{"record":{"id":"99b3664cd6abe959","repo":"santifer/career-ops","slug":"the-release-pointer-is-not-json-url","errorCode":null,"errorMessage":"the release pointer is not JSON: ${url}","messagePattern":"the release pointer is not JSON: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"plugins/h1b-sponsor/install-h1b-index.mjs","lineNumber":116,"sourceCode":" *\n * Both fields are validated before use. They come from the network, and one of\n * them is about to become part of a URL and the other the sole thing standing\n * between a substituted download and a lookup that trusts it.\n */\nasync function fetchPointer(fetchImpl, url) {\n const out = await fetchImpl(url, { timeoutMs: POINTER_TIMEOUT_MS }, async res => {\n if (res.status !== 200) return { status: res.status };\n const read = await readBoundedText(res, MAX_POINTER_BYTES);\n return read.oversized ? { oversized: true } : { text: read.text };\n });\n if (out.status) throw new Error(`could not read the release pointer (HTTP ${out.status}): ${url}`);\n if (out.oversized) throw new Error(`the release pointer is implausibly large: ${url}`);\n\n let doc;\n try {\n doc = JSON.parse(String(out.text || ''));\n } catch {\n throw new Error(`the release pointer is not JSON: ${url}`);\n }\n if (!doc || typeof doc !== 'object') throw new Error(`the release pointer is not an object: ${url}`);\n\n const filename = String(doc.filename || '');\n if (!FILENAME_RE.test(filename)) {\n throw new Error(`the release pointer names an unusable index filename (${JSON.stringify(doc.filename)}): ${url}`);\n }\n const sha256 = String(doc.sha256 || '').trim().toLowerCase();\n if (!SHA256_RE.test(sha256)) {\n throw new Error(`the release pointer does not carry a sha256 digest: ${url}`);\n }\n // Recorded, never acted on, so a missing or odd value costs a label rather\n // than the install. Bounded because it lands in a file on disk.\n const version = doc.version === undefined || doc.version === null\n ? null\n : String(doc.version).slice(0, 64);\n return { filename, sha256, version };\n}","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/santifer/career-ops/blob/1696bec4d021768e7359f9aad6b329cba883da20/plugins/h1b-sponsor/install-h1b-index.mjs#L98-L134","documentation":"After fetchPointer() successfully reads the release pointer, it JSON.parses the body. If parsing fails — the body is HTML, an error page, truncated text, or empty — this error is thrown with the pointer URL. The library requires the pointer to be a strict JSON document naming the index asset, and refuses to guess.","triggerScenarios":"fetchPointer(url) gets HTTP 200 within the byte cap, but JSON.parse(String(out.text || '')) throws because the body is not valid JSON.","commonSituations":"The endpoint returns an HTML login/captcha page with status 200; a captive portal or corporate proxy rewrites the response; the pointer file on the release host was truncated or corrupted; H1B_API_BASE points at the wrong path that serves plain text.","solutions":["curl the pointer URL and check the raw body — confirm it is valid JSON with a filename field.","Fix H1B_API_BASE / the pointer URL so it hits the real pointer file, not an HTML page.","If the release host is corrupted, wait for or trigger republish of the pointer, then retry.","Rule out proxy interference (VPN, corporate proxy) that injects HTML into responses."],"exampleFix":"// before\ncurl $H1B_API_BASE/release-pointer.json # -> 'Sign in...'\n// after\nunset H1B_API_BASE # fall back to the default endpoint that serves real JSON","handlingStrategy":"validation","validationCode":"const res = await fetch(pointerUrl);\nconst text = await res.text();\ntry { JSON.parse(text); } catch { throw new Error(`${pointerUrl} is not serving JSON (got: ${text.slice(0, 80)}...)`); }","typeGuard":"function looksLikePointer(text) {\n try { const d = JSON.parse(text); return !!d && typeof d === 'object' && !Array.isArray(d); } catch { return false; }\n}","tryCatchPattern":"try {\n await installH1BIndex();\n} catch (e) {\n if (String(e.message).includes('release pointer is not JSON')) {\n console.error('Endpoint returned a non-JSON body (HTML login page, proxy, or truncation). Inspect with curl.');\n } else throw e;\n}","preventionTips":["curl custom endpoints before configuring H1B_API_BASE to confirm they return raw JSON.","Avoid endpoints behind auth walls or captive portals that answer 200 with HTML.","Watch for proxies that rewrite responses and disable them for install runs.","Validate pointer files after publishing (CI JSON.parse smoke test)."],"tags":["json","network","http"],"backgroundTag":"invalid-json-response","analyzedSha":"1696bec4d021768e7359f9aad6b329cba883da20","analyzedAt":"2026-09-01T19:19:23.111Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}