Hmbown/CodeWhale · error · anyhow::Error

Codewhale account API base URL must not contain a query or…

Error message

Codewhale account API base URL must not contain a query or fragment

What it means

The account API base URL must be a bare origin: validate_api_base rejects any URL carrying a query string or fragment, since the client builds /api/... paths itself and a query or fragment would corrupt request URLs or be dropped inconsistently.

Solutions

Remove everything from ? or # onward; use only the origin, e.g. https://api.example.com.
Query-parameter auth is unsupported for this endpoint — use header-based auth.
Retry the command with the origin-only URL.

Example fix

// before
CODEWHALE_API_BASE=https://api.example.com?env=prod
// after
CODEWHALE_API_BASE=https://api.example.com

Defensive patterns

Strategy: validation

Validate before calling

fn is_bare_origin(url: &str) -> bool {
    url::Url::parse(url.trim())
        .map(|u| u.query().is_none() && u.fragment().is_none())
        .unwrap_or(false)
}

Prevention

Configure origin-only URLs: cut at the first ? or #.
Do not paste URLs straight from a browser address bar.
Never put auth in query parameters for this client.
Validate the base URL in CI config checks before deploy.

When it happens

Trigger: Setting the base URL with a trailing ?key=... query or #fragment, e.g. https://api.example.com?env=prod or https://api.example.com/#/dashboard.

Common situations: Copying a URL from a browser address bar (often carries query/fragment); adding an API key as a query parameter out of habit.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/9c40b44315475ff4. Report an issue: GitHub.

Appendix: source

Thrown at crates/cli/src/cloud.rs:1021

        writeln!(out, "Plan: {}", printable(&user.plan))?;
    }
    writeln!(out, "Profile: {}", printable(profile))?;
    writeln!(out, "API: {api_base}")?;
    Ok(())
}

struct ValidatedApiBase {
    url: Url,
    display: String,
}

fn validate_api_base(value: &str) -> Result<ValidatedApiBase> {
    let mut url = Url::parse(value.trim()).context("invalid Codewhale account API base URL")?;
    if !url.username().is_empty() || url.password().is_some() {
        bail!("Codewhale account API base URL must not contain credentials");
    }
    if url.query().is_some() || url.fragment().is_some() {
        bail!("Codewhale account API base URL must not contain a query or fragment");
    }
    if !matches!(url.path(), "" | "/") {
        bail!("Codewhale account API base URL must be an origin without a path");
    }
    let host = url
        .host_str()
        .ok_or_else(|| anyhow!("Codewhale account API base URL must include a host"))?;
    let allowed = url.scheme() == "https" || (url.scheme() == "http" && is_loopback_host(host));
    if !allowed {
        bail!(
            "Codewhale account API base URL must use HTTPS (loopback HTTP is allowed for testing)"
        );
    }
    url.set_path("/");
    let display = url.as_str().trim_end_matches('/').to_string();
    Ok(ValidatedApiBase { url, display })
}

View on GitHub (pinned to 73e0f67d83)