{"record":{"id":"c2f5134a51394410","repo":"bytedance/deer-flow","slug":"failed-to-load-agents-res-statustext","errorCode":null,"errorMessage":"Failed to load agents: ${res.statusText}","messagePattern":"Failed to load agents: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"frontend/src/core/agents/api.ts","lineNumber":41,"sourceCode":"    super(message);\n    this.name = \"AgentNameCheckError\";\n  }\n}\n\nexport class AgentsApiDisabledError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"AgentsApiDisabledError\";\n  }\n}\n\nfunction isAgentsApiDisabledDetail(detail: string | undefined): boolean {\n  return typeof detail === \"string\" && detail.includes(\"agents_api.enabled\");\n}\n\nexport async function listAgents(): Promise<Agent[]> {\n  const res = await fetch(`${getBackendBaseURL()}/api/agents`);\n  if (!res.ok) throw new Error(`Failed to load agents: ${res.statusText}`);\n  const data = (await res.json()) as { agents: Agent[] };\n  return data.agents;\n}\n\nexport async function getAgent(name: string): Promise<Agent> {\n  const res = await fetch(`${getBackendBaseURL()}/api/agents/${name}`);\n  if (!res.ok) throw new Error(`Agent '${name}' not found`);\n  return res.json() as Promise<Agent>;\n}\n\nexport async function createAgent(request: CreateAgentRequest): Promise<Agent> {\n  const res = await fetch(`${getBackendBaseURL()}/api/agents`, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/json\" },\n    body: JSON.stringify(request),\n  });\n  if (!res.ok) {\n    const err = (await res.json().catch(() => ({}))) as { detail?: string };","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/frontend/src/core/agents/api.ts#L23-L59","documentation":"Raised by Mem0Config validation when base_url uses an http:// scheme while allow_insecure_http is false. The mem0 backend sends the API key as a credential on every request to base_url, so plaintext HTTP would leak it on the wire; the config therefore demands https:// unless the operator explicitly opts into insecure transport.","triggerScenarios":"Setting the mem0 memory backend's base_url to an http:// URL (e.g. a local or self-hosted instance at http://10.0.0.5:8080) in config.yaml without also setting allow_insecure_http: true. Any startup or config reload that constructs the mem0 backend from that config fails immediately in the validate hook.","commonSituations":"Pointing at a local mem0 container or an internal endpoint with no TLS certificate; copying a docker-compose example URL with http:// into production config; running behind a TLS-terminating proxy and mistakenly giving the backend the plain upstream address.","solutions":["Change base_url to an https:// URL (terminate TLS at the service or a reverse proxy).","If the endpoint is trusted local/internal infrastructure, set allow_insecure_http: true in the mem0 backend_config and keep the deployment off public networks.","Check for a scheme typo, e.g. base_url: http://api.mem0.ai should be https://api.mem0.ai."],"exampleFix":"# before\nmemory:\n  backend: mem0\n  backend_config:\n    base_url: http://mem0.internal:8080\n\n# after (option 1: TLS)\n    base_url: https://mem0.internal:8443\n# after (option 2: explicit opt-in, trusted network only)\n    base_url: http://mem0.internal:8080\n    allow_insecure_http: true","handlingStrategy":"validation","validationCode":"from urllib.parse import urlsplit\n\n\ndef check_mem0_base_url(base_url: str, allow_insecure_http: bool) -> None:\n    p = urlsplit(base_url)\n    assert p.scheme in {'http', 'https'} and p.netloc, 'need absolute http(s) URL'\n    assert p.scheme == 'https' or allow_insecure_http, (\n        'http:// base_url requires allow_insecure_http: true (trusted local only)'\n    )","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default to https:// base_url everywhere; treat http:// as a local-only exception.","Run a pre-deploy config lint that urlsplit-checks the scheme.","Centralize allow_insecure_http: true in a dev-only config overlay that never reaches production."],"tags":["mem0","configuration","security","tls","validation"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}