larksuite/cli · error

invalid proxy address %q: scheme must be http

Error message

invalid proxy address %q: scheme must be http

What it means

ValidateProxyAddr requires the proxy URL scheme to be exactly http (https is rejected separately with its own message). This error means the scheme was some other value — e.g. socks5, ws, ftp, or a typo like htp/HTTPs.

Source

Thrown at sidecar/protocol.go:171

			return errNotSameHost(addr)
		}
		return nil
	}

	u, err := url.Parse(addr)
	if err != nil {
		return fmt.Errorf("invalid proxy address %q: %w", addr, err)
	}
	if u.User != nil {
		return fmt.Errorf("invalid proxy address %q: userinfo is not allowed", addr)
	}
	if u.Scheme == "https" {
		return fmt.Errorf("invalid proxy address %q: use http:// — sidecar is "+
			"same-host only (loopback or virtual same-host bridge), so TLS adds "+
			"no security; cross-machine deployment is out of scope", addr)
	}
	if u.Scheme != "http" {
		return fmt.Errorf("invalid proxy address %q: scheme must be http", addr)
	}
	if u.Host == "" {
		return fmt.Errorf("invalid proxy address %q: missing host", addr)
	}
	if u.Path != "" && u.Path != "/" {
		return fmt.Errorf("invalid proxy address %q: path is not allowed", addr)
	}
	// u.Hostname() strips the port and unwraps IPv6 brackets.
	if !isSameHost(u.Hostname()) {
		return errNotSameHost(addr)
	}
	return nil
}

// ProxyHost extracts the host:port from an AUTH_PROXY URL.
// Input is expected to be an HTTP URL like "http://127.0.0.1:16384".
// Returns the host:port portion for URL rewriting.
func ProxyHost(authProxy string) string {

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Use lowercase http scheme: `export LARKSUITE_CLI_AUTH_PROXY="http://127.0.0.1:16384"`.
2. Remove socks5/ws/file or other schemes — only http (or a bare host:port) is accepted.
3. Check the scheme is not uppercase; write it lowercase exactly as `http://`.
4. If you need a SOCKS proxy, that deployment is unsupported for the sidecar; run the sidecar on loopback http instead.

Example fix

// before
export LARKSUITE_CLI_AUTH_PROXY="socks5://127.0.0.1:16384"
// after
export LARKSUITE_CLI_AUTH_PROXY="http://127.0.0.1:16384"

u, err := url.Parse(addr)
if err != nil {
	return err
}
if u.Scheme != "http" {
	return fmt.Errorf("scheme %q unsupported; use lowercase http://", u.Scheme)
}

func isHTTPScheme(addr string) bool {
	u, err := url.Parse(addr)
	return err == nil && u.Scheme == "http"
}

if err := sidecar.ValidateProxyAddr(addr); err != nil {
	if strings.Contains(err.Error(), "scheme must be http") {
		return fmt.Errorf("only http:// (or bare host:port) is accepted, got %q", addr)
	}
	return err
}

When it happens

Trigger: Calling ValidateProxyAddr (via ResolveAccount / ResolveInterceptor / init) with values like "socks5://127.0.0.1:1080", "ws://localhost:16384", "file:///tmp/proxy", or "HTTP://127.0.0.1:16384" (url.Parse lowercases scheme? no — url.Parse preserves case in Scheme, so uppercase "HTTP" fails the == "http" comparison and lands here).

Common situations: Reusing a SOCKS proxy config; writing scheme in uppercase; pasting a websocket or non-http URL; typos like "htp://".

Related errors

• invalid proxy address %q: host must be loopback (127.0.0.1 /
• proxy address is empty
• invalid proxy address %q: expected host:port or http://host:
• invalid proxy address %q: host and port must not be empty
• invalid proxy address %q: %w

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/652aa5f17667f788. Report an issue: GitHub.