affaan-m/ECC · error · Error

Missing value for --target

Error message

Missing value for --target

What it means

_validate_import_url() enforces HTTPS-only for remote instinct imports. Any URL whose scheme is not exactly 'https' (http, ftp, file, git, ssh, etc.) is rejected before any DNS lookup or network connection is opened. This prevents plaintext credential leakage and man-in-the-middle content tampering on an import path that writes files to disk.

Source

Thrown at scripts/catalog.js:85

  parsed.command = args[0];

  for (let index = 1; index < args.length; index += 1) {
    const arg = args[index];

    if (arg === '--help' || arg === '-h') {
      parsed.help = true;
    } else if (arg === '--json') {
      parsed.json = true;
    } else if (arg === '--family') {
      if (!args[index + 1]) {
        throw new Error('Missing value for --family');
      }
      parsed.family = normalizeFamily(args[index + 1]);
      index += 1;
    } else if (arg === '--target') {
      if (!args[index + 1]) {
        throw new Error('Missing value for --target');
      }
      parsed.target = args[index + 1];
      index += 1;
    } else if (parsed.command === 'show' && !parsed.componentId) {
      parsed.componentId = arg;
    } else {
      throw new Error(`Unknown argument: ${arg}`);
    }
  }

  return parsed;
}

function printProfiles(profiles) {
  console.log('Install profiles:\n');
  for (const profile of profiles) {
    console.log(`- ${profile.id} (${profile.moduleCount} modules)`);
    console.log(`  ${profile.description}`);

View on GitHub (pinned to 01e15490f0)

Solutions

1. Use an https URL for the remote instinct file.
2. For local development, import the local file directly via its filesystem path instead of a URL.
3. If you control the host, enable TLS (e.g. via a reverse proxy or Let's Encrypt) and switch the URL to https.

Example fix

# before
_validate_import_url('http://example.com/instinct.md')  # rejected

# after
_validate_import_url('https://example.com/instinct.md')

# Reject non-https URLs at the boundary, before any import call.
import urllib.parse
parsed = urllib.parse.urlparse(source)
if parsed.scheme != 'https':
    raise SystemExit(f'remote instinct imports require https; got scheme {parsed.scheme!r}')

import urllib.parse

def is_https_url(s) -> bool:
    return urllib.parse.urlparse(s).scheme == 'https'

try:
    content = _fetch_import_url(source)
except ValueError as e:
    if 'https' in str(e):
        source = source.replace('http://', 'https://', 1)  # only if you trust the host
        content = _fetch_import_url(source)
    else:
        raise

When it happens

Trigger: Passing 'http://example.com/instinct.md'; 'ftp://host/file'; 'file:///etc/passwd'; 'git://host/repo'.

Common situations: Copying a URL from internal docs that uses plain http; pointing at a localhost dev server over http; a URL field that accepted any scheme upstream.

Related errors

• Unknown catalog command: ${options.command}
• plan-canvas request path must stay on the loopback server
• Failed to read ${path.basename(filePath)}: ${error.message}
• unsupported plan-canvas request path: ${url.pathname}
• Invalid ECC repo root: missing install script at ${installAp

AI-assisted analysis of affaan-m/ECC@01e15490f0 (2026-08-13). Data as JSON: /api/errors/fa87372142d7f3f1. Report an issue: GitHub.