can1357/oh-my-pi · error · HTTPException

remote url host must be github.com for repo {expected_repo!r

Error message

remote url host must be github.com for repo {expected_repo!r}

What it means

Raised when the origin URL is valid HTTPS but its hostname is not github.com. The proxy authenticates only against public GitHub (github.com); other hosts (GitHub Enterprise, gitlab, internal mirrors, typo'd hosts) are rejected with the expected repo name in the message to aid diagnosis.

Source

Thrown at python/robomp/src/proxy/server.py:328

        raise HTTPException(400, f"origin must have exactly one {kind} url")
    return urls[0]


def _normalized_github_https_url(url: str, expected_repo: str) -> str:
    _validate_repo_name(expected_repo)
    parsed = urlparse(url)
    if (parsed.scheme or "").lower() != "https":
        raise HTTPException(400, f"remote url must be https://github.com/{expected_repo}[.git]")
    if parsed.username or parsed.password:
        raise HTTPException(400, "remote url must not contain embedded credentials")
    try:
        port = parsed.port
    except ValueError as exc:
        raise HTTPException(400, "remote url has invalid port") from exc
    if port is not None:
        raise HTTPException(400, "remote url must not specify a port")
    if (parsed.hostname or "").lower() != "github.com":
        raise HTTPException(400, f"remote url host must be github.com for repo {expected_repo!r}")
    if parsed.params or parsed.query or parsed.fragment:
        raise HTTPException(400, "remote url must not contain params, query, or fragment")
    path = parsed.path.strip("/")
    if path.endswith(".git"):
        path = path[:-4]
    if path.lower() != expected_repo.lower():
        raise HTTPException(400, f"remote url does not match repo {expected_repo!r}")
    return _github_url_for_repo(expected_repo)


def _remote_auth_for_url(url: str, expected_repo: str, token: str) -> _RemoteAuth:
    raw = url.strip()
    if not raw or raw != url:
        raise HTTPException(400, "remote url must not be empty or padded")
    if _FORBIDDEN_URL_BYTES_RE.search(raw):
        raise HTTPException(400, "remote url contains forbidden control bytes")
    if raw.startswith("-"):
        raise HTTPException(400, "remote url must not start with '-'")

View on GitHub (pinned to 9690622007)

Solutions

  1. Point origin at github.com: `git remote set-url origin https://github.com/<owner>/<repo>.git`
  2. If the repo truly lives on another host, this proxy does not support it — use direct git instead
  3. Check for insteadOf rewrites rewriting the host (`git config --get-regexp url\..*\.insteadof`)
  4. Remove host-rewriting HTTPS_PROXY/hosts-file tricks that alter the effective hostname

Example fix

// before (enterprise host)
$ git remote set-url origin https://ghe.acme.internal/acme/repo.git
// after
$ git remote set-url origin https://github.com/acme/repo.git
Defensive patterns

Strategy: validation

Validate before calling

from urllib.parse import urlparse

def origin_host_is_github(url: str) -> bool:
    return (urlparse(url).hostname or "").lower() == "github.com"

Try / catch

from fastapi import HTTPException

try:
    result = client.post("/git/op", json={"repo": "acme/repo"})
except HTTPException as e:
    if e.status_code == 400 and "host must be github.com" in e.detail:
        set_origin(worktree_dir, f"https://github.com/{expected_repo}.git")
    else:
        raise

Prevention

When it happens

Trigger: Proxied git op where urlparse(origin).hostname != 'github.com' (case-insensitive) — e.g. ghe.example.com, github.company.internal, ssh converted URLs pointing at a fork host, or hosts like www.github.com.

Common situations: Worktrees cloned from GitHub Enterprise or a mirror; DNS/search-domain appending producing gitlab.com vs github.com mixups; proxies rewriting the host; typo'd hostnames.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/8d82be13dc476439. Report an issue: GitHub.