paperclipai/paperclip · error · PluginSandboxError

Import denied for module '${specifier}'. Add an explicit san

Error message

Import denied for module '${specifier}'. Add an explicit sandbox allow-list entry.

What it means

Allow-list guard in requireInSandbox: a bare (non-relative) module specifier is not in the sandbox's allowed set. Only explicitly allow-listed host-provided modules can be required; the unapproved import specifier is at fault.

Source

Thrown at server/src/services/plugin-runtime-sandbox.ts:122

    const cached = moduleCache.get(realPath);
    if (cached) return cached;

    const code = readModuleSourceSync(realPath);

    if (looksLikeEsm(code)) {
      throw new PluginSandboxError(
        "Sandbox loader only supports CommonJS modules. Build plugin worker entrypoints as CJS for sandboxed loading.",
      );
    }

    const module = { exports: {} as Record<string, unknown> };
    // Cache the module before execution to preserve CommonJS cycle semantics.
    moduleCache.set(realPath, module.exports);

    const requireInSandbox = (specifier: string): Record<string, unknown> => {
      if (!specifier.startsWith(".") && !specifier.startsWith("/")) {
        if (!allowedSpecifiers.has(specifier)) {
          throw new PluginSandboxError(
            `Import denied for module '${specifier}'. Add an explicit sandbox allow-list entry.`,
          );
        }

        const binding = allowedModules[specifier];
        if (!binding) {
          throw new PluginSandboxError(
            `Bare module '${specifier}' is allow-listed but no host binding is registered.`,
          );
        }

        return binding;
      }

      const candidatePath = path.resolve(path.dirname(realPath), specifier);
      return loadModuleSync(candidatePath);
    };

View on GitHub (pinned to 120ae5428f)

Solutions

1. Add the module specifier to the sandbox allow-list in the plugin/host configuration, or remove the import from plugin code.

When it happens

Trigger: Thrown at server/src/services/plugin-runtime-sandbox.ts:122 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/b6e7b56cee3a99c9. Report an issue: GitHub.