setup repository URLs must not contain credentials, query pa

Error message

setup repository URLs must not contain credentials, query parameters, or fragments; use a Git credential helper or SSH agent

What it means

validate_url checks setup-repository URLs before any network git operation. A URL with embedded credentials (userinfo password, or any username on http/https), a query string, or a fragment is refused because such parts leak secrets into logs/remotes or make the remote address ambiguous; the library demands credential helpers or SSH agents instead.

Source

Thrown at src/system/history/sync/network.rs:44

        .trim_start()
        .get(..5)
        .is_some_and(|prefix| prefix.eq_ignore_ascii_case("http:"))
        || value
            .trim_start()
            .get(..6)
            .is_some_and(|prefix| prefix.eq_ignore_ascii_case("https:"));
    if http_like && url::Url::parse(value).is_err() {
        bail!("invalid HTTP setup repository URL; use a Git credential helper for authentication");
    }
    if let Ok(url) = url::Url::parse(value) {
        let http = matches!(url.scheme(), "http" | "https");
        if url.password().is_some()
            || (http
                && (!url.username().is_empty()
                    || url.query().is_some()
                    || url.fragment().is_some()))
        {
            bail!(
                "setup repository URLs must not contain credentials, query parameters, or fragments; use a Git credential helper or SSH agent"
            );
        }
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::{HistoryRepo, PushOutcome, Remote, UPSTREAM_REF, validate_url};

    #[test]
    fn disposable_tip_probe_is_shallow_but_ordinary_fetch_keeps_ancestry() {
        let temp = tempfile::tempdir().unwrap();
        let source = HistoryRepo::open_or_init_in(&temp.path().join("source"))
            .unwrap()
            .unwrap();
        let tree = source.empty_object("tree").unwrap();

View on GitHub (pinned to afd2eddd3a)

Solutions

Strip credentials from the URL and configure a git credential helper (git config credential.helper) or use SSH remotes.
Remove the query string and fragment from the URL; reference branches/commits via refspecs instead.
If an http(s) username is needed for auth, switch to SSH (git@host:repo.git) or rely on the credential helper's configured username.
Verify with git ls-remote <cleaned-url> that the sanitized URL still resolves before retrying.

Example fix

// before
let url = "https://ci-bot:ghp_token@example.com/repo.git";
network.validate_url(&url)?;
// after
let url = "https://example.com/repo.git"; // auth via credential.helper or SSH

Defensive patterns

Strategy: validation

Validate before calling

let parsed = url::Url::parse(candidate)?;
let http = matches!(parsed.scheme(), "http" | "https");
if parsed.password().is_some()
    || (http && (!parsed.username().is_empty() || parsed.query().is_some() || parsed.fragment().is_some()))
{
    return Err("strip credentials/query/fragment from the setup URL".into());
}

Type guard

fn is_clean_remote_url(u: &url::Url) -> bool {
    let http = matches!(u.scheme(), "http" | "https");
    u.password().is_none()
        && (!http || (u.username().is_empty() && u.query().is_none() && u.fragment().is_none()))
}

Prevention

Use credential helpers (git credential-store/cache) or SSH agents instead of embedding tokens in URLs.
Never copy clone URLs straight from a web UI address bar; strip ? and # parts.
Lint CI pipelines for credentials in remote URLs.
Prefer SSH remotes for authenticated access.

When it happens

Trigger: Passing a remote like https://user:token@host/repo.git, an http(s) URL with any username, or a URL containing ?query or #fragment to validate_url, whether directly or via fetch_with_depth, push, symbolic_head, or ls_remote.

Common situations: Developers paste clone URLs copied from a cloud Git UI that embed a personal access token; CI config injects credentials into the remote URL; a stray ?ref= or #anchor is left in the URL from copying a web link.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/e42289ed3fc83b39. Report an issue: GitHub.