invalid HTTP setup repository URL; use a Git credential help

Error message

invalid HTTP setup repository URL; use a Git credential helper for authentication

What it means

`validate_url` in src/system/history/sync/network.rs requires that a URL which looks like HTTP/HTTPS actually parse as a valid URL. If the prefix is `http:`/`https:` (case-insensitive) but `url::Url::parse` fails, this error is thrown. The message deliberately avoids echoing the URL back so that any embedded credentials (e.g. `https://token@host/...`) are never leaked into errors recorded in history health; it also instructs the user to use a Git credential helper for authentication instead.

Source

Thrown at src/system/history/sync/network.rs:34

#[error("{0}")]
pub(crate) struct NetworkError(pub String);

/// Authentication belongs in a credential helper or SSH agent, never in
/// persisted connection URLs or the errors recorded in history health.
pub(crate) fn validate_url(value: &str) -> Result<()> {
    if value.trim().is_empty() || value.trim_start().starts_with('-') {
        bail!("setup repository URL must be nonempty and must not start with '-'");
    }
    let http_like = value
        .trim_start()
        .get(..5)
        .is_some_and(|prefix| prefix.eq_ignore_ascii_case("http:"))
        || value
            .trim_start()
            .get(..6)
            .is_some_and(|prefix| prefix.eq_ignore_ascii_case("https:"));
    if http_like && url::Url::parse(value).is_err() {
        bail!("invalid HTTP setup repository URL; use a Git credential helper for authentication");
    }
    if let Ok(url) = url::Url::parse(value) {
        let http = matches!(url.scheme(), "http" | "https");
        if url.password().is_some()
            || (http
                && (!url.username().is_empty()
                    || url.query().is_some()
                    || url.fragment().is_some()))
        {
            bail!(
                "setup repository URLs must not contain credentials, query parameters, or fragments; use a Git credential helper or SSH agent"
            );
        }
    }
    Ok(())
}

#[cfg(test)]

View on GitHub (pinned to afd2eddd3a)

Solutions

Fix the URL so it is a valid absolute HTTP(S) URL (balanced brackets, valid host and port, e.g. `https://github.com/user/dotfiles.git`).
Remove any embedded username/password/token from the URL and configure a Git credential helper (`git config --global credential.helper`) or SSH remote instead — credentials in URLs are also rejected outright.
Copy the URL fresh from the provider (GitHub/GitLab clone button) to avoid transcription errors; test it with `git ls-remote <url>`.

Example fix

// before (config)
history.remote = "https://ghp_secret@github.com:bad/repo"

// after
history.remote = "https://github.com/user/dotfiles.git"
// plus: git config --global credential.helper store

Defensive patterns

Strategy: validation

Validate before calling

fn is_valid_http_url(v: &str) -> bool {
    let t = v.trim_start();
    let http_like = t.get(..5).map_or(false, |p| p.eq_ignore_ascii_case("http:"))
        || t.get(..6).map_or(false, |p| p.eq_ignore_ascii_case("https:"));
    !http_like || url::Url::parse(v).is_ok()
}

Try / catch

// Rust
match validate_url(url) {
    Ok(()) => remote.fetch("main")?,
    Err(e) if e.to_string().contains("credential helper") => {
        eprintln!("URL is malformed or embeds credentials; use `git config credential.helper` instead");
    }
    Err(e) => return Err(e),
}

Prevention

Never embed usernames, passwords, or tokens in remote URLs — configure a Git credential helper or use SSH remotes
Copy HTTPS URLs directly from the provider's clone button to avoid transcription errors
Test the URL with `git ls-remote <url>` before saving it to settings
Watch for shell quoting or templating that mangles brackets, ports, or slashes in URLs

When it happens

Trigger: Calling any `Remote` network method with an HTTP(S)-prefixed string that is not a parseable URL — e.g. `"https://secret@example.com:bad/repo"` (invalid port), `"HTTP://secret@[broken/repo"` (malformed host), a truncated URL with unbalanced brackets, or spaces/illegal characters in an https URL.

Common situations: Pasting a URL with an embedded access token or password into the remote field; hand-editing the URL and corrupting the host or port; missing scheme characters (e.g. `https:/host` with one slash); shell/quoting mangling of the URL before it reaches mise; uppercase-scheme URLs with bad hosts.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/49580c52e6132ba2. Report an issue: GitHub.