santifer/career-ops · warning · Error

echojobs: invalid URL: ${url}

Error message

echojobs: invalid URL: ${url}

What it means

Thrown by echojobs' assertEchojobsUrl when new URL() cannot parse the value. It is defense-in-depth: in the shipped fetch() the URL is always built from the FEED_BASE constant ('https://echojobs.io/api/jobs') plus a query string, so it is always well-formed and this branch is unreachable through normal use. Reachable only via a direct assertEchojobsUrl call (e.g. a unit test or custom integration).

Source

Thrown at providers/echojobs.mjs:28

// Each row's `url` is the ORIGINAL ATS posting (e.g. jobs.ashbyhq.com/…), so —
// unlike the feed host — job URLs are not pinned to echojobs.io; only the feed
// fetch is host-locked. The url is display-only and never server-fetched here.
//
// Wire in via a `job_boards:` entry with `provider: echojobs`.

const FEED_BASE = 'https://echojobs.io/api/jobs';
const TRUSTED_HOST = 'echojobs.io';
const PER_PAGE = 100;
const DEFAULT_MAX_PAGES = 3;
const MAX_PAGES_CAP = 50;

/** @param {string} url */
function assertEchojobsUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`echojobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`echojobs: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`echojobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */
function resolveMaxPages(entry) {
  const v = entry?.max_pages;
  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);
  return DEFAULT_MAX_PAGES;
}

// Guards against a doubled marker when the board already spells the work model
// into the location itself ("Berlin (Hybrid)", "Hybrid - London").
const HYBRID_MARKER = /\bhybrid\b/i;

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. For direct callers, validate the value parses as a URL before invoking assertEchojobsUrl.
2. For normal fetch() use, no action is needed — the constant-derived URL is always valid.
3. Treat a production hit as a signal that the URL is no longer constant-derived (a refactor).

Example fix

// before — direct call on raw input
assertEchojobsUrl(maybeUrl);

// after — validate first
try { new URL(maybeUrl); } catch { /* not a URL, skip */ }

// Through fetch() this is unreachable (URL built from FEED_BASE). For a direct assertEchojobsUrl call:
function isParseableUrl(u) { try { new URL(u); return true; } catch { return false; } }

function isParseableUrl(u) {
  if (typeof u !== 'string' || !u) return false;
  try { new URL(u); return true; } catch { return false; }
}

// Only relevant for direct assertEchojobsUrl callers.
try { assertEchojobsUrl(url); }
catch (e) {
  if (/^echojobs: invalid URL/.test(e.message)) { /* input wasn't a URL — skip */ }
  else throw e;
}

When it happens

Trigger: assertEchojobsUrl is called directly with a non-URL value. fetch() constructs the URL internally from a constant, so no entry config can produce this.

Common situations: A unit test asserting the guard on malformed input; a fork or custom integration that sources the URL from elsewhere. Production scans do not reach this branch.

Related errors

• echojobs: URL must use HTTPS: ${url}
• echojobs: untrusted hostname "${parsed.hostname}" — must be
• comeet: invalid URL: ${redactToken(url)}
• comeet: URL must use HTTPS: ${redactToken(url)}
• comeet: untrusted hostname "${parsed.hostname}" — must be ${

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/408da98668fd297a. Report an issue: GitHub.