Sandbox Policy

Turning text into code at run time is disabled: loadstring, load, loadfile, and dofile are removed, and a script that calls them is rejected before it starts. What a shared script does must stay readable before it runs.

External module loading is blocked. The entire API surface is shipped with the app; no unexpected external code can be injected.

There is no shell, subprocess, or direct file access: the io library (including io.popen) and os.execute are removed. File work goes through the sandboxed File API. This is the core safety guarantee for shared macros.

Only the time functions remain in the os library: os.clock, os.date, os.time, and os.difftime.

The Lua debug library is fully disabled. A sandboxed script cannot reach host-side state (upvalues, getlocal, sethook).

setmetatable and getmetatable are removed once the app's own helpers have loaded, and a script that calls them is rejected before it starts; the string library is read-only. User scripts cannot install metatables.

Raw table access and environment changes are closed: these functions are removed, and a script that calls them directly or in disguised form is rejected.

Creating and running coroutines is closed; only coroutine.status and coroutine.isyieldable remain. Use Async.defer, Async.every, and the promise APIs for timers and waiting.

Controlling the garbage collector and exporting functions as bytecode are closed. A script that calls string.dump is rejected before it starts.

There is no Java bridge or reflection access: luajava is removed, and a script that uses luajava, Java.type, Class.forName, Runtime.getRuntime, or ProcessBuilder is rejected before it starts.

The Lua 5.4-only floor division (//) and bitwise operators (&, |, ~, <<, >>) are not available. So that scripts behave the same on the LuaJ and native Lua runtimes, a script that uses them is rejected before it starts. Use math.floor(a / b) for floor division; the not-equal comparison (~=) is fine. A // at the start of a line is read as a comment.

Commands that reboot the device, lock or turn off the screen, or open the power menu are blocked, including sending lock_screen or power_dialog through System.globalAction, System.pressKey, or System.keyevent. System.openApp, System.closeApp, and System.takeScreenshot are allowed but noted in the runtime log as high-impact actions.

Network requests must use HTTPS. A literal http:// address in a script is rejected before the script starts, and any other non-HTTPS request is refused when it is made.

Inline expressions in Visual Builder parameter fields support variable reads + basic math only. ; loadstring require if/while/for and similar are rejected at the block level.

60 global objects + 800+ methods. Region, Asset, Snap, Touch, Request, JSON, Hud, KV, Async, System, etc.

The pcall(function() ... end) pattern is fully supported across scripts. Unexpected LuaError values can be caught and logged.

The pure (side-effect-free) parts of the standard library are open: string.format / string.sub / table.insert / math.floor and so on.

A sandboxed timer + promise API: MAX 128 timers + 128 promises. All active timers are auto-cancelled when the script stops.