paperclipai/paperclip · error · PluginSandboxError

Sandbox loader only supports CommonJS modules. Build plugin

Error message

Sandbox loader only supports CommonJS modules. Build plugin worker entrypoints as CJS for sandboxed loading.

What it means

Module-format guard: the module source looks like ESM (import/export syntax), which the synchronous vm sandbox loader cannot execute. Plugin workers must be built as CommonJS for sandboxed loading; the ESM-built entrypoint is at fault.

Source

Thrown at server/src/services/plugin-runtime-sandbox.ts:110

  const realPluginRoot = realpathSync(pluginRoot);

  const loadModuleSync = (modulePath: string): Record<string, unknown> => {
    const resolvedPath = resolveModulePathSync(path.resolve(modulePath));
    const realPath = realpathSync(resolvedPath);

    if (!isWithinRoot(realPath, realPluginRoot)) {
      throw new PluginSandboxError(
        `Import '${modulePath}' escapes plugin root and is not allowed`,
      );
    }

    const cached = moduleCache.get(realPath);
    if (cached) return cached;

    const code = readModuleSourceSync(realPath);

    if (looksLikeEsm(code)) {
      throw new PluginSandboxError(
        "Sandbox loader only supports CommonJS modules. Build plugin worker entrypoints as CJS for sandboxed loading.",
      );
    }

    const module = { exports: {} as Record<string, unknown> };
    // Cache the module before execution to preserve CommonJS cycle semantics.
    moduleCache.set(realPath, module.exports);

    const requireInSandbox = (specifier: string): Record<string, unknown> => {
      if (!specifier.startsWith(".") && !specifier.startsWith("/")) {
        if (!allowedSpecifiers.has(specifier)) {
          throw new PluginSandboxError(
            `Import denied for module '${specifier}'. Add an explicit sandbox allow-list entry.`,
          );
        }

        const binding = allowedModules[specifier];
        if (!binding) {

View on GitHub (pinned to 120ae5428f)

Solutions

1. Build the plugin worker entrypoint as CommonJS (e.g. tsup/rollup output format 'cjs') so the sandbox loader can require it.

When it happens

Trigger: Thrown at server/src/services/plugin-runtime-sandbox.ts:110 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/a8e297941b7577ad. Report an issue: GitHub.