{"record":{"id":"f9b78cc507a88514","repo":"paperclipai/paperclip","slug":"broker-tailscale-bin-must-be-an-absolute-path","errorCode":null,"errorMessage":"BROKER_TAILSCALE_BIN must be an absolute path","messagePattern":"BROKER_TAILSCALE_BIN must be an absolute path","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/tailscale-https-broker/src/config.ts","lineNumber":54,"sourceCode":"  return Number(raw);\n}\n\nexport function loadHostConfig(env: NodeJS.ProcessEnv): BrokerHostConfig {\n  const config: BrokerHostConfig = {\n    socketPath: env.BROKER_SOCKET_PATH ?? \"/run/paperclip-tailscale-broker/broker.sock\",\n    registryPath: env.BROKER_REGISTRY_PATH ?? \"/var/lib/paperclip-tailscale-broker/registry.json\",\n    auditPath: env.BROKER_AUDIT_PATH ?? \"/var/log/paperclip-tailscale-broker/audit.log\",\n    tailscaleBinPath: env.BROKER_TAILSCALE_BIN ?? \"/usr/bin/tailscale\",\n    nodeIdentity: requireEnv(env, \"BROKER_NODE_IDENTITY\"),\n    serviceUid: requireUid(env, \"BROKER_SERVICE_UID\"),\n    serviceGid: requireUid(env, \"BROKER_SERVICE_GID\"),\n    runtimeUid: requireUid(env, \"BROKER_RUNTIME_UID\"),\n    // Throws on a malformed list so the broker refuses to start rather than\n    // starting up silently protecting nothing (PAP-17285).\n    protectedPorts: parseProtectedPorts(env.BROKER_PROTECTED_PORTS),\n  };\n  if (!config.tailscaleBinPath.startsWith(\"/\")) {\n    throw new Error(\"BROKER_TAILSCALE_BIN must be an absolute path\");\n  }\n  const unsafe = registryPathUnsafeReason(config.registryPath);\n  if (unsafe) {\n    throw new Error(`refusing to start: ${unsafe} (${config.registryPath})`);\n  }\n  return config;\n}\n","sourceCodeStart":36,"sourceCodeEnd":62,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/tailscale-https-broker/src/config.ts#L36-L62","documentation":"Path-shape guard in loadHostConfig for BROKER_TAILSCALE_BIN: the configured tailscale binary path is not absolute (does not start with '/'). Rejected because executing a relative path would resolve against the CWD, undermining the fixed privileged-execution model.","triggerScenarios":"Thrown at packages/tailscale-https-broker/src/config.ts:54 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set BROKER_TAILSCALE_BIN to an absolute path, e.g. /usr/bin/tailscale.","Unset BROKER_TAILSCALE_BIN so the broker resolves tailscale from PATH."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}