mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-29 04:25:52 +01:00
Dotta
3ded2a0ed5
HTTPS was opt-in, so the UI could still advertise `http://paperclip-dev:<port>` whenever a project template or UI caller forgot the `expose` block. The start path now decides for itself: deliberate opt-out wins, then an explicit opt-in, then the automatic default for an eligible Paperclip-managed worktree runtime on a broker-capable host, then nothing. `PAPERCLIP_MANAGED_RUNTIME_HTTPS` gates the default (`auto` | `off` | `force`). Under `auto` the default is skipped when the broker socket is absent, so an install without the host broker keeps working; an *explicit* opt-in is never gated that way, because a missing broker must fail the start rather than quietly downgrade a requested HTTPS preview to HTTP. Two things the real pre-feature config forced out into the open: - The persisted Paperclip App template pins `port: 45439`, which the broker's dedicated allowlist can never publish. So an exposed runtime now treats a configured or previously used port as a *preference*: kept when it is already an allowlisted app port with a free HMR companion (stable across restarts and deploys), relocated when it is not. - The cross-workspace port-conflict guard checked the *pinned* port even when exposure had relocated the service off it. That rejected a legacy `45439` service purely because the pre-backfill instance still held 45439 — i.e. it would have blocked the one workspace this feature exists to upgrade. It now guards the port the service actually binds. Covered: default on a legacy no-exposure service incl. port relocation, port preservation inside the range, opt-out preserved on HTTP, unmanaged service untouched, broker-absent skip, explicit opt-in still failing loudly without a broker, and repeat-start idempotence landing on the same port pair.