[BUG] Claude Code SSE stream repeatedly resets (ECONNRESET) on sustained connections only — local network/security software exhaustively ruled out

24ea7ab5-a1c3-4952-bc26-d274b5af9396.txt

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code's SSE stream (https://api.anthropic.com/v1/code/sessions/<id>/worker/events/stream) and streaming /v1/messages calls repeatedly reset with ECONNRESET every ~1-15 seconds, retrying continuously and eventually falling back to non-streaming mode to complete a turn. This happens on a Windows laptop across every install method tested (native binary, npm-global, WSL2/Linux), every network tested (home Wi-Fi, wired Ethernet, mobile hotspot, with and without VPN), and a brand-new Windows user account with no shared configuration. A packet capture (pktmon) confirms the RST packet that kills each connection is generated by and sent from this machine (Direction Tx) to Anthropic's server — it is not received from the network, ruling out a router/ISP/middlebox cause. Extensive local troubleshooting (detailed below) has ruled out every local software/security/network cause found, yet the reset persists — narrowed specifically to sustained Claude Code streaming connections to Anthropic; generic long-lived Node.js HTTPS streaming to another host, and quick non-streaming Node.js HTTPS requests to api.anthropic.com itself, both complete with zero issues.

What Should Happen?

The SSE/streaming connection to Anthropic should hold for the full duration of a response without being reset, the same way it does from other machines on the identical network and the same way non-streaming requests to the same API already do from this machine.

Error Messages/Logs

SSETransport: Opening https://api.anthropic.com/v1/code/sessions/<id>/worker/events/stream
SSETransport: Connected
[ERROR] SSETransport: Stream read error: The socket connection was closed unexpectedly.
SSETransport: Stream ended, reconnecting
[WARN] Stream connection error (ECONNRESET) — retrying streaming (1/10)
... repeats continuously, often exhausting 10/10 retries, then:
[ERROR] Error streaming, falling back to non-streaming mode: The socket connection was closed unexpectedly.

Steps to Reproduce

1. On the affected Windows machine, run claude --debug and send any prompt that takes roughly 10+ seconds to generate (short prompts usually complete before the reset window is hit).
2. Observe in the debug output that the SSE stream connects, then resets within ~1-15 seconds (ECONNRESET), reconnects, and repeats — sometimes exhausting all 10 retry attempts before falling back to non-streaming mode.
3. To confirm it isn't local network/security software: this reproduces identically after (a) fully removing all AV/VPN software including leftover kernel drivers, verified via netsh wfp show state; (b) disabling Windows Defender's Intrusion Prevention System, Network Protection, real-time/behavior/on-access protection, verified via Get-MpComputerStatus; (c) confirming Windows Firewall drop-logging shows zero drops for Anthropic's IP; (d) disabling VM bridging network drivers (VMware/VirtualBox) on all adapters; (e) testing from a brand-new local Windows user account with no shared config.
4. To confirm it isn't the local network stack in general: run a plain Node.js script holding open a long streaming HTTPS connection to a different host (e.g. https://httpbin.org/drip?duration=15&numbytes=200&delay=1) — completes normally with no reset. Run a plain Node.js https.get/https.request (non-streaming) to api.anthropic.com — also completes normally. Only Claude Code's own SSE/streaming connections to Anthropic fail.
5. (Optional, for maintainers) Packet capture via pktmon during a failure shows the RST packet's source IP is the local machine, sent immediately after the TCP handshake completes — confirming the connection is being torn down by this machine's own stack, not the network.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.227 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_