Kuberwastaken/claurst · critical

failed to build reqwest client

Error message

failed to build reqwest client

What it means

BedrockProvider::from_env resolves AWS credentials/region from the environment, builds a reqwest::Client with the request timeout, and .expect()s the build result, panicking with 'failed to build reqwest client' on failure. This is a should-be-impossible client construction failure, indicating an environment/TLS problem rather than a config problem.

Solutions

  1. Ensure the workspace enables a reqwest TLS backend (rustls-tls preferred for portability).
  2. Check `cargo tree -i reqwest` for feature unification that disabled TLS.
  3. For minimal containers, install CA certificates (e.g. ca-certificates package) and a TLS-capable binary build.
  4. Reproduce the root cause by building the client manually and logging the reqwest error.
  5. In new code, prefer constructors returning Result and propagate instead of expect.

Example fix

// before
let http_client = reqwest::Client::builder()
    .timeout(crate::request_timeout())
    .build()
    .expect("failed to build reqwest client");
// after
let http_client = reqwest::Client::builder()
    .timeout(crate::request_timeout())
    .build()
    .with_context(|| "building Bedrock HTTP client")?;
Defensive patterns

Strategy: try-catch

Validate before calling

reqwest::Client::builder().timeout(crate::request_timeout()).build()
    .map_err(|e| anyhow!("HTTP/TLS init failed before Bedrock provider setup: {e}"))?;
// also verify AWS credentials exist before calling from_env
let has_creds = std::env::var("AWS_BEARER_TOKEN_BEDROCK").is_ok()
    || (std::env::var("AWS_ACCESS_KEY_ID").is_ok() && std::env::var("AWS_SECRET_ACCESS_KEY").is_ok());

Try / catch

let http_client = reqwest::Client::builder()
    .timeout(crate::request_timeout())
    .build()
    .map_err(|e| anyhow!("failed to build reqwest client: {e}"))?;

Prevention

When it happens

Trigger: Calling BedrockProvider::from_env() in a binary whose reqwest client cannot be built — TLS backend initialization failure at runtime.

Common situations: Builds without any TLS feature enabled; musl/cross-compiled binaries missing OpenSSL; minimal Docker images lacking CA certificates/TLS libs.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of Kuberwastaken/claurst@b0637c97ec (2026-09-10). Data as JSON: /api/errors/64ca0988cc726afd. Report an issue: GitHub.

Appendix: source

Thrown at src-rust/crates/api/src/providers/bedrock.rs:60

    id: ProviderId,
    region: String,
    http_client: reqwest::Client,
    access_key_id: Option<String>,
    secret_access_key: Option<String>,
    session_token: Option<String>,
    bearer_token: Option<String>,
}

impl BedrockProvider {
    pub fn from_env() -> Option<Self> {
        let region = std::env::var("AWS_REGION")
            .or_else(|_| std::env::var("AWS_DEFAULT_REGION"))
            .unwrap_or_else(|_| "us-east-1".to_string());

        let http_client = reqwest::Client::builder()
            .timeout(crate::request_timeout())
            .build()
            .expect("failed to build reqwest client");

        // Bearer token takes priority over SigV4 credentials.
        if let Ok(token) = std::env::var("AWS_BEARER_TOKEN_BEDROCK") {
            return Some(Self {
                id: ProviderId::new(ProviderId::AMAZON_BEDROCK),
                region,
                http_client,
                access_key_id: None,
                secret_access_key: None,
                session_token: None,
                bearer_token: Some(token),
            });
        }

        // Standard SigV4 credentials.
        let key = std::env::var("AWS_ACCESS_KEY_ID").ok()?;
        let secret = std::env::var("AWS_SECRET_ACCESS_KEY").ok()?;
        let session = std::env::var("AWS_SESSION_TOKEN").ok();

View on GitHub (pinned to b0637c97ec)