opencode-immune 1.0.37 → 1.0.39

package/dist/plugin.js

@@ -11,7 +11,7 @@ const child_process_1 = require("child_process");
 // ═══════════════════════════════════════════════════════════════════════════════
 // PLUGIN VERSION CHECK
 // ═══════════════════════════════════════════════════════════════════════════════
-const PLUGIN_VERSION = "1.0.37";
+const PLUGIN_VERSION = "1.0.39";
 const PLUGIN_PACKAGE_NAME = "opencode-immune";
 /**
  * Read plugin version from package.json at runtime.
@@ -93,11 +93,11 @@ const ULTRAWORK_AGENT = "0-ultrawork";
 const MANAGED_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const RATE_LIMIT_FALLBACK_MODEL = {
     providerID: "externcash",
-    modelID: "gpt-5.4",
+    modelID: "gpt-5.5",
 };
 const CHILD_SESSION_FALLBACK_MODEL = {
     providerID: "externcash",
-    modelID: "gpt-5.4",
+    modelID: "gpt-5.5",
 };
 function isManagedUltraworkSession(state, sessionID) {
     return !!sessionID && state.managedUltraworkSessions.has(sessionID);
@@ -294,6 +294,13 @@ function isRetryableApiError(error) {
         message.includes("timeout") ||
         message.includes("sse read") ||
         message.includes("stream error") ||
+        // Certificate/TLS provider failures must pass this primary retry gate
+        // before the managed-session fallback model branch can run.
+        message.includes("unknown certificate verification error") ||
+        message.includes("certificate has expired") ||
+        message.includes("certificate verification") ||
+        message.includes("tls") ||
+        message.includes("ssl") ||
         message.includes("connection reset") ||
         message.includes("socket hang up") ||
         message.includes("aborted")) {
@@ -323,6 +330,26 @@ function isRateLimitApiError(error) {
     const type = `${maybeError.data?.type ?? ""}`.toLowerCase();
     return ((type.includes("rate_limit") || message.includes("too many requests") || message.includes("rate limit")));
 }
+function isCertificateApiError(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const maybeError = error;
+    const message = `${maybeError.message ?? ""} ${maybeError.data?.message ?? ""}`.toLowerCase();
+    const code = `${maybeError.code ?? ""} ${maybeError.data?.code ?? ""}`.toLowerCase();
+    const type = `${maybeError.data?.type ?? ""}`.toLowerCase();
+    return (message.includes("unknown certificate verification error") ||
+        message.includes("certificate has expired") ||
+        message.includes("certificate verification") ||
+        message.includes("tls") ||
+        message.includes("ssl") ||
+        code.includes("cert_has_expired") ||
+        code.includes("unable_to_verify_leaf_signature") ||
+        code.includes("self_signed_cert") ||
+        code.includes("tls") ||
+        type.includes("certificate") ||
+        type.includes("tls") ||
+        type.includes("ssl"));
+}
 async function setSessionFallbackModel(state, sessionID, model) {
     const existing = state.managedUltraworkSessions.get(sessionID);
     if (!existing)
@@ -1264,16 +1291,17 @@ function createEventHandler(state) {
             if (count < MAX_RETRIES) {
                 const delay = Math.min(BASE_DELAY_MS * Math.pow(2, count), MAX_DELAY_MS);
                 state.sessionErrorRetryCount.set(sessionID, count + 1);
-                // Pin fallback model: for child sessions always, for root on rate-limit
+                // Pin fallback model: for child sessions always, for root provider-level failures.
                 if (isChild) {
                     await setSessionFallbackModel(state, sessionID, CHILD_SESSION_FALLBACK_MODEL);
-                    const errorType = isModelAccessError(error) ? "model access error" : isRateLimitApiError(error) ? "rate limit" : "retryable error";
+                    const errorType = isModelAccessError(error) ? "model access error" : isRateLimitApiError(error) ? "rate limit" : isCertificateApiError(error) ? "certificate error" : "retryable error";
                     console.log(`[opencode-immune] Child session ${sessionID}: ${errorType} detected. ` +
                         `Retry will use fallback model ${CHILD_SESSION_FALLBACK_MODEL.providerID}/${CHILD_SESSION_FALLBACK_MODEL.modelID}.`);
                 }
-                else if (isRoot && isRateLimitApiError(error)) {
+                else if (isRoot && (isRateLimitApiError(error) || isCertificateApiError(error))) {
                     await setSessionFallbackModel(state, sessionID, RATE_LIMIT_FALLBACK_MODEL);
-                    console.log(`[opencode-immune] Rate limit detected for root session ${sessionID}. ` +
+                    const errorType = isCertificateApiError(error) ? "certificate error" : "rate limit";
+                    console.log(`[opencode-immune] ${errorType} detected for root session ${sessionID}. ` +
                         `Retry will use fallback model ${RATE_LIMIT_FALLBACK_MODEL.providerID}/${RATE_LIMIT_FALLBACK_MODEL.modelID}.`);
                 }
                 const scheduled = scheduleManagedSessionRetry(state, sessionID, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-immune",
-  "version": "1.0.37",
+  "version": "1.0.39",
   "description": "OpenCode plugin: session recovery, auto-retry, multi-cycle automation, context monitoring",
   "exports": {
     "./server": "./dist/plugin.js"