{"record":{"id":"be7fb7e4abaeb661","repo":"larksuite/cli","slug":"invalid-s-q-explicit-port-is-required","errorCode":null,"errorMessage":"invalid %s %q: explicit port is required","messagePattern":"invalid (.+?) %q: explicit port is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/config.go","lineNumber":212,"sourceCode":"\tif err != nil {\n\t\t// Do not wrap the raw url.Parse error: its string embeds the original\n\t\t// URL, which can contain userinfo (user:password). Return a redacted,\n\t\t// generic message instead.\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: malformed URL\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Scheme != \"http\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: scheme must be http\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Host == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: missing host\", envvars.CliProxyAddress, redacted)\n\t}\n\t// Security hardening: only allow a loopback proxy. This prevents accidental\n\t// cross-machine proxying of credentials/traffic.\n\tif u.Hostname() != \"127.0.0.1\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: host must be 127.0.0.1\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Port() == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: explicit port is required\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Path != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: path is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.RawQuery != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: query is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Fragment != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: fragment is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\treturn u, nil\n}\n\n// ApplyToTransport clones base and applies proxy plugin settings to the clone.\n// Caller owns the returned *http.Transport.\nfunc (c *Config) ApplyToTransport(base *http.Transport) (*http.Transport, error) {\n\tif base == nil {\n\t\tbase = http.DefaultTransport.(*http.Transport)","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/config.go#L194-L230","documentation":"The proxy address must be a bare origin: scheme://127.0.0.1:port. Any URL path is rejected by proxyURL with the address shown redacted. A path has no meaning for an HTTP proxy endpoint and usually signals a copy-paste of a full website URL.","triggerScenarios":"LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080/ or .../proxy or .../connect while proxy mode is enabled; ApplyToTransport fails at startup.","commonSituations":"Copying the proxy's web-admin URL (which has a path) instead of the proxy endpoint; a trailing slash from copy-paste; appending an API route to the proxy address.","solutions":["Strip everything after host:port, including a trailing slash: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.","If you meant a web/UI URL for the proxy tool, find its plain proxy (CONNECT) listening port instead and use that.","Re-check the value: `echo $LARKSUITE_CLI_PROXY_ADDRESS` and remove any `/...` suffix.","Apply the same fix to LARKSUITE_CLI_PROXY_ADDRESS in ~/.lark-cli/proxy_config.json if set there."],"exampleFix":"// before\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080/proxy\n// after\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080","handlingStrategy":"validation","validationCode":"case \"$LARKSUITE_CLI_PROXY_ADDRESS\" in */*) echo 'proxy address must not contain a path: use http://127.0.0.1:port only' >&2 ;; esac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the proxy's CONNECT endpoint (bare host:port), not its web-admin URL.","Watch for trailing slashes from copy-paste.","Never append API routes or health-check paths to the proxy address.","Validate the final value with echo before committing it to scripts."],"tags":["proxy","url","config","validation"],"backgroundTag":"invalid-proxy-url","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}