paperclipai/paperclip · error · Error

BROKER_PROTECTED_PORTS must not list 443; the primary route

Error message

BROKER_PROTECTED_PORTS must not list 443; the primary route is always protected

What it means

parseProtectedPorts guard: the operator listed 443 in BROKER_PROTECTED_PORTS. 443 is rejected because the primary HTTPS route is protected by a stronger non-optional invariant; listing it would misleadingly imply that protection were opt-in.

Source

Thrown at packages/tailscale-https-broker/src/port-policy.ts:43

 * than silently protecting nothing. Protecting a port the broker cannot mutate
 * anyway is harmless, so no range restriction is applied — but `443` is rejected
 * because the primary route has its own stronger, non-optional invariant and
 * listing it here would imply it were opt-in.
 */
export function parseProtectedPorts(raw: string | undefined): number[] {
  if (raw === undefined) return [];
  const tokens = raw.split(/[,\s]+/).filter((token) => token.length > 0);
  const ports = new Set<number>();
  for (const token of tokens) {
    if (!/^[0-9]{1,5}$/.test(token)) {
      throw new Error(`BROKER_PROTECTED_PORTS contains a non-numeric entry: ${JSON.stringify(token)}`);
    }
    const port = Number(token);
    if (port < 1 || port > 65535) {
      throw new Error(`BROKER_PROTECTED_PORTS contains an out-of-range port: ${token}`);
    }
    if (port === 443) {
      throw new Error("BROKER_PROTECTED_PORTS must not list 443; the primary route is always protected");
    }
    ports.add(port);
  }
  return [...ports].sort((a, b) => a - b);
}

View on GitHub (pinned to 120ae5428f)

Solutions

1. Remove 443 from BROKER_PROTECTED_PORTS; the primary route is always protected.

When it happens

Trigger: Thrown at packages/tailscale-https-broker/src/port-policy.ts:43 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/0da52f9722d0f499. Report an issue: GitHub.