{"record":{"id":"8e88a05cbf6a1ddb","repo":"paperclipai/paperclip","slug":"bare-module-specifier-is-allow-listed-but-no","errorCode":null,"errorMessage":"Bare module '${specifier}' is allow-listed but no host binding is registered.","messagePattern":"Bare module '(.+?)' is allow-listed but no host binding is registered\\.","errorType":"exception","errorClass":"PluginSandboxError","httpStatus":null,"severity":"error","filePath":"server/src/services/plugin-runtime-sandbox.ts","lineNumber":129,"sourceCode":"        \"Sandbox loader only supports CommonJS modules. Build plugin worker entrypoints as CJS for sandboxed loading.\",\n      );\n    }\n\n    const module = { exports: {} as Record<string, unknown> };\n    // Cache the module before execution to preserve CommonJS cycle semantics.\n    moduleCache.set(realPath, module.exports);\n\n    const requireInSandbox = (specifier: string): Record<string, unknown> => {\n      if (!specifier.startsWith(\".\") && !specifier.startsWith(\"/\")) {\n        if (!allowedSpecifiers.has(specifier)) {\n          throw new PluginSandboxError(\n            `Import denied for module '${specifier}'. Add an explicit sandbox allow-list entry.`,\n          );\n        }\n\n        const binding = allowedModules[specifier];\n        if (!binding) {\n          throw new PluginSandboxError(\n            `Bare module '${specifier}' is allow-listed but no host binding is registered.`,\n          );\n        }\n\n        return binding;\n      }\n\n      const candidatePath = path.resolve(path.dirname(realPath), specifier);\n      return loadModuleSync(candidatePath);\n    };\n\n    // Inject the CJS module arguments into the context so the script can call\n    // the wrapper immediately. This is critical: the timeout in runInContext\n    // only applies during script evaluation. By including the self-invocation\n    // `(fn)(exports, module, ...)` in the script text, the timeout also covers\n    // the actual module body execution — preventing infinite loops from hanging.\n    const sandboxArgs = {\n      __paperclip_exports: module.exports,","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/services/plugin-runtime-sandbox.ts#L111-L147","documentation":"Binding guard in requireInSandbox: the bare specifier is allow-listed but no host binding was registered for it (options.allowedModules lacks it). Configuration gap between the allow-list and provided globals; the incomplete sandbox configuration is at fault.","triggerScenarios":"Thrown at server/src/services/plugin-runtime-sandbox.ts:129 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Register a host binding for the allow-listed bare module, or remove it from the allow-list if unused."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}