{"record":{"id":"3921a4eed72c6dfe","repo":"larksuite/cli","slug":"invalid-proxy-address-q-host-must-be-loopback-1","errorCode":null,"errorMessage":"invalid proxy address %q: host must be loopback (127.0.0.1 / ::1) or a recognized same-host alias (localhost, host.docker.internal, host.containers.internal, host.lima.internal, gateway.docker.internal). The sidecar must run on the same physical machine as the sandbox — cross-machine deployment is not a sidecar and is not supported","messagePattern":"invalid proxy address %q: host must be loopback \\(127\\.0\\.0\\.1 / ::1\\) or a recognized same-host alias \\(localhost, host\\.docker\\.internal, host\\.containers\\.internal, host\\.lima\\.internal, gateway\\.docker\\.internal\\)\\. The sidecar must run on the same physical machine as the sandbox — cross-machine deployment is not a sidecar and is not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sidecar/protocol.go","lineNumber":110,"sourceCode":"// isSameHost returns true when host is either a loopback IP or a recognized\n// same-host DNS alias. Does not perform DNS resolution — a tampered /etc/hosts\n// that points an alias elsewhere is out of scope (attacker with that access\n// already has ambient control of the machine).\nfunc isSameHost(host string) bool {\n\tif sameHostAliases[host] {\n\t\treturn true\n\t}\n\tif ip := net.ParseIP(host); ip != nil {\n\t\treturn ip.IsLoopback()\n\t}\n\treturn false\n}\n\n// errNotSameHost is the shared error returned when the sidecar address does\n// not resolve to the same physical host as the sandbox. Kept in one place so\n// tests can look for a stable marker.\nfunc errNotSameHost(addr string) error {\n\treturn fmt.Errorf(\"invalid proxy address %q: host must be loopback \"+\n\t\t\"(127.0.0.1 / ::1) or a recognized same-host alias \"+\n\t\t\"(localhost, host.docker.internal, host.containers.internal, \"+\n\t\t\"host.lima.internal, gateway.docker.internal). \"+\n\t\t\"The sidecar must run on the same physical machine as the sandbox — \"+\n\t\t\"cross-machine deployment is not a sidecar and is not supported\", addr)\n}\n\n// ValidateProxyAddr validates the LARKSUITE_CLI_AUTH_PROXY value.\n// Accepted formats:\n//   - http://host:port\n//   - host:port         (bare address, treated as http)\n//\n// Host must be loopback or in sameHostAliases. The sidecar pattern is\n// inherently same-machine; cross-machine deployment is a different product\n// and is not supported by this feature.\n//\n// https:// is rejected because sidecar is a same-host pattern: loopback\n// and virtual same-host bridges don't traverse any untrusted medium, so","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/sidecar/protocol.go#L92-L128","documentation":"errNotSameHost is returned by ValidateProxyAddr when the host in the LARKSUITE_CLI_AUTH_PROXY value is neither a loopback IP (127.0.0.1/::1) nor one of the recognized same-host aliases (localhost, host.docker.internal, host.containers.internal, host.lima.internal, gateway.docker.internal). The sidecar auth model requires the proxy to run on the same physical machine as the sandbox, so remote hosts are rejected by design.","triggerScenarios":"Setting LARKSUITE_CLI_AUTH_PROXY (validated via ValidateProxyAddr, called by ResolveAccount / ResolveInterceptor / package init) to an address whose host resolves to a LAN IP, public IP, external hostname, or an unlisted container alias — e.g. http://192.168.1.10:16384 or http://my-proxy.example.com:16384.","commonSituations":"Running the sidecar in a separate Docker container/VM reachable only over the network; pointing the CLI at a teammate's or central shared proxy host; using the container's own IP instead of a host alias; typo like 127.0.0.2 (loopback-ish but not exactly loopback in this check it IS loopback — actually any 127.x passes IsLoopback, so this usually fires for 10.x/192.168.x/public hosts).","solutions":["Run the sidecar on the same physical machine as the sandbox and point the config at 127.0.0.1:<port>, localhost:<port>, or [::1]:<port>.","From a container, use the runtime's host alias instead of a raw IP: host.docker.internal (Docker Desktop), host.containers.internal (Podman), host.lima.internal (Lima/colima/rancher-desktop), or gateway.docker.internal.","If the host is a Linux Docker daemon without host.docker.internal, add `--add-host=host.docker.internal:host-gateway` to the container run flags.","Do not attempt to host the proxy on a different machine — that deployment model is explicitly unsupported; use the documented sidecar pattern (same-host proxy listening on DefaultListenAddr 127.0.0.1:16384)."],"exampleFix":"// before (cross-machine, rejected)\nexport LARKSUITE_CLI_AUTH_PROXY=\"http://192.168.1.10:16384\"\n// after (same-host via alias)\nexport LARKSUITE_CLI_AUTH_PROXY=\"http://host.docker.internal:16384\"","handlingStrategy":"validation","validationCode":"addr := os.Getenv(\"LARKSUITE_CLI_AUTH_PROXY\")\nif err := sidecar.ValidateProxyAddr(addr); err != nil {\n\treturn fmt.Errorf(\"LARKSUITE_CLI_AUTH_PROXY unusable: %w\", err)\n}","typeGuard":"func isSameHostAddr(addr string) bool {\n\treturn sidecar.ValidateProxyAddr(addr) == nil\n}","tryCatchPattern":"if err := sidecar.ValidateProxyAddr(addr); err != nil {\n\tif strings.Contains(err.Error(), \"same physical machine\") {\n\t\treturn fmt.Errorf(\"sidecar must be same-host; use 127.0.0.1, localhost, or host.docker.internal: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Default to 127.0.0.1:16384 (sidecar.DefaultListenAddr) unless in a container.","Inside containers use the runtime host alias (host.docker.internal, host.containers.internal, host.lima.internal, gateway.docker.internal), not a LAN IP.","On Linux Docker, add --add-host=host.docker.internal:host-gateway if the alias is missing.","Never point the CLI at a proxy on another machine — deploy the sidecar locally instead."],"tags":["configuration","sidecar","proxy-address","security","network"],"backgroundTag":"cross-machine-proxy-rejected","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}