Hmbown/CodeWhale · error

build platform HTTP client

Error message

build platform HTTP client

What it means

Panic building the HTTP client used for registry-synced skill installs. `codewhale_release::platform_http_client_builder().build()` fails when the TLS stack cannot initialize — typically a rustls-native-certs failure reading `SSL_CERT_FILE`/`SSL_CERT_DIR` (set to a nonexistent path), an unreadable system CA bundle, or a broken OpenSSL for native-tls builds. The expect fires on the first network-touching skills operation.

Source

Thrown at crates/tui/src/skills/install.rs:56

//!   does not execute `plugin.json` plugin runtimes or custom command bundles.

use std::fs;
use std::io::{Read, Write};
use std::path::{Component, Path, PathBuf};

use anyhow::{Context, Result, bail};
use flate2::read::GzDecoder;
use futures_util::stream::{self, StreamExt};
use serde::{Deserialize, Serialize};
use sha2::{Digest, Sha256};
use thiserror::Error;

use crate::network_policy::{Decision, NetworkPolicy, host_from_url};

fn reqwest_client() -> reqwest::Client {
    codewhale_release::platform_http_client_builder()
        .build()
        .expect("build platform HTTP client")
}

/// Cache directory for registry-synced skills.
///
/// Lives at `~/.codewhale/cache/skills/` so it's separate from user-installed
/// skills and can be blown away without losing anything irreplaceable.
pub fn default_cache_skills_dir() -> PathBuf {
    crate::config::effective_home_dir().map_or_else(
        || PathBuf::from("/tmp/codewhale/cache/skills"),
        |p| p.join(".codewhale").join("cache").join("skills"),
    )
}

/// Default registry. Falls back to a community-curated `index.json` hosted on
/// GitHub raw; users can override via `[skills] registry_url` in config.toml.
pub const DEFAULT_REGISTRY_URL: &str =
    "https://raw.githubusercontent.com/Hmbown/deepseek-skills/main/index.json";

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Check the environment: `env | grep -iE 'ssl|proxy'` and verify `SSL_CERT_FILE`/`SSL_CERT_DIR` point at existing, readable files; unset them if stale.
2. Install or refresh the system CA bundle (`apt-get install --reinstall ca-certificates` or the platform equivalent) and retry the skill install.
3. Behind a TLS-intercepting proxy, point `SSL_CERT_FILE` at the corporate root bundle.
4. If it persists, reproduce with `RUST_BACKTRACE=1` to confirm the failure is inside the platform client builder and report the builder configuration.

Example fix

// before
codewhale_release::platform_http_client_builder().build().expect("build platform HTTP client")

// after: build lazily and return the error to the install flow
fn reqwest_client() -> std::result::Result<reqwest::Client, reqwest::Error> {
    codewhale_release::platform_http_client_builder().build()
}

// Check the TLS environment before the first skills network call
for var in ["SSL_CERT_FILE", "SSL_CERT_DIR"] {
    if let Ok(v) = std::env::var(var) {
        assert!(std::path::Path::new(&v).exists(), "{var}={v} does not exist");
    }
}

let client = std::panic::catch_unwind(reqwest_client)
    .unwrap_or_else(|_| reqwest::Client::new()); // default client without native-cert customization

When it happens

Trigger: Environment with `SSL_CERT_FILE` or `SSL_CERT_DIR` exported to a missing file (common in hardened shells, Nix, direnv); empty or unreadable `/etc/ssl/certs`; corporate MITM proxy roots installed only in a nonstandard store. Any skill install/sync then panics inside `reqwest_client()` (skills/install.rs:56).

Common situations: CI images without `ca-certificates`; dev containers where the env var leaks from another tool; dotfiles copied between macOS and Linux machines; air-gapped hosts with modified cert layouts.

Related errors

• failed to build HTTP client
• validated sandbox permission
• sandbox escalation was validated while planning
• registered shell tool context
• cancelled tool result is always model-visible

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/f01e91299ba11b83. Report an issue: GitHub.