different-ai/openwork · error · InterpreterRuntimeError

URL.${name} is not available in CodeMode.

Error message

URL.${name} is not available in CodeMode.

What it means

CodeMode whitelists a small set of URL statics (e.g. canParse, parse-like helpers). Calling a URL static outside that whitelist is rejected before any argument evaluation, keeping the sandbox surface explicit.

Source

Thrown at packages/codemode/src/stdlib/url.ts:72

        return encodeURIComponent(value)
      case "decodeURI":
        return decodeURI(value)
      case "decodeURIComponent":
        return decodeURIComponent(value)
    }
  } catch (error) {
    throw new InterpreterRuntimeError(
      `${ref.name} received malformed URI data: ${error instanceof Error ? error.message : String(error)}`,
      node,
    ).as("URIError")
  }
}

export const urlArgument = (value: unknown, label: string): string =>
  value instanceof SandboxURL ? value.url.href : uriArgument(value, label)

export const invokeURLStatic = (name: string, args: Array<unknown>, node: AstNode): unknown => {
  if (!urlStatics.has(name)) throw new InterpreterRuntimeError(`URL.${name} is not available in CodeMode.`, node)
  if (args.length === 0) throw new InterpreterRuntimeError(`URL.${name} requires a URL argument.`, node).as("TypeError")
  const input = urlArgument(args[0], `URL.${name} input`)
  const base = args[1] === undefined ? undefined : urlArgument(args[1], `URL.${name} base`)
  try {
    const url = new URL(input, base)
    return name === "canParse" ? true : new SandboxURL(url)
  } catch {
    return name === "canParse" ? false : null
  }
}

export const invokeURLMethod = (value: SandboxURL, name: string, node: AstNode): string => {
  if (name === "toString" || name === "toJSON") return value.url.href
  throw new InterpreterRuntimeError(`URL method '${name}' is not available in CodeMode.`, node)
}
import { type AstNode, InterpreterRuntimeError, UriFunction } from "../interpreter/model.js"
import { SandboxURL } from "../values.js"
import { boundedData, coerceToString } from "./value.js"

View on GitHub (pinned to 2b7df46e8a)

Solutions

  1. Use only whitelisted statics (e.g. URL.canParse).
  2. Create the URL via the sandbox's URL constructor path and use its properties.
  3. Handle blobs/object-URL workflows outside CodeMode, in the host.

Example fix

// before
const u = URL.createObjectURL(blob)
// after
const ok = URL.canParse(candidateHref)
const u = ok ? new SandboxURL(candidateHref) : null
Defensive patterns

Strategy: validation

Validate before calling

const urlStatics = new Set(["canParse"])
if (!urlStatics.has(name)) throw new TypeError(`URL.${name} unsupported in CodeMode`)

Type guard

const isAllowedURLStatic = (name) => urlStatics.has(name)

Try / catch

try { u = URL.createObjectURL(b) } catch { u = null /* do it in host instead */ }

Prevention

When it happens

Trigger: `URL.createObjectURL(...)`, `URL.revokeObjectURL(...)`, or any static not in urlStatics, invoked inside CodeMode.

Common situations: Porting browser code that uses object URLs into the sandbox; assuming all WHATWG URL statics exist in CodeMode.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/b761d118f5732a44. Report an issue: GitHub.