Repository navigation
cli: 2.2.2 gets ECONNRESET from all opencode.ai models while 1.18.12 and curl work #60518
Description
Description
Summary
OpenCode 2.2.2 cannot get a response from any opencode.ai model (OpenCode Go and
free models): requests hang ~40 s and fail with Transport: ECONNRESET /
AI.Error: Timed out waiting for response headers. The same API key, machine and
network work with curl, with Node fetch, and with OpenCode 1.18.12.
Environment
- opencode version: 2.2.2 (channel
latest); 1.18.12 installed side by side via npm global - OS: Linux 6.6.87.2-microsoft-standard-WSL2 (x86_64, WSL2)
- Terminal:
TERM=xterm-256color, TERM_PROGRAM/COLORTERM unset - Shell:
/bin/bash - Install/channel:
~/.opencode/bin/opencode(2.2.2, latest),/usr/bin/opencode(1.18.12) - Active plugins:
@dietrichgebert/ponytail; MCPcontext7(remote),codegraph(local)
Reproduction
- Authenticate with a valid OpenCode Go key (
opencode auth login). - In an empty directory run:
opencode run --standalone -m opencode-go/deepseek-v4.1-flash "reply with just: OK" - The run stalls ~40 s, then exits with a transport error. The same happens without
--standalone(shared background service, freshly started after the key was written). - Same for
opencode/deepseek-v4.1-flash-freeand otheropencode-go/*models.
deepseek/deepseek-flashworks in the same setup.
Expected Behavior
The model streams a reply (OK).
Actual Behavior
No model output. CLI prints:
Error: Transport: ECONNRESET: The socket connection was closed unexpectedly.
Server log (~/.local/share/opencode/log/opencode.log) shows no stream providerID=...
line for the run, and then:
level=ERROR message="Failed to drain Session" cause="AI.Error: Timed out waiting for response headers ..."
Frequency: 0/6 successful direct runs (success only twice, while routing through a local
CONNECT proxy). 1.18.12 with the same config/auth: 4/4 successful.
Additional Context
Same key, same host, same moment:
curlPOSThttps://opencode.ai/inference/go/openai/v1/chat/completionswith
Authorization+x-opencode-session+ app-like headers (User-Agent: opencode/latest/2.2.2/cli,
x-opencode-client: cli,x-opencode-project: ...) ->200in 1-3 s, streamed,
body contains"opencode":{"billing_source":"go",...}. Also works forstream:true,
a ~120 KB body, and two parallel requests on the same session id.- Node 20
fetchto the same endpoint ->200. - MCP traffic from the same 2.2.2 process to other Cloudflare-fronted hosts works
(mcp.context7.com->200), so it is not a general outbound-fetch failure. - The 2.2.2 update check also fails for the same reason:
update check failed error="UpgradeError: The operation timed out. (cause: TimeoutError...)". - A local HTTP CONNECT tunnel (
HTTPS_PROXY=http://127.0.0.1:8899) made 2.2.2 answer
OKtwice out of several attempts, which points at the connection from the bundled
client to the gateway rather than at auth or the plan. - Earlier in the same log there was
AI_APICallError: This API key has expired...; the key
was replaced afterwards, and the current key returns200via curl, so that part is resolved. - Environment notes: no global IPv6 address (
curl -6fails in 81 ms, so IPv4 is used),
opencode.airesolves to four Cloudflare IPv4 addresses, no HTTP(S) proxy configured. - Config:
"model": "opencode-go/deepseek-v4.1-flash", only an extraaitunnelprovider block.
Log excerpt (timestamps UTC):
timestamp=2026-10-30T06:47:48.094Z level=INFO run=cd475181 message="location services booted" ...
timestamp=2026-10-30T06:47:49.815Z level=INFO run=cd475181 message="mcp connected" server=context7 tools=2
timestamp=2026-10-30T06:48:32.822Z level=INFO run=cd475181 message="shutdown started" signal=SIGTERM role=cli
(no model request, no stream entry between those lines)
Plugins
No response
OpenCode version
No response
Steps to reproduce
No response
Screenshot
No response
Operating System
No response
Terminal
No response
Activity
opencodejr commentedon Oct 30, 2026
Thanks for the very thorough report. The curl, Node 20 and 1.18.12 comparisons made this easy to place.
I think this is a duplicate of #60399. That issue is also on 2.2.2. Logs stop before any
session/streamline, and the run then fails withECONNRESETor a header timeout againstopencode.ai. curl from the same machine works, and a VPN or proxy works around it. The cause found there is that some networks drop or reset TLS handshakes whose ClientHello carries a post-quantum key share. That makes the ClientHello large enough to be split across two TCP segments. OpenCode 2.x's bundled client sends that larger handshake. curl, Node 20fetchand older clients send a smaller classic one, which would explain why only 2.2.2 fails here, including its update check to the same host.To check whether it's the same cause on your connection, compare a post-quantum handshake with a classic one to the same host (needs OpenSSL 3.5+):
If the first one hangs or resets and the second one succeeds, it's the same problem.
Possible duplicates and related issues, ordered by likelihood:
ECONNRESETbefore any request is sent, while curl works and a VPN fixes it; traced to the network dropping fragmented post-quantum TLS ClientHellos.ECONNRESETon the built-in Zen provider, fixed by a VPN; already marked as a duplicate of cli: hangs before sending request on networks that drop fragmented TLS ClientHello (post-quantum key share) #60399.opencode.aiunreachable from some networks because certain Cloudflare edge IPs get reset (related network-level block, different mechanism).The bot will close this issue as a duplicate in 1 day unless you reply explaining how your problem is different, for example if the classic handshake also fails, or your network isn't the kind of filtered network described in #60399.
Simtel commentedon Oct 30, 2026
1.19.5 - not work
1.19.3 - work
opencodejr commentedon Oct 31, 2026
Closing this as a duplicate of #60399. There's been no reply in the past day saying how this differs. Both reports are on 2.2.2. In both,
opencode.airequests fail withECONNRESETor a header timeout before any request is sent, while curl, Nodefetchand older clients work. The likely cause found there is that some networks drop or reset the larger post-quantum TLS handshake that OpenCode's bundled client sends. Please follow #60399 for updates.If the
openssl s_clientcheck from my earlier comment shows something different, for example the classicX25519handshake fails too, please reply here with the output and we can reopen this.