{"record":{"id":"446ef139046e621b","repo":"larksuite/cli","slug":"invalid-proxy-plugin-config-q-w","errorCode":null,"errorMessage":"invalid proxy plugin config %q: %w","messagePattern":"invalid proxy plugin config %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/config.go","lineNumber":113,"sourceCode":"\t\t// process can tamper with (symlink, foreign owner, group/world-writable)\n\t\t// could redirect credential traffic. Audit it the same way the CA file is.\n\t\tsafePath, err := binding.AssertSecurePath(binding.AuditParams{\n\t\t\tTargetPath:            p,\n\t\t\tLabel:                 ConfigFileName,\n\t\t\tAllowReadableByOthers: true, // config is not a secret; only writability/owner/symlink matter\n\t\t})\n\t\tif err != nil {\n\t\t\tloadErr = fmt.Errorf(\"unsafe proxy plugin config %q: %w\", p, err)\n\t\t\treturn\n\t\t}\n\t\tb, err := vfs.ReadFile(safePath)\n\t\tif err != nil {\n\t\t\tloadErr = fmt.Errorf(\"failed to read proxy plugin config %q: %w\", p, err)\n\t\t\treturn\n\t\t}\n\t\tvar fileCfg Config\n\t\tif err := json.Unmarshal(b, &fileCfg); err != nil {\n\t\t\tloadErr = fmt.Errorf(\"invalid proxy plugin config %q: %w\", p, err)\n\t\t\treturn\n\t\t}\n\n\t\t// Merge: file base + env overrides.\n\t\tif cfg == nil {\n\t\t\tcfg = &fileCfg\n\t\t} else {\n\t\t\t*cfg = fileCfg\n\t\t\tapplyEnvOverrides(cfg)\n\t\t}\n\t\tloadCfg = cfg\n\t})\n\treturn loadCfg, loadErr\n}\n\n// Enabled reports whether proxy plugin mode is enabled.\nfunc (c *Config) Enabled() bool { return c != nil && c.Enable }\n","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/config.go#L95-L131","documentation":"Load() reads ~/.lark-cli/proxy_config.json (the proxy-plugin config) and parses it into transport.Config. This error is thrown when the file exists but is not valid JSON for the expected schema (top-level keys LARKSUITE_CLI_PROXY_ENABLE, LARKSUITE_CLI_PROXY_ADDRESS, LARKSUITE_CLI_CA_PATH). Transport setup fails closed: a malformed proxy config is never silently ignored, because it controls where all outbound CLI traffic (including credentials) egresses.","triggerScenarios":"Running any CLI command after transport.Init/Load() when the config file exists and json.Unmarshal fails: truncated/hand-edited JSON, trailing commas, wrong types (e.g. a string where LARKSUITE_CLI_PROXY_ENABLE needs a boolean), BOM, or a YAML/INI file saved with a .json name.","commonSituations":"A user hand-edits ~/.lark-cli/proxy_config.json and breaks the syntax; an editor or provisioning script writes partial/invalid JSON; someone pastes a proxy config sample into the file with comments or different key names.","solutions":["Open ~/.lark-cli/proxy_config.json and fix the JSON syntax error named in the wrapped %w detail (line/char offset).","Validate the file with `python3 -m json.tool ~/.lark-cli/proxy_config.json` or `jq . ~/.lark-cli/proxy_config.json`.","Ensure the three keys are the exact env-var-style names and correctly typed: LARKSUITE_CLI_PROXY_ENABLE (bool), LARKSUITE_CLI_PROXY_ADDRESS (string), LARKSUITE_CLI_CA_PATH (string).","If you don't need proxy-plugin mode, delete or rename the file; proxy mode is off when the file is absent and no proxy env vars are set.","Regenerate the file from a known-good sample instead of hand-editing."],"exampleFix":"// before (invalid: comments and string bool)\n{\n  // turn proxy on\n  \"LARKSUITE_CLI_PROXY_ENABLE\": \"true\"\n}\n// after\n{\n  \"LARKSUITE_CLI_PROXY_ENABLE\": true,\n  \"LARKSUITE_CLI_PROXY_ADDRESS\": \"http://127.0.0.1:8080\"\n}","handlingStrategy":"validation","validationCode":"python3 - <<'EOF'\nimport json, os\np = os.path.expanduser('~/.lark-cli/proxy_config.json')\nif os.path.exists(p):\n    cfg = json.load(open(p))  # raises like the CLI does\n    for k, t in (('LARKSUITE_CLI_PROXY_ENABLE', bool), ('LARKSUITE_CLI_PROXY_ADDRESS', str), ('LARKSUITE_CLI_CA_PATH', str)):\n        if k in cfg and not isinstance(cfg[k], t):\n            raise SystemExit(f'{k} must be {t.__name__}, got {type(cfg[k]).__name__}')\nprint('proxy_config.json OK')\nEOF","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the file with `jq . ~/.lark-cli/proxy_config.json` after every hand edit.","Keep the three keys exactly as the env-var-style names and correct types (bool/string/string).","Never add comments or trailing commas — the file is strict JSON.","If you don't need proxy-plugin mode, keep the file absent rather than a stubbed-out copy."],"tags":["config","json","proxy"],"backgroundTag":"invalid-config-file","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}