{"record":{"id":"9cf3b11f2c7335fc","repo":"larksuite/cli","slug":"proxy-plugin-enabled-but-config-is-invalid-w","errorCode":null,"errorMessage":"proxy plugin enabled but config is invalid: %w","messagePattern":"proxy plugin enabled but config is invalid: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/transport/transport.go","lineNumber":49,"sourceCode":"\t\t// as Fallback cannot silently degrade this into a\n\t\t// direct-egress transport.\n\t\treturn failClosedTransport(fmt.Errorf(\"proxy plugin transport unavailable: http.DefaultTransport is %T, want *http.Transport\", http.DefaultTransport))\n\t}\n\n\tcfg, err := Load()\n\tif err != nil {\n\t\t// Fail closed: config file exists but is malformed/unreadable — do not\n\t\t// silently fall back to direct egress.\n\t\treturn blockedTransport(def, fmt.Errorf(\"proxy plugin config is invalid: %w\", err))\n\t}\n\tif cfg == nil || !cfg.Enabled() {\n\t\treturn def\n\t}\n\tt, err := cfg.ApplyToTransport(def)\n\tif err != nil {\n\t\t// Fail closed: do not silently fall back to direct egress when the\n\t\t// operator explicitly enabled proxy plugin mode.\n\t\treturn blockedTransport(def, fmt.Errorf(\"proxy plugin enabled but config is invalid: %w\", err))\n\t}\n\treturn t\n}\n\n// pluginTransport returns the proxy plugin transport when proxy plugin mode is\n// configured. The bool return is false when the plugin is not configured or not enabled.\nfunc pluginTransport() (http.RoundTripper, bool) {\n\tcfg, err := Load()\n\tif err != nil {\n\t\treturn cachedBlockedTransport(), true\n\t}\n\tif cfg == nil || !cfg.Enabled() {\n\t\treturn nil, false\n\t}\n\treturn proxyPluginTransport(), true\n}\n\n// failClosedTransport returns a *http.Transport that always fails RoundTrip with","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/transport.go#L31-L67","documentation":"Proxy plugin mode was explicitly enabled and the config loaded, but cfg.ApplyToTransport(def) failed validation (e.g. bad proxy URL, bad CA path — errors 450-455). Because the operator explicitly enabled proxy mode, the CLI fails closed rather than silently falling back to direct egress.","triggerScenarios":"Proxy plugin enabled with an invalid address (fragment/query/path in URL), relative CA path, unreadable/invalid PEM, etc.; buildProxyPluginTransport -> ApplyToTransport returns an error and it is wrapped as 'proxy plugin enabled but config is invalid: %w'.","commonSituations":"Typo in proxy address such as a trailing '#fragment' or '?query'; CA path misconfigured during corporate TLS setup; config enabled by platform tooling with values the transport validator rejects.","solutions":["Read the wrapped cause (%w) to identify which validation failed (URL vs CA path vs PEM).","Correct the offending value: bare scheme://host:port proxy URL, absolute PEM path, valid PEM contents.","Re-run the CLI; alternatively disable the proxy plugin if proxying is not required."],"exampleFix":"// before\n{\"enabled\": true, \"address\": \"http://proxy:8080#tier1\"}\n// after\n{\"enabled\": true, \"address\": \"http://proxy:8080\"}","handlingStrategy":"validation","validationCode":"cfg, err := transport.Load()\nif err != nil { log.Fatal(err) }\nif cfg != nil && cfg.Enabled() {\n\tif _, err := cfg.ApplyToTransport(http.DefaultTransport.(*http.Transport).Clone()); err != nil {\n\t\tlog.Fatalf(\"proxy config rejected before launch: %v\", err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"tr, err := buildProxyPluginTransport()\nif err != nil && strings.Contains(err.Error(), \"enabled but config is invalid\") {\n\tlog.Fatalf(\"fix proxy URL / CA path per wrapped cause: %v\", err)\n}","preventionTips":["Pre-validate proxy address (no fragment/query/path) and CA path (absolute, valid PEM) when enabling the plugin.","Test the enabled config in staging before rollout.","Document the exact accepted URL and CA path formats next to the config template."],"tags":["proxy","configuration","fail-closed","tls"],"backgroundTag":"invalid-proxy-configuration","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}