{"record":{"id":"a51f9d3aedbb11c2","repo":"different-ai/openwork","slug":"den-diagnostics-origin-must-be-an-absolute-http-or","errorCode":null,"errorMessage":"DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.","messagePattern":"DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"ee/apps/den-api/src/env.ts","lineNumber":397,"sourceCode":"  }\n\n  if (url.protocol !== \"redis:\" && url.protocol !== \"rediss:\") {\n    throw new Error(\"DATABASE_REDIS_URL must use redis:// or rediss://.\")\n  }\n\n  if (url.protocol === \"redis:\" && !isLocalRedisHost(url.hostname) && !allowInsecureInternal) {\n    throw new Error(\"DATABASE_REDIS_URL must use rediss:// for non-local Redis endpoints unless DATABASE_REDIS_ALLOW_INSECURE_INTERNAL=1 is set for a trusted private network.\")\n  }\n\n  return url.toString()\n}\n\nfunction normalizeDiagnosticsOrigin(value: string | undefined, allowInsecureHttp: boolean) {\n  const configured = optionalString(value) ?? DEFAULT_DEN_DIAGNOSTICS_ORIGIN\n\n  let url: URL\n  try {\n    url = new URL(configured)\n  } catch {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.\")\n  }\n\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.\")\n  }\n  if (url.username || url.password || url.search || url.hash || (url.pathname !== \"/\" && url.pathname !== \"\")) {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.\")\n  }\n  if (url.protocol !== \"https:\" && !allowInsecureHttp) {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.\")\n  }\n  return url.origin\n}\n\nfunction normalizeOptionalHttpsOrigin(envName: string, value: string | undefined) {\n  const configured = optionalString(value)","sourceCodeStart":379,"sourceCodeEnd":415,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/env.ts#L379-L415","documentation":"normalizeDiagnosticsOrigin parses DEN_DIAGNOSTICS_ORIGIN with the URL constructor; when parsing fails entirely (not an absolute URL), it throws this error at startup. The value must be a full absolute http/https origin, not a hostname or relative path.","triggerScenarios":"DEN_DIAGNOSTICS_ORIGIN set to something like 'diagnostics.example.com', '//host', '/path', or an empty/invalid string that optionalString still passes through and new URL() cannot parse.","commonSituations":"Deploy config missing the scheme ('example.com:8080' is ambiguous), YAML interpolation leaving a placeholder, copying a path instead of a URL.","solutions":["Set DEN_DIAGNOSTICS_ORIGIN to a full origin, e.g. 'https://diagnostics.example.com' (scheme + host, no path)","If the default is intended, unset the variable so DEFAULT_DEN_DIAGNOSTICS_ORIGIN applies","In non-production, enable allowInsecureHttp only if you really need an http:// origin"],"exampleFix":"// before\nDEN_DIAGNOSTICS_ORIGIN=diagnostics.internal:9000\n// after\nDEN_DIAGNOSTICS_ORIGIN=https://diagnostics.internal:9000","handlingStrategy":"validation","validationCode":"function validateDiagnosticsOrigin(v: string | undefined): void {\n  if (!v) return // default applies\n  try { new URL(v) } catch { throw new Error('DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.') }\n}","typeGuard":"function isAbsoluteHttpUrl(v: string): boolean {\n  try { const u = new URL(v); return u.protocol === 'http:' || u.protocol === 'https:' } catch { return false }\n}","tryCatchPattern":"try {\n  bootServer(env)\n} catch (e) {\n  if (String((e as Error).message).includes('DEN_DIAGNOSTICS_ORIGIN must be an absolute')) {\n    console.error('Fix DEN_DIAGNOSTICS_ORIGIN: set full https://host[:port] or unset for default')\n    process.exit(1)\n  }\n  throw e\n}","preventionTips":["Always include the scheme in URL-typed env vars","Validate env vars at CI/deploy time with a startup smoke test","Prefer unsetting the var to inherit DEFAULT_DEN_DIAGNOSTICS_ORIGIN"],"tags":["configuration","env","startup"],"backgroundTag":"invalid-env-var","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}