Hmbown/CodeWhale · error · anyhow::Error

Codewhale account API base URL must be an origin without a p

Error message

Codewhale account API base URL must be an origin without a path

What it means

validate_api_base only accepts an origin: the URL path must be empty or exactly '/'. Any real path (e.g. /api or /codewhale) is rejected because the transport appends fixed endpoint paths itself and a base with a path would produce wrong request URLs.

Source

Thrown at crates/cli/src/cloud.rs:770

    writeln!(out, "API: {api_base}")?;
    Ok(())
}

struct ValidatedApiBase {
    url: Url,
    display: String,
}

fn validate_api_base(value: &str) -> Result<ValidatedApiBase> {
    let mut url = Url::parse(value.trim()).context("invalid Codewhale account API base URL")?;
    if !url.username().is_empty() || url.password().is_some() {
        bail!("Codewhale account API base URL must not contain credentials");
    }
    if url.query().is_some() || url.fragment().is_some() {
        bail!("Codewhale account API base URL must not contain a query or fragment");
    }
    if !matches!(url.path(), "" | "/") {
        bail!("Codewhale account API base URL must be an origin without a path");
    }
    let host = url
        .host_str()
        .ok_or_else(|| anyhow!("Codewhale account API base URL must include a host"))?;
    let allowed = url.scheme() == "https" || (url.scheme() == "http" && is_loopback_host(host));
    if !allowed {
        bail!(
            "Codewhale account API base URL must use HTTPS (loopback HTTP is allowed for testing)"
        );
    }
    url.set_path("/");
    let display = url.as_str().trim_end_matches('/').to_string();
    Ok(ValidatedApiBase { url, display })
}

fn validate_verification_url(
    value: &str,
    api_base: &str,

View on GitHub (pinned to 0c42157ee5)

Solutions

Use the bare origin: https://host (optionally with port); the CLI adds /api/... paths itself.
If you need a path prefix, configure the proxy to rewrite at the root instead of encoding it in api-base.
For local testing, bind the test server at root, e.g. http://127.0.0.1:8080.

Example fix

# before
--api-base https://claude-proxy.internal/api

# after
--api-base https://claude-proxy.internal   # proxy rewrites /api/* to backend

Defensive patterns

Strategy: validation

Validate before calling

fn has_no_path(u: &url::Url) -> bool { matches!(u.path(), "" | "/") }

Type guard

fn is_valid_api_base(value: &str) -> bool {
    url::Url::parse(value.trim()).map(|u| {
        matches!(u.path(), "" | "/") && u.query().is_none() && u.fragment().is_none()
            && (u.scheme() == "https" || u.scheme() == "http" && is_loopback_host(u.host_str().unwrap_or("")))
    }).unwrap_or(false)
}

Prevention

Enter the server root, not an endpoint or subpath.
Handle path prefixes at the reverse proxy, not in api-base.
Add a config lint that rejects paths in api-base.

When it happens

Trigger: Setting --api-base https://example.com/api, https://host/codewhale/, or a reverse-proxy subpath URL; pasting an endpoint URL instead of the server root.

Common situations: Self-hosted/loopback test servers mounted under a subpath, users copying a full API endpoint from docs, proxies that require a path prefix (which must be handled at the proxy, not in api-base).

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/2eaf47dc4b04c2cb. Report an issue: GitHub.