{"record":{"id":"d161290f695d9a40","repo":"larksuite/cli","slug":"invalid-s-q-scheme-must-be-http","errorCode":null,"errorMessage":"invalid %s %q: scheme must be http","messagePattern":"invalid (.+?) %q: scheme must be http","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/config.go","lineNumber":201,"sourceCode":"\treturn false, fmt.Errorf(\"invalid %s %q (want true/false/1/0)\", name, raw)\n}\n\n// proxyURL validates the fixed configured proxy configuration and returns its URL.\nfunc (c *Config) proxyURL() (*url.URL, error) {\n\traw := strings.TrimSpace(c.Proxy)\n\tif raw == \"\" {\n\t\treturn nil, fmt.Errorf(\"%s is empty\", envvars.CliProxyAddress)\n\t}\n\tredacted := redactProxyURL(raw)\n\tu, err := url.Parse(raw)\n\tif err != nil {\n\t\t// Do not wrap the raw url.Parse error: its string embeds the original\n\t\t// URL, which can contain userinfo (user:password). Return a redacted,\n\t\t// generic message instead.\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: malformed URL\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Scheme != \"http\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: scheme must be http\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Host == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: missing host\", envvars.CliProxyAddress, redacted)\n\t}\n\t// Security hardening: only allow a loopback proxy. This prevents accidental\n\t// cross-machine proxying of credentials/traffic.\n\tif u.Hostname() != \"127.0.0.1\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: host must be 127.0.0.1\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Port() == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: explicit port is required\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.Path != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: path is not allowed\", envvars.CliProxyAddress, redacted)\n\t}\n\tif u.RawQuery != \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid %s %q: query is not allowed\", envvars.CliProxyAddress, redacted)\n\t}","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/config.go#L183-L219","documentation":"The proxy-plugin mode only accepts an http:// proxy. proxyURL rejects https://, socks5://, or scheme-less addresses. The address is shown redacted (userinfo stripped) so credentials never appear in the error. This is intentional hardening: the fixed loopback proxy terminates plain HTTP CONNECT traffic locally.","triggerScenarios":"LARKSUITE_CLI_PROXY_ADDRESS=http://… required, but user sets `https://127.0.0.1:8080`, `socks5://127.0.0.1:1080`, or `127.0.0.1:8080` (no scheme) while proxy mode is enabled.","commonSituations":"Copying a corporate proxy URL that is https; configuring a SOCKS proxy expecting support; omitting the scheme because curl-style env vars accept scheme-less values.","solutions":["Change the scheme to http: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.","If your proxy is SOCKS-only, front it with a local HTTP proxy (e.g. a tool that maps HTTP CONNECT to your SOCKS upstream) and point the variable at that http:// loopback port.","Don't drop the scheme — a scheme-less value also fails; always write http://host:port.","Note https:// proxies are unsupported by design; TLS to the proxy is not how this plugin works — use the LARKSUITE_CLI_CA_PATH option only if your proxy does TLS interception of the upstream traffic, not for an https:// proxy address."],"exampleFix":"// before\nexport LARKSUITE_CLI_PROXY_ADDRESS=socks5://127.0.0.1:1080\n// after\nexport LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080","handlingStrategy":"validation","validationCode":"case \"$LARKSUITE_CLI_PROXY_ADDRESS\" in http://*) echo OK ;; *) echo 'LARKSUITE_CLI_PROXY_ADDRESS must start with http://' >&2 ;; esac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remember only http:// scheme is supported — never https:// or socks5://.","For a SOCKS/https upstream, front it with a local http:// loopback forwarder.","Don't strip the scheme to 'fix' the error; scheme-less values also fail.","Document the required format in your team's setup script."],"tags":["proxy","url","config","security"],"backgroundTag":"unsupported-proxy-scheme","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}