Skip to main content
sndbox distinguishes ordinary JSON-compatible values from local path and connection references. File nodes establish or preserve a trusted path boundary; data nodes shape, parse, compare, or store values.

​
Follow the value, not just the edge

A control edge says when a node may run. A binding says what value it receives. For example, this file-processing sequence needs both:
Map Download File’s trusted path output into Parse CSV’s path input. Then map the parser’s rowCount into Condition and the desired transformed content into Write File. Canvas proximity and control edges do not perform those mappings automatically.

​
Choose the right node

Files and folders

Read, write, move, copy, delete, and list approved paths.

Parsers

Turn CSV, JSON, or text files and mapped content into structured output.

HTTP

Call an endpoint with explicit method, headers, query, body, timeout, and retry.

Code and Web Builder

Author checked source, optionally run Python or JavaScript, and assemble localhost sites.

Workflow state

Read prior successful state and detect meaningful changes across runs.

​
Mapped content wins

CSV, JSON, and text parsers accept either an optional approved file or mapped/pasted content. When both exist, mapped content takes precedence. This makes a parser reusable after HTTP, browser extraction, download, or file-read nodes without guessing which source was used. Use content when data is already in memory and path when provenance and the file artifact matter. Keep the unused field empty so a reviewer can see the intended source without relying on precedence.

​
Inspect actual types

Test the producer and inspect its output before selecting a nested path. Node reference pages list each typed input and output port generated from the source catalogue.

​
Choose storage deliberately

​
Safe processing pattern

  1. Bound the producer with a timeout or maximum byte size.
  2. Parse into a known structure.
  3. Test empty, malformed, and oversized inputs.
  4. Validate or branch before a write, command, upload, or communication.
  5. Keep only the evidence required by retention policy.
External data remains untrusted after parsing. A valid JSON string can still contain a dangerous command argument, destination path, URL, or message recipient.