Desktop 2.1.4 on Windows: ECONNRESET without VPN, works with VPN, curl succeeds #60533

Activity

1. opencodejr commented on Oct 30, 2026

   

   opencodejrBot

   on Oct 30, 2026

   Contributor

   More actions

   Thanks for the detailed report and the curl comparison, which made this easy to place.

   I think this is a duplicate of #60399. It has the same pattern: on Windows, requests to opencode.ai fail with ECONNRESET without a VPN and work with one, while curl on the same machine succeeds. Reports there also say it started on Oct 29–30, without any update. The cause found there is that some ISPs' traffic filtering (DPI) drops or resets the TLS handshake that OpenCode 2.x's bundled runtime sends. That handshake includes a post-quantum key share, which makes it about 1.5 KB, while curl's is much smaller and gets through. So the connection is cut before any HTTP request is sent, which is why the provider config fetch fails as well.

   To check whether it's the same cause on your connection, compare a post-quantum handshake with a classic one to the same host (needs OpenSSL 3.5+):

   openssl s_client -connect opencode.ai:443 -servername opencode.ai -groups X25519MLKEM768 </dev/null
   openssl s_client -connect opencode.ai:443 -servername opencode.ai -groups X25519 </dev/null
   

   If the first one hangs or resets and the second one succeeds, it's the same problem. A browser failing to load opencode.ai without the VPN is another sign. #60399 has detailed measurements and workarounds, such as adding opencode.ai to a DPI-bypass host list. If you post there, please include your ISP and region.

   For more detailed logs, the log files are in %USERPROFILE%\.local\share\opencode\log\. With the CLI you can also run opencode run --print-logs ... to see them live.

   Possible duplicates and related issues, ordered by likelihood:

   • cli: hangs before sending request on networks that drop fragmented TLS ClientHello (post-quantum key share) #60399: same symptoms (fails without VPN, works with VPN, curl works), traced to DPI dropping the large post-quantum TLS handshake
   • ECONNRESET on built-in Zen provider — works with VPN, fails without (same network, no rate-limit JSON) #60422: ECONNRESET on the Zen provider on Windows, works with VPN; same cause
   • cli: 2.2.2 gets ECONNRESET from all opencode.ai models while 1.18.12 and curl work #60518: 2.2.2 gets ECONNRESET from opencode.ai while curl and 1.18.12 (older runtime, smaller handshake) work
   • desktop: intermittent EPROTO TLS handshake on macOS 2.2.0 (provider stream + internal config fetch) #59949: desktop TLS handshake errors on the internal config fetch; related, but on macOS with a different error

   The bot will close this issue as a duplicate in 1 day unless you reply explaining how your problem is different.
2. opencodejr

   added

   pending close

   triaging

   on Oct 30, 2026
3. opencodejr

   closed this as duplicateon Oct 31, 2026
4. opencodejr commented on Oct 31, 2026

   

   opencodejrBot

   on Oct 31, 2026

   Contributor

   More actions

   Closing this as a duplicate of #60399, since there's been no reply showing a difference. The symptoms match: ECONNRESET to opencode.ai without a VPN, it works with one, and curl succeeds. They point to the same cause, ISP filtering that drops the larger post-quantum TLS handshake.

   Please follow #60399 for updates and workarounds. If the openssl check from my earlier comment shows something different on your connection, reply here and we can reopen.