fix(ws): install a rustls crypto provider so the TLS connect does not panic

[mkzung]

Fixes #57.

connect_async resolves the process-level rustls CryptoProvider from crate features, which panics when more than one provider is present in the dependency graph. That is the default situation here, aws-lc-rs and ring are both in Cargo.lock already, so the first TLS connect panics.

The panic happens inside the detached tokio::spawn in ConnectionManager::new, and its JoinHandle is dropped, so nothing surfaces. The manager keeps reporting the last state it reached, Connecting, and every subscription stream hangs with no error and no data.

Two changes:

ensure_crypto_provider installs a default provider if the process does not already have one, so the ambiguity never comes up. An application that has installed its own provider is left alone, I checked that by installing ring from the test app first and confirming the guard steps aside.

The connection loop is wrapped in catch_unwind and the connection is reported as Disconnected if it panics. Without that, any panic in that loop is swallowed and becomes a silent hang, which is what made this one hard to see.

Against a live market, before:

thread 'tokio-rt-worker' panicked at rustls-0.23.38/src/crypto/mod.rs:249
state = Connecting
NO DATA in 12s

and after:

state = Connected { .. }
GOT BOOK SNAPSHOT: bids=56 asks=82

REST is not affected. reqwest uses the same rustls version but selects a provider explicitly, and I confirmed it completes the handshake in the same process where tungstenite panics. So this only needs fixing on the websocket path. ConnectionManager is the only place the SDK opens a TLS connection, so the one fix covers both the clob ws client and rtds.

cargo test --features clob,ws,tracing passes, 388 tests, no failures. cargo fmt --check is clean and clippy reports the same findings as on main.

Two things I ran into while reproducing this, both separate from the fix and not in this PR:

cargo test --features clob,ws does not run any tests at all. It fails to build nine of the examples, because they import tracing but their required-features does not include it (error[E0432]: unresolved import tracing). It fails the same way on main, so it is not from this change, but it does mean that feature combination has no working test command right now. The affected examples are async, authenticated, aws_authenticated, builder_authenticated, websocket_orderbook, websocket_user, websocket_unsubscribe, rfq_quotes and rfq_requests.

That is also why the repro command quoted in the issue, cargo run --example websocket_orderbook --features clob,ws, does not compile. Adding tracing to the feature list is the workaround.

Happy to send a follow-up for the required-features gap if you want it.

I used an AI assistant while working on this. I built and ran everything myself, including the live-market check above, and I understand the change.

---

Note

Medium Risk
Touches TLS/crypto initialization for all WebSocket and RTDS connections; behavior is narrowly scoped but incorrect provider choice could affect handshake compatibility in edge deployments.

Overview
Fixes WebSocket TLS setup when the process has multiple rustls crypto providers in the dependency graph (e.g. aws-lc-rs and ring), which previously caused connect_async to panic on first connect.

Adds ensure_crypto_provider, called when creating a ConnectionManager, to install aws-lc-rs as the default only if none is set yet—apps that already chose a provider are unchanged. rustls is wired in as an optional dependency for the ws and rtds features.

Wraps the spawned connection loop in catch_unwind so a panic in that detached task sets state to Disconnected (and logs with tracing when enabled) instead of leaving clients stuck in Connecting with no data or error.

Includes a unit test that ensure_crypto_provider leaves a default provider installed.

^{Reviewed by Cursor Bugbot for commit 67e8a4c. Bugbot is set up for automated code reviews on this repo. Configure here.}