invalid proxy address %q: host and port must not be empty

Error message

invalid proxy address %q: host and port must not be empty

What it means

For a bare (scheme-less) LARKSUITE_CLI_AUTH_PROXY value that SplitHostPort accepts, ValidateProxyAddr additionally requires both host and port to be non-empty. This error fires when one side is empty — e.g. ":16384" (host omitted) or "127.0.0.1:" (port omitted).

Source

Thrown at sidecar/protocol.go:150

//
// userinfo (user:pass@) is rejected unconditionally — the sidecar protocol
// does not use basic auth, and the syntactic slot exists only as a phishing
// vector (e.g. http://127.0.0.1@attacker.com).
//
// Returns an error if the value is not a valid proxy address.
func ValidateProxyAddr(addr string) error {
	if addr == "" {
		return fmt.Errorf("proxy address is empty")
	}

	// Bare host:port (no scheme) — validate as a net address.
	if !strings.Contains(addr, "://") {
		host, port, err := net.SplitHostPort(addr)
		if err != nil {
			return fmt.Errorf("invalid proxy address %q: expected host:port or http://host:port", addr)
		}
		if host == "" || port == "" {
			return fmt.Errorf("invalid proxy address %q: host and port must not be empty", addr)
		}
		if !isSameHost(host) {
			return errNotSameHost(addr)
		}
		return nil
	}

	u, err := url.Parse(addr)
	if err != nil {
		return fmt.Errorf("invalid proxy address %q: %w", addr, err)
	}
	if u.User != nil {
		return fmt.Errorf("invalid proxy address %q: userinfo is not allowed", addr)
	}
	if u.Scheme == "https" {
		return fmt.Errorf("invalid proxy address %q: use http:// — sidecar is "+
			"same-host only (loopback or virtual same-host bridge), so TLS adds "+
			"no security; cross-machine deployment is out of scope", addr)

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Specify both host and port explicitly: `export LARKSUITE_CLI_AUTH_PROXY="127.0.0.1:16384"`.
Remember the client dials the sidecar — a wildcard/empty listen-style host is not valid here; use 127.0.0.1, localhost, [::1], or a same-host alias.
Check the value end-to-end (`echo "$LARKSUITE_CLI_AUTH_PROXY"`) for truncation from quoting or newlines.
Prefer the explicit scheme form `http://127.0.0.1:16384` to avoid bare-address parsing pitfalls.

Example fix

// before
export LARKSUITE_CLI_AUTH_PROXY=":16384"
// after
export LARKSUITE_CLI_AUTH_PROXY="127.0.0.1:16384"

Defensive patterns

Strategy: validation

Validate before calling

host, port, err := net.SplitHostPort(addr) // scheme-less values only
if err != nil || host == "" || port == "" {
	return fmt.Errorf("proxy %q must be host:port with both parts, e.g. 127.0.0.1:16384", addr)
}

Try / catch

if err := sidecar.ValidateProxyAddr(addr); err != nil {
	if strings.Contains(err.Error(), "host and port must not be empty") {
		return fmt.Errorf("incomplete address %q; use 127.0.0.1:16384 (client dial address, not a listen wildcard)", addr)
	}
	return err
}

Prevention

Never reuse a server/listen-style address (":port") as the client proxy value.
Always specify an explicit loopback or same-host alias host.
Echo the env value before startup to catch truncated quoting.
Prefer the http:// scheme form so parsing is unambiguous.

When it happens

Trigger: ValidateProxyAddr is called (via ResolveAccount / ResolveInterceptor / init) with a scheme-less value like ":16384" or "127.0.0.1:", or with ":" where the empty component follows from a truncated variable value.

Common situations: Variable partially truncated by shell quoting or a truncated secret; writing the listen address (":16384" — valid for net.Listen) where a dial address is required; typo dropping the host or port.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/3737f109dc1a55ee. Report an issue: GitHub.