What causes "MITM router URL must use http or https" in decolua/9router?

Use an http:// or https:// URL for the MITM router base, e.g. 'http://localhost:20128'.

decolua/9router · error · Error

MITM router URL must use http or https

Error message

MITM router URL must use http or https

What it means

normalizeMitmRouterBaseUrlInput validates a user-supplied MITM router base URL before it is used by the antigravity MITM proxy route. After parsing the input with new URL(), it rejects any URL whose protocol is neither http: nor https:. This guards the proxy against invalid schemes like file:, ws:, or ftp: which fetch/upstream routing cannot handle.

Source

Thrown at src/app/api/cli-tools/antigravity-mitm/route.js:33

import { getSettings, updateSettings } from "@/lib/localDb";

initDbHooks(getSettings, updateSettings);

const DEFAULT_MITM_ROUTER_BASE = "http://localhost:20128";

function normalizeMitmRouterBaseUrlInput(input) {
  if (input == null || String(input).trim() === "") {
    return DEFAULT_MITM_ROUTER_BASE;
  }
  const t = String(input).trim().replace(/\/+$/, "");
  let u;
  try {
    u = new URL(t);
  } catch {
    throw new Error("Invalid MITM router URL");
  }
  if (u.protocol !== "http:" && u.protocol !== "https:") {
    throw new Error("MITM router URL must use http or https");
  }
  return t;
}

const isWin = process.platform === "win32";

function getPassword(provided) {
  return provided || getCachedPassword() || null;
}

function requiresSudoPassword(pwd) {
  return !isWin && !pwd && isSudoPasswordRequired();
}

function checkIsAdmin() {
  if (isWin) {
    try {
      require("child_process").execSync("net session >nul 2>&1", { windowsHide: true });

View on GitHub (pinned to 90b52e06ff)

Solutions

Use an http:// or https:// URL for the MITM router base, e.g. 'http://localhost:20128'.
If the value was typed without a scheme, prefix it with 'http://' before submitting.
Check the settings file / env where the MITM router URL is stored and correct the scheme.

Example fix

// before
normalizeMitmRouterBaseUrlInput("ftp://localhost:20128")
// after
normalizeMitmRouterBaseUrlInput("http://localhost:20128")

Defensive patterns

Strategy: validation

Validate before calling

function isValidHttpUrl(s) {
  try {
    const u = new URL(s);
    return u.protocol === "http:" || u.protocol === "https:";
  } catch { return false; }
}
if (!isValidHttpUrl(input)) input = "http://" + input;

Type guard

const isHttpUrl = (v) => {
  try { const u = new URL(v); return ["http:","https:"].includes(u.protocol); }
  catch { return false; }
};

Try / catch

try {
  await configureMitm(routerUrl);
} catch (e) {
  if (e.message.includes("must use http or https")) {
    console.error("Fix the scheme, e.g. http://host:port");
  } else throw e;
}

Prevention

Always include an explicit http:// or https:// scheme in router URLs
Never use ws:// or other schemes for the MITM router base
Validate config values at startup with a URL-scheme check

When it happens

Trigger: POSTing to /api/cli-tools/antigravity-mitm with a routerUrl whose scheme is not http/https, e.g. 'ftp://host:20128', 'localhost:20128' parsed with a stray scheme, or a URL like 'file:///etc/passwd'.

Common situations: Users paste a router URL from docs including a typo'd scheme (e.g. 'tcp://'), or omit '//' so the URL parser assigns an unexpected scheme, or configure a ws:// websocket address believing it works for the proxy.

Related errors

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/0d2e42bf799ac374. Report an issue: GitHub.