yamadashy/repomix · error · RepomixError

Invalid repository URL. Please provide a valid URL: ${redact

Error message

Invalid repository URL. Please provide a valid URL: ${redactUrl(url)}

What it means

For https:// URLs, validateGitUrl parses the URL with the WHATWG URL constructor; a parse failure means the URL is malformed and it is rejected with this error. The URL is redacted in the message to avoid leaking embedded credentials.

Source

Thrown at src/core/git/gitCommand.ts:247

export const validateGitUrl = (url: string): void => {
  // Block dangerous git parameters that could be used for command injection
  const dangerousParams = ['--upload-pack', '--receive-pack', '--config', '--exec'];
  if (dangerousParams.some((param) => url.includes(param))) {
    throw new RepomixError(`Invalid repository URL. URL contains potentially dangerous parameters: ${redactUrl(url)}`);
  }

  // Check if the URL starts with git@ or https://
  if (!(url.startsWith('git@') || url.startsWith('https://'))) {
    throw new RepomixError(`Invalid URL protocol for '${redactUrl(url)}'. URL must start with 'git@' or 'https://'`);
  }

  try {
    if (url.startsWith('https://')) {
      new URL(url);
    }
  } catch (error: unknown) {
    logger.trace('Invalid repository URL:', redactErrorMessage(error));
    throw new RepomixError(`Invalid repository URL. Please provide a valid URL: ${redactUrl(url)}`);
  }
};

/**
 * Validates a Git ref (branch, tag, or commit) before passing it to git commands.
 * A ref starting with '-' could be interpreted as a git option (e.g. --upload-pack),
 * enabling argument injection. Git's own refname rules also forbid leading '-',
 * so rejecting it is safe for all legitimate branches, tags, and SHAs.
 * @throws {RepomixError} If the ref could be interpreted as a command-line option
 */
export const validateGitRef = (ref: string): void => {
  if (ref.startsWith('-')) {
    throw new RepomixError(`Invalid branch or ref name. Name must not start with '-': ${ref}`);
  }
};

View on GitHub (pinned to f465ad9093)

Solutions

Validate the URL in a browser or `new URL(url)` in Node to see the exact parse failure.
Fix typos: ensure 'https://' with two slashes and a proper host, e.g. https://github.com/owner/repo.
Percent-encode illegal characters (spaces, non-ASCII) or remove them.
Check the variable/CI secret supplying the URL for truncation or whitespace.

Example fix

// before
repomix --remote "https:/github.com/owner/repo"

// after
repomix --remote "https://github.com/owner/repo"

Defensive patterns

Strategy: validation

Validate before calling

function assertParseableHttpsUrl(url: string): void {
  if (url.startsWith('https://')) {
    try { new URL(url); } catch (e) {
      throw new Error(`Malformed https URL: ${url} (${(e as Error).message})`);
    }
  }
}

Type guard

const isParseableHttpsUrl = (url: string): boolean => {
  if (!url.startsWith('https://')) return false;
  try { new URL(url); return true; } catch { return false; }
};

Try / catch

try {
  await repomix.pack({ input: { remote: url } });
} catch (e) {
  if (e instanceof Error && e.message.startsWith('Invalid repository URL. Please provide a valid URL:')) {
    console.error('Fix the https URL syntax — check slashes, host, port, and encoding.');
  } else throw e;
}

Prevention

Run `new URL(url)` (Node) on remote URLs before passing them to repomix.
Watch for classic typos: single slash (https:/), missing host, bad port.
Percent-encode spaces and non-ASCII characters in URLs.
Inspect CI variables/secrets supplying URLs for truncation or whitespace.

When it happens

Trigger: Passing an https:// URL that `new URL()` cannot parse — missing host (https:///path), spaces or illegal characters, malformed port (https://host:abc/), or a badly formed userinfo section.

Common situations: Typos like 'https:/github.com/owner/repo' (single slash), unencoded spaces from shell interpolation, credentials pasted with stray '@' or ':' characters, or truncated URLs from environment variables.

Related errors

AI-assisted analysis of yamadashy/repomix@f465ad9093 (2026-08-29). Data as JSON: /api/errors/85ff49eaaae2a059. Report an issue: GitHub.