can rebind take a screenshot of the screen or a selection of the screen
Yes, Rebind can take a screenshot of an entire monitor or a specific rectangular region using the Screen.Capture API.
Screen.Capture() captures the monitor currently under the mouse cursor. You can also specify a particular display with { display = index } (indexes come from Screen.List()).region table with { region = { x = X, y = Y, w = WIDTH, h = HEIGHT } } in the local coordinates of that display.image: A base64-encoded lossless PNG string.width and height: Dimensions of the captured area.cursor: The cursor position { x, y } at the moment of capture.display: Metadata about the display that was captured.Codec.Base64Decode(cap.image) and save it with File.Write("screenshot.png", bytes).Screen.Capture performs image encoding on a worker thread and yields, so it must be executed inside a Run(function() ... end) coroutine or an Async(...) callback. Calling it synchronously outside a coroutine will raise an error.Screen.Capture is currently unavailable and will raise an error.max_edge = 1280 in opts to automatically downscale the image, or add rebind: memory_limit_mb=64 to your script's modeline to avoid hitting the default 8 MB Luau heap limit.create a script
I will assume you want hotkeys to capture either the full screen or a selected region and save the result as a PNG file in the script's directory.
memory_limit_mb=64): Raises the script's Luau heap ceiling to prevent memory overflow when encoding and decoding large high-resolution screenshot strings.Bind with Async: Wraps the keybind actions in coroutines so that Screen.Capture() can yield safely while processing the PNG on a worker thread.F9): Grabs the active display under the cursor using Screen.Capture(), decodes the base64 PNG data via Codec.Base64Decode, and saves it to a timestamped file in the script folder with File.Write.F10): Samples the current cursor position with System.Mouse() and captures a 500×500 square region centered on the cursor via the region = { x, y, w, h } option.can it resize the screenshot so that the images aren't huge
Yes. Screen.Capture includes a built-in max_edge option that automatically downscales the output image so its longer side is at most that many pixels while preserving the aspect ratio.
Here is the updated script with a configurable max-dimension slider in the UI options:
max_edge parameter: When passed to Screen.Capture({ max_edge = ... }), the capture engine proportionally downscales the image before producing the base64 PNG data. For example, a 4K display (3840×2160) with max_edge = 1280 outputs a 1280×720 image.what do perms look like in rebind.toml for a script
In rebind.toml, permissions are declared under the [runtime] table as a list of strings called permissions.
Rebind only gates two specific permissions:
"net": Access to the Net namespace (HTTP client, Net.Listen, WebSocket, and UDP)."exec": Access to System.Exec and System.ExecDetached.All other namespaces (Screen, File, HID, Input, Clipboard, Audio, etc.) have no permission checks.
[package] name = "my-tool" version = "1.0.0" min_sdk = "3.0.0" [runtime] permissions = ["net", "exec"]
System.Exec)[runtime] permissions = ["net"]
If your script doesn't need network or shell access (like a screen capture, key remap, or macro script), declare an empty list:
[runtime] permissions = []
permissions is declared, the runtime switches to an allow-list mode. Any permission not explicitly in the list will throw a runtime error when called (e.g. System.Exec() requires 'exec' permission).permissions key entirely, the package is granted all permissions by default. However, if you plan to publish the package to the Marketplace, rebind check and the registry will refuse it unless permissions is explicitly declared (even if just permissions = []).how much of this is done permissions] target_process = ["PathOfExile.exe", "PathOfExileSteam.exe"] # HID output only when this window is focused network = ["poe.ninja", "api.rebind.gg"] # domain allowlist, nothing else screen = "target_window" # can't capture other apps clipboard = "read" files = "script_dir" # no access outside its own folder input_observe = "bound_keys" # sees only keys it binds, not everything typed
Here is the breakdown of what Rebind actually implements today versus what looks like a wishlist in that snippet:
target_process — Built-in (via targeting, not permissions)[runtime] in rebind.toml:
[runtime] process = ["PathOfExile.exe", "PathOfExileSteam.exe"]
files = "script_dir" — Enforced by Sandbox ArchitectureFile namespace is hard-sandboxed to the script directory by design. Any path traversal (like ../) or attempt to access outside folders throws path traversal not allowed at runtime.input_observe = "bound_keys" — Supported by Default (Bind)Bind(...) rather than defining global OnDown/OnUp hooks, Rebind only intercepts those exact declared keys at the OS level. It never captures or inspects other keystrokes. (Or, if defining OnDown/OnUp, setting key_block = false turns off exclusive capture).network = ["domain1", "domain2"] (Domain allowlisting):
permissions = ["net"]). Once "net" is granted, the script can communicate with any URL or IP.screen = "target_window" (Window-scoped capture):
Screen.Capture and pixel sampling operate at the display or coordinate level across the virtual desktop. There is no OS-level window sandbox restricting pixel reads to only a specific window.clipboard = "read" (Read/write granularity):
Clipboard namespace is ungated; if the script runs on Windows/macOS, it has access to both Clipboard.Get() and Clipboard.Set().rebind.toml:To achieve as much of your goal as Rebind currently supports, your rebind.toml would look like this:
[package] name = "poe-overlay" version = "1.0.0" min_sdk = "3.4.1" [runtime] # 1. Target only PoE processes (script deactivates when tabbed out) process = ["PathOfExile.exe", "PathOfExileSteam.exe"] # 2. Grant network access (cannot restrict by domain) # Omitting "exec" ensures shell execution is blocked. permissions = ["net"]
And in your code:
Bind("F5", ...) instead of OnDown so only your configured hotkeys are captured.write a md spec of the unsupported perms that need to be added so i can add it to the backlog
rebind.tomlRebind currently treats permissions as coarse binary switches (net, exec) while other capabilities are ungated (Clipboard, Screen). This specification proposes three additions to the permission model in rebind.toml:
network = [...])screen = "target_window")clipboard = "read" | "write" | ["read", "write"])These controls limit data exfiltration risks and protect user privacy when running untrusted or marketplace community scripts.
Security-sensitive game overlays, text utilities, and automation scripts often require partial access to external subsystems:
poe.ninja), but should not have arbitrary outbound internet access.rebind.toml)Replace or extend the current binary "net" permission with an explicit domain array:
[runtime] # Option A: Coarse permission (existing) permissions = ["net"] # Option B: Restricted domain allowlist (proposed) [runtime.permissions] network = [ "poe.ninja", "*.poe.ninja", "api.rebind.gg" ]
network is specified as an array, the host network layer intercepts all outgoing requests across Net.Get, Net.Post, Net.Put, Net.Patch, Net.Delete, Net.Head, Net.Request, and Net.WSConnect."api.rebind.gg" matches only api.rebind.gg."*.poe.ninja" matches poe.ninja, api.poe.ninja, etc."127.0.0.1").Net.Listen, Net.WSListen, Net.UDPListen) are disallowed under domain-restricted mode unless "listen" or localhost is explicitly granted.Net request to 'evil.com' blocked by network domain allowlist.rebind.toml)Restrict visual inspection APIs (Screen.Capture, Screen.GetPixelColor, Screen.SearchForColor, Screen.FindImage) to only the process or window targeted by the script:
[runtime] process = ["PathOfExile.exe", "PathOfExileSteam.exe"] [runtime.permissions] screen = "target_window" # Options: "full" (default), "target_window", "none"
"none": All Screen sampling calls fail immediately with a permission error."target_window":
process, process_regex, window, or window_regex to be defined in [runtime].Screen sampling calls return nil or error.#000000) or raise an out-of-bounds error.PrintWindow/DWM capture) and macOS (via ScreenCaptureKit window-filtering), captures only composite the targeted window surface, excluding all occluding or underlying windows.Screen.Capture outside target bounds raises:Screen capture blocked: Script is restricted to target_window.rebind.toml)Control read and write capabilities independently:
[runtime.permissions] clipboard = "read" # Options: "read", "write", ["read", "write"], "none"
"none": Both Clipboard.Get() and Clipboard.Set() fail."read":
Clipboard.Get() succeeds.Clipboard.Set(...) raises a runtime permission error."write":
Clipboard.Set(...) succeeds.Clipboard.Get() raises a runtime permission error.["read", "write"] or "full": Standard unrestricted behavior.Clipboard.Get() requires 'clipboard:read' permission.For bare single-file scripts without a rebind.toml, represent these permissions using standard key-value modeline pairs:
--[[
rebind: min_sdk=3.8.0
rebind: permission=clipboard:read
rebind: permission=screen:target_window
rebind: net_domain=poe.ninja net_domain=api.rebind.gg
]][runtime.permissions] or define permissions = ["net"] retain legacy, unrestricted behavior for those subsystems.min_sdk (e.g., 3.8.0). Older engines encountering these keys must fail validation at load time rather than silently widening the permission scope.rebind check should inspect these fields and display the restricted bounds as security badges on marketplace listings (e.g., "Network: 2 domains", "Screen: Target Window Only").