fix(rust): take fantoccini without default features to drop OpenSSL from consumers

[konard]

Summary

browser-commander took fantoccini with default features, and fantoccini's default is native-tls = ["hyper-tls", "openssl"]. Every consumer therefore inherited openssl-sys, and the crate stopped building on any image that has a Rust toolchain but no pkg-config and no OpenSSL headers.

Fixes #77.

Change

fantoccini = { version = "0.21", default-features = false, features = ["rustls-tls"] }

plus an opt-in escape hatch for consumers that want the system TLS stack:

[features]
default = []
native-tls = ["fantoccini/native-tls"]

chromiumoxide was already taken without a TLS stack, so nothing else needed to change.

Reproduction (before the fix)

$ cargo tree -i openssl-sys
openssl-sys v0.9.111
├── native-tls v0.2.14
│   ├── hyper-tls v0.6.0
│   │   └── fantoccini v0.21.5
│   │       └── browser-commander v0.9.0

Verification (after the fix)

• cargo tree -i openssl-sys → error: package ID specification 'openssl-sys' did not match any packages (empty for a default-feature build).
• Acceptance build in a stock container with no apt-get step:

  $ docker run --rm -v "$PWD/rust":/src:ro rust:slim-bookworm sh -c 'cp -r /src /tmp/b && cd /tmp/b && cargo build'
      Compiling hyper-rustls v0.27.9
      Compiling fantoccini v0.21.5
      Compiling browser-commander v0.9.0 (/tmp/b)
      Finished `dev` profile [unoptimized + debuginfo] target(s) in 6m 40s
  

• cargo test --all-features → 166 + 16 tests pass, 0 failures. cargo fmt --check and cargo clippy --all-targets --all-features clean.

Automated tests

• rust/tests/dependency_features.rs — 4 manifest regression tests asserting default-features = false, rustls-tls selected, native-tls not enabled by default, and the native-tls opt-in feature still present. These fail on the pre-fix manifest.
• New no-openssl CI job in .github/workflows/rust.yml: builds inside rust:slim-bookworm with no apt-get install step and fails if cargo tree -i openssl-sys matches anything.

Notes

The WebDriver integration tests (connect_smoke, real_browser_*) are #[ignore]d without a live WebDriver/browser endpoint, so the "HTTPS endpoint under rustls" acceptance item is covered by the compile-and-link check plus the existing suite rather than by a live HTTPS run in this environment.

A minor changelog fragment is included (rust/changelog.d/77.fantoccini-rustls.md) to trigger the release, since the new feature flag and the TLS backend switch are consumer-visible.

[konard]

Working session summary

Done. PR #78 is ready for review, all CI green: #78

Root cause. rust/Cargo.toml took fantoccini = "0.21" with defaults, and fantoccini's default is native-tls = ["hyper-tls", "openssl"]. Confirmed locally before the fix:

openssl-sys v0.9.111
└── native-tls → hyper-tls → fantoccini v0.21.5 → browser-commander

Fix.

• fantoccini = { version = "0.21", default-features = false, features = ["rustls-tls"] }
• Added an opt-in escape hatch: [features] default = [], native-tls = ["fantoccini/native-tls"], documented in the README.

Verified.

• cargo tree -i openssl-sys now reports "did not match any packages" for a default build.
• Acceptance build in a stock rust:slim-bookworm container with no apt-get step finished successfully (the rustls path needs no cmake/pkg-config).
• cargo test --all-features: 182 tests pass; cargo fmt --check and cargo clippy --all-targets --all-features clean.
• Full CI green on the branch, including the new OpenSSL-free Build job.

Regression coverage.

• rust/tests/dependency_features.rs — 4 manifest assertions that fail on the pre-fix manifest.
• New no-openssl CI job that builds inside rust:slim-bookworm and fails if cargo tree -i openssl-sys matches anything. (First run of it failed on set -o pipefail — that container has no bash — fixed in a follow-up commit and now passing.)

Two things worth flagging: the WebDriver integration tests (connect_smoke, real_browser_*) are #[ignore]d without a live WebDriver endpoint, so the "HTTPS under rustls" acceptance item is covered by the compile/link check rather than a live HTTPS request. And --all-features in CI does enable native-tls, which re-adds openssl-sys — that is intentional, and it only compiles OpenSSL on Linux since native-tls uses schannel/Security.framework elsewhere.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost: $2.133385

📊 Context and tokens usage:

• 65.7K / 1M (7%) input tokens, 16.5K / 128K (13%) output tokens

Total: (95 new + 51.9K cache writes + 2.4M cache reads) input tokens, 16.5K output tokens, $2.133385 cost

🤖 Models used:

• Tool: Anthropic Claude Code
• Requested: opus (claude-opus-5)
• Thinking level: off (disabled)
• Model: Claude Opus 5 (claude-opus-5)

📎 Log file uploaded as Gist (1328KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag