Hmbown/CodeWhale · error · anyhow::Error

failed to initialize the cloud agent client

Error message

failed to initialize the cloud agent client: {message}

What it means

The reqwest HTTP client used to talk to the cloud agent control plane failed to build. The lazy client initializer maps the reqwest::Error's Display string into `failed to initialize the cloud agent client: {message}`.

Solutions

1. Read the wrapped `{message}` for the reqwest build failure cause
2. Install/repair CA certificates (e.g. ca-certificates package) for the TLS backend
3. Verify the TLS feature of reqwest matches the target platform
4. Retry after fixing the environment; the client is lazily built once

Example fix

// Dockerfile before
FROM alpine
// after
FROM alpine
RUN apk add --no-cache ca-certificates

// ensure CA certs exist before first client use
std::path::Path::new("/etc/ssl/certs/ca-certificates.crt").exists();

let client = build_client().map_err(|e| {
    eprintln!("cloud client init failed: {e}; check TLS/CA setup");
    e
})?;

When it happens

Trigger: `reqwest::ClientBuilder::build()` fails inside the OnceCell initializer in cloud_dispatch.rs:1398 — typically TLS backend initialization failure (rustls/native-tls root store problems) or invalid builder configuration.

Common situations: Systems without a usable TLS root certificate store (minimal containers, musl builds without certs), broken OpenSSL installation, or platform-specific reqwest backend issues.

Related errors

• building bundle fetch client failed
• build platform HTTP client
• bundle fetch failed with HTTP status
• bundle fetch request failed
• bundle redirects may not change URL scheme

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/0172bfacfe2de6a2. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/cloud_dispatch.rs:1398

        // connection pool and a TLS configuration, so building one per call
        // paid a fresh TCP+TLS handshake on all nine call sites (one of them a
        // poll loop). `clone()` here is a refcount bump on that shared pool.
        //
        // The total timeout is attached per request instead, because a harness
        // turn carries a budget derived from its own command and must not
        // inherit the control-plane cap.
        static CLIENT: std::sync::OnceLock<Result<reqwest::blocking::Client, String>> =
            std::sync::OnceLock::new();
        CLIENT
            .get_or_init(|| {
                crate::tls::reqwest_blocking_client_builder()
                    .connect_timeout(std::time::Duration::from_secs(8))
                    .redirect(reqwest::redirect::Policy::none())
                    .build()
                    .map_err(|error| error.to_string())
            })
            .clone()
            .map_err(|message| anyhow!("failed to initialize the cloud agent client: {message}"))
    }

    /// The total-timeout budget for a harness-carrying client, in seconds.
    /// Public to the crate so the runner's tests can pin it against the
    /// declared `HARNESS_TIMEOUT_SECS`.
    pub(crate) fn harness_client_budget_secs(command: &HarnessCommand) -> u64 {
        u64::from(command.timeout_secs).saturating_add(Self::HARNESS_CLIENT_SLACK_SECS)
    }

    fn api_key() -> Result<String> {
        read_api_key().ok_or_else(|| anyhow!(missing_credentials_message()))
    }

    /// Control-plane URL under the validated base.
    fn control_plane_url(path: &str) -> Result<reqwest::Url> {
        let base = validate_outbound_origin(&daytona_api_url())?;
        join_api_path(base, path).context("failed to build the cloud agent request URL")
    }

View on GitHub (pinned to 73e0f67d83)