fix(web-search): consolidate replay isolation and bounded bridge repair

[luvs01]

Summary

Combine #5480 and #5365 with the end-to-end bridge-leg regression and contract updates carried in 973a4ac70281add989e7b6643a08463f25baacce. Preserve all six source commits, their review follow-ups and original attribution.

• Restore a retained search result only under the same principal, conversation, provider, destination, adapter, model and physical credential. Configured API-key principals remain distinct on loopback; keyless loopback keeps its existing shared local principal.
• Rebind the initial request before rebuilding after credential reselection, while refusing continuation dispatch if the already-served binding changes.
• Keep a sidecar's original 429 evidence when Retry-After or cleanup/backoff would outlive the existing deadline.
• Preserve the shadow-helper marker through combo dispatch, using the same provider/model intersection rule at early and late interception.
• Apply terminal repair to the raw first search leg and every successful continuation under the same scheduler, abort and budget contracts. A complete but still-open leg can therefore finish without silently losing the intercepted search lifecycle.

The source production repair already exists in the #5365 carries, so it is not applied twice. Its distinct outer handleResponses regression and both structure-document updates are retained. The additional combined assertion verifies that a result produced by repaired legs remains restricted to its caller/thread/credential scope.

Validation exposed two cleanup boundaries. The key-failover fixture now owns proxy listeners and cancellable requests, waits for the shared listener-stop operation, then drains existing native/config producers and ACL child reaping before removing its home. The initial shared sandbox cleanup carry 421ba780ae is also carried by #5549; this proposal further resolves cleanup dependencies during protected setup and drains native releases before config hardening. Home isolation, guard arming, run-lock admission and ownership-checked stale recovery are preserved. The HTTP fixture uses existing test-only icacls runners to isolate key/pacing behavior from OS permission setup; dedicated ACL tests and real SQLite lease checks remain intact. No production ACL rule, deletion strength, test timeout, skip or size cap is weakened.

Verification

• Head 6ea3a95c212c94103177fd17ffa37b28f05ce843, based on dev a6b54297b03fc218105273887ce147c901848d89. The final follow-up changes only the shared cleanup documentation; all production and test content equals the 199-pass 6b122cd2 tree. Structure checks passed. A virtual merge with ci: consolidate review gates and test cleanup boundaries #5549 head 8dc4050fade83b8cfad76f3ab1ed7946f7dc9cf8 is conflict-free at tree 33cac6e8a3262ed5fe706110d5ce891334c4851e, with both sets of production behavior preserved; this is not a full-suite execution of the virtual union.
• All six source commits match stable patch IDs with authors/dates preserved. The three unique integration-test/document paths match their source patch at carry 973a4ac70281add989e7b6643a08463f25baacce. The existing production-repair equivalence was reviewed separately; path/patch equality is not used as a substitute for that semantic comparison.
• Initial eight-file run: 166 pass / 39 fail. The key-failover fixture showed explicit EBUSY during removal, followed by hook timeouts and spend-owner conflicts; another suite reported an unnamed cleanup hook timeout. These failures are retained in the record, not reclassified as a passing run.
• After the fixture cleanup correction, the complete key-failover file passed 42/42, including the original two failing cases and dispatch-time search-cache rebinding. After the global sandbox correction, cleanup/inline-document/bridge suites passed 88/88. These are separate runs; overlapping earlier results are not summed into a fabricated final-suite total.
• The combined repaired-search scope case passed with 15 assertions, including denial under another principal, thread or credential. Typecheck, structure and whitespace checks passed on the final combined tree; privacy and unchanged-cap ratchet checks passed during preparation. The common cleanup source separately passed its deterministic negative-control regression and guard coverage.
• The required changed-import-graph invocation was attempted once on the preceding integration head 65c3477dd2806b931f43eac35c11cf7af925e763. Bun 1.4.2 selected zero tests despite 24 changed files, including changed test files; the repository guard correctly returned exit 1. The wrapper preserves the requested comparison ref, so ref omission is not supported as a cause. The internal candidate/dependency mapping failure remains unexplained; no timeout, guard or selector was bypassed. Explicit-file checks are separate scoped evidence, not a replacement claim of complete automatic impact coverage.
• The first explicit eight-file fallback then failed 170 pass / 26 fail / one error: timeout left a proxy and request body alive beyond teardown, retaining the old home's spend lease. After fixture ownership/cancellation fixes and deterministic permission preparation, the original eight-file scope passed 199 / 199 tests, 976 assertions, 38.90 seconds at unchanged limits. Three added regressions cover delayed shared stop, ordinary assertion propagation, and actual proxy cancellation followed by acquiring a real SQLite lease for a new home. Final typecheck, structure, privacy and ratchet checks passed; the committed tree equals the tested tree.
• Cross-platform CI run 35743465771 passed on the preceding 65c3477 head. It does not validate the new fixture commit; updated-head hosted checks remain pending.
• Full-suite completion, exact-head cross-platform CI, live-provider acceptance and explicit security review remain outstanding. This is a draft integration proposal, not merge or release readiness.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: Epinephrine luvs01@hanmail.net
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 69 / 80

