zeroclaw-labs/zeroclaw · error

Only http:// or https:// URLs are allowed

Error message

Only http:// or https:// URLs are allowed

What it means

browser_open only accepts URLs that literally start with https:// or http:// — a case-sensitive, byte-exact prefix check after trimming. There is no scheme parsing or defaulting: protocol-relative URLs (//example.com), uppercase schemes (HTTPS://), and bare hostnames all fail here, before any allowlist logic runs.

Source

Thrown at crates/zeroclaw-tools/src/browser_open.rs:55

                allowed_private_hosts,
                "browser.allowed_private_hosts",
            )?,
        })
    }

    fn validate_url(&self, raw_url: &str) -> anyhow::Result<String> {
        let url = raw_url.trim();

        if url.is_empty() {
            anyhow::bail!("URL cannot be empty");
        }

        if url.chars().any(char::is_whitespace) {
            anyhow::bail!("URL cannot contain whitespace");
        }

        if !(url.starts_with("https://") || url.starts_with("http://")) {
            anyhow::bail!("Only http:// or https:// URLs are allowed");
        }

        if self.allowed_domains.is_empty() && self.allowed_private_hosts.is_empty() {
            anyhow::bail!(
                "Browser tool is enabled but no allowed_domains are configured. Add [browser].allowed_domains in config.toml"
            );
        }

        let host = extract_host(url)?;
        let private_host = domain_guard::is_private_or_local_host(&host);
        let private_host_allowed = private_host
            && domain_guard::host_matches_allowlist(&host, &self.allowed_private_hosts);

        if private_host && !private_host_allowed {
            anyhow::bail!("Blocked local/private host: {host}");
        }

        if private_host_allowed {

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Always prefix the scheme in lowercase: https://example.com
2. Normalize scheme and host to lowercase before calling
3. When accepting human-typed input, default a missing scheme to https:// at your call site

Example fix

// before
{"url": "example.com"}
// after
{"url": "https://example.com"}

let u = raw_url.trim();
if !(u.starts_with("https://") || u.starts_with("http://")) {
    return Err("URL must start with http:// or https:// (lowercase)".into());
}

match open_tool.execute(args).await {
    Ok(res) if res.success => { /* ... */ }
    Ok(res) => {
        if res.error.as_deref().unwrap_or_default().contains("Only http:// or https://") {
            // add a lowercase scheme prefix and retry
        }
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: url="example.com", url="//example.com", or url="HTTPS://example.com" — the starts_with comparison never matches these.

Common situations: Users passing bare domains the way they type them into a browser address bar; markdown links using protocol-relative forms; code that uppercases URLs for logging and then reuses the uppercased copy.

Related errors

• Custom model_provider `{prefix}:<url>` requires a URL beginn
• OpenAI Codex endpoint override must use http:// or https://
• unsupported URL scheme: {}
• URL cannot be empty
• URL cannot contain whitespace

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/950532a69f9fbcf4. Report an issue: GitHub.