jdx/mise · error

invalid repository origin

Error message

invalid repository origin

What it means

Before using a repository origin for remote onboarding, mise validates it (validate_origin). Origins starting with '-' (which git could parse as flags) or containing any control character are rejected outright as invalid, protecting the later git invocation from option injection and malformed input.

Source

Thrown at src/system/remote_repository.rs:46

async fn git_async(path: &Path, args: &[&str]) -> Result<String> {
    let mut command = Command::new("git");
    crate::git::sanitize_git_command(&mut command);
    command.arg("-C").arg(path).args(args);
    let output = tokio::process::Command::from(command)
        .kill_on_drop(true)
        .output()
        .await?;
    if !output.status.success() {
        bail!("repository operation failed ({})", output.status);
    }
    Ok(String::from_utf8(output.stdout)?
        .trim_end_matches('\n')
        .to_string())
}

pub(crate) fn validate_origin(origin: &str) -> Result<()> {
    if origin.starts_with('-') || origin.chars().any(char::is_control) {
        bail!("invalid repository origin");
    }
    // Explicit local paths may contain colons; otherwise :: selects a Git helper.
    let explicit_local = std::path::Path::new(origin).is_absolute()
        || origin.starts_with("./")
        || origin.starts_with("../");
    if !explicit_local
        && origin.split_once("::").is_some_and(|(prefix, _)| {
            !prefix.is_empty() && !prefix.contains(['/', '\\', '[', ']', '@', ':'])
        })
    {
        bail!("Git remote helpers are not supported for remote onboarding");
    }
    if !explicit_local && origin.contains("://") {
        let url = url::Url::parse(origin).wrap_err("invalid repository URL")?;
        if !matches!(url.scheme(), "https" | "ssh" | "file") {
            bail!("remote bootstrap requires HTTPS, SSH, or a local path");
        }
    }

View on GitHub (pinned to afd2eddd3a)

Solutions

  1. Remove the leading '-' and any control characters from the origin value
  2. Re-type the origin manually rather than pasting from terminal output
  3. Validate the origin with a plain `git remote -v`-style check before configuring

Example fix

// before
origin = "-https://git.example.com/repo.git"
// after
origin = "https://git.example.com/repo.git"
Defensive patterns

Strategy: validation

Validate before calling

const safeOrigin = (o) => typeof o === 'string' && o.length > 0 && !o.startsWith('-') && !/[^\x20-\x7E]/.test(o);

Type guard

const isPrintableNonDashOrigin = (s) => typeof s === 'string' && !s.startsWith('-') && [...s].every(ch => ch.charCodeAt(0) >= 32 && ch.charCodeAt(0) < 127);

Try / catch

try { setOrigin(o); } catch (e) { o = sanitizeOrigin(o); setOrigin(o); }

Prevention

When it happens

Trigger: Configuring a remote repository origin that begins with a dash or contains control bytes (e.g. a stray \n, \t, or escaped terminal sequences) in fetch or install_at flows.

Common situations: Copy-pasting an origin from terminal output that included ANSI codes; accidentally prefixing the URL with a dash; generating the origin from untrusted/unsanitized input.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors


AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/7bc498c3c1f32439. Report an issue: GitHub.