fix(responses): repair terminal-less bridged search legs

[luvs01]

Motivation

• A composition change moved the web-search bridge to wrap the raw upstream before terminal repair, which prevented terminal repair from seeing a complete but terminal-less first-leg web_search lifecycle and caused some turns to stall indefinitely.
• The intent is to preserve request liveness when an upstream emits a complete intercepted web_search call but does not emit a terminal or close the leg.

Description

• Reordered the passthrough composition in src/server/responses/core.ts so terminal repair is applied to the raw upstream first and the resulting repaired stream is passed as the firstLeg to createPassthroughWebSearchBridgeStream.
• Updated the source-oracle test tests/responses/passthrough-abort.test.ts to assert the composition order and that the bridge receives the repaired stream as its firstLeg.
• Preserved existing bridge continuation behavior, outbound-size checks, and all downstream invariants while ensuring terminal repair can arm its grace timer when appropriate.

Testing

• Ran the focused test bun test tests/responses/passthrough-abort.test.ts, which passed (24 tests, 0 failures).
• Ran bun run typecheck, which succeeded.
• Attempted the full test suite with bun run test; focused changes passed but the full-suite run encountered unrelated, environment-sensitive failures and panics in other test areas (combo-management / codex-shim) that prevented a complete parallel run; these failures are not related to the patched changes.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8bdffea8-b9c6-4a34-ae73-4bbb873a6812

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T12:12:53.362413Z	d7dce5a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d7dce5ac40

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devin-ai-integration]

Merged dev (53e3164) to resolve the conflicts and the Analyze (rust) CodeQL failure — the branch predated the desktop/native Rust code on dev, so CodeQL exited 32 ("could not process any code written in Rust") on every push.

The dev-side src/server/responses/core.ts split moved the passthrough composition into src/server/responses/passthrough-delivery.ts; the PR's reorder (terminal repair wraps the raw upstream first, repaired stream becomes the bridge's firstLeg) was re-applied there, and the source-oracle assertions in tests/responses/passthrough-abort.test.ts now track the new composition order against passthrough-delivery.ts.

Verified locally: bun test tests/responses/passthrough-abort.test.ts 24/24, bun run typecheck clean, and bun test tests/responses tests/web-search failure set identical to pristine dev (55 environmental ws-steering fixture timeouts that also fail on this Linux box without the change).

Written by Devin

[devin-ai-integration]

Addressed in b1044e7: tests/web-search/web-search-passthrough-bridge.test.ts now includes "a complete but terminal-less leg still repairs, on the first leg AND the continuation" — it drives a completed-but-never-closing web_search first leg through handleResponses with an injected ManualScheduler, asserts no search runs before the grace window fires, advances the scheduler, and verifies the Exa search executes and the continuation request is dispatched. The same test also covers the terminal-less continuation leg end-to-end.

[luvs01]

Consolidated into lidge-jun#5562 as a single related-function aggregate.

Source head: e272364c9a5fd8ab098a5f372119aa38ab3b2299. Replacement head: 6b122cd2f024fb56f25667dad235575b5c50f001.

The final source net change was compared semantically with the existing first-leg and continuation repair carried from upstream lidge-jun#5365, including the module-split merge resolution; production repair was not duplicated. The distinct b1044e7 outer handleResponses regression and both structure-document updates are preserved in 973a4ac with matching path-restricted patch ID and author/date. The aggregate's complete final eight-file scope passed 199/199 tests with 976 assertions, retaining both terminal-less legs and the added replay-isolation coupling. Updated-head hosted CI and security review remain pending on the draft replacement.

Closing this duplicate standalone review entry as part of the requested consolidation after verifying coverage. This is not a merge or release claim; remaining integration checks and reviews are tracked on the replacement. Original branches are retained.