No retry on transient TLS errors: "unknown certificate verification error" #43864

Description

Title: No retry on transient TLS errors: "unknown certificate verification error"

Environment: opencode 1.18.20 (linux-x64), provider zai-coding-plan, endpoint api.z.ai

Problem: When the TCP connection to the provider is reset mid-TLS-handshake (degraded route, ~20% packet loss measured with curl to the same endpoint), Bun surfaces Error: unknown certificate verification error from doStream. None of RETRYABLE_MESSAGE_PATTERNS in packages/opencode/src/session/retry.ts match this message, so opencode aborts the agent run instead of retrying. 45 occurrences in my logs over 2 weeks.

Fix: PR adds TLS handshake/certificate verification patterns to the retryable list — these are transport-level transient failures, same class as econnreset/socket hang up

Plugins

No plugins. Custom provider config only: zai-coding-plan (z.ai endpoint) in ~/.config/opencode/opencode.json

OpenCode version

1.18.20

Steps to reproduce

1. Configure the zai-coding-plan provider (endpoint https://api.z.ai)
2. From a network with a degraded route to api.z.ai, run any prompt
3. When the TCP connection is reset mid-TLS-handshake, the run fails immediately with
   Error: unknown certificate verification error — no retry attempt is shown

Route degradation is verifiable outside opencode:
for i in $(seq 1 15); do curl -sS -o /dev/null -w "%{http_code}\n" --max-time 10 https://api.z.ai/api/coding/paas/v4/models; done
→ ~3/15 requests fail with "Connection timed out", while
openssl s_client -connect api.z.ai:443 verifies the certificate OK every time —
i.e. the cert is valid, the transport is flaky.

Screenshot and/or share link

No response

Operating System

Ubuntu 24.04.3 LTS (Linux 7.0.0-29-generic, x64)

Terminal

kitty / zsh (TUI)