larksuite/cli · error

create HTTP client: %w

Error message

create HTTP client: %w

What it means

This error wraps the failure to construct the CLI's shared HTTP client before fetching bot info from the Lark bot/v3/info endpoint. The Factory's HttpClient() builds a client from the resolved configuration (endpoints, timeouts, transport); if that construction fails, identity diagnostics cannot proceed. The %w wrap preserves the underlying cause (bad config, TLS setup failure, etc.) for errors.Is/As inspection.

Source

Thrown at internal/identitydiag/diagnostics.go:386

	result, err := f.Credential.ResolveToken(ctx, credential.NewTokenSpec(core.AsBot, cfg.AppID))
	if err != nil {
		return nil, err
	}
	if result == nil || result.Token == "" {
		return nil, &credential.TokenUnavailableError{Type: credential.TokenTypeTAT}
	}
	return result, nil
}

type botInfo struct {
	OpenID  string
	AppName string
}

func fetchBotInfo(ctx context.Context, f *cmdutil.Factory, cfg *core.CliConfig, token *credential.TokenResult) (*botInfo, error) {
	httpClient, err := f.HttpClient()
	if err != nil {
		return nil, fmt.Errorf("create HTTP client: %w", err)
	}
	ctx = core.WithCredentialSource(ctx, token.Source)
	ctx, cancel := context.WithTimeout(ctx, verifyTimeout)
	defer cancel()
	url := strings.TrimRight(core.ResolveEndpoints(cfg.Brand).Open, "/") + "/open-apis/bot/v3/info"
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
	if err != nil {
		return nil, err
	}
	req.Header.Set("Authorization", "Bearer "+token.Token)

	resp, err := httpClient.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Inspect the wrapped cause (the part after 'create HTTP client:') for the exact construction failure.
2. Check proxy environment variables (HTTP_PROXY, HTTPS_PROXY, NO_PROXY) for malformed URLs and fix or unset them.
3. Validate CLI config (TLS/CA cert paths, timeouts) that the HTTP client builder consumes.
4. Re-run the diagnostics command after fixing config to confirm bot auth works.

Example fix

// before: bad proxy env breaks client construction
HTTPS_PROXY="://not-a-url" lark-cli doctor identity

// after
unset HTTPS_PROXY   # or set a valid URL
HTTPS_PROXY="http://proxy.corp:8080" lark-cli doctor identity

for _, v := range []string{"HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"} {
    if u := os.Getenv(v); u != "" {
        if _, err := url.Parse(u); err != nil {
            return fmt.Errorf("invalid %s: %w", v, err)
        }
    }
}
// also verify configured CA files exist and are readable before running diagnostics

info, err := fetchBotInfo(ctx, f, cfg, token)
if err != nil {
    var wrap *fmt.wrapError
    if errors.As(err, &wrap) && strings.HasPrefix(err.Error(), "create HTTP client:") {
        return fmt.Errorf("check proxy/TLS config: %w", err)
    }
    return err
}

When it happens

Trigger: fetchBotInfo calls f.HttpClient() and it returns an error — reached via diagnoseBot or diagnoseExternalBot during identity diagnostics runs.

Common situations: Malformed proxy configuration in the environment (HTTP_PROXY/HTTPS_PROXY unparseable); invalid TLS/CA settings in CLI config; corrupted CliConfig values the transport builder rejects; custom transport factory misconfiguration.

Related errors

• multiple plugins called Restrict; only one plugin may own th
• open_id is empty
• environment variable %q is not allowlisted in provider
• environment variable %q is missing or empty
• exec provider command is empty

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/d30869b89104a490. Report an issue: GitHub.