fix(review): bound retry session.create, compose BIND fallback, entrypoint comment

- Wrap all 4 retry-path session.create (chat stream/non-stream,
  responses + messages non-stream) in withTimeout so a hung backend
  504s instead of stalling past REQUEST_TIMEOUT_MS; regression test
- Compose BIND_HOST chains OPENCODE_PROXY_BIND_HOST fallback instead
  of shadowing it with a hard default
- Entrypoint wait comment distinguishes fast-refused (~180s, covered
  by start_period 200s) from hung-backend worst case (~630s, wedged)

Author: samson910022

docker-compose.yml

@@ -13,7 +13,7 @@ services:
       - OPENCODE_SERVER_PASSWORD=${OPENCODE_SERVER_PASSWORD:-}
       - OPENCODE_ZEN_API_KEY=${OPENCODE_ZEN_API_KEY:-}
       - API_KEY=${API_KEY:-}
-      - BIND_HOST=${BIND_HOST:-0.0.0.0}
+      - BIND_HOST=${BIND_HOST:-${OPENCODE_PROXY_BIND_HOST:-0.0.0.0}}
       - DISABLE_TOOLS=${DISABLE_TOOLS:-true}
       - OPENCODE_DISABLE_TOOLS=${OPENCODE_DISABLE_TOOLS:-}
       - OPENCODE_USE_ISOLATED_HOME=${OPENCODE_USE_ISOLATED_HOME:-false}

entrypoint.sh

@@ -46,6 +46,11 @@ if [[ "$1" == "opencode" && "$2" == "serve" ]]; then
 
     echo "Waiting for OpenCode Server to become available..."
     # Cold start on small (1GB) hosts can take minutes; do not kill early.
+    # Budget: 90 x 2s sleep ~= 180s when the backend refuses fast (normal
+    # cold start; covered by compose start_period 200s). If the backend
+    # accepts but hangs every probe, each round costs up to curl -m 5 + 2s
+    # sleep (worst case ~630s) — that means the backend itself is wedged,
+    # not slow, and the container will exit 1 so it can be rescheduled.
     MAX_RETRIES=90
     RETRY_DELAY=2
     COUNT=0

src/proxy.js

@@ -1961,7 +1961,8 @@ export function createApp(config) {
                                 } catch (e) {
                                     logDebug('Failed to delete retried session', { sessionId, error: e.message });
                                 }
-                                const retrySessionRes = await client.session.create();
+                                const retrySessionRes = await withTimeout(
+                                    client.session.create(), REQUEST_TIMEOUT_MS, 'create session');
                                 sessionId = retrySessionRes.data?.id;
                                 if (!sessionId) throw new Error('Failed to create OpenCode session for retry');
                                 promptParams.path.id = sessionId;
@@ -2174,7 +2175,8 @@ export function createApp(config) {
                                 } catch (e) {
                                     logDebug('Failed to delete retried session', { sessionId, error: e.message });
                                 }
-                                const retrySessionRes = await client.session.create();
+                                const retrySessionRes = await withTimeout(
+                                    client.session.create(), REQUEST_TIMEOUT_MS, 'create session');
                                 sessionId = retrySessionRes.data?.id;
                                 if (!sessionId) throw new Error('Failed to create OpenCode session for retry');
                                 promptParams.path.id = sessionId;
@@ -3073,7 +3075,8 @@ export function createApp(config) {
                     try { await client.session.delete({ path: { id: sessionId } }); } catch (e) {
                         logDebug('Failed to delete retried session', { sessionId, error: e.message });
                     }
-                    const retrySessionRes = await client.session.create();
+                    const retrySessionRes = await withTimeout(
+                        client.session.create(), REQUEST_TIMEOUT_MS, 'create session');
                     sessionId = retrySessionRes.data?.id;
                     if (!sessionId) throw new Error('Failed to create OpenCode session for retry');
                     promptParams.path.id = sessionId;
@@ -3397,7 +3400,8 @@ export function createApp(config) {
                             }
                             if (attempt > 1) {
                                 try { await client.session.delete({ path: { id: sessionId } }); } catch {}
-                                const r = await client.session.create();
+                                const r = await withTimeout(
+                                    client.session.create(), REQUEST_TIMEOUT_MS, 'create session');
                                 sessionId = r.data?.id;
                                 if (!sessionId) throw new Error('Failed to create OpenCode session for retry');
                                 promptParams.path.id = sessionId;

tests/stream-hardening.test.js

@@ -125,6 +125,31 @@ describe('POST /v1/responses stream hardening', () => {
         expect(res.statusCode).toBe(504);
         expect(JSON.stringify(res.body)).not.toContain('"Object"');
     }, 20000);
+
+    test('hung retry session.create surfaces a 504 instead of stalling', async () => {
+        // Attempt 1 fails transiently (fast backoff via retry-after-ms),
+        // then the retry's session.create hangs: must 504, not stall.
+        sdkMocks.sessionCreate
+            .mockImplementationOnce(async () => ({ data: { id: SESSION_ID } }))
+            .mockImplementationOnce(() => new Promise(() => {}));
+        sdkMocks.sessionPrompt.mockImplementationOnce(async () => {
+            throw {
+                name: 'CreditsError',
+                data: {
+                    message: '429: {"message":"Too many requests","type":"CreditsError"}',
+                    responseHeaders: { 'retry-after-ms': '10' }
+                }
+            };
+        });
+        const started = Date.now();
+        const res = await request(buildApp({ REQUEST_TIMEOUT_MS: 400, RETRY_MAX_RETRIES: 1 }))
+            .post('/v1/responses')
+            .set('Authorization', 'Bearer test-key')
+            .send({ model: 'big-pickle', input: 'hi' });
+        expect(Date.now() - started).toBeLessThan(15000);
+        expect(res.statusCode).toBe(504);
+        expect(JSON.stringify(res.body)).not.toContain('"Object"');
+    }, 20000);
 });
 
 describe('POST /v1/messages stream does not cancel itself', () => {