The Codewhale service returned a verification URL without a

Error message

The Codewhale service returned a verification URL without a host

What it means

During the device-authorization login flow, the Codewhale account service returns a verification URL that the CLI validates before showing/opening it. Url::parse succeeded but host_str() is None (a hostless non-special scheme), so the CLI refuses the URL. Unlike the api-base check, this validates server output, so the fault is on the service side, not user input.

Source

Thrown at crates/cli/src/cloud.rs:798

    }
    url.set_path("/");
    let display = url.as_str().trim_end_matches('/').to_string();
    Ok(ValidatedApiBase { url, display })
}

fn validate_verification_url(
    value: &str,
    api_base: &str,
    user_code: &str,
    complete: bool,
) -> Result<String> {
    let url =
        Url::parse(value).context("The Codewhale service returned an invalid verification URL")?;
    if value != url.as_str() {
        bail!("The Codewhale service returned an unsafe verification URL");
    }
    let host = url.host_str().ok_or_else(|| {
        anyhow!("The Codewhale service returned a verification URL without a host")
    })?;
    if !url.username().is_empty() || url.password().is_some() || url.fragment().is_some() {
        bail!("The Codewhale service returned an unsafe verification URL");
    }
    if url.path() != "/cli/authorize" {
        bail!("The Codewhale service returned an unsafe verification URL");
    }

    let api = Url::parse(api_base).context("invalid Codewhale account API base URL")?;
    let canonical_api = api.scheme() == "https"
        && api.host_str() == Some("api.codewhale.net")
        && api.port_or_known_default() == Some(443);
    let loopback_api = api.host_str().is_some_and(is_loopback_host);
    if canonical_api {
        if url.scheme() != "https"
            || !host.eq_ignore_ascii_case("app.codewhale.net")
            || url.port_or_known_default() != Some(443)
        {

View on GitHub (pinned to 8880682c63)

Solutions

Retry the login after a short wait in case of a transient bad deployment
Verify the service status/advisories for api.codewhale.net
Confirm api_base points at the real Codewhale account service, not a stub or proxy
Report the received URL to Codewhale support if it persists (the CLI deliberately refuses to open it)

Defensive patterns

Strategy: try-catch

Try / catch

match codewhale::cloud::login(&client).await {
    Ok(session) => session,
    Err(err) if err.to_string().contains("verification URL without a host") => {
        // Service-side defect: do not open any URL, surface a clear message and retry later
        return report_service_misconfiguration(err);
    }
    Err(err) => return Err(err),
}

Prevention

Pin api_base to the canonical service origin in managed environments
Monitor Codewhale service advisories during login automation
Never bypass the CLI's verification-URL hardening by extracting URLs from raw API responses yourself

When it happens

Trigger: `codewhale cloud login` reaches the device-code step and the account API's response carries a verification_uri without a host (e.g. mailto: or a truncated URL from a misconfigured deployment).

Common situations: Service misconfiguration or an intermediate proxy rewriting the verification URL; a custom api_base pointing at a backend that emits malformed OAuth/device-flow links.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/79bdaae5edd3f660. Report an issue: GitHub.