santifer/career-ops · warning · Error

flowxtra: invalid URL: ${url}

Error message

flowxtra: invalid URL: ${url}

What it means

Thrown by flowxtra's assertFlowxtraEndpointUrl when new URL() cannot parse the value. Defense-in-depth: in fetch() the URL is always built from the JOBS_ENDPOINT constant ('https://app.flowxtra.com/api/central/jobs') plus a query string, so it is always well-formed and this branch is unreachable through normal use. Reachable only via a direct assertFlowxtraEndpointUrl call.

Source

Thrown at providers/flowxtra.mjs:31

// arbeitnow/echojobs/thehub, not a per-company provider: scan.mjs's own
// title/location filters narrow the result afterwards.
//
// Wire in via a `job_boards:` entry with `provider: flowxtra`.

const JOBS_ENDPOINT = 'https://app.flowxtra.com/api/central/jobs';
const TRUSTED_ENDPOINT_HOST = 'app.flowxtra.com';
const TRUSTED_APPLY_HOST = 'flowxtra.com';
const PER_PAGE = 100;
const DEFAULT_MAX_PAGES = 3;
const MAX_PAGES_CAP = 50;

/** @param {string} url */
function assertFlowxtraEndpointUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`flowxtra: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`flowxtra: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_ENDPOINT_HOST) {
    throw new Error(`flowxtra: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_ENDPOINT_HOST}`);
  }
  return url;
}

/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */
function resolveMaxPages(entry) {
  const v = entry?.max_pages;
  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);
  return DEFAULT_MAX_PAGES;
}

// NaN-safe Date.parse — `|| undefined` would also coerce a valid epoch 0.
function toEpochMs(value) {
  if (!value) return undefined;

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. For direct callers, validate the value parses as a URL before invoking the guard.
2. For normal fetch() use, no action — the constant-derived URL is always valid.
3. Treat a production hit as a signal the URL is no longer constant-derived.

Example fix

// before — direct call on raw input
assertFlowxtraEndpointUrl(maybeUrl);

// after — validate first
try { new URL(maybeUrl); } catch { /* not a URL, skip */ }

// Through fetch() unreachable (URL built from JOBS_ENDPOINT). For a direct call:
function isParseableUrl(u) { try { new URL(u); return true; } catch { return false; } }

function isParseableUrl(u) {
  if (typeof u !== 'string' || !u) return false;
  try { new URL(u); return true; } catch { return false; }
}

try { assertFlowxtraEndpointUrl(url); }
catch (e) {
  if (/^flowxtra: invalid URL/.test(e.message)) { /* input wasn't a URL — skip */ }
  else throw e;
}

When it happens

Trigger: assertFlowxtraEndpointUrl is called directly with a non-URL value. fetch() constructs the URL internally from a constant, so no entry config can produce this.

Common situations: A unit test or custom integration calling assertFlowxtraEndpointUrl on raw input. Production scans do not reach this branch.

Related errors

• flowxtra: URL must use HTTPS: ${url}
• comeet: invalid URL: ${redactToken(url)}
• comeet: URL must use HTTPS: ${redactToken(url)}
• comeet: untrusted hostname "${parsed.hostname}" — must be ${
• comeet: URL path must be the careers-api endpoint: ${redactT

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/cf1cb3d2899379f1. Report an issue: GitHub.