ssl.SSLError during a request is no longer retried since 3.14.1 #3969

Since 3.14.1, an ssl.SSLError raised while reading a response is neither retried nor wrapped in APIConnectionError. It reaches the caller as a bare ssl.SSLError after one attempt. Up to 3.14.0 it was retried like any other connection failure.

This looks like a side effect of #3867 ("preserve application errors"), which narrowed the retry to httpx2.TimeoutException / httpx2.RequestError. The catch is that httpcore2 doesn't map every TLS error to an httpx2 exception: AnyIOStream.read() only maps anyio's BrokenResourceError / ClosedResourceError / EndOfStream, so an ssl.SSLError raised mid-read surfaces unmapped (see pydantic/httpx2#854). Before #3867 the client's broader except caught it and retried. Now it's treated as an application error.

How we hit it: we run an agent through pydantic-ai against OpenRouter, with streamed chat completions from ~10 processes in parallel. Now and then a request fails while reading the response headers:

File ".../httpcore2/_async/http11.py", line 167, in _receive_response_headers
File ".../httpcore2/_backends/anyio.py", line 37, in read
File ".../anyio/streams/tls.py", line 254, in receive
ssl.SSLError: [SSL: SSLV3_ALERT_BAD_RECORD_MAC] ssl/tls alert bad record mac (_ssl.c:2657)

On 3.13 the client logged Encountered exception: SSLError … 2 retries left, and the retry succeeded. On 3.14.1 and later, the request fails on the first attempt. In one run of our eval suite on 3.19.2, 10 TLS errors meant 10 failed agent replies. In a comparable run on 3.13, 5 TLS errors all went through the retry and no reply failed.

Minimal reproduction (no network):

import asyncio, ssl
import httpx2, openai

class BrokenTLS(httpx2.AsyncBaseTransport):
    calls = 0
    async def handle_async_request(self, request):
        BrokenTLS.calls += 1
        raise ssl.SSLError(1, "[SSL: SSLV3_ALERT_BAD_RECORD_MAC] ssl/tls alert bad record mac")

async def main():
    client = openai.AsyncOpenAI(api_key="test", base_url="https://example.invalid/v1",
                                http_client=httpx2.AsyncClient(transport=BrokenTLS()), max_retries=2)
    try:
        await client.chat.completions.create(model="m", messages=[{"role": "user", "content": "hi"}])
    except Exception as e:
        print(f"openai {openai.__version__}: {type(e).__name__} after {BrokenTLS.calls} attempt(s)")

asyncio.run(main())

openai 3.13.0: APIConnectionError after 3 attempt(s)
openai 3.14.0: APIConnectionError after 3 attempt(s)
openai 3.14.1: SSLError after 1 attempt(s)
openai 3.19.2: SSLError after 1 attempt(s)

Expected: a TLS failure is a connection failure. It should be retried and, once retries run out, raised as APIConnectionError, as before 3.14.1. Catching ssl.SSLError alongside request_exceptions() would restore that without undoing the intent of #3867.

Environment: Python 3.13.7, macOS; openai 3.19.2 with pydantic-ai 2.51 (failing), openai 3.13.0 with pydantic-ai 2.49 (retrying); httpx2 / httpcore2 2.12.0, also seen on 2.13.1. For now we've pinned openai 3.13.