:202 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the file read failure for the sandbox module (permissions, missing file, or I/O error) per the wrapped message."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}