What causes "remote URL %q does not match any allowed pattern" in gastownhall/beads?

Check the configured allowed patterns and use a URL that matches one of them exactly.

remote URL %q does not match any allowed pattern

Error message

remote URL %q does not match any allowed pattern

What it means

ValidateRemoteURLWithPatterns enforces an allowlist: the URL must match at least one configured glob-style pattern (path.Match semantics, e.g. "dolthub://myorg/*"). If no pattern matches, the remote is outside policy and the call fails with the offending URL quoted.

Source

Thrown at internal/remotecache/url.go:233

	return matched
}

// ValidateRemoteURLWithPatterns validates a URL and optionally checks it
// against an allowlist of glob patterns. If patterns is empty, only
// structural validation is performed.
func ValidateRemoteURLWithPatterns(rawURL string, patterns []string) error {
	if err := ValidateRemoteURL(rawURL); err != nil {
		return err
	}
	if len(patterns) == 0 {
		return nil
	}
	for _, p := range patterns {
		if MatchesRemotePattern(rawURL, p) {
			return nil
		}
	}
	return fmt.Errorf("remote URL %q does not match any allowed pattern", rawURL)
}

func sortedSchemes() []string {
	// Return in a consistent display order
	return []string{"dolthub", "https", "http", "ssh", "git", "git+ssh", "git+https", "git+http", "git+file", "s3", "aws", "gs", "az", "oci", "file"}
}

// CacheKey returns a filesystem-safe identifier for a remote URL.
// It uses the first 16 hex characters (64 bits) of the SHA-256 hash.
// Birthday-bound collision risk is negligible for a local cache: 50% at
// ~4.3 billion entries, well beyond any realistic number of remotes.
func CacheKey(remoteURL string) string {
	h := sha256.Sum256([]byte(remoteURL))
	return fmt.Sprintf("%x", h[:8])
}

View on GitHub (pinned to 71377f2769)

Solutions

Check the configured allowed patterns and use a URL that matches one of them exactly.
Fix the URL typo or wrong scheme/host (e.g. dolthub://myorg/repo instead of dolthub://myorgx/repo).
If the remote is legitimately needed, have an admin add a pattern covering it (e.g. "dolthub://myorg/forks/*").

Example fix

// before
patterns := []string{"dolthub://myorg/*"}
ValidateRemoteURLWithPatterns("https://github.com/other/repo", patterns) // fails
// after
ValidateRemoteURLWithPatterns("dolthub://myorg/repo", patterns) // ok

Defensive patterns

Strategy: validation

Validate before calling

func urlAllowed(rawURL string, patterns []string) bool {
    for _, p := range patterns {
        if matched, _ := path.Match(p, rawURL); matched {
            return true
        }
    }
    return false
}

Try / catch

if err := remotecache.ValidateRemoteURLWithPatterns(rawURL, patterns); err != nil {
    return fmt.Errorf("remote not permitted by policy: %w", err)
}

Prevention

Keep the allowlist in config and document covered hosts/schemes for users.
Validate scheme and host before constructing the full URL.
Log the offending URL on failure so typos are easy to spot.

When it happens

Trigger: Adding a remote whose URL scheme or host is not covered by any allowed pattern — e.g. allowlist is ["dolthub://myorg/*"] but the URL is https://github.com/other/repo, or a typo like dolthub://myorgX/repo.

Common situations: Organization policy configs that restrict remotes to trusted hosts; users pointing at a personal fork or a different registry; scheme typos (http vs https) not covered by patterns.

Related errors

AI-assisted analysis of gastownhall/beads@71377f2769 (2026-08-30). Data as JSON: /api/errors/41dda8ad1b1e5cc2. Report an issue: GitHub.