santifer/career-ops · error · Error

agentic-jobs: untrusted hostname

Error message

agentic-jobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}

What it means

assertAgenticUrl validates every URL the agentic-jobs provider will request as an SSRF guard: it must parse, be HTTPS, and its hostname must equal the hardcoded TRUSTED_HOST ('agentic-engineering-jobs.com'). This throw fires when a URL pointing at a different host is about to be fetched, refusing to follow a redirect or a misconfigured base to an arbitrary server. In practice the provider builds all URLs from API_BASE internally, so hitting this means something substituted a foreign URL into the fetch path.

Solutions

Use the built-in provider unchanged — it constructs URLs from API_BASE itself; do not pass custom URLs into assertAgenticUrl.
If testing, stub ctx.fetchJson rather than pointing the validator at a local host, or inject the mock at the fetch layer.
If you intentionally need a different endpoint (mirror/proxy), edit TRUSTED_HOST/API_BASE in providers/agentic-jobs.mjs deliberately — never bypass the check by catching and proceeding.
Check the URL that reached the validator: if it's a redirect target, the provider uses redirect:'error' by design; do not feed redirects back through assertAgenticUrl.

Example fix

// before (test)
const url = 'http://localhost:3000/api/v1/jobs?page=1';
assertAgenticUrl(url); // throws: untrusted hostname
// after (stub at the fetch layer instead)
const ctx = { fetchJson: async () => ({ data: [], meta: { total: 0, per_page: 50 } }) };
await provider.fetch(entry, ctx);

Defensive patterns

Strategy: validation

Validate before calling

const u = new URL(candidateUrl);
if (u.protocol !== 'https:' || u.hostname !== 'agentic-engineering-jobs.com') {
  throw new Error(`refusing to fetch untrusted URL: ${candidateUrl}`);
}

Type guard

function isTrustedAgenticUrl(url) {
  try { const u = new URL(url); return u.protocol === 'https:' && u.hostname === 'agentic-engineering-jobs.com'; }
  catch { return false; }
}

Try / catch

try {
  await provider.fetch(entry, ctx);
} catch (err) {
  if (String(err.message).includes('untrusted hostname')) {
    console.error('URL was redirected/overridden away from the trusted host — check API_BASE overrides and test stubs');
  }
  throw err;
}

Prevention

Never override API_BASE or pass external URLs into the provider's URL validator.
Stub ctx.fetchJson in tests instead of pointing the provider at localhost.
Treat this error as a security signal: something redirected or rewrote the target host — investigate rather than bypassing.

When it happens

Trigger: assertAgenticUrl is called with a URL whose hostname differs from agentic-engineering-jobs.com — e.g. http-vs-https variants were rejected earlier, so this is a genuinely different host: an overridden API_BASE, a test passing a mock URL like https://localhost/api/v1/jobs, or a redirect target that was passed back through the validator instead of following the redirect.

Common situations: Test harnesses stubbing the API with a local server URL; forks or patches pointing API_BASE at a mirror or proxy; someone wiring a custom portal entry whose URL the provider re-validates; DNS/hosts-file tricks that don't apply here because validation is on the hostname string, not resolution.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of santifer/career-ops@aac998c7ed (2026-09-16). Data as JSON: /api/errors/501a10bd3be7336a. Report an issue: GitHub.

Appendix: source

Thrown at providers/agentic-jobs.mjs:49

const SITE_ORIGIN = 'https://agentic-engineering-jobs.com';
const API_BASE = `${SITE_ORIGIN}/api/v1`;
const TRUSTED_HOST = 'agentic-engineering-jobs.com';
const PAGE_SIZE = 50; // fixed by the API (meta.per_page)
const MAX_PAGES = 40; // safety cap on request count (40*50 = 2000 postings)
const MAX_JOBS = 2000;
const PAGE_DELAY_MS = 2100; // stays under the documented 30 req/60s limit

/** @param {string} url */
function assertAgenticUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`agentic-jobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`agentic-jobs: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`agentic-jobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

const regionNames = new Intl.DisplayNames(['en'], { type: 'region' });

/**
 * Resolve a two-letter ISO country code to an English name. Returns '' for
 * anything that isn't a resolvable two-letter code. Exported for tests.
 * @param {unknown} code
 */
export function countryName(code) {
  if (typeof code !== 'string' || !/^[A-Za-z]{2}$/.test(code)) return '';
  try {
    const name = regionNames.of(code.toUpperCase());
    return name && name !== code.toUpperCase() ? name : '';
  } catch {
    return '';

View on GitHub (pinned to aac998c7ed)