{"record":{"id":"84e164d92a2317fa","repo":"abhigyanpatwari/GitNexus","slug":"allow-insecure-connection-llm-allow-insecure","errorCode":null,"errorMessage":"--allow-insecure-connection / ${LLM_ALLOW_INSECURE_CONNECTION_ENV} entries must be exact hostnames or IP addresses","messagePattern":"--allow-insecure-connection / (.+?) entries must be exact hostnames or IP addresses","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"gitnexus/src/core/wiki/llm-client.ts","lineNumber":188,"sourceCode":"function formatTimeoutDuration(timeoutMs: number): string {\n  if (timeoutMs >= 1000 && timeoutMs % 1000 === 0) {\n    return `${timeoutMs / 1000}s`;\n  }\n  return `${timeoutMs}ms`;\n}\n\nfunction isTimeoutLikeError(err: unknown): boolean {\n  if (!(err instanceof Error)) return false;\n  if (err.name === 'TimeoutError' || err.name === 'AbortError') return true;\n  return /time(d)?\\s*out|timeout/i.test(err.message);\n}\n\nexport const LLM_ALLOW_INSECURE_CONNECTION_ENV = 'GITNEXUS_ALLOW_INSECURE_CONNECTION';\n\nfunction normalizeAllowedInsecureHttpHost(host: string): string {\n  const trimmed = host.trim().toLowerCase();\n  const fail = () => {\n    throw new Error(\n      `--allow-insecure-connection / ${LLM_ALLOW_INSECURE_CONNECTION_ENV} entries must be exact hostnames or IP addresses`,\n    );\n  };\n  if (!trimmed || /[/@?#]/.test(trimmed)) fail();\n\n  if (trimmed.startsWith('[')) {\n    if (!trimmed.endsWith(']')) fail();\n    const normalized = trimmed.slice(1, -1);\n    if (!normalized || /[\\[\\]]/.test(normalized)) fail();\n    return normalized;\n  }\n\n  if (/[\\[\\]]/.test(trimmed)) fail();\n  if ((trimmed.match(/:/g)?.length ?? 0) === 1) {\n    // URL.hostname never includes the port, so accepting \"host:port\" would\n    // create a confusing no-op allowlist entry.\n    fail();\n  }","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/gitnexus/src/core/wiki/llm-client.ts#L170-L206","documentation":"Thrown by `normalizeAllowedInsecureHttpHost` when parsing an entry from the `GITNEXUS_ALLOW_INSECURE_CONNECTION` env var (or `--allow-insecure-connection` flag) that is not a valid bare hostname or IP address. Entries must be exact hostnames or address literals — no path separators (`/@?#`), no port suffixes (`host:port` creates a confusing no-op since URL.hostname excludes ports), no mismatched or stray brackets. IPv6 literals may be wrapped in `[...]` but the inner value must be a clean address.","triggerScenarios":"`parseLLMAllowedInsecureHttpHosts` splits the env value by comma and calls `normalizeAllowedInsecureHttpHost` on each entry. The function fails if: the trimmed entry is empty; contains `/`, `@`, `?`, or `#`; starts with `[` but doesn't end with `]`; contains stray brackets; or has exactly one colon (interpreted as a `host:port` pair, which is rejected because URL.hostname excludes ports).","commonSituations":"Entering `host:8080` (port included, which is a no-op); entering `http://host` or `https://host` (scheme prefix); entering `user@host` (credentials); entering `[::1` (unclosed IPv6 bracket); entering an empty string between commas (`host,,other`).","solutions":["Use bare hostnames only: `host.example.com`, `192.168.1.10`, or `[::1]` for IPv6.","Remove port suffixes — the allowlist matches the hostname regardless of port.","Remove scheme prefixes (`http://`, `https://`) — the entries are hostnames, not URLs.","Separate multiple hosts with commas: `host1.com,host2.com,192.168.1.10`."],"exampleFix":"# before\nexport GITNEXUS_ALLOW_INSECURE_CONNECTION=host.lan:8080,http://other.lan\ngitnexus analyze\n# error: ...entries must be exact hostnames or IP addresses\n# after\nexport GITNEXUS_ALLOW_INSECURE_CONNECTION=host.lan,other.lan\ngitnexus analyze","handlingStrategy":"validation","validationCode":"// Validate allowlist entries before passing them to the LLM client:\nimport { parseLLMAllowedInsecureHttpHosts } from './wiki/llm-client.js';\ntry {\n  parseLLMAllowedInsecureHttpHosts(process.env.GITNEXUS_ALLOW_INSECURE_CONNECTION);\n} catch (err) {\n  console.error('Invalid insecure-connection allowlist entry:', (err as Error).message);\n  process.exit(1);\n}","typeGuard":"// A simple guard: entries must be bare hostnames without scheme, path, or port\nconst isValidInsecureHost = (host: string): boolean => {\n  const trimmed = host.trim().toLowerCase();\n  if (!trimmed || /[/@?#]/.test(trimmed)) return false;\n  if (trimmed.includes('://')) return false;\n  if ((trimmed.match(/:/g)?.length ?? 0) === 1) return false; // host:port\n  return true;\n};","tryCatchPattern":"try {\n  parseLLMAllowedInsecureHttpHosts(process.env.GITNEXUS_ALLOW_INSECURE_CONNECTION);\n} catch (err) {\n  console.error('Fix GITNEXUS_ALLOW_INSECURE_CONNECTION: use bare hostnames only, comma-separated.');\n  throw err;\n}","preventionTips":["Use bare hostnames only: `host.lan,192.168.1.10,[::1]` — no scheme, no port, no path.","Test the env var with `parseLLMAllowedInsecureHttpHosts` in a script before deploying."],"tags":["config","security","llm-client","validation","http","env-var"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}