fix(provider): hint OPENSSL_ia32cap connection failures

packages/opencode/src/provider/error.ts

@@ -59,7 +59,7 @@ const FRIENDLY_GATEWAY_CODES: Record<string, string> = {
 }
 
 function message(providerID: ProviderID, e: APICallError) {
-  return iife(() => {
+  const base = iife(() => {
     // MiMo gateway: relabel known block codes and surface error.param (the real
     // reason often lives there while error.message stays generic). json() returns
     // undefined for non-JSON, so HTML/proxy error pages fall through to the
@@ -107,6 +107,24 @@ function message(providerID: ProviderID, e: APICallError) {
 
     return `${msg}: ${e.responseBody}`
   }).trim()
+  const hint = opensslIa32capHint(e)
+  return hint ? `${base}\n\n${hint}` : base
+}
+
+function errorField(input: unknown, field: string) {
+  if (!input || typeof input !== "object") return ""
+  const value = (input as Record<string, unknown>)[field]
+  return typeof value === "string" ? value : ""
+}
+
+function opensslIa32capHint(e: APICallError) {
+  if (!process.env.OPENSSL_ia32cap) return
+  if (!/connectionrefused|econnrefused/i.test([e.message, errorField(e.cause, "code")].join(" "))) return
+  return [
+    `Detected OPENSSL_ia32cap=${process.env.OPENSSL_ia32cap} in your environment.`,
+    "On Windows, this can trigger a Bun/OpenSSL AES-GCM bug that makes HTTPS requests fail with ConnectionRefused.",
+    "To fix it, delete it and restart your terminal or computer.",
+  ].join(" ")
 }
 
 function json(input: unknown) {

packages/opencode/test/provider/error.test.ts

@@ -7,14 +7,15 @@ const xiaomi = ProviderID.make("xiaomi")
 const mimo = ProviderID.make("mimo")
 const openai = ProviderID.make("openai")
 
-function apiError(opts: { message: string; statusCode?: number; responseBody?: string }) {
+function apiError(opts: { message: string; statusCode?: number; responseBody?: string; cause?: unknown }) {
   return new APICallError({
     message: opts.message,
     url: "https://api.example.com/v1/messages",
     requestBodyValues: {},
     statusCode: opts.statusCode,
     responseHeaders: { "content-type": "application/json" },
     responseBody: opts.responseBody,
+    cause: opts.cause,
     isRetryable: false,
   })
 }
@@ -157,4 +158,27 @@ describe("provider error message", () => {
     })
     expect(parsed.message).toBe("Insufficient account balance")
   })
+
+  test("adds OPENSSL_ia32cap hint for Bun ConnectionRefused failures", () => {
+    const previous = process.env.OPENSSL_ia32cap
+    process.env.OPENSSL_ia32cap = "~0x200000200000000"
+
+    try {
+      const parsed = parseAPICallError({
+        providerID: xiaomi,
+        error: apiError({
+          message: "ConnectionRefused",
+          cause: { code: "ConnectionRefused", path: "https://api.xiaomimimo.com/api/free-ai/bootstrap", errno: 0 },
+        }),
+      })
+
+      expect(parsed.type).toBe("api_error")
+      expect(parsed.message).toContain("OPENSSL_ia32cap")
+      expect(parsed.message).toContain("Bun")
+      expect(parsed.message).toContain("delete it and restart")
+    } finally {
+      if (previous === undefined) delete process.env.OPENSSL_ia32cap
+      else process.env.OPENSSL_ia32cap = previous
+    }
+  })
 })