abhigyanpatwari/GitNexus · error · Error

--allow-insecure-connection / GITNEXUS_ALLOW_INSECURE_CONNEC

Error message

--allow-insecure-connection / GITNEXUS_ALLOW_INSECURE_CONNECTION entries must be exact hostnames or IP addresses

What it means

Entries passed via `--allow-insecure-connection <host>` or GITNEXUS_ALLOW_INSECURE_CONNECTION must be bare hostnames or IP addresses so they can be compared against URL.hostname. normalizeAllowedInsecureHttpHost rejects empty entries, anything containing '/', '@', '?', or '#' (schemes, paths, userinfo), malformed bracketed IPv6 like '[::1' or 'a[b]c', and 'host:port' values (URL.hostname never contains the port, so a port would create a silent no-op entry). The check runs while parsing the comma-separated list, before any request is made.

Source

Thrown at gitnexus/src/core/wiki/llm-client.ts:188

function formatTimeoutDuration(timeoutMs: number): string {
  if (timeoutMs >= 1000 && timeoutMs % 1000 === 0) {
    return `${timeoutMs / 1000}s`;
  }
  return `${timeoutMs}ms`;
}

function isTimeoutLikeError(err: unknown): boolean {
  if (!(err instanceof Error)) return false;
  if (err.name === 'TimeoutError' || err.name === 'AbortError') return true;
  return /time(d)?\s*out|timeout/i.test(err.message);
}

export const LLM_ALLOW_INSECURE_CONNECTION_ENV = 'GITNEXUS_ALLOW_INSECURE_CONNECTION';

function normalizeAllowedInsecureHttpHost(host: string): string {
  const trimmed = host.trim().toLowerCase();
  const fail = () => {
    throw new Error(
      `--allow-insecure-connection / ${LLM_ALLOW_INSECURE_CONNECTION_ENV} entries must be exact hostnames or IP addresses`,
    );
  };
  if (!trimmed || /[/@?#]/.test(trimmed)) fail();

  if (trimmed.startsWith('[')) {
    if (!trimmed.endsWith(']')) fail();
    const normalized = trimmed.slice(1, -1);
    if (!normalized || /[\[\]]/.test(normalized)) fail();
    return normalized;
  }

  if (/[\[\]]/.test(trimmed)) fail();
  if ((trimmed.match(/:/g)?.length ?? 0) === 1) {
    // URL.hostname never includes the port, so accepting "host:port" would
    // create a confusing no-op allowlist entry.
    fail();
  }

View on GitHub (pinned to aac7515d2a)

Solutions

1. Pass only the hostname/IP: `--allow-insecure-connection 192.168.1.10` (no scheme, path, or port)
2. For IPv6 use the bare or bracketed literal: `--allow-insecure-connection '[::1]'` or `::1`
3. Check the env var value for trailing commas/empty segments: GITNEXUS_ALLOW_INSECURE_CONNECTION=host1,host2
4. Prefer switching the endpoint to https:// so no allowlist entry is needed at all

Example fix

# before
gitnexus wiki --provider custom --base-url http://192.168.1.10:8080/v1 --allow-insecure-connection http://192.168.1.10:8080

# after
gitnexus wiki --provider custom --base-url http://192.168.1.10:8080/v1 --allow-insecure-connection 192.168.1.10

const HOST_RE = /^[a-z0-9._-]+$/i; // or IPv6 literal
function isValidInsecureHost(entry: string): boolean {
  const t = entry.trim().toLowerCase();
  if (!t || /[/@?#]/.test(t)) return false;
  if (t.startsWith('[')) return /^\[[0-9a-f:]+\]$/i.test(t);
  if (/[\[\]]/.test(t)) return false;
  return (t.match(/:/g)?.length ?? 0) !== 1; // reject host:port
}
const hosts = raw.split(',').filter(isValidInsecureHost); // validate before passing

function isValidInsecureHost(entry: string): boolean {
  const t = entry.trim().toLowerCase();
  if (!t || /[/@?#]/.test(t)) return false;
  if (t.startsWith('[')) return /^\[[0-9a-f:]+\]$/i.test(t);
  if (/[\[\]]/.test(t)) return false;
  return (t.match(/:/g)?.length ?? 0) !== 1;
}

try {
  parseLLMAllowedInsecureHttpHosts(envValue);
} catch (err) {
  if (err instanceof Error && err.message.includes('exact hostnames or IP addresses')) {
    // strip scheme/port from each entry and retry: new URL(entry).hostname
  }
}

When it happens

Trigger: Passing a full URL fragment such as `--allow-insecure-connection http://192.168.1.10:8080` or `llm.lan/v1`; adding a port (`myhost:11434`); an empty item from a trailing/doubled comma in GITNEXUS_ALLOW_INSECURE_CONNECTION; a half-typed IPv6 literal `[::1`. Note bare multi-colon IPv6 like `::1` is accepted.

Common situations: Copy-pasting the base URL into the allowlist flag instead of just its host; users assuming the flag takes a URL; environment variables assembled by scripts that leave empty fields; trying to scope the exception to a port (unsupported — the exception is per host).

Related errors

• Insecure http:// LLM base URLs are only allowed for localhos
• Invalid LLM base URL: must be a well-formed http:// or https
• LLM request timed out after ${formatTimeoutDuration(config.r
• ${name} must be a positive integer, got "${raw}"
• ${name} must be a positive integer <= ${max}, got "${raw}"

AI-assisted analysis of abhigyanpatwari/GitNexus@aac7515d2a (2026-08-20). Data as JSON: /api/errors/72e2ad43f5001645. Report an issue: GitHub.