Function baseUrlProblem

The rule for a configured base URL — every rule, so the CLI's --base-url parser keeps none of its own. Checked on the value as passed, before the trailing-slash strip, in this order:

• it parses as an absolute URL (so a blank value or a stray notaurl is refused with a message about the base URL, not an opaque "Invalid URL" that names a request path);

• its scheme is http: or https: (the default transport gates this per hop, but a custom transport may not, so a file:/ftp: base URL never reaches one);

• it has no query or fragment (request paths are appended to it as a string, so http://h/?x=1 would request /?x=1/app/... and http://h/#f would request /);

• it has no surrounding whitespace (new URL() trims silently, but the engine appends request paths to the raw string, so a trailing space would request /%20/app/... on the mirror);

• it holds no control character (C0, TAB included, DEL, C1): new URL() drops an inner TAB, LF or CR silently, so /p\nX requested /pX, and an echo of the value would carry ESC to a terminal. One a path or password needs is written percent-encoded (%09).

• a % in its userinfo starts a valid escape (%25 for a literal one): Node decodes the userinfo into the Authorization header and would otherwise fail every request with "URI malformed".

Userinfo (https://user:pw@mirror) is allowed and sent as Basic auth. No reason echoes the value, so a credential in it never reaches an error message.