yamadashy/repomix · error · RepomixError

Invalid URL protocol for '${redactUrl(url)}'. URL must start

Error message

Invalid URL protocol for '${redactUrl(url)}'. URL must start with 'git@' or 'https://'

What it means

validateGitUrl only accepts URLs starting with 'git@' (SSH) or 'https://'. Any other protocol (http://, ssh://, file://, git://, plain paths) is rejected with this error to keep remote operations safe and predictable.

Source

Thrown at src/core/git/gitCommand.ts:238

    logger.trace('Failed to execute git log:', (error as Error).message);
    throw error;
  }
};

/**
 * Validates a Git URL for security and format
 * @throws {RepomixError} If the URL is invalid or contains potentially dangerous parameters
 */
export const validateGitUrl = (url: string): void => {
  // Block dangerous git parameters that could be used for command injection
  const dangerousParams = ['--upload-pack', '--receive-pack', '--config', '--exec'];
  if (dangerousParams.some((param) => url.includes(param))) {
    throw new RepomixError(`Invalid repository URL. URL contains potentially dangerous parameters: ${redactUrl(url)}`);
  }

  // Check if the URL starts with git@ or https://
  if (!(url.startsWith('git@') || url.startsWith('https://'))) {
    throw new RepomixError(`Invalid URL protocol for '${redactUrl(url)}'. URL must start with 'git@' or 'https://'`);
  }

  try {
    if (url.startsWith('https://')) {
      new URL(url);
    }
  } catch (error: unknown) {
    logger.trace('Invalid repository URL:', redactErrorMessage(error));
    throw new RepomixError(`Invalid repository URL. Please provide a valid URL: ${redactUrl(url)}`);
  }
};

/**
 * Validates a Git ref (branch, tag, or commit) before passing it to git commands.
 * A ref starting with '-' could be interpreted as a git option (e.g. --upload-pack),
 * enabling argument injection. Git's own refname rules also forbid leading '-',
 * so rejecting it is safe for all legitimate branches, tags, and SHAs.
 * @throws {RepomixError} If the ref could be interpreted as a command-line option

View on GitHub (pinned to f465ad9093)

Solutions

1. Switch the URL to https://, e.g. https://github.com/owner/repo.git.
2. Convert ssh:// URLs to the scp-like git@host:path form, e.g. git@github.com:owner/repo.git.
3. For http-only internal servers, use https if available or clone manually and run repomix on the local path.
4. Trim stray characters/whitespace before the URL so it truly starts with an accepted prefix.

Example fix

// before
repomix --remote http://github.com/owner/repo

// after
repomix --remote https://github.com/owner/repo

function assertRemoteUrlProtocol(url: string): void {
  if (!(url.startsWith('git@') || url.startsWith('https://'))) {
    throw new Error(`Unsupported URL protocol: ${url}. Use git@ or https:// form.`);
  }
}

const isAcceptedGitUrl = (url: string): boolean =>
  url.startsWith('git@') || url.startsWith('https://');

try {
  await repomix.pack({ input: { remote: url } });
} catch (e) {
  if (e instanceof Error && e.message.includes("URL must start with 'git@' or 'https://'")) {
    console.error('Convert the URL: use https://... or git@host:path form.');
  } else throw e;
}

When it happens

Trigger: Calling execLsRemote, execLsRemoteHead, or execGitShallowClone with a URL that does not begin with 'git@' or 'https://' — e.g. `http://github.com/owner/repo`, `ssh://git@...`, or a local path.

Common situations: Using old http:// links, org-hosted SSH URLs in ssh:// form, internal GitLab servers on http, or accidentally passing a local directory path to --remote.

Related errors

• Invalid repository URL. Please provide a valid URL: ${redact
• Git is not installed or not in the system PATH.
• Invalid repository URL. URL contains potentially dangerous p
• Refusing to access ${host}: it is a cloud instance metadata
• Failed to get remote refs: ${redactErrorMessage(error)}

AI-assisted analysis of yamadashy/repomix@f465ad9093 (2026-08-29). Data as JSON: /api/errors/650926a5d9dcf198. Report an issue: GitHub.