router-for-me/CLIProxyAPI · error

direct plugin sync artifact %d must use https

Error message

direct plugin sync artifact %d must use https

What it means

For a direct-install manifest, artifact number N (0-based) has a URL that either failed url.Parse or whose scheme is not https (case-insensitive check). The sync protocol requires HTTPS for all pinned artifact downloads to prevent tampering in transit.

Source

Thrown at internal/pluginstore/home_sync.go:94

				return fmt.Errorf("plugin sync item %d auth %d: %w", index, authIndex, errAuth)
			}
		}
	}
	return nil
}

func validatePluginSyncManifestURLs(manifest Manifest) error {
	if manifest.InstallType() != InstallTypeDirect {
		return nil
	}
	plan := NormalizeInstallPlan(manifest.Install)
	if len(plan.Artifacts) == 0 {
		return fmt.Errorf("direct plugin sync manifest requires pinned artifacts")
	}
	for index, artifact := range plan.Artifacts {
		parsed, errParse := url.Parse(strings.TrimSpace(artifact.URL))
		if errParse != nil || !strings.EqualFold(parsed.Scheme, "https") {
			return fmt.Errorf("direct plugin sync artifact %d must use https", index)
		}
	}
	return nil
}

func (r *PluginSyncResponse) Clear() {
	if r == nil {
		return
	}
	for index := range r.Items {
		r.Items[index].Clear()
	}
	r.Items = nil
	r.ExpiresAt = time.Time{}
	r.SchemaVersion = 0
}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Change the artifact URL to https://
2. Put the plain-HTTP mirror behind TLS (or a self-signed CA added to system trust, still served as https)
3. Fix malformed URLs — verify with url.Parse before publishing the manifest

Example fix

// before
{"url":"http://artifacts.internal/p_1.0.0_linux_amd64.zip"}

// after
{"url":"https://artifacts.internal/p_1.0.0_linux_amd64.zip"}

for k, a := range plan.Artifacts {
    u, e := url.Parse(strings.TrimSpace(a.URL))
    if e != nil || !strings.EqualFold(u.Scheme, "https") {
        return fmt.Errorf("artifact %d not https: %s", k, a.URL)
    }
}

if err != nil && strings.Contains(err.Error(), "must use https") {
    // block install, surface the offending URL for correction
}

When it happens

Trigger: Validate on a direct manifest where an artifact URL is http://, has no scheme (bare host/path), or contains characters that make url.Parse fail.

Common situations: Internal HTTP mirror used for artifact hosting; URL missing the scheme after a copy-paste; trailing whitespace/control characters breaking the parse.

Related errors

• invalid auth file name
• plugin sync item %d: %w
• plugin sync response contains duplicate plugin %q
• direct plugin sync manifest requires pinned artifacts
• unsupported install type %q

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/9c9e39faac532a72. Report an issue: GitHub.