RightNow-AI/openfang · critical

Failed to build HTTP client

Error message

Failed to build HTTP client

What it means

This panic comes from `reqwest::Client::builder().timeout(TOKEN_EXCHANGE_TIMEOUT).build().expect(...)` in CopilotDriver::new (crates/openfang-runtime/src/drivers/copilot.rs:482). reqwest builds a connection pool with a TLS backend at Client construction; builder().build() returns Err if TLS cannot be initialized, the native certificate store cannot be loaded, or the configuration (timeouts, proxies from env) is invalid. The driver builds the client eagerly because all GitHub Copilot token-exchange calls need it.

Source

Thrown at crates/openfang-runtime/src/drivers/copilot.rs:482

/// completions through the Copilot API (OpenAI-compatible).
pub struct CopilotDriver {
    openfang_dir: PathBuf,
    http_client: reqwest::Client,

    /// Persisted OAuth tokens (ghu_ + grt_).
    oauth_tokens: Mutex<Option<PersistedTokens>>,
    /// Cached short-lived Copilot API token.
    copilot_token: Mutex<Option<CachedCopilotToken>>,
    /// Cached model list.
    models: Mutex<Option<CachedModels>>,
}

impl CopilotDriver {
    pub fn new(openfang_dir: PathBuf) -> Self {
        let http_client = reqwest::Client::builder()
            .timeout(TOKEN_EXCHANGE_TIMEOUT)
            .build()
            .expect("Failed to build HTTP client");

        // Try to load persisted tokens on construction.
        let persisted = PersistedTokens::load(&openfang_dir);
        if persisted.is_some() {
            debug!("Loaded persisted Copilot OAuth tokens");
        }

        Self {
            openfang_dir,
            http_client,
            oauth_tokens: Mutex::new(persisted),
            copilot_token: Mutex::new(None),
            models: Mutex::new(None),
        }
    }

    /// Ensure we have a valid `ghu_` access token, refreshing or re-authing as needed.
    async fn ensure_access_token(&self) -> Result<String, crate::llm_driver::LlmError> {

View on GitHub (pinned to acf2587e46)

Solutions

1. Install/repair system CA certificates (apt install ca-certificates / update-ca-certificates).
2. Pin a single TLS strategy: use reqwest with the rustls-tls feature and default-features = false for portable static builds.
3. Check SSL_CERT_FILE/SSL_CERT_DIR and proxy env vars (HTTP_PROXY/HTTPS_PROXY) for invalid values that break client construction.
4. Replace expect with a Result-returning constructor so CopilotDriver::new can report the reqwest error instead of panicking.
5. Alternatively build the Client lazily via OnceCell and cache it, retrying construction on failure.

Example fix

// before
let http_client = reqwest::Client::builder()
    .timeout(TOKEN_EXCHANGE_TIMEOUT)
    .build()
    .expect("Failed to build HTTP client");
// after
let http_client = reqwest::Client::builder()
    .timeout(TOKEN_EXCHANGE_TIMEOUT)
    .build()
    .map_err(|e| DriverError::HttpClientInit(e.to_string()))?;

// Check TLS prerequisites before constructing the client (Linux)
if !std::path::Path::new("/etc/ssl/certs").exists()
    && std::env::var("SSL_CERT_FILE").is_err()
{
    eprintln!("no system CA certificates found; reqwest TLS init will fail");
}

let client = reqwest::Client::builder().timeout(TOKEN_EXCHANGE_TIMEOUT).build();
let http_client = match client {
    Ok(c) => c,
    Err(e) => {
        log::error!("reqwest client init failed: {e}");
        return Err(DriverError::HttpClientInit(e.to_string()));
    }
};

When it happens

Trigger: (1) rustls-native-certs cannot read the system trust store; (2) native-tls/openssl backend fails to initialize (missing OpenSSL libs, FIPS config problems); (3) an invalid value passed to the builder (e.g. a zero or malformed timeout) — with plain .timeout(Duration) this is usually valid, so TLS init is the realistic cause.

Common situations: Minimal/Docker images without CA certificates (/etc/ssl/certs empty); statically-linked binaries built with a mismatched TLS feature set (switching between native-tls and rustls); broken SSL_CERT_FILE/SSL_CERT_DIR env vars; corrupted curl/openssl system config on Linux.

Related errors

• Failed to build HTTP client
• Failed to build HTTP client
• Failed to create tokio runtime for embedded server
• Failed to set listener to non-blocking
• Failed to convert std TcpListener to tokio

AI-assisted analysis of RightNow-AI/openfang@acf2587e46 (2026-09-02). Data as JSON: /api/errors/184a4b72bf41434d. Report an issue: GitHub.