What causes "LLM base URL must use http:// or https:// (got ${parsed.protocol})" in abhigyanpatwari/GitNexus?

Change the URL scheme to `https://` (preferred for all remote LLM endpoints).

abhigyanpatwari/GitNexus · warning · Error

LLM base URL must use http:// or https:// (got ${parsed.prot

Error message

LLM base URL must use http:// or https:// (got ${parsed.protocol})

What it means

Thrown by `validateLLMBaseUrl` when the URL parses successfully but its protocol is neither `http:` nor `https:`. This blocks SSRF vectors via `file://`, `data:`, `javascript:`, `ftp:`, and other schemes that a misconfigured or malicious base URL could introduce. Only the parsed protocol (scheme) is included in the message, never the full URL, to avoid leaking credentials.

Source

Thrown at gitnexus/src/core/wiki/llm-client.ts:248

 * clear error rather than an opaque network error.
 */
export function validateLLMBaseUrl(
  baseUrl: string,
  allowedInsecureHttpHosts: readonly string[] = parseLLMAllowedInsecureHttpHosts(
    process.env[LLM_ALLOW_INSECURE_CONNECTION_ENV],
  ),
): void {
  let parsed: URL;
  try {
    parsed = new URL(baseUrl);
  } catch {
    // Do not include the raw input in the message — it may contain credentials.
    throw new Error('Invalid LLM base URL: must be a well-formed http:// or https:// URL');
  }

  if (!['https:', 'http:'].includes(parsed.protocol)) {
    // Use parsed.protocol only (scheme), not the full URL, to avoid leaking credentials.
    throw new Error(`LLM base URL must use http:// or https:// (got ${parsed.protocol})`);
  }

  if (parsed.protocol === 'http:') {
    // Node's URL parser preserves IPv6 brackets in hostname (e.g. "[::1]"),
    // so strip them before comparing to bare address literals.
    const host = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
    const allowedHosts = new Set(allowedInsecureHttpHosts.map(normalizeAllowedInsecureHttpHost));
    if (host !== 'localhost' && host !== '127.0.0.1' && host !== '::1' && !allowedHosts.has(host)) {
      // Use parsed.origin (scheme+host+port, no credentials) instead of the full URL.
      throw new Error(
        `Insecure http:// LLM base URLs are only allowed for localhost/127.0.0.1 ` +
          `or hosts listed by --allow-insecure-connection / ${LLM_ALLOW_INSECURE_CONNECTION_ENV}. ` +
          `Use https:// for remote endpoints (got ${parsed.origin})`,
      );
    }
  }
}

View on GitHub (pinned to d540b00184)

Solutions

Change the URL scheme to `https://` (preferred for all remote LLM endpoints).
For local servers (Ollama, LiteLLM, etc.), use `http://localhost:PORT` or `http://127.0.0.1:PORT` — these are allowed without an explicit insecure-connection entry.
For a LAN/self-hosted endpoint over plain HTTP, use `http://` and add the host to `GITNEXUS_ALLOW_INSECURE_CONNECTION`.

Example fix

# before
export GITNEXUS_LLM_BASE_URL=file:///path/to/local/model
gitnexus wiki
# error: LLM base URL must use http:// or https:// (got file:)
# after
export GITNEXUS_LLM_BASE_URL=http://localhost:11434  # local Ollama
gitnexus wiki

Defensive patterns

Strategy: validation

Validate before calling

// Validate the protocol before initializing the LLM client:
import { validateLLMBaseUrl } from './wiki/llm-client.js';
try {
  validateLLMBaseUrl(process.env.GITNEXUS_LLM_BASE_URL!);
} catch (err) {
  console.error('LLM base URL validation failed:', (err as Error).message);
  process.exit(1);
}

Type guard

const isHttpOrHttpsUrl = (url: string): boolean => {
  try {
    const parsed = new URL(url);
    return parsed.protocol === 'http:' || parsed.protocol === 'https:';
  } catch {
    return false;
  }
};

Try / catch

try {
  validateLLMBaseUrl(baseUrl);
} catch (err) {
  if (err instanceof Error && err.message.includes('must use http:// or https://')) {
    console.error('Change the URL scheme to http:// or https://.');
  }
  throw err;
}

Prevention

Use `https://` for all remote LLM endpoints.
For local servers, use `http://localhost:PORT` or `http://127.0.0.1:PORT` — no allowlist needed.
Never use `file://`, `data:`, or other non-HTTP schemes for LLM base URLs.

When it happens

Trigger: `validateLLMBaseUrl` successfully constructs a `URL` object, but `parsed.protocol` is not `http:` or `https:` (e.g., `file:`, `data:`, `ftp:`, `javascript:`).

Common situations: `GITNEXUS_LLM_BASE_URL` set to a `file://` path (perhaps from a local-file-only configuration); a copy-paste from a documentation example that used a placeholder scheme; a misconfigured proxy or gateway URL that was entered with an internal protocol.

Related errors

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/1a4e8abf277da2b8. Report an issue: GitHub.