What causes "invalid %s %q: query is not allowed" in larksuite/cli?

Remove the fragment: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.

invalid %s %q: query is not allowed

Error message

invalid %s %q: query is not allowed

What it means

The proxy address must be a bare origin with no fragment. proxyURL rejects URLs with a `#...` suffix, showing a redacted address. Fragments are meaningless for a fixed HTTP proxy endpoint and typically indicate a copied web URL.

Source

Thrown at internal/transport/config.go:218

	if u.Scheme != "http" {
		return nil, fmt.Errorf("invalid %s %q: scheme must be http", envvars.CliProxyAddress, redacted)
	}
	if u.Host == "" {
		return nil, fmt.Errorf("invalid %s %q: missing host", envvars.CliProxyAddress, redacted)
	}
	// Security hardening: only allow a loopback proxy. This prevents accidental
	// cross-machine proxying of credentials/traffic.
	if u.Hostname() != "127.0.0.1" {
		return nil, fmt.Errorf("invalid %s %q: host must be 127.0.0.1", envvars.CliProxyAddress, redacted)
	}
	if u.Port() == "" {
		return nil, fmt.Errorf("invalid %s %q: explicit port is required", envvars.CliProxyAddress, redacted)
	}
	if u.Path != "" {
		return nil, fmt.Errorf("invalid %s %q: path is not allowed", envvars.CliProxyAddress, redacted)
	}
	if u.RawQuery != "" {
		return nil, fmt.Errorf("invalid %s %q: query is not allowed", envvars.CliProxyAddress, redacted)
	}
	if u.Fragment != "" {
		return nil, fmt.Errorf("invalid %s %q: fragment is not allowed", envvars.CliProxyAddress, redacted)
	}
	return u, nil
}

// ApplyToTransport clones base and applies proxy plugin settings to the clone.
// Caller owns the returned *http.Transport.
func (c *Config) ApplyToTransport(base *http.Transport) (*http.Transport, error) {
	if base == nil {
		base = http.DefaultTransport.(*http.Transport)
	}
	u, err := c.proxyURL()
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Remove the fragment: `export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080`.
Quote assignments in shell scripts so `#` isn't misinterpreted, and verify with `echo $LARKSUITE_CLI_PROXY_ADDRESS`.
Use the proxy tool's plain listening endpoint, not a web-UI page URL.
Update ~/.lark-cli/proxy_config.json's LARKSUITE_CLI_PROXY_ADDRESS identically if configured there.

Example fix

// before
export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080#setup
// after
export LARKSUITE_CLI_PROXY_ADDRESS=http://127.0.0.1:8080

Defensive patterns

Strategy: validation

Validate before calling

case "$LARKSUITE_CLI_PROXY_ADDRESS" in *'#'*) echo 'proxy address must not contain a fragment' >&2 ;; esac

Prevention

Strip anything from '#' onward — fragments are never valid here.
Quote assignments in shell scripts so '#' can't start a comment inside the value.
Don't copy anchor-bearing documentation URLs as the proxy address.
Keep the value a minimal http://127.0.0.1:port literal.

When it happens

Trigger: LARKSUITE_CLI_PROXY_ADDRESS containing `#...` (e.g. http://127.0.0.1:8080#section, or a browser-copied URL with an anchor) while proxy mode is enabled; ApplyToTransport fails at startup.

Common situations: Copying a documentation/anchor URL instead of the proxy endpoint; shell scripts where a `#` comment accidentally became part of an unquoted value; templating leftovers.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/4cc41931cc2d0ad0. Report an issue: GitHub.