fix(web-search): release unused OpenAI probe leases

src/server/responses/core.ts

@@ -6300,6 +6300,10 @@ async function handleResponsesInner(
             const result = checkOutboundBodySize(continuationBody, config.maxUpstreamBodyBytes);
             return result.admitted ? undefined : describeOutboundBodyRefusal(result);
           },
+          // Resolution can acquire the account's sole cooldown-recovery probe before the routed
+          // provider reveals whether it will request search. Hand an unused lease back on every
+          // terminal path; after an executed search, the outcome recorder has already settled it.
+          onFinalize: () => releaseCodexAuthContextProbeLease(openAiSidecar?.authContext),
           signal: upstream.signal,
         })
         : upstreamResponse.body;

src/web-search/passthrough-bridge.ts

@@ -283,6 +283,8 @@ export interface PassthroughWebSearchBridgeStreamOptions {
    * message when the extended body may not be sent, or undefined when it is admitted.
    */
   checkOutboundBody?: (body: string) => string | undefined;
+  /** Releases request-scoped resources when the stream completes, fails, or is cancelled. */
+  onFinalize?: () => void;
   signal?: AbortSignal;
 }
 
@@ -964,22 +966,30 @@ export function createPassthroughWebSearchBridgeStream(
   const aborted = (): boolean => cancelled || options.signal?.aborted === true;
   const iterator = bridgeStreamBlocks(options, aborted)[Symbol.asyncIterator]();
   const encoder = new TextEncoder();
+  let finalized = false;
+  const finalize = (): void => {
+    if (finalized) return;
+    finalized = true;
+    options.onFinalize?.();
+  };
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
       try {
         const next = await iterator.next();
         if (next.done) {
+          finalize();
           controller.close();
           return;
         }
         controller.enqueue(encoder.encode(next.value));
       } catch (error) {
+        finalize();
         controller.error(error);
       }
     },
     cancel(reason) {
       cancelled = true;
-      void iterator.return?.(reason);
+      void iterator.return?.(reason).finally(finalize);
     },
   });
 }

structure/runtime.md

@@ -244,7 +244,9 @@ on the planned search endpoint. `openai`, `anthropic`, `xai`, `gemini`, and `exa
 sidecar executor and that executor's own credential; a missing credential leaves the bridge
 disarmed rather than falling through to another paid search. A leg that mixes an intercepted
 `web_search` call with another client-executed tool still fails closed. Assistant text is not
-treated as a search instruction.
+treated as a search instruction. The bridge finalizes request-scoped OpenAI sidecar authority on
+completion, failure, and client cancellation, returning any recovery probe lease when no search
+request consumed it.
 
 ## Remote Hub hardening ownership
 

tests/web-search/web-search-passthrough-bridge.test.ts

@@ -400,6 +400,7 @@ describe("the bridged client stream", () => {
 
   test("a turn with no search is relayed untouched and never re-sends", async () => {
     let sends = 0;
+    let finalizations = 0;
     const stream = createPassthroughWebSearchBridgeStream({
       plan,
       firstLeg: streamFromText(answerLeg()),
@@ -411,6 +412,7 @@ describe("the bridged client stream", () => {
       execute: async () => {
         throw new Error("must not execute a search for a turn that did not ask for one");
       },
+      onFinalize: () => { finalizations += 1; },
     });
 
     const body = await new Response(stream).text();
@@ -419,6 +421,7 @@ describe("the bridged client stream", () => {
     expect(body).toContain("response.completed");
     expect(body).toContain("The current release is 2.50.0.");
     expect(body.trimEnd().endsWith("data: [DONE]")).toBe(true);
+    expect(finalizations).toBe(1);
   });
 
   test("a search mixed with another client tool call fails closed instead of dropping it", async () => {
@@ -657,7 +660,7 @@ describe("the bridged client stream", () => {
   test("a cancelled client stream bills no further search and sends no continuation", async () => {
     let sends = 0;
     let executes = 0;
-    const controller = new AbortController();
+    let finalizations = 0;
     const stream = createPassthroughWebSearchBridgeStream({
       plan,
       firstLeg: streamFromText(searchLeg()),
@@ -672,13 +675,13 @@ describe("the bridged client stream", () => {
         executes += 1;
         return { text: "a result", sources: [] };
       },
-      signal: controller.signal,
+      onFinalize: () => { finalizations += 1; },
     });
 
-    controller.abort();
-    await new Response(stream).text();
+    await stream.getReader().cancel("client disconnected");
     expect(executes).toBe(0);
     expect(sends).toBe(0);
+    expect(finalizations).toBe(1);
   });