can1357/oh-my-pi · error · HTTPException

remote url must be https://github.com/{expected_repo}[.git]

Error message

remote url must be https://github.com/{expected_repo}[.git]

What it means

Raised by _normalized_github_https_url when the worktree's origin URL is not HTTPS (e.g. ssh://, git@..., git://, file://). The proxy only authenticates and forwards git operations against https://github.com URLs, because it injects a bearer token over HTTPS; SSH URLs would bypass or break that auth model.

Source

Thrown at python/robomp/src/proxy/server.py:318


def _read_single_remote_url(repo_dir: Path, expected_repo: str, *, push: bool, slot_uid: int | None = None) -> str:
    urls = list(dict.fromkeys(_read_remote_urls(repo_dir, slot_uid=slot_uid, push=push)))
    if len(urls) != 1:
        kind = "push" if push else "fetch"
        log.warning(
            "gh-proxy: refusing git op — origin has ambiguous remote urls",
            extra={"expected_repo": expected_repo, "kind": kind, "count": len(urls)},
        )
        raise HTTPException(400, f"origin must have exactly one {kind} url")
    return urls[0]


def _normalized_github_https_url(url: str, expected_repo: str) -> str:
    _validate_repo_name(expected_repo)
    parsed = urlparse(url)
    if (parsed.scheme or "").lower() != "https":
        raise HTTPException(400, f"remote url must be https://github.com/{expected_repo}[.git]")
    if parsed.username or parsed.password:
        raise HTTPException(400, "remote url must not contain embedded credentials")
    try:
        port = parsed.port
    except ValueError as exc:
        raise HTTPException(400, "remote url has invalid port") from exc
    if port is not None:
        raise HTTPException(400, "remote url must not specify a port")
    if (parsed.hostname or "").lower() != "github.com":
        raise HTTPException(400, f"remote url host must be github.com for repo {expected_repo!r}")
    if parsed.params or parsed.query or parsed.fragment:
        raise HTTPException(400, "remote url must not contain params, query, or fragment")
    path = parsed.path.strip("/")
    if path.endswith(".git"):
        path = path[:-4]
    if path.lower() != expected_repo.lower():
        raise HTTPException(400, f"remote url does not match repo {expected_repo!r}")
    return _github_url_for_repo(expected_repo)

View on GitHub (pinned to 9690622007)

Solutions

  1. Convert origin to HTTPS: `git remote set-url origin https://github.com/<owner>/<repo>.git`
  2. Strip insteadOf rewrites affecting the URL (`git config --get-all url.*.insteadOf`) if a rewrite is mutating your https URL into ssh
  3. Re-clone the worktree with the HTTPS URL
  4. If you require SSH, do not route those repos through this proxy

Example fix

// before
$ git remote set-url origin git@github.com:acme/repo.git
// after
$ git remote set-url origin https://github.com/acme/repo.git
Defensive patterns

Strategy: validation

Validate before calling

from urllib.parse import urlparse

def origin_is_https(url: str) -> bool:
    return (urlparse(url).scheme or "").lower() == "https"

Try / catch

from fastapi import HTTPException

try:
    result = client.post("/git/op", json={"repo": "acme/repo"})
except HTTPException as e:
    if e.status_code == 400 and "must be https" in e.detail:
        set_origin_https(worktree_dir, "acme/repo")
    else:
        raise

Prevention

When it happens

Trigger: Any proxied git op where the repo's origin (fetch or push) scheme is not 'https' — e.g. origin set to git@github.com:acme/repo.git or https replaced by http/ssh/file after cloning.

Common situations: Cloning via SSH locally and letting the proxy reuse that worktree; http:// (cleartext) URLs from internal tooling; local path or file:// remotes from offline setups; insteadOf rewrites changing the effective URL.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/ff428679f3e497d5. Report an issue: GitHub.