{"record":{"id":"f3b7af8e7b37409b","repo":"Kong/insomnia","slug":"plugin-pluginname-sandboxed-surface-are-n","errorCode":null,"errorMessage":"Plugin \"${pluginName}\": sandboxed ${surface} are not supported yet. Disable \"Run template tags in sandbox\" to use them.","messagePattern":"Plugin \"(.+?)\": sandboxed (.+?) are not supported yet\\. Disable \"Run template tags in sandbox\" to use them\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/insomnia/src/plugins/index.ts","lineNumber":82,"sourceCode":"// discovery has to reach the sandbox from either. In main we call the sandbox directly — the\n// `insomnia-templating-worker-database://` protocol is a renderer<->main channel and main's own\n// `fetch` can't resolve it. In a renderer (the plugin window) we go over that protocol.\nasync function discoverUserPluginExports(\n  directory: string,\n  name: string,\n  permissions: Plugin['permissions'],\n): Promise<PluginExportManifest> {\n  const body = { directory, name, permissions };\n  if (__IS_RENDERER__) {\n    return (await fetchFromTemplateWorkerDatabase('plugin.discoverUserPluginExports', body)) as PluginExportManifest;\n  }\n  const { discoverUserPluginExportsForLoader } = await import('~/main/templating-worker-database');\n  return discoverUserPluginExportsForLoader(body);\n}\n\nfunction buildUserPluginModuleFromManifest(pluginName: string, manifest: PluginExportManifest): Plugin['module'] {\n  const notRouted = (surface: string) => () => {\n    throw new Error(\n      `Plugin \"${pluginName}\": sandboxed ${surface} are not supported yet. Disable \"Run template tags in sandbox\" to use them.`,\n    );\n  };\n  const toAction = (surface: string) => (a: ActionDescriptor) => ({\n    label: a.label ?? '',\n    icon: a.icon,\n    action: notRouted(surface),\n  });\n  // The count comes from untrusted sandbox output; clamp to a finite, non-negative, bounded integer\n  // before allocating so a hostile manifest can't drive a huge Array.from allocation (the sandbox\n  // clamps too — this is defense in depth).\n  const hookStubs = (count: number, surface: string) =>\n    Array.from({ length: Number.isFinite(count) && count > 0 ? Math.min(Math.floor(count), 1000) : 0 }, () =>\n      notRouted(surface),\n    );\n  return {\n    templateTags: manifest.templateTags.map(t => ({ ...t, run: notRouted('template-tag run()') }) as PluginTemplateTag),\n    requestHooks: hookStubs(manifest.requestHooks, 'request hooks'),","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/Kong/insomnia/blob/d9bb2b0142600f21309832daea3317942d285984/packages/insomnia/src/plugins/index.ts#L64-L100","documentation":"Error \"Plugin \"${pluginName}\": sandboxed ${surface} are not supported yet. Disable \"Run template tags in sandbox\" to use them.\" thrown in Kong/insomnia.","triggerScenarios":"Thrown at packages/insomnia/src/plugins/index.ts:82 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9bb2b0142600f21309832daea3317942d285984","analyzedAt":"2026-08-26T18:04:05.187Z","schemaVersion":2},"datasetVersion":"2026-08-26T21:11:00.512Z"}