Sandbox and limits
Scripts are shared between users, so each one runs in a sandbox. The rules below are enforced by the program, not by trust.
Lua libraries
| Available | Notes |
|---|---|
base | print, pairs, ipairs, type, tostring, tonumber, select, pcall, error, assert, setmetatable, next and the rest. load accepts text only (no compiled chunks). |
string | Everything except string.dump. |
table | Full. |
math | Full, plus math.clamp, math.lerp, math.round, math.distance, math.angle_to. |
utf8 | Full. |
coroutine | Full. |
collectgarbage | Only "count", "collect" and "step". |
Not available: os, io, package, debug, require, dofile, loadfile, string.dump. For time use globals.time(); for files use files.
Permissions
Three kinds of calls need the user's OK. The header line -- permissions: says what a script wants; the user grants it by ticking it under PERMISSIONS on the script's page. Granted permissions are saved and follow the script when it is renamed.
| Permission | Unlocks |
|---|---|
settings | Lets the script change the real program settings: config.set, aim.enabled(on), trigger.enabled(on), players.flag(id, flag) and players.color(id, c). |
chat | Lets the script send chat messages with chat.say and chat.team. |
network | Lets the script call http.get. Only https://adolfjon.uz/ addresses are allowed. |
Without the permission, the call does nothing, returns false (or the current value), and the console shows needs permission: settings, allow it on the script page once. Reading never needs a permission.
Time and memory
Every callback gets 8 ms or 1 000 000 Lua instructions, whichever comes first. A script that goes over is stopped with script ran too long (infinite loop?), so a mistake like while true do end never freezes the game. Each script may use 64 MB of memory.
Everything runs on the render thread, one callback after another. http.get and vpk.read work on background threads and call you back on the render thread later.
All limits
| What | Limit |
|---|---|
Time per callback | 8 ms or 1 000 000 Lua instructions, whichever comes first. Then the script stops with an error. |
Memory | 64 MB per script. |
config.set | 64 changes per frame across all scripts. Only existing keys, same type and shape. misc.menuToggleKey and misc.obsBypass are locked. |
files | Only the script's own data/<script>/ folder. Names use A-Z a-z 0-9 _ . - (up to 64 characters). 1 MB per file, 64 files. |
db | 256 KB per script. |
http.get | https://adolfjon.uz/ only. 4 requests at a time per script (shared with vpk.read). Replies are cut at about 512 KB. |
vpk.read | 16 MB per entry. Shares the 4-at-a-time limit with http.get. |
Images | 16 per script. PNG or JPG, up to 2048 x 2048 and 8 MB. |
Fonts | 8 in total across all scripts, 6 to 96 px. |
chat | One message every 3.5 seconds across all scripts, up to 120 bytes. |
esp.add_text | 4 lines per player per frame, 64 characters each. |
notify.push | 64 characters. |
menu.input | 255 bytes. |
Polygons | 128 points. |
Never available
These were asked about and are left out on purpose. Do not expect them in a later version.
- Writing game memory. Every game read is read-only.
- Rage features, material changes and console variable writes.
- Simulated mouse or keyboard input.
- Anything that hides from anti-cheat.
- Running programs, or reading and writing files outside the script's data folder.
- Custom GPU shaders.
Scripts can still change existing program settings (with permission) through config, for example animate a chams colour.