larksuite/cli · error

invalid %s %q: fragment is not allowed

Error message

invalid %s %q: fragment is not allowed

What it means

The proxy URL supplied for the CLI proxy plugin (env var CLI_PROXY_ADDRESS) contains a URI fragment (a '#...' suffix). The transport layer accepts only a bare scheme://host:port proxy address, so any URL with a fragment is rejected during proxyURL validation. This keeps the proxy address unambiguous, since fragments have no meaning for an HTTP proxy endpoint.

Source

Thrown at internal/transport/config.go:221

	if u.Host == "" {
		return nil, fmt.Errorf("invalid %s %q: missing host", envvars.CliProxyAddress, redacted)
	}
	// Security hardening: only allow a loopback proxy. This prevents accidental
	// cross-machine proxying of credentials/traffic.
	if u.Hostname() != "127.0.0.1" {
		return nil, fmt.Errorf("invalid %s %q: host must be 127.0.0.1", envvars.CliProxyAddress, redacted)
	}
	if u.Port() == "" {
		return nil, fmt.Errorf("invalid %s %q: explicit port is required", envvars.CliProxyAddress, redacted)
	}
	if u.Path != "" {
		return nil, fmt.Errorf("invalid %s %q: path is not allowed", envvars.CliProxyAddress, redacted)
	}
	if u.RawQuery != "" {
		return nil, fmt.Errorf("invalid %s %q: query is not allowed", envvars.CliProxyAddress, redacted)
	}
	if u.Fragment != "" {
		return nil, fmt.Errorf("invalid %s %q: fragment is not allowed", envvars.CliProxyAddress, redacted)
	}
	return u, nil
}

// ApplyToTransport clones base and applies proxy plugin settings to the clone.
// Caller owns the returned *http.Transport.
func (c *Config) ApplyToTransport(base *http.Transport) (*http.Transport, error) {
	if base == nil {
		base = http.DefaultTransport.(*http.Transport)
	}
	u, err := c.proxyURL()
	if err != nil {
		return nil, err
	}

	t := base.Clone()
	t.Proxy = http.ProxyURL(u) // fixed proxy overrides environment proxy vars
	if err := applyExtraRootCA(t, c.CAPath); err != nil {

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Remove everything from the '#' onward in the CLI_PROXY_ADDRESS value.
2. Re-check the proxy plugin config file for a quoted '#...' inside the URL string and strip it.
3. If '#...' came from documentation, verify it was an anchor, not part of the address, and use only scheme://host:port.

Example fix

// before
export LARKSUITE_CLI_PROXY_ADDRESS="http://proxy.corp:8080#main"
// after
export LARKSUITE_CLI_PROXY_ADDRESS="http://proxy.corp:8080"

u, err := url.Parse(os.Getenv("LARKSUITE_CLI_PROXY_ADDRESS"))
if err != nil || u.Fragment != "" || u.RawQuery != "" || u.Path != "" {
	return fmt.Errorf("proxy address must be scheme://host:port only")
}

func isBareProxyURL(raw string) bool {
	u, err := url.Parse(raw)
	return err == nil && u.Fragment == "" && u.RawQuery == "" && u.Path == "" && u.Host != ""
}

When it happens

Trigger: Setting CLI_PROXY_ADDRESS (or the proxy plugin config URL) to a value containing a '#', e.g. 'http://proxy.local:8080#default', then starting the CLI so ApplyToTransport -> proxyURL validates it.

Common situations: Copy-pasting a proxy URL from a dashboard or docs where an anchor was appended; shell scripts that append comment-like suffixes; YAML/JSON config where a '#' was meant as a comment but ended up inside a quoted string.

Related errors

• proxy plugin config is invalid: %w
• proxy plugin enabled but config is invalid: %w
• multiple plugins called Restrict; only one plugin may own th
• environment variable %q is not allowlisted in provider
• environment variable %q is missing or empty

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/e985b6e668650d64. Report an issue: GitHub.