unslothai/unsloth · warning · ValueError

Refused notebook fetch from {host!r}: not in allowlist {sort

Error message

Refused notebook fetch from {host!r}: not in allowlist {sorted(_ALLOWED_NOTEBOOK_HOSTS)}

What it means

Thrown by parseBaseUrlForProvider (chat-providers-dialog.tsx:476-491) when the Base URL field is empty (after trim) but the provider being configured requires one. Required is determined per provider type: hosted registry entries have their own base_url, while custom/user-supplied connections (OpenAI-compatible gateways, local servers) must be told where to send requests.

Source

Thrown at scripts/notebook_to_python.py:65

    if parsed.netloc != "github.com" or "/blob/" not in parsed.path:
        return url
    new_path = parsed.path.replace("/blob/", "/", 1)
    return urllib.parse.urlunparse(
        parsed._replace(netloc = "raw.githubusercontent.com", path = new_path)
    )


def download_notebook(url: str) -> tuple[str, str]:
    """Download notebook from URL. Returns (content, filename)."""
    raw_url = github_blob_to_raw(url)

    parsed = urllib.parse.urlparse(raw_url)
    filename = os.path.basename(urllib.parse.unquote(parsed.path))

    # Host allowlist: refuse to fetch from anything we don't recognise.
    host = parsed.hostname
    if host not in _ALLOWED_NOTEBOOK_HOSTS:
        raise ValueError(
            f"Refused notebook fetch from {host!r}: not in allowlist "
            f"{sorted(_ALLOWED_NOTEBOOK_HOSTS)}"
        )

    print(f"Downloading {url}...")
    with urllib.request.urlopen(raw_url, timeout = 60) as response:
        content = response.read().decode("utf-8")

    return content, filename


def is_url(path: str) -> bool:
    """Check if path is a URL."""
    return path.startswith("http://") or path.startswith("https://")


def replace_colab_paths(source: str) -> str:
    """Replace Colab-specific /content/ paths with current working directory."""

View on GitHub (pinned to 203007d190)

Solutions

Fill in the provider's API endpoint, e.g. 'https://api.groq.com/openai/v1'.
Verify which field group is visible — the requirement depends on the selected connection type; pick a preset that hosts its own URL if you don't have one.
Re-enter the URL after switching provider types, since resetForm clears the draft.

Defensive patterns

Strategy: validation

Validate before calling

function baseUrlSatisfied(required: boolean, input: string): boolean {
  return !required || input.trim().length > 0;
}

Prevention

Mark the Base URL field required (*) for provider types that need it and disable Save while empty.
Re-populate the field when editing an existing provider so users don't accidentally clear it.
Choose a hosted preset (which owns its base_url) when you don't manage an endpoint yourself.

When it happens

Trigger: Saving a custom provider connection with an empty Base URL field — required === true for that providerType. parseBaseUrlForProvider is called from the save/submit handler, so this fires when the user skipped the field, or it was cleared by resetForm after switching pages.

Common situations: Adding an OpenAI-compatible custom provider and forgetting the endpoint; editing an existing provider whose base URL was cleared; switching provider type in the form leaving the old (now-cleared) URL draft empty.

Related errors

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/69949d9ae1be6468. Report an issue: GitHub.