jackwener/OpenCLI · error · CommandExecutionError

NotebookLM RPC response redirected outside the active truste

Error message

NotebookLM RPC response redirected outside the active trusted endpoint

What it means

After the login-redirect check, callNotebooklmRpc validates that response.finalUrl still resolves to the trusted origin with the exact NOTEBOOKLM_RPC_PATH. If the final URL is missing, on another origin, or another path, the response came from somewhere other than the trusted endpoint, so the body cannot be trusted and this CommandExecutionError is thrown. Unlike the login check, this indicates a non-login redirect or an unusable finalUrl.

Source

Thrown at clis/notebooklm/rpc.js:249

        `&hl=${encodeURIComponent(options.hl ?? 'en')}` +
        `&f.sid=${encodeURIComponent(auth.sessionId)}&rt=c`;
    const response = await fetchNotebooklmInPage(page, url, {
        method: 'POST',
        headers: {
            'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
        },
        body: requestBody,
    });
    const requestUrl = parseTrustedNotebooklmUrl(response.requestUrl);
    const finalUrl = parseTrustedNotebooklmUrl(response.finalUrl);
    if (!requestUrl || requestUrl.origin !== auth.origin || requestUrl.pathname !== NOTEBOOKLM_RPC_PATH) {
        throw new CommandExecutionError('NotebookLM RPC request resolved outside the active trusted origin');
    }
    if (finalUrl?.origin === auth.origin && (finalUrl.pathname === '/login' || finalUrl.pathname.startsWith('/login/'))) {
        throw new AuthRequiredError(NOTEBOOKLM_DOMAIN, 'NotebookLM RPC redirected to the login page');
    }
    if (!finalUrl || finalUrl.origin !== auth.origin || finalUrl.pathname !== NOTEBOOKLM_RPC_PATH) {
        throw new CommandExecutionError('NotebookLM RPC response redirected outside the active trusted endpoint');
    }
    if (response.status === 401 || response.status === 403) {
        throw new AuthRequiredError(NOTEBOOKLM_DOMAIN, `NotebookLM RPC returned auth error (${response.status})`);
    }
    if (!response.ok) {
        throw new CliError('NOTEBOOKLM_RPC', `NotebookLM RPC request failed with HTTP ${response.status}`, 'Retry from the NotebookLM home page in an already logged-in Chrome session.');
    }
    return {
        auth,
        url: requestUrl.href,
        requestBody,
        response,
        result: extractNotebooklmRpcResult(response.body, rpcId),
    };
}

View on GitHub (pinned to 49907e53dc)

Solutions

Open the attached Chrome page manually, clear any consent/SSO interstitial, and retry.
Exclude the NotebookLM domain from proxy/SSL interception or disable the VPN and retry.
Log response.finalUrl to see where the redirect chain ends and address that hop specifically.
If NOTEBOOKLM_RPC_PATH changed, update the constant/adapter to the new endpoint path.

Example fix

// before
const finalUrl = parseTrustedNotebooklmUrl(response.finalUrl);
// after: log the offending URL to diagnose redirects
const finalUrl = parseTrustedNotebooklmUrl(response.finalUrl);
if (!finalUrl || finalUrl.origin !== auth.origin) {
  console.error('RPC ended at unexpected URL:', response.finalUrl);
}

Defensive patterns

Strategy: validation

Validate before calling

const finalUrl = parseTrustedNotebooklmUrl(response.finalUrl);
if (!finalUrl || finalUrl.origin !== auth.origin || finalUrl.pathname !== NOTEBOOKLM_RPC_PATH) {
  console.error('RPC redirect chain ended at:', response.finalUrl);
  throw new Error('Untrusted final URL — clear SSO/consent interstitials and proxy redirects first.');
}

Try / catch

try {
  const res = await callNotebooklmRpc(page, auth, method, body);
} catch (e) {
  if (e instanceof CommandExecutionError && e.message.includes('redirected outside the active trusted endpoint')) {
    // inspect response.finalUrl (log it), clear the interstitial/proxy page, retry
  } else throw e;
}

Prevention

Clear any Google consent/terms interstitials in the automation profile ahead of time.
Exclude notebooklm.google.com (and accounts.google.com) from proxy/SSL interception.
Log finalUrl on every failure to map redirect behavior in your environment.
Update the adapter when NotebookLM changes its RPC path.

When it happens

Trigger: A redirect chain ends on a non-login page of another origin (SSO loop, consent page on accounts.google.com, proxy block page); finalUrl is absent because the envelope was malformed; the RPC path changed in a frontend update so the final path never equals NOTEBOOKLM_RPC_PATH.

Common situations: Google consent/terms interstitial intercepting the request; enterprise proxy redirecting to an auth gateway domain; corrupted response envelope from the in-page bridge; NotebookLM deploying a versioned RPC path.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/c2cb2ecd21b7d8b2. Report an issue: GitHub.