From 960b2dbd9580ae29af18289a175b3730b9459011 Mon Sep 17 00:00:00 2001
From: Tyler Glowaski <tglowaski419@gmail.com>
Date: Tue, 21 Jul 2026 22:00:11 -0400
Subject: [PATCH] fix(cli): install rustls ring CryptoProvider at startup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The workspace enables more than one rustls crypto backend, so rustls
cannot auto-select a process-level provider. buzz-relay, buzz-admin,
buzz-acp, and buzz-dev-mcp all install the ring provider explicitly,
but buzz-cli never did — any CLI code path that opens a TLS-capable
connection (e.g. agents draft-create) panicked with:

  Could not automatically determine the process-level CryptoProvider
  from Rustls crate features

Install the ring provider at the top of run_from_args, matching the
pattern used by the other workspace binaries.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Cargo.lock                 | 1 +
 crates/buzz-cli/Cargo.toml | 3 +++
 crates/buzz-cli/src/lib.rs | 5 +++++
 3 files changed, 9 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index 0b9e8577ec..eae38064cb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -899,6 +899,7 @@ dependencies = [
  "nostr",
  "rand 0.10.1",
  "reqwest 0.13.4",
+ "rustls",
  "serde",
  "serde_json",
  "sha2 0.11.0",
diff --git a/crates/buzz-cli/Cargo.toml b/crates/buzz-cli/Cargo.toml
index a12260b526..188b8440dd 100644
--- a/crates/buzz-cli/Cargo.toml
+++ b/crates/buzz-cli/Cargo.toml
@@ -19,6 +19,9 @@ path = "src/main.rs"
 # CLI argument parsing — derive macros + env var support (BUZZ_API_TOKEN auto-wired)
 clap = { version = "4", features = ["derive", "env"] }
 
+# Explicit rustls dep so the CLI can install the ring CryptoProvider at startup
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
+
 # HTTP client — async REST calls to the relay
 reqwest = { workspace = true, features = ["json"] }
 
diff --git a/crates/buzz-cli/src/lib.rs b/crates/buzz-cli/src/lib.rs
index d5c6b6f9ab..eac85f04c0 100644
--- a/crates/buzz-cli/src/lib.rs
+++ b/crates/buzz-cli/src/lib.rs
@@ -25,6 +25,11 @@ where
     I: IntoIterator<Item = S>,
     S: Into<std::ffi::OsString> + Clone,
 {
+    // Install the ring CryptoProvider for rustls. The workspace enables more
+    // than one rustls crypto backend, so rustls cannot auto-select a
+    // process-level provider and panics on the first TLS-capable connection
+    // without this.
+    let _ = rustls::crypto::ring::default_provider().install_default();
     let cli = match Cli::try_parse_from(args) {
         Ok(cli) => cli,
         Err(e) => {