different-ai/openwork · critical

DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https ori

Error message

DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.

What it means

normalizeDiagnosticsOrigin parses DEN_DIAGNOSTICS_ORIGIN with the URL constructor; when parsing fails entirely (not an absolute URL), it throws this error at startup. The value must be a full absolute http/https origin, not a hostname or relative path.

Source

Thrown at ee/apps/den-api/src/env.ts:397

  }

  if (url.protocol !== "redis:" && url.protocol !== "rediss:") {
    throw new Error("DATABASE_REDIS_URL must use redis:// or rediss://.")
  }

  if (url.protocol === "redis:" && !isLocalRedisHost(url.hostname) && !allowInsecureInternal) {
    throw new Error("DATABASE_REDIS_URL must use rediss:// for non-local Redis endpoints unless DATABASE_REDIS_ALLOW_INSECURE_INTERNAL=1 is set for a trusted private network.")
  }

  return url.toString()
}

function normalizeDiagnosticsOrigin(value: string | undefined, allowInsecureHttp: boolean) {
  const configured = optionalString(value) ?? DEFAULT_DEN_DIAGNOSTICS_ORIGIN

  let url: URL
  try {
    url = new URL(configured)
  } catch {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.")
  }

  if (url.protocol !== "http:" && url.protocol !== "https:") {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.")
  }
  if (url.username || url.password || url.search || url.hash || (url.pathname !== "/" && url.pathname !== "")) {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.")
  }
  if (url.protocol !== "https:" && !allowInsecureHttp) {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.")
  }
  return url.origin
}

function normalizeOptionalHttpsOrigin(envName: string, value: string | undefined) {
  const configured = optionalString(value)

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Set DEN_DIAGNOSTICS_ORIGIN to a full origin, e.g. 'https://diagnostics.example.com' (scheme + host, no path)
2. If the default is intended, unset the variable so DEFAULT_DEN_DIAGNOSTICS_ORIGIN applies
3. In non-production, enable allowInsecureHttp only if you really need an http:// origin

Example fix

// before
DEN_DIAGNOSTICS_ORIGIN=diagnostics.internal:9000
// after
DEN_DIAGNOSTICS_ORIGIN=https://diagnostics.internal:9000

function validateDiagnosticsOrigin(v: string | undefined): void {
  if (!v) return // default applies
  try { new URL(v) } catch { throw new Error('DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.') }
}

function isAbsoluteHttpUrl(v: string): boolean {
  try { const u = new URL(v); return u.protocol === 'http:' || u.protocol === 'https:' } catch { return false }
}

try {
  bootServer(env)
} catch (e) {
  if (String((e as Error).message).includes('DEN_DIAGNOSTICS_ORIGIN must be an absolute')) {
    console.error('Fix DEN_DIAGNOSTICS_ORIGIN: set full https://host[:port] or unset for default')
    process.exit(1)
  }
  throw e
}

When it happens

Trigger: DEN_DIAGNOSTICS_ORIGIN set to something like 'diagnostics.example.com', '//host', '/path', or an empty/invalid string that optionalString still passes through and new URL() cannot parse.

Common situations: Deploy config missing the scheme ('example.com:8080' is ambiguous), YAML interpolation leaving a placeholder, copying a path instead of a URL.

Related errors

• DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a
• ${envName} must be an absolute https origin.
• DEN_API_PUBLIC_URL must be an absolute http or https URL.
• PORT must be an integer between 1 and 65535
• DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/a51f9d3aedbb11c2. Report an issue: GitHub.