{"record":{"id":"a94bcdeb46a36291","repo":"jackwener/OpenCLI","slug":"notebooklm-page-auth-probe-is-not-on-a-trusted-htt","errorCode":null,"errorMessage":"NotebookLM page auth probe is not on a trusted HTTPS NotebookLM origin","messagePattern":"NotebookLM page auth probe is not on a trusted HTTPS NotebookLM origin","errorType":"exception","errorClass":"CommandExecutionError","httpStatus":null,"severity":"error","filePath":"clis/notebooklm/rpc.js","lineNumber":61,"sourceCode":"    const pathMatch = (location.pathname || '').match(/^\\\\/u\\\\/(\\\\d+)\\\\//);\n    return {\n      html,\n      sourcePath: location.pathname || '/',\n      readyState: document.readyState || '',\n      csrfToken: typeof wiz.SNlM0e === 'string' ? wiz.SNlM0e : '',\n      sessionId: typeof wiz.FdrFJe === 'string' ? wiz.FdrFJe : '',\n      authuser: authMatch ? authMatch[1] : (pathMatch ? pathMatch[1] : ''),\n      url: location.href,\n    };\n  })()`);\n    }\n    catch (error) {\n        rethrowNotebooklmTransport(error, 'page auth probe');\n    }\n    const raw = requireNotebooklmObject(unwrapNotebooklmEvaluateResult(evaluated), 'page auth probe');\n    const pageUrl = parseTrustedNotebooklmUrl(raw.url);\n    if (!pageUrl) {\n        throw new CommandExecutionError('NotebookLM page auth probe is not on a trusted HTTPS NotebookLM origin');\n    }\n    if (typeof raw.html !== 'string' || typeof raw.sourcePath !== 'string' || typeof raw.csrfToken !== 'string' || typeof raw.sessionId !== 'string' || typeof raw.authuser !== 'string') {\n        throw new CommandExecutionError('NotebookLM page auth probe returned malformed fields');\n    }\n    if (raw.sourcePath !== pageUrl.pathname || (raw.authuser && !/^\\d+$/.test(raw.authuser))) {\n        throw new CommandExecutionError('NotebookLM page auth probe returned an invalid path or authuser');\n    }\n    return {\n        html: raw.html,\n        sourcePath: raw.sourcePath,\n        readyState: typeof raw.readyState === 'string' ? raw.readyState : '',\n        csrfToken: raw.csrfToken,\n        sessionId: raw.sessionId,\n        authuser: raw.authuser,\n        origin: pageUrl.origin,\n    };\n}\nexport async function getNotebooklmPageAuth(page) {","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/notebooklm/rpc.js#L43-L79","documentation":"After the page auth probe evaluates inside the browser, the returned raw.url is passed through parseTrustedNotebooklmUrl. If that returns falsy the page is not on a trusted HTTPS NotebookLM origin (NOTEBOOKLM_DOMAIN), so probeNotebooklmPageAuth throws this CommandExecutionError. This prevents harvesting auth tokens from lookalike or redirected pages.","triggerScenarios":"probe() runs while the active tab's URL is not a trusted HTTPS NotebookLM origin — parseTrustedNotebooklmUrl(raw.url) returns null because the page is on accounts.google.com, http:// (not HTTPS), another Google property, or an attacker/lookalike domain.","commonSituations":"User opened the CLI-linked Chrome tab on the Google sign-in page and never finished navigation to NotebookLM; a redirect chain left the tab on accounts.google.com; the URL had an unsupported subdomain; HTTPS was downgraded by a proxy.","solutions":["Navigate the Chrome tab to the https://notebooklm.google.com notebook page before running the command","Complete any pending Google login/redirect so the tab lands on the NotebookLM origin","Check for corporate proxies/extensions that strip HTTPS or rewrite the domain","Verify the configured NOTEBOOKLM_DOMAIN / base URL matches the expected trusted origin"],"exampleFix":"// before (running probe from wherever the tab is)\nawait probe(page);\n// after (navigate to a trusted origin first)\nawait page.goto('https://notebooklm.google.com/', { waitUntil: 'networkidle' });\nawait probe(page);","handlingStrategy":"validation","validationCode":"const u = new URL(page.url());\nif (u.protocol !== 'https:' || !/(^|\\.)notebooklm\\.google\\.com$/.test(u.hostname)) {\n  throw new Error(`Tab is on untrusted origin: ${u.origin}; navigate to https://notebooklm.google.com first`);\n}","typeGuard":"function isTrustedNotebooklmUrl(u) {\n  try { const p = new URL(u); return p.protocol === 'https:' && /(^|\\.)notebooklm\\.google\\.com$/.test(p.hostname); } catch { return false; }\n}","tryCatchPattern":"try {\n  const auth = await probeNotebooklmPageAuth(page);\n} catch (e) {\n  if (/trusted HTTPS NotebookLM origin/.test(e.message)) {\n    console.error('Navigate the linked Chrome tab to https://notebooklm.google.com and complete login.');\n  } else throw e;\n}","preventionTips":["Open the notebook page in the linked Chrome profile before running commands","Complete all Google sign-in/redirect steps first","Check HTTPS-proxifying corporate tools that alter the origin"],"tags":["security","origin-validation","auth","notebooklm"],"backgroundTag":"untrusted-origin","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}