larksuite/cli · error

invalid proxy plugin config %q: %w

Error message

invalid proxy plugin config %q: %w

What it means

Load() reads ~/.lark-cli/proxy_config.json (the proxy-plugin config) and parses it into transport.Config. This error is thrown when the file exists but is not valid JSON for the expected schema (top-level keys LARKSUITE_CLI_PROXY_ENABLE, LARKSUITE_CLI_PROXY_ADDRESS, LARKSUITE_CLI_CA_PATH). Transport setup fails closed: a malformed proxy config is never silently ignored, because it controls where all outbound CLI traffic (including credentials) egresses.

Source

Thrown at internal/transport/config.go:113

		// process can tamper with (symlink, foreign owner, group/world-writable)
		// could redirect credential traffic. Audit it the same way the CA file is.
		safePath, err := binding.AssertSecurePath(binding.AuditParams{
			TargetPath:            p,
			Label:                 ConfigFileName,
			AllowReadableByOthers: true, // config is not a secret; only writability/owner/symlink matter
		})
		if err != nil {
			loadErr = fmt.Errorf("unsafe proxy plugin config %q: %w", p, err)
			return
		}
		b, err := vfs.ReadFile(safePath)
		if err != nil {
			loadErr = fmt.Errorf("failed to read proxy plugin config %q: %w", p, err)
			return
		}
		var fileCfg Config
		if err := json.Unmarshal(b, &fileCfg); err != nil {
			loadErr = fmt.Errorf("invalid proxy plugin config %q: %w", p, err)
			return
		}

		// Merge: file base + env overrides.
		if cfg == nil {
			cfg = &fileCfg
		} else {
			*cfg = fileCfg
			applyEnvOverrides(cfg)
		}
		loadCfg = cfg
	})
	return loadCfg, loadErr
}

// Enabled reports whether proxy plugin mode is enabled.
func (c *Config) Enabled() bool { return c != nil && c.Enable }

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Open ~/.lark-cli/proxy_config.json and fix the JSON syntax error named in the wrapped %w detail (line/char offset).
2. Validate the file with `python3 -m json.tool ~/.lark-cli/proxy_config.json` or `jq . ~/.lark-cli/proxy_config.json`.
3. Ensure the three keys are the exact env-var-style names and correctly typed: LARKSUITE_CLI_PROXY_ENABLE (bool), LARKSUITE_CLI_PROXY_ADDRESS (string), LARKSUITE_CLI_CA_PATH (string).
4. If you don't need proxy-plugin mode, delete or rename the file; proxy mode is off when the file is absent and no proxy env vars are set.
5. Regenerate the file from a known-good sample instead of hand-editing.

Example fix

// before (invalid: comments and string bool)
{
  // turn proxy on
  "LARKSUITE_CLI_PROXY_ENABLE": "true"
}
// after
{
  "LARKSUITE_CLI_PROXY_ENABLE": true,
  "LARKSUITE_CLI_PROXY_ADDRESS": "http://127.0.0.1:8080"
}

python3 - <<'EOF'
import json, os
p = os.path.expanduser('~/.lark-cli/proxy_config.json')
if os.path.exists(p):
    cfg = json.load(open(p))  # raises like the CLI does
    for k, t in (('LARKSUITE_CLI_PROXY_ENABLE', bool), ('LARKSUITE_CLI_PROXY_ADDRESS', str), ('LARKSUITE_CLI_CA_PATH', str)):
        if k in cfg and not isinstance(cfg[k], t):
            raise SystemExit(f'{k} must be {t.__name__}, got {type(cfg[k]).__name__}')
print('proxy_config.json OK')
EOF

When it happens

Trigger: Running any CLI command after transport.Init/Load() when the config file exists and json.Unmarshal fails: truncated/hand-edited JSON, trailing commas, wrong types (e.g. a string where LARKSUITE_CLI_PROXY_ENABLE needs a boolean), BOM, or a YAML/INI file saved with a .json name.

Common situations: A user hand-edits ~/.lark-cli/proxy_config.json and breaks the syntax; an editor or provisioning script writes partial/invalid JSON; someone pastes a proxy config sample into the file with comments or different key names.

Related errors

• malformed config
• invalid JSON in %s: %w
• invalid JSON in %s: %w
• SecretRef.source must be env|file|exec, got %q
• SecretRef.id must be non-empty

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/446ef139046e621b. Report an issue: GitHub.