abhigyanpatwari/GitNexus · error

Unsupported npm registry protocol

Error message

Unsupported npm registry protocol

What it means

buildUpdateRegistry in update-cache.ts validates the configured npm registry URL and throws when its protocol is neither https: nor http:. The update checker only talks to HTTP(S) registries, and stripping to these schemes prevents file:, data:, or other scheme-based bypasses.

Source

Thrown at gitnexus/src/core/update-cache.ts:73

}

let registryMemo: { key: string; value: { identity: string; packageUrl: string } } | undefined;

export function normalizedUpdateRegistry(env: NodeJS.ProcessEnv = process.env): {
  identity: string;
  packageUrl: string;
} {
  const key = env.npm_config_registry ?? '';
  if (registryMemo?.key === key) return registryMemo.value;
  const value = buildUpdateRegistry(key);
  registryMemo = { key, value };
  return value;
}

function buildUpdateRegistry(rawRegistry: string): { identity: string; packageUrl: string } {
  const parsed = new URL(rawRegistry || DEFAULT_UPDATE_REGISTRY);
  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
    throw new Error('Unsupported npm registry protocol');
  }
  if (parsed.search || parsed.hash) {
    throw new Error('Registry URL cannot contain query or fragment');
  }
  parsed.username = '';
  parsed.password = '';
  parsed.pathname = parsed.pathname.replace(/\/+$/, '') || '/';

  const pathname = parsed.pathname === '/' ? '' : parsed.pathname;
  const identity = `${parsed.protocol}//${parsed.host}${pathname}`;
  // `/<pkg>/latest` is the small dist-tag document. The full packument at
  // `/<pkg>` is multi-megabyte on this package and cannot fit the fetch cap.
  const packagePath = `${pathname}/gitnexus/latest`.replace(/\/{2,}/g, '/');
  return { identity, packageUrl: `${parsed.protocol}//${parsed.host}${packagePath}` };
}

export function updateCheckCachePath(env: NodeJS.ProcessEnv = process.env): string {
  return path.join(env.GITNEXUS_HOME || getGlobalDir(), 'update-check.json');

View on GitHub (pinned to 0d1aed942f)

Solutions

1. Prefix the registry value with 'https://' (or 'http://' only for local testing)
2. Check the env/config source feeding the registry value (e.g. NPM_CONFIG_REGISTRY or CLI flag) for a missing scheme
3. Validate the URL with `new URL(v).protocol` before setting it

Example fix

// before
buildUpdateRegistry('registry.npmjs.org'); // throws: protocol is not https:/http:
// after
buildUpdateRegistry('https://registry.npmjs.org');

function validRegistry(v){ try { const p = new URL(v || 'https://registry.npmjs.org'); return p.protocol==='https:'||p.protocol==='http:'; } catch { return false; } }

try { cache = buildUpdateRegistry(registryRaw); } catch (e) { if (e.message === 'Unsupported npm registry protocol') { log(`Registry '${registryRaw}' must start with https://`); fallbackToDefaultRegistry(); } else throw e; }

When it happens

Trigger: Passing a registry string such as 'ftp://registry.example.com', 'file:///local/registry', or a malformed value with no parseable scheme to the registry configuration consumed by buildUpdateRegistry (default applies only when the raw string is empty).

Common situations: Typo'd npmrc-style registry config ('registry.example.com' with no scheme — URL parses it as a path, protocol becomes 'file:' in some environments or fails); copy-pasting a custom registry URL from a vendor doc that omits https://.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Registry URL cannot contain query or fragment
• Registry response too large
• Too many registry redirects
• Registry redirect missing location
• Registry returned ${response.status}

AI-assisted analysis of abhigyanpatwari/GitNexus@0d1aed942f (2026-09-08). Data as JSON: /api/errors/8a97aef251af9a84. Report an issue: GitHub.