xai-org/grok-build · error

default reqwest client builds

Error message

default reqwest client builds

What it means

default_upload_client builds the fallback reqwest Client used by StorageClient::new via xai_grok_extra_ca::build_reqwest_client and .expect()s success. Build failure usually means TLS/crypto backend initialization or bundled extra root certificate loading failed, so the crate treats it as unrecoverable for the default path.

Source

Thrown at crates/codegen/xai-file-utils/src/storage_client.rs:430

    /// deployment-key path supplies); falls back to the user token otherwise.
    #[test]
    fn wire_bearer_prefers_deployment_key_then_falls_back_to_user_token() {
        let mut deployment = StaticGrokAuth::new(Some(String::new()));
        deployment.deployment_key = Some("deploy-key".to_string());
        assert_eq!(deployment.wire_bearer().as_deref(), Some("deploy-key"));

        let oauth = StaticGrokAuth::new(Some("oauth-token".to_string()));
        assert_eq!(oauth.wire_bearer().as_deref(), Some("oauth-token"));
    }
}

/// Default reqwest client used by `StorageClient::new`. Plain defaults --
/// production callers should instead pass a tuned client (e.g. shell's
/// `crate::http::shared_upload_client()`) to `with_provider`.
fn default_upload_client() -> Client {
    #[expect(clippy::expect_used)]
    xai_grok_extra_ca::build_reqwest_client(|builder| builder)
        .expect("default reqwest client builds")
}

/// Client for uploading files to GCS via cli-chat-proxy.
#[derive(Clone)]
pub struct StorageClient {
    http_client: reqwest_middleware::ClientWithMiddleware,
    /// Plain `reqwest::Client` for requests that must NOT go through the
    /// auth middleware (direct GCS uploads via signed URLs, signed-URL
    /// downloads, etc.).
    raw_http_client: Client,
    /// Base URL for the proxy (e.g., "https://cli-chat-proxy.grok.com/v1")
    base_url: String,
    /// Retry configuration for handling transient failures (especially 429 errors)
    retry_config: RetryConfig,
    /// Optional callback invoked on every 401 so the embedding application
    /// can record auth-attribution telemetry. Shell installs a bridge here;
    /// bins/tests typically leave it `None`.
    attribution: Option<Arc<dyn Auth401AttributionCallback>>,

View on GitHub (pinned to bc7f02eddd)

Solutions

1. Bypass the default path: construct a tuned Client yourself and pass it via StorageClient::with_provider (as production shells do with http::shared_upload_client())
2. Verify xai-grok-extra-ca and rustls/aws-lc-rs feature flags are consistent across the workspace
3. Check that process-level rustls crypto provider installation (rustls::crypto::CryptoProvider::install_default) is not conflicting
4. Reproduce with a minimal binary calling build_reqwest_client directly to isolate TLS init

Example fix

// before
let client = StorageClient::new(endpoint)?; // may panic building default client
// after
let http = xai_grok_extra_ca::build_reqwest_client(|b| b)
    .context("building upload HTTP client")?;
let client = StorageClient::with_provider(endpoint, http);

let client = xai_grok_extra_ca::build_reqwest_client(|b| b)
    .map_err(|e| anyhow!("upload TLS stack unavailable: {e}"))?;

null

let client = match xai_grok_extra_ca::build_reqwest_client(|b| b) {
    Ok(c) => c,
    Err(e) => return Err(anyhow!("cannot build upload client: {e}")),
};
let storage = StorageClient::with_provider(endpoint, client);

When it happens

Trigger: Calling StorageClient::new (which invokes default_upload_client) when the rustls/aws-lc-rs crypto provider cannot initialize, the extra root DERs fail to parse/load, or reqwest builder TLS setup fails in the target environment.

Common situations: Missing or mismatched rustls/aws-lc-rs feature flags across the workspace; stripped or unusual deployment images lacking needed crypto material; static musl builds where the TLS provider fails to init; conflicting process-level rustls provider installation.

Related errors

• failed to build shared HTTP client
• failed to build shared upload HTTP client
• hook HTTP client config is valid
• Failed to parse upload response: {}
• Failed to parse part {} response: {}

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/9477392163a76cb6. Report an issue: GitHub.