What causes "proxy plugin enabled but config is invalid: %w" in larksuite/cli?

Read the wrapped cause (%w) to identify which validation failed (URL vs CA path vs PEM).

proxy plugin enabled but config is invalid: %w

Error message

proxy plugin enabled but config is invalid: %w

What it means

Proxy plugin mode was explicitly enabled and the config loaded, but cfg.ApplyToTransport(def) failed validation (e.g. bad proxy URL, bad CA path — errors 450-455). Because the operator explicitly enabled proxy mode, the CLI fails closed rather than silently falling back to direct egress.

Source

Thrown at internal/transport/transport.go:49

		// as Fallback cannot silently degrade this into a
		// direct-egress transport.
		return failClosedTransport(fmt.Errorf("proxy plugin transport unavailable: http.DefaultTransport is %T, want *http.Transport", http.DefaultTransport))
	}

	cfg, err := Load()
	if err != nil {
		// Fail closed: config file exists but is malformed/unreadable — do not
		// silently fall back to direct egress.
		return blockedTransport(def, fmt.Errorf("proxy plugin config is invalid: %w", err))
	}
	if cfg == nil || !cfg.Enabled() {
		return def
	}
	t, err := cfg.ApplyToTransport(def)
	if err != nil {
		// Fail closed: do not silently fall back to direct egress when the
		// operator explicitly enabled proxy plugin mode.
		return blockedTransport(def, fmt.Errorf("proxy plugin enabled but config is invalid: %w", err))
	}
	return t
}

// pluginTransport returns the proxy plugin transport when proxy plugin mode is
// configured. The bool return is false when the plugin is not configured or not enabled.
func pluginTransport() (http.RoundTripper, bool) {
	cfg, err := Load()
	if err != nil {
		return cachedBlockedTransport(), true
	}
	if cfg == nil || !cfg.Enabled() {
		return nil, false
	}
	return proxyPluginTransport(), true
}

// failClosedTransport returns a *http.Transport that always fails RoundTrip with

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Read the wrapped cause (%w) to identify which validation failed (URL vs CA path vs PEM).
Correct the offending value: bare scheme://host:port proxy URL, absolute PEM path, valid PEM contents.
Re-run the CLI; alternatively disable the proxy plugin if proxying is not required.

Example fix

// before
{"enabled": true, "address": "http://proxy:8080#tier1"}
// after
{"enabled": true, "address": "http://proxy:8080"}

Defensive patterns

Strategy: validation

Validate before calling

cfg, err := transport.Load()
if err != nil { log.Fatal(err) }
if cfg != nil && cfg.Enabled() {
	if _, err := cfg.ApplyToTransport(http.DefaultTransport.(*http.Transport).Clone()); err != nil {
		log.Fatalf("proxy config rejected before launch: %v", err)
	}
}

Try / catch

tr, err := buildProxyPluginTransport()
if err != nil && strings.Contains(err.Error(), "enabled but config is invalid") {
	log.Fatalf("fix proxy URL / CA path per wrapped cause: %v", err)
}

Prevention

Pre-validate proxy address (no fragment/query/path) and CA path (absolute, valid PEM) when enabling the plugin.
Test the enabled config in staging before rollout.
Document the exact accepted URL and CA path formats next to the config template.

When it happens

Trigger: Proxy plugin enabled with an invalid address (fragment/query/path in URL), relative CA path, unreadable/invalid PEM, etc.; buildProxyPluginTransport -> ApplyToTransport returns an error and it is wrapped as 'proxy plugin enabled but config is invalid: %w'.

Common situations: Typo in proxy address such as a trailing '#fragment' or '?query'; CA path misconfigured during corporate TLS setup; config enabled by platform tooling with values the transport validator rejects.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/9cf3b11f2c7335fc. Report an issue: GitHub.