Environments and permissions

Script environments provide named values through the frozen env global. Permissions separately decide whether a saved script may write to the clipboard, open a dialog, post a notification, or make a network request.

Changing an environment never grants a permission, and granting a permission never changes which environment values are in scope.

Create an environment

Open Settings → Scripting → Script environments and create a named environment. Each variable is either:

• Plain — its value is stored with the environment and can sync with it.
• Secret — its declaration can sync, but its value stays in this device’s keyring or session overlay.

Select the active environment from the Script environment control in the connection workspace status bar.

Screenshot plannedSelect the active Script environmentThe Varc workspace status bar with the Script environment selector open and one named environment selected.

Read variables

Use properties on env:

const response = await fetch(new URL("/health", env.API_ORIGIN), {
  headers: { authorization: `Bearer ${env.API_TOKEN}` },
});

return { status: response.status };

The editor regenerates the environment declaration when the selection changes, so env. completion follows the active variable names.

The object is frozen. Scripts cannot replace, add, or redefine its properties. With no environment selected, env still exists as an empty object and an unknown property is undefined.

If a secret is declared but has no value on this device, reading that property throws scriptSecretUnavailable. Merely selecting the environment does not fail a run that never reads the unavailable secret.

Protect output as well as storage

Secret storage does not redact script output. If code logs, returns, copies, posts, or sends a secret, that value has left the protected environment boundary.

// Avoid this: the transcript will contain the value.
console.log(env.API_TOKEN);

// Prefer reporting only non-sensitive state.
return { tokenConfigured: env.API_TOKEN.length > 0 };

Every execution class can read the active environment, including transformers and dashboards. Select a lower-privilege environment before running code that should not see production values.

Grant saved-script permissions

Host access is denied by default and stored per saved script. Save the script, then use either its Permissions control in the Scripts editor or Settings → Scripting → Permissions.

Permission	Script API	Boundary
Clipboard	clipboard.write(value)	Write-only, 64 KiB per call, at most 32 writes per run.
Dialogs	dialog.info, dialog.warn, dialog.error	Fire-and-forget, 4 KiB message, at most 8 per run plus host rate limiting.
Notifications	notifications.show(title, body?)	Fire-and-forget, bounded title/body, at most 8 per run plus host rate limiting.
Network	fetch(input, init?)	Bounded HTTP/HTTPS request and response through Varc’s Fetch bridge.

Manual scripts and command macros can receive these grants. Transformers and dashboards cannot; their permission controls remain unavailable because those execution classes are structurally restricted.

Screenshot plannedGrant Network to a saved scriptVarc Scripting permissions showing a saved manual script with Network enabled and the other host permissions disabled.

Use write-only host actions

clipboard.write("report ready");
dialog.info("The report has been generated.");
notifications.show("Varc script complete", "The report is ready to review.");
return true;

These calls do not return clipboard contents, a dialog choice, or a notification delivery result. Varc checks permissions and quotas before performing the action.

Use Network safely

Network is consent to contact any URL; Varc does not apply a domain allowlist or private-address block. It does enforce URL, header, body, response, redirect, deadline, and cancellation limits. There is no ambient cookie or credential store.

Read the Fetch API before enabling Network for a script that handles secrets.

Move or delete a script

Permissions belong to the saved script identity rather than its name. Renaming or editing that script preserves the reviewed grant. A newly saved copy has a different identity and starts denied. Deleting a script removes the effective grant with it.