paperclipai/paperclip · error · PluginSandboxError

Bare module '${specifier}' is allow-listed but no host bindi

Error message

Bare module '${specifier}' is allow-listed but no host binding is registered.

What it means

Binding guard in requireInSandbox: the bare specifier is allow-listed but no host binding was registered for it (options.allowedModules lacks it). Configuration gap between the allow-list and provided globals; the incomplete sandbox configuration is at fault.

Source

Thrown at server/src/services/plugin-runtime-sandbox.ts:129

        "Sandbox loader only supports CommonJS modules. Build plugin worker entrypoints as CJS for sandboxed loading.",
      );
    }

    const module = { exports: {} as Record<string, unknown> };
    // Cache the module before execution to preserve CommonJS cycle semantics.
    moduleCache.set(realPath, module.exports);

    const requireInSandbox = (specifier: string): Record<string, unknown> => {
      if (!specifier.startsWith(".") && !specifier.startsWith("/")) {
        if (!allowedSpecifiers.has(specifier)) {
          throw new PluginSandboxError(
            `Import denied for module '${specifier}'. Add an explicit sandbox allow-list entry.`,
          );
        }

        const binding = allowedModules[specifier];
        if (!binding) {
          throw new PluginSandboxError(
            `Bare module '${specifier}' is allow-listed but no host binding is registered.`,
          );
        }

        return binding;
      }

      const candidatePath = path.resolve(path.dirname(realPath), specifier);
      return loadModuleSync(candidatePath);
    };

    // Inject the CJS module arguments into the context so the script can call
    // the wrapper immediately. This is critical: the timeout in runInContext
    // only applies during script evaluation. By including the self-invocation
    // `(fn)(exports, module, ...)` in the script text, the timeout also covers
    // the actual module body execution — preventing infinite loops from hanging.
    const sandboxArgs = {
      __paperclip_exports: module.exports,

View on GitHub (pinned to 120ae5428f)

Solutions

1. Register a host binding for the allow-listed bare module, or remove it from the allow-list if unused.

When it happens

Trigger: Thrown at server/src/services/plugin-runtime-sandbox.ts:129 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/8e88a05cbf6a1ddb. Report an issue: GitHub.