{"record":{"id":"c8d184ff2937291d","repo":"sipeed/picoclaw","slug":"must-be-in-range-1-65535","errorCode":null,"errorMessage":"must be in range 1-65535","messagePattern":"must be in range 1-65535","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"web/backend/main.go","lineNumber":564,"sourceCode":"\t}\n\n\tif hostOverrideActive && explicitPublic {\n\t\tlogger.InfoC(\"web\", \"Ignoring -public because launcher host was explicitly set\")\n\t}\n\n\tif decision := launcherAllowlistBypassLogPolicy(hostInput, effectivePublic, launcherCfg); decision.emit {\n\t\tswitch decision.level {\n\t\tcase logger.WARN:\n\t\t\tlogger.WarnC(\"web\", decision.message)\n\t\tdefault:\n\t\t\tlogger.InfoC(\"web\", decision.message)\n\t\t}\n\t}\n\n\tportNum, err := strconv.Atoi(effectivePort)\n\tif err != nil || portNum < 1 || portNum > 65535 {\n\t\tif err == nil {\n\t\t\terr = errors.New(\"must be in range 1-65535\")\n\t\t}\n\t\tlogger.Fatalf(\"Invalid port %q: %v\", effectivePort, err)\n\t}\n\n\topenResult, err := openLauncherListeners(hostInput, effectivePublic, effectivePort)\n\tif err != nil {\n\t\tlogger.Fatalf(\"Failed to open launcher listener(s): %v\", err)\n\t}\n\tlisteners := openResult.Listeners\n\n\tdashboardSessionCookie, dashErr := middleware.NewLauncherDashboardSessionCookie()\n\tif dashErr != nil {\n\t\tlogger.Fatalf(\"Dashboard auth setup failed: %v\", dashErr)\n\t}\n\n\t// Open the bcrypt password store (creates the DB file on first run).\n\tauthStore, authStoreErr := dashboardauth.New(picoHome)\n\tvar passwordStore api.PasswordStore","sourceCodeStart":546,"sourceCodeEnd":582,"githubUrl":"https://github.com/sipeed/picoclaw/blob/49183d7e8daed0dba89ddbb6fcb60089401d9680/web/backend/main.go#L546-L582","documentation":"Startup-time port validation in web/backend/main.go. effectivePort (from flag, env, or config resolution) is parsed with strconv.Atoi and range-checked; an out-of-range integer produces this error, a non-integer surfaces the Atoi error, and either way logger.Fatalf terminates the process before listeners open. This is deliberate fail-fast: the launcher refuses to run on an unusable port.","triggerScenarios":"Launching with -port 0, -port 65536, -port 8080t, or an env/config value that resolves to those; whitespace or a trailing newline in a port env var making Atoi fail.","commonSituations":"Typo'd flag in a systemd unit or Dockerfile; CI overriding PORT with an empty or invalid value; scripts passing a computed port that can exceed 65535 after adding an offset.","solutions":["Set a valid port: an integer between 1 and 65535 (unprivileged users need >1024)","Print the effective value before launching to catch env/flag precedence surprises","In wrapper scripts, validate with a one-liner before exec: case \"$PORT\" in ''|*[!0-9]*|0|655[3-6][5-9]*) echo bad port; exit;; esac","If you meant 'any free port', pick one yourself (net.Listen :0 then close) because this launcher does not accept 0"],"exampleFix":"// before\nlogger.Fatalf(\"Invalid port %q: %v\", effectivePort, err)\n\n// after (validate before startup, in the caller)\nportNum, err := strconv.Atoi(portStr)\nif err != nil || portNum < 1 || portNum > 65535 {\n    return fmt.Errorf(\"port %q must be in range 1-65535\", portStr)\n}","handlingStrategy":"validation","validationCode":"func validPort(s string) bool {\n    n, err := strconv.Atoi(strings.TrimSpace(s))\n    return err == nil && n >= 1 && n <= 65535\n}\n\nif !validPort(os.Getenv(\"PORT\")) {\n    return fmt.Errorf(\"PORT must be 1-65535, got %q\", os.Getenv(\"PORT\"))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate ports in wrapper scripts/systemd units before exec'ing the binary — it exits via Fatalf","Note that port 0 ('pick a free port') is rejected here; choose explicitly","Trim whitespace from env-provided values; strconv.Atoi does not","Unprivileged users must pick >1024 or the listener open will fail next"],"tags":["go","config","port","startup","fail-fast"],"backgroundTag":null,"analyzedSha":"49183d7e8daed0dba89ddbb6fcb60089401d9680","analyzedAt":"2026-08-15T21:55:41.315Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}