{"record":{"id":"81123fbedd19c89a","repo":"RightNow-AI/openfang","slug":"failed-to-build-http-client-81123f","errorCode":null,"errorMessage":"Failed to build HTTP client","messagePattern":"Failed to build HTTP client","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/openfang-cli/src/mcp.rs","lineNumber":143,"sourceCode":"            Ok(Some(msg)) => {\n                let response = handle_message(&backend, &msg);\n                if let Some(resp) = response {\n                    write_message(&mut writer, &resp);\n                }\n            }\n            Ok(None) => break,\n            Err(_) => break,\n        }\n    }\n}\n\nfn create_backend(config: Option<std::path::PathBuf>) -> McpBackend {\n    // Try daemon first\n    if let Some(base_url) = super::find_daemon() {\n        let client = reqwest::blocking::Client::builder()\n            .timeout(std::time::Duration::from_secs(120))\n            .build()\n            .expect(\"Failed to build HTTP client\");\n        return McpBackend::Daemon { base_url, client };\n    }\n\n    // Fall back to in-process kernel\n    let kernel = match OpenFangKernel::boot(config.as_deref()) {\n        Ok(k) => k,\n        Err(e) => {\n            eprintln!(\"Failed to boot kernel for MCP: {e}\");\n            std::process::exit(1);\n        }\n    };\n    let rt = tokio::runtime::Runtime::new().expect(\"Failed to create Tokio runtime\");\n    McpBackend::InProcess {\n        kernel: Box::new(kernel),\n        rt,\n    }\n}\n","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/RightNow-AI/openfang/blob/acf2587e46be174c10200489c9a2d23a39a98aeb/crates/openfang-cli/src/mcp.rs#L125-L161","documentation":"Same reqwest failure as the CLI main path: reqwest::blocking::Client::builder().build() errors when TLS backend init, proxy parsing, or builder config is invalid. The MCP server's create_backend() panics via expect, so the whole MCP process dies when a daemon was found but the HTTP client cannot be constructed.","triggerScenarios":"create_backend() finds a daemon via find_daemon(), then builds a blocking client with a 120s timeout; build() fails due to TLS backend initialization errors, malformed proxy env vars, or invalid builder options.","commonSituations":"Containers missing CA certificates (rustls-native-certs or system trust store empty); HTTPS_PROXY pointing to an invalid URL; running under musl/minimal images without TLS crypto provider initialized.","solutions":["Fix the environment: install CA certificates (ca-certificates package) and correct/unset malformed proxy env vars.","Fall back to the in-process kernel backend instead of panicking when client construction fails.","If using rustls with multiple crypto providers installed, ensure a default provider is installed (CryptoProvider::install_default) at startup.","Propagate the error and report it via MCP protocol instead of aborting the process."],"exampleFix":"// before\nlet client = reqwest::blocking::Client::builder()\n    .timeout(std::time::Duration::from_secs(120))\n    .build()\n    .expect(\"Failed to build HTTP client\");\nreturn McpBackend::Daemon { base_url, client };\n// after\nmatch reqwest::blocking::Client::builder()\n    .timeout(std::time::Duration::from_secs(120))\n    .build()\n{\n    Ok(client) => return McpBackend::Daemon { base_url, client },\n    Err(e) => eprintln!(\"daemon client unavailable ({e}); using in-process kernel\"),\n}","handlingStrategy":"fallback","validationCode":"// Verify TLS-capable environment before attempting daemon client\nfn tls_env_ok() -> bool {\n    std::path::Path::new(\"/etc/ssl/certs/ca-certificates.crt\").exists()\n        || std::env::var_os(\"SSL_CERT_FILE\").is_some()\n}","typeGuard":null,"tryCatchPattern":"// fall back to in-process kernel when client build fails\nmatch reqwest::blocking::Client::builder()\n    .timeout(std::time::Duration::from_secs(120))\n    .build()\n{\n    Ok(client) => return McpBackend::Daemon { base_url, client },\n    Err(e) => {\n        eprintln!(\"daemon client unavailable: {e}; falling back to in-process kernel\");\n        // proceed to OpenFangKernel::boot path\n    }\n}","preventionTips":["Always provide a functional fallback backend (in-process kernel) for MCP.","Install ca-certificates in deployment images.","Reject or sanitize keys that fail HeaderValue::from_str earlier, at config load time.","Log the underlying reqwest error rather than a bare expect string."],"tags":["reqwest","mcp","http","panic","tls"],"backgroundTag":"http-client-build-failed","analyzedSha":"acf2587e46be174c10200489c9a2d23a39a98aeb","analyzedAt":"2026-09-02T22:42:28.464Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}