{"record":{"id":"b36ebe7f9d422e8c","repo":"paperclipai/paperclip","slug":"refusing-to-start-unsafe-config-registrypat","errorCode":null,"errorMessage":"refusing to start: ${unsafe} (${config.registryPath})","messagePattern":"refusing to start: (.+?) \\((.+?)\\)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/tailscale-https-broker/src/config.ts","lineNumber":58,"sourceCode":"  const config: BrokerHostConfig = {\n    socketPath: env.BROKER_SOCKET_PATH ?? \"/run/paperclip-tailscale-broker/broker.sock\",\n    registryPath: env.BROKER_REGISTRY_PATH ?? \"/var/lib/paperclip-tailscale-broker/registry.json\",\n    auditPath: env.BROKER_AUDIT_PATH ?? \"/var/log/paperclip-tailscale-broker/audit.log\",\n    tailscaleBinPath: env.BROKER_TAILSCALE_BIN ?? \"/usr/bin/tailscale\",\n    nodeIdentity: requireEnv(env, \"BROKER_NODE_IDENTITY\"),\n    serviceUid: requireUid(env, \"BROKER_SERVICE_UID\"),\n    serviceGid: requireUid(env, \"BROKER_SERVICE_GID\"),\n    runtimeUid: requireUid(env, \"BROKER_RUNTIME_UID\"),\n    // Throws on a malformed list so the broker refuses to start rather than\n    // starting up silently protecting nothing (PAP-17285).\n    protectedPorts: parseProtectedPorts(env.BROKER_PROTECTED_PORTS),\n  };\n  if (!config.tailscaleBinPath.startsWith(\"/\")) {\n    throw new Error(\"BROKER_TAILSCALE_BIN must be an absolute path\");\n  }\n  const unsafe = registryPathUnsafeReason(config.registryPath);\n  if (unsafe) {\n    throw new Error(`refusing to start: ${unsafe} (${config.registryPath})`);\n  }\n  return config;\n}\n","sourceCodeStart":40,"sourceCodeEnd":62,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/tailscale-https-broker/src/config.ts#L40-L62","documentation":"Fail-closed filesystem check in loadHostConfig: the resolved registry path is in an unsafe location (e.g. world/group-writable or not under a trusted root), so the broker refuses to start rather than trust a registry file an attacker could tamper with.","triggerScenarios":"Thrown at packages/tailscale-https-broker/src/config.ts:58 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the unsafe condition named in the message (e.g. permissions or ownership of the registry path), then restart the broker.","Point the registry path at a safe location and restart."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}