What causes "the upload response URL must use HTTP or HTTPS" in can1357/oh-my-pi?

Configure the endpoint (or its response) to return absolute `https://` URLs for the uploaded file

can1357/oh-my-pi · error · LegacyDestinationError

the upload response URL must use HTTP or HTTPS

Error message

the upload response URL must use HTTP or HTTPS

What it means

This LegacyDestinationError is thrown by httpUrl() when the URL from the upload response parses successfully but its protocol is not `https:` or `http:`. Like the configured-endpoint protocol check, it guarantees the returned direct-download URL is fetchable over HTTP(S).

Source

Thrown at packages/coding-agent/src/blob-broker/uploaders-legacy.ts:103

}

function sendSpaceEndpoint(config: DestinationRuntimeConfig): URL {
	const endpoint = configuredEndpoint("sendspace", config);
	if (endpoint.hostname.toLowerCase() === SENDSPACE_DEFAULT_HOST) {
		throw new DestinationUnavailableError("sendspace", "the deprecated public discovery endpoint cannot be used");
	}
	return endpoint;
}

function httpUrl(destination: BlobDestinationId, raw: string, base?: URL): string {
	let url: URL;
	try {
		url = base ? new URL(raw, base) : new URL(raw);
	} catch (error) {
		throw new LegacyDestinationError(destination, "the upload response did not contain a valid direct URL", error);
	}
	if (url.protocol !== "https:" && url.protocol !== "http:") {
		throw new LegacyDestinationError(destination, "the upload response URL must use HTTP or HTTPS");
	}
	return url.href;
}

function objectValue(value: unknown): Readonly<Record<string, unknown>> {
	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
	return value as Readonly<Record<string, unknown>>;
}

function firstString(record: Readonly<Record<string, unknown>>, keys: readonly string[]): string | undefined {
	for (const key of keys) {
		const value = record[key];
		if (typeof value === "string" && value.trim()) return value.trim();
	}
	return undefined;
}

async function jsonObject(

View on GitHub (pinned to 9690622007)

Solutions

Configure the endpoint (or its response) to return absolute `https://` URLs for the uploaded file
If the endpoint returns data-URIs, add a wrapper that stores the bytes and returns an HTTP URL instead
Inspect the response body to confirm which scheme the URL field carries and adjust the server

Defensive patterns

Strategy: try-catch

Type guard

function isHttpUrlString(value: unknown): value is string {
  if (typeof value !== "string") return false;
  try { return /^https?:$/.test(new URL(value).protocol); } catch { return false; }
}

Try / catch

try {
  const result = await uploader.upload(request);
} catch (err) {
  if (err instanceof Error && err.message.includes("must use HTTP or HTTPS")) {
    // server returned a non-HTTP scheme (data:, ftp:, ...) in its response URL
  } else throw err;
}

Prevention

Configure endpoints to return http(s) URLs, not data-URIs or other schemes
Proxy data-URI responses through a store-and-serve layer
Verify response URL schemes during endpoint integration testing
Reject non-HTTP URL fields server-side before returning them to clients

When it happens

Trigger: The upload endpoint's response contains a URL with an unusual scheme — e.g. 'ftp://host/f.png', a 'data:image/png;base64,...' URI, or a javascript:/file: URL in a field the library treats as a direct link; thrown from directJsonUrl/url/upload/discoverSendSpaceNode.

Common situations: Replacement endpoints that return data-URIs for inline images; misconfigured servers emitting internal scheme links; hand-written response shims returning non-HTTP URLs.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/a079fe9aef4a547b. Report an issue: GitHub.