{"record":{"id":"4688bf82fc48396f","repo":"JuliusBrussee/caveman","slug":"name-must-not-contain-a-query-or-fragment","errorCode":null,"errorMessage":"${name} must not contain a query or fragment","messagePattern":"(.+?) must not contain a query or fragment","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/sdk/typescript/src/index.ts","lineNumber":346,"sourceCode":"  kind: number;\n  startTimeNs: number;\n  endTimeNs: number;\n  statusCode: number; // 0=unset, 1=ok, 2=error\n  attributes: Record<string, string | number | boolean>;\n};\n\nfunction normalizedServiceURL(value: string, name: \"baseURL\" | \"controlURL\"): string {\n  if (value.trim() !== value) throw new Error(`${name} must not contain surrounding whitespace`);\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    throw new Error(`${name} must be an absolute http(s) URL`);\n  }\n  if ((parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") || !parsed.hostname || parsed.username || parsed.password) {\n    throw new Error(`${name} must be an absolute http(s) URL without credentials`);\n  }\n  if (parsed.search || parsed.hash) throw new Error(`${name} must not contain a query or fragment`);\n  return value.replace(/\\/+$/, \"\");\n}\n\nexport class Cave {\n  readonly options: CaveOptions;\n\n  constructor(options: CaveOptions) {\n    if (!options.apiKey || !options.baseURL || !options.agent) throw new Error(\"apiKey, baseURL, and agent are required\");\n    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0)) {\n      throw new Error(\"timeoutMs must be a positive integer\");\n    }\n    // CAVE_WORKFLOW lets a wrapper (`cave wrap --workflow x`) label every request\n    // from an SDK app without a code change. An explicit option always wins.\n    // globalThis lookup keeps the SDK browser-neutral (no node type dependency).\n    // The env value is normalized to the gateway's label rule (lowercase\n    // [a-z0-9_-], max 96) — an invalid ambient value is ignored rather than\n    // 400-ing every request. Mirrors caveman_cloud (Python).\n    const envRaw = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env?.[\"CAVE_WORKFLOW\"]?.toLowerCase();","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/packages/sdk/typescript/src/index.ts#L328-L364","documentation":"normalizedServiceURL rejects baseURL/controlURL values that contain a query string (?...) or fragment (#...). The SDK appends its own paths and parameters to the base, so a preset query or fragment would produce malformed request URLs; it requires a clean origin-plus-path base.","triggerScenarios":"baseURL: \"https://api.example.com/?env=prod\" or \"https://api.example.com/page#section\" passed to new Cave(...) via normalized().","commonSituations":"Copying the browser URL of a console page (with query/fragment) instead of the API base; appending auth or env parameters to the base URL; templating mistakes inserting a trailing '#'.","solutions":["Strip the query and fragment, keeping only scheme://host[/path].","If you need an env query param, pass it via the SDK's dedicated options or headers, not the base URL.","Use new URL(value) and pass url.origin + url.pathname to sanitize."],"exampleFix":"// before\nnew Cave({ apiKey, baseURL: \"https://api.example.com/?env=prod\", agent: \"x\" });\n\n// after\nnew Cave({ apiKey, baseURL: \"https://api.example.com\", agent: \"x\" });","handlingStrategy":"validation","validationCode":"function stripQueryAndFragment(v: string): string {\n  const u = new URL(v);\n  return u.origin + u.pathname; // drops search and hash\n}","typeGuard":"const hasNoQueryOrFragment = (v: string): boolean => {\n  try { const u = new URL(v); return u.search === \"\" && u.hash === \"\"; } catch { return false; }\n};","tryCatchPattern":"try {\n  const cave = new Cave({ apiKey, baseURL, agent });\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"query or fragment\")) {\n    const u = new URL(baseURL);\n    baseURL = u.origin + u.pathname;\n    // retry construction\n  } else throw e;\n}","preventionTips":["Use the API/console origin only — never paste a full browser URL as a base URL.","Normalize with new URL(v) and rebuild from origin+pathname when accepting user input.","Add a startup config check rejecting '?' or '#' in base URLs."],"tags":["validation","url","configuration"],"backgroundTag":"invalid-url-format","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}