이 PR은 웹 검색·Responses 쪽에서 따로 열려 있던 고침 두 줄기(#5480 재생 칸 격리·429 데드라인, #5365 그림자 콤보 격리·터미널 없는 검색 다리 수리)를 dev 위에 한 장으로 모은 초안 통합본입니다. 브리지가 대신 돌려 준 검색 결과는 이제 누가·어느 대화·어느 공급자·어댑터·모델·목적지·키인지가 모두 맞을 때만 다시 꺼냅니다. 키를 고른 뒤에는 새 신원으로 먼저 다시 묶고 본문을 다시 만듭니다. 사이드카가 429를 받았을 때 남은 시간보다 긴 대기는 하지 않고, 그 429를 타임아웃으로 바꾸지 않습니다. 그림자 가로채기는 이른 자리와 늦은 자리에서 같은 교차 규칙을 쓰고, 콤보 자식까지 격리 표시를 넘깁니다. 패스스루 브리지는 첫 다리와 이어가기 다리 모두에 터미널 수리를 같은 계약으로 감쌉니다. 테스트 홈을 지울 때는 ACL 자식이 끝날 때까지 기다린 뒤 지우는 정리를 #5549와 같은 순서로 가져왔습니다. base는 dev이고, 작성자도 머지·릴리스 준비 완료라고 쓰지 않았습니다. types.ts·config.ts 분할이나 미리보기 배포 이야기는 없습니다.

라인 - 상태 · #5480 / #5365 — 원본 PR 두 개가 아직 OPEN입니다. 이 브랜치가 그 커밋을 그대로 실은 통합 차량이면, 머지 전에 둘을 무효·중복으로 닫아 이중 머지·이중 리뷰를 막아야 합니다.

라인 - tests/preload.ts / tests/helpers/test-sandbox-cleanup.ts / #5549 — 샌드박스 정리 순서 수정이 #5549와 같은 파일을 건드립니다. 둘 다 dev에 넣으면 충돌하거나 한쪽 커밋이 비게 됩니다. 어느 쪽이 정리 조각을 가져갈지 먼저 정해야 합니다.

라인 - 검증 · changed-import-graph — 작성자가 이 head에서 Bun이 바뀐 파일 24개인데도 테스트를 0개 고르고 guard가 exit 1을 냈다고 적었습니다. 원인 설명이 없고, 파일별 수동 통과로 대신했다고 스스로도 쓰지 않았습니다. 자동 영향 범위 증거가 비어 있습니다.

라인 - 체크리스트 · Security-sensitive — 재생 칸이 주체·대화·자격증명 경계를 다루는데 보안 칸이 비어 있습니다. 루프백은 API 키를 내면 키별 주체, 키 없으면 공유 loopback으로 두는 규칙은 본문·코드가 맞지만, 메인테이너가 한 번 더 보면 좋습니다.

메인테이너의 판단이 필요한 지점

이 PR을 #5480+#5365의 유일한 머지 차량으로 둘지, 아니면 원본을 각각 머지할지. 샌드박스 정리는 #5549에 두고 여기서 빼을지, 여기 carry를 살리고 #5549에서 겹치는 조각을 뺄지. draft를 ready로 올리기 전에 changed-import-graph 실패 원인을 고칠지, 합의한 대체 영향 범위 증거로 넘길지.

너의 추천

방향(재생 칸을 대화·서빙 신원으로 좁히기, 키 교체 후 재바인딩, 데드라인 밖 429 유지, shadow 교차 규칙 통일, 첫·이어가기 다리 터미널 수리, ACL reap 후 정리)은 맞고, #5480·#5365에서 지적했던 구멍도 이 트리에서 메운 상태로 보입니다. draft는 유지한 채 (1) #5480·#5365를 이 PR에 흡수되면 닫고, (2) #5549와 정리 파일 소유권을 한 줄로 정하고, (3) changed-import-graph 또는 합의된 대체 증거를 채운 뒤 Ready로 올리세요. 호스티드 linux 테스트·hygiene는 초록으로 보이니, 그 위에 위 세 가지만 고정하면 됩니다.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Partial landing note: the replay-isolation commits carried from #5480 landed on dev in #5575 (b7351ddef3), rewritten. A caller with no principal now fails closed instead of using a shared loopback principal, and the sidecar keeps one three-send budget across reset and 429 recovery.

Still only in this PR: Cursor combo shadow-call isolation; terminal-less and continuation bridged-leg repair in passthrough-delivery.ts; the test sandbox cleanup and ACL-worker reaping; the key-failover fixture shutdown; and their docs. Rebasing onto dev will conflict in request-prepare.ts, executor.ts, bridge-search-replay-cache.ts, server-key-failover-e2e.test.ts and the replay tests. Take dev's version of the replay parts.

[lidge-jun]

Carried in #5608: seven commits are cherry-picked with authorship kept, plus follow-ups that keep combo shadow interception on the dispatch pick and bind the repaired-leg replay test to a keyed caller. The changes from 76aa665 and 7e826dc are already on dev through b7351dd (#5575). The shared sandbox cleanup from 421ba78 and the helper portion of 6b122cd are carried by #5597, which replaced #5549. The key-failover fixture lifecycle from 6b122cd and the documentation in 6ea3a95 build on that helper and are not carried; they can be re-offered once #5597 lands. Closing as superseded. Thank you @luvs01.