abhigyanpatwari/GitNexus · warning · Error

--allow-insecure-connection / ${LLM_ALLOW_INSECURE_CONNECTIO

Error message

--allow-insecure-connection / ${LLM_ALLOW_INSECURE_CONNECTION_ENV} entries must be exact hostnames or IP addresses

What it means

Thrown by `normalizeAllowedInsecureHttpHost` when parsing an entry from the `GITNEXUS_ALLOW_INSECURE_CONNECTION` env var (or `--allow-insecure-connection` flag) that is not a valid bare hostname or IP address. Entries must be exact hostnames or address literals — no path separators (`/@?#`), no port suffixes (`host:port` creates a confusing no-op since URL.hostname excludes ports), no mismatched or stray brackets. IPv6 literals may be wrapped in `[...]` but the inner value must be a clean address.

Source

Thrown at gitnexus/src/core/wiki/llm-client.ts:188

function formatTimeoutDuration(timeoutMs: number): string {
  if (timeoutMs >= 1000 && timeoutMs % 1000 === 0) {
    return `${timeoutMs / 1000}s`;
  }
  return `${timeoutMs}ms`;
}

function isTimeoutLikeError(err: unknown): boolean {
  if (!(err instanceof Error)) return false;
  if (err.name === 'TimeoutError' || err.name === 'AbortError') return true;
  return /time(d)?\s*out|timeout/i.test(err.message);
}

export const LLM_ALLOW_INSECURE_CONNECTION_ENV = 'GITNEXUS_ALLOW_INSECURE_CONNECTION';

function normalizeAllowedInsecureHttpHost(host: string): string {
  const trimmed = host.trim().toLowerCase();
  const fail = () => {
    throw new Error(
      `--allow-insecure-connection / ${LLM_ALLOW_INSECURE_CONNECTION_ENV} entries must be exact hostnames or IP addresses`,
    );
  };
  if (!trimmed || /[/@?#]/.test(trimmed)) fail();

  if (trimmed.startsWith('[')) {
    if (!trimmed.endsWith(']')) fail();
    const normalized = trimmed.slice(1, -1);
    if (!normalized || /[\[\]]/.test(normalized)) fail();
    return normalized;
  }

  if (/[\[\]]/.test(trimmed)) fail();
  if ((trimmed.match(/:/g)?.length ?? 0) === 1) {
    // URL.hostname never includes the port, so accepting "host:port" would
    // create a confusing no-op allowlist entry.
    fail();
  }

View on GitHub (pinned to d540b00184)

Solutions

1. Use bare hostnames only: `host.example.com`, `192.168.1.10`, or `[::1]` for IPv6.
2. Remove port suffixes — the allowlist matches the hostname regardless of port.
3. Remove scheme prefixes (`http://`, `https://`) — the entries are hostnames, not URLs.
4. Separate multiple hosts with commas: `host1.com,host2.com,192.168.1.10`.

Example fix

# before
export GITNEXUS_ALLOW_INSECURE_CONNECTION=host.lan:8080,http://other.lan
gitnexus analyze
# error: ...entries must be exact hostnames or IP addresses
# after
export GITNEXUS_ALLOW_INSECURE_CONNECTION=host.lan,other.lan
gitnexus analyze

// Validate allowlist entries before passing them to the LLM client:
import { parseLLMAllowedInsecureHttpHosts } from './wiki/llm-client.js';
try {
  parseLLMAllowedInsecureHttpHosts(process.env.GITNEXUS_ALLOW_INSECURE_CONNECTION);
} catch (err) {
  console.error('Invalid insecure-connection allowlist entry:', (err as Error).message);
  process.exit(1);
}

// A simple guard: entries must be bare hostnames without scheme, path, or port
const isValidInsecureHost = (host: string): boolean => {
  const trimmed = host.trim().toLowerCase();
  if (!trimmed || /[/@?#]/.test(trimmed)) return false;
  if (trimmed.includes('://')) return false;
  if ((trimmed.match(/:/g)?.length ?? 0) === 1) return false; // host:port
  return true;
};

try {
  parseLLMAllowedInsecureHttpHosts(process.env.GITNEXUS_ALLOW_INSECURE_CONNECTION);
} catch (err) {
  console.error('Fix GITNEXUS_ALLOW_INSECURE_CONNECTION: use bare hostnames only, comma-separated.');
  throw err;
}

When it happens

Trigger: `parseLLMAllowedInsecureHttpHosts` splits the env value by comma and calls `normalizeAllowedInsecureHttpHost` on each entry. The function fails if: the trimmed entry is empty; contains `/`, `@`, `?`, or `#`; starts with `[` but doesn't end with `]`; contains stray brackets; or has exactly one colon (interpreted as a `host:port` pair, which is rejected because URL.hostname excludes ports).

Common situations: Entering `host:8080` (port included, which is a no-op); entering `http://host` or `https://host` (scheme prefix); entering `user@host` (credentials); entering `[::1` (unclosed IPv6 bracket); entering an empty string between commas (`host,,other`).

Related errors

• Invalid LLM base URL: must be a well-formed http:// or https
• LLM base URL must use http:// or https:// (got ${parsed.prot
• Invalid backend URL: must be a well-formed http:// or https:
• Backend URL must use http:// or https:// (got ${parsed.proto
• ${source}: value contains control or hidden/bidirectional ch

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/84e164d92a2317fa. Report an issue: GitHub.