{"record":{"id":"2400a11494b8bde0","repo":"larksuite/cli","slug":"invalid-s-q-host-must-be-127-0-0-1","errorCode":null,"errorMessage":"invalid %s %q: host must be 127.0.0.1","messagePattern":"invalid (.+?) %q: host must be 127\\.0\\.0\\.1","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/config.go","lineNumber":209,"sourceCode":"\t}\n\tredacted := redactProxyURL(raw)\n\tu, err := url.Parse(raw)\n\tif err != nil {\n\t\t// Do not wrap the raw url.Parse error: its string embeds the original\n\t\t// URL, which can contain userinfo (user:password). Return a redacted,\n\t\t// generic message instead.\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: malformed URL\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Scheme != \"http\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: scheme must be http\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Host == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: missing host\", envvars.CliProxyAddress, redacted)\n\t}\n\t// Security hardening: only allow a loopback proxy. This prevents accidental\n\t// cross-machine proxying of credentials/traffic.\n\tif u.Hostname() != \"127.0.0.1\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: host must be 127.0.0.1\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Port() == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: explicit port is required\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Path != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: path is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.RawQuery != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: query is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Fragment != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: fragment is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\treturn u, nil\n}\n\n// ApplyToTransport clones base and applies proxy plugin settings to the clone.\n// Caller owns the returned *http.Transport.","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/config.go#L191-L227","documentation":"The proxy address must carry an explicit port. proxyURL rejects loopback URLs without one (e.g. http://127.0.0.1). The fixed-proxy design needs a concrete endpoint to route all outbound traffic through, so a default-port guess is not allowed.","triggerScenarios":"LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1 or http://127.0.0.1/ with proxy mode enabled; ApplyToTransport fails at startup with the redacted address.","commonSituations":"Assuming port 80/8080 defaults; truncating the port when copying a command; shell variable expansion dropping `:8080` because a var was empty.","solutions":["Append the port your proxy listens on: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.","Confirm the proxy's actual listening port (`ss -ltnp | grep <proxy>` or its config) and use it exactly.","If a variable supplies the port, ensure it isn't empty: `echo \"[$PROXY_PORT]\"`.","Fix the same value in ~/.lark-cli/proxy_config.json if you configure via file."],"exampleFix":"// before\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1\n// after\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080","handlingStrategy":"validation","validationCode":"case \"$LARKSUITE_CLI_PROXY_ADDRESS\" in http://127.0.0.1:[0-9]*) echo OK ;; *) echo 'proxy address needs an explicit port, e.g. http://127.0.0.1:8080' >&2 ;; esac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include :<port>; there is no default-port fallback.","Look up the proxy's real listening port before configuring.","Watch for shell expansions that can drop an empty $PORT suffix.","Keep host and port as one literal string."],"tags":["proxy","url","config","validation"],"backgroundTag":"missing-port","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}