{"record":{"id":"9477392163a76cb6","repo":"xai-org/grok-build","slug":"default-reqwest-client-builds","errorCode":null,"errorMessage":"default reqwest client builds","messagePattern":"default reqwest client builds","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-file-utils/src/storage_client.rs","lineNumber":430,"sourceCode":"    /// deployment-key path supplies); falls back to the user token otherwise.\n    #[test]\n    fn wire_bearer_prefers_deployment_key_then_falls_back_to_user_token() {\n        let mut deployment = StaticGrokAuth::new(Some(String::new()));\n        deployment.deployment_key = Some(\"deploy-key\".to_string());\n        assert_eq!(deployment.wire_bearer().as_deref(), Some(\"deploy-key\"));\n\n        let oauth = StaticGrokAuth::new(Some(\"oauth-token\".to_string()));\n        assert_eq!(oauth.wire_bearer().as_deref(), Some(\"oauth-token\"));\n    }\n}\n\n/// Default reqwest client used by `StorageClient::new`. Plain defaults --\n/// production callers should instead pass a tuned client (e.g. shell's\n/// `crate::http::shared_upload_client()`) to `with_provider`.\nfn default_upload_client() -> Client {\n    #[expect(clippy::expect_used)]\n    xai_grok_extra_ca::build_reqwest_client(|builder| builder)\n        .expect(\"default reqwest client builds\")\n}\n\n/// Client for uploading files to GCS via cli-chat-proxy.\n#[derive(Clone)]\npub struct StorageClient {\n    http_client: reqwest_middleware::ClientWithMiddleware,\n    /// Plain `reqwest::Client` for requests that must NOT go through the\n    /// auth middleware (direct GCS uploads via signed URLs, signed-URL\n    /// downloads, etc.).\n    raw_http_client: Client,\n    /// Base URL for the proxy (e.g., \"https://cli-chat-proxy.grok.com/v1\")\n    base_url: String,\n    /// Retry configuration for handling transient failures (especially 429 errors)\n    retry_config: RetryConfig,\n    /// Optional callback invoked on every 401 so the embedding application\n    /// can record auth-attribution telemetry. Shell installs a bridge here;\n    /// bins/tests typically leave it `None`.\n    attribution: Option<Arc<dyn Auth401AttributionCallback>>,","sourceCodeStart":412,"sourceCodeEnd":448,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-file-utils/src/storage_client.rs#L412-L448","documentation":"default_upload_client builds the fallback reqwest Client used by StorageClient::new via xai_grok_extra_ca::build_reqwest_client and .expect()s success. Build failure usually means TLS/crypto backend initialization or bundled extra root certificate loading failed, so the crate treats it as unrecoverable for the default path.","triggerScenarios":"Calling StorageClient::new (which invokes default_upload_client) when the rustls/aws-lc-rs crypto provider cannot initialize, the extra root DERs fail to parse/load, or reqwest builder TLS setup fails in the target environment.","commonSituations":"Missing or mismatched rustls/aws-lc-rs feature flags across the workspace; stripped or unusual deployment images lacking needed crypto material; static musl builds where the TLS provider fails to init; conflicting process-level rustls provider installation.","solutions":["Bypass the default path: construct a tuned Client yourself and pass it via StorageClient::with_provider (as production shells do with http::shared_upload_client())","Verify xai-grok-extra-ca and rustls/aws-lc-rs feature flags are consistent across the workspace","Check that process-level rustls crypto provider installation (rustls::crypto::CryptoProvider::install_default) is not conflicting","Reproduce with a minimal binary calling build_reqwest_client directly to isolate TLS init"],"exampleFix":"// before\nlet client = StorageClient::new(endpoint)?; // may panic building default client\n// after\nlet http = xai_grok_extra_ca::build_reqwest_client(|b| b)\n    .context(\"building upload HTTP client\")?;\nlet client = StorageClient::with_provider(endpoint, http);","handlingStrategy":"fallback","validationCode":"let client = xai_grok_extra_ca::build_reqwest_client(|b| b)\n    .map_err(|e| anyhow!(\"upload TLS stack unavailable: {e}\"))?;","typeGuard":"null","tryCatchPattern":"let client = match xai_grok_extra_ca::build_reqwest_client(|b| b) {\n    Ok(c) => c,\n    Err(e) => return Err(anyhow!(\"cannot build upload client: {e}\")),\n};\nlet storage = StorageClient::with_provider(endpoint, client);","preventionTips":["Pass an explicit tuned client via with_provider instead of relying on the default","Keep rustls/aws-lc-rs feature flags consistent across the workspace","Verify TLS material loads in your deployment image before rollout"],"tags":["http","tls","panics","reqwest","rust"],"backgroundTag":"tls-client-build-failed","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}