router-for-me/CLIProxyAPI · error

source-url must use http or https

Error message

source-url must use http or https

What it means

validateManifestSourceURL() accepts only http and https schemes. A URL that parses fine and has a host but uses file://, git+ssh://, ftp://, etc. is rejected because the pluginstore fetches provenance over HTTP(S) only.

Source

Thrown at internal/pluginstore/manifest.go:187

		return fmt.Errorf("missing required field id")
	}
	if !validPluginID(id) {
		return fmt.Errorf("invalid plugin id %q", id)
	}
	return nil
}

func validateManifestSourceURL(sourceURL string) error {
	sourceURL = strings.TrimSpace(sourceURL)
	if sourceURL == "" {
		return fmt.Errorf("missing required field source-url")
	}
	parsed, errParse := url.Parse(sourceURL)
	if errParse != nil || parsed.Scheme == "" || parsed.Host == "" {
		return fmt.Errorf("invalid source-url")
	}
	if parsed.Scheme != "https" && parsed.Scheme != "http" {
		return fmt.Errorf("source-url must use http or https")
	}
	if hasSensitiveQueryParameter(parsed) {
		return fmt.Errorf("source-url contains sensitive query parameter")
	}
	return nil
}

View on GitHub (pinned to 78f0c4079e)

Solutions

  1. Use the HTTPS web URL of the repository/page: https://github.com/acme/plug
  2. For local development, serve the source over a local http server or accept using the real upstream URL
  3. Check for typos like "htps://" which can masquerade as unsupported schemes

Example fix

# before
source-url: file:///srv/plug-src
# source-url must use http or https

# after
source-url: https://github.com/acme/plug
Defensive patterns

Strategy: validation

Validate before calling

u, err := url.Parse(strings.TrimSpace(m.SourceURL))
if err != nil || u.Scheme == "" || u.Host == "" || (u.Scheme != "https" && u.Scheme != "http") {
    return errors.New("source-url must be http(s)")
}
_ = m.Validate()

Type guard

func httpSourceURL(raw string) bool { u, err := url.Parse(strings.TrimSpace(raw)); return err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Host != "" }

Try / catch

if err := m.Validate(); err != nil && strings.Contains(err.Error(), "must use http or https") { /* replace file:// or ssh:// with the https web URL */ }

Prevention

When it happens

Trigger: source-url: "file:///srv/plug"; "git@github.com:acme/plug.git" (parsed scheme is ssh-ish/empty — typically caught by 691, but scp-like strings with a scheme like "ssh://git@github.com/acme/plug" land here); "ftp://mirror/plug".

Common situations: Local development manifests pointing at a file path; developers pasting the SSH clone URL instead of the HTTPS web URL; internal git-scheme URIs from documentation.

Related errors

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/2bd4c1177a2f8a01. Report an issue: GitHub.