[WRONG BRANCH] fix(web-search): release unused OpenAI probe leases

[luvs01]

Motivation

• The passthrough web-search bridge could resolve an OpenAI sidecar and acquire a quota-recovery probe lease before the routed provider actually executed a search, and in the common no-search or cancellation paths the lease was never released, blocking later recovery probes for the stored account.
• The change ensures request-scoped sidecar authority is finalized on every terminal path so unused probe leases are returned promptly and cooled accounts are not artificially held out of rotation.

Description

• Add an onFinalize?: () => void hook to PassthroughWebSearchBridgeStreamOptions and wire an exactly-once finalize() in createPassthroughWebSearchBridgeStream that runs on normal completion, error, or client cancellation. (src/web-search/passthrough-bridge.ts)
• Pass a finalizer from the Responses handler that calls releaseCodexAuthContextProbeLease(openAiSidecar?.authContext) so any probe lease acquired during early OpenAI-sidecar resolution is returned when no upstream sidecar request occurs. (src/server/responses/core.ts)
• Add focused tests that assert the bridge finalizer runs for the ordinary no-search completion and for an explicit client cancellation. (tests/web-search/web-search-passthrough-bridge.test.ts)
• Update runtime documentation to record the sidecar authority / probe-lease lifecycle invariant. (structure/runtime.md)

Testing

• Ran node_modules/.bin/bun test tests/web-search/web-search-passthrough-bridge.test.ts and the file's suite passed (41 tests, 0 failures).
• Ran node_modules/.bin/bun run typecheck, node_modules/.bin/bun run structure:check, and node_modules/.bin/bun run privacy:scan, all of which succeeded for the change set.
• Ran the repository bun test in this environment; the full suite exercise succeeded for the modified bridge tests but the run exposed unrelated environment-sensitive failures in the Codex shim process-group cleanup tests (external to this change); these are not regressions introduced by this PR.
• git diff --check showed no whitespace or diff issues.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: bcd75dd7-b305-451b-b2aa-867bf458a8a1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T00:58:47.252247Z	de7b4a1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: de7b4a171c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Finalize before waiting for iterator shutdown

When the client cancels while pull() is awaiting an upstream SSE chunk, an async generator's return() waits for the pending reader.read() before entering its finally; chaining finalize to that promise therefore leaves the sole recovery-probe lease held until the upstream produces data or is separately aborted. This is especially visible on the tee relay path, whose inspection branch may continue draining after client disconnection, so subsequent recovery probes remain blocked despite this cancellation fix. Invoke finalize() synchronously in cancel() and then request iterator/reader shutdown independently.

AGENTS.md reference: src/AGENTS.md:L17-L17

Useful? React with 👍 / 👎.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.