jackwener/OpenCLI · error · CommandExecutionError

NotebookLM page auth probe is not on a trusted HTTPS Noteboo

Error message

NotebookLM page auth probe is not on a trusted HTTPS NotebookLM origin

What it means

After the page auth probe evaluates inside the browser, the returned raw.url is passed through parseTrustedNotebooklmUrl. If that returns falsy the page is not on a trusted HTTPS NotebookLM origin (NOTEBOOKLM_DOMAIN), so probeNotebooklmPageAuth throws this CommandExecutionError. This prevents harvesting auth tokens from lookalike or redirected pages.

Source

Thrown at clis/notebooklm/rpc.js:61

    const pathMatch = (location.pathname || '').match(/^\\/u\\/(\\d+)\\//);
    return {
      html,
      sourcePath: location.pathname || '/',
      readyState: document.readyState || '',
      csrfToken: typeof wiz.SNlM0e === 'string' ? wiz.SNlM0e : '',
      sessionId: typeof wiz.FdrFJe === 'string' ? wiz.FdrFJe : '',
      authuser: authMatch ? authMatch[1] : (pathMatch ? pathMatch[1] : ''),
      url: location.href,
    };
  })()`);
    }
    catch (error) {
        rethrowNotebooklmTransport(error, 'page auth probe');
    }
    const raw = requireNotebooklmObject(unwrapNotebooklmEvaluateResult(evaluated), 'page auth probe');
    const pageUrl = parseTrustedNotebooklmUrl(raw.url);
    if (!pageUrl) {
        throw new CommandExecutionError('NotebookLM page auth probe is not on a trusted HTTPS NotebookLM origin');
    }
    if (typeof raw.html !== 'string' || typeof raw.sourcePath !== 'string' || typeof raw.csrfToken !== 'string' || typeof raw.sessionId !== 'string' || typeof raw.authuser !== 'string') {
        throw new CommandExecutionError('NotebookLM page auth probe returned malformed fields');
    }
    if (raw.sourcePath !== pageUrl.pathname || (raw.authuser && !/^\d+$/.test(raw.authuser))) {
        throw new CommandExecutionError('NotebookLM page auth probe returned an invalid path or authuser');
    }
    return {
        html: raw.html,
        sourcePath: raw.sourcePath,
        readyState: typeof raw.readyState === 'string' ? raw.readyState : '',
        csrfToken: raw.csrfToken,
        sessionId: raw.sessionId,
        authuser: raw.authuser,
        origin: pageUrl.origin,
    };
}
export async function getNotebooklmPageAuth(page) {

View on GitHub (pinned to 49907e53dc)

Solutions

1. Navigate the Chrome tab to the https://notebooklm.google.com notebook page before running the command
2. Complete any pending Google login/redirect so the tab lands on the NotebookLM origin
3. Check for corporate proxies/extensions that strip HTTPS or rewrite the domain
4. Verify the configured NOTEBOOKLM_DOMAIN / base URL matches the expected trusted origin

Example fix

// before (running probe from wherever the tab is)
await probe(page);
// after (navigate to a trusted origin first)
await page.goto('https://notebooklm.google.com/', { waitUntil: 'networkidle' });
await probe(page);

const u = new URL(page.url());
if (u.protocol !== 'https:' || !/(^|\.)notebooklm\.google\.com$/.test(u.hostname)) {
  throw new Error(`Tab is on untrusted origin: ${u.origin}; navigate to https://notebooklm.google.com first`);
}

function isTrustedNotebooklmUrl(u) {
  try { const p = new URL(u); return p.protocol === 'https:' && /(^|\.)notebooklm\.google\.com$/.test(p.hostname); } catch { return false; }
}

try {
  const auth = await probeNotebooklmPageAuth(page);
} catch (e) {
  if (/trusted HTTPS NotebookLM origin/.test(e.message)) {
    console.error('Navigate the linked Chrome tab to https://notebooklm.google.com and complete login.');
  } else throw e;
}

When it happens

Trigger: probe() runs while the active tab's URL is not a trusted HTTPS NotebookLM origin — parseTrustedNotebooklmUrl(raw.url) returns null because the page is on accounts.google.com, http:// (not HTTPS), another Google property, or an attacker/lookalike domain.

Common situations: User opened the CLI-linked Chrome tab on the Google sign-in page and never finished navigation to NotebookLM; a redirect chain left the tab on accounts.google.com; the URL had an unsupported subdomain; HTTPS was downgraded by a proxy.

Related errors

• NotebookLM RPC request resolved outside the active trusted o
• NotebookLM RPC response redirected outside the active truste
• Google SSO cookies (SID + SAPISID) missing
• NotebookLM redirected to Google sign-in
• opencli notebooklm list

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/a94bcdeb46a36291. Report an issue: GitHub.