{"record":{"id":"81b7eab6bf077030","repo":"langchain-ai/deepagents","slug":"remote-marketplace-sources-must-use-https","errorCode":null,"errorMessage":"Remote marketplace sources must use https","messagePattern":"Remote marketplace sources must use https","errorType":"exception","errorClass":"MarketplaceError","httpStatus":null,"severity":"error","filePath":"libs/code/deepagents_code/plugins/marketplace.py","lineNumber":167,"sourceCode":"        Parsed marketplace source.\n\n    Raises:\n        MarketplaceError: If the source string is empty or unsupported.\n    \"\"\"\n    value = raw.strip()\n    if not value:\n        msg = \"Please enter a marketplace source\"\n        raise MarketplaceError(msg)\n\n    ssh_match = _SSH_GIT_RE.match(value)\n    if ssh_match:\n        return RepositoryMarketplaceSource(\n            source_type=\"git\", value=ssh_match.group(1), ref=ssh_match.group(2)\n        )\n\n    if value.startswith(\"http://\"):\n        msg = \"Remote marketplace sources must use https\"\n        raise MarketplaceError(msg)\n    if value.startswith(\"https://\"):\n        url, _, ref = value.partition(\"#\")\n        try:\n            parsed = urlparse(url)\n        except ValueError as exc:\n            msg = \"Invalid marketplace URL\"\n            raise MarketplaceError(msg) from exc\n        path = parsed.path\n        if path.endswith(\".git\") or \"/_git/\" in path:\n            return RepositoryMarketplaceSource(\n                source_type=\"git\", value=url, ref=ref or None\n            )\n        if parsed.hostname in {\"github.com\", \"www.github.com\"}:\n            parts = [part for part in path.split(\"/\") if part]\n            if len(parts) == _GITHUB_REPO_PART_COUNT:\n                repo_path = \"/\".join(parts)\n                git_url = urlunparse(parsed._replace(path=f\"/{repo_path}.git\"))\n                return RepositoryMarketplaceSource(","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/code/deepagents_code/plugins/marketplace.py#L149-L185","documentation":"`parse_marketplace_source` rejects any marketplace source that starts with `http://` (marketplace.py:165-167). The library enforces HTTPS for all remote marketplaces so that the marketplace JSON is fetched over an encrypted connection; a plaintext HTTP source could be tampered with in transit and the plugins it describes would then be installed unverified. The check runs before URL parsing, so even valid HTTP URLs are refused outright.","triggerScenarios":"Calling `parse_marketplace_source('http://example.com/marketplace.json')`, `add_marketplace_source(...)` with an `http://` URL, or configuring a plugin repository source (via `_plugin_repository_source`) whose value starts with `http://`. Any leading-whitespace-trimmed `http://` string reaches this branch, since SCP-style and GitHub-shorthand regexes do not match it.","commonSituations":"Copying a marketplace URL from an internal server or docs page that still uses plain HTTP; self-hosted Git servers (GitLab/Gitea) behind HTTP-only endpoints; hand-typed URLs in a config file; older CI scripts written before the HTTPS-only policy.","solutions":["Change the source URL scheme from `http://` to `https://` and retry.","If the server does not support HTTPS, put it behind TLS (reverse proxy or certificate) before registering it as a marketplace.","For purely local marketplaces, use a filesystem path (`./path` or `~/path`) instead of an HTTP URL."],"exampleFix":"// before\nadd_marketplace_source(\"http://example.com/marketplace.json\")\n// after\nadd_marketplace_source(\"https://example.com/marketplace.json\")","handlingStrategy":"validation","validationCode":"def ensure_https(source: str) -> str:\n    stripped = source.strip()\n    if stripped.startswith(\"http://\"):\n        raise ValueError(f\"Use https instead of http: {stripped}\")\n    return stripped\n\nadd_marketplace_source(ensure_https(user_source))","typeGuard":"def is_https_url(value: str) -> bool:\n    return value.strip().startswith(\"https://\")","tryCatchPattern":"try:\n    source = parse_marketplace_source(raw)\nexcept MarketplaceError as exc:\n    if \"must use https\" in str(exc):\n        raw = raw.replace(\"http://\", \"https://\", 1)\n        source = parse_marketplace_source(raw)\n    else:\n        raise","preventionTips":["Always copy https:// URLs when sharing marketplace links.","Add a lint/config check that rejects http:// in marketplace source fields.","Prefer local path sources for internal HTTP-only servers, or front them with TLS."],"tags":["validation","https","security","url"],"backgroundTag":"insecure-http-url-rejected","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}