{"record":{"id":"b6e7b56cee3a99c9","repo":"paperclipai/paperclip","slug":"import-denied-for-module-specifier-add-an-ex","errorCode":null,"errorMessage":"Import denied for module '${specifier}'. Add an explicit sandbox allow-list entry.","messagePattern":"Import denied for module '(.+?)'\\. Add an explicit sandbox allow-list entry\\.","errorType":"exception","errorClass":"PluginSandboxError","httpStatus":null,"severity":"error","filePath":"server/src/services/plugin-runtime-sandbox.ts","lineNumber":122,"sourceCode":"    const cached = moduleCache.get(realPath);\n    if (cached) return cached;\n\n    const code = readModuleSourceSync(realPath);\n\n    if (looksLikeEsm(code)) {\n      throw new PluginSandboxError(\n        \"Sandbox loader only supports CommonJS modules. Build plugin worker entrypoints as CJS for sandboxed loading.\",\n      );\n    }\n\n    const module = { exports: {} as Record<string, unknown> };\n    // Cache the module before execution to preserve CommonJS cycle semantics.\n    moduleCache.set(realPath, module.exports);\n\n    const requireInSandbox = (specifier: string): Record<string, unknown> => {\n      if (!specifier.startsWith(\".\") && !specifier.startsWith(\"/\")) {\n        if (!allowedSpecifiers.has(specifier)) {\n          throw new PluginSandboxError(\n            `Import denied for module '${specifier}'. Add an explicit sandbox allow-list entry.`,\n          );\n        }\n\n        const binding = allowedModules[specifier];\n        if (!binding) {\n          throw new PluginSandboxError(\n            `Bare module '${specifier}' is allow-listed but no host binding is registered.`,\n          );\n        }\n\n        return binding;\n      }\n\n      const candidatePath = path.resolve(path.dirname(realPath), specifier);\n      return loadModuleSync(candidatePath);\n    };\n","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/services/plugin-runtime-sandbox.ts#L104-L140","documentation":"Allow-list guard in requireInSandbox: a bare (non-relative) module specifier is not in the sandbox's allowed set. Only explicitly allow-listed host-provided modules can be required; the unapproved import specifier is at fault.","triggerScenarios":"Thrown at server/src/services/plugin-runtime-sandbox.ts:122 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add the module specifier to the sandbox allow-list in the plugin/host configuration, or remove the import from plugin code."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}