From a33c63a03a4b3d058a5ad0474bcf27c62c03727a Mon Sep 17 00:00:00 2001
From: Tu Zengji <73597555+tuzengji@users.noreply.github.com>
Date: Thu, 15 Oct 2026 19:13:17 +0800
Subject: [PATCH] fix(config): reject hostless addresses in single-user mode

---
 CHANGELOG.md                | 6 ++++++
 server/src/config.ts        | 1 +
 server/tests/config.test.ts | 9 +++++++++
 3 files changed, 16 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2aa59af7d..13756bddf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,6 +32,12 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
   `code_required` (below). A server and a computer must be upgraded together: an older computer has
   no `/sign-in/code`.
 
+### No-sign-in startup rejects addresses without a host
+
+With `OPENBOT_SINGLE_USER=true`, an address such as `example.com:3010` in `OPENBOT_PUBLIC_URL`,
+`OPENBOT_APP_URL` or `TRUSTED_ORIGINS` now refuses startup. It previously counted as a private
+network address and only warned, even though the missing URL scheme left its host unidentified.
+
 ### A reply's tool calls fold into one line
 
 A Bot that searched, read two pages and checked Drive before answering drew four lines above its
diff --git a/server/src/config.ts b/server/src/config.ts
index 337100055..51e29edc8 100644
--- a/server/src/config.ts
+++ b/server/src/config.ts
@@ -560,6 +560,7 @@ function reachOf(raw: string): Reach {
     return "public";
   }
   bare = bare.replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (!bare) return "public";
 
   if (
     bare === "localhost" ||
diff --git a/server/tests/config.test.ts b/server/tests/config.test.ts
index 7e5b1ddbe..4651f8675 100644
--- a/server/tests/config.test.ts
+++ b/server/tests/config.test.ts
@@ -530,6 +530,15 @@ describe("deployment configuration", () => {
       { TRUSTED_ORIGINS: "http://localhost:3010,https://openbot.example.com" },
     ],
     ["an address that is not a URL at all", { OPENBOT_PUBLIC_URL: "openbot" }],
+    [
+      "a public URL missing its scheme",
+      { OPENBOT_PUBLIC_URL: "example.com:3010" },
+    ],
+    ["an app URL missing its scheme", { OPENBOT_APP_URL: "example.com:3010" }],
+    [
+      "a trusted origin missing its scheme",
+      { TRUSTED_ORIGINS: "http://localhost:3010,example.com:3010" },
+    ],
   ])("refuses no sign-in combined with %s", (_label, published) => {
     expect(() =>
       loadConfig({ ...withoutSignIn, ...OPEN, ...published }),