different-ai/openwork · critical

DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a

Error message

DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.

What it means

normalizeDiagnosticsOrigin enforces that the value is a bare origin: any embedded username/password, query string, hash, or non-root pathname is rejected, because the diagnostics endpoint is used as an origin only and extra components indicate a misconfiguration.

Source

Thrown at ee/apps/den-api/src/env.ts:406

  return url.toString()
}

function normalizeDiagnosticsOrigin(value: string | undefined, allowInsecureHttp: boolean) {
  const configured = optionalString(value) ?? DEFAULT_DEN_DIAGNOSTICS_ORIGIN

  let url: URL
  try {
    url = new URL(configured)
  } catch {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.")
  }

  if (url.protocol !== "http:" && url.protocol !== "https:") {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.")
  }
  if (url.username || url.password || url.search || url.hash || (url.pathname !== "/" && url.pathname !== "")) {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.")
  }
  if (url.protocol !== "https:" && !allowInsecureHttp) {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.")
  }
  return url.origin
}

function normalizeOptionalHttpsOrigin(envName: string, value: string | undefined) {
  const configured = optionalString(value)
  if (!configured) {
    return undefined
  }

  let url: URL
  try {
    url = new URL(configured)
  } catch {
    throw new Error(`${envName} must be an absolute https origin.`)

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Strip the path/query/fragment so only scheme://host[:port] remains, e.g. 'https://host/diag/v1?key=x' → 'https://host'
2. Move any credentials or query params into dedicated env vars or headers, never into the origin
3. If a path is genuinely needed, the app must support a base-URL var instead — this var intentionally accepts origins only

Example fix

// before
DEN_DIAGNOSTICS_ORIGIN=https://diag.example.com/ingest?token=abc
// after
DEN_DIAGNOSTICS_ORIGIN=https://diag.example.com

function validateBareOrigin(v: string | undefined): void {
  if (!v) return
  const u = new URL(v)
  if (u.username || u.password || u.search || u.hash || (u.pathname !== '/' && u.pathname !== '')) {
    throw new Error('DEN_DIAGNOSTICS_ORIGIN must be a bare origin (no path/query/credentials)')
  }
}

function isBareOrigin(v: string): boolean {
  try {
    const u = new URL(v)
    return !u.username && !u.password && !u.search && !u.hash && (u.pathname === '/' || u.pathname === '')
  } catch { return false }
}

try {
  bootServer(env)
} catch (e) {
  if (String((e as Error).message).includes('DEN_DIAGNOSTICS_ORIGIN cannot contain')) {
    console.error('Use only scheme://host[:port]; move path/credentials elsewhere')
    process.exit(1)
  }
  throw e
}

When it happens

Trigger: DEN_DIAGNOSTICS_ORIGIN containing 'user:pass@', '?key=...', '#frag', or a path like 'https://host/diag/v1'.

Common situations: Pasting a full endpoint URL including a path or API key into an origin-only variable; accidentally including credentials to 'make it work'.

Related errors

• DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https ori
• ${envName} must be an absolute https origin.
• DEN_API_PUBLIC_URL must be an absolute http or https URL.
• PORT must be an integer between 1 and 65535
• DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/41f79fa9db404801. Report an issue: GitHub.