{"record":{"id":"64ca0988cc726afd","repo":"Kuberwastaken/claurst","slug":"failed-to-build-reqwest-client-64ca09","errorCode":null,"errorMessage":"failed to build reqwest client","messagePattern":"failed to build reqwest client","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src-rust/crates/api/src/providers/bedrock.rs","lineNumber":60,"sourceCode":"    id: ProviderId,\r\n    region: String,\r\n    http_client: reqwest::Client,\r\n    access_key_id: Option<String>,\r\n    secret_access_key: Option<String>,\r\n    session_token: Option<String>,\r\n    bearer_token: Option<String>,\r\n}\r\n\r\nimpl BedrockProvider {\r\n    pub fn from_env() -> Option<Self> {\r\n        let region = std::env::var(\"AWS_REGION\")\r\n            .or_else(|_| std::env::var(\"AWS_DEFAULT_REGION\"))\r\n            .unwrap_or_else(|_| \"us-east-1\".to_string());\r\n\r\n        let http_client = reqwest::Client::builder()\r\n            .timeout(crate::request_timeout())\r\n            .build()\r\n            .expect(\"failed to build reqwest client\");\r\n\r\n        // Bearer token takes priority over SigV4 credentials.\r\n        if let Ok(token) = std::env::var(\"AWS_BEARER_TOKEN_BEDROCK\") {\r\n            return Some(Self {\r\n                id: ProviderId::new(ProviderId::AMAZON_BEDROCK),\r\n                region,\r\n                http_client,\r\n                access_key_id: None,\r\n                secret_access_key: None,\r\n                session_token: None,\r\n                bearer_token: Some(token),\r\n            });\r\n        }\r\n\r\n        // Standard SigV4 credentials.\r\n        let key = std::env::var(\"AWS_ACCESS_KEY_ID\").ok()?;\r\n        let secret = std::env::var(\"AWS_SECRET_ACCESS_KEY\").ok()?;\r\n        let session = std::env::var(\"AWS_SESSION_TOKEN\").ok();\r","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/Kuberwastaken/claurst/blob/b0637c97ec34144387cbf2f74f65df6d16a6cef1/src-rust/crates/api/src/providers/bedrock.rs#L42-L78","documentation":"BedrockProvider::from_env resolves AWS credentials/region from the environment, builds a reqwest::Client with the request timeout, and .expect()s the build result, panicking with 'failed to build reqwest client' on failure. This is a should-be-impossible client construction failure, indicating an environment/TLS problem rather than a config problem.","triggerScenarios":"Calling BedrockProvider::from_env() in a binary whose reqwest client cannot be built — TLS backend initialization failure at runtime.","commonSituations":"Builds without any TLS feature enabled; musl/cross-compiled binaries missing OpenSSL; minimal Docker images lacking CA certificates/TLS libs.","solutions":["Ensure the workspace enables a reqwest TLS backend (rustls-tls preferred for portability).","Check `cargo tree -i reqwest` for feature unification that disabled TLS.","For minimal containers, install CA certificates (e.g. ca-certificates package) and a TLS-capable binary build.","Reproduce the root cause by building the client manually and logging the reqwest error.","In new code, prefer constructors returning Result and propagate instead of expect."],"exampleFix":"// before\nlet http_client = reqwest::Client::builder()\n    .timeout(crate::request_timeout())\n    .build()\n    .expect(\"failed to build reqwest client\");\n// after\nlet http_client = reqwest::Client::builder()\n    .timeout(crate::request_timeout())\n    .build()\n    .with_context(|| \"building Bedrock HTTP client\")?;","handlingStrategy":"try-catch","validationCode":"reqwest::Client::builder().timeout(crate::request_timeout()).build()\n    .map_err(|e| anyhow!(\"HTTP/TLS init failed before Bedrock provider setup: {e}\"))?;\n// also verify AWS credentials exist before calling from_env\nlet has_creds = std::env::var(\"AWS_BEARER_TOKEN_BEDROCK\").is_ok()\n    || (std::env::var(\"AWS_ACCESS_KEY_ID\").is_ok() && std::env::var(\"AWS_SECRET_ACCESS_KEY\").is_ok());","typeGuard":null,"tryCatchPattern":"let http_client = reqwest::Client::builder()\n    .timeout(crate::request_timeout())\n    .build()\n    .map_err(|e| anyhow!(\"failed to build reqwest client: {e}\"))?;","preventionTips":["Ensure rustls-tls or native-tls is enabled in the build graph.","Test provider construction at startup in CI, not lazily at first request.","Keep AWS_BEARER_TOKEN_BEDROCK or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_REGION set correctly (region defaults to us-east-1).","Install CA certificates in slim Docker images."],"tags":["panic","http-client","tls","aws","reqwest"],"backgroundTag":"internal-invariant-violation","analyzedSha":"b0637c97ec34144387cbf2f74f65df6d16a6cef1","analyzedAt":"2026-09-10T00:24:58.650Z","contentChangedAt":"2026-09-10T00:24:58.650Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}