What causes "invalid %s %q: path is not allowed" in larksuite/cli?

Remove the query string: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.

invalid %s %q: path is not allowed

Error message

invalid %s %q: path is not allowed

What it means

The proxy address must be a bare origin with no query string. proxyURL rejects URLs like http://127.0.0.1:8080?foo=bar, showing a redacted address. A query has no meaning for a fixed HTTP proxy endpoint and usually indicates the wrong string was pasted.

Source

Thrown at internal/transport/config.go:215

		// generic message instead.
		return nil, fmt.Errorf("invalid %s %q: malformed URL", envvars.CliProxyAddress, redacted)
	}
	if u.Scheme != "http" {
		return nil, fmt.Errorf("invalid %s %q: scheme must be http", envvars.CliProxyAddress, redacted)
	}
	if u.Host == "" {
		return nil, fmt.Errorf("invalid %s %q: missing host", envvars.CliProxyAddress, redacted)
	}
	// Security hardening: only allow a loopback proxy. This prevents accidental
	// cross-machine proxying of credentials/traffic.
	if u.Hostname() != "127.0.0.1" {
		return nil, fmt.Errorf("invalid %s %q: host must be 127.0.0.1", envvars.CliProxyAddress, redacted)
	}
	if u.Port() == "" {
		return nil, fmt.Errorf("invalid %s %q: explicit port is required", envvars.CliProxyAddress, redacted)
	}
	if u.Path != "" {
		return nil, fmt.Errorf("invalid %s %q: path is not allowed", envvars.CliProxyAddress, redacted)
	}
	if u.RawQuery != "" {
		return nil, fmt.Errorf("invalid %s %q: query is not allowed", envvars.CliProxyAddress, redacted)
	}
	if u.Fragment != "" {
		return nil, fmt.Errorf("invalid %s %q: fragment is not allowed", envvars.CliProxyAddress, redacted)
	}
	return u, nil
}

// ApplyToTransport clones base and applies proxy plugin settings to the clone.
// Caller owns the returned *http.Transport.
func (c *Config) ApplyToTransport(base *http.Transport) (*http.Transport, error) {
	if base == nil {
		base = http.DefaultTransport.(*http.Transport)
	}
	u, err := c.proxyURL()
	if err != nil {

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Remove the query string: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.
If you were putting a token in the query, move it into your proxy tool's own config file — the CLI proxy address accepts none.
Inspect the value: `echo $LARKSUITE_CLI_PROXY_ADDRESS` and strip everything from `?` onward.
Mirror the fix in ~/.lark-cli/proxy_config.json if the address is set there.

Example fix

// before
export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080?token=abc
// after
export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080

Defensive patterns

Strategy: validation

Validate before calling

case "$LARKSUITE_CLI_PROXY_ADDRESS" in *\?*) echo 'proxy address must not contain a query string' >&2 ;; esac

Prevention

Strip everything from '?' onward — the address is a bare origin only.
Don't pass tokens/credentials as query parameters; configure them in the proxy tool itself.
Avoid pasting URLs straight from a browser address bar.
Keep the value a minimal http://127.0.0.1:port literal.

When it happens

Trigger: LARKSUITE_CLI_PROXY_ADDRESS containing a `?...` suffix (e.g. a copied URL with tracking params or a token in the query) while proxy mode is enabled; ApplyToTransport fails at startup.

Common situations: Copying a full URL from a browser address bar (query included); appending credentials as query parameters; templating that leaves `?port=8080` style suffixes.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/666cfbbb6dd9cc70. Report an issue: GitHub.