sandbox-environment

Sandbox Environment Reference

Available APIs

ctx.vault

• ctx.vault.read(path: string): Promise<string> -- Read text file
• ctx.vault.readBinary(path: string): Promise<ArrayBuffer> -- Read binary file
• ctx.vault.write(path: string, content: string): Promise<void> -- Write text (max 10MB, no writes to .obsidian/)
• ctx.vault.writeBinary(path: string, content: ArrayBuffer): Promise<void> -- Write binary (max 10MB)
• ctx.vault.list(path: string): Promise<string[]> -- List folder contents

ctx.requestUrl

• ctx.requestUrl(url: string, options?: {method?: string, body?: string}): Promise<{status: number, text: string}>
• HTTPS only. Allowed domains: esm.sh, cdn.jsdelivr.net, unpkg.com, registry.npmjs.org
• Rate limit: 5 requests/minute

Standard Globals

Promise, JSON, Math, Date, Object (full), Array, Map, Set, RegExp, Number, String, Boolean, Symbol, setTimeout, clearTimeout, TextEncoder, TextDecoder, parseInt, parseFloat, isNaN, isFinite, encodeURIComponent, decodeURIComponent, Error, TypeError, RangeError

TypedArrays (for binary data)

Uint8Array, Int8Array, Uint16Array, Int16Array, Uint32Array, Int32Array, Float32Array, Float64Array, ArrayBuffer, DataView

NOT Available (will cause errors)

Buffer (Node.js), require(), dynamic import(), process, fs, path, __dirname, __filename, child_process, WebAssembly, eval(), new Function()

require, import(), process, globalThis, eval, new Function and WebAssembly are not merely absent: the AstValidator rejects the script BEFORE it compiles if the source so much as contains them, and its comment stripper deliberately keeps string literals. A script that searches for these tokens must therefore assemble them at runtime ('pro' + 'cess'), or it rejects itself. new RegExp is allowed.

The one rule that has no error message

A skill script is a single, self-contained file. No import, no require.

A static import x from './y.js' passes every check: the AstValidator only blocks require( and import(, and the repo has no other gate. But esbuild.transform (no bundling) rewrites it to require(), and there is no require here. The script dies on the user's first call, with an error that names none of this. Put everything in one file.