larksuite/cli · error

inline cid %q contains invalid characters (spaces, tabs, ang

Error message

inline cid %q contains invalid characters (spaces, tabs, angle brackets, or parentheses are not allowed)

What it means

validateCID rejects Content-IDs containing characters that are illegal or ambiguous in MIME headers and cid references: spaces, tabs, angle brackets, and parentheses. Allowing them could break header parsing or create ambiguous CID references in the HTML body.

Source

Thrown at shortcuts/mail/draft/patch.go:861

func normalizeCID(cid string) string {
	cid = strings.TrimSpace(cid)
	if strings.HasPrefix(cid, "<") && strings.HasSuffix(cid, ">") {
		cid = cid[1 : len(cid)-1]
	}
	return cid
}

// validateCID checks that a Content-ID value is non-empty and free of
// characters that would break MIME headers or cause ambiguous references.
func validateCID(cid string) error {
	if cid == "" {
		return fmt.Errorf("inline cid is empty")
	}
	if err := validate.RejectCRLF(cid, "inline cid"); err != nil {
		return err
	}
	if strings.ContainsAny(cid, " \t<>()") {
		return fmt.Errorf("inline cid %q contains invalid characters (spaces, tabs, angle brackets, or parentheses are not allowed)", cid)
	}
	return nil
}

func ensureInlineContainerRef(partRef **Part) (*Part, error) {
	if partRef == nil || *partRef == nil {
		return nil, fmt.Errorf("body container is nil")
	}
	part := *partRef
	if strings.EqualFold(part.MediaType, "multipart/related") {
		return part, nil
	}
	related := newMultipartContainer("multipart/related")
	related.Children = []*Part{part}
	related.Dirty = true
	*partRef = related
	return related, nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Strip angle brackets and whitespace: use the bare cid like image001@domain
2. Generate a UUID-based cid via the library's CID generation (see generateCID) which is inherently safe
3. Sanitize/replace invalid characters in your cid before building the op
4. Note that CRLF is separately rejected by validate.RejectCRLF; keep cids single-line

Example fix

// before
cid := "<image 001@domain>"
// after
cid := "image001@domain"

func cidSafe(cid string) bool {
	return cid != "" && !strings.ContainsAny(cid, " \t<>()") && !strings.ContainsAny(cid, "\r\n")
}

func cidSafe(cid string) bool {
	return cid != "" && !strings.ContainsAny(cid, " \t<>()") && !strings.ContainsAny(cid, "\r\n")
}

if err := applyOp(snap, op); err != nil && strings.Contains(err.Error(), "invalid characters") {
	// strip <>/whitespace or regenerate a UUID cid and retry
}

When it happens

Trigger: Calling inline add/replace with a cid containing a space, tab, '<', '>', '(' or ')' — e.g. passing a raw '<cid:image001@x>' string including brackets, or a filename with spaces used as the cid.

Common situations: Reusing the full <...> wrapped cid string from HTML source instead of the bare value; using file names like 'screen shot 1.png' as cids; cids copied with surrounding parentheses from prose.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• inline cid is empty
• add_inline requires cid
• no part with cid %q found
• add_attachment requires path
• remove_attachment requires target with at least one of part_

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/58d8024d4a4c52d9. Report an issue: GitHub.