{"record":{"id":"45f14b53a96bed68","repo":"jackwener/OpenCLI","slug":"notebooklm-rpc-request-resolved-outside-the-active","errorCode":null,"errorMessage":"NotebookLM RPC request resolved outside the active trusted origin","messagePattern":"NotebookLM RPC request resolved outside the active trusted origin","errorType":"exception","errorClass":"CommandExecutionError","httpStatus":null,"severity":"error","filePath":"clis/notebooklm/rpc.js","lineNumber":243,"sourceCode":"    const auth = await getNotebooklmPageAuth(page);\n    const requestBody = buildNotebooklmRpcBody(rpcId, params, auth.csrfToken);\n    const authuser = auth.authuser || '';\n    const url = NOTEBOOKLM_RPC_PATH +\n        `?rpcids=${rpcId}&source-path=${encodeURIComponent(auth.sourcePath)}` +\n        (authuser ? `&authuser=${encodeURIComponent(authuser)}` : '') +\n        `&hl=${encodeURIComponent(options.hl ?? 'en')}` +\n        `&f.sid=${encodeURIComponent(auth.sessionId)}&rt=c`;\n    const response = await fetchNotebooklmInPage(page, url, {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',\n        },\n        body: requestBody,\n    });\n    const requestUrl = parseTrustedNotebooklmUrl(response.requestUrl);\n    const finalUrl = parseTrustedNotebooklmUrl(response.finalUrl);\n    if (!requestUrl || requestUrl.origin !== auth.origin || requestUrl.pathname !== NOTEBOOKLM_RPC_PATH) {\n        throw new CommandExecutionError('NotebookLM RPC request resolved outside the active trusted origin');\n    }\n    if (finalUrl?.origin === auth.origin && (finalUrl.pathname === '/login' || finalUrl.pathname.startsWith('/login/'))) {\n        throw new AuthRequiredError(NOTEBOOKLM_DOMAIN, 'NotebookLM RPC redirected to the login page');\n    }\n    if (!finalUrl || finalUrl.origin !== auth.origin || finalUrl.pathname !== NOTEBOOKLM_RPC_PATH) {\n        throw new CommandExecutionError('NotebookLM RPC response redirected outside the active trusted endpoint');\n    }\n    if (response.status === 401 || response.status === 403) {\n        throw new AuthRequiredError(NOTEBOOKLM_DOMAIN, `NotebookLM RPC returned auth error (${response.status})`);\n    }\n    if (!response.ok) {\n        throw new CliError('NOTEBOOKLM_RPC', `NotebookLM RPC request failed with HTTP ${response.status}`, 'Retry from the NotebookLM home page in an already logged-in Chrome session.');\n    }\n    return {\n        auth,\n        url: requestUrl.href,\n        requestBody,\n        response,","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/notebooklm/rpc.js#L225-L261","documentation":"After the RPC call, callNotebooklmRpc parses response.requestUrl with parseTrustedNotebooklmUrl and asserts it stays on the authenticated origin (auth.origin) with the exact NOTEBOOKLM_RPC_PATH. If the URL cannot be parsed, points at a different origin, or a different path, the request did not land on the trusted endpoint, so it refuses to trust the response and throws this CommandExecutionError.","triggerScenarios":"The in-page fetch was redirected (proxy, captive portal, SSO bounce) to another origin; response.requestUrl is relative or absent (malformed envelope); the request path no longer matches NOTEBOOKLM_RPC_PATH because NotebookLM changed its batchexecute path.","commonSituations":"Corporate proxy or SSL-intercepting appliance rewriting the URL; the user is behind an SSO redirect chain that lands on a different domain; a VPN/captive portal serving a challenge page; an attacker/MITM scenario this check exists to catch; NotebookLM deploying a new RPC path in an updated frontend.","solutions":["Verify network egress: disable proxies/VPNs or exclude the NotebookLM domain from interception and retry.","Log in directly at the NotebookLM origin in the attached Chrome profile, then re-run `opencli notebooklm open <notebook>`.","Confirm response.requestUrl is an absolute URL; if the wrapper returns a relative URL, fix or upgrade the adapter code.","If NotebookLM changed NOTEBOOKLM_RPC_PATH, update the constant to the new path and ensure parseTrustedNotebooklmUrl accepts the origin."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const requestUrl = parseTrustedNotebooklmUrl(response.requestUrl);\nif (!requestUrl || requestUrl.origin !== auth.origin || requestUrl.pathname !== NOTEBOOKLM_RPC_PATH) {\n  throw new Error('RPC request URL is not on the trusted endpoint — check proxy/VPN/SSO settings before calling.');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const res = await callNotebooklmRpc(page, auth, method, body);\n} catch (e) {\n  if (e instanceof CommandExecutionError && e.message.includes('outside the active trusted origin')) {\n    // disable proxy/VPN interception or re-login on the trusted origin, then retry\n  } else throw e;\n}","preventionTips":["Avoid corporate proxies / SSL interception for notebooklm.google.com traffic.","Log in directly on the NotebookLM origin in the attached Chrome profile before automation.","Keep the adapter's NOTEBOOKLM_RPC_PATH in sync with NotebookLM's current endpoint.","Log response.requestUrl on failures to spot redirect or rewrite patterns early."],"tags":["rpc","origin-validation","redirect","security","notebooklm"],"backgroundTag":"cross-origin-redirect","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}