What causes "invalid download url: {url}" in Hmbown/CodeWhale?

Re-enter the source as a full, well-formed URL including the host.

invalid download url: {url}

Error message

invalid download url: {url}

What it means

download_first_success extracts a host from each candidate URL to drive the network policy decision; a URL yielding no host bails the whole loop. Only well-formed http(s) URLs with a host should ever be enqueued, so this is a guard against malformed URL construction upstream.

Source

Thrown at crates/tui/src/skills/install.rs:1097

        }
    }
}

/// Download the first URL whose host the policy allows and which returns 2xx.
/// Returns `NeedsApproval` if every candidate hit `Prompt`, or `Denied` if every
/// candidate was denied.
async fn download_first_success(
    urls: &[String],
    network: &NetworkPolicy,
    max_size: u64,
) -> Result<DownloadOutcome> {
    let mut last_status: Option<reqwest::StatusCode> = None;
    let mut prompt_host: Option<String> = None;
    let mut denied_host: Option<String> = None;
    for url in urls {
        let host = match host_from_url(url) {
            Some(h) => h,
            None => bail!("invalid download url: {url}"),
        };
        match network.decide(&host) {
            Decision::Allow => {}
            Decision::Deny => {
                denied_host.get_or_insert(host);
                continue;
            }
            Decision::Prompt => {
                prompt_host.get_or_insert(host);
                continue;
            }
        }
        match download_with_cap(url, max_size).await? {
            DownloadAttempt::Bytes(bytes) => {
                return Ok(DownloadOutcome::Bytes {
                    bytes,
                    url: url.clone(),
                });

View on GitHub (pinned to 0c42157ee5)

Solutions

Re-enter the source as a full, well-formed URL including the host.
Validate with url::Url::parse plus a host check before install.
If the URL was built internally from a github: spec, fix the spec; see the malformed-github-spec errors.

Example fix

# before
/skill install https:///skills/pack.tar.gz

# after
/skill install https://example.com/skills/pack.tar.gz

Defensive patterns

Strategy: validation

Validate before calling

fn download_url_ok(url: &str) -> bool {
    matches!(url::Url::parse(url), Ok(u) if u.host_str().is_some())
}

Prevention

Parse URLs with url::Url before storing them as install sources.
Never build download URLs by naive string concatenation of possibly-empty parts.
Reject URLs containing spaces or unicode lookalike characters at input time.

When it happens

Trigger: A DirectUrl spec with a scheme but no host ('https:///x.tar.gz'), or an internally built GitHub archive URL degenerated by an empty repo string.

Common situations: Specs assembled by string formatting where a component was empty, URLs with unicode lookalike characters, and trailing-punctuation paste artifacts.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/8df450eaa6c5d2ba. Report an issue: GitHub.