Hmbown/CodeWhale · error

Refusing base URL '{display_base_url}': only HTTPS (or expli

Error message

Refusing base URL '{display_base_url}': only HTTPS (or explicitly allowed HTTP) URLs are supported.

What it means

The terminal branch of `validate_base_url_security`: the base URL scheme is neither `https://` nor `http://` (the http:// branches were already handled above), so the client refuses it outright. This catches URLs with no scheme at all and non-HTTP schemes; the scheme test is a literal case-sensitive prefix match, so an uppercase `HTTP://` or `HTTPS://` also lands here.

Source

Thrown at crates/tui/src/client.rs:684

        logging::warn(format!(
            "Using insecure HTTP base URL because {ALLOW_INSECURE_HTTP_ENV} is set"
        ));
        return Ok(());
    }

    if base_url.starts_with("http://") {
        anyhow::bail!(
            "Refusing insecure base URL '{display_base_url}'.\n\
             \n\
             Loopback hosts (localhost, 127.0.0.1, [::1]) are auto-allowed.\n\
             For other trusted local hosts (LAN, llama.cpp on a private IP, etc.)\n\
             set the env var `{ALLOW_INSECURE_HTTP_ENV}=1` in the shell that runs codewhale and re-run.\n\
             \n\
             Example: `{ALLOW_INSECURE_HTTP_ENV}=1 codewhale` (note the underscores).",
        );
    }

    anyhow::bail!(
        "Refusing base URL '{display_base_url}': only HTTPS (or explicitly allowed HTTP) URLs are supported.",
    )
}

pub(crate) fn redact_url_for_display(url: &str) -> String {
    let Ok(mut parsed) = reqwest::Url::parse(url) else {
        return url.to_string();
    };
    if !parsed.username().is_empty() || parsed.password().is_some() {
        let _ = parsed.set_username("***");
        let _ = parsed.set_password(Some("***"));
    }
    if parsed.query().is_none() {
        return parsed.to_string();
    }
    let pairs: Vec<(String, String)> = parsed
        .query_pairs()
        .map(|(key, value)| {

View on GitHub (pinned to 8880682c63)

Solutions

1. Write the full absolute URL with a lowercase scheme: `base_url = "https://api.example.com/v1"`.
2. If you intended plain HTTP to a local server, use `http://localhost...` or set `CODEWHALE_ALLOW_INSECURE_HTTP=1` with an `http://` scheme — but the scheme must still be lowercase `http://`.
3. Check the value for leading/trailing whitespace, BOM, or uppercase scheme characters in the config file.

Example fix

# before
base_url = "api.example.com/v1"
# after
base_url = "https://api.example.com/v1"

fn has_supported_scheme(base_url: &str) -> bool {
    let u = base_url.trim();
    u.starts_with("https://") || u.starts_with("http://")
}

When it happens

Trigger: A `base_url` like `api.example.com/v1` (missing scheme), `ftp://host`, `ws://host:8080`, `HTTPS://api.example.com` (uppercase), or a URL with leading whitespace before the scheme. Any of these fall through both `starts_with("https://")` and `starts_with("http://")` checks and hit the final bail.

Common situations: Copying a hostname from docs without the scheme; assuming the client will add `https://` automatically; pasting a websocket URL because the provider docs show `wss://`; editors auto-capitalizing or inserting a smart quote/BOM before the URL.

Related errors

• Refusing insecure base URL '{display_base_url}'. Loopback h
• {kind} tool surface_profile must be `{TOOL_SURFACE_PROFILE}`
• invalid Codewhale-owned xAI OAuth basename
• xAI OAuth private basename must be one UTF-8 path component
• Codewhale credentials directory cannot be a volume root

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/d04537fc72bade17. Report an issue: GitHub.