santifer/career-ops · error · Error

H1B_API_BASE is set but empty. Unset it to use the default e

Error message

H1B_API_BASE is set but empty. Unset it to use the default endpoint.

What it means

resolveBase() reads the H1B_API_BASE environment variable to allow replacing the default API endpoint. An unset variable falls back to DEFAULT_BASE, but a variable that is set to an empty/whitespace-only string is rejected: the comment explains that silently falling back could send someone's shortlist and token to a host they believed they had replaced — i.e. an empty value most likely means an override failed to populate, and guessing would be dangerous.

Source

Thrown at plugins/h1b-sponsor/lib/api.mjs:43

let resolvedBase;

export function apiBase() {
  // Only a successful resolve is memoized; a bad value keeps throwing so the
  // failure cannot be masked by an earlier call that happened to succeed.
  if (resolvedBase === undefined) resolvedBase = resolveBase();
  return resolvedBase;
}

function resolveBase() {
  const raw = process.env.H1B_API_BASE;
  // Absent means "use the default". Present but blank is a misconfiguration
  // (an unset shell variable, an empty .env line, a CI secret that did not
  // populate), and silently falling back would send someone's shortlist and
  // their token to a host they believed they had replaced.
  if (raw === undefined) return DEFAULT_BASE;
  const trimmed = String(raw).trim();
  if (!trimmed) {
    throw new Error('H1B_API_BASE is set but empty. Unset it to use the default endpoint.');
  }

  let parsed;
  try {
    parsed = new URL(trimmed);
  } catch {
    throw new Error(`H1B_API_BASE is not a valid URL: ${trimmed}`);
  }
  if (parsed.username || parsed.password) {
    // Undici refuses a credentialed Request anyway, and the value reaches
    // stdout through the source field, so this would print a password.
    throw new Error('H1B_API_BASE must not embed credentials.');
  }
  if (parsed.search || parsed.hash) {
    // Paths are appended, so a query or fragment swallows them: the request
    // would go to the base itself and answer about a company never asked for.
    throw new Error('H1B_API_BASE must not contain a query string or a fragment.');
  }

View on GitHub (pinned to 1696bec4d0)

Solutions

Unset the variable entirely (unset H1B_API_BASE / delete the .env line) so the default endpoint is used.
If you meant to override the endpoint, set it to the full URL, e.g. export H1B_API_BASE=https://your-host.example.com.
In CI, fix the secret/variable reference so it actually populates, or remove the env entry.
Grep your .env, shell rc, and deployment manifests for 'H1B_API_BASE=' with no value.

Example fix

// before (.env)
H1B_API_BASE=
// after (.env)
H1B_API_BASE=https://h1b-api.internal.example.com
// or simply remove the line to use the default endpoint

Defensive patterns

Strategy: validation

Validate before calling

const raw = process.env.H1B_API_BASE;
if (raw !== undefined && !raw.trim()) {
  throw new Error('H1B_API_BASE is set but empty — unset it (unset H1B_API_BASE) or set a full URL');
}

Type guard

function hasValidBaseOverride(env = process.env) {
  const raw = env.H1B_API_BASE;
  if (raw === undefined) return true; // default endpoint
  if (!String(raw).trim()) return false;
  try { new URL(String(raw).trim()); return true; } catch { return false; }
}

Try / catch

try {
  await installH1BIndex();
} catch (e) {
  if (String(e.message).includes('H1B_API_BASE is set but empty')) {
    console.error('Fix your environment: either unset H1B_API_BASE or provide a full https:// URL.');
  } else throw e;
}

Prevention

Prefer unset over setting an empty string in .env files and shell scripts.
In CI, verify the secret actually populates before jobs that call the plugin.
Grep .env / rc files / manifests for 'H1B_API_BASE=' with no value during setup.
Validate env overrides at script startup so failures surface before any install runs.

When it happens

Trigger: resolveBase() is called during plugin init/API client construction while process.env.H1B_API_BASE is defined (present in the environment, .env file, or CI secret store) but trims to an empty string; raw !== undefined but !trimmed.

Common situations: A .env line like 'H1B_API_BASE=' left behind after removing a value; a CI/CD secret (GitHub Actions secret, Docker env) referenced but never populated, injecting an empty string; a shell script doing H1B_API_BASE= instead of unset H1B_API_BASE; a compose/k8s env entry with a missing ConfigMap value.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of santifer/career-ops@1696bec4d0 (2026-09-01). Data as JSON: /api/errors/9060d962eb973d07. Report an issue: GitHub.