{"record":{"id":"2cd00d9c01b429cd","repo":"langchain-ai/deepagents","slug":"marketplace-url-must-use-https-redact-url-crede","errorCode":null,"errorMessage":"Marketplace URL must use https: {_redact_url_credentials(url)}","messagePattern":"Marketplace URL must use https: (.+?)","errorType":"exception","errorClass":"MarketplaceError","httpStatus":null,"severity":"error","filePath":"libs/code/deepagents_code/plugins/marketplace.py","lineNumber":363,"sourceCode":"        req: urllib.request.Request,\n        fp: IO[bytes],\n        code: int,\n        msg: str,\n        headers: HTTPMessage,\n        newurl: str,\n    ) -> urllib.request.Request | None:\n        if urlparse(newurl).scheme != \"https\":\n            detail = _redact_url_credentials(newurl)\n            error = f\"Marketplace redirect must use https: {detail}\"\n            raise MarketplaceError(error)\n        return super().redirect_request(req, fp, code, msg, headers, newurl)\n\n\ndef _download_marketplace(url: str) -> Path:\n    parsed = urlparse(url)\n    if parsed.scheme != \"https\":\n        msg = f\"Marketplace URL must use https: {_redact_url_credentials(url)}\"\n        raise MarketplaceError(msg)\n    cache_path = (\n        ensure_marketplace_cache_dir() / f\"marketplace-url-{opaque_cache_key(url)}.json\"\n    )\n    request = urllib.request.Request(  # noqa: S310  # Scheme is restricted above.\n        url, headers={\"User-Agent\": \"dcode-plugin-manager\"}\n    )\n    opener = urllib.request.build_opener(_HttpsOnlyRedirectHandler())\n    try:\n        with opener.open(request, timeout=10) as response:\n            final_url = response.geturl()\n            if urlparse(final_url).scheme != \"https\":\n                detail = _redact_url_credentials(final_url)\n                msg = f\"Marketplace response must use https: {detail}\"\n                raise MarketplaceError(msg)\n            data = json.load(response)\n    except (OSError, urllib.error.URLError, json.JSONDecodeError) as exc:\n        msg = (\n            \"Failed to download marketplace from \"","sourceCodeStart":345,"sourceCodeEnd":381,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/code/deepagents_code/plugins/marketplace.py#L345-L381","documentation":"_download_marketplace rejects any initial marketplace URL whose scheme is not https before issuing the request. This is a deliberate guard so plugin catalogs are only ever fetched over TLS; the URL is credential-redacted in the message.","triggerScenarios":"Calling materialize_marketplace_source with a URL source (or add_marketplace_source) whose value starts with http://, ftp://, or any non-https scheme.","commonSituations":"Typing http:// instead of https:// when adding a marketplace; copying an old HTTP link from documentation; a config file containing a plain-HTTP catalog URL.","solutions":["Change the marketplace URL to start with https://","Serve the catalog over HTTPS (e.g. via a TLS-enabled host or a static hosting provider)","If this is a git/local marketplace, use the git or local source type instead of a URL source"],"exampleFix":"// before\nadd_marketplace_source(\"http://example.com/marketplace.json\")\n// after\nadd_marketplace_source(\"https://example.com/marketplace.json\")","handlingStrategy":"validation","validationCode":"from urllib.parse import urlparse\ndef validate_marketplace_url(url: str) -> None:\n    if urlparse(url).scheme != \"https\":\n        raise ValueError(f\"use https, got {urlparse(url).scheme}\")","typeGuard":"def is_https_url(url: str) -> bool:\n    from urllib.parse import urlparse\n    return urlparse(url).scheme == \"https\"","tryCatchPattern":"try:\n    add_marketplace_source(url_source)\nexcept MarketplaceError as exc:\n    if \"must use https\" in str(exc):\n        url_source = url_source.replace(\"http://\", \"https://\", 1)\n        add_marketplace_source(url_source)","preventionTips":["Default to https:// when writing marketplace configs","Lint config files for http:// marketplace URLs","Never paste plain-HTTP links from docs without checking the scheme"],"tags":["network","security","https","validation"],"backgroundTag":"non-https-url-rejected","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}