invalid proxy address %q: expected host:port or http://host:

Error message

invalid proxy address %q: expected host:port or http://host:port

What it means

When LARKSUITE_CLI_AUTH_PROXY has no '://' scheme, ValidateProxyAddr treats it as a bare host:port and parses it with net.SplitHostPort. This error means the value is not a parseable host:port — e.g. missing port, unbalanced IPv6 brackets, stray characters, or a URL-ish string without a recognized scheme separator.

Source

Thrown at sidecar/protocol.go:147

// TLS adds no security. Cross-machine deployment is out of scope (see the
// host constraint above), so there is no scenario today where https
// provides a real benefit over http on loopback.
//
// userinfo (user:pass@) is rejected unconditionally — the sidecar protocol
// does not use basic auth, and the syntactic slot exists only as a phishing
// vector (e.g. http://127.0.0.1@attacker.com).
//
// Returns an error if the value is not a valid proxy address.
func ValidateProxyAddr(addr string) error {
	if addr == "" {
		return fmt.Errorf("proxy address is empty")
	}

	// Bare host:port (no scheme) — validate as a net address.
	if !strings.Contains(addr, "://") {
		host, port, err := net.SplitHostPort(addr)
		if err != nil {
			return fmt.Errorf("invalid proxy address %q: expected host:port or http://host:port", addr)
		}
		if host == "" || port == "" {
			return fmt.Errorf("invalid proxy address %q: host and port must not be empty", addr)
		}
		if !isSameHost(host) {
			return errNotSameHost(addr)
		}
		return nil
	}

	u, err := url.Parse(addr)
	if err != nil {
		return fmt.Errorf("invalid proxy address %q: %w", addr, err)
	}
	if u.User != nil {
		return fmt.Errorf("invalid proxy address %q: userinfo is not allowed", addr)
	}
	if u.Scheme == "https" {

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Use the full form `http://host:port`, e.g. `export LARKSUITE_CLI_AUTH_PROXY="http://127.0.0.1:16384"`.
Or use a plain `host:port` with both parts present: `127.0.0.1:16384` (DefaultListenAddr).
Wrap IPv6 hosts in brackets exactly once: `[::1]:16384`.
Remove any path, spaces, or trailing junk from the value; the address must be scheme-optional host:port or a full http:// URL with no path.

Example fix

// before
export LARKSUITE_CLI_AUTH_PROXY="127.0.0.1"
// after
export LARKSUITE_CLI_AUTH_PROXY="127.0.0.1:16384"

Defensive patterns

Strategy: validation

Validate before calling

func validProxyAddrFormat(addr string) bool {
	if strings.Contains(addr, "://") {
		u, err := url.Parse(addr)
		return err == nil && u.Scheme == "http" && u.Host != ""
	}
	_, _, err := net.SplitHostPort(addr)
	return err == nil
}

Try / catch

if err := sidecar.ValidateProxyAddr(addr); err != nil {
	if strings.Contains(err.Error(), "expected host:port or http://host:port") {
		return fmt.Errorf("%q is not host:port; use http://127.0.0.1:16384", addr)
	}
	return err
}

Prevention

Always write the full form http://host:port to avoid bare-address parsing.
Include the port explicitly; the sidecar default is 16384.
Wrap IPv6 in exactly one pair of brackets: [::1]:16384.
Trim whitespace before validating; reject values containing spaces or paths.

When it happens

Trigger: Calling ValidateProxyAddr (via ResolveAccount / ResolveInterceptor / init) with values like "127.0.0.1" (no port), ":16384" (no host is actually caught next, but "127.0.0.1:" hits this via empty port), "localhost 16384" (space), "[::1]:16384:extra", or "127.0.0.1:16384/path".

Common situations: Typing just the host without a port; pasting a full URL but omitting the scheme while keeping a path; copy/paste introducing whitespace; port included twice; missing IPv6 brackets.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/3e54e0a72d9d3227. Report an issue: GitHub.