paperclipai/paperclip · error · Error

refusing to start: ${unsafe} (${config.registryPath})

Error message

refusing to start: ${unsafe} (${config.registryPath})

What it means

Fail-closed filesystem check in loadHostConfig: the resolved registry path is in an unsafe location (e.g. world/group-writable or not under a trusted root), so the broker refuses to start rather than trust a registry file an attacker could tamper with.

Source

Thrown at packages/tailscale-https-broker/src/config.ts:58

  const config: BrokerHostConfig = {
    socketPath: env.BROKER_SOCKET_PATH ?? "/run/paperclip-tailscale-broker/broker.sock",
    registryPath: env.BROKER_REGISTRY_PATH ?? "/var/lib/paperclip-tailscale-broker/registry.json",
    auditPath: env.BROKER_AUDIT_PATH ?? "/var/log/paperclip-tailscale-broker/audit.log",
    tailscaleBinPath: env.BROKER_TAILSCALE_BIN ?? "/usr/bin/tailscale",
    nodeIdentity: requireEnv(env, "BROKER_NODE_IDENTITY"),
    serviceUid: requireUid(env, "BROKER_SERVICE_UID"),
    serviceGid: requireUid(env, "BROKER_SERVICE_GID"),
    runtimeUid: requireUid(env, "BROKER_RUNTIME_UID"),
    // Throws on a malformed list so the broker refuses to start rather than
    // starting up silently protecting nothing (PAP-17285).
    protectedPorts: parseProtectedPorts(env.BROKER_PROTECTED_PORTS),
  };
  if (!config.tailscaleBinPath.startsWith("/")) {
    throw new Error("BROKER_TAILSCALE_BIN must be an absolute path");
  }
  const unsafe = registryPathUnsafeReason(config.registryPath);
  if (unsafe) {
    throw new Error(`refusing to start: ${unsafe} (${config.registryPath})`);
  }
  return config;
}

View on GitHub (pinned to 120ae5428f)

Solutions

1. Fix the unsafe condition named in the message (e.g. permissions or ownership of the registry path), then restart the broker.
2. Point the registry path at a safe location and restart.

When it happens

Trigger: Thrown at packages/tailscale-https-broker/src/config.ts:58 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/b36ebe7f9d422e8c. Report an issue: GitHub.