{"record":{"id":"a6e1d4ee65e1ae90","repo":"JuliusBrussee/caveman","slug":"cache-replay-custom-base-urls-require-allow-cust","errorCode":null,"errorMessage":"cache-replay: custom base URLs require -allow-custom-base-url","messagePattern":"cache-replay: custom base URLs require -allow-custom-base-url","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cacheengine/cmd/cache-replay/main.go","lineNumber":225,"sourceCode":"\tverifierOutputBytes := flag.Int64(\"max-verifier-output-bytes\", 16<<20, \"maximum verifier JSON bytes/request\")\n\ttargetRate := flag.Float64(\"target\", .97, \"required request and token cache-hit rate\")\n\tminEligible := flag.Int(\"min-requests\", 100, \"minimum eligible requests/provider\")\n\tallowInsecureLoopback := flag.Bool(\"allow-insecure-loopback\", false, \"allow HTTP only for explicit loopback test base URLs\")\n\tallowCustomBaseURL := flag.Bool(\"allow-custom-base-url\", false, \"confirm credentials may be sent to explicit custom HTTPS base URLs\")\n\tverifierTimeout := flag.Duration(\"verifier-timeout\", 5*time.Minute, \"hard timeout per task-verifier invocation\")\n\tflag.Var(&verifierArgs, \"verifier-arg\", \"verifier argument; repeatable, no shell parsing\")\n\tflag.Var(&verifierEnv, \"verifier-env\", \"environment variable exposed to verifier; repeatable\")\n\tflag.Var(&baseURLs, \"base-url\", \"test/custom provider base URL as provider=https://host; repeatable\")\n\tflag.Parse()\n\n\tif *tracePath == \"\" || !filepath.IsAbs(*tracePath) || *maxRequests <= 0 || *maxRequests > maxReplayRequests || *maxTokens <= 0 || *maxTraceBytes <= 0 || *maxTraceBytes > maxReplayTraceBytes || *maxResponseBytes <= 0 || *maxResponseBytes > 256<<20 || *providerTimeout < time.Second || *providerTimeout > time.Hour || *verifierOutputBytes <= 0 || *verifierOutputBytes > 256<<20 || *verifierTimeout <= 0 || *maxScheduleDrift <= 0 || *maxConcurrency <= 0 || *maxConcurrency > 1024 {\n\t\tfatalConfig(errors.New(\"cache-replay: -trace and positive request/token/trace/response/verifier limits required\"))\n\t}\n\tif (*maxResponseBytes+*verifierOutputBytes)*int64(*maxConcurrency) > maxReplayInflightBytes {\n\t\tfatalConfig(fmt.Errorf(\"cache-replay: concurrent response and verifier buffers exceed %d bytes\", maxReplayInflightBytes))\n\t}\n\tif len(baseURLs) > 0 && !*allowCustomBaseURL {\n\t\tfatalConfig(errors.New(\"cache-replay: custom base URLs require -allow-custom-base-url\"))\n\t}\n\trecords, traceSHA, err := readTrace(*tracePath, *maxTraceBytes, *maxRequests)\n\tif err != nil {\n\t\tfatalConfig(err)\n\t}\n\tlimits := cachebench.ReplayLimits{\n\t\tMaxRequests: *maxRequests, MaxDeclaredBilledTokens: *maxTokens, MaxGap: *maxGap, MaxScheduleDrift: *maxScheduleDrift,\n\t\tMaxConcurrency:        *maxConcurrency,\n\t\tRequireGroundedTiming: !*allowUngrounded, RequireProviderTokens: !*allowEstimatedTokens,\n\t}\n\tpreflight, err := cachebench.ValidateReplay(records, limits, *timeScale)\n\tif err != nil {\n\t\tfatalConfig(err)\n\t}\n\ttarget := cachebench.Target{RequestHitRate: *targetRate, TokenHitRate: *targetRate, MinEligibleRequest: *minEligible}\n\tif err := cachebench.ValidateReplayTarget(records, target); err != nil {\n\t\tfatalConfig(err)\n\t}","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/cacheengine/cmd/cache-replay/main.go#L207-L243","documentation":"Fatal config error from cache-replay: at least one -base-url provider=https://host was supplied but -allow-custom-base-url was not set to true. Because custom base URLs determine where provider credentials are sent, the tool requires an explicit opt-in confirming you accept sending credentials to that host.","triggerScenarios":"Any invocation that includes one or more -base-url flags without also passing -allow-custom-base-url. Common when pointing replay at a staging mirror or a local fake provider.","commonSituations":"Testing against an internal staging endpoint or a mock server; forgetting the confirmation flag after copying a staging command template.","solutions":["Add -allow-custom-base-url to the command when using -base-url","Verify the base URLs use HTTPS unless they are explicit loopback hosts with -allow-insecure-loopback","If you did not intend custom routing, remove the -base-url flags entirely"],"exampleFix":"# before\ncache-replay -base-url openai=https://staging.example.com ...\n\n# after\ncache-replay -base-url openai=https://staging.example.com -allow-custom-base-url ...","handlingStrategy":"validation","validationCode":"if len(baseURLs) > 0 {\n\tif !allowCustomBaseURL {\n\t\treturn errors.New(\"refusing custom base URLs without explicit opt-in\")\n\t}\n\tfor _, u := range baseURLs {\n\t\tif !strings.HasPrefix(u, \"https://\") && !isLoopback(u) {\n\t\t\treturn fmt.Errorf(\"non-HTTPS non-loopback base URL %q\", u)\n\t\t}\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pair -base-url and -allow-custom-base-url in shared scripts so they cannot drift apart","Prefer HTTPS staging endpoints; use -allow-insecure-loopback only for 127.0.0.1/::1 test doubles"],"tags":["go","cli","configuration","security"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}