santifer/career-ops · error · Error

agentic-jobs: URL must use HTTPS: ${url}

Error message

agentic-jobs: URL must use HTTPS: ${url}

What it means

After parse, assertAgenticUrl() requires the protocol be exactly 'https:'. Non-https schemes are rejected as a transport-security / SSRF control for this server-side fetch. Fires for http://, ftp://, file://, data://, etc.

Source

Thrown at providers/agentic-jobs.mjs:47

// Wire in via a `job_boards:` entry with `provider: agentic-jobs`.

const SITE_ORIGIN = 'https://agentic-engineering-jobs.com';
const API_BASE = `${SITE_ORIGIN}/api/v1`;
const TRUSTED_HOST = 'agentic-engineering-jobs.com';
const PAGE_SIZE = 50; // fixed by the API (meta.per_page)
const MAX_PAGES = 40; // safety cap on request count (40*50 = 2000 postings)
const MAX_JOBS = 2000;
const PAGE_DELAY_MS = 2100; // stays under the documented 30 req/60s limit

/** @param {string} url */
function assertAgenticUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`agentic-jobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`agentic-jobs: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`agentic-jobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

const regionNames = new Intl.DisplayNames(['en'], { type: 'region' });

/**
 * Resolve a two-letter ISO country code to an English name. Returns '' for
 * anything that isn't a resolvable two-letter code. Exported for tests.
 * @param {unknown} code
 */
export function countryName(code) {
  if (typeof code !== 'string' || !/^[A-Za-z]{2}$/.test(code)) return '';
  try {
    const name = regionNames.of(code.toUpperCase());
    return name && name !== code.toUpperCase() ? name : '';

View on GitHub (pinned to 9b17a8ac97)

Solutions

  1. Switch the scheme to https — use 'https://agentic-engineering-jobs.com/api'.
  2. For a local non-https test mirror, mock fetchJson in tests rather than pointing the provider at http.

Example fix

// before
const API_BASE = 'http://agentic-engineering-jobs.com/api';

// after
const API_BASE = 'https://agentic-engineering-jobs.com/api';
Defensive patterns

Strategy: validation

Validate before calling

function isHttpsUrl(u) {
  try { return new URL(u).protocol === 'https:'; } catch { return false; }
}
if (!isHttpsUrl(API_BASE)) throw new Error('agentic-jobs API must be https');

Type guard

/** @param {unknown} u @returns {u is string} */
function isHttpsUrlString(u) {
  if (typeof u !== 'string') return false;
  try { return new URL(u).protocol === 'https:'; } catch { return false; }
}

Try / catch

try { assertAgenticUrl(url); } catch (err) {
  if (/must use HTTPS/.test(err.message)) console.error('agentic-jobs API must be https.');
  throw err;
}

Prevention

When it happens

Trigger: The agentic-jobs API URL uses http:// or another non-https scheme — typically API_BASE set to its http variant.

Common situations: API_BASE copied from an http bookmark; local http dev mirror used as the endpoint.

Related errors

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/03e704daa72434f4. Report an issue: GitHub.