{"record":{"id":"a1fa580d35158bc1","repo":"musistudio/claude-code-router","slug":"identityissue-message","errorCode":null,"errorMessage":"${identityIssue.message}","messagePattern":"\\$\\{identityIssue\\.message\\}","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/providers/manifest-service.ts","lineNumber":165,"sourceCode":"  }\n  if (url.username || url.password) {\n    throw new Error(\"Provider manifest URL cannot include credentials.\");\n  }\n  if (url.hash) {\n    url.hash = \"\";\n  }\n  validateRemoteHostname(url.hostname, \"Provider manifest URL\");\n  return url;\n}\n\nasync function validateRemoteManifestProvider(provider: ProviderDeepLinkPayload): Promise<void> {\n  await validatePublicHttpsUrl(provider.baseUrl, \"Provider Base URL\");\n  const identityIssue = providerIdentitySafetyIssue({\n    baseUrl: provider.baseUrl,\n    name: provider.name\n  });\n  if (identityIssue) {\n    throw new Error(identityIssue.message);\n  }\n\n  const connectors = provider.account?.connectors ?? [];\n  for (const connector of connectors) {\n    await validateRemoteAccountConnector(provider, connector);\n  }\n}\n\nasync function validateRemoteAccountConnector(provider: ProviderDeepLinkPayload, connector: ProviderAccountConnectorConfig): Promise<void> {\n  if (connector.type === \"http-json\") {\n    validateSafeHeaders(connector.headers);\n    const endpoint = (connector as ProviderAccountHttpJsonConnectorConfig).endpoint;\n    await validatePublicHttpsUrl(endpoint, \"Fetch usage URL\");\n    validateProviderApiKeyTarget(provider, endpoint);\n    return;\n  }\n  if (connector.type === \"standard\") {\n    const standardConnector = connector as ProviderAccountStandardConnectorConfig;","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/musistudio/claude-code-router/blob/99f24806c6a2c660b16e53e95211c517448a6c90/packages/core/src/providers/manifest-service.ts#L147-L183","documentation":"Thrown when a remote provider manifest defines a provider whose baseUrl or name trips the providerIdentitySafetyIssue check (e.g. the base URL impersonates a known/bundled provider identity). This is a supply-chain/SSRF guard: a remote manifest is untrusted input, so providers that masquerade as official presets are rejected before any fetch happens.","triggerScenarios":"fetchProviderManifest() on a remote manifest whose provider entry has a baseUrl that collides with a known provider preset identity (or a spoofing name pattern), causing providerIdentitySafetyIssue({baseUrl, name}) to return an issue.","commonSituations":"Hosting a community manifest that copies an official provider's base URL, renaming a custom provider to match a bundled one, or stale manifest entries after the local presets list changed in an upgrade.","solutions":["Change the manifest provider's baseUrl to a domain you actually own rather than one matching a bundled provider preset","Rename the provider in the manifest so it does not impersonate an official provider identity","If the manifest is yours and the collision is legitimate, serve it locally instead of as a remote manifest (local manifests skip the remote identity checks)","Upgrade the manifest host and core package together so preset identity data is in sync"],"exampleFix":"// before (manifest.json)\n{\"name\": \"openrouter\", \"baseUrl\": \"https://openrouter.ai/api/v1\"}\n// after\n{\"name\": \"my-gateway\", \"baseUrl\": \"https://manifests.example.com/my-gateway\"}","handlingStrategy":"validation","validationCode":"const issue = providerIdentitySafetyIssue({ baseUrl: provider.baseUrl, name: provider.name });\nif (issue) throw new Error(issue.message); // surface before fetchProviderManifest","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only reference remote manifests you control","Keep manifest provider names/base URLs distinct from bundled presets"],"tags":["manifest","ssrf","provider-config","security"],"backgroundTag":"manifest-validation-failed","analyzedSha":"99f24806c6a2c660b16e53e95211c517448a6c90","analyzedAt":"2026-08-27T04:11:01.184Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}