paperclipai/paperclip · error · Error

RUNNER_PROTOCOL_EVAL_HISTORY_PUBLIC_BASE_URL must be a crede

Error message

RUNNER_PROTOCOL_EVAL_HISTORY_PUBLIC_BASE_URL must be a credential-free HTTPS URL

What it means

Thrown by validateProtocolEvalHistoryDestination when the public base URL is not an HTTPS URL without credentials, query string, or hash. RUNNER_PROTOCOL_EVAL_HISTORY_PUBLIC_BASE_URL must be a clean https:// origin-style URL used to build public links to the published report.

Source

Thrown at packages/paperclip-runner/scripts/publish-runner-protocol-eval-history.mjs:94

  if (
    !normalizedPrefix ||
    normalizedPrefix
      .split("/")
      .some((segment) => !segment || segment === "." || segment === "..")
  ) {
    throw new Error(
      "RUNNER_PROTOCOL_EVAL_HISTORY_PREFIX must be a safe non-empty key prefix",
    );
  }
  const url = new URL(publicBaseUrl);
  if (
    url.protocol !== "https:" ||
    url.username ||
    url.password ||
    url.search ||
    url.hash
  ) {
    throw new Error(
      "RUNNER_PROTOCOL_EVAL_HISTORY_PUBLIC_BASE_URL must be a credential-free HTTPS URL",
    );
  }
  return {
    bucket,
    prefix: normalizedPrefix,
    publicBaseUrl: url.href.replace(/\/$/, ""),
  };
}

export function isPublicProtocolEvalPath(relativePath) {
  if (
    relativePath.includes("\\") ||
    relativePath.startsWith("/") ||
    relativePath
      .split("/")
      .some((segment) => !segment || segment === "." || segment === "..")
  ) {

View on GitHub (pinned to 01ad858492)

Solutions

Change the scheme to https:// (e.g. https://evals.example.com).
Remove any username/password, query string, and fragment from the URL.
Point the variable at the bare public CDN/site base URL only.

Example fix

// before
RUNNER_PROTOCOL_EVAL_HISTORY_PUBLIC_BASE_URL=http://admin:secret@evals.example.com?v=2
// after
RUNNER_PROTOCOL_EVAL_HISTORY_PUBLIC_BASE_URL=https://evals.example.com

Defensive patterns

Strategy: validation

Validate before calling

const u = new URL(process.env.RUNNER_PROTOCOL_EVAL_HISTORY_PUBLIC_BASE_URL ?? '');
if (u.protocol !== 'https:' || u.username || u.password || u.search || u.hash) throw new Error('base URL must be credential-free https');

Prevention

Configure only bare https:// origin URLs for public base URLs.
Never paste signed or credentialed console URLs into env config.
Add a CI preflight that parses and checks the URL components.

When it happens

Trigger: Setting RUNNER_PROTOCOL_EVAL_HISTORY_PUBLIC_BASE_URL to an http:// URL, embedding user:pass@ credentials, or including ?query or #fragment components.

Common situations: Using a local http:// mirror for testing; pasting a signed or credentialed URL from a cloud console; appending a cache-busting query parameter.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/1ee8d88795156ac0. Report an issue: GitHub.