{"record":{"id":"14502537fec016c2","repo":"musistudio/claude-code-router","slug":"artifact-url-contains-unsupported-credentials-or-f","errorCode":null,"errorMessage":"Artifact URL contains unsupported credentials or fragments.","messagePattern":"Artifact URL contains unsupported credentials or fragments\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/agents/codex/media-preview-bridge.ts","lineNumber":277,"sourceCode":"    } catch (error) {\n      lastError = error;\n    }\n    await sleep(codexMediaPreviewPollIntervalMs);\n  }\n  throw new Error(`Codex App CDP page target was not available${lastError ? `: ${redactBridgeError(lastError)}` : \".\"}`);\n}\n\nfunction isCodexAppPageTarget(target: DevToolsTarget): boolean {\n  if (target.type !== \"page\" || !target.webSocketDebuggerUrl) return false;\n  const url = target.url || \"\";\n  return url.startsWith(\"app://codex\") || url.startsWith(\"app://chatgpt\") || /\\b(codex|chatgpt)\\b/i.test(target.title || \"\");\n}\n\nfunction validateCodexMediaArtifactUrl(value: string, endpoint: string): ValidatedArtifactUrl {\n  const expected = new URL(endpoint);\n  const url = new URL(value);\n  if (url.protocol !== \"http:\" || url.origin !== expected.origin) throw new Error(\"Artifact origin is not the configured CCR gateway.\");\n  if (url.username || url.password || url.hash) throw new Error(\"Artifact URL contains unsupported credentials or fragments.\");\n  if (!url.pathname.startsWith(MEDIA_ARTIFACT_PATH_PREFIX)) throw new Error(\"Artifact URL does not use the CCR media artifact path.\");\n  const encodedId = url.pathname.slice(MEDIA_ARTIFACT_PATH_PREFIX.length);\n  if (!encodedId || encodedId.includes(\"/\")) throw new Error(\"Artifact URL contains an invalid identifier.\");\n  const artifactId = decodeURIComponent(encodedId);\n  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(artifactId)) {\n    throw new Error(\"Artifact URL contains an invalid identifier.\");\n  }\n  const keys = [...url.searchParams.keys()];\n  const token = url.searchParams.get(\"token\") || \"\";\n  if (keys.length !== 1 || keys[0] !== \"token\" || !/^[A-Za-z0-9_-]{32}$/.test(token)) {\n    throw new Error(\"Artifact URL contains an invalid access token.\");\n  }\n  return { artifactId, url };\n}\n\nasync function loadCodexMediaArtifact(validated: ValidatedArtifactUrl, signal: AbortSignal): Promise<LoadedMediaArtifact> {\n  let response: Response;\n  try {","sourceCodeStart":259,"sourceCodeEnd":295,"githubUrl":"https://github.com/musistudio/claude-code-router/blob/99f24806c6a2c660b16e53e95211c517448a6c90/packages/core/src/agents/codex/media-preview-bridge.ts#L259-L295","documentation":"Part of validateCodexMediaArtifactUrl's strict parsing: the artifact URL must be a bare http URL with no userinfo (username/password) and no #fragment. Any of url.username, url.password, or url.hash being non-empty triggers this throw.","triggerScenarios":"Passing an artifact URL like http://user:pass@gateway/... or http://gateway/media/...#section — anything containing credentials or a fragment component.","commonSituations":"URLs copied from browser devtools that include fragments; gateways or proxies that embed basic-auth credentials in the URL; hand-built URL strings that accidentally append '#'.","solutions":["Strip credentials and fragments from the artifact URL before validation","Fix the upstream generator so it never emits userinfo or fragments in artifact links","If auth is required, deliver it out-of-band (headers/token param) instead of URL credentials"],"exampleFix":"// before\nvalidateCodexMediaArtifactUrl(\"http://gw/media/artifact/...#preview\", endpoint);\n// after\nvalidateCodexMediaArtifactUrl(\"http://gw/media/artifact/...\", endpoint);","handlingStrategy":"validation","validationCode":"const u = new URL(artifactUrl);\nif (u.username || u.password || u.hash) artifactUrl = u.origin + u.pathname + (u.search || ''); // sanitize before validating","typeGuard":"function isBareArtifactUrl(value: string): boolean {\n  try { const u = new URL(value); return !u.username && !u.password && !u.hash; } catch { return false; }\n}","tryCatchPattern":null,"preventionTips":["Sanitize URLs (strip hash/userinfo) before passing to the bridge","Don't embed basic-auth credentials in artifact URLs","Avoid copying URLs from browser UIs that add fragments"],"tags":["url-validation","credentials","fragment"],"backgroundTag":"invalid-url-format","analyzedSha":"99f24806c6a2c660b16e53e95211c517448a6c90","analyzedAt":"2026-08-27T04:11:01.184Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}