{"record":{"id":"0da52f9722d0f499","repo":"paperclipai/paperclip","slug":"broker-protected-ports-must-not-list-443-the-prim","errorCode":null,"errorMessage":"BROKER_PROTECTED_PORTS must not list 443; the primary route is always protected","messagePattern":"BROKER_PROTECTED_PORTS must not list 443; the primary route is always protected","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/tailscale-https-broker/src/port-policy.ts","lineNumber":43,"sourceCode":" * than silently protecting nothing. Protecting a port the broker cannot mutate\n * anyway is harmless, so no range restriction is applied — but `443` is rejected\n * because the primary route has its own stronger, non-optional invariant and\n * listing it here would imply it were opt-in.\n */\nexport function parseProtectedPorts(raw: string | undefined): number[] {\n  if (raw === undefined) return [];\n  const tokens = raw.split(/[,\\s]+/).filter((token) => token.length > 0);\n  const ports = new Set<number>();\n  for (const token of tokens) {\n    if (!/^[0-9]{1,5}$/.test(token)) {\n      throw new Error(`BROKER_PROTECTED_PORTS contains a non-numeric entry: ${JSON.stringify(token)}`);\n    }\n    const port = Number(token);\n    if (port < 1 || port > 65535) {\n      throw new Error(`BROKER_PROTECTED_PORTS contains an out-of-range port: ${token}`);\n    }\n    if (port === 443) {\n      throw new Error(\"BROKER_PROTECTED_PORTS must not list 443; the primary route is always protected\");\n    }\n    ports.add(port);\n  }\n  return [...ports].sort((a, b) => a - b);\n}\n","sourceCodeStart":25,"sourceCodeEnd":49,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/tailscale-https-broker/src/port-policy.ts#L25-L49","documentation":"parseProtectedPorts guard: the operator listed 443 in BROKER_PROTECTED_PORTS. 443 is rejected because the primary HTTPS route is protected by a stronger non-optional invariant; listing it would misleadingly imply that protection were opt-in.","triggerScenarios":"Thrown at packages/tailscale-https-broker/src/port-policy.ts:43 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove 443 from BROKER_PROTECTED_PORTS; the primary route is always protected."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}