santifer/career-ops · error · Error

4dayweek: URL must use HTTPS: ${url}

Error message

4dayweek: URL must use HTTPS: ${url}

What it means

Same allowlist guard as error 51, one check later: the URL parses, but its protocol is not 'https:'. The 4dayweek provider only accepts HTTPS to prevent sending requests or leaking context over plaintext HTTP.

Source

Thrown at providers/4dayweek.mjs:55

      if (parsed.protocol === 'https:' && parsed.hostname === TRUSTED_HOST) {
        return { url: FEED_BASE };
      }
    } catch {
      // Ignore malformed URLs; another provider may still claim the entry.
    }
  }
  return null;
}

/** @param {string} url */
function assertFourDayUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`4dayweek: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`4dayweek: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`4dayweek: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */
function resolveMaxPages(entry) {
  const v = entry?.max_pages;
  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);
  return DEFAULT_MAX_PAGES;
}

// NaN-safe: posted is epoch SECONDS → ms; anything non-finite yields undefined.
function toEpochMs(seconds) {
  return Number.isFinite(seconds) ? seconds * 1000 : undefined;
}

View on GitHub (pinned to 1696bec4d0)

Solutions

1. Change the URL scheme to https:// in the config/entry it came from.
2. If the source is a site that serves http only, do not downgrade the check — the target must be reachable over HTTPS.
3. Search your portals.yml/feed entries for 'http://' and fix them to 'https://'.

Example fix

// before
assertFourDayUrl('http://4dayweek.io/job/9');
// after
assertFourDayUrl('https://4dayweek.io/job/9');

function isHttpsUrl(url) {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}
if (!isHttpsUrl(entry.url)) entry.url = entry.url.replace(/^http:/, 'https:');

function isHttpsUrl(v) {
  if (typeof v !== 'string') return false;
  try { return new URL(v).protocol === 'https:'; } catch { return false; }
}

try {
  provider.check(url);
} catch (err) {
  if (err.message.startsWith('4dayweek: URL must use HTTPS')) {
    console.warn(`Upgrading to HTTPS: ${url}`);
    return provider.check(url.replace(/^http:/, 'https:'));
  }
  throw err;
}

When it happens

Trigger: Passing a parseable URL whose scheme is http:, ftp:, file:, or anything non-https to assertFourDayUrl — e.g. 'http://4dayweek.io/job/1' or a file:// URL from a local config.

Common situations: Older config entries written before the provider enforced HTTPS; manually typed http:// URLs; URLs built by string concatenation that defaults to http; redirects not involved here — this fires before any request is made.

Related errors

• a16z-speedrun-talent: URL must use HTTPS: ${url}
• rippling: URL must use HTTPS: ${url}
• 4dayweek: invalid URL: ${url}
• a16z-speedrun-talent: invalid URL: ${url}
• breezy: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@1696bec4d0 (2026-09-01). Data as JSON: /api/errors/c704aee728af0a80. Report an issue: GitHub